Install Cairn in Laravel and Bagisto

Use the production snippet from Settings → Widget → Install, a separately stored widget identity secret, and the CSP guide. In Bagisto-derived applications, storefront customers, marketplace sellers and administrators frequently use different layouts and authentication guards. Inventory the actual guards and layouts in your version before editing; a global Auth::user() call can identify the wrong person on a seller or admin page.

Server configuration

Add a dedicated configuration file rather than reading environment values in controllers or templates:

// config/cairn.php
return [
    'enabled' => (bool) env('CAIRN_ENABLED', false),
    'website_id' => env('CAIRN_WEBSITE_ID'), // No invented fallback.
    'widget_identity_secret' => env('CAIRN_WIDGET_IDENTITY_SECRET'),
    'helpcenter_jwt_secret' => env('CAIRN_HELPCENTER_JWT_SECRET'),
    'helpcenter_auth_return_url' => env('CAIRN_HELPCENTER_AUTH_RETURN_URL'),
    // Keep the issued application/CDN/WebSocket addresses alongside the snippet.
];

List each key in your application's .env.example with secrets empty. Store values in the deployment secret manager and rebuild the configuration cache. Never commit production values. Add firebase/php-jwt as a direct Composer requirement for the identity token service.

Fail closed when the website ID, secret or an unambiguous account association is missing. Do not emit an unsigned account identity as a fallback. Anonymous support can remain available where its consent category permits it.

Layout and guard mapping

Use the exact guard names in your application; they are not universally identical across Bagisto versions and marketplace packages. Prefer an application-level layout hook or overridden view over editing vendor files. Prevent duplicate installation when a child template and its parent both include the integration.

Place the issued globals and loader together, then queue a server-generated {email, name, token} response. Blade should serialize the response using Js::from or @json, never raw interpolated JavaScript. Prefer a CSRF/session-protected same-origin endpoint returning Cache-Control: no-store so tokens are not stored in a cached HTML response. Do not add tokens to page or application telemetry.

AccordRx allowlist and consent

Wrap the existing OnboardingContextResolver::forAccount() in an explicit Cairn attribute builder. The identity is platform-account:<id> with a one-hour HS256 expiry. Allow only signup time, pharmacy/buying-group audience, actor surface, role, pharmacy ID/name, buying-group ID/name/status, approval and onboarding-completion attributes. An ambiguous account link returns no identity.

Never emit DEA number/class code, NPI, NCPDP, state license details, Stripe accounts/payment methods, phone/address fields, order/lot/serial data, DSCSA/EPCIS documents or PHI. Unit tests must prove those fields cannot be emitted even if present on the source model. Configure the AI agent not to request those details and to escalate regulatory questions.

Under the pilot governance mapping, tours and Experiences use experience_enhancement; chat uses basic_interaction. Analytics events still require an explicit governance decision. Do not infer consent from subscription or feature availability. Keep the application's consent controls authoritative when deciding whether to load or offer these functions.

Help-center sign-in and logout

Add an authenticated server endpoint for help-center sign-in. Sign with the help-center secret, use the fixed portal-issued /auth return URL and validate the destination as a local path. JWT expiry controls the help-center session; use one hour.

In each guard's logout flow, clear every cairn: key from both browser storages before submitting the normal CSRF-protected logout form. Complete a full document navigation afterward. When switching guards/accounts in one browser, clear the old visitor before identifying the next person.

Verify before production rollout

Test each layout with an ordinary account under the real CSP and allowed-host rules. Confirm one loader, one widget session, verified identity, exactly the allowlisted attributes, realtime replies, a published tour/checklist and help-center sign-in. Test an anonymous visitor, ambiguous account link, expired/old-secret JWT, account switch and logout. Confirm customer-only knowledge is inaccessible to anonymous users and internal content remains inaccessible to customer proofs.

Use sanitized fixture accounts and pages for capture/element picking; redaction is not permission to capture prohibited pilot data. Record production manifest/extension versions, host, browser, guard, role, expected/actual outcome and screenshots. The AccordRx customer-installation stories supply the production proof; Cairn's implementation tests alone do not establish it.