[GROWTH] Embeddable campaign widgets + partner distribution SDK

[joelpeace48-cell]

Growth initiative. Net-new, high-priority. Distribution / partner-led growth.

Why this matters (distribution)

The fastest growth channel for a campaign platform is other people's audiences. If any project, DAO, or creator can drop a Trivela campaign widget onto their own site/app in minutes, Trivela rides their distribution. An embeddable widget + partner SDK turns every partner into a growth channel.

Goal

Ship a secure, themeable embeddable campaign widget + a lightweight partner JS SDK so third parties can host register/claim flows on their own sites with attribution back to Trivela.

Technical design

• Embed widget: build on the existing embed (pages/EmbedCampaign.jsx, EmbedCampaignCard.jsx, routes/embed.js) → a robust iframe/web-component widget with a one-line snippet: <script src=".../embed.js" data-campaign="…">. Themeable (org branding), responsive, sandboxed.
• Partner SDK: tiny JS that mounts the widget, exposes events (onRegister, onClaim), handles wallet hand-off (deep-link/passkey), and carries a partner/referrer attribution tag through to on-chain referral rewards.
• Security: strict framing/CSP, postMessage origin allowlist, no key exposure, rate-limited embed endpoints.
• Attribution: partner ID flows into referral tracking so partners can be rewarded (links the on-chain referral economy).

Edge cases

• Cross-origin wallet signing (popup/redirect fallback when iframe can't sign).
• CSP/framing on partner sites; clickjacking protection.
• Attribution integrity (no spoofed partner credit) → signed attribution tokens.
• Graceful render when JS/wallet unavailable.

Task breakdown

• Harden embed into a one-line script/web-component widget (themeable, responsive, sandboxed).
• Partner SDK (mount, events, wallet hand-off, attribution tag).
• Signed attribution tokens → referral rewards integration.
• Security: framing/CSP/postMessage allowlist + embed rate limits.
• Partner quickstart + live example.

Acceptance criteria

• A third party embeds a working register/claim widget with one snippet; partner attribution is captured securely and can drive referral rewards.

Verification

• E2E embedding on a sample external origin; attribution integrity tests; security review of framing/postMessage.

Dependencies

• Builds on existing embed; ties to on-chain referral rewards + org branding.

Priority: high · Difficulty: hard · Effort: L · growth (distribution)

[Menjay7]

Hi! I came across this issue and would love to work on it. I have experience with similar tasks and I'm confident I can investigate, implement a clean solution, and thoroughly test it before submitting a PR. If the issue is still open, I would appreciate it if you could assign it to me. Thank you!