@tokenoftrust/storefront-runner 2.4.84 → 2.4.86

package/apps/storefront/package.json

@@ -14,7 +14,7 @@
     "preview": "wrangler dev",
     "typecheck": "astro check && tsc --noEmit",
     "astro": "astro",
-    "test": "NODE_OPTIONS=--experimental-sqlite vitest run --exclude src/lib/apps/v84CleanCloneReplay.test.ts --exclude src/lib/apps/v84NonportableRouteDogfood.test.ts --exclude src/lib/apps/v84CloneLifecycleEvidence.test.ts && NODE_OPTIONS=--experimental-sqlite vitest run src/lib/apps/v84CleanCloneReplay.test.ts src/lib/apps/v84NonportableRouteDogfood.test.ts src/lib/apps/v84CloneLifecycleEvidence.test.ts --fileParallelism=false && pnpm run test:pipeline && pnpm run test:pipeline-faults"
+    "test": "NODE_OPTIONS=--experimental-sqlite vitest run --exclude src/lib/integrations/apps/v84CleanCloneReplay.test.ts --exclude src/lib/integrations/apps/v84NonportableRouteDogfood.test.ts --exclude src/lib/integrations/apps/v84CloneLifecycleEvidence.test.ts && NODE_OPTIONS=--experimental-sqlite vitest run src/lib/integrations/apps/v84CleanCloneReplay.test.ts src/lib/integrations/apps/v84NonportableRouteDogfood.test.ts src/lib/integrations/apps/v84CloneLifecycleEvidence.test.ts --fileParallelism=false && pnpm run test:pipeline && pnpm run test:pipeline-faults"
   },
   "dependencies": {
     "@astrojs/cloudflare": "^14.0.1",

package/apps/storefront/src/components/{apps → integrations/storefront/apps}/AppWidgetFrame.astro

@@ -10,7 +10,7 @@
  * `<iframe>` for the parent-side `mountWidgetPostMessageBridge()`
  * (`@tot/public-runtime`) to scan for.
  */
-import { buildAppWidgetFrameAttrs, type AppWidgetFrameProps } from "@/lib/apps/widgets/frameProps.js";
+import { buildAppWidgetFrameAttrs, type AppWidgetFrameProps } from "@/lib/integrations/apps/widgets/frameProps.js";
 
 type Props = AppWidgetFrameProps;
 

package/apps/storefront/src/config/devTenantSeed.ts

@@ -28,7 +28,7 @@
 import type { DeepPartial, TenantConfig, ThemeTokens } from "@tot/public-runtime";
 import { SHARED_DEMO_CHECKOUT } from "@tot/public-runtime";
 import { rootPublicationSpaceConfig } from "./publicationSpaceConfig";
-import { loadTenantAnalyticsDeclarations } from "@/lib/integration/tenantAnalyticsDeclarations";
+import { loadTenantAnalyticsDeclarations } from "@/lib/integrations/integration/tenantAnalyticsDeclarations";
 
 /** Per-dir overrides the resolver derives from disk before synthesis. */
 export interface DevTenantHints {

package/apps/storefront/src/layouts/Layout.astro

@@ -38,9 +38,9 @@ import { bindManagedCartAnchors, managedCartHref } from "@/lib/chrome/managedCar
 import type { HeaderVariant, FooterVariant } from "@/lib/chrome/model";
 import { renderIntegrationPhases, INTERACTION_TRACKING_BOOT_JS } from "@tot/public-runtime";
 import { readViewerSession } from "@/lib/auth/route";
-import AppWidgetFrame from "@/components/apps/AppWidgetFrame.astro";
-import { getRegistryService } from "@/lib/apps/registryAccess.js";
-import { renderWidgetSlot } from "@/lib/apps/widgets/renderSlot.js";
+import AppWidgetFrame from "@/components/integrations/storefront/apps/AppWidgetFrame.astro";
+import { getRegistryService } from "@/lib/integrations/apps/registryAccess.js";
+import { renderWidgetSlot } from "@/lib/integrations/apps/widgets/renderSlot.js";
 
 interface Props {
   title: string;

package/apps/storefront/src/lib/admin/README.md

@@ -81,8 +81,8 @@ lib/admin/
   testable source of truth for what the floating Ask button emits — the full
   tenant envelope, active tab, selected record id (if any), role +
   permissions (derived from `isStaff`), active filters, and evidence context.
-  `admin.astro`'s `is:inline` script mirrors this logic in plain JS (inline
-  scripts can't import modules) and emits it on Ask-button click as
+  The processed `adminShell.ts` client imports this builder and emits its
+  result on Ask-button click as
   `window.__toTAdminAsk` and a `tot:admin-ask` `CustomEvent` — **dev-inspectable
   only, no chat backend yet.** The envelope changes whenever the active tab
   changes (kept current by `setAskContext`) and is rebuilt fresh on click so a
@@ -117,6 +117,6 @@ const orders = getOrdersViewModel({
 - **Tabs/pages → lib, never lib → tabs/pages.** Nothing under `lib/admin/**`
   imports from `components/admin/**` or `pages/admin.astro`. Tab components
   and `admin.astro` are free to import from here (`admin.astro` already does,
-  for `resolveAdminTenantMode` and the Ask-envelope logic it mirrors inline).
+  for `resolveAdminTenantMode` and the shared shell configuration).
 - Gaps in these contracts should go back to the workstream board as a
   decision, not get patched from a tab's unit.

package/apps/storefront/src/lib/admin/adminShell.ts

@@ -4,7 +4,7 @@
  * the tablists. Imported from a processed `<script>` in admin.astro (ADR 0013):
  * type-checked, bundled, tree-shaken, and its bundle hash is in the enforced
  * CSP. The Ask envelope is built with the shared, unit-tested
- * `buildAskEnvelope` (ai/askEnvelope) instead of a hand-copied inline mirror.
+ * `buildAskEnvelope` (ai/askEnvelope).
  *
  * There is no chat backend yet — the Ask envelope is emitted for dev inspection
  * only (window.__toTAdminAsk + a "tot:admin-ask" CustomEvent), never sent over
@@ -12,33 +12,23 @@
  */
 import { buildAskEnvelope, type AskEnvelope } from "./ai/askEnvelope";
 
-const TAB_IDS = [
-  "orders",
-  "products",
-  "subscriptions",
-  "customers",
-  "fulfillment",
-  "reporting",
-  "ai-workflows",
-  "blog",
-  "publish",
-  "integrations",
-  "settings",
-] as const;
-
-const ASK_CONTEXTS: Record<string, string> = {
-  orders: "Orders",
-  products: "Products",
-  subscriptions: "Subscriptions",
-  customers: "Customers",
-  fulfillment: "Fulfillment",
-  reporting: "Reporting",
-  "ai-workflows": "AI Workflows",
-  blog: "Blog",
-  publish: "Publish",
-  integrations: "Integrations",
-  settings: "Settings",
-};
+/** Static shell data shared by server-rendered navigation and browser startup. */
+export const ADMIN_SHELL_CONFIG = {
+  workAreas: [
+    { id: "orders", label: "Orders", icon: "i-file" },
+    { id: "products", label: "Products", icon: "i-box" },
+    { id: "subscriptions", label: "Subscriptions", icon: "i-refresh" },
+    { id: "customers", label: "Customers", icon: "i-users" },
+    { id: "fulfillment", label: "Fulfillment", icon: "i-truck" },
+    { id: "reporting", label: "Reporting", icon: "i-chart" },
+    { id: "ai-workflows", label: "AI Workflows", icon: "i-workflows" },
+    { id: "blog", label: "Blog", icon: "i-file" },
+    { id: "publish", label: "Publish", icon: "i-export" },
+    { id: "integrations", label: "Integrations", icon: "i-workflows" },
+    { id: "settings", label: "Settings", icon: "i-gear" },
+  ],
+  defaultTabs: { staff: "orders", merchant: "settings" },
+} as const;
 
 declare global {
   interface Window {
@@ -47,11 +37,13 @@ declare global {
 }
 
 export function initAdminShell(): void {
-  const tabSet = new Set<string>(TAB_IDS);
-  const tabHashPattern = new RegExp(`^#(${TAB_IDS.join("|")})$`);
+  const tabIds = ADMIN_SHELL_CONFIG.workAreas.map(({ id }) => id);
+  const tabSet = new Set<string>(tabIds);
+  const tabHashPattern = new RegExp(`^#(${tabIds.join("|")})$`);
   const canViewInternalGuide =
     document.documentElement.dataset.internalAdminGuide === "true";
-  const defaultTab = canViewInternalGuide ? "orders" : "settings";
+  const defaultTab =
+    ADMIN_SHELL_CONFIG.defaultTabs[canViewInternalGuide ? "staff" : "merchant"];
 
   const buildAskEnvelopeForTab = (id: string): AskEnvelope => {
     const root = document.documentElement.dataset;
@@ -74,7 +66,9 @@ export function initAdminShell(): void {
   };
 
   const setAskContext = (id: string): void => {
-    const label = ASK_CONTEXTS[id] ?? "Storefront";
+    const label =
+      ADMIN_SHELL_CONFIG.workAreas.find((area) => area.id === id)?.label ??
+      "Storefront";
     const askButton = document.querySelector<HTMLElement>("[data-admin-ask]");
     const askContext = document.querySelector<HTMLElement>(
       "[data-admin-ask-context]",
@@ -196,7 +190,7 @@ export function initAdminShell(): void {
       // normalized away to #settings for merchant viewers.
       const hashTab = window.location.hash.slice(1).split("?")[0] ?? "";
       if (!canViewInternalGuide && !tabSet.has(hashTab)) {
-        history.replaceState(null, "", "#settings");
+        history.replaceState(null, "", `#${defaultTab}`);
       }
       if (scroll) requestAnimationFrame(() => scrollToHashTarget(panelId));
       return;
@@ -229,12 +223,6 @@ export function initAdminShell(): void {
     const envelope = buildAskEnvelopeForTab(activeTab);
     window.__toTAdminAsk = envelope;
     document.dispatchEvent(new CustomEvent("tot:admin-ask", { detail: envelope }));
-    if (
-      window.location.hostname === "localhost" ||
-      window.location.hostname === "127.0.0.1"
-    ) {
-      console.debug("[admin:ask]", envelope);
-    }
   });
 
   document.addEventListener("click", (event) => {

package/apps/storefront/src/lib/admin/ai/askEnvelope.ts

@@ -1,10 +1,9 @@
 /**
  * The floating `Ask` button's context envelope (baseline §Horizontal AI
  * Concepts / Ask; ai-evidence-substrate item a). PURE + no I/O so it is
- * unit-testable and reusable from both the inline admin.astro script (via a
- * plain-object mirror, since `is:inline` scripts cannot import modules) and
+ * unit-testable and reusable from the processed adminShell.ts client and
  * any future server-side Ask route. There is no chat backend yet — today
- * this is emitted for dev inspection only (see admin.astro's `data-admin-ask`
+ * this is emitted for dev inspection only (see adminShell.ts's `data-admin-ask`
  * click handler), never sent over the network.
  */
 import type { AdminTenantEnvelope } from "../envelope";

package/apps/storefront/src/lib/apps/orders/orderForwardReceiver.ts

@@ -33,8 +33,8 @@
  * see `docs/private-apps/order-forward-contract.md` for the full rationale.
  */
 import { OrdersStore, ScrappyOrderLedger, type OrderLineItem, type OrderStatus, type Order } from "./ordersStore.js";
-import { emitWebhookEvent } from "../../webhooks/emit.js";
-import type { WebhookTopic } from "../../webhooks/deliveryStore.js";
+import { emitWebhookEvent } from "../../integrations/webhooks/emit.js";
+import type { WebhookTopic } from "../../integrations/webhooks/deliveryStore.js";
 import type { Queryable } from "../../d1/catalog.js";
 import {
   createLocalJWKSet,

package/apps/storefront/src/lib/apps/orders/orderMapper.ts

@@ -8,7 +8,7 @@
  * internals — and never lets a raw customer identifier leave this module:
  * customer identity is always the per-(tenant, install) `customerHash`.
  */
-import { customerHash } from "./customerHash.js";
+import { customerHash } from "../../integrations/apps/orders/customerHash.js";
 import type { FoxyOrder, FoxyOrderLineItem } from "./foxyOrderClient.js";
 import {
   COMPLIANCE_STATES,

package/apps/storefront/src/lib/{apps → integrations/apps}/appVersionStore.ts

@@ -37,7 +37,7 @@ import type {
   NormalizedContribution,
 } from "@tot/public-runtime";
 import { findForbiddenFields } from "@tot/public-runtime";
-import type { Queryable, QueryStatement } from "../d1/catalog.js";
+import type { Queryable, QueryStatement } from "../../d1/catalog.js";
 
 /**
  * One managed-app version's COMPLETE restorable facet set — everything a rollback

package/apps/storefront/src/lib/{apps → integrations/apps}/credentials.ts

@@ -19,7 +19,7 @@
  */
 import { sha256Hex } from "@tot/public-runtime";
 import type { CredentialPort, IssuedCredential } from "./registryService.js";
-import type { Queryable } from "../d1/catalog.js";
+import type { Queryable } from "../../d1/catalog.js";
 
 /** `IssuedCredential` plus the one-time plaintext secret — never stored, never re-returned. */
 export type IssuedCredentialSecret = IssuedCredential & { secret: string };

package/apps/storefront/src/lib/{apps → integrations/apps}/orders/idempotency.ts

@@ -14,7 +14,7 @@
  * idempotent write route can reuse this.
  */
 import { sha256Hex } from "@tot/public-runtime";
-import type { Queryable } from "../../d1/catalog.js";
+import type { Queryable } from "../../../d1/catalog.js";
 
 export type IdempotencyCheck =
   | { status: "proceed" }

package/apps/storefront/src/lib/{apps → integrations/apps}/registryAccess.ts

@@ -16,8 +16,8 @@
 import { AppRegistryService } from "./registryService.js";
 import { D1CredentialStore } from "./credentials.js";
 import { DEFAULT_APP_GATEWAY_KID, APP_GATEWAY_KID_ENV } from "./gatewayKeys.js";
-import { fromD1 } from "../d1/catalog.js";
-import { readD1, readEnv } from "../env.js";
+import { fromD1 } from "../../d1/catalog.js";
+import { readD1, readEnv } from "../../env.js";
 
 /**
  * No-store JSON response — install/rotate bodies carry a one-time client

package/apps/storefront/src/lib/{apps → integrations/apps}/registryService.ts

@@ -70,7 +70,7 @@ import {
   type PlanIntegrationEntry,
   type PlanIntegrationConsent,
 } from "@tot/public-runtime";
-import type { Queryable } from "../d1/catalog.js";
+import type { Queryable } from "../../d1/catalog.js";
 
 export type AppInstallStatus = "active" | "suspended" | "uninstalled";
 

package/apps/storefront/src/lib/{integration → integrations/integration}/browserEnvironment.ts

@@ -23,7 +23,7 @@ import { isAdminPath } from "@/lib/auth/loginGate";
 import {
   resolveIntegrationRenderState,
   type IntegrationRenderState,
-} from "@/lib/integration/renderIntegrationState";
+} from "@/lib/integrations/integration/renderIntegrationState";
 
 /**
  * The non-secret render revision: the commit SHA this build was cut from (baked at

package/apps/storefront/src/lib/{integration → integrations/integration}/managedInstallDeclarations.ts

@@ -11,7 +11,7 @@ import {
   type IntegrationDeclarationInput,
 } from "@tot/public-runtime";
 import { AppVersionStore } from "../apps/appVersionStore.js";
-import type { Queryable } from "../d1/catalog.js";
+import type { Queryable } from "../../d1/catalog.js";
 import { migrateLegacyDestinationIds, parseStageDestinationIds } from "./stageDestinationIds.js";
 
 const MANAGED_KIND = "managed-analytics-v1";

package/apps/storefront/src/lib/{webhooks → integrations/webhooks}/deliveryEngine.ts

@@ -28,7 +28,7 @@ import { buildCloudEventEnvelope } from "./events.js";
 import { computeBackoffDelaySeconds, MAX_DELIVERY_ATTEMPTS, type AttemptOutcome } from "./dispatcher.js";
 import { validateWebhookEndpoint } from "./endpointGuard.js";
 import { COMMERCE_SCHEDULER } from "@tot/public-runtime";
-import type { Queryable } from "../d1/catalog.js";
+import type { Queryable } from "../../d1/catalog.js";
 
 /** Bounded per-attempt timeout — a hung receiver must not hold a dispatcher slot open indefinitely. */
 const DEFAULT_TIMEOUT_MS = 10_000;

package/apps/storefront/src/lib/{webhooks → integrations/webhooks}/deliveryStore.ts

@@ -39,7 +39,7 @@
  * the delivery via `getOrThrowDelivery` before returning it, the same
  * read-after-write discipline `AppRegistryService` uses.
  */
-import type { Queryable } from "../d1/catalog.js";
+import type { Queryable } from "../../d1/catalog.js";
 
 /** Mirrors the `Delivery.topic` / CloudEvents channel enum in the D1/D2 contract. */
 export type WebhookTopic =

package/apps/storefront/src/lib/{webhooks → integrations/webhooks}/emit.ts

@@ -50,8 +50,8 @@ import { TOPIC_REQUIRED_SCOPE } from "./events.js";
 import { getDispatcher } from "./getDispatcher.js";
 import { getRegistryService } from "../apps/registryAccess.js";
 import type { AppInstall } from "../apps/registryService.js";
-import { fromD1 } from "../d1/catalog.js";
-import { readD1 } from "../env.js";
+import { fromD1 } from "../../d1/catalog.js";
+import { readD1 } from "../../env.js";
 
 /** Contract-scoped payload schema version — `asyncapi.yaml`'s `dataschemaversion` is `const: "1"` for V1. */
 const DATASCHEMA_VERSION = "1";

package/apps/storefront/src/lib/{webhooks → integrations/webhooks}/getDispatcher.ts

@@ -22,8 +22,8 @@ import { AppRegistryService } from "../apps/registryService.js";
 import { D1CredentialStore } from "../apps/credentials.js";
 import { DEFAULT_APP_GATEWAY_KID, APP_GATEWAY_KID_ENV } from "../apps/gatewayKeys.js";
 import { json } from "../apps/registryAccess.js";
-import { fromD1, type Queryable } from "../d1/catalog.js";
-import { readD1, readEnv, readQueue } from "../env.js";
+import { fromD1, type Queryable } from "../../d1/catalog.js";
+import { readD1, readEnv, readQueue } from "../../env.js";
 import { COMMERCE_SCHEDULER } from "@tot/public-runtime";
 
 /** Binding name `getDispatcher()` checks to pick the Cloudflare Queues adapter. Not yet declared in `wrangler.toml`. */

package/apps/storefront/src/middleware/controlPlane.ts

@@ -10,7 +10,7 @@ import type { APIContext, MiddlewareNext } from "astro";
 import { readEnv, readD1, readKv } from "@/lib/env";
 import { fromD1, type D1Like } from "@/lib/d1/catalog";
 import { readCurrentTenantConsentConfig } from "@/lib/apps/consentConfigRead";
-import { loadActiveManagedInstallDeclarations } from "@/lib/integration/managedInstallDeclarations";
+import { loadActiveManagedInstallDeclarations } from "@/lib/integrations/integration/managedInstallDeclarations";
 import { buildTenantConsentBroker, verifyPreviewToken } from "@tot/public-runtime";
 import { tenantIsDeclaredPublic } from "@/config/tenants";
 import type {

package/apps/storefront/src/middleware/renderChain.ts

@@ -64,7 +64,7 @@ import {
   verifyConsentSnapshotSig,
   resolveNativeGa4SandboxUrl,
 } from "@tot/public-runtime";
-import { readBakedManagedInstalls } from "@/lib/integration/bakedManagedInstalls";
+import { readBakedManagedInstalls } from "@/lib/integrations/integration/bakedManagedInstalls";
 import { readWithImagePreviewRewriteOverlay } from "@tot/public-runtime/image-preview-rewrite-overlay";
 import type {
   CapabilityConfig,
@@ -84,24 +84,24 @@ import {
   HTML_CACHE_POLICY_CAPTURE_PROBE,
 } from "@tot/public-runtime";
 import { publicationContentRedirectLocationV1 } from "@tot/public-runtime/publication-content-redirects";
-import { loadTenantIntegrationDeclarations } from "@/lib/integration/tenantDeclarations";
+import { loadTenantIntegrationDeclarations } from "@/lib/integrations/integration/tenantDeclarations";
 import { resolveTenantCommerce } from "@/lib/checkoutCommerce";
 import {
   requestBrowserEnvironment,
   previewBrowserEnvironment,
   deriveSiteSurface,
   cspHeaderName,
-} from "@/lib/integration/browserEnvironment";
+} from "@/lib/integrations/integration/browserEnvironment";
 import {
   carriesLiveNonce,
   freshNonce,
   isErrorPageReroute,
   stampResponseNonce,
-} from "@/lib/integration/nonceStamp";
+} from "@/lib/integrations/integration/nonceStamp";
 import {
   composeIntegrationDeclarations,
   resolveIntegrationRenderState,
-} from "@/lib/integration/renderIntegrationState";
+} from "@/lib/integrations/integration/renderIntegrationState";
 import { recordActivity } from "@/lib/activity/recordActivity";
 import { middlewareRewriteTargetV1 } from "./routeBranch.js";
 import { declaredTenantOrigins } from "@/lib/tenantOrigins";

package/apps/storefront/src/pages/index.astro

@@ -21,9 +21,9 @@ import TierCards from "@/components/membership/storefront/membership/TierCards.a
 import { withBase } from "@/lib/basePath";
 import { rawHtmlPolicy, rawHtmlResponse } from "@/lib/rawMarketingHtml";
 import { renderRawComplianceTop, renderRawComplianceBottom } from "@/lib/compliance/rawComplianceNotices";
-import AppWidgetFrame from "@/components/apps/AppWidgetFrame.astro";
-import { getRegistryService } from "@/lib/apps/registryAccess.js";
-import { renderWidgetSlot } from "@/lib/apps/widgets/renderSlot.js";
+import AppWidgetFrame from "@/components/integrations/storefront/apps/AppWidgetFrame.astro";
+import { getRegistryService } from "@/lib/integrations/apps/registryAccess.js";
+import { renderWidgetSlot } from "@/lib/integrations/apps/widgets/renderSlot.js";
 import type { CatalogCollection, CatalogProduct } from "@tot/public-runtime";
 import {
   isMarketingBlock,

package/apps/storefront/src/pages/products/[handle].astro

@@ -49,9 +49,9 @@ import { productPageType, structuredDataProfile } from "@/lib/seo/structuredData
 import { pageUrlForm } from "@/lib/seo/urlForm";
 import { sourceSeoTitle } from "@/lib/seo/documentTitle";
 import { shippingPolicyPath } from "@/lib/commerce/shippingPolicy";
-import AppWidgetFrame from "@/components/apps/AppWidgetFrame.astro";
-import { getRegistryService } from "@/lib/apps/registryAccess.js";
-import { renderWidgetSlot } from "@/lib/apps/widgets/renderSlot.js";
+import AppWidgetFrame from "@/components/integrations/storefront/apps/AppWidgetFrame.astro";
+import { getRegistryService } from "@/lib/integrations/apps/registryAccess.js";
+import { renderWidgetSlot } from "@/lib/integrations/apps/widgets/renderSlot.js";
 
 const { handle } = Astro.params;
 const { tenant, tot, canonicalBase, basePath, apiBasePath, commerce } = Astro.locals;

package/docs/widget-library-guide.md

@@ -1317,7 +1317,7 @@ Shared primitives composed by the higher-level widgets, plus the homepage hero.
   <Img src={image?.url} rehosted={image?.rehosted} seed={image?.id ?? handle} alt={title} width={800} height={1000} sizes="(min-width:1024px) 25vw, 100vw" priority />
   ```
 
-### WidgetFrame (`components/WidgetFrame.astro`)
+### WidgetFrame (`components/integrations/storefront/WidgetFrame.astro`)
 
 - **Purpose:** Renders a tenant-registered widget (`isolation: "sandbox"`) in a sandboxed iframe —
   `allow-scripts` without `allow-same-origin` puts it in an opaque origin (can't read page

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.4.84",
+  "version": "2.4.86",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/src/customization-scripts.ts

@@ -1,7 +1,7 @@
 /**
  * Tenant browser-script vocabulary the renderer needs: the slot / strategy /
  * isolation constants, the CSP hash helper, and the sandboxed widget iframe
- * attributes the renderer draws (`components/WidgetFrame.astro`).
+ * attributes the renderer draws (`components/integrations/storefront/WidgetFrame.astro`).
  *
  * Dependency-free + Workers-portable (Web Crypto, btoa).
  */