@tokenoftrust/storefront-runner 2.0.27 → 2.0.28

package/apps/storefront/src/lib/integration/managedInstallDeclarations.ts

@@ -12,7 +12,7 @@ import {
 } from "@tot/public-runtime";
 import { AppVersionStore } from "../apps/appVersionStore.js";
 import type { Queryable } from "../d1/catalog.js";
-import { parseStageDestinationIds } from "./stageDestinationIds.js";
+import { migrateLegacyDestinationIds, parseStageDestinationIds } from "./stageDestinationIds.js";
 
 const MANAGED_KIND = "managed-analytics-v1";
 
@@ -51,9 +51,11 @@ export async function loadActiveManagedInstallDeclarations(
       if (current.facets.digest !== manifest.value.app.digest || manifest.value.app.id !== row.app_id) continue;
       // The stored per-stage map, re-parsed through the SAME validator the API used, so a
       // row that no longer satisfies the contract disables its install rather than
-      // resolving a partial or stale destination set.
+      // resolving a partial or stale destination set. A row saved before per-stage
+      // arrays existed is lifted into the current shape first, so an install predating
+      // that change keeps firing instead of silently going inert underneath its tenant.
       const ids = parseStageDestinationIds(
-        current.facets.publicConfig["destinationIds"],
+        migrateLegacyDestinationIds(current.facets.publicConfig),
         getPlatformAdapter(row.app_id),
       );
       if (!ids.ok) continue;

package/apps/storefront/src/lib/integration/stageDestinationIds.ts

@@ -154,3 +154,25 @@ export function parseStageDestinationIds(
   if (details.length > 0) return { ok: false, details };
   return { ok: true, value };
 }
+
+/**
+ * Lift a stored install's public config into the shape {@link parseStageDestinationIds}
+ * expects, tolerating the two shapes that predate the per-stage array contract: the
+ * original single `destinationId` (implicitly `live`, from before per-stage support
+ * existed at all) and the per-stage map whose values were bare strings rather than
+ * arrays (the shape between per-stage support landing and it going array-valued).
+ * Anything already array-shaped passes through untouched, so this is idempotent and
+ * safe to run on every read — never on a submission, which always arrives in the
+ * current shape already.
+ */
+export function migrateLegacyDestinationIds(publicConfig: Record<string, unknown>): unknown {
+  const staged = publicConfig["destinationIds"];
+  if (staged !== undefined) {
+    if (typeof staged !== "object" || staged === null || Array.isArray(staged)) return staged;
+    const entries = Object.entries(staged as Record<string, unknown>);
+    if (entries.every(([, ids]) => Array.isArray(ids))) return staged;
+    return Object.fromEntries(entries.map(([stage, ids]) => [stage, Array.isArray(ids) ? ids : [ids]]));
+  }
+  const legacy = publicConfig["destinationId"];
+  return typeof legacy === "string" && legacy.length > 0 ? { live: [legacy] } : staged;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.0.27",
+  "version": "2.0.28",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/src/gtm-migration/draft-generator.ts

@@ -60,6 +60,17 @@ export const WS1_GOOGLE_MEASUREMENT_ADAPTER_ID: OpaquePublicId = "platform.googl
  */
 export const WS1_GOOGLE_MEASUREMENT_DESTINATION_KEY = "destinationIds";
 
+/**
+ * The canonical WS1 catalog's declared cap on the google-measurement adapter's
+ * `destinationIds` field (its `maxEntries`) — mirrors
+ * `GOOGLE_MEASUREMENT_ADAPTER.maxDestinationsPerStage` in `../integration/
+ * platform-adapters.js`. Duplicated rather than imported for the same reason the id
+ * and config key above are: this module speaks WS1's public vocabulary only, never a
+ * different catalog. Used as the DEFAULT cap when no `adapterCatalog` is supplied;
+ * with a catalog, the SELECTED adapter's own declared `maxEntries` wins.
+ */
+const WS1_GOOGLE_MEASUREMENT_DEFAULT_MAX_DESTINATIONS = 4;
+
 /** The opaque adapter handle used when a container has no supported GA4 concept. */
 export const NO_ADAPTER_SELECTED_ID: OpaquePublicId = "none-selected";
 
@@ -164,12 +175,22 @@ function selectGoogleMeasurementAdapter(
   return catalog?.find((a) => a.adapterId === WS1_GOOGLE_MEASUREMENT_ADAPTER_ID);
 }
 
-/** The config field key an adapter declares for its Google measurement destination id. */
-function destinationKeyFor(adapter: AdapterDefinition): string {
+/** The adapter's declared destination config field: its key, and its entry cap. */
+interface DestinationField {
+  readonly key: string;
+  readonly maxEntries: number;
+}
+
+/** The config field an adapter declares for its Google measurement destination id(s). */
+function destinationFieldFor(adapter: AdapterDefinition): DestinationField {
   const declared =
     adapter.configuration.find((f) => f.key === WS1_GOOGLE_MEASUREMENT_DESTINATION_KEY) ??
+    adapter.configuration.find((f) => f.kind === "stageMap") ??
     adapter.configuration.find((f) => f.kind === "string");
-  return declared?.key ?? WS1_GOOGLE_MEASUREMENT_DESTINATION_KEY;
+  return {
+    key: declared?.key ?? WS1_GOOGLE_MEASUREMENT_DESTINATION_KEY,
+    maxEntries: declared?.maxEntries ?? WS1_GOOGLE_MEASUREMENT_DEFAULT_MAX_DESTINATIONS,
+  };
 }
 
 function normalizeType(type: string | null): string {
@@ -319,41 +340,59 @@ export function generateDisabledMigrationDraft(
   const catalogProvided = args.adapterCatalog !== undefined;
 
   let proposedAdapterId: OpaquePublicId;
-  let destinationKey: string;
+  let destinationField: DestinationField;
   if (!hasGa4 || (catalogProvided && catalogAdapter === undefined)) {
     proposedAdapterId = NO_ADAPTER_SELECTED_ID;
-    destinationKey = WS1_GOOGLE_MEASUREMENT_DESTINATION_KEY;
+    destinationField = {
+      key: WS1_GOOGLE_MEASUREMENT_DESTINATION_KEY,
+      maxEntries: WS1_GOOGLE_MEASUREMENT_DEFAULT_MAX_DESTINATIONS,
+    };
   } else if (catalogAdapter !== undefined) {
     proposedAdapterId = catalogAdapter.adapterId;
-    destinationKey = destinationKeyFor(catalogAdapter);
+    destinationField = destinationFieldFor(catalogAdapter);
   } else {
     proposedAdapterId = WS1_GOOGLE_MEASUREMENT_ADAPTER_ID;
-    destinationKey = WS1_GOOGLE_MEASUREMENT_DESTINATION_KEY;
+    destinationField = {
+      key: WS1_GOOGLE_MEASUREMENT_DESTINATION_KEY,
+      maxEntries: WS1_GOOGLE_MEASUREMENT_DEFAULT_MAX_DESTINATIONS,
+    };
   }
   const adapterSelected = proposedAdapterId !== NO_ADAPTER_SELECTED_ID;
 
   const proposedConfiguration: Record<string, AdapterConfigValue> = {};
-  let destinationId: string | null = null;
+  let destinationIds: string[] = [];
+  let destinationIdsCapped = false;
   if (adapterSelected) {
+    // Every GA4 config tag on the trigger contributes its literal id — a container can
+    // carry a primary property plus a rollup, and each must reach the draft; dropping all
+    // but the first silently loses a merchant's destination while the report reads clean.
+    const found: string[] = [];
     for (const config of ga4Configs) {
       const raw = nodeByKey.get(config.nodeKey)?.record.raw ?? {};
-      const found = extractDestinationId(raw);
-      if (found !== null) {
-        destinationId = found;
-        break; // deterministic: first config carrying a literal id wins.
-      }
+      const id = extractDestinationId(raw);
+      if (id !== null) found.push(id);
+    }
+    // Dedupe (the same literal id declared on more than one config tag), preserving
+    // deterministic first-seen order.
+    destinationIds = [...new Set(found)];
+    // A fan-out beyond the adapter's declared cap cannot be represented — refuse the
+    // excess rather than guess, and REPORT it (below) rather than drop it silently.
+    if (destinationIds.length > destinationField.maxEntries) {
+      destinationIdsCapped = true;
+      destinationIds = destinationIds.slice(0, destinationField.maxEntries);
     }
-    // A container's GA4 id is the merchant's LIVE destination, so the draft proposes it
-    // at that stage only. A non-live stage needs its own TEST id, which the merchant adds
-    // before verifying — the contract refuses reusing the live one there.
-    if (destinationId !== null) proposedConfiguration[destinationKey] = { live: [destinationId] };
+    // A container's GA4 id(s) are the merchant's LIVE destination(s), so the draft
+    // proposes them at that stage only. A non-live stage needs its own TEST id(s), which
+    // the merchant adds before verifying — the contract refuses reusing the live one there.
+    if (destinationIds.length > 0) proposedConfiguration[destinationField.key] = { live: destinationIds };
   }
 
   // --- Redacted finding codes (no source text; stable, sorted-by-construction). -
   const findings: MigrationFindingCode[] = [];
   if (ga4Configs.length > 0) findings.push("ga4-config-detected");
   if (ga4Events.length > 0) findings.push("ga4-events-detected");
-  findings.push(destinationId !== null ? "ga4-destination-id-configured" : "ga4-destination-id-deferred");
+  findings.push(destinationIds.length > 0 ? "ga4-destination-id-configured" : "ga4-destination-id-deferred");
+  if (destinationIdsCapped) findings.push("ga4-destination-ids-capped");
   if (!hasGa4) findings.push("no-automatically-portable-analytics");
   if (unresolvedInventory.length > 0) findings.push("unresolved-objects-inventoried");