@tokenoftrust/storefront-runner 1.4.2-rc.0 → 2.0.1

package/packages/public-runtime/tests/fixtures/integration/managed-analytics-v1/fake-adapter-catalog.json

@@ -0,0 +1,35 @@
+{
+  "apiVersion": "v1",
+  "requestId": "req_fake_catalog_1",
+  "data": {
+    "items": [
+      {
+        "schemaVersion": 1,
+        "adapterId": "fake.metrics",
+        "adapterVersion": "1.0.0",
+        "displayName": "Fake Metrics",
+        "description": "A deterministic fake catalog adapter for consumers and tests.",
+        "availability": "available",
+        "configuration": [
+          {
+            "key": "datasetId",
+            "label": "Dataset id",
+            "description": "Public identifier for the fake dataset.",
+            "kind": "string",
+            "required": true
+          },
+          {
+            "key": "sampleRate",
+            "label": "Sample rate",
+            "description": "Integer sampling percentage.",
+            "kind": "integer",
+            "required": false
+          }
+        ],
+        "eventTypes": ["storefront.page.viewed.v1"],
+        "consentPurposes": ["analytics"],
+        "collectionOrigins": ["https://collector.invalid"]
+      }
+    ]
+  }
+}

package/packages/public-runtime/tests/fixtures/integration/tenant-action-registry.example.json

@@ -0,0 +1,11 @@
+{
+  "$comment": "Canonical v1 action names are explicit authored data and are never inferred from markup or labels.",
+  "schemaVersion": 1,
+  "actions": [
+    { "name": "user_clicked_contact_sales_mktg" },
+    { "name": "user_clicked_create_account_mktg" },
+    { "name": "user_clicked_login_mktg" },
+    { "name": "user_clicked_contact_support_consumer_mktg" },
+    { "name": "user_clicked_contact_support_partner_mktg" }
+  ]
+}

package/packages/public-runtime/tests/fixtures/integration/tenant-local-example/README.md

@@ -0,0 +1,22 @@
+# Tenant-local example integration
+
+The smallest complete, valid tenant-local integration declaration: one
+`document.deferred` entry module plus one `body.start` fallback contribution,
+gated on the `analytics` consent purpose and the curated `plausible` CSP
+profile. It validates through `validateIntegrationManifest` — the identical
+function a managed app's manifest validates through (ADR 0014 C1) — so
+nothing here is a tenant-local special case.
+
+| File | What it is |
+|---|---|
+| `manifest.json` | The `IntegrationManifest` — the same contract a managed app ships. |
+| `public-config.json` | Resolved tenant values for `manifest.json`'s `browser.publicConfigSchema`. |
+| `entry.js` | The `document.deferred` entry module (`IntegrationLifecycleModule`: `init`/`update`/`dispose`). |
+
+Walked end to end — validate → resolve → render → boot → update → dispose →
+remove — by
+[`../../../integration/kernel-docs-harness.test.ts`](../../../integration/kernel-docs-harness.test.ts).
+Run it with `pnpm --filter @tot/public-runtime test kernel-docs-harness`.
+
+Full contract reference, ordering/failure guide, and removal walkthrough:
+[`docs/architecture/browser-integration-kernel.md`](../../../../../../docs/architecture/browser-integration-kernel.md).

package/packages/public-runtime/tests/fixtures/integration/tenant-local-example/entry.js

@@ -0,0 +1,30 @@
+/**
+ * A minimal tenant-local integration entry module — the shape every entry
+ * asset exports (IntegrationLifecycleModule from
+ * packages/public-runtime/src/integration/lifecycle.ts): `init` is required,
+ * `update`/`dispose` are optional.
+ *
+ * The deferred lifecycle runtime (lifecycle-runtime.ts's IntegrationLifecycle)
+ * calls these hooks exactly once per document; it never imports this file by
+ * name. An entry-asset layer maps this integration's appId/version (from the
+ * boot descriptor) to this file via an injected IntegrationModuleLoader — see
+ * kernel-docs-harness.test.ts, which dynamically imports this exact file
+ * through that same loader shape.
+ *
+ * `calls` is test/demo-only bookkeeping, not part of the contract — it lets
+ * the harness assert exactly-once init, in-place update, and terminal dispose
+ * without any DOM.
+ */
+export const calls = [];
+
+export function init() {
+  calls.push("init");
+}
+
+export function update(reason) {
+  calls.push(`update:${reason}`);
+}
+
+export function dispose() {
+  calls.push("dispose");
+}

package/packages/public-runtime/tests/fixtures/integration/tenant-local-example/manifest.json

@@ -0,0 +1,75 @@
+{
+  "$comment": "A minimal, valid tenant-local integration declaration. Validated by validateIntegrationManifest — the SAME function that validates a managed app (ADR 0014 C1 integration-schema-shared); nothing here is special-cased for tenant-local. Walked end to end by ../../integration/kernel-docs-harness.test.ts; see docs/architecture/browser-integration-kernel.md.",
+  "schemaVersion": 2,
+  "app": {
+    "id": "site.acme.analytics",
+    "name": "Acme Analytics (tenant-local)",
+    "version": "1.0.0",
+    "digest": "sha256:tenant-local-example-fixture",
+    "publisher": "Acme (tenant-local)",
+    "supportUrl": "https://acme.example/support"
+  },
+  "compatibility": {
+    "storefrontBrowserContract": ">=2.0.0 <3.0.0",
+    "configurationSchemaVersion": 2
+  },
+  "browser": {
+    "executionTier": "sandbox",
+    "entry": {
+      "asset": "public/apps/site.acme.analytics/entry.1.0.0.js",
+      "format": "module",
+      "phase": "document.deferred"
+    },
+    "contributions": [
+      {
+        "id": "fallback-badge",
+        "phase": "body.start",
+        "kind": "platform-template",
+        "template": "vendor-fallback-frame.v1"
+      }
+    ],
+    "dependencies": [
+      { "contribution": "entry", "after": "fallback-badge" }
+    ],
+    "publicConfigSchema": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["siteId"],
+      "properties": {
+        "siteId": {
+          "type": "string",
+          "description": "Public Plausible site identifier; never a credential."
+        }
+      }
+    },
+    "consent": {
+      "purposes": ["analytics"],
+      "loadWhen": "all-declared-purposes-eligible",
+      "unknownState": "block"
+    },
+    "csp": {
+      "profiles": ["plausible"],
+      "sources": {}
+    },
+    "permissions": {
+      "events": ["storefront.page.viewed.v1"],
+      "data": [],
+      "actions": [],
+      "domIntent": "none"
+    },
+    "performanceBudget": {
+      "maxTransferredBytes": 15000,
+      "maxAdditionalRequests": 1,
+      "maxMainThreadMilliseconds": 20,
+      "mustBeAsyncOrDeferred": true
+    }
+  },
+  "server": { "topics": [], "secretRequirements": [] },
+  "assurance": {
+    "requestedClassification": "baseline",
+    "regulatedTenantDefault": "disabled-until-certified"
+  },
+  "configurationMigrations": [
+    { "from": 1, "to": 2, "migration": "migrations/public-config-1-to-2.v1.json" }
+  ]
+}

package/packages/public-runtime/tests/fixtures/integration/tenant-local-example/public-config.json

@@ -0,0 +1,3 @@
+{
+  "siteId": "acme-shop"
+}

package/packages/public-runtime/tests/fixtures/regulated-commerce/fake-destinations.ts

@@ -0,0 +1,38 @@
+import {
+  REGULATED_COMMERCE_INTENT_SCHEMA_VERSION,
+  type RegulatedCommerceIntent,
+} from "../../../src/regulated-commerce/events/contract.js";
+import { LOCAL_FAKE_DESTINATION_SCHEMA_VERSION, type LocalFakeDestinationConfig } from "../../../src/regulated-commerce/testing/fake-destination.js";
+
+export const LOCAL_FAKE_DESTINATION: LocalFakeDestinationConfig = {
+  schemaVersion: LOCAL_FAKE_DESTINATION_SCHEMA_VERSION,
+  name: "fake-analytics",
+  outageAttempts: 0,
+};
+
+export function browserFixture(id = "fixture-browser-event-0001"): RegulatedCommerceIntent {
+  return {
+    schemaVersion: REGULATED_COMMERCE_INTENT_SCHEMA_VERSION,
+    id,
+    kind: "page_viewed",
+    occurredAt: "2026-08-30T12:00:00.000Z",
+    source: "accepted_browser_operation",
+    provenanceId: "fixture-browser-operation-0001",
+    attribution: { state: "unattributed_missing" },
+    consent: { state: "denied" },
+  };
+}
+
+export function serverFixture(id = "fixture-server-event-0001"): RegulatedCommerceIntent {
+  return {
+    schemaVersion: REGULATED_COMMERCE_INTENT_SCHEMA_VERSION,
+    id,
+    kind: "purchase_recorded",
+    occurredAt: "2026-08-30T12:00:00.000Z",
+    source: "verified_server_order",
+    provenanceId: "fixture-verified-order-0001",
+    money: { minor: "4250", currency: "USD" },
+    attribution: { state: "unattributed_missing" },
+    consent: { state: "denied" },
+  };
+}

package/packages/public-runtime/tests/gtm-migration/fixtures/gtm-sample-container-v84.provenance.json

@@ -0,0 +1,29 @@
+{
+  "note": "Fully synthetic GTM container export fixture. The container public id, account/container ids, container name, and all hostnames are fabricated sample values. This fixture does NOT correspond to any real Google Tag Manager container, account, tenant, or domain; its only purpose is to exercise the GTM-migration parser and accounting graph.",
+  "sourceFile": "GTM-SAMPLE1_v84.json",
+  "containerPublicId": "GTM-SAMPLE1",
+  "containerVersion": "84",
+  "exportFormatVersion": 2,
+  "redactedAt": "2026-08-29T00:00:00Z",
+  "opaqueSourceDigest": {
+    "algorithm": "sha256",
+    "value": "dcef7ec4b585fb82071841d4343e450456019d08a132a91fc6055ead848c3618",
+    "note": "One-way digest retained only as an opaque marker of the original redaction run. It is not reversible and carries no cleartext identifier."
+  },
+  "redactedSha256": "57d28f3ed5da4215599bfb4b74f984d8b0cd8bf7d8b31e0e1172877308e9b688",
+  "counts": {
+    "tag": 27,
+    "trigger": 30,
+    "variable": 20,
+    "builtInVariable": 6,
+    "customTemplate": 2,
+    "folder": 1,
+    "zone": 0,
+    "client": 0
+  },
+  "redaction": {
+    "codeFieldsRedacted": 7,
+    "secretsRedacted": 17,
+    "domainsRedacted": 8
+  }
+}