@tokenoftrust/cli 1.3.4-rc.3 → 1.3.4-rc.5

package/template/private-app/README.md

@@ -0,0 +1,45 @@
+# my-app
+
+A Storefront Private App, scaffolded by `tot app scaffold`. See
+[the Private Apps devbook](https://github.com/tokenoftrust/storefront/blob/main/docs/private-apps/devbook/private-apps-devbook.md)
+for the full contract this manifest and receiver implement.
+
+## What's here
+
+- **`tot-app.json`** — your app's manifest: identity, scopes, webhook
+  subscriptions, widgets. Validated against
+  [`tot-app.schema.json`](https://github.com/tokenoftrust/storefront/blob/main/docs/private-apps/contract/tot-app.schema.json).
+  Everything here is a PLACEHOLDER — edit `id`, `owner`, `webhooks.endpoint`,
+  and `scopes` for your real app before you install it anywhere.
+- **`fixtures/`** — sample CloudEvents (from `docs/private-apps/contract/examples/`)
+  you can sign and deliver to your own receiver locally, before you have a
+  real install. Add one fixture per topic you subscribe to.
+- **`server.js`** — a minimal Node HTTP receiver for `webhooks.endpoint`. It
+  verifies the RFC 9421 HTTP Message Signature + RFC 9530 Content-Digest on
+  every inbound request before trusting the body — replace the handler logic,
+  keep the verification.
+- **`Dockerfile`** — only relevant if you set `installMode: "hosted"`; ignored
+  for `"external"` apps (the default here).
+- **`.env.example`** — copy to `.env`; no real values are included.
+
+## Local loop (no network, no real ToT account needed)
+
+```
+tot app dev validate            # lint tot-app.json against the contract
+node server.js &                # start the stub receiver
+tot app dev emit order.created  # sign a fixture CloudEvent and POST it in
+tot app dev mint                 # mint a dev widget-launch JWT against an ephemeral key
+```
+
+`tot app dev` generates its own throwaway RS256 keypair per app directory
+(`.tot/dev-keys.json`, gitignored) so signing and verifying works fully
+offline — nothing here is a real ToT-issued credential. Run `tot app dev --help`
+for the full command surface.
+
+## Going live
+
+1. Point `webhooks.endpoint` at your real, publicly reachable HTTPS receiver.
+2. Get your manifest installed for a real `(tenant, env)` — this issues your
+   real client credentials; nothing above touches them.
+3. Swap the dev-only signature verification for the real gateway's published
+   JWKS/signing-key metadata (see the devbook's Signature Verification section).

package/template/private-app/fixtures/order.created.cloudevent.json

@@ -0,0 +1,36 @@
+{
+  "specversion": "1.0",
+  "id": "evt_01J9Z3Q7M2K8V6C4B0N5X7Y2A1",
+  "source": "/tenants/acme/storefront",
+  "type": "com.tokenoftrust.storefront.order.created",
+  "time": "2026-07-21T18:42:07.512Z",
+  "datacontenttype": "application/json",
+  "dataschemaversion": "1",
+  "tenantid": "acme",
+  "appinstallid": "inst_01J9Z2R4H5T3W1P8D6F0K9M2C7",
+  "retrycount": 0,
+  "totrequestid": "req_7f3c9a1e2b4d",
+  "traceparent": "00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01",
+  "data": {
+    "id": "ord_10482",
+    "status": "created",
+    "currency": "USD",
+    "customerHash": "cus_h_9a7f2c4e8b1d6033",
+    "subtotal": 84.0,
+    "total": 91.35,
+    "lineItems": [
+      {
+        "sku": "VAPE-KIT-STARTER",
+        "handle": "starter-kit",
+        "quantity": 1,
+        "lineTotal": 49.0
+      },
+      {
+        "sku": "PODS-MENTHOL-4PK",
+        "handle": "menthol-pods-4pk",
+        "quantity": 1,
+        "lineTotal": 35.0
+      }
+    ]
+  }
+}

package/template/private-app/server.js

@@ -0,0 +1,81 @@
+#!/usr/bin/env node
+/**
+ * Minimal webhook receiver stub for a Storefront Private App. Verifies the
+ * RFC 9421 HTTP Message Signature + RFC 9530 Content-Digest on every inbound
+ * request BEFORE trusting the body — replace the "handle the event" bit
+ * below, keep the verification.
+ *
+ * Trusts the public key `tot app dev` wrote to .tot/dev-keys.json (re-read on
+ * every request, so it always sees the harness's current key). That file is
+ * dev-only scaffolding: your real receiver checks against the platform's
+ * published JWKS/signing-key metadata instead — see the devbook's Signature
+ * Verification section.
+ */
+import { createServer } from "node:http";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { verifyWebhookSignature } from "./lib/private-apps-devkit.mjs";
+
+const PORT = Number(process.env.PORT || 8787);
+const DEV_KEYS_PATH = join(process.cwd(), ".tot", "dev-keys.json");
+
+function loadDevPublicKey() {
+  if (!existsSync(DEV_KEYS_PATH)) return null;
+  const { publicKeyJwk } = JSON.parse(readFileSync(DEV_KEYS_PATH, "utf8"));
+  return crypto.subtle.importKey("jwk", publicKeyJwk, { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" }, false, ["verify"]);
+}
+
+function readBody(req) {
+  return new Promise((resolvePromise, reject) => {
+    const chunks = [];
+    req.on("data", (c) => chunks.push(c));
+    req.on("end", () => resolvePromise(Buffer.concat(chunks).toString("utf8")));
+    req.on("error", reject);
+  });
+}
+
+const server = createServer(async (req, res) => {
+  const requestId = req.headers["tot-request-id"] || "(none)";
+  if (req.method !== "POST") {
+    res.writeHead(405).end();
+    return;
+  }
+
+  const body = await readBody(req);
+  const publicKey = await loadDevPublicKey();
+  if (!publicKey) {
+    console.error(`[${requestId}] no .tot/dev-keys.json — run \`tot app dev emit\` first`);
+    res.writeHead(401, { "content-type": "application/json" }).end(JSON.stringify({ error: "no trusted key on file" }));
+    return;
+  }
+
+  const result = await verifyWebhookSignature({
+    method: req.method,
+    url: `http://${req.headers.host}${req.url}`,
+    body,
+    headers: {
+      "content-digest": req.headers["content-digest"],
+      "signature-input": req.headers["signature-input"],
+      signature: req.headers["signature"],
+    },
+    publicKey,
+  });
+
+  if (!result.ok) {
+    console.error(`[${requestId}] signature verification FAILED: ${result.code} — ${result.reason}`);
+    res.writeHead(401, { "content-type": "application/json" }).end(JSON.stringify(result));
+    return;
+  }
+
+  console.log(`[${requestId}] verified delivery (keyid=${result.keyid}, created=${result.created})`);
+  // ── Handle the event ────────────────────────────────────────────────────
+  const event = JSON.parse(body);
+  console.log(`[${requestId}] ${event.type} for tenant ${event.tenantid}`);
+  // ─────────────────────────────────────────────────────────────────────────
+
+  res.writeHead(200, { "content-type": "application/json" }).end(JSON.stringify({ ok: true }));
+});
+
+server.listen(PORT, () => {
+  console.log(`webhook receiver listening on http://localhost:${PORT} (POST here — see tot-app.json webhooks.endpoint)`);
+});

package/template/private-app/tot-app.json

@@ -0,0 +1,29 @@
+{
+  "contractVersion": "1",
+  "id": "com.example.my-app",
+  "name": "My Example App",
+  "version": "0.1.0",
+  "owner": {
+    "name": "Your Company",
+    "email": "you@example.com",
+    "url": "https://example.com"
+  },
+  "description": "Describe what your app does in one or two sentences.",
+  "installMode": "external",
+  "scopes": [
+    "orders:read:minimal",
+    "orders:webhook"
+  ],
+  "webhooks": {
+    "endpoint": "https://example.com/webhooks/tot",
+    "topics": [
+      "order.created"
+    ],
+    "signatureKeyId": "dev-key-1"
+  },
+  "telemetryMode": "sampled",
+  "retention": {
+    "eventLogDays": 30,
+    "piiRedaction": "default"
+  }
+}

package/template/sample-store/content/chrome.html

@@ -0,0 +1,140 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<link rel="icon" type="image/svg+xml" href="/tenants/sample-store.example/logo.svg">
+<link rel="stylesheet" href="/tenants/sample-store.example/themes/sample.css">
+<link rel="stylesheet" href="/tenants/sample-store.example/pages/mkt.css">
+<!--PAGE_HEAD-->
+</head>
+<body>
+<a class="skip-link" href="#main">Skip to main content</a>
+
+<!-- Top age/nicotine warning bar -->
+<div class="topbar-warning"><p>WARNING: This product contains nicotine. Nicotine is an addictive chemical.</p></div>
+
+<!-- Announcement: scrolling marquee -->
+<div class="announce-marquee" aria-label="Free US shipping on orders over $100">
+  <div class="announce-marquee__track" aria-hidden="true">
+    <span>FREE U.S. Shipping on Orders Over $100!</span><span>FREE U.S. Shipping on Orders Over $100!</span><span>FREE U.S. Shipping on Orders Over $100!</span><span>FREE U.S. Shipping on Orders Over $100!</span>
+    <span>FREE U.S. Shipping on Orders Over $100!</span><span>FREE U.S. Shipping on Orders Over $100!</span><span>FREE U.S. Shipping on Orders Over $100!</span><span>FREE U.S. Shipping on Orders Over $100!</span>
+  </div>
+</div>
+
+<!-- Utility nav -->
+<div class="utility-nav">
+  <div class="container">
+    <ul>
+      <li><a href="/blogs/news">News</a></li>
+      <li><a href="/pages/about-us">About</a></li>
+      <li><a href="/pages/contact-us">Contact</a></li>
+    </ul>
+    <div class="utility-nav__right">
+      <span class="sel">English</span>
+      <span class="sel">United States (USD $)</span>
+    </div>
+  </div>
+</div>
+
+<!-- Header -->
+<header class="site-header">
+  <div class="container header-row">
+    <a class="brand" href="/" aria-label="Sample Vapor Co. home"><img src="/tenants/sample-store.example/logo.svg" alt="Sample Vapor Co." width="240" height="48"></a>
+    <form class="header-search" action="/search" method="get" role="search">
+      <label class="sr-only" for="hdr-q">Search for anything</label>
+      <input id="hdr-q" type="search" name="q" placeholder="Search e-liquids, disposables, hardware" autocomplete="off">
+      <button type="submit" aria-label="Search"><svg viewBox="0 0 24 24"><circle cx="11" cy="11" r="7"/><path d="M21 21l-4.3-4.3"/></svg></button>
+    </form>
+    <div class="header-actions">
+      <a href="/account" aria-label="Account"><svg viewBox="0 0 24 24"><circle cx="12" cy="8" r="4"/><path d="M4 21c0-4.4 3.6-7 8-7s8 2.6 8 7"/></svg></a>
+      <a class="cart" href="/cart" aria-label="Cart"><svg viewBox="0 0 24 24"><path d="M6 6h15l-1.5 9h-12z"/><circle cx="9" cy="20" r="1.4"/><circle cx="18" cy="20" r="1.4"/><path d="M6 6L5 3H2"/></svg><span class="count">0</span></a>
+      <button class="hamburger" id="hamburger" aria-label="Toggle navigation menu" aria-expanded="false" aria-controls="primaryNav"><span></span><span></span><span></span></button>
+    </div>
+  </div>
+  <nav class="primary-nav-bar" aria-label="Primary">
+    <div class="container">
+      <nav class="primary-nav" id="primaryNav">
+        <ul>
+          <li><a href="/collections/e-liquid">E-Liquid<span class="caret">▾</span></a></li>
+          <li><a href="/collections/salt-nic">Salt Nic</a></li>
+          <li><a href="/collections/disposables">Disposables<span class="caret">▾</span></a></li>
+          <li><a href="/collections/hardware">Hardware<span class="caret">▾</span></a></li>
+          <li><a href="/collections/new-arrivals">New Arrivals</a></li>
+          <li><a class="is-flag" href="/collections/clearance">Clearance<span class="new-badge">SALE</span></a></li>
+        </ul>
+      </nav>
+    </div>
+  </nav>
+</header>
+
+<!--PAGE_BODY-->
+
+<!-- Compliance strip -->
+<div class="compliance-strip">
+  <div class="container"><p>WARNING: This product contains nicotine. Nicotine is an addictive chemical.</p></div>
+</div>
+
+<!-- Footer -->
+<footer class="site-footer">
+  <div class="container">
+    <div class="footer-grid">
+      <div class="footer-brand">
+        <img src="/tenants/sample-store.example/logo.svg" alt="Sample Vapor Co." width="240" height="48">
+        <p>A fictional demo store for the Token of Trust local dev loop.<br>Not a real merchant — sample content only.</p>
+      </div>
+      <div class="footer-col">
+        <h4>Shop</h4>
+        <ul>
+          <li><a href="/collections/e-liquid">E-Liquid</a></li>
+          <li><a href="/collections/salt-nic">Salt Nic</a></li>
+          <li><a href="/collections/disposables">Disposables</a></li>
+          <li><a href="/collections/hardware">Hardware</a></li>
+          <li><a href="/collections/clearance">Clearance</a></li>
+        </ul>
+      </div>
+      <div class="footer-col">
+        <h4>Support</h4>
+        <ul>
+          <li><a href="/search">Search</a></li>
+          <li><a href="/pages/about-us">About Us</a></li>
+          <li><a href="/pages/contact-us">Contact Us</a></li>
+          <li><a href="/blogs/news">Blog</a></li>
+        </ul>
+      </div>
+      <div class="footer-col">
+        <h4>Company</h4>
+        <ul>
+          <li><a href="/pages/shipping-returns">Shipping &amp; Returns</a></li>
+          <li><a href="/pages/privacy-policy">Privacy Policy</a></li>
+        </ul>
+        <form class="footer-news" action="/api/newsletter" method="post">
+          <input type="hidden" name="source" value="footer">
+          <label class="sr-only" for="foot-email">Email</label>
+          <input id="foot-email" type="email" name="email" placeholder="Email" required>
+          <button type="submit" aria-label="Subscribe">→</button>
+        </form>
+        <div class="pay-badges" aria-label="Accepted payments">
+          <span>AMEX</span><span>Discover</span><span>Mastercard</span><span>Visa</span><span>PayPal</span>
+        </div>
+      </div>
+    </div>
+    <div class="footer-warning">
+      <p><strong>WARNING:</strong> This product contains nicotine. Nicotine is an addictive chemical. Products intended for adults of legal smoking age (21+) only.</p>
+    </div>
+    <div class="footer-bottom">
+      <p>© Sample Vapor Co. — fictional demo store. All rights reserved.</p>
+      <p>Must be 21 or older to purchase. Not for sale to minors.</p>
+    </div>
+  </div>
+</footer>
+
+<script>
+(function () {
+  var burger = document.getElementById('hamburger');
+  var nav = document.getElementById('primaryNav');
+  if (burger && nav) burger.addEventListener('click', function () { var o = nav.classList.toggle('open'); burger.setAttribute('aria-expanded', o ? 'true' : 'false'); });
+})();
+</script>
+</body>
+</html>

package/template/sample-store/content/chrome.json

@@ -0,0 +1,86 @@
+{
+  "announcement": "FREE U.S. Shipping on Orders Over $100!",
+  "nav": [
+    {
+      "label": "E-Liquid",
+      "href": "/collections/e-liquid",
+      "children": [
+        {
+          "label": "E-Liquid",
+          "href": "/collections/e-liquid"
+        },
+        {
+          "label": "Salt Nic",
+          "href": "/collections/salt-nic"
+        }
+      ]
+    },
+    {
+      "label": "Salt Nic",
+      "href": "/collections/salt-nic"
+    },
+    {
+      "label": "Disposables",
+      "href": "/collections/disposables"
+    },
+    {
+      "label": "About",
+      "href": "/about"
+    }
+  ],
+  "footer": {
+    "tagline": "A fictional demo store for the Token of Trust local dev loop.",
+    "columns": [
+      {
+        "title": "Shop",
+        "links": [
+          {
+            "label": "E-Liquid",
+            "href": "/collections/e-liquid"
+          },
+          {
+            "label": "Salt Nic",
+            "href": "/collections/salt-nic"
+          },
+          {
+            "label": "Disposables",
+            "href": "/collections/disposables"
+          },
+          {
+            "label": "Search",
+            "href": "/search"
+          }
+        ]
+      },
+      {
+        "title": "Company",
+        "links": [
+          {
+            "label": "About",
+            "href": "/about"
+          },
+          {
+            "label": "Shipping & Returns",
+            "href": "/shipping-returns"
+          },
+          {
+            "label": "Privacy",
+            "href": "/privacy"
+          }
+        ]
+      }
+    ],
+    "social": [
+      {
+        "label": "Newsletter",
+        "href": "#newsletter"
+      }
+    ]
+  },
+  "disclaimer": "<p><b>WARNING:</b> This product contains nicotine. Nicotine is an addictive chemical. Products intended for adults of legal smoking age (21+) only.</p>\n<p>This is sample demo content for the Token of Trust local dev loop, not a real merchant. Sample Vapor Co. makes no product claims.</p>",
+  "disclaimers": {
+    "Vape Juice": "<p><b>WARNING:</b> This product contains nicotine. Nicotine is an addictive chemical. Products intended for adults of legal smoking age (21+) only. Sample demo content — not a real product.</p>",
+    "Nicotine Salt": "<p><b>WARNING:</b> This product contains nicotine. Nicotine is an addictive chemical. Nicotine salt e-liquid carries a higher nicotine concentration; use only with low-output devices. Products intended for adults 21+ only. Sample demo content — not a real product.</p>",
+    "Vape Disposable": "<p><b>WARNING:</b> This product contains nicotine. Nicotine is an addictive chemical. Products intended for adults of legal smoking age (21+) only. Sample demo content — not a real product.</p>"
+  }
+}

package/template/sample-store/content/home.html

@@ -0,0 +1,121 @@
+<head>
+<title>Sample Vapor Co. | Local Dev Demo Store</title>
+<meta name="description" content="Sample Vapor Co. is a fictional demo store bundled with the Token of Trust local dev loop. It shows the 21+ age gate and nicotine-warning compliance affordances on non-merchant sample content.">
+<link rel="canonical" href="https://sample-store.example/">
+<meta name="robots" content="noindex,nofollow">
+<meta property="og:type" content="website">
+<meta property="og:site_name" content="Sample Vapor Co.">
+<meta property="og:title" content="Sample Vapor Co. | Local Dev Demo Store">
+<meta property="og:description" content="A fictional demo store showing the 21+ compliance gate and nicotine warnings. Sample content only.">
+<meta property="og:url" content="https://sample-store.example/">
+<link rel="stylesheet" href="/tenants/sample-store.example/pages/home.css">
+</head>
+
+<main id="main">
+  <!-- 1. HERO — two-up -->
+  <section class="hero2" aria-label="Featured">
+    <div class="container">
+      <a class="promo-tile promo-tile--hero" href="/collections/e-liquid" aria-label="Shop the sample e-liquid collection">
+        <div class="promo-tile__copy">
+          <span class="eyebrow">Sample content · 21+ only</span>
+          <h2>Big flavor, no nonsense.</h2>
+          <p>A fictional demo store for the local dev loop.</p>
+          <span class="btn btn-primary">Shop E-Liquid</span>
+        </div>
+      </a>
+      <a class="promo-tile" href="/collections/new-arrivals" aria-label="New arrivals just landed"></a>
+    </div>
+  </section>
+
+  <!-- 2. Promo cards -->
+  <section class="promos" aria-label="Promotions">
+    <div class="container">
+      <a class="promo-card promo-card--blue" href="/collections/new-arrivals"><h3>New Arrivals</h3><p>Fresh juice &amp; hardware just in</p><span class="link">Shop New Arrivals</span></a>
+      <a class="promo-card promo-card--red" href="/collections/clearance"><h3>Clearance</h3><p>Deals while they last</p><span class="link">Shop Clearance</span></a>
+      <a class="promo-card promo-card--blue" href="/collections/disposables" style="background:linear-gradient(160deg,#1b3b64,#2f5a8f)"><h3>Disposables</h3><p>Big puff counts, big flavor</p><span class="link">Shop Disposables</span></a>
+    </div>
+  </section>
+
+  <!-- 3. Categories (icon cards) -->
+  <section class="cats" aria-labelledby="cats-h">
+    <div class="container">
+      <h2 id="cats-h">Categories</h2>
+      <div class="grid">
+        <a class="cat-icon-card" href="/collections/e-liquid"><span class="ico"><svg viewBox="0 0 48 48"><path d="M19 8h10v6l4 6v18a4 4 0 0 1-4 4H19a4 4 0 0 1-4-4V20l4-6z"/><path d="M22 30h4"/></svg></span><span>E-Liquid</span></a>
+        <a class="cat-icon-card" href="/collections/salt-nic"><span class="ico"><svg viewBox="0 0 48 48"><path d="M20 8h8v5l3 5v17a4 4 0 0 1-4 4h-6a4 4 0 0 1-4-4V18l3-5z"/><path d="M23 28h2"/></svg></span><span>Salt Nic</span></a>
+        <a class="cat-icon-card" href="/collections/disposables"><span class="ico"><svg viewBox="0 0 48 48"><rect x="18" y="6" width="12" height="30" rx="3"/><path d="M20 36v4a4 4 0 0 0 8 0v-4"/><path d="M21 12h6"/></svg></span><span>Disposables</span></a>
+        <a class="cat-icon-card" href="/collections/hardware"><span class="ico"><svg viewBox="0 0 48 48"><rect x="16" y="6" width="16" height="36" rx="4"/><rect x="21" y="12" width="6" height="8" rx="1"/><path d="M22 28h4"/></svg></span><span>Hardware</span></a>
+        <a class="cat-icon-card" href="/collections/clearance"><span class="ico"><svg viewBox="0 0 48 48"><path d="M8 24 24 8l16 16-16 16z"/><circle cx="19" cy="19" r="2.5"/></svg></span><span>Clearance</span></a>
+      </div>
+    </div>
+  </section>
+
+  <!-- SHELF: Sample E-Liquid -->
+  <section class="section shelf" aria-labelledby="shelf-eliquid">
+    <div class="container">
+      <div class="sec-head sec-head--between">
+        <div><span class="eyebrow">Shop</span><h2 id="shelf-eliquid">Sample E-Liquid</h2></div>
+        <a class="link-more" href="/collections/e-liquid">View all →</a>
+      </div>
+      <div class="pcarousel">
+        <article class="pcard"><a href="/products/sample-house-blend"><div class="pcard__media"></div><p class="pcard__vendor">Sample Vapor Co.</p><h3 class="pcard__title">House Blend — 120mL</h3><p class="pcard__price">$14.99 <span class="pcard__was">$19.99</span></p></a></article>
+        <article class="pcard"><a href="/products/sample-citrus"><div class="pcard__media"></div><p class="pcard__vendor">Sample Vapor Co.</p><h3 class="pcard__title">Citrus Sample — 120mL</h3><p class="pcard__price">$14.99 <span class="pcard__was">$19.99</span></p></a></article>
+        <article class="pcard"><a href="/products/sample-berry"><div class="pcard__media"></div><p class="pcard__vendor">Sample Vapor Co.</p><h3 class="pcard__title">Berry Sample — 120mL</h3><p class="pcard__price">$14.99 <span class="pcard__was">$19.99</span></p></a></article>
+        <article class="pcard"><a href="/products/sample-menthol"><div class="pcard__media"></div><p class="pcard__vendor">Sample Vapor Co.</p><h3 class="pcard__title">Cool Menthol — 120mL</h3><p class="pcard__price">$14.99 <span class="pcard__was">$19.99</span></p></a></article>
+      </div>
+    </div>
+  </section>
+
+  <!-- SHELF: Sample Salt Nic -->
+  <section class="section shelf" aria-labelledby="shelf-salt">
+    <div class="container">
+      <div class="sec-head sec-head--between">
+        <div><span class="eyebrow">Shop</span><h2 id="shelf-salt">Sample Salt Nic</h2></div>
+        <a class="link-more" href="/collections/salt-nic">View all →</a>
+      </div>
+      <div class="pcarousel">
+        <article class="pcard"><a href="/products/sample-salt-mango"><div class="pcard__media"></div><p class="pcard__vendor">Sample Vapor Co.</p><h3 class="pcard__title">Mango Salt — 30mL</h3><p class="pcard__price">$12.99 <span class="pcard__was">$16.99</span></p></a></article>
+        <article class="pcard"><a href="/products/sample-salt-grape"><div class="pcard__media"></div><p class="pcard__vendor">Sample Vapor Co.</p><h3 class="pcard__title">Grape Salt — 30mL</h3><p class="pcard__price">$12.99 <span class="pcard__was">$16.99</span></p></a></article>
+        <article class="pcard"><a href="/products/sample-salt-mint"><div class="pcard__media"></div><p class="pcard__vendor">Sample Vapor Co.</p><h3 class="pcard__title">Mint Salt — 30mL</h3><p class="pcard__price">$12.99 <span class="pcard__was">$16.99</span></p></a></article>
+        <article class="pcard"><a href="/products/sample-salt-tobacco"><div class="pcard__media"></div><p class="pcard__vendor">Sample Vapor Co.</p><h3 class="pcard__title">Classic Tobacco Salt — 30mL</h3><p class="pcard__price">$12.99 <span class="pcard__was">$16.99</span></p></a></article>
+      </div>
+    </div>
+  </section>
+
+  <!-- Featured Hardware -->
+  <section class="section section--surface" aria-labelledby="feat-hw-h">
+    <div class="container">
+      <div class="sec-head"><span class="eyebrow">Featured Hardware</span><h2 id="feat-hw-h">Sample Pod Systems</h2></div>
+      <a class="spotlight" href="/collections/hardware">
+        <div class="spotlight__media"></div>
+        <div class="spotlight__body">
+          <p class="pcard__vendor">Sample Vapor Co.</p>
+          <h3>Innovation in every draw</h3>
+          <p>This is placeholder demo copy for a fictional hardware line. Swap it out in <code>content/home.html</code> to see your edits hot-reload in the local dev loop.</p>
+          <span class="btn btn-primary">Shop Hardware</span>
+        </div>
+      </a>
+    </div>
+  </section>
+
+  <!-- Ecigs and Vapes Online — story / SEO -->
+  <section class="section section--surface intro" aria-labelledby="story-h">
+    <div class="container">
+      <span class="eyebrow">Sample Vapor Co.</span>
+      <h2 id="story-h">A fictional demo store</h2>
+      <p>Sample Vapor Co. is not a real merchant. It ships with the Token of Trust local dev loop as neutral sample content so you can see the renderer, the shared chrome, and the 21+ age-gate / nicotine-warning compliance affordances without any real store's data. Edit these files under <code>content/</code> and save to watch the page reload.</p>
+    </div>
+  </section>
+
+  <!-- Blog -->
+  <section class="section" aria-labelledby="blog-h">
+    <div class="container">
+      <div class="sec-head sec-head--between"><div><span class="eyebrow">News</span><h2 id="blog-h">From the Blog</h2></div><a class="link-more" href="/blogs/news">Read the blog →</a></div>
+      <div class="bloggrid">
+        <a class="blogcard" href="/blogs/news"><div class="blogcard__media"></div><h3>Sample blog post one</h3><span class="link-more">Read more →</span></a>
+        <a class="blogcard" href="/blogs/news"><div class="blogcard__media"></div><h3>Sample blog post two</h3><span class="link-more">Read more →</span></a>
+        <a class="blogcard" href="/blogs/news"><div class="blogcard__media"></div><h3>Sample blog post three</h3><span class="link-more">Read more →</span></a>
+      </div>
+    </div>
+  </section>
+</main>

package/template/sample-store/content/home.json

@@ -0,0 +1,50 @@
+{
+  "seoTitle": "Sample Vapor Co. — Local Dev Demo Store",
+  "seoDescription": "A fictional demo store bundled with the Token of Trust local dev loop. Shows the 21+ age gate and nicotine warnings on neutral sample content. 21+ only.",
+  "blocks": [
+    {
+      "component": "hero",
+      "eyebrow": "Sample content · 21+ only",
+      "headline": "Big flavor,",
+      "headlineAccent": "no nonsense.",
+      "subhead": "A fictional demo store for the local dev loop. Edit content/ and save to see this page reload. 21+ only.",
+      "ctaLabel": "Shop e-liquids",
+      "ctaHref": "/collections/e-liquid",
+      "featureCollection": "e-liquid"
+    },
+    {
+      "component": "featured_collections",
+      "title": "Start here",
+      "handles": ["e-liquid", "salt-nic", "disposables"]
+    },
+    {
+      "component": "featured_products",
+      "title": "Crowd favorites",
+      "source": "featured",
+      "limit": 4
+    },
+    {
+      "component": "editorial",
+      "eyebrow": "About this demo",
+      "title": "Sample content only",
+      "body_html": "<p>Sample Vapor Co. is not a real merchant. It ships with the local dev loop as neutral placeholder content so you can see the renderer and the 21+ compliance affordances.</p><p>Edit these files and save — the page hot-reloads.</p>",
+      "imageSeed": "sample-store-make",
+      "align": "right",
+      "ctaLabel": "About us",
+      "ctaHref": "/about"
+    },
+    {
+      "component": "featured_products",
+      "title": "Just landed",
+      "source": "newest",
+      "limit": 4
+    },
+    {
+      "component": "newsletter",
+      "title": "New drops & restock alerts",
+      "body": "Sample newsletter block — wire it to your own list when you build a real store.",
+      "placeholder": "you@example.com",
+      "ctaLabel": "Keep me posted"
+    }
+  ]
+}

package/template/sample-store/content/pages/about.json

@@ -0,0 +1,10 @@
+{
+  "slug": "about",
+  "title": "About Sample Vapor Co.",
+  "seoTitle": "About | Sample Vapor Co.",
+  "seoDescription": "Sample Vapor Co. is a fictional demo store bundled with the Token of Trust local dev loop.",
+  "eyebrow": "Sample content",
+  "intro": "Sample Vapor Co. is a fictional demo store — not a real merchant.",
+  "isPolicy": false,
+  "body_html": "<p>Sample Vapor Co. is a fictional store that ships with the Token of Trust local dev loop. It exists so you can see the renderer, the shared chrome, and the 21+ age-gate and nicotine-warning compliance affordances on neutral sample content — without any real merchant's data.</p><h2>Edit and reload</h2><p>Every file under <code>content/</code> is yours to change. Edit this page's copy, save, and watch the local dev server hot-reload it.</p><h2>Build a real store</h2><p>When you're ready, check out your own tenant with the Token of Trust CLI and this sample is replaced by your real content.</p>"
+}

package/template/sample-store/content/pages/privacy.json

@@ -0,0 +1,10 @@
+{
+  "slug": "privacy",
+  "title": "Privacy Policy",
+  "seoTitle": "Privacy Policy | Sample Vapor Co.",
+  "seoDescription": "Sample privacy policy for the fictional Sample Vapor Co. demo store.",
+  "eyebrow": "Sample content",
+  "intro": "This is placeholder policy copy for a fictional demo store.",
+  "isPolicy": true,
+  "body_html": "<p><em>Sample Vapor Co. is a fictional demo store bundled with the Token of Trust local dev loop. The text below is neutral placeholder copy — it is not a real privacy policy and does not describe any real data practices.</em></p><h2>Information we collect</h2><p>A real store's privacy policy would describe the information it collects, such as contact and order details. Replace this copy with your own.</p><h2>How we use information</h2><p>Describe here how your store uses the information it collects, and any third parties involved.</p><h2>Your choices</h2><p>Describe here the choices customers have about their information. Edit this file under <code>content/pages/</code> and save to see it reload.</p>"
+}

package/template/sample-store/content/pages/shipping-returns.json

@@ -0,0 +1,10 @@
+{
+  "slug": "shipping-returns",
+  "title": "Shipping & Returns",
+  "seoTitle": "Shipping & Returns | Sample Vapor Co.",
+  "seoDescription": "Sample shipping and returns copy for the fictional Sample Vapor Co. demo store.",
+  "eyebrow": "Sample content",
+  "intro": "Placeholder shipping & returns copy for a fictional demo store.",
+  "isPolicy": true,
+  "body_html": "<p><em>Sample Vapor Co. is a fictional demo store. The text below is neutral placeholder copy, not a real shipping policy.</em></p><h2>Shipping</h2><p>Age-restricted products require an adult signature (21+) on delivery. Describe your real shipping methods and timelines here.</p><h2>Returns</h2><p>Describe your return policy here. Consumable nicotine products are commonly non-returnable — set your own terms.</p>"
+}