@tokenoftrust/storefront-runner 2.0.30 → 2.0.32

package/apps/storefront/astro.config.mjs

@@ -59,6 +59,7 @@ import tailwindcss from "@tailwindcss/vite";
 import { tenantHotReload } from "./dev-plugins/tenant-hot-reload.mjs";
 import { materializeGuard } from "./integrations/materialize-guard.mjs";
 import { lifecycleHostAsset } from "./integrations/lifecycle-host-asset.mjs";
+import { googleMeasurementSandboxAsset } from "./integrations/google-measurement-sandbox-asset.mjs";
 
 // SSR on Cloudflare Workers. `output: 'server'` because every response is
 // tenant-resolved at the edge from the Host header (see src/middleware).
@@ -99,6 +100,7 @@ export default defineConfig({
     // stable same-origin URL so BOTH document mounts load the same boot — the raw
     // marketing mount has no bundler to hoist a module import through.
     lifecycleHostAsset(),
+    googleMeasurementSandboxAsset(),
     preact({ compat: true }),
     // Astro's file-based router ignores ANY path segment starting with "_" (see
     // `astro/dist/core/routing/create-manifest.js`), so a page literally named

package/apps/storefront/env.d.ts

@@ -61,7 +61,6 @@ interface CloudflareEnv {
   TOT_API_KEY?: string;
   TOT_SECRET_KEY?: string;
   TOT_ACCESS_TOKEN?: string;
-  PUBLIC_CF_ANALYTICS_TOKEN?: string;
   /** HMAC secret for signing/verifying customization preview tokens. */
   CUSTOMIZATION_PREVIEW_SECRET?: string;
   /**
@@ -260,7 +259,6 @@ interface ImportMetaEnv {
   readonly TOT_API_KEY?: string;
   readonly TOT_SECRET_KEY?: string;
   readonly TOT_ACCESS_TOKEN?: string;
-  readonly PUBLIC_CF_ANALYTICS_TOKEN?: string;
   readonly CUSTOMIZATION_PREVIEW_SECRET?: string;
 }
 interface ImportMeta {

package/apps/storefront/integrations/google-measurement-sandbox-asset.mjs

@@ -0,0 +1,97 @@
+/** Emit the reviewed GA4 runtime as one import-free, CSP-hashed static document. */
+import { createHash } from "node:crypto";
+import { mkdir, writeFile } from "node:fs/promises";
+import { createRequire } from "node:module";
+import { dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import {
+  NATIVE_GA4_SANDBOX_ASSET_PATH,
+} from "@tot/public-runtime/integration/native-ga4-sandbox-asset";
+
+const SANDBOX_ENTRY = fileURLToPath(new URL(
+  "../../../packages/public-runtime/src/integration/native-ga4-sandbox-entry.ts",
+  import.meta.url,
+));
+
+export async function bundleGoogleMeasurementSandboxScript() {
+  const require = createRequire(import.meta.url);
+  const esbuild = createRequire(require.resolve("astro/package.json"))("esbuild");
+  const result = await esbuild.build({
+    entryPoints: [SANDBOX_ENTRY],
+    bundle: true,
+    write: false,
+    metafile: true,
+    format: "iife",
+    platform: "browser",
+    target: "es2022",
+    minify: true,
+    treeShaking: true,
+    legalComments: "none",
+    sourcemap: false,
+    logLevel: "silent",
+  });
+  if (result.outputFiles.length !== 1) {
+    throw new Error(`GA4 sandbox emitted ${result.outputFiles.length} files; expected one.`);
+  }
+  for (const output of Object.values(result.metafile.outputs)) {
+    if ((output.imports ?? []).length > 0) throw new Error("GA4 sandbox must be import-free.");
+  }
+  const code = result.outputFiles[0].text.trim();
+  if (/<\/script/i.test(code)) throw new Error("GA4 sandbox bundle contains a closing script token.");
+  return code;
+}
+
+export function googleMeasurementSandboxCsp(code) {
+  const hash = createHash("sha256").update(code).digest("base64");
+  const script = `'sha256-${hash}' https://www.googletagmanager.com`;
+  return [
+    "default-src 'none'",
+    "base-uri 'none'",
+    "object-src 'none'",
+    "form-action 'none'",
+    "frame-src 'none'",
+    "worker-src 'none'",
+    `script-src ${script}`,
+    `script-src-elem ${script}`,
+    "img-src https://*.google-analytics.com https://www.googletagmanager.com",
+    "connect-src https://*.google-analytics.com https://*.analytics.google.com https://www.googletagmanager.com",
+  ].join("; ");
+}
+
+export async function buildGoogleMeasurementSandboxHtml() {
+  const code = await bundleGoogleMeasurementSandboxScript();
+  const csp = googleMeasurementSandboxCsp(code);
+  return `<!doctype html>\n<meta charset="utf-8">\n<meta http-equiv="Content-Security-Policy" content="${csp}">\n<title>Analytics transport</title>\n<script>${code}</script>\n`;
+}
+
+export function googleMeasurementSandboxAsset() {
+  let clientDir = null;
+  return {
+    name: "tot-google-measurement-sandbox-asset",
+    hooks: {
+      "astro:config:done": ({ config }) => { clientDir = config.build.client; },
+      "astro:server:setup": ({ server }) => {
+        server.middlewares.use((req, res, next) => {
+          const path = (req.url ?? "").split("?")[0];
+          if (path !== `/${NATIVE_GA4_SANDBOX_ASSET_PATH}`) return next();
+          buildGoogleMeasurementSandboxHtml().then(
+            (html) => {
+              res.setHeader("content-type", "text/html; charset=utf-8");
+              res.setHeader("cache-control", "no-store");
+              res.end(html);
+            },
+            (error) => next(error),
+          );
+        });
+      },
+      "astro:build:done": async ({ logger }) => {
+        if (!clientDir) throw new Error("the GA4 sandbox has no resolved client output dir");
+        const html = await buildGoogleMeasurementSandboxHtml();
+        const target = fileURLToPath(new URL(NATIVE_GA4_SANDBOX_ASSET_PATH, clientDir));
+        await mkdir(dirname(target), { recursive: true });
+        await writeFile(target, html, "utf8");
+        logger.info(`GA4 sandbox → /${NATIVE_GA4_SANDBOX_ASSET_PATH} (${html.length} bytes)`);
+      },
+    },
+  };
+}

package/apps/storefront/public/platform/google-measurement/v2/entry.mjs

@@ -0,0 +1,13 @@
+/** Reviewed parent-side marker for the null-origin GA4 platform adapter. */
+export const platformAdapterEntry = Object.freeze({
+  schemaVersion: 1,
+  origin: "platform-adapter",
+  executionTier: "platform-adapter",
+  appId: "platform.google-measurement",
+  version: "1.0.0",
+  entry: Object.freeze({
+    url: "/platform/google-measurement/v2/entry.mjs",
+    format: "module",
+  }),
+  runtime: "native-ga4-v2",
+});

package/apps/storefront/src/layouts/Layout.astro

@@ -222,10 +222,6 @@ const { gridColumns: footerColumns, legalLinks: bottomLinks } = splitFooterLegal
 const legalBase = chrome.footer.bottom?.copyright ?? `© ${new Date().getFullYear()} ${tenant.displayName}`;
 const legalLine = `${legalBase}${chrome.footer.bottom?.note ? ` · ${chrome.footer.bottom.note}` : ""}`;
 
-const analyticsToken = import.meta.env.PUBLIC_CF_ANALYTICS_TOKEN;
-const analyticsEnabled =
-  analyticsToken && !/REPLACE|PLACEHOLDER/i.test(analyticsToken);
-
 // Private-app widgets — global.footer slot. Resolved once here so it
 // renders for BOTH footer paths below (the tenant-owned chrome.html splice
 // and the generic <Footer>) instead of being owned by either. No dark-mode
@@ -293,46 +289,6 @@ const footerWidgets = await renderWidgetSlot(
       alternates={alternates}
     />
 
-    {
-      /* Cloudflare Web Analytics is a non-essential measurement destination —
-         gate it on the SAME neutral consent broker every vendor loader reads
-         (ext-kernel-04 `consent.defaults` phase, published above as
-         `window.__TOT_INTEGRATION_CONSENT__`). The token rides a <meta> tag
-         (any script attribute, incl. define:vars, forces is:inline and drops
-         module processing — this script needs a real import) rather than a
-         page global; the script fail-closes like every other consumer of that
-         global: an absent/tampered snapshot denies, so an unconfigured CMP
-         means this never loads rather than loading ungated. */
-      analyticsEnabled && <meta name="cf-beacon-token" content={analyticsToken} />
-    }
-    {
-      analyticsEnabled && (
-        <script>
-          import {
-            parseConsentSnapshot,
-            isPurposeEligible,
-            defaultConsentSnapshot,
-            INTEGRATION_CONSENT_GLOBAL,
-          } from "@tot/public-runtime";
-
-          const snapshot =
-            parseConsentSnapshot((window as unknown as Record<string, unknown>)[INTEGRATION_CONSENT_GLOBAL]) ??
-            defaultConsentSnapshot();
-
-          const token = document
-            .querySelector('meta[name="cf-beacon-token"]')
-            ?.getAttribute("content");
-
-          if (token && isPurposeEligible(snapshot, "analytics")) {
-            const beacon = document.createElement("script");
-            beacon.defer = true;
-            beacon.src = "https://static.cloudflareinsights.com/beacon.min.js";
-            beacon.setAttribute("data-cf-beacon", JSON.stringify({ token }));
-            document.head.appendChild(beacon);
-          }
-        </script>
-      )
-    }
   </head>
   <body>
     {/* body.start fallback boundary (ext-kernel-04) — the renderer-owned mount
@@ -582,11 +538,10 @@ const footerWidgets = await renderWidgetSlot(
     {/* Field Web Vitals (RUM) — measures LCP/INP/CLS for real visitors and
         beacons per-route samples to the RUM sink. ~1KB, no framework; no-ops
         where PerformanceObserver is absent. This is the per-route-template
-        signal the `core-web-vitals` monitor consumes (the CF Web Analytics
-        beacon above only gives aggregate field CWV). */}
+        signal the `core-web-vitals` monitor consumes. */}
     <script>
-      import { startWebVitals } from "@/lib/analytics/webVitals";
-      startWebVitals();
+      import { startConsentGatedWebVitals } from "@/lib/analytics/webVitals";
+      startConsentGatedWebVitals();
     </script>
 
     {/* Protected-surface tamper sentinel (ext-policy-09, D-R7) — a DETECTIVE

package/apps/storefront/src/lib/analytics/budgets.json

@@ -15,7 +15,6 @@
     "totalKib": 1300
   },
   "thirdPartyScriptAllowlist": [
-    "static.cloudflareinsights.com",
     "cdn.foxycart.com"
   ],
   "routes": [

package/apps/storefront/src/lib/analytics/index.ts

@@ -1,10 +1,7 @@
 /**
  * Privacy-friendly analytics (brief §5 Analytics).
  *
- * Phase 1 ships TWO layers:
- *  1. Pageviews — Cloudflare Web Analytics, a single beacon script injected in
- *     Layout.astro when PUBLIC_CF_ANALYTICS_TOKEN is set (no cookies, no PII).
- *  2. Commerce events — product impression/click/PDP-view instrumented NOW to a
+ * Phase 1 ships commerce events — product impression/click/PDP-view instrumented NOW to a
  *     NO-OP sink, so Phase 2 conversion work inherits the call sites for free.
  *
  * The event API is intentionally tiny and synchronous-looking; swap the sink

package/apps/storefront/src/lib/analytics/webVitals.ts

@@ -24,12 +24,16 @@
  * + bucketing in node; `startWebVitals` is the thin browser wiring, guarded so
  * importing this module in a non-browser context (SSR, tests) is a no-op.
  *
- * Field CWV is emitted TWICE, deliberately: Cloudflare Web Analytics
- * (PUBLIC_CF_ANALYTICS_TOKEN, Layout.astro) already gives aggregate field CWV;
- * this beacon adds the PER-ROUTE-TEMPLATE breakdown the budget gate + the
- * regression alert (`rumAlert.ts`) reason over, which CF's aggregate cannot.
+ * Field CWV is emitted through the consent-gated per-route-template beacon that the
+ * budget gate and regression alert (`rumAlert.ts`) reason over.
  */
 import { classifyPath, PERF_BUDGETS, type PerfBudgetManifest, type RouteClass } from "./perfBudgets.js";
+import {
+  INTEGRATION_CONSENT_GLOBAL,
+  VIEWER_ANALYTICS_CONSENT_CHANGE_EVENT,
+  isPurposeEligible,
+  parseConsentSnapshot,
+} from "@tot/public-runtime";
 
 /** The three field metrics we collect. INP is field-only (no lab equivalent). */
 export type WebVitalName = "lcp" | "inp" | "cls";
@@ -267,3 +271,37 @@ export function startWebVitals(
     inpObs.disconnect();
   };
 }
+
+/**
+ * Keep field telemetry behind the same authenticated viewer-consent snapshot as
+ * every managed analytics adapter. Withdrawal tears down observers before they
+ * can flush; a later grant starts a fresh collector for the current document.
+ */
+export function startConsentGatedWebVitals(
+  start: () => () => void = () => startWebVitals(),
+): () => void {
+  if (typeof window === "undefined") return () => {};
+  const win = window as unknown as Record<string, unknown>;
+  let stopCollector: (() => void) | null = null;
+  let disposed = false;
+  const sync = () => {
+    if (disposed) return;
+    const snapshot = parseConsentSnapshot(win[INTEGRATION_CONSENT_GLOBAL]);
+    const eligible = snapshot !== null && isPurposeEligible(snapshot, "analytics");
+    if (eligible && !stopCollector) {
+      stopCollector = start();
+    } else if (!eligible && stopCollector) {
+      const stop = stopCollector;
+      stopCollector = null;
+      stop();
+    }
+  };
+  window.addEventListener(VIEWER_ANALYTICS_CONSENT_CHANGE_EVENT, sync);
+  sync();
+  return () => {
+    disposed = true;
+    window.removeEventListener(VIEWER_ANALYTICS_CONSENT_CHANGE_EVENT, sync);
+    stopCollector?.();
+    stopCollector = null;
+  };
+}

package/apps/storefront/src/lib/integration/tenantDeclarations.ts

@@ -69,7 +69,7 @@ const DEMO_ANALYTICS_MANIFEST: IntegrationManifest = {
     digest: `sha256:${DEMO_ANALYTICS_APP_ID}-${DEMO_ANALYTICS_VERSION}`,
     publisher: "Token of Trust",
   },
-  compatibility: { storefrontBrowserContract: ">=2.0.0 <3.0.0", configurationSchemaVersion: 1 },
+  compatibility: { storefrontBrowserContract: ">=3.0.0 <4.0.0", configurationSchemaVersion: 1 },
   browser: {
     executionTier: "sandbox",
     entry: { asset: DEMO_ANALYTICS_ENTRY_URL, format: "module", phase: "document.deferred" },

package/apps/storefront/src/lib/monitoring/manifest.ts

@@ -258,8 +258,7 @@ export const MONITORS: readonly Monitor[] = [
     runbook: "bad-content-policy",
     wiring: "needs-external",
     notes:
-      "Reference F14's RUM signal by name; do NOT edit F14's analytics files. Cloudflare Web Analytics " +
-      "(PUBLIC_CF_ANALYTICS_TOKEN, injected in Layout.astro) gives field CWV today; F14's beacon gives per-template detail.",
+      "Reference F14's consent-gated RUM signal by name; do not duplicate its analytics implementation.",
   },
 ] as const;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.0.30",
+  "version": "2.0.32",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/package.json

@@ -10,7 +10,8 @@
   "exports": {
     ".": "./src/index.ts",
     "./blog-visibility": "./src/blog-visibility.mjs",
-    "./integration/lifecycle-host-asset": "./src/integration/lifecycle-host-asset.mjs"
+    "./integration/lifecycle-host-asset": "./src/integration/lifecycle-host-asset.mjs",
+    "./integration/native-ga4-sandbox-asset": "./src/integration/native-ga4-sandbox-asset.mjs"
   },
   "scripts": {
     "typecheck": "tsc --noEmit",

package/packages/public-runtime/src/csp.ts

@@ -78,7 +78,7 @@ export const CSP_REPORT_GROUP = "csp-endpoint";
  * origin) per request.
  */
 export const STOREFRONT_CSP_ALLOWLIST = {
-  scriptSrc: ["https://static.cloudflareinsights.com"],
+  scriptSrc: [],
   // Web fonts are self-hosted (@fontsource, bundled same-origin) — no
   // fonts.googleapis.com stylesheet or fonts.gstatic.com woff2 to allowlist;
   // 'self' + `data:` (both added by buildCsp) cover style-src + font-src,
@@ -87,7 +87,7 @@ export const STOREFRONT_CSP_ALLOWLIST = {
   fontSrc: [],
   // Product imagery is rehosted to R2 or served from remote CDNs.
   imgSrc: ["https:"],
-  connectSrc: ["https://cloudflareinsights.com"],
+  connectSrc: [],
 } as const;
 
 /**