@tokenoftrust/storefront-runner 1.3.2

package/apps/storefront/src/lib/chrome/model.ts

@@ -0,0 +1,244 @@
+/**
+ * Chrome model — typed props for the reusable, tenant-agnostic site-chrome
+ * components (AnnouncementBar, UtilityNav, SiteHeader, NavDropdown/MegaMenu,
+ * SiteFooter). Chrome is a STANDARD component set skinned by theme tokens, never
+ * hand-built per tenant page. A tenant's chrome is data (`chrome.json`) that
+ * populates these shapes; the wrapping mechanism (see lib/rawChrome.ts) surrounds
+ * body-only page fragments with the rendered chrome.
+ */
+
+/** A navigation/footer link. `external` opens off-site; `badge` shows e.g. "NEW". */
+export interface ChromeLink {
+  label: string;
+  href: string;
+  external?: boolean;
+  badge?: string;
+}
+
+/** One column of a mega-menu panel. */
+export interface MegaColumn {
+  title?: string;
+  links: ChromeLink[];
+}
+
+/**
+ * A primary-nav item. A plain link (no children/columns), a single-column
+ * dropdown (`children`), or a multi-column mega-menu (`columns`). `badge` marks
+ * it (e.g. "NEW"); `flag` gives it the emphasized/highlighted treatment.
+ */
+export interface ChromeNavItem {
+  label: string;
+  href: string;
+  badge?: string;
+  flag?: boolean;
+  children?: ChromeLink[];
+  columns?: MegaColumn[];
+}
+
+export interface SocialLink {
+  label: string;
+  href: string;
+  /** Optional inline-SVG path data (single <path d="…">) — no external images. */
+  iconPath?: string;
+}
+
+export interface ChromeLogo {
+  src: string;
+  alt: string;
+  width?: number;
+  height?: number;
+}
+
+/** A marketing conversion CTA (header-actions / footer, non-commerce tenants). */
+export interface ChromeCta {
+  label: string;
+  href: string;
+  variant?: "primary" | "secondary" | "ghost";
+}
+
+export interface FooterColumn {
+  title: string;
+  links: ChromeLink[];
+}
+
+export interface FooterNewsletter {
+  title?: string;
+  body?: string;
+  /** Form action (defaults to /api/newsletter). */
+  action?: string;
+  placeholder?: string;
+  /** Hidden `source` field value (e.g. "footer"). */
+  source?: string;
+  /** When true, render the "I confirm I am 21+" age-attestation checkbox (regulated tenants). */
+  ageAttestation?: boolean;
+}
+
+// ---------------------------------------------------------------------------
+// TenantChrome — the FULL per-tenant chrome config (content only) that drives the
+// canonical RAW chrome wrapper (unit F3, see lib/rawChrome.ts). It is the superset
+// the three vape tenants need: bigd/giant (marquee announce + flat nav + utility
+// social) and PVC (dismissible rotating bar + mega panels + member cue + age gate +
+// trust marks). A tenant authors this as `chrome.json`; the renderer turns it into
+// the wrapper document that the rawMarketingHtml splice pipeline surrounds body-only
+// page fragments with. CONTENT ONLY — every color/space/type comes from theme
+// tokens via the platform-shipped stylesheet (decision raw-chrome-single-stylesheet);
+// this config carries no styling. The same file also feeds SiteChrome (getChrome);
+// the two consumers read overlapping-but-distinct field subsets.
+// ---------------------------------------------------------------------------
+
+/** A brand identity: an image wordmark/logo, OR a text wordmark of styled spans. */
+export interface ChromeBrand {
+  /** Link target (defaults to "/"). */
+  href?: string;
+  /** Accessible name (aria-label / img alt), e.g. "Prime Vapor Club". */
+  label: string;
+  /** Image wordmark. Preferred when present and a valid src. */
+  logo?: ChromeLogo;
+  /**
+   * Text wordmark rendered as inline spans (e.g. PVC's `Prime`/`Vapor`/`Club`),
+   * each span optionally given a class the theme styles. Used when there's no logo
+   * image (placeholder brand — brief §9 Q15).
+   */
+  wordmark?: { text: string; className?: string }[];
+  /** Marks the brand as a stand-in for a pending real logo (adds data-placeholder). */
+  placeholder?: boolean;
+}
+
+/** Header search affordance (progressive GET form). Omit to hide search. */
+export interface ChromeSearch {
+  /** Form action (defaults to "/search"). */
+  action?: string;
+  placeholder?: string;
+  /** sr-only label (defaults to "Search"). */
+  label?: string;
+}
+
+/** The persistent member-price cue for guests (regulated/membership tenants). */
+export interface ChromeMemberCue {
+  label: string;
+  href: string;
+}
+
+/** The thin utility bar above the header: minor links, locale chips, social, cue. */
+export interface ChromeUtilityNav {
+  links?: ChromeLink[];
+  /** Locale/currency chips shown on the right (e.g. "English", "United States (USD $)"). */
+  locale?: string[];
+  social?: SocialLink[];
+  /** Optional right-aligned member-price cue link. */
+  memberCue?: ChromeMemberCue;
+}
+
+/**
+ * Announcement banner. Three variants map to the F2 stylesheet's classes:
+ *   - "marquee": infinite horizontal scroll (bigd/giant `.announce-marquee`);
+ *   - "bar": dismissible + optionally message-rotating promo bar (PVC `.announce-bar`);
+ *   - "solid": a static single-line solid bar (`.announce`).
+ */
+export interface ChromeAnnouncement {
+  variant: "marquee" | "bar" | "solid";
+  /** One or more messages. "bar" rotates through them when >1 and rotateMs set. */
+  messages: string[];
+  /** aria-label for the region (defaults to the first message). */
+  label?: string;
+  /** "bar" only — show a dismiss button (remembered via storageKey). */
+  dismissible?: boolean;
+  /** "bar" only — rotate messages every N ms (needs messages.length > 1). */
+  rotateMs?: number;
+  /** localStorage key remembering a dismissal (defaults to a stable derived key). */
+  storageKey?: string;
+}
+
+/**
+ * 21+ age-gate interstitial config (regulated tenants). The F3 renderer (rawChrome.ts)
+ * embeds this as JSON; the shared behavior JS mounts the gate inside a closed shadow
+ * root — the same tamper-resistance pattern components/islands/IsolatedAgeGate.tsx
+ * uses for component pages (unit C1) — so tenant CSS/JS can't reach the dialog.
+ * Per decision compliance-widgets-platform-owned.
+ */
+export interface ChromeAgeGate {
+  minAge: number;
+  /** localStorage key remembering a pass (defaults to a stable derived key). */
+  storageKey?: string;
+  title?: string;
+  lede?: string;
+  yesLabel?: string;
+  noLabel?: string;
+  denyText?: string;
+  /** Fine-print warning under the actions (e.g. the FDA nicotine line). */
+  fineText?: string;
+  /** Optional styled wordmark above the title (spans, like ChromeBrand.wordmark). */
+  mark?: { text: string; className?: string }[];
+}
+
+/** Footer brand block: identity + tagline/contact + optional inline newsletter. */
+export interface ChromeFooterBrand {
+  logo?: ChromeLogo;
+  wordmark?: { text: string; className?: string }[];
+  /** Tagline / contact HTML-free text (rendered with <br> on newlines). */
+  text?: string;
+}
+
+/** A footer trust mark: a small inline-SVG cue + label (e.g. "Secure checkout"). */
+export interface ChromeTrustMark {
+  /** Inner SVG markup (paths/rects/circles), viewBox 0 0 24 24. */
+  icon: string;
+  label: string;
+}
+
+/** The full footer content. */
+export interface ChromeFooter {
+  brand?: ChromeFooterBrand;
+  columns: FooterColumn[];
+  newsletter?: FooterNewsletter;
+  trustMarks?: ChromeTrustMark[];
+  /** Accepted-payment marks (text tokens, e.g. "VISA"). */
+  payments?: string[];
+  social?: SocialLink[];
+  /** The bold compliance/nicotine warning block. */
+  warning?: string;
+  /** Bottom bar: copyright + a legal note line. */
+  bottom?: { copyright?: string; note?: string };
+}
+
+/** Per-tenant <head> extras the wrapper links (the shared css is ALWAYS linked). */
+export interface ChromeHead {
+  /** Favicon href (image/png). */
+  favicon?: string;
+  /** Tenant theme stylesheet hrefs (token definitions), e.g. the *-navy.css theme. */
+  themeStylesheets?: string[];
+  /** <meta name="theme-color"> — a deliberately brand-fixed surface color. */
+  themeColor?: string;
+}
+
+export interface TenantChrome {
+  /**
+   * OPT-IN: render the canonical shared chrome for this tenant's RAW page
+   * fragments. Absent/false ⇒ the tenant keeps serving its hand-authored
+   * chrome.html (or a full document) unchanged — so a shipped tenant never flips
+   * to shared chrome until it explicitly adopts (units I1/I2/I3). Required so the
+   * cutover of a SHIPPED tenant stays a deliberate, gated step.
+   */
+  sharedChrome?: boolean;
+  /** <html lang> (defaults to "en"). */
+  lang?: string;
+  head?: ChromeHead;
+  /** Skip-link target/label overrides (defaults to "#main" / "Skip to main content"). */
+  skipLink?: { href?: string; label?: string };
+  /** FDA/compliance warning strip at the very top (e.g. the nicotine line). */
+  warningBar?: string;
+  announcement?: ChromeAnnouncement;
+  utilityNav?: ChromeUtilityNav;
+  brand: ChromeBrand;
+  search?: ChromeSearch;
+  /** Header-actions member-price cue (in addition to any utility-nav cue). */
+  memberCue?: ChromeMemberCue;
+  accountHref?: string;
+  cartHref?: string;
+  /** Primary nav — flat links and/or mega panels (ChromeNavItem.columns). */
+  nav: ChromeNavItem[];
+  ageGate?: ChromeAgeGate;
+  /** The compliance strip below the page body (e.g. the nicotine warning). */
+  complianceStrip?: string;
+  footer: ChromeFooter;
+}

package/apps/storefront/src/lib/chrome/parseConfig.ts

@@ -0,0 +1,34 @@
+/**
+ * Parse/validate a tenant's `chrome.json` as a raw-chrome `TenantChrome` config
+ * (unit F3). This is the OPT-IN gate for the canonical shared chrome: it returns a
+ * config ONLY when the tenant has explicitly set `sharedChrome: true` AND supplies
+ * the minimum a wrapper needs (brand + nav + footer). Any other shape — a tenant
+ * that hasn't adopted, or a half-authored file — returns null, so the caller keeps
+ * serving the tenant's hand-authored chrome.html (or falls back cleanly) and a
+ * shipped tenant never flips to shared chrome by accident. Adoption (authoring the
+ * canonical config + removing chrome.html) is the tenant-integration units (I1/I2/I3).
+ */
+import type { TenantChrome } from "./model.js";
+
+function isObject(v: unknown): v is Record<string, unknown> {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+
+/**
+ * Coerce parsed chrome.json into a `TenantChrome`, or null if it isn't an opted-in,
+ * minimally-complete raw-chrome config. Trusts the authored (first-party) field
+ * shapes beyond the required-key check — the renderer is defensive (escapes values,
+ * guards every optional section), so a missing optional degrades rather than breaks.
+ */
+export function parseChromeConfig(raw: unknown): TenantChrome | null {
+  if (!isObject(raw)) return null;
+  // Opt-in switch — absent/false means "not adopted; keep legacy chrome".
+  if (raw.sharedChrome !== true) return null;
+  // Minimum a wrapper needs to render something coherent.
+  const brand = raw.brand;
+  if (!isObject(brand) || typeof brand.label !== "string") return null;
+  if (!Array.isArray(raw.nav)) return null;
+  const footer = raw.footer;
+  if (!isObject(footer) || !Array.isArray(footer.columns)) return null;
+  return raw as unknown as TenantChrome;
+}

package/apps/storefront/src/lib/colors.ts

@@ -0,0 +1,97 @@
+/**
+ * Map human color-option values to swatch fills for product cards.
+ *
+ * Merchants name colors in their own vernacular ("Oatmeal", "Spruce"), not hex.
+ * We resolve a known palette first, fall back to a CSS named color when the
+ * value happens to be one, and otherwise render an "unknown" swatch (neutral
+ * with a slash) rather than guessing wrong. Tenant-agnostic: this is product
+ * data, not theme.
+ */
+
+/** Curated names common to apparel/home catalogs (lowercased keys). */
+const PALETTE: Record<string, string> = {
+  black: "#1a1a1a",
+  charcoal: "#36393b",
+  graphite: "#3a3a3a",
+  slate: "#556770",
+  grey: "#8a8d91",
+  gray: "#8a8d91",
+  silver: "#c7c9cc",
+  white: "#f6f5f1",
+  ivory: "#f3efe4",
+  cream: "#efe9d8",
+  ecru: "#e8e1cd",
+  oatmeal: "#ddd3bf",
+  natural: "#e3d9c2",
+  sand: "#d8c6a3",
+  stone: "#cbbfa9",
+  tan: "#c5a980",
+  camel: "#b48a5e",
+  rust: "#a4512f",
+  terracotta: "#bf6a4a",
+  brick: "#8f4334",
+  olive: "#6f6f3a",
+  forest: "#2f4a36",
+  spruce: "#23413a",
+  sage: "#9aa583",
+  teal: "#2a6f72",
+  navy: "#1f2a44",
+  indigo: "#2c3a63",
+  denim: "#41597d",
+  blue: "#2f5e8f",
+  burgundy: "#5e2230",
+  wine: "#5e2230",
+  plum: "#5a3a55",
+  blush: "#e7c7c0",
+  pink: "#e3a6ad",
+  mustard: "#c79a3a",
+  amber: "#b5612f",
+  brown: "#5f4733",
+  chocolate: "#46342a",
+  khaki: "#9a8b66",
+};
+
+/** CSS named colors we accept as a fallback when not in PALETTE. */
+const CSS_NAMED = new Set([
+  "red", "orange", "yellow", "green", "blue", "purple", "pink", "brown",
+  "black", "white", "gray", "grey", "beige", "ivory", "navy", "teal",
+  "maroon", "olive", "coral", "salmon", "khaki", "tan", "gold",
+]);
+
+export interface Swatch {
+  /** Original option value, e.g. "Oatmeal". */
+  label: string;
+  /** CSS color for the dot, or null when unknown. */
+  fill: string | null;
+}
+
+export function resolveSwatch(value: string): Swatch {
+  const key = value.trim().toLowerCase();
+  if (key in PALETTE) return { label: value, fill: PALETTE[key]! };
+  // Two-word names: try the last token ("Heather Grey" -> "grey").
+  const last = key.split(/\s+/).pop()!;
+  if (last in PALETTE) return { label: value, fill: PALETTE[last]! };
+  if (CSS_NAMED.has(key)) return { label: value, fill: key };
+  if (CSS_NAMED.has(last)) return { label: value, fill: last };
+  return { label: value, fill: null };
+}
+
+/** The product option that holds colors, if any (Color / Colour / Shade). */
+export function colorOptionValues(
+  options: { name: string; values: string[] }[],
+): string[] {
+  const opt = options.find((o) => /colou?r|shade|finish/i.test(o.name));
+  return opt ? opt.values : [];
+}
+
+/** True when a fill is light enough to need a ring so it reads on a light bg. */
+export function isLightFill(fill: string): boolean {
+  const m = /^#([0-9a-f]{6})$/i.exec(fill);
+  if (!m) return false;
+  const n = parseInt(m[1]!, 16);
+  const r = (n >> 16) & 255,
+    g = (n >> 8) & 255,
+    b = n & 255;
+  // Perceived luminance.
+  return 0.2126 * r + 0.7152 * g + 0.0722 * b > 200;
+}

package/apps/storefront/src/lib/commerce/foxyCartSettings.ts

@@ -0,0 +1,253 @@
+/**
+ * FoxyCart settings model — the admin "Cart & Checkout appearance" section.
+ *
+ * Mirrors the settings surface that the **tot-foxycart** service actually manages
+ * (verified against that repo), and defines how each field is PREPOPULATED from
+ * the tenant's theme (the style-guide), OVERRIDDEN, and RESET.
+ *
+ * tot-foxycart's real settings are three groups:
+ *   1. `colors`   — Foxy's native `template_config.colors` (primary/secondary/
+ *                   tertiary + usage). The only named brand-color fields in the
+ *                   Foxy model; documented in tot-foxycart, applied via the theme.
+ *   2. `templates`— per-template-type `contentUrl` pointers (checkout / cart /
+ *                   cart_include[sidecart] / receipt / email), set via
+ *                   `PUT /theme/foxy` then published via `POST /theme/foxy/refresh`.
+ *                   The colors/fonts/logo live INSIDE the hosted template file.
+ *   3. `store`    — storeSubDomain + loader feature toggles (excise tax, age/ID
+ *                   verification). Non-visual; no theme default.
+ *
+ * Prepopulation lands on the parts with a theme default — the brand colors and
+ * the template pointers (defaulted to a ToT-hosted, theme-derived template URL).
+ * The feature toggles are mirrored as plain config (no default → not resettable).
+ *
+ * The ACTUAL persistence — PATCHing Foxy's colors + PUT/refresh of the template
+ * URLs — is the tot-foxycart HTTP seam (`/theme/foxy`), intentionally NOT wired
+ * here; this module is the pure model the admin renders and edits.
+ */
+import type { ResolvedFoxyCommerce, ThemeTokens } from "@tot/public-runtime";
+
+/** Foxy template types (tot-foxycart `TEMPLATE_TYPES`). */
+export type FoxyTemplateType =
+  | "checkout"
+  | "cart"
+  | "cart_include"
+  | "receipt"
+  | "email";
+
+export const FOXY_TEMPLATE_TYPES: readonly FoxyTemplateType[] = [
+  "checkout",
+  "cart",
+  "cart_include",
+  "receipt",
+  "email",
+] as const;
+
+export const FOXY_TEMPLATE_LABELS: Record<FoxyTemplateType, string> = {
+  checkout: "Checkout page",
+  cart: "Full cart page",
+  cart_include: "Sidecart (slide-out)",
+  receipt: "Receipt page",
+  email: "Order email",
+};
+
+/** Foxy native `template_config.colors` — the only named brand-color fields. */
+export interface FoxyBrandColors {
+  primary: string;
+  secondary: string;
+  tertiary: string;
+  /** Foxy's `usage`: how broadly the colors apply. "none" = Foxy default look. */
+  usage: "none" | "all";
+}
+
+/** A per-template-type pointer (mirrors `PUT /theme/foxy`). */
+export interface FoxyTemplatePointer {
+  contentUrl: string;
+  templateSet: string;
+}
+
+/** Store + loader feature config (foxyCartOptions + totOpts). Non-visual. */
+export interface FoxyStoreConfig {
+  storeSubDomain: string;
+  exciseTaxCollectionEnabled: boolean;
+  verificationEnabled: boolean;
+}
+
+/** The full tot-foxycart settings mirror. */
+export interface FoxyCartSettings {
+  colors: FoxyBrandColors;
+  templates: Record<FoxyTemplateType, FoxyTemplatePointer>;
+  store: FoxyStoreConfig;
+}
+
+/** Overrides are a deep-partial of the mirror; anything unset falls back to the
+ *  theme-derived default. Reset === delete the key here. */
+export type FoxyCartSettingsOverrides = {
+  colors?: Partial<FoxyBrandColors>;
+  templates?: Partial<Record<FoxyTemplateType, Partial<FoxyTemplatePointer>>>;
+  store?: Partial<FoxyStoreConfig>;
+};
+
+// ---------------------------------------------------------------------------
+// Prepopulation: theme (style-guide) → FoxyCart settings defaults.
+// ---------------------------------------------------------------------------
+
+export interface DeriveOptions {
+  /**
+   * Absolute origin the ToT-hosted, theme-derived templates are served from —
+   * the tenant's own storefront origin (e.g. `https://sample-store.example`). Templates
+   * live at `${originBase}/foxy-templates/<type>.html`.
+   */
+  originBase: string;
+}
+
+/**
+ * Build the theme-derived DEFAULTS. This is the "prepopulate from the style-guide"
+ * step: brand colors come straight from the theme tokens; each template pointer
+ * defaults to a stable ToT-hosted URL for that tenant's theme-derived template.
+ */
+export function deriveFoxyCartSettings(
+  theme: ThemeTokens,
+  commerce: ResolvedFoxyCommerce | null,
+  opts: DeriveOptions,
+): FoxyCartSettings {
+  const base = opts.originBase.replace(/\/$/, "");
+  const templateUrl = (type: FoxyTemplateType) =>
+    `${base}/foxy-templates/${type}.html`;
+
+  const templates = Object.fromEntries(
+    FOXY_TEMPLATE_TYPES.map((type) => [
+      type,
+      { contentUrl: templateUrl(type), templateSet: "DEFAULT" },
+    ]),
+  ) as Record<FoxyTemplateType, FoxyTemplatePointer>;
+
+  return {
+    colors: {
+      // Foxy primary/secondary/tertiary ← the tenant's brand tokens.
+      primary: theme.color.primary,
+      secondary: theme.color.accent,
+      tertiary: theme.color.sale,
+      usage: "all",
+    },
+    templates,
+    store: {
+      storeSubDomain: commerce?.storeSubDomain ?? "",
+      // Feature toggles have no theme default — start off; not prepopulatable.
+      exciseTaxCollectionEnabled: false,
+      verificationEnabled: false,
+    },
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Resolve with provenance: defaults + overrides → renderable field descriptors.
+// ---------------------------------------------------------------------------
+
+export type FoxyFieldKind = "color" | "url" | "text" | "boolean" | "select";
+export type FoxyFieldGroup = "colors" | "templates" | "store";
+
+/** One renderable settings row: resolved value + provenance + reset affordance. */
+export interface FoxySettingsField {
+  group: FoxyFieldGroup;
+  /** Dot path into FoxyCartSettings, e.g. "colors.primary" / "templates.checkout.contentUrl". */
+  key: string;
+  label: string;
+  kind: FoxyFieldKind;
+  value: string | boolean;
+  /** The theme-derived default; undefined when the field has no theme default. */
+  default?: string | boolean;
+  source: "theme" | "override";
+  /** True when there is a theme default to reset back to. */
+  resettable: boolean;
+  options?: string[];
+  help?: string;
+}
+
+function readPath(obj: unknown, path: string): unknown {
+  return path.split(".").reduce<unknown>((o, k) => {
+    if (o && typeof o === "object" && k in (o as Record<string, unknown>)) {
+      return (o as Record<string, unknown>)[k];
+    }
+    return undefined;
+  }, obj);
+}
+
+/**
+ * Merge defaults + overrides into the flat field list the admin renders. Each
+ * field's `source` is "override" when the overrides object supplies that exact
+ * path, else "theme". `resettable` marks fields with a real theme default (the
+ * visual ones) so the UI can show/hide the "Reset to theme" control.
+ */
+export function buildFoxySettingsFields(
+  defaults: FoxyCartSettings,
+  overrides: FoxyCartSettingsOverrides,
+): FoxySettingsField[] {
+  const field = (
+    group: FoxyFieldGroup,
+    key: string,
+    label: string,
+    kind: FoxyFieldKind,
+    opts: { resettable?: boolean; options?: string[]; help?: string } = {},
+  ): FoxySettingsField => {
+    const def = readPath(defaults, key);
+    const ov = readPath(overrides, key);
+    const overridden = ov !== undefined;
+    const resettable = opts.resettable ?? true;
+    return {
+      group,
+      key,
+      label,
+      kind,
+      value: (overridden ? ov : def) as string | boolean,
+      default: resettable ? (def as string | boolean) : undefined,
+      source: overridden ? "override" : "theme",
+      resettable,
+      options: opts.options,
+      help: opts.help,
+    };
+  };
+
+  const fields: FoxySettingsField[] = [
+    // Group 1 — brand colors (theme-derived; the "make it look bigd" surface).
+    field("colors", "colors.primary", "Primary color", "color", {
+      help: "Checkout/cart primary buttons and accents. From --color-primary.",
+    }),
+    field("colors", "colors.secondary", "Secondary color", "color", {
+      help: "Secondary accents. From --color-accent.",
+    }),
+    field("colors", "colors.tertiary", "Tertiary color", "color", {
+      help: "Sale/clearance accent. From --color-sale.",
+    }),
+    field("colors", "colors.usage", "Apply brand colors", "select", {
+      options: ["all", "none"],
+      help: '"all" applies the brand palette to Foxy; "none" keeps Foxy defaults.',
+    }),
+  ];
+
+  // Group 2 — template pointers (default = ToT-hosted theme-derived template).
+  for (const type of FOXY_TEMPLATE_TYPES) {
+    fields.push(
+      field("templates", `templates.${type}.contentUrl`, FOXY_TEMPLATE_LABELS[type], "url", {
+        help: `Hosted template URL for the ${FOXY_TEMPLATE_LABELS[type].toLowerCase()}. Defaults to the ToT theme-derived template; override with a custom URL.`,
+      }),
+    );
+  }
+
+  // Group 3 — store/feature config (no theme default → not resettable).
+  fields.push(
+    field("store", "store.storeSubDomain", "Foxy store subdomain", "text", {
+      resettable: false,
+      help: "The <sub>.foxycart.com store this tenant checks out through.",
+    }),
+    field("store", "store.exciseTaxCollectionEnabled", "Collect excise tax", "boolean", {
+      resettable: false,
+      help: "tot-foxycart pre-cart excise tax collection.",
+    }),
+    field("store", "store.verificationEnabled", "Age / identity verification", "boolean", {
+      resettable: false,
+      help: "Token of Trust verification at checkout.",
+    }),
+  );
+
+  return fields;
+}