@tokenoftrust/storefront-runner 2.0.30 → 2.0.32

package/packages/public-runtime/src/integration/platform-adapter-runtime.ts

@@ -17,11 +17,11 @@ import {
   createAmplitudeLifecycleModule,
 } from "./native-amplitude.js";
 import {
-  createNativeGa4FetchTransport,
   createNativeGa4Module,
   NATIVE_GA4_ADAPTER_VERSION,
   NATIVE_GA4_ENTRY_URL,
   NATIVE_GA4_RUNTIME_ID,
+  type NativeGa4Transport,
 } from "./native-ga4.js";
 import { AMPLITUDE_HTTP_ADAPTER, GOOGLE_MEASUREMENT_ADAPTER } from "./platform-adapters.js";
 
@@ -38,7 +38,8 @@ export interface PlatformAdapterEntryMarker {
 }
 
 export interface PlatformAdapterRuntimeHost {
-  fetch: typeof fetch;
+  fetch?: typeof fetch;
+  nativeGa4Transport?: NativeGa4Transport;
 }
 
 export interface PlatformAdapterRuntimeRegistration {
@@ -70,19 +71,23 @@ const AMPLITUDE_MARKER: PlatformAdapterEntryMarker = Object.freeze({
 export const PLATFORM_ADAPTER_RUNTIME_REGISTRY: readonly PlatformAdapterRuntimeRegistration[] = Object.freeze([
   Object.freeze({
     marker: GA4_MARKER,
-    create: ({ fetch: fetchCapability }: PlatformAdapterRuntimeHost) => createNativeGa4Module({
-      transport: createNativeGa4FetchTransport(fetchCapability),
-    }),
+    create: ({ nativeGa4Transport }: PlatformAdapterRuntimeHost) => {
+      if (!nativeGa4Transport) throw new Error("platform_adapter_ga4_sandbox_unavailable");
+      return createNativeGa4Module({ transport: nativeGa4Transport });
+    },
   }),
   Object.freeze({
     marker: AMPLITUDE_MARKER,
-    create: ({ fetch: fetchCapability }: PlatformAdapterRuntimeHost) =>
-      createAmplitudeLifecycleModule({ fetch: fetchCapability }),
+    create: ({ fetch: fetchCapability }: PlatformAdapterRuntimeHost) => {
+      if (!fetchCapability) throw new Error("platform_adapter_fetch_unavailable");
+      return createAmplitudeLifecycleModule({ fetch: fetchCapability });
+    },
   }),
 ]);
 
 export interface PlatformAdapterRuntimeLoaderOptions {
   fetchCapability?: typeof fetch;
+  nativeGa4Transport?: () => NativeGa4Transport;
   importModule?: (url: string) => Promise<unknown>;
   fallback: IntegrationModuleLoader;
 }
@@ -137,10 +142,14 @@ export function makePlatformAdapterRuntimeLoader(
     if (!platformClaim(integration)) return options.fallback(integration);
     const registration = registrationFor(integration);
     if (!registration) throw new Error("platform_adapter_entry_unreviewed");
-    if (!options.fetchCapability) throw new Error("platform_adapter_fetch_unavailable");
     const namespace = await importModule(registration.marker.entry.url);
     const marker = (namespace as { platformAdapterEntry?: unknown })?.platformAdapterEntry;
     if (!markerEquals(registration.marker, marker)) throw new Error("platform_adapter_entry_invalid");
-    return registration.create({ fetch: options.fetchCapability });
+    return registration.create({
+      fetch: options.fetchCapability,
+      nativeGa4Transport: registration.marker.appId === GOOGLE_MEASUREMENT_ADAPTER.adapterId
+        ? options.nativeGa4Transport?.()
+        : undefined,
+    });
   };
 }

package/packages/public-runtime/src/integration/platform-adapters.ts

@@ -107,6 +107,8 @@ export interface PlatformAdapterDefinition {
   supportUrl: string;
   /** The ONE platform-owned entry module every instance of this adapter points at. */
   entryAsset: string;
+  /** Vendor origins used inside the reviewed adapter, independent of parent CSP effects. */
+  collectionOrigins: readonly string[];
   /** The curated CSP profile slug this adapter's origins come from. */
   cspProfile: IntegrationCspProfile;
   /** The consent purpose the destination depends on (the broker enforces it). */
@@ -137,10 +139,10 @@ const META_PIXEL_ID = /^\d{10,20}$/;
 const AMPLITUDE_PROJECT_KEY = /^(?=[a-f0-9]{32}$)(?=.*[a-f])[a-f0-9]+$/i;
 
 /**
- * Native Google Analytics 4 measurement. A single public measurement id drives
- * the platform adapter, which sends reviewed event payloads to the curated analytics
- * endpoints in the `google-measurement` CSP profile. It does not run a merchant-owned
- * browser container. Depends on analytics consent (ADR 0023 Q3).
+ * Native Google Analytics 4 measurement. Reviewed parent code sends a closed event
+ * protocol to supported gtag.js inside a null-origin iframe. Google code and network
+ * authority stay out of the parent document. It does not run a merchant-owned browser
+ * container. Depends on analytics consent (ADR 0023 Q3).
  */
 export const GOOGLE_MEASUREMENT_ADAPTER: PlatformAdapterDefinition = Object.freeze({
   adapterId: "platform.google-measurement",
@@ -148,20 +150,24 @@ export const GOOGLE_MEASUREMENT_ADAPTER: PlatformAdapterDefinition = Object.free
   purpose: "Native Google Analytics 4 measurement.",
   publisher: "Storefront platform adapter",
   supportUrl: "https://developers.google.com/analytics/devguides/collection/ga4",
-  entryAsset: "/platform/google-measurement/v1/entry.mjs",
+  entryAsset: "/platform/google-measurement/v2/entry.mjs",
+  collectionOrigins: Object.freeze([
+    "https://www.googletagmanager.com",
+    "https://www.google-analytics.com",
+    "https://analytics.google.com",
+  ]),
   cspProfile: "google-measurement",
   consentPurpose: "analytics",
   phase: "document.deferred",
   performanceBudget: Object.freeze({
     maxTransferredBytes: 90_000,
-    maxAdditionalRequests: 4,
+    maxAdditionalRequests: 5,
     maxMainThreadMilliseconds: 120,
     mustBeAsyncOrDeferred: true,
   }),
   idLabel: "GA4 measurement id (e.g. G-XXXXXXX)",
-  // GA4 natively receives one event at several properties (a primary plus a rollup); the
-  // wire shape is one `/g/collect` request per measurement id, so the ceiling is the
-  // budget's own `maxAdditionalRequests`.
+  // One gtag.js loader plus one event request per configured property (primary + rollups).
+  // The four-destination ceiling therefore consumes the five-request budget exactly.
   maxDestinationsPerStage: 4,
   validateId: (id: string) => GOOGLE_MEASUREMENT_ID.test(id),
   eventMap: Object.freeze({
@@ -183,6 +189,7 @@ export const META_PIXEL_ADAPTER: PlatformAdapterDefinition = Object.freeze({
   publisher: "Storefront platform adapter",
   supportUrl: "https://developers.facebook.com/docs/meta-pixel",
   entryAsset: "platform/meta-pixel/v1/entry.mjs",
+  collectionOrigins: Object.freeze(["https://connect.facebook.net", "https://www.facebook.com"]),
   cspProfile: "meta-pixel",
   consentPurpose: "marketing",
   phase: "document.deferred",
@@ -217,6 +224,7 @@ export const AMPLITUDE_HTTP_ADAPTER: PlatformAdapterDefinition = Object.freeze({
   publisher: "Storefront platform adapter",
   supportUrl: "https://amplitude.com/docs/apis/analytics/http-v2",
   entryAsset: "/platform/amplitude-http/v1/entry.mjs",
+  collectionOrigins: Object.freeze(["https://api2.amplitude.com"]),
   cspProfile: "amplitude-http",
   consentPurpose: "analytics",
   phase: "document.deferred",
@@ -347,6 +355,8 @@ export interface PlatformAdapterCard {
   performanceBudget: PerformanceBudget;
   /** The exact CSP origins this adapter contributes (flattened, sorted). */
   cspOrigins: string[];
+  /** Vendor collection/loading origins, even when isolated from the parent CSP. */
+  collectionOrigins: string[];
   /** The semantic events this adapter measures. */
   eventTypes: CommerceEventType[];
   /** Which stages have a configured destination id, and whether each is conversion-live. */
@@ -415,6 +425,7 @@ export function buildPlatformAdapterCard(
     consentPurposes: [def.consentPurpose],
     performanceBudget: def.performanceBudget,
     cspOrigins: profileOrigins(def.cspProfile),
+    collectionOrigins: [...def.collectionOrigins].sort(),
     eventTypes: adapterEventTypes(def),
     destinationBehavior: stageBehavior(ids),
   };

package/packages/public-runtime/src/integration/render-phases.ts

@@ -40,6 +40,7 @@ import {
 } from "./environment.js";
 import { defaultConsentSnapshot, type ConsentSnapshot } from "./consent-broker.js";
 import { LIFECYCLE_HOST_ASSET_URL } from "./lifecycle-host-asset.mjs";
+import { VIEWER_ANALYTICS_CONSENT_EARLY_BOOT_JS } from "./consent-broker.js";
 
 /** Re-exported so consumers and tests read the host URL from the engine that emits it. */
 export { LIFECYCLE_HOST_ASSET_PATH, LIFECYCLE_HOST_ASSET_URL } from "./lifecycle-host-asset.mjs";
@@ -163,10 +164,14 @@ export function renderIntegrationPhases(
     phaseBoundary("consent.defaults") +
     inlineFrozenGlobal(INTEGRATION_CONSENT_GLOBAL, consentSnapshot, nonce) +
     phaseBoundary("head.early") +
-    inlineFrozenGlobal(INTEGRATION_PLAN_GLOBAL, bootDescriptor(plan), nonce);
+    inlineFrozenGlobal(INTEGRATION_PLAN_GLOBAL, bootDescriptor(plan), nonce) +
+    inlineScript(VIEWER_ANALYTICS_CONSENT_EARLY_BOOT_JS, nonce) +
+    viewerAnalyticsConsentStyle(nonce);
 
   const bodyStart =
-    phaseBoundary("body.start") + `<div data-tot-integration-root hidden></div>`;
+    phaseBoundary("body.start") +
+    `<div data-tot-integration-root hidden></div>` +
+    viewerAnalyticsConsentControl();
 
   const bodyDeferred =
     phaseBoundary("document.deferred") +
@@ -196,6 +201,27 @@ function lifecycleHostScript(): string {
   return `<script type="module" src="${LIFECYCLE_HOST_ASSET_URL}"></script>`;
 }
 
+function inlineScript(source: string, nonce: string): string {
+  const nonceAttr = nonce ? ` nonce="${nonce}"` : "";
+  return `<script${nonceAttr}>${source}</script>`;
+}
+
+/** Renderer-owned, provider-neutral viewer control: identical in both document mounts. */
+function viewerAnalyticsConsentStyle(nonce: string): string {
+  const style = `.tot-analytics-consent{position:fixed;z-index:900;right:1rem;bottom:1rem;display:flex;max-width:min(30rem,calc(100vw - 2rem));align-items:center;gap:.65rem;padding:.7rem .8rem;border:1px solid var(--color-border,#cbd5e1);border-radius:.75rem;background:var(--color-bg,#fff);color:var(--color-text,#111827);box-shadow:0 8px 30px rgba(15,23,42,.18);font:500 .75rem/1.25 system-ui,sans-serif}.tot-analytics-consent__copy{display:grid;gap:.15rem;min-width:8rem}.tot-analytics-consent__detail{color:var(--color-muted,#475569);font-size:.68rem}.tot-analytics-consent__actions{display:flex;gap:.4rem}.tot-analytics-consent button{border:1px solid currentColor;border-radius:999px;background:transparent;color:inherit;padding:.4rem .65rem;font:inherit;cursor:pointer}.tot-analytics-consent button:disabled{cursor:default;opacity:.45}@media(max-width:34rem){.tot-analytics-consent{left:1rem;right:1rem;align-items:flex-start;flex-direction:column}.tot-analytics-consent__actions{width:100%}.tot-analytics-consent button{flex:1}}`;
+  return `<style${nonce ? ` nonce="${nonce}"` : ""}>${style}</style>`;
+}
+
+function viewerAnalyticsConsentControl(): string {
+  return `<aside class="tot-analytics-consent" data-tot-analytics-consent-control aria-label="Analytics privacy settings">` +
+    `<span class="tot-analytics-consent__copy"><strong data-tot-analytics-consent-status aria-live="polite">Analytics off</strong>` +
+    `<span class="tot-analytics-consent__detail">Choose whether anonymous analytics may run.</span></span>` +
+    `<span class="tot-analytics-consent__actions">` +
+    `<button type="button" data-tot-analytics-consent-decision="granted" aria-pressed="false" disabled>Allow</button>` +
+    `<button type="button" data-tot-analytics-consent-decision="denied" aria-pressed="true" disabled>Decline</button>` +
+    `</span></aside>`;
+}
+
 /**
  * Replace every {@link INTEGRATION_NONCE_PLACEHOLDER} in `text` (an HTML body or a
  * CSP header value) with one fresh per-response `nonce`. Idempotent on text with no

package/packages/public-runtime/src/integration/version.ts

@@ -11,13 +11,13 @@
  * schema versions fail closed.
  */
 
-export const BROWSER_INTEGRATION_CONTRACT_VERSION = "2.0.0" as const;
+export const BROWSER_INTEGRATION_CONTRACT_VERSION = "3.0.0" as const;
 
 export const ENVIRONMENT_SCHEMA_VERSION = 1 as const;
 export const INTEGRATION_MANIFEST_SCHEMA_VERSION = 2 as const;
 export const EFFECTIVE_PLAN_SCHEMA_VERSION = 1 as const;
 export const COMMERCE_EVENT_STOREFRONT_SCHEMA_VERSION = 1 as const;
-export const CONSENT_SNAPSHOT_SCHEMA_VERSION = 1 as const;
+export const CONSENT_SNAPSHOT_SCHEMA_VERSION = 2 as const;
 export const RECEIPT_MEASUREMENT_GRANT_SCHEMA_VERSION = 1 as const;
 export const CONSENT_CONFIG_SCHEMA_VERSION = 1 as const;
 export const ASSURANCE_RECORD_SCHEMA_VERSION = 1 as const;

package/packages/public-runtime/tests/fixtures/integration/commerce-event.example.json

@@ -21,7 +21,7 @@
     "expiresAt": "2026-08-28T21:15:30.000Z"
   },
   "consent": {
-    "schemaVersion": 1,
+    "schemaVersion": 2,
     "snapshotId": "consent_public_01J6EXAMPLE",
     "eligiblePurposes": [
       "essential",

package/packages/public-runtime/tests/fixtures/integration/commerce-order-event.example.json

@@ -20,7 +20,7 @@
     "expiresAt": "2026-08-28T21:15:30.000Z"
   },
   "consent": {
-    "schemaVersion": 1,
+    "schemaVersion": 2,
     "snapshotId": "consent_public_01J6EXAMPLE",
     "eligiblePurposes": [
       "essential",

package/packages/public-runtime/tests/fixtures/integration/integration-manifest-v2.example.json

@@ -11,7 +11,7 @@
     "supportUrl": "https://support.example.invalid/storefront"
   },
   "compatibility": {
-    "storefrontBrowserContract": ">=2.0.0 <3.0.0",
+    "storefrontBrowserContract": ">=3.0.0 <4.0.0",
     "configurationSchemaVersion": 3
   },
   "browser": {

package/packages/public-runtime/tests/fixtures/integration/tenant-local-example/manifest.json

@@ -10,7 +10,7 @@
     "supportUrl": "https://acme.example/support"
   },
   "compatibility": {
-    "storefrontBrowserContract": ">=2.0.0 <3.0.0",
+    "storefrontBrowserContract": ">=3.0.0 <4.0.0",
     "configurationSchemaVersion": 2
   },
   "browser": {

package/scripts/tenant/lint-embeds.mjs

@@ -41,12 +41,6 @@ export const KNOWN_EMBEDS = Object.entries(EMBED_PROVIDERS).map(([slug, p]) => (
   origins: [...new Set([...(p.scriptSrc ?? []), ...(p.connectSrc ?? []), ...(p.frameSrc ?? [])])],
 }));
 
-/** Hosts the platform always allows (self is implicit); embeds to these are fine. */
-const ALWAYS_ALLOWED_HOSTS = new Set([
-  "static.cloudflareinsights.com",
-  "cloudflareinsights.com",
-]);
-
 // Only <script src> and <iframe src> load executable/frameable content the CSP
 // gates (script-src / frame-src). We deliberately DON'T scan generic URLs
 // (canonical links, JSON-LD @context, <a href>, og:url) — those aren't embeds
@@ -79,8 +73,6 @@ export function scanHtmlForEmbeds(html) {
   while ((m = SRC_RE.exec(html))) {
     const origin = originOf(m[1]);
     if (!origin) continue;
-    const host = new URL(origin).hostname;
-    if (ALWAYS_ALLOWED_HOSTS.has(host)) continue;
     external.add(origin);
   }
   // An external origin is "unknown" if no catalog provider claims it.

package/apps/storefront/public/platform/google-measurement/v1/entry.mjs

@@ -1,19 +0,0 @@
-/**
- * Reviewed same-origin marker for the native GA4 platform adapter.
- *
- * The lifecycle host imports this exact-version asset, verifies every field, then
- * constructs the adapter from its bundled @tot/public-runtime implementation with
- * host-injected fetch. This file executes no vendor code and reads no browser global.
- */
-export const platformAdapterEntry = Object.freeze({
-  schemaVersion: 1,
-  origin: "platform-adapter",
-  executionTier: "platform-adapter",
-  appId: "platform.google-measurement",
-  version: "1.0.0",
-  entry: Object.freeze({
-    url: "/platform/google-measurement/v1/entry.mjs",
-    format: "module",
-  }),
-  runtime: "native-ga4-v1",
-});