@tokenoftrust/storefront-runner 2.0.29 → 2.0.31

package/apps/storefront/astro.config.mjs

@@ -59,6 +59,7 @@ import tailwindcss from "@tailwindcss/vite";
 import { tenantHotReload } from "./dev-plugins/tenant-hot-reload.mjs";
 import { materializeGuard } from "./integrations/materialize-guard.mjs";
 import { lifecycleHostAsset } from "./integrations/lifecycle-host-asset.mjs";
+import { googleMeasurementSandboxAsset } from "./integrations/google-measurement-sandbox-asset.mjs";
 
 // SSR on Cloudflare Workers. `output: 'server'` because every response is
 // tenant-resolved at the edge from the Host header (see src/middleware).
@@ -99,6 +100,7 @@ export default defineConfig({
     // stable same-origin URL so BOTH document mounts load the same boot — the raw
     // marketing mount has no bundler to hoist a module import through.
     lifecycleHostAsset(),
+    googleMeasurementSandboxAsset(),
     preact({ compat: true }),
     // Astro's file-based router ignores ANY path segment starting with "_" (see
     // `astro/dist/core/routing/create-manifest.js`), so a page literally named

package/apps/storefront/integrations/google-measurement-sandbox-asset.mjs

@@ -0,0 +1,97 @@
+/** Emit the reviewed GA4 runtime as one import-free, CSP-hashed static document. */
+import { createHash } from "node:crypto";
+import { mkdir, writeFile } from "node:fs/promises";
+import { createRequire } from "node:module";
+import { dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import {
+  NATIVE_GA4_SANDBOX_ASSET_PATH,
+} from "@tot/public-runtime/integration/native-ga4-sandbox-asset";
+
+const SANDBOX_ENTRY = fileURLToPath(new URL(
+  "../../../packages/public-runtime/src/integration/native-ga4-sandbox-entry.ts",
+  import.meta.url,
+));
+
+export async function bundleGoogleMeasurementSandboxScript() {
+  const require = createRequire(import.meta.url);
+  const esbuild = createRequire(require.resolve("astro/package.json"))("esbuild");
+  const result = await esbuild.build({
+    entryPoints: [SANDBOX_ENTRY],
+    bundle: true,
+    write: false,
+    metafile: true,
+    format: "iife",
+    platform: "browser",
+    target: "es2022",
+    minify: true,
+    treeShaking: true,
+    legalComments: "none",
+    sourcemap: false,
+    logLevel: "silent",
+  });
+  if (result.outputFiles.length !== 1) {
+    throw new Error(`GA4 sandbox emitted ${result.outputFiles.length} files; expected one.`);
+  }
+  for (const output of Object.values(result.metafile.outputs)) {
+    if ((output.imports ?? []).length > 0) throw new Error("GA4 sandbox must be import-free.");
+  }
+  const code = result.outputFiles[0].text.trim();
+  if (/<\/script/i.test(code)) throw new Error("GA4 sandbox bundle contains a closing script token.");
+  return code;
+}
+
+export function googleMeasurementSandboxCsp(code) {
+  const hash = createHash("sha256").update(code).digest("base64");
+  const script = `'sha256-${hash}' https://www.googletagmanager.com`;
+  return [
+    "default-src 'none'",
+    "base-uri 'none'",
+    "object-src 'none'",
+    "form-action 'none'",
+    "frame-src 'none'",
+    "worker-src 'none'",
+    `script-src ${script}`,
+    `script-src-elem ${script}`,
+    "img-src https://*.google-analytics.com https://www.googletagmanager.com",
+    "connect-src https://*.google-analytics.com https://*.analytics.google.com https://www.googletagmanager.com",
+  ].join("; ");
+}
+
+export async function buildGoogleMeasurementSandboxHtml() {
+  const code = await bundleGoogleMeasurementSandboxScript();
+  const csp = googleMeasurementSandboxCsp(code);
+  return `<!doctype html>\n<meta charset="utf-8">\n<meta http-equiv="Content-Security-Policy" content="${csp}">\n<title>Analytics transport</title>\n<script>${code}</script>\n`;
+}
+
+export function googleMeasurementSandboxAsset() {
+  let clientDir = null;
+  return {
+    name: "tot-google-measurement-sandbox-asset",
+    hooks: {
+      "astro:config:done": ({ config }) => { clientDir = config.build.client; },
+      "astro:server:setup": ({ server }) => {
+        server.middlewares.use((req, res, next) => {
+          const path = (req.url ?? "").split("?")[0];
+          if (path !== `/${NATIVE_GA4_SANDBOX_ASSET_PATH}`) return next();
+          buildGoogleMeasurementSandboxHtml().then(
+            (html) => {
+              res.setHeader("content-type", "text/html; charset=utf-8");
+              res.setHeader("cache-control", "no-store");
+              res.end(html);
+            },
+            (error) => next(error),
+          );
+        });
+      },
+      "astro:build:done": async ({ logger }) => {
+        if (!clientDir) throw new Error("the GA4 sandbox has no resolved client output dir");
+        const html = await buildGoogleMeasurementSandboxHtml();
+        const target = fileURLToPath(new URL(NATIVE_GA4_SANDBOX_ASSET_PATH, clientDir));
+        await mkdir(dirname(target), { recursive: true });
+        await writeFile(target, html, "utf8");
+        logger.info(`GA4 sandbox → /${NATIVE_GA4_SANDBOX_ASSET_PATH} (${html.length} bytes)`);
+      },
+    },
+  };
+}

package/apps/storefront/public/platform/google-measurement/v2/entry.mjs

@@ -0,0 +1,13 @@
+/** Reviewed parent-side marker for the null-origin GA4 platform adapter. */
+export const platformAdapterEntry = Object.freeze({
+  schemaVersion: 1,
+  origin: "platform-adapter",
+  executionTier: "platform-adapter",
+  appId: "platform.google-measurement",
+  version: "1.0.0",
+  entry: Object.freeze({
+    url: "/platform/google-measurement/v2/entry.mjs",
+    format: "module",
+  }),
+  runtime: "native-ga4-v2",
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.0.29",
+  "version": "2.0.31",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/package.json

@@ -10,7 +10,8 @@
   "exports": {
     ".": "./src/index.ts",
     "./blog-visibility": "./src/blog-visibility.mjs",
-    "./integration/lifecycle-host-asset": "./src/integration/lifecycle-host-asset.mjs"
+    "./integration/lifecycle-host-asset": "./src/integration/lifecycle-host-asset.mjs",
+    "./integration/native-ga4-sandbox-asset": "./src/integration/native-ga4-sandbox-asset.mjs"
   },
   "scripts": {
     "typecheck": "tsc --noEmit",

package/packages/public-runtime/src/integration/contact-sales-action-source.ts

@@ -0,0 +1,75 @@
+/**
+ * The platform-owned browser binding for the two reviewed contact-sales CTAs.
+ *
+ * This is deliberately not a general interaction adapter. Both DOM identifiers and
+ * the emitted semantic name are fixed below; the source reads no labels, URLs,
+ * selectors supplied by a caller, event detail, or arbitrary DOM data.
+ */
+import type { PlatformManagedActionActivation, PlatformManagedActionSource } from "./managed-analytics-bridge.js";
+
+/** The only reviewed CTA identities that may raise this marketing action. */
+export const CONTACT_SALES_ACTION_SOURCES = [
+  { ctaId: "cta-book-demo", logicalId: "contact-sales-book-demo" },
+  { ctaId: "contact-sales", logicalId: "contact-sales-lower" },
+] as const;
+
+const CONTACT_SALES_ACTION_NAME = "user_clicked_contact_sales_mktg" as const;
+const CORRELATION_TTL_MS = 60 * 60 * 1000;
+
+export interface ContactSalesActionElement {
+  addEventListener(type: "click", listener: () => void): void;
+  removeEventListener(type: "click", listener: () => void): void;
+}
+
+/** The narrow DOM seam used only to find the two fixed platform CTA identities. */
+export interface ContactSalesActionDocument {
+  querySelectorAll(selector: string): ArrayLike<ContactSalesActionElement>;
+}
+
+export interface ContactSalesActionSourceOptions {
+  document?: ContactSalesActionDocument;
+  planRevision: string;
+  now?: () => number;
+}
+
+/**
+ * Bind literal `data-cta-id` values to a typed source for the managed-analytics
+ * bridge. A keyboard activation of an anchor/button produces its native `click`, so
+ * it follows this same semantic path without a separate key listener.
+ */
+export function createContactSalesActionSource(
+  options: ContactSalesActionSourceOptions,
+): PlatformManagedActionSource {
+  const document = options.document;
+  const now = options.now ?? Date.now;
+  let sequence = 0;
+
+  return {
+    subscribe(listener) {
+      if (!document || typeof document.querySelectorAll !== "function") return () => {};
+      const removals: Array<() => void> = [];
+      for (const source of CONTACT_SALES_ACTION_SOURCES) {
+        const nodes = document.querySelectorAll(`[data-cta-id="${source.ctaId}"]`);
+        for (const node of Array.from(nodes)) {
+          const emit = (): void => {
+            sequence += 1;
+            const at = now();
+            const activation: PlatformManagedActionActivation = {
+              logicalId: `${source.logicalId}-${options.planRevision}-${sequence}`,
+              name: CONTACT_SALES_ACTION_NAME,
+              correlation: {
+                id: `contact-sales-${options.planRevision}`,
+                expiresAt: new Date(at + CORRELATION_TTL_MS).toISOString(),
+              },
+              sequence,
+            };
+            listener(activation);
+          };
+          node.addEventListener("click", emit);
+          removals.push(() => node.removeEventListener("click", emit));
+        }
+      }
+      return () => removals.splice(0).forEach((remove) => remove());
+    },
+  };
+}

package/packages/public-runtime/src/integration/csp-compiler.ts

@@ -63,12 +63,9 @@ export const INTEGRATION_CSP_PROFILES: Readonly<Record<string, CspSourceSet>> =
     "connect-src": ["https://cdn.usefathom.com"],
   },
 
-  // Native Google Analytics / Ads measurement. The adapter sends reviewed event
-  // payloads only to Google's measurement endpoints; it does not load a remote
-  // browser container. Every origin is exact and platform-owned.
-  "google-measurement": {
-    "connect-src": ["https://www.google-analytics.com"],
-  },
+  // Google code and network authority live only in the null-origin sandbox. The
+  // parent needs no addition: base frame-src 'self' admits the versioned host.
+  "google-measurement": {},
 
   // Meta pixel (fbevents.js). The loader is served from connect.facebook.net; the
   // pixel's collect endpoint is the facebook.com tracking origin. The tenant

package/packages/public-runtime/src/integration/events.ts

@@ -56,7 +56,10 @@ import {
 import { INTEGRATION_ENVIRONMENTS, INTEGRATION_SITE_SURFACES } from "./environment.js";
 import type { IntegrationEnvironment, IntegrationSiteSurface } from "./environment.js";
 import { findForbiddenFields } from "./secrets.js";
-import { resemblesManagedAnalyticsPii } from "./managed-analytics-value-safety.js";
+import {
+  resemblesManagedAnalyticsPii,
+  resemblesManagedAnalyticsProtectedValue,
+} from "./managed-analytics-value-safety.js";
 
 /**
  * The reserved commerce event taxonomy. Every accepted type is here; an unknown
@@ -348,9 +351,6 @@ function validateLineItems(parent: Record<string, unknown>, v: Violations, path:
 
 const UTM_FIELDS = ["source", "medium", "campaign", "term", "content"] as const;
 const SAFE_UTM_VALUE = /^[A-Za-z0-9][A-Za-z0-9._~-]{0,127}$/;
-const PROTECTED_ATTRIBUTION_VALUE =
-  /(?:@|\d{7,}|(?:^|[._~-])(?:bearer|password|secret|token|authorization|preview)(?:$|[._~-]))/i;
-
 function validatePageAttribution(parent: Record<string, unknown>, v: Violations): void {
   const attribution = childObject(parent, "attribution", v, "data");
   if (!attribution) return;
@@ -403,7 +403,7 @@ function validatePageAttribution(parent: Record<string, unknown>, v: Violations)
             `UTM ${key} must be a 1-128 character opaque campaign token.`,
           );
         }
-        if (value !== undefined && PROTECTED_ATTRIBUTION_VALUE.test(value)) {
+        if (value !== undefined && resemblesManagedAnalyticsProtectedValue(value)) {
           v.add(
             `data.attribution.utm.${key}`,
             "protected_value",

package/packages/public-runtime/src/integration/index.ts

@@ -58,6 +58,7 @@ export * from "./resolve.js";
 export * from "./platform-adapters.js";
 export * from "./native-amplitude.js";
 export * from "./native-ga4.js";
+export * from "./native-ga4-sandbox.js";
 export * from "./platform-adapter-runtime.js";
 export * from "./render-phases.js";
 export * from "./interim-bridge.js";
@@ -76,6 +77,7 @@ export * from "./events-catalog.js";
 export * from "./commerce-broker.js";
 export * from "./managed-analytics.js";
 export * from "./managed-analytics-bridge.js";
+export * from "./contact-sales-action-source.js";
 export * from "./g2-action-boundary.js";
 export * from "./correlation-token.js";
 export * from "./order-conversion.js";

package/packages/public-runtime/src/integration/lifecycle-boot.ts

@@ -16,11 +16,10 @@
  * constructs bundled platform code with host-owned capabilities. Every other entry goes
  * through the authority-tier loader: it loads ONLY an `elevated-parent` entry (whose
  * honest, review-only contract IS arbitrary parent-document JavaScript) and REFUSES every
- * other tier. A `sandbox`-tier entry —
- * whose contract is a null-origin iframe reachable only through the typed postMessage
- * broker — is refused here and held back until the iframe host that actually isolates
- * it ships, so third-party code labeled "sandboxed" is never executed with the parent
- * authority its label does not grant. Loading is also consent-gated: the binding reads
+ * other tier. A reviewed registry entry may construct its own null-origin iframe and
+ * private typed MessagePort; arbitrary `sandbox`-tier entry modules remain refused by
+ * the parent-realm loader, so their isolation is never silently downgraded. Loading is
+ * also consent-gated: the binding reads
  * the renderer-inlined default-deny consent snapshot and holds a non-essential entry
  * back until its declared purposes are eligible. With an environment-only plan there
  * are no integrations, so the runtime boots inert and ready.
@@ -43,16 +42,24 @@ import type { NavigationCompletedEvent, NavigationKind } from "./events.js";
 import { CommerceEventBroker } from "./commerce-broker.js";
 import { validateBrowserEnvironment, BROWSER_ENVIRONMENT_GLOBAL, type BrowserEnvironment } from "./environment.js";
 import { makePlatformAdapterRuntimeLoader } from "./platform-adapter-runtime.js";
+import { NATIVE_GA4_SANDBOX_URL, type NativeGa4Transport } from "./native-ga4.js";
+import {
+  createBrowserNativeGa4SandboxHost,
+  createNativeGa4SandboxTransport,
+} from "./native-ga4-sandbox.js";
 import { ManagedAnalyticsEventBrokerBridge } from "./managed-analytics-bridge.js";
 import { minimizePageAttribution, type ManagedPageViewInput } from "./managed-analytics.js";
+import {
+  createContactSalesActionSource,
+  type ContactSalesActionDocument,
+} from "./contact-sales-action-source.js";
 
 /** The window property holding the single per-document lifecycle (idempotent boot guard). */
 export const LIFECYCLE_SINGLETON_GLOBAL = "__TOT_INTEGRATION_LIFECYCLE__";
 /**
- * An optional window-published loader the entry-asset layer may install to OVERRIDE the
- * fail-closed same-origin default. It is the seam the null-origin sandboxed-iframe host
- * (the tracked F3 follow-up) installs to actually isolate a `sandbox`-tier entry; until
- * that host ships the seam is unused and the default loader refuses the sandbox tier.
+ * An optional window-published loader the entry-asset layer may install to override the
+ * fail-closed same-origin default. The default loader still refuses sandbox-tier modules;
+ * reviewed platform adapters construct any required isolation through their registry.
  */
 export const LIFECYCLE_MODULE_LOADER_GLOBAL = "__TOT_INTEGRATION_MODULE_LOADER__";
 /** An optional window-published sink for the completed-navigation event. */
@@ -68,7 +75,7 @@ export interface LifecycleWindow {
    * analytics data allowlist accepts no other document state — no title, no DOM, no
    * globals — so this is deliberately the narrowest slice that supports attribution.
    */
-  document?: { referrer?: string };
+  document?: { referrer?: string; querySelectorAll?: ContactSalesActionDocument["querySelectorAll"] };
   [key: string]: unknown;
 }
 
@@ -110,6 +117,8 @@ export interface BootLifecycleOptions {
   fetchCapability?: typeof fetch;
   /** Entry import capability; injectable for tests and non-browser hosts. */
   importModule?: (url: string) => Promise<unknown>;
+  /** Reviewed null-origin GA4 transport; injectable for DOM-free tests. */
+  nativeGa4Transport?: NativeGa4Transport;
 }
 
 /**
@@ -142,11 +151,10 @@ const PARENT_REALM_TIER = "elevated-parent" as const;
  * a hardcoded vendor path. `importModule` is injected so the loader is testable without
  * a live network; it defaults to a native dynamic `import()`.
  *
- * FAIL-CLOSED BY TIER (design-partner finding F3): a parent-realm import gives the entry
+ * FAIL-CLOSED BY TIER: a parent-realm import gives the entry
  * full parent-document authority, so the loader refuses any tier but `elevated-parent`
  * BEFORE importing — a `sandbox`-tier entry throws without ever being fetched or
- * evaluated, so code labeled "sandboxed" cannot run in the parent while its isolating
- * iframe host is still the tracked follow-up. The throw is caught by the runtime's
+ * evaluated, so code labeled "sandboxed" cannot run in the parent. The throw is caught by the runtime's
  * per-integration load isolation: the entry never becomes active, the page is unaffected,
  * and every other integration still boots.
  */
@@ -159,8 +167,8 @@ export function makeSameOriginEntryLoader(
         `Refusing to load "${integration.appId}@${integration.version}" (tier ` +
           `"${integration.executionTier}") into the parent document: the same-origin loader ` +
           `only runs the "${PARENT_REALM_TIER}" tier. A "sandbox"-tier entry must run inside a ` +
-          `null-origin iframe reachable only through the typed postMessage broker; that ` +
-          `isolating host is not yet wired, so the entry is held fail-closed rather than run ` +
+          `null-origin iframe reachable only through a typed MessagePort broker, so the entry ` +
+          `is held fail-closed rather than run ` +
           `with parent-document authority its tier does not grant.`,
       );
     }
@@ -310,6 +318,16 @@ export function bootIntegrationLifecycle(
     fetchCapability: hostFetch,
     importModule: options.importModule,
     fallback: ordinaryLoader,
+    nativeGa4Transport: () => {
+      if (options.nativeGa4Transport) return options.nativeGa4Transport;
+      if (typeof document === "undefined" || typeof MessageChannel === "undefined") {
+        throw new Error("platform_adapter_ga4_sandbox_unavailable");
+      }
+      return createNativeGa4SandboxTransport(
+        createBrowserNativeGa4SandboxHost(document, MessageChannel),
+        NATIVE_GA4_SANDBOX_URL,
+      );
+    },
   });
 
   const isEligible = options.isEligible ?? defaultConsentGate(win);
@@ -337,7 +355,16 @@ export function bootIntegrationLifecycle(
     commerceBroker,
     managedAnalytics: {
       bridge: options.managedAnalyticsBridge ??
-        new ManagedAnalyticsEventBrokerBridge({ broker: commerceBroker }),
+        new ManagedAnalyticsEventBrokerBridge({
+          broker: commerceBroker,
+          actionSource: createContactSalesActionSource({
+            document: typeof win.document?.querySelectorAll === "function"
+              ? win.document as ContactSalesActionDocument
+              : undefined,
+            planRevision: descriptor.planRevision,
+            now: options.now ?? Date.now,
+          }),
+        }),
       pageView: () => documentPageView(win, descriptor, options.now ?? Date.now),
     },
   });

package/packages/public-runtime/src/integration/managed-analytics-value-safety.ts

@@ -2,12 +2,21 @@
 import { MANAGED_ANALYTICS_PII_VALUE_PATTERN } from "./managed-analytics-api-v1-safety.mjs";
 
 const MANAGED_ANALYTICS_PII_VALUE = new RegExp(MANAGED_ANALYTICS_PII_VALUE_PATTERN);
+const MANAGED_ANALYTICS_PROTECTED_VALUE =
+  /(?:@|\d{7,}|(?:^|[./_~-])(?:bearer|password|secret|token|authorization|preview)(?:$|[./_~-]))/i;
 
 /** True when a public string resembles an email, SSN, payment card, or phone number. */
 export function resemblesManagedAnalyticsPii(value: unknown): boolean {
   return typeof value === "string" && MANAGED_ANALYTICS_PII_VALUE.test(value);
 }
 
+/** True when a public value resembles PII or an authentication/protected token. */
+export function resemblesManagedAnalyticsProtectedValue(value: unknown): boolean {
+  return typeof value === "string" && (
+    resemblesManagedAnalyticsPii(value) || MANAGED_ANALYTICS_PROTECTED_VALUE.test(value)
+  );
+}
+
 /** Defense-in-depth for identifiers copied into structured broker observations. */
 export function safeManagedAnalyticsDiagnosticId(value: string): string {
   return resemblesManagedAnalyticsPii(value) ? "[redacted]" : value;

package/packages/public-runtime/src/integration/native-ga4-sandbox-asset.d.mts

@@ -0,0 +1,2 @@
+export const NATIVE_GA4_SANDBOX_ASSET_PATH: "platform/google-measurement/v2/sandbox.html";
+export const NATIVE_GA4_SANDBOX_ASSET_URL: "/platform/google-measurement/v2/sandbox.html";

package/packages/public-runtime/src/integration/native-ga4-sandbox-asset.mjs

@@ -0,0 +1,3 @@
+/** Stable provider-neutral artifact path for the reviewed GA4 null-origin sandbox. */
+export const NATIVE_GA4_SANDBOX_ASSET_PATH = "platform/google-measurement/v2/sandbox.html";
+export const NATIVE_GA4_SANDBOX_ASSET_URL = `/${NATIVE_GA4_SANDBOX_ASSET_PATH}`;

package/packages/public-runtime/src/integration/native-ga4-sandbox-entry.ts

@@ -0,0 +1,207 @@
+/** Runtime bundled inline into the versioned GA4 sandbox HTML. */
+import { APPROVED_MARKETING_ACTION_NAMES } from "./events.js";
+import {
+  NATIVE_GA4_SANDBOX_MAX_DESTINATIONS,
+  NATIVE_GA4_SANDBOX_PROTOCOL,
+  type NativeGa4SandboxPortMessage,
+} from "./native-ga4-sandbox.js";
+import { resemblesManagedAnalyticsProtectedValue } from "./managed-analytics-value-safety.js";
+
+const MEASUREMENT_ID = /^G-[A-Z0-9]{4,20}$/;
+const CAMPAIGN_VALUE = /^[A-Za-z0-9][A-Za-z0-9._~-]{0,127}$/;
+const APPROVED_ACTIONS: ReadonlySet<string> = new Set(APPROVED_MARKETING_ACTION_NAMES);
+
+function plainRecord(value: unknown): Record<string, unknown> | null {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null ? value as Record<string, unknown> : null;
+}
+
+function exactKeys(value: Record<string, unknown>, allowed: readonly string[], required = allowed): boolean {
+  const keys = Object.keys(value);
+  return required.every((key) => keys.includes(key)) && keys.every((key) => allowed.includes(key));
+}
+
+function validOrigin(value: unknown): value is string {
+  if (typeof value !== "string") return false;
+  try {
+    const parsed = new URL(value);
+    return parsed.origin === value && (
+      parsed.protocol === "https:" ||
+      (parsed.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(parsed.hostname))
+    );
+  } catch { return false; }
+}
+
+function validPath(value: unknown): value is string {
+  return typeof value === "string" && value.startsWith("/") && !value.startsWith("//") &&
+    !value.includes("\\") && !value.includes("?") && !value.includes("#") &&
+    !resemblesManagedAnalyticsProtectedValue(value);
+}
+
+function validIds(value: unknown): value is string[] {
+  return Array.isArray(value) && value.length > 0 && value.length <= NATIVE_GA4_SANDBOX_MAX_DESTINATIONS &&
+    value.every((id) => typeof id === "string" && MEASUREMENT_ID.test(id)) && new Set(value).size === value.length;
+}
+
+function validCampaign(value: unknown): value is Record<string, string> {
+  const record = plainRecord(value);
+  if (!record || !exactKeys(record, ["source", "medium", "campaign", "term", "content"], [])) return false;
+  return Object.values(record).every((item) =>
+    typeof item === "string" && CAMPAIGN_VALUE.test(item) && !resemblesManagedAnalyticsProtectedValue(item));
+}
+
+export interface NativeGa4SandboxRuntimeWindow extends Pick<Window, "parent" | "location"> {
+  addEventListener(type: "message", listener: (event: MessageEvent) => void): void;
+  removeEventListener(type: "message", listener: (event: MessageEvent) => void): void;
+  dataLayer?: unknown[];
+  gtag?: (...args: unknown[]) => void;
+}
+
+export function startNativeGa4Sandbox(win: NativeGa4SandboxRuntimeWindow, doc: Document): void {
+  let bound = false;
+
+  const bind = (event: MessageEvent): void => {
+    try {
+      const data = plainRecord(event.data);
+      const ownOrigin = new URL(win.location.href).origin;
+      if (
+        bound || event.source !== win.parent || event.origin !== ownOrigin || event.ports.length !== 1 ||
+        !data || !exactKeys(data, ["protocol", "type"]) ||
+        data["protocol"] !== NATIVE_GA4_SANDBOX_PROTOCOL || data["type"] !== "bind"
+      ) return;
+      bound = true;
+      win.removeEventListener("message", bind);
+      runPort(event.ports[0]!, win, doc);
+    } catch {
+      // Hostile window messages fail closed without exposing an oracle.
+    }
+  };
+
+  win.addEventListener("message", bind);
+}
+
+function runPort(port: MessagePort, win: NativeGa4SandboxRuntimeWindow, doc: Document): void {
+  let active = false;
+  let disposed = false;
+  let canonicalOrigin = "";
+  let currentGroup = "";
+  let lastPageLocation = "";
+  let generation = 0;
+  let tagLoaded = false;
+
+  const dataLayer: unknown[] = [];
+  const gtag = function(..._args: unknown[]): void {
+    dataLayer.push(arguments);
+  };
+  win.dataLayer = dataLayer;
+  win.gtag = gtag;
+
+  const configure = (message: Record<string, unknown>): void => {
+    if (
+      !exactKeys(message, ["schemaVersion", "type", "destinationIds", "canonicalOrigin"]) ||
+      message["schemaVersion"] !== 1 || message["type"] !== "configure" ||
+      !validIds(message["destinationIds"]) || !validOrigin(message["canonicalOrigin"])
+    ) return;
+    const ids = message["destinationIds"];
+    canonicalOrigin = message["canonicalOrigin"];
+    currentGroup = `tot_storefront_${++generation}`;
+    lastPageLocation = "";
+    active = true;
+
+    if (!tagLoaded) {
+      tagLoaded = true;
+      gtag("consent", "default", {
+        analytics_storage: "denied",
+        ad_storage: "denied",
+        ad_user_data: "denied",
+        ad_personalization: "denied",
+      });
+      gtag("js", new Date());
+    }
+    for (const id of ids) {
+      gtag("config", id, {
+        groups: currentGroup,
+        send_page_view: false,
+        allow_google_signals: false,
+        allow_ad_personalization_signals: false,
+        restricted_data_processing: true,
+        ignore_referrer: true,
+      });
+    }
+    if (doc.querySelector('script[data-tot-ga4="1"]') === null) {
+      const script = doc.createElement("script");
+      script.async = true;
+      script.src = `https://www.googletagmanager.com/gtag/js?id=${encodeURIComponent(ids[0]!)}`;
+      script.setAttribute("data-tot-ga4", "1");
+      doc.head.append(script);
+    }
+  };
+
+  const deliver = (message: Record<string, unknown>): void => {
+    if (!active || disposed || message["schemaVersion"] !== 1) return;
+    if (message["type"] === "page_view") {
+      if (!exactKeys(message, ["schemaVersion", "type", "path", "referrerOrigin", "campaign"], ["schemaVersion", "type", "path"])) return;
+      if (!validPath(message["path"])) return;
+      if (message["referrerOrigin"] !== undefined && !validOrigin(message["referrerOrigin"])) return;
+      if (message["campaign"] !== undefined && !validCampaign(message["campaign"])) return;
+      const pageLocation = `${canonicalOrigin}${message["path"]}`;
+      lastPageLocation = pageLocation;
+      const params: Record<string, unknown> = {
+        send_to: currentGroup,
+        page_location: pageLocation,
+        page_path: message["path"],
+      };
+      if (message["referrerOrigin"] !== undefined) params["page_referrer"] = message["referrerOrigin"];
+      if (message["campaign"] !== undefined) {
+        const campaign = message["campaign"] as Record<string, string>;
+        for (const key of ["source", "medium", "campaign", "term", "content"] as const) {
+          const ga4Key = key === "campaign" ? "name" : key;
+          if (campaign[key] !== undefined) params[`campaign_${ga4Key}`] = campaign[key];
+        }
+      }
+      gtag("event", "page_view", params);
+      return;
+    }
+    if (message["type"] === "action") {
+      if (!exactKeys(message, ["schemaVersion", "type", "name", "pageLocation"])) return;
+      if (
+        typeof message["name"] !== "string" || !APPROVED_ACTIONS.has(message["name"]) ||
+        message["pageLocation"] !== lastPageLocation || !lastPageLocation
+      ) return;
+      gtag("event", message["name"], { send_to: currentGroup, page_location: lastPageLocation });
+    }
+  };
+
+  port.onmessage = (event: MessageEvent<NativeGa4SandboxPortMessage>) => {
+    try {
+      const message = plainRecord(event.data);
+      if (!message || disposed) return;
+      if (message["type"] === "configure") return configure(message);
+      if (message["type"] === "disable") {
+        if (exactKeys(message, ["schemaVersion", "type"]) && message["schemaVersion"] === 1) {
+          active = false;
+          lastPageLocation = "";
+        }
+        return;
+      }
+      if (message["type"] === "dispose") {
+        if (exactKeys(message, ["schemaVersion", "type"]) && message["schemaVersion"] === 1) {
+          active = false;
+          disposed = true;
+          lastPageLocation = "";
+          port.close();
+        }
+        return;
+      }
+      deliver(message);
+    } catch {
+      // Every malformed port message fails closed without exposing an oracle.
+    }
+  };
+  port.start();
+}
+
+if (typeof window !== "undefined" && typeof document !== "undefined") {
+  startNativeGa4Sandbox(window, document);
+}