@tokenoftrust/storefront-runner 2.0.30 → 2.0.32

package/packages/public-runtime/src/integration/lifecycle-runtime.ts

@@ -160,6 +160,13 @@ type LifecycleState = "idle" | "initializing" | "initialized" | "disposing" | "d
 interface ActiveIntegration {
   integration: BootDescriptorIntegration;
   module: IntegrationLifecycleModule;
+  eligible: boolean;
+}
+
+/** A module whose init hook has started but has not yet settled. */
+interface StartingIntegration extends ActiveIntegration {
+  cancelled: boolean;
+  disposed: boolean;
 }
 
 function messageOf(error: unknown): string {
@@ -195,8 +202,16 @@ export function sanitizeNavigationUrl(raw: string, keepHash: boolean): string {
 export class IntegrationLifecycle {
   private state: LifecycleState = "idle";
   private readonly active: ActiveIntegration[] = [];
+  /** Modules visible to an interrupting consent withdrawal while init is unresolved. */
+  private readonly starting: StartingIntegration[] = [];
   /** Integrations held back by the consent gate; re-evaluated on each `update`. */
   private deferred: BootDescriptorIntegration[] = [];
+  /** Updates arriving during async initialization, replayed before bootstrap emission. */
+  private readonly pendingUpdates: LifecycleUpdateReason[] = [];
+  /** An atomic withdrawal/grant seen during init needs only deferred-load reconciliation. */
+  private pendingGrantReconciliation = false;
+  /** Serializes ordinary post-init updates; consent withdrawal interrupts an unresolved grant. */
+  private updateQueue: Promise<void> = Promise.resolve();
   private eventCounter = 0;
   private readonly opts: IntegrationLifecycleOptions;
 
@@ -220,16 +235,26 @@ export class IntegrationLifecycle {
     if (this.state !== "idle") return;
     this.state = "initializing";
     for (const integration of this.opts.descriptor.integrations) {
+      if (this.state !== "initializing") break;
       if (!this.eligible(integration)) {
         // Consent precedes the loader: hold it back, do not load, and record why.
         this.deferred.push(integration);
         this.observe({ stage: "gate", integration, ok: false });
         continue;
       }
-      await this.initOne(integration);
+      const remainDeferred = await this.initOne(integration);
+      if (this.state !== "initializing") break;
+      if (remainDeferred) this.deferred.push(integration);
     }
     // A dispose that raced in during an await leaves us terminal; otherwise we are live.
     if (this.state === "initializing") this.state = "initialized";
+    if (this.state === "initialized" && this.pendingGrantReconciliation) {
+      this.pendingGrantReconciliation = false;
+      await this.loadNewlyEligible();
+    }
+    if (this.state === "initialized") {
+      for (const reason of this.pendingUpdates.splice(0)) await this.update(reason);
+    }
     // Last, so every adapter that just subscribed is registered when this emits: the
     // broker has no replay, so a page view emitted before their `init` reaches nobody.
     if (this.state === "initialized") this.emitBootstrapPageView();
@@ -250,6 +275,7 @@ export class IntegrationLifecycle {
    * throwing integration.
    */
   private emitBootstrapPageView(): void {
+    if (this.state !== "initialized") return;
     const managed = this.opts.managedAnalytics;
     if (!managed || managed.bridge.isInitialized || managed.bridge.isDisposed) return;
     if (this.opts.commerceBroker?.isConsentEligible("analytics") === false) return;
@@ -265,6 +291,11 @@ export class IntegrationLifecycle {
     return this.opts.isEligible ? this.opts.isEligible(integration) : true;
   }
 
+  /** Read terminal state across async hook boundaries without relying on stale narrowing. */
+  private isTerminal(): boolean {
+    return this.state === "disposing" || this.state === "disposed";
+  }
+
   /**
    * Load any consent-deferred integration that has since become eligible, in the
    * plan's resolved order. Called from `update` so a consent grant loads the
@@ -273,31 +304,179 @@ export class IntegrationLifecycle {
   private async loadNewlyEligible(): Promise<void> {
     if (this.deferred.length === 0) return;
     const stillDeferred: BootDescriptorIntegration[] = [];
+    const candidates: BootDescriptorIntegration[] = [];
     for (const integration of this.deferred) {
-      if (this.eligible(integration)) await this.initOne(integration);
-      else stillDeferred.push(integration);
+      (this.eligible(integration) ? candidates : stillDeferred).push(integration);
     }
+    // Reserve eligible entries before the first await so an interrupting consent
+    // transition cannot start a duplicate load of the same adapter.
     this.deferred = stillDeferred;
+    for (const integration of candidates) {
+      if (this.isTerminal()) break;
+      let remainDeferred = await this.initOne(integration);
+      // A rapid withdrawal can cancel this reserved init, then a regrant can arrive
+      // before it settles. Retry with a fresh module as soon as the cancelled attempt
+      // returns; otherwise that regrant has no later update left to wake it.
+      while (
+        remainDeferred
+        && this.state !== "disposing"
+        && this.state !== "disposed"
+        && this.eligible(integration)
+      ) {
+        remainDeferred = await this.initOne(integration);
+      }
+      if (remainDeferred && this.state !== "disposing" && this.state !== "disposed") {
+        this.deferred.push(integration);
+      }
+    }
   }
 
-  private async initOne(integration: BootDescriptorIntegration): Promise<void> {
+  /** Returns true when consent changed during loading and the entry remains deferred. */
+  private async initOne(integration: BootDescriptorIntegration): Promise<boolean> {
+    if (this.isTerminal()) return false;
     let module: IntegrationLifecycleModule;
     try {
       module = await this.opts.loadModule(integration);
     } catch (error) {
       this.observe({ stage: "load", integration, ok: false, error: messageOf(error) });
-      return;
+      return false;
+    }
+    if (this.state === "disposing" || this.state === "disposed") return false; // torn down mid-load: do not init.
+    // Consent may be withdrawn while the asynchronous loader is in flight. Recheck
+    // before calling tenant/vendor code; an entry must never initialize after denial.
+    if (!this.eligible(integration)) {
+      this.observe({ stage: "gate", integration, ok: false });
+      return true;
     }
-    if (this.state === "disposing" || this.state === "disposed") return; // torn down mid-load: do not init.
+    const starting: StartingIntegration = {
+      integration,
+      module,
+      eligible: true,
+      cancelled: false,
+      disposed: false,
+    };
+    this.starting.push(starting);
+    let remainDeferred = false;
     try {
       await module.init(this.buildContext(integration));
-      this.active.push({ integration, module });
-      this.observe({ stage: "init", integration, ok: true });
+      // A consent withdrawal may arrive while vendor/sandbox init is unresolved. Its
+      // interrupt marks the module cancelled and invokes teardown immediately; never
+      // publish that late init as active, and load a fresh module on a later grant.
+      remainDeferred = starting.cancelled
+        || this.isTerminal()
+        || !this.eligible(integration);
+      if (!remainDeferred) {
+        this.active.push({ integration, module, eligible: true });
+        this.observe({ stage: "init", integration, ok: true });
+      }
     } catch (error) {
+      remainDeferred = starting.cancelled
+        || this.isTerminal()
+        || !this.eligible(integration);
       this.observe({ stage: "init", integration, ok: false, error: messageOf(error) });
+    } finally {
+      const index = this.starting.indexOf(starting);
+      if (index >= 0) this.starting.splice(index, 1);
+    }
+    return remainDeferred;
+  }
+
+  /**
+   * Interrupt a consent grant whose module init has not settled. Calling update and
+   * dispose synchronously gives the module/sandbox its immediate stop signal; returned
+   * promises are observed in the background so a hostile or stuck hook cannot delay the
+   * viewer's withdrawal. The late init is kept out of `active` by `cancelled` above.
+   */
+  private interruptWithdrawnStarts(reason: LifecycleUpdateReason): boolean {
+    const withdrawn = this.starting.filter(({ integration }) => !this.eligible(integration));
+    if (withdrawn.length === 0) return false;
+    for (const entry of withdrawn) {
+      if (entry.cancelled) continue;
+      entry.cancelled = true;
+      if (entry.module.update) {
+        try {
+          const result = entry.module.update(reason, this.buildContext(entry.integration));
+          void Promise.resolve(result).then(
+            () => this.observe({ stage: "update", integration: entry.integration, ok: true, reason }),
+            (error) => this.observe({
+              stage: "update", integration: entry.integration, ok: false, reason, error: messageOf(error),
+            }),
+          );
+        } catch (error) {
+          this.observe({
+            stage: "update", integration: entry.integration, ok: false, reason, error: messageOf(error),
+          });
+        }
+      }
+      if (entry.module.dispose && !entry.disposed) {
+        entry.disposed = true;
+        try {
+          const result = entry.module.dispose();
+          void Promise.resolve(result).then(
+            () => this.observe({ stage: "dispose", integration: entry.integration, ok: true }),
+            (error) => this.observe({
+              stage: "dispose", integration: entry.integration, ok: false, error: messageOf(error),
+            }),
+          );
+        } catch (error) {
+          this.observe({ stage: "dispose", integration: entry.integration, ok: false, error: messageOf(error) });
+        }
+      }
+    }
+    return true;
+  }
+
+  /** Deliver an update to a fixed set of active modules without loading deferred work. */
+  private async updateActive(
+    reason: LifecycleUpdateReason,
+    entries: readonly ActiveIntegration[],
+  ): Promise<void> {
+    for (const { integration, module } of entries) {
+      if (this.state !== "initialized") return;
+      if (!module.update) continue;
+      try {
+        await module.update(reason, this.buildContext(integration));
+        this.observe({ stage: "update", integration, ok: true, reason });
+      } catch (error) {
+        this.observe({ stage: "update", integration, ok: false, reason, error: messageOf(error) });
+      }
+    }
+  }
+
+  /**
+   * Signal every active module synchronously during a withdrawal. Returned promises
+   * are observed in the background so one stuck adapter cannot delay the stop signal
+   * for another adapter or keep the viewer's withdrawal request pending.
+   */
+  private interruptActiveUpdates(
+    reason: LifecycleUpdateReason,
+    entries: readonly ActiveIntegration[],
+  ): void {
+    for (const { integration, module } of entries) {
+      if (!module.update) continue;
+      try {
+        const result = module.update(reason, this.buildContext(integration));
+        void Promise.resolve(result).then(
+          () => this.observe({ stage: "update", integration, ok: true, reason }),
+          (error) => this.observe({ stage: "update", integration, ok: false, reason, error: messageOf(error) }),
+        );
+      } catch (error) {
+        this.observe({ stage: "update", integration, ok: false, reason, error: messageOf(error) });
+      }
     }
   }
 
+  /** Record current eligibility and report whether this consent change withdrew an active entry. */
+  private updateActiveEligibility(): boolean {
+    let withdrew = false;
+    for (const entry of this.active) {
+      const eligible = this.eligible(entry.integration);
+      if (entry.eligible && !eligible) withdrew = true;
+      entry.eligible = eligible;
+    }
+    return withdrew;
+  }
+
   /**
    * Build the typed context handed to `init`/`update`: this integration's own
    * resolved public config (never another integration's), the document's
@@ -349,26 +528,59 @@ export class IntegrationLifecycle {
 
   /**
    * Deliver an in-place `update(reason)` to every initialized integration that implements
-   * it. Used for a consent change, a config change, or a rollback — never a re-init. A no-op
-   * before init or after dispose. One integration's throwing `update` is isolated.
+   * it. Used for a consent change, a config change, or a rollback — never a re-init. An
+   * update during async initialization is replayed before bootstrap emission; calls before
+   * initialization starts or after dispose are no-ops. One throwing `update` is isolated.
    */
   async update(reason: LifecycleUpdateReason): Promise<void> {
     if (!LIFECYCLE_UPDATE_REASONS.includes(reason)) return;
+    if (this.state !== "initializing" && this.state !== "initialized") return;
+    // Withdrawal is a safety interrupt, including while the document's initial
+    // lifecycle boot is still awaiting module.init().
+    let interruptedWithdrawal = false;
+    if (reason === "consent-changed") {
+      interruptedWithdrawal = this.interruptWithdrawnStarts(reason);
+      interruptedWithdrawal = this.updateActiveEligibility() || interruptedWithdrawal;
+    }
+    if (interruptedWithdrawal) {
+      // A mixed initial state can have earlier entries active while a later analytics
+      // entry is still starting. Stop both groups now; returning before this delivery
+      // would leave an active sibling subscribed under a withdrawn snapshot.
+      this.interruptActiveUpdates(reason, [...this.active]);
+      // One atomic consent snapshot may withdraw one purpose and grant another.
+      // Once initial traversal is complete, start those grants without making
+      // withdrawal wait for loader/vendor code. During traversal, queue the grant
+      // reconciliation so it cannot duplicate an entry the init loop has not reached.
+      if (this.state === "initializing") {
+        this.pendingGrantReconciliation = true;
+      } else {
+        void this.loadNewlyEligible().then(
+          () => this.emitBootstrapPageView(),
+          () => {},
+        );
+      }
+      return;
+    }
+    if (this.state === "initializing") {
+      this.pendingUpdates.push(reason);
+      return;
+    }
+    if (this.state !== "initialized") return;
+    const run = this.updateQueue.then(() => this.applyUpdate(reason));
+    this.updateQueue = run.catch(() => {});
+    await run;
+  }
+
+  private async applyUpdate(reason: LifecycleUpdateReason): Promise<void> {
     if (this.state !== "initialized") return;
     // A consent/config change may make a gated integration eligible: load it now
     // (init), then deliver the update only to integrations that were already live —
     // a just-loaded entry gets `init`, not an immediate redundant `update`.
     const alreadyActive = [...this.active];
     await this.loadNewlyEligible();
-    for (const { integration, module } of alreadyActive) {
-      if (!module.update) continue;
-      try {
-        await module.update(reason, this.buildContext(integration));
-        this.observe({ stage: "update", integration, ok: true, reason });
-      } catch (error) {
-        this.observe({ stage: "update", integration, ok: false, reason, error: messageOf(error) });
-      }
-    }
+    if (this.state !== "initialized") return;
+    await this.updateActive(reason, alreadyActive);
+    if (this.state !== "initialized") return;
     // A consent grant is the case that matters: it both loads a previously-gated adapter
     // (above) and makes the held-back bootstrap page view emittable, so the document the
     // visitor consented ON is still counted rather than only its successors.
@@ -378,16 +590,38 @@ export class IntegrationLifecycle {
   /**
    * Dispose every initialized integration on teardown. Idempotent — a second dispose is a
    * no-op — and terminal: after it, `update` and a late `init` do nothing. One integration's
-   * throwing `dispose` is isolated; every other integration is still disposed.
+   * throwing or unresolved `dispose` is isolated; every other integration is still signalled.
    */
   async dispose(): Promise<void> {
     if (this.state === "disposed" || this.state === "disposing") return;
     this.state = "disposing";
+    // Starting modules are already executing tenant/vendor code but are not yet in
+    // `active`. Cancel and signal teardown synchronously so a late init settlement
+    // cannot publish after this terminal transition.
+    for (const entry of this.starting) {
+      entry.cancelled = true;
+      if (!entry.module.dispose || entry.disposed) continue;
+      entry.disposed = true;
+      try {
+        const result = entry.module.dispose();
+        void Promise.resolve(result).then(
+          () => this.observe({ stage: "dispose", integration: entry.integration, ok: true }),
+          (error) => this.observe({
+            stage: "dispose", integration: entry.integration, ok: false, error: messageOf(error),
+          }),
+        );
+      } catch (error) {
+        this.observe({ stage: "dispose", integration: entry.integration, ok: false, error: messageOf(error) });
+      }
+    }
     for (const { integration, module } of this.active) {
       if (!module.dispose) continue;
       try {
-        await module.dispose();
-        this.observe({ stage: "dispose", integration, ok: true });
+        const result = module.dispose();
+        void Promise.resolve(result).then(
+          () => this.observe({ stage: "dispose", integration, ok: true }),
+          (error) => this.observe({ stage: "dispose", integration, ok: false, error: messageOf(error) }),
+        );
       } catch (error) {
         this.observe({ stage: "dispose", integration, ok: false, error: messageOf(error) });
       }

package/packages/public-runtime/src/integration/managed-analytics-value-safety.ts

@@ -2,12 +2,21 @@
 import { MANAGED_ANALYTICS_PII_VALUE_PATTERN } from "./managed-analytics-api-v1-safety.mjs";
 
 const MANAGED_ANALYTICS_PII_VALUE = new RegExp(MANAGED_ANALYTICS_PII_VALUE_PATTERN);
+const MANAGED_ANALYTICS_PROTECTED_VALUE =
+  /(?:@|\d{7,}|(?:^|[./_~-])(?:bearer|password|secret|token|authorization|preview)(?:$|[./_~-]))/i;
 
 /** True when a public string resembles an email, SSN, payment card, or phone number. */
 export function resemblesManagedAnalyticsPii(value: unknown): boolean {
   return typeof value === "string" && MANAGED_ANALYTICS_PII_VALUE.test(value);
 }
 
+/** True when a public value resembles PII or an authentication/protected token. */
+export function resemblesManagedAnalyticsProtectedValue(value: unknown): boolean {
+  return typeof value === "string" && (
+    resemblesManagedAnalyticsPii(value) || MANAGED_ANALYTICS_PROTECTED_VALUE.test(value)
+  );
+}
+
 /** Defense-in-depth for identifiers copied into structured broker observations. */
 export function safeManagedAnalyticsDiagnosticId(value: string): string {
   return resemblesManagedAnalyticsPii(value) ? "[redacted]" : value;

package/packages/public-runtime/src/integration/native-ga4-sandbox-asset.d.mts

@@ -0,0 +1,2 @@
+export const NATIVE_GA4_SANDBOX_ASSET_PATH: "platform/google-measurement/v2/sandbox.html";
+export const NATIVE_GA4_SANDBOX_ASSET_URL: "/platform/google-measurement/v2/sandbox.html";

package/packages/public-runtime/src/integration/native-ga4-sandbox-asset.mjs

@@ -0,0 +1,3 @@
+/** Stable provider-neutral artifact path for the reviewed GA4 null-origin sandbox. */
+export const NATIVE_GA4_SANDBOX_ASSET_PATH = "platform/google-measurement/v2/sandbox.html";
+export const NATIVE_GA4_SANDBOX_ASSET_URL = `/${NATIVE_GA4_SANDBOX_ASSET_PATH}`;

package/packages/public-runtime/src/integration/native-ga4-sandbox-entry.ts

@@ -0,0 +1,207 @@
+/** Runtime bundled inline into the versioned GA4 sandbox HTML. */
+import { APPROVED_MARKETING_ACTION_NAMES } from "./events.js";
+import {
+  NATIVE_GA4_SANDBOX_MAX_DESTINATIONS,
+  NATIVE_GA4_SANDBOX_PROTOCOL,
+  type NativeGa4SandboxPortMessage,
+} from "./native-ga4-sandbox.js";
+import { resemblesManagedAnalyticsProtectedValue } from "./managed-analytics-value-safety.js";
+
+const MEASUREMENT_ID = /^G-[A-Z0-9]{4,20}$/;
+const CAMPAIGN_VALUE = /^[A-Za-z0-9][A-Za-z0-9._~-]{0,127}$/;
+const APPROVED_ACTIONS: ReadonlySet<string> = new Set(APPROVED_MARKETING_ACTION_NAMES);
+
+function plainRecord(value: unknown): Record<string, unknown> | null {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null ? value as Record<string, unknown> : null;
+}
+
+function exactKeys(value: Record<string, unknown>, allowed: readonly string[], required = allowed): boolean {
+  const keys = Object.keys(value);
+  return required.every((key) => keys.includes(key)) && keys.every((key) => allowed.includes(key));
+}
+
+function validOrigin(value: unknown): value is string {
+  if (typeof value !== "string") return false;
+  try {
+    const parsed = new URL(value);
+    return parsed.origin === value && (
+      parsed.protocol === "https:" ||
+      (parsed.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(parsed.hostname))
+    );
+  } catch { return false; }
+}
+
+function validPath(value: unknown): value is string {
+  return typeof value === "string" && value.startsWith("/") && !value.startsWith("//") &&
+    !value.includes("\\") && !value.includes("?") && !value.includes("#") &&
+    !resemblesManagedAnalyticsProtectedValue(value);
+}
+
+function validIds(value: unknown): value is string[] {
+  return Array.isArray(value) && value.length > 0 && value.length <= NATIVE_GA4_SANDBOX_MAX_DESTINATIONS &&
+    value.every((id) => typeof id === "string" && MEASUREMENT_ID.test(id)) && new Set(value).size === value.length;
+}
+
+function validCampaign(value: unknown): value is Record<string, string> {
+  const record = plainRecord(value);
+  if (!record || !exactKeys(record, ["source", "medium", "campaign", "term", "content"], [])) return false;
+  return Object.values(record).every((item) =>
+    typeof item === "string" && CAMPAIGN_VALUE.test(item) && !resemblesManagedAnalyticsProtectedValue(item));
+}
+
+export interface NativeGa4SandboxRuntimeWindow extends Pick<Window, "parent" | "location"> {
+  addEventListener(type: "message", listener: (event: MessageEvent) => void): void;
+  removeEventListener(type: "message", listener: (event: MessageEvent) => void): void;
+  dataLayer?: unknown[];
+  gtag?: (...args: unknown[]) => void;
+}
+
+export function startNativeGa4Sandbox(win: NativeGa4SandboxRuntimeWindow, doc: Document): void {
+  let bound = false;
+
+  const bind = (event: MessageEvent): void => {
+    try {
+      const data = plainRecord(event.data);
+      const ownOrigin = new URL(win.location.href).origin;
+      if (
+        bound || event.source !== win.parent || event.origin !== ownOrigin || event.ports.length !== 1 ||
+        !data || !exactKeys(data, ["protocol", "type"]) ||
+        data["protocol"] !== NATIVE_GA4_SANDBOX_PROTOCOL || data["type"] !== "bind"
+      ) return;
+      bound = true;
+      win.removeEventListener("message", bind);
+      runPort(event.ports[0]!, win, doc);
+    } catch {
+      // Hostile window messages fail closed without exposing an oracle.
+    }
+  };
+
+  win.addEventListener("message", bind);
+}
+
+function runPort(port: MessagePort, win: NativeGa4SandboxRuntimeWindow, doc: Document): void {
+  let active = false;
+  let disposed = false;
+  let canonicalOrigin = "";
+  let currentGroup = "";
+  let lastPageLocation = "";
+  let generation = 0;
+  let tagLoaded = false;
+
+  const dataLayer: unknown[] = [];
+  const gtag = function(..._args: unknown[]): void {
+    dataLayer.push(arguments);
+  };
+  win.dataLayer = dataLayer;
+  win.gtag = gtag;
+
+  const configure = (message: Record<string, unknown>): void => {
+    if (
+      !exactKeys(message, ["schemaVersion", "type", "destinationIds", "canonicalOrigin"]) ||
+      message["schemaVersion"] !== 1 || message["type"] !== "configure" ||
+      !validIds(message["destinationIds"]) || !validOrigin(message["canonicalOrigin"])
+    ) return;
+    const ids = message["destinationIds"];
+    canonicalOrigin = message["canonicalOrigin"];
+    currentGroup = `tot_storefront_${++generation}`;
+    lastPageLocation = "";
+    active = true;
+
+    if (!tagLoaded) {
+      tagLoaded = true;
+      gtag("consent", "default", {
+        analytics_storage: "denied",
+        ad_storage: "denied",
+        ad_user_data: "denied",
+        ad_personalization: "denied",
+      });
+      gtag("js", new Date());
+    }
+    for (const id of ids) {
+      gtag("config", id, {
+        groups: currentGroup,
+        send_page_view: false,
+        allow_google_signals: false,
+        allow_ad_personalization_signals: false,
+        restricted_data_processing: true,
+        ignore_referrer: true,
+      });
+    }
+    if (doc.querySelector('script[data-tot-ga4="1"]') === null) {
+      const script = doc.createElement("script");
+      script.async = true;
+      script.src = `https://www.googletagmanager.com/gtag/js?id=${encodeURIComponent(ids[0]!)}`;
+      script.setAttribute("data-tot-ga4", "1");
+      doc.head.append(script);
+    }
+  };
+
+  const deliver = (message: Record<string, unknown>): void => {
+    if (!active || disposed || message["schemaVersion"] !== 1) return;
+    if (message["type"] === "page_view") {
+      if (!exactKeys(message, ["schemaVersion", "type", "path", "referrerOrigin", "campaign"], ["schemaVersion", "type", "path"])) return;
+      if (!validPath(message["path"])) return;
+      if (message["referrerOrigin"] !== undefined && !validOrigin(message["referrerOrigin"])) return;
+      if (message["campaign"] !== undefined && !validCampaign(message["campaign"])) return;
+      const pageLocation = `${canonicalOrigin}${message["path"]}`;
+      lastPageLocation = pageLocation;
+      const params: Record<string, unknown> = {
+        send_to: currentGroup,
+        page_location: pageLocation,
+        page_path: message["path"],
+      };
+      if (message["referrerOrigin"] !== undefined) params["page_referrer"] = message["referrerOrigin"];
+      if (message["campaign"] !== undefined) {
+        const campaign = message["campaign"] as Record<string, string>;
+        for (const key of ["source", "medium", "campaign", "term", "content"] as const) {
+          const ga4Key = key === "campaign" ? "name" : key;
+          if (campaign[key] !== undefined) params[`campaign_${ga4Key}`] = campaign[key];
+        }
+      }
+      gtag("event", "page_view", params);
+      return;
+    }
+    if (message["type"] === "action") {
+      if (!exactKeys(message, ["schemaVersion", "type", "name", "pageLocation"])) return;
+      if (
+        typeof message["name"] !== "string" || !APPROVED_ACTIONS.has(message["name"]) ||
+        message["pageLocation"] !== lastPageLocation || !lastPageLocation
+      ) return;
+      gtag("event", message["name"], { send_to: currentGroup, page_location: lastPageLocation });
+    }
+  };
+
+  port.onmessage = (event: MessageEvent<NativeGa4SandboxPortMessage>) => {
+    try {
+      const message = plainRecord(event.data);
+      if (!message || disposed) return;
+      if (message["type"] === "configure") return configure(message);
+      if (message["type"] === "disable") {
+        if (exactKeys(message, ["schemaVersion", "type"]) && message["schemaVersion"] === 1) {
+          active = false;
+          lastPageLocation = "";
+        }
+        return;
+      }
+      if (message["type"] === "dispose") {
+        if (exactKeys(message, ["schemaVersion", "type"]) && message["schemaVersion"] === 1) {
+          active = false;
+          disposed = true;
+          lastPageLocation = "";
+          port.close();
+        }
+        return;
+      }
+      deliver(message);
+    } catch {
+      // Every malformed port message fails closed without exposing an oracle.
+    }
+  };
+  port.start();
+}
+
+if (typeof window !== "undefined" && typeof document !== "undefined") {
+  startNativeGa4Sandbox(window, document);
+}