@tokenoftrust/storefront-runner 2.0.29 → 2.0.31

package/packages/public-runtime/src/integration/native-ga4-sandbox.ts

@@ -0,0 +1,168 @@
+/** Closed parent/iframe protocol for the reviewed GA4 null-origin sandbox. */
+export const NATIVE_GA4_SANDBOX_PROTOCOL = "tot.ga4-sandbox/1" as const;
+export const NATIVE_GA4_SANDBOX_MAX_DESTINATIONS = 4 as const;
+
+export interface NativeGa4SandboxConfig {
+  schemaVersion: 1;
+  destinationIds: string[];
+  canonicalOrigin: string;
+}
+
+export interface NativeGa4PageViewCommand {
+  schemaVersion: 1;
+  type: "page_view";
+  path: string;
+  referrerOrigin?: string;
+  campaign?: {
+    source?: string;
+    medium?: string;
+    campaign?: string;
+    term?: string;
+    content?: string;
+  };
+}
+
+export interface NativeGa4ActionCommand {
+  schemaVersion: 1;
+  type: "action";
+  name: string;
+  pageLocation: string;
+}
+
+export type NativeGa4SandboxCommand = NativeGa4PageViewCommand | NativeGa4ActionCommand;
+
+export type NativeGa4SandboxPortMessage =
+  | ({ type: "configure" } & NativeGa4SandboxConfig)
+  | NativeGa4SandboxCommand
+  | { schemaVersion: 1; type: "disable" }
+  | { schemaVersion: 1; type: "dispose" };
+
+export interface NativeGa4MessagePort {
+  postMessage(message: NativeGa4SandboxPortMessage): void;
+  close(): void;
+}
+
+export interface NativeGa4SandboxFrame {
+  contentWindow: { postMessage(message: unknown, targetOrigin: string, transfer: Transferable[]): void } | null;
+  setAttribute(name: string, value: string): void;
+  addEventListener(type: "load" | "error", listener: () => void, options?: { once?: boolean }): void;
+  remove(): void;
+  src: string;
+  hidden: boolean;
+}
+
+export interface NativeGa4SandboxHost {
+  createFrame(): NativeGa4SandboxFrame;
+  appendFrame(frame: NativeGa4SandboxFrame): void;
+  createChannel(): { port1: NativeGa4MessagePort; port2: Transferable };
+  setTimer(callback: () => void, milliseconds: number): unknown;
+  clearTimer(handle: unknown): void;
+}
+
+export interface NativeGa4SandboxTransport {
+  configure(config: NativeGa4SandboxConfig): void;
+  send(command: NativeGa4SandboxCommand): void;
+  disable(): void;
+  dispose(): void;
+}
+
+export function createBrowserNativeGa4SandboxHost(
+  doc: Document,
+  messageChannel: typeof MessageChannel,
+): NativeGa4SandboxHost {
+  return {
+    createFrame: () => doc.createElement("iframe"),
+    appendFrame: (frame) => (doc.body ?? doc.documentElement).append(frame as HTMLIFrameElement),
+    createChannel: () => new messageChannel(),
+    setTimer: (callback, milliseconds) => globalThis.setTimeout(callback, milliseconds),
+    clearTimer: (handle) => globalThis.clearTimeout(handle as ReturnType<typeof setTimeout>),
+  };
+}
+
+/**
+ * Mount one hidden same-origin iframe and transfer exactly one MessagePort after load.
+ * The wildcard target is required because `allow-scripts` without `allow-same-origin`
+ * gives the receiver an opaque origin; the exact iframe window and one-shot transfer
+ * are the authority boundary. No general parent `message` listener is installed.
+ */
+export function createNativeGa4SandboxTransport(
+  host: NativeGa4SandboxHost,
+  sandboxUrl: string,
+): NativeGa4SandboxTransport {
+  const frame = host.createFrame();
+  frame.setAttribute("sandbox", "allow-scripts");
+  frame.setAttribute("referrerpolicy", "no-referrer");
+  frame.setAttribute("aria-hidden", "true");
+  frame.setAttribute("tabindex", "-1");
+  frame.setAttribute("title", "Analytics transport");
+  frame.hidden = true;
+  frame.src = sandboxUrl;
+
+  let port: NativeGa4MessagePort | null = null;
+  let disposed = false;
+  let unavailable = false;
+  let queue: NativeGa4SandboxPortMessage[] = [];
+  let timer: unknown;
+
+  const reject = (): void => {
+    unavailable = true;
+    queue = [];
+    host.clearTimer(timer);
+    frame.remove();
+  };
+
+  frame.addEventListener("load", () => {
+    if (disposed || port) return;
+    const target = frame.contentWindow;
+    if (!target) return reject();
+    const channel = host.createChannel();
+    port = channel.port1;
+    try {
+      target.postMessage(
+        Object.freeze({ protocol: NATIVE_GA4_SANDBOX_PROTOCOL, type: "bind" }),
+        "*",
+        [channel.port2],
+      );
+    } catch {
+      port.close();
+      port = null;
+      return reject();
+    }
+    host.clearTimer(timer);
+    const pending = queue;
+    queue = [];
+    for (const message of pending) port.postMessage(Object.freeze(message));
+  }, { once: true });
+  frame.addEventListener("error", reject, { once: true });
+  timer = host.setTimer(reject, 5_000);
+  host.appendFrame(frame);
+
+  const post = (message: NativeGa4SandboxPortMessage): void => {
+    if (disposed || unavailable) throw new Error("ga4_sandbox_unavailable");
+    if (!port) queue.push(message);
+    else port.postMessage(Object.freeze(message));
+  };
+
+  return {
+    configure(config) { post({ ...config, type: "configure" }); },
+    send(command) { post(command); },
+    disable() {
+      if (disposed || unavailable) return;
+      if (!port) queue = [];
+      post({ schemaVersion: 1, type: "disable" });
+    },
+    dispose() {
+      if (disposed) return;
+      if (port) {
+        post({ schemaVersion: 1, type: "dispose" });
+        port.close();
+      } else {
+        queue = [];
+      }
+      port = null;
+      disposed = true;
+      host.clearTimer(timer);
+      frame.remove();
+    },
+  };
+}

package/packages/public-runtime/src/integration/native-ga4.ts

@@ -1,19 +1,13 @@
 /**
  * Storefront-owned GA4 browser adapter.
  *
- * The adapter consumes only the manually-authored page/action events exposed by the
- * scoped lifecycle subscription. It does not load vendor code, inspect the document,
- * or persist browser identity. A reviewed direct POST sends a closed, anonymous
- * payload to one exact collection origin after the shared broker has applied consent
- * and logical-event dedupe.
- *
- * A stage may configure SEVERAL measurement ids (a primary plus a rollup). GA4 has no
- * multi-property hit — `tid` names exactly one measurement id — so one logical event
- * becomes one POST per id, identical but for `tid`. The fan-out sits below the broker's
- * dedupe, so a logical action is still measured exactly once per property.
+ * The adapter consumes only manually-authored page/action events from the scoped
+ * lifecycle subscription. It never loads Google code into the regulated parent.
+ * Instead, a closed command crosses one private MessagePort into the reviewed,
+ * null-origin GA4 sandbox after consent and logical-event dedupe have passed.
  */
 import type { IntegrationLifecycleContext, IntegrationLifecycleModule, LifecycleUpdateReason } from "./lifecycle.js";
-import type { CommerceEvent, CommerceEventType } from "./events.js";
+import type { CommerceEventType } from "./events.js";
 import { APPROVED_MARKETING_ACTION_NAMES, validateCommerceEvent } from "./events.js";
 import { isPurposeEligible, parseConsentSnapshot } from "./consent-broker.js";
 import {
@@ -22,13 +16,17 @@ import {
   resolveAdapterDestinationIds,
 } from "./platform-adapters.js";
 import { INTEGRATION_ENVIRONMENTS, type IntegrationEnvironment } from "./environment.js";
-import { resemblesManagedAnalyticsPii } from "./managed-analytics-value-safety.js";
-
-export const GA4_COLLECTION_ORIGIN = "https://www.google-analytics.com" as const;
-export const GA4_COLLECTION_ENDPOINT = `${GA4_COLLECTION_ORIGIN}/g/collect` as const;
-export const NATIVE_GA4_ENTRY_URL = "/platform/google-measurement/v1/entry.mjs" as const;
+import { resemblesManagedAnalyticsProtectedValue } from "./managed-analytics-value-safety.js";
+import type {
+  NativeGa4SandboxCommand,
+  NativeGa4SandboxConfig,
+} from "./native-ga4-sandbox.js";
+import { NATIVE_GA4_SANDBOX_ASSET_URL } from "./native-ga4-sandbox-asset.mjs";
+
+export const NATIVE_GA4_ENTRY_URL = "/platform/google-measurement/v2/entry.mjs" as const;
+export const NATIVE_GA4_SANDBOX_URL = NATIVE_GA4_SANDBOX_ASSET_URL;
 export const NATIVE_GA4_ADAPTER_VERSION = "1.0.0" as const;
-export const NATIVE_GA4_RUNTIME_ID = "native-ga4-v1" as const;
+export const NATIVE_GA4_RUNTIME_ID = "native-ga4-v2" as const;
 
 export const NATIVE_GA4_EVENT_TYPES = Object.freeze([
   "storefront.page.viewed.v1",
@@ -38,9 +36,7 @@ export const NATIVE_GA4_EVENT_TYPES = Object.freeze([
 
 const NATIVE_GA4_EVENT_SET: ReadonlySet<string> = new Set(NATIVE_GA4_EVENT_TYPES);
 const APPROVED_ACTION_SET: ReadonlySet<string> = new Set(APPROVED_MARKETING_ACTION_NAMES);
-const CONFIG_KEYS: ReadonlySet<string> = new Set(
-  INTEGRATION_ENVIRONMENTS.map(destinationIdConfigKey),
-);
+const CONFIG_KEYS: ReadonlySet<string> = new Set(INTEGRATION_ENVIRONMENTS.map(destinationIdConfigKey));
 
 export type NativeGa4DiagnosticCode =
   | "configuration_invalid"
@@ -50,62 +46,45 @@ export type NativeGa4DiagnosticCode =
   | "teardown_failed"
   | "transport_failed";
 
-export interface NativeGa4Observation {
-  code: NativeGa4DiagnosticCode;
-}
+export interface NativeGa4Observation { code: NativeGa4DiagnosticCode }
 
-export interface NativeGa4CollectRequest {
-  endpoint: typeof GA4_COLLECTION_ENDPOINT;
-  /** Closed GA4 request body. Values are anonymous strings, never raw event envelopes. */
-  fields: Readonly<Record<string, string>>;
+export interface NativeGa4Transport {
+  send(command: NativeGa4SandboxCommand): void | Promise<void>;
+  configure?(config: NativeGa4SandboxConfig): void | Promise<void>;
+  disable?(): void | Promise<void>;
+  dispose?(): void | Promise<void>;
 }
-
-export type NativeGa4Transport = (
-  request: NativeGa4CollectRequest,
-) => void | Promise<void>;
+export type NativeGa4TransportSend = (command: NativeGa4SandboxCommand) => void | Promise<void>;
 
 export type NativeGa4Observer = (observation: NativeGa4Observation) => void;
 
 export interface NativeGa4ModuleOptions {
-  transport: NativeGa4Transport;
+  transport: NativeGa4Transport | NativeGa4TransportSend;
   observe?: NativeGa4Observer;
 }
 
 interface ActiveGa4Config {
-  /** Every measurement id this stage collects to, in configured order. */
   destinationIds: readonly string[];
   environment: IntegrationEnvironment;
   siteSurface: IntegrationLifecycleContext["environment"]["siteSurface"];
+  canonicalOrigin: string;
 }
 
 function observeSafely(observer: NativeGa4Observer | undefined, code: NativeGa4DiagnosticCode): void {
-  try {
-    observer?.(Object.freeze({ code }));
-  } catch {
-    // Diagnostics are fail-soft and carry no exception text or payload.
-  }
+  try { observer?.(Object.freeze({ code })); } catch { /* diagnostics are fail-soft */ }
 }
 
 function configuredFor(ctx: IntegrationLifecycleContext): ActiveGa4Config | null {
-  if (ctx.appId !== GOOGLE_MEASUREMENT_ADAPTER.adapterId) return null;
-  if (!hasAnalyticsConsent(ctx)) return null;
-
-  for (const key of Object.keys(ctx.config)) {
-    if (!CONFIG_KEYS.has(key)) return null;
-  }
+  if (ctx.appId !== GOOGLE_MEASUREMENT_ADAPTER.adapterId || !hasAnalyticsConsent(ctx)) return null;
+  for (const key of Object.keys(ctx.config)) if (!CONFIG_KEYS.has(key)) return null;
 
-  // Every stage present must decode to a valid, in-cap set, and no non-live stage may
-  // reuse ANY live id — checked across the whole config, not just the active stage, so a
-  // misconfigured neighbour resolves the entire integration to nothing rather than
-  // collecting from a page whose other stages would leak.
   const liveIds = resolveAdapterDestinationIds(GOOGLE_MEASUREMENT_ADAPTER, ctx.config, "live");
   if (liveIds.length === 0) return null;
   const live = new Set(liveIds);
   for (const environment of INTEGRATION_ENVIRONMENTS) {
     if (ctx.config[destinationIdConfigKey(environment)] === undefined) continue;
     const ids = resolveAdapterDestinationIds(GOOGLE_MEASUREMENT_ADAPTER, ctx.config, environment);
-    if (ids.length === 0) return null;
-    if (environment !== "live" && ids.some((id) => live.has(id))) return null;
+    if (ids.length === 0 || (environment !== "live" && ids.some((id) => live.has(id)))) return null;
   }
 
   const destinationIds = resolveAdapterDestinationIds(
@@ -113,11 +92,16 @@ function configuredFor(ctx: IntegrationLifecycleContext): ActiveGa4Config | null
     ctx.config,
     ctx.environment.environment,
   );
-  if (destinationIds.length === 0) return null;
+  const canonicalHost = ctx.environment.canonicalHost;
+  if (
+    destinationIds.length === 0 || typeof canonicalHost !== "string" || canonicalHost.length === 0 ||
+    canonicalHost.includes("/") || canonicalHost.includes("?") || canonicalHost.includes("#")
+  ) return null;
   return {
     destinationIds,
     environment: ctx.environment.environment,
     siteSurface: ctx.environment.siteSurface,
+    canonicalOrigin: `https://${canonicalHost}`,
   };
 }
 
@@ -126,108 +110,96 @@ function hasAnalyticsConsent(ctx: IntegrationLifecycleContext): boolean {
   return consent !== null && isPurposeEligible(consent, "analytics");
 }
 
-function fnv1a32(value: string): number {
-  let hash = 0x811c9dc5;
-  for (let index = 0; index < value.length; index += 1) {
-    const code = value.charCodeAt(index);
-    hash = Math.imul(hash ^ (code & 0xff), 0x01000193);
-    hash = Math.imul(hash ^ ((code >> 8) & 0xff), 0x01000193);
-  }
-  return hash >>> 0;
-}
-
-/** GA4 requires a client id. Derive an opaque document/session value without storage. */
-function anonymousClientId(event: CommerceEvent): string {
-  const high = fnv1a32(`ga4:${event.correlation.id}`);
-  const low = fnv1a32(`ga4:${event.correlation.expiresAt}`);
-  return `ga4.${high.toString(16)}.${low.toString(16)}`;
-}
-
 function exactKeys(value: Record<string, unknown>, allowed: readonly string[]): boolean {
   const actual = Object.keys(value);
   return actual.length <= allowed.length && actual.every((key) => allowed.includes(key));
 }
 
-/**
- * Build the collect requests one event becomes — ONE per configured measurement id.
- *
- * GA4 has no multi-property hit: `tid` names exactly one measurement id, so reaching a
- * primary and a rollup means repeating the same closed payload with a different `tid`.
- * Returns an empty list when the event does not map, so a caller cannot mistake "not
- * measured" for "measured once".
- */
-function mapEvent(config: ActiveGa4Config, input: unknown): NativeGa4CollectRequest[] {
+function safePagePath(value: unknown): value is string {
+  return typeof value === "string" && value.startsWith("/") && !value.startsWith("//") &&
+    !value.includes("\\") && !value.includes("?") && !value.includes("#") &&
+    !resemblesManagedAnalyticsProtectedValue(value);
+}
+
+function mapEvent(
+  config: ActiveGa4Config,
+  input: unknown,
+  currentPageLocation: string | null,
+): NativeGa4SandboxCommand | null {
   const validated = validateCommerceEvent(input);
-  if (!validated.ok) return [];
+  if (!validated.ok) return null;
   const event = validated.value;
-  if (!NATIVE_GA4_EVENT_SET.has(event.type)) return [];
-  if (event.storefront.emitter !== "browser") return [];
-  if (event.storefront.environment !== config.environment) return [];
-  if (event.storefront.siteSurface !== config.siteSurface) return [];
-  if (!event.consent.eligiblePurposes.includes("analytics")) return [];
-
-  // `tid` is the one field that differs between the fan-out requests; it is added per
-  // destination below.
-  const fields: Record<string, string> = {
-    v: "2",
-    cid: anonymousClientId(event),
-  };
+  if (
+    !NATIVE_GA4_EVENT_SET.has(event.type) || event.storefront.emitter !== "browser" ||
+    event.storefront.environment !== config.environment || event.storefront.siteSurface !== config.siteSurface ||
+    !event.consent.eligiblePurposes.includes("analytics")
+  ) return null;
 
   if (event.type === "storefront.page.viewed.v1") {
-    if (!exactKeys(event.data, ["path"]) || typeof event.data["path"] !== "string") return [];
-    fields["en"] = "page_view";
-    fields["ep.page_path"] = event.data["path"];
-  } else if (event.type === "storefront.page.viewed.v2") {
-    if (!exactKeys(event.data, ["path", "attribution"]) || typeof event.data["path"] !== "string") return [];
-    fields["en"] = "page_view";
-    fields["ep.page_path"] = event.data["path"];
+    if (!exactKeys(event.data, ["path"]) || !safePagePath(event.data["path"])) return null;
+    return Object.freeze({ schemaVersion: 1, type: "page_view", path: event.data["path"] });
+  }
+
+  if (event.type === "storefront.page.viewed.v2") {
+    if (!exactKeys(event.data, ["path", "attribution"]) || !safePagePath(event.data["path"])) return null;
+    const command: {
+      schemaVersion: 1; type: "page_view"; path: string; referrerOrigin?: string;
+      campaign?: { source?: string; medium?: string; campaign?: string; term?: string; content?: string };
+    } = { schemaVersion: 1, type: "page_view", path: event.data["path"] };
     const attribution = event.data["attribution"];
     if (typeof attribution === "object" && attribution !== null && !Array.isArray(attribution)) {
       const record = attribution as Record<string, unknown>;
       const referrer = record["referrer"];
       if (typeof referrer === "object" && referrer !== null && !Array.isArray(referrer)) {
         const origin = (referrer as Record<string, unknown>)["origin"];
-        if (typeof origin === "string") fields["ep.referrer_origin"] = origin;
+        if (typeof origin === "string") command.referrerOrigin = origin;
       }
       const utm = record["utm"];
       if (typeof utm === "object" && utm !== null && !Array.isArray(utm)) {
+        const campaign: NonNullable<typeof command.campaign> = {};
         for (const key of ["source", "medium", "campaign", "term", "content"] as const) {
           const value = (utm as Record<string, unknown>)[key];
-          if (typeof value === "string") fields[`ep.utm_${key}`] = value;
+          if (typeof value === "string" && !resemblesManagedAnalyticsProtectedValue(value)) campaign[key] = value;
         }
+        if (Object.keys(campaign).length > 0) command.campaign = campaign;
       }
     }
-  } else {
-    if (!exactKeys(event.data, ["name"])) return [];
-    const name = event.data["name"];
-    if (typeof name !== "string" || !APPROVED_ACTION_SET.has(name)) return [];
-    fields["en"] = name;
+    return Object.freeze(command);
   }
 
-  return config.destinationIds.map((tid) => Object.freeze({
-    endpoint: GA4_COLLECTION_ENDPOINT,
-    fields: Object.freeze({ ...fields, tid }),
-  }));
+  if (!exactKeys(event.data, ["name"])) return null;
+  const name = event.data["name"];
+  if (typeof name !== "string" || !APPROVED_ACTION_SET.has(name) || !currentPageLocation) return null;
+  return Object.freeze({ schemaVersion: 1, type: "action", name, pageLocation: currentPageLocation });
 }
 
-/**
- * Build the lifecycle entry module used by the platform-owned GA4 asset. The host
- * supplies fetch as a capability; this module never reaches through a browser global.
- */
 export function createNativeGa4Module(options: NativeGa4ModuleOptions): IntegrationLifecycleModule {
   let unsubscribe: (() => void) | null = null;
   let active: ActiveGa4Config | null = null;
   let disposed = false;
+  let currentPageLocation: string | null = null;
   const delivered = new Set<string>();
   const deliveredOrder: string[] = [];
 
+  const transport = typeof options.transport === "function" ? undefined : options.transport;
+  const send = typeof options.transport === "function" ? options.transport : options.transport.send.bind(options.transport);
+
+  const runTransportEffect = (effect: (() => void | Promise<void>) | undefined): void => {
+    if (!effect) return;
+    const result = effect();
+    if (result && typeof result.then === "function") {
+      void result.catch(() => observeSafely(options.observe, "transport_failed"));
+    }
+  };
+
   const stop = (): boolean => {
     const release = unsubscribe;
     active = null;
-    if (!release) return true;
+    currentPageLocation = null;
     try {
-      release();
+      if (release) release();
       unsubscribe = null;
+      runTransportEffect(transport?.disable?.bind(transport));
       return true;
     } catch {
       observeSafely(options.observe, "teardown_failed");
@@ -236,20 +208,27 @@ export function createNativeGa4Module(options: NativeGa4ModuleOptions): Integrat
   };
 
   const apply = (ctx: IntegrationLifecycleContext): void => {
-    if (!stop()) return;
-    if (disposed) return;
+    if (!stop() || disposed) return;
     const next = configuredFor(ctx);
     if (!next) {
-      observeSafely(
-        options.observe,
-        hasAnalyticsConsent(ctx) ? "configuration_invalid" : "consent_ineligible",
-      );
+      observeSafely(options.observe, hasAnalyticsConsent(ctx) ? "configuration_invalid" : "consent_ineligible");
       return;
     }
     if (!ctx.subscribe) {
       observeSafely(options.observe, "configuration_invalid");
       return;
     }
+    try {
+      const configuration = {
+        schemaVersion: 1 as const,
+        destinationIds: [...next.destinationIds],
+        canonicalOrigin: next.canonicalOrigin,
+      };
+      runTransportEffect(transport?.configure ? () => transport.configure!(configuration) : undefined);
+    } catch {
+      observeSafely(options.observe, "transport_failed");
+      return;
+    }
     active = next;
     unsubscribe = ctx.subscribe({
       types: NATIVE_GA4_EVENT_TYPES,
@@ -263,29 +242,25 @@ export function createNativeGa4Module(options: NativeGa4ModuleOptions): Integrat
             observeSafely(options.observe, "duplicate_suppressed");
             return;
           }
-          const requests = mapEvent(current, event);
-          if (requests.length === 0) {
+          const command = mapEvent(current, event, currentPageLocation);
+          if (!command) {
             observeSafely(options.observe, "event_rejected");
             return;
           }
+          if (command.type === "page_view") currentPageLocation = `${current.canonicalOrigin}${command.path}`;
           delivered.add(event.id);
           deliveredOrder.push(event.id);
           if (deliveredOrder.length > 1_024) {
             const oldest = deliveredOrder.shift();
             if (oldest !== undefined) delivered.delete(oldest);
           }
-          // One logical event, one send per configured measurement id. Each send is
-          // independent: a destination whose transport fails is observed on its own and
-          // never suppresses the others.
-          for (const request of requests) {
-            try {
-              const result = options.transport(request);
-              if (result && typeof result.then === "function") {
-                void result.catch(() => observeSafely(options.observe, "transport_failed"));
-              }
-            } catch {
-              observeSafely(options.observe, "transport_failed");
+          try {
+            const result = send(command);
+            if (result && typeof result.then === "function") {
+              void result.catch(() => observeSafely(options.observe, "transport_failed"));
             }
+          } catch {
+            observeSafely(options.observe, "transport_failed");
           }
         },
       },
@@ -293,91 +268,12 @@ export function createNativeGa4Module(options: NativeGa4ModuleOptions): Integrat
   };
 
   return {
-    init(ctx) {
-      apply(ctx);
-    },
-    update(_reason: LifecycleUpdateReason, ctx) {
-      apply(ctx);
-    },
+    init: apply,
+    update(_reason: LifecycleUpdateReason, ctx) { return apply(ctx); },
     dispose() {
       disposed = true;
       stop();
+      runTransportEffect(transport?.dispose?.bind(transport));
     },
   };
 }
-
-/** A fixed-origin, credentialless browser transport for the native lifecycle entry. */
-export function createNativeGa4FetchTransport(
-  fetchCapability: typeof fetch,
-): NativeGa4Transport {
-  return async (request) => {
-    if (request.endpoint !== GA4_COLLECTION_ENDPOINT) throw new Error("ga4_transport_invalid");
-    if (!safeTransportFields(request.fields)) throw new Error("ga4_transport_invalid");
-    const response = await fetchCapability(request.endpoint, {
-      method: "POST",
-      body: new URLSearchParams(request.fields).toString(),
-      mode: "no-cors",
-      credentials: "omit",
-      referrerPolicy: "no-referrer",
-      keepalive: true,
-      headers: { "content-type": "text/plain;charset=UTF-8" },
-    });
-    // Opaque no-cors responses are expected. A non-opaque explicit failure is stable.
-    if (response.type !== "opaque" && !response.ok) throw new Error("ga4_transport_failed");
-  };
-}
-
-const GA4_OPTIONAL_PAGE_FIELDS = [
-  "ep.referrer_origin",
-  "ep.utm_source",
-  "ep.utm_medium",
-  "ep.utm_campaign",
-  "ep.utm_term",
-  "ep.utm_content",
-] as const;
-const SAFE_CAMPAIGN_VALUE = /^[A-Za-z0-9][A-Za-z0-9._~-]{0,127}$/;
-
-function safeTransportFields(fields: Readonly<Record<string, string>>): boolean {
-  const keys = Object.keys(fields);
-  const allowed = new Set(["v", "tid", "cid", "en", "ep.page_path", ...GA4_OPTIONAL_PAGE_FIELDS]);
-  if (keys.some((key) => !allowed.has(key))) return false;
-  if (fields["v"] !== "2") return false;
-  if (!GOOGLE_MEASUREMENT_ADAPTER.validateId(fields["tid"] ?? "")) return false;
-  if (!/^ga4\.[a-f0-9]{1,8}\.[a-f0-9]{1,8}$/.test(fields["cid"] ?? "")) return false;
-  if (Object.values(fields).some((value) => resemblesManagedAnalyticsPii(value))) return false;
-
-  const eventName = fields["en"];
-  if (eventName !== "page_view") {
-    return (
-      eventName !== undefined &&
-      APPROVED_ACTION_SET.has(eventName) &&
-      keys.length === 4 &&
-      keys.every((key) => ["v", "tid", "cid", "en"].includes(key))
-    );
-  }
-
-  const path = fields["ep.page_path"];
-  if (
-    typeof path !== "string" ||
-    !path.startsWith("/") ||
-    path.startsWith("//") ||
-    path.includes("\\") ||
-    path.includes("?") ||
-    path.includes("#")
-  ) return false;
-  const origin = fields["ep.referrer_origin"];
-  if (origin !== undefined) {
-    try {
-      const parsed = new URL(origin);
-      if (!["http:", "https:"].includes(parsed.protocol) || parsed.origin !== origin) return false;
-    } catch {
-      return false;
-    }
-  }
-  for (const key of GA4_OPTIONAL_PAGE_FIELDS) {
-    if (key === "ep.referrer_origin") continue;
-    const value = fields[key];
-    if (value !== undefined && !SAFE_CAMPAIGN_VALUE.test(value)) return false;
-  }
-  return true;
-}