@tokenoftrust/storefront-runner 2.0.31 → 2.0.33

package/apps/storefront/astro.config.mjs

@@ -133,6 +133,14 @@ export default defineConfig({
         "@astrojs/cloudflare/entrypoints/preview.js",
       ],
     },
+    // The Cloudflare dev worker keeps its SSR module graph across Vite optimizer
+    // turns. Prebundle Preact's renderer before that graph is loaded so it never
+    // retains a URL for a superseded .vite/deps_ssr chunk.
+    ssr: {
+      optimizeDeps: {
+        include: ["@astrojs/preact/server.js"],
+      },
+    },
     // Dev-only: let the dev server accept tenant Host headers so host-based
     // tenant routing can be tested locally (e.g. curl -H 'Host: sample-store.example').
     // Prod runs on Cloudflare Workers, which has no such allowlist.

package/apps/storefront/env.d.ts

@@ -61,7 +61,6 @@ interface CloudflareEnv {
   TOT_API_KEY?: string;
   TOT_SECRET_KEY?: string;
   TOT_ACCESS_TOKEN?: string;
-  PUBLIC_CF_ANALYTICS_TOKEN?: string;
   /** HMAC secret for signing/verifying customization preview tokens. */
   CUSTOMIZATION_PREVIEW_SECRET?: string;
   /**
@@ -260,7 +259,6 @@ interface ImportMetaEnv {
   readonly TOT_API_KEY?: string;
   readonly TOT_SECRET_KEY?: string;
   readonly TOT_ACCESS_TOKEN?: string;
-  readonly PUBLIC_CF_ANALYTICS_TOKEN?: string;
   readonly CUSTOMIZATION_PREVIEW_SECRET?: string;
 }
 interface ImportMeta {

package/apps/storefront/src/layouts/Layout.astro

@@ -222,10 +222,6 @@ const { gridColumns: footerColumns, legalLinks: bottomLinks } = splitFooterLegal
 const legalBase = chrome.footer.bottom?.copyright ?? `© ${new Date().getFullYear()} ${tenant.displayName}`;
 const legalLine = `${legalBase}${chrome.footer.bottom?.note ? ` · ${chrome.footer.bottom.note}` : ""}`;
 
-const analyticsToken = import.meta.env.PUBLIC_CF_ANALYTICS_TOKEN;
-const analyticsEnabled =
-  analyticsToken && !/REPLACE|PLACEHOLDER/i.test(analyticsToken);
-
 // Private-app widgets — global.footer slot. Resolved once here so it
 // renders for BOTH footer paths below (the tenant-owned chrome.html splice
 // and the generic <Footer>) instead of being owned by either. No dark-mode
@@ -293,46 +289,6 @@ const footerWidgets = await renderWidgetSlot(
       alternates={alternates}
     />
 
-    {
-      /* Cloudflare Web Analytics is a non-essential measurement destination —
-         gate it on the SAME neutral consent broker every vendor loader reads
-         (ext-kernel-04 `consent.defaults` phase, published above as
-         `window.__TOT_INTEGRATION_CONSENT__`). The token rides a <meta> tag
-         (any script attribute, incl. define:vars, forces is:inline and drops
-         module processing — this script needs a real import) rather than a
-         page global; the script fail-closes like every other consumer of that
-         global: an absent/tampered snapshot denies, so an unconfigured CMP
-         means this never loads rather than loading ungated. */
-      analyticsEnabled && <meta name="cf-beacon-token" content={analyticsToken} />
-    }
-    {
-      analyticsEnabled && (
-        <script>
-          import {
-            parseConsentSnapshot,
-            isPurposeEligible,
-            defaultConsentSnapshot,
-            INTEGRATION_CONSENT_GLOBAL,
-          } from "@tot/public-runtime";
-
-          const snapshot =
-            parseConsentSnapshot((window as unknown as Record<string, unknown>)[INTEGRATION_CONSENT_GLOBAL]) ??
-            defaultConsentSnapshot();
-
-          const token = document
-            .querySelector('meta[name="cf-beacon-token"]')
-            ?.getAttribute("content");
-
-          if (token && isPurposeEligible(snapshot, "analytics")) {
-            const beacon = document.createElement("script");
-            beacon.defer = true;
-            beacon.src = "https://static.cloudflareinsights.com/beacon.min.js";
-            beacon.setAttribute("data-cf-beacon", JSON.stringify({ token }));
-            document.head.appendChild(beacon);
-          }
-        </script>
-      )
-    }
   </head>
   <body>
     {/* body.start fallback boundary (ext-kernel-04) — the renderer-owned mount
@@ -582,11 +538,10 @@ const footerWidgets = await renderWidgetSlot(
     {/* Field Web Vitals (RUM) — measures LCP/INP/CLS for real visitors and
         beacons per-route samples to the RUM sink. ~1KB, no framework; no-ops
         where PerformanceObserver is absent. This is the per-route-template
-        signal the `core-web-vitals` monitor consumes (the CF Web Analytics
-        beacon above only gives aggregate field CWV). */}
+        signal the `core-web-vitals` monitor consumes. */}
     <script>
-      import { startWebVitals } from "@/lib/analytics/webVitals";
-      startWebVitals();
+      import { startConsentGatedWebVitals } from "@/lib/analytics/webVitals";
+      startConsentGatedWebVitals();
     </script>
 
     {/* Protected-surface tamper sentinel (ext-policy-09, D-R7) — a DETECTIVE

package/apps/storefront/src/lib/analytics/budgets.json

@@ -15,7 +15,6 @@
     "totalKib": 1300
   },
   "thirdPartyScriptAllowlist": [
-    "static.cloudflareinsights.com",
     "cdn.foxycart.com"
   ],
   "routes": [

package/apps/storefront/src/lib/analytics/index.ts

@@ -1,10 +1,7 @@
 /**
  * Privacy-friendly analytics (brief §5 Analytics).
  *
- * Phase 1 ships TWO layers:
- *  1. Pageviews — Cloudflare Web Analytics, a single beacon script injected in
- *     Layout.astro when PUBLIC_CF_ANALYTICS_TOKEN is set (no cookies, no PII).
- *  2. Commerce events — product impression/click/PDP-view instrumented NOW to a
+ * Phase 1 ships commerce events — product impression/click/PDP-view instrumented NOW to a
  *     NO-OP sink, so Phase 2 conversion work inherits the call sites for free.
  *
  * The event API is intentionally tiny and synchronous-looking; swap the sink

package/apps/storefront/src/lib/analytics/webVitals.ts

@@ -24,12 +24,16 @@
  * + bucketing in node; `startWebVitals` is the thin browser wiring, guarded so
  * importing this module in a non-browser context (SSR, tests) is a no-op.
  *
- * Field CWV is emitted TWICE, deliberately: Cloudflare Web Analytics
- * (PUBLIC_CF_ANALYTICS_TOKEN, Layout.astro) already gives aggregate field CWV;
- * this beacon adds the PER-ROUTE-TEMPLATE breakdown the budget gate + the
- * regression alert (`rumAlert.ts`) reason over, which CF's aggregate cannot.
+ * Field CWV is emitted through the consent-gated per-route-template beacon that the
+ * budget gate and regression alert (`rumAlert.ts`) reason over.
  */
 import { classifyPath, PERF_BUDGETS, type PerfBudgetManifest, type RouteClass } from "./perfBudgets.js";
+import {
+  INTEGRATION_CONSENT_GLOBAL,
+  VIEWER_ANALYTICS_CONSENT_CHANGE_EVENT,
+  isPurposeEligible,
+  parseConsentSnapshot,
+} from "@tot/public-runtime";
 
 /** The three field metrics we collect. INP is field-only (no lab equivalent). */
 export type WebVitalName = "lcp" | "inp" | "cls";
@@ -267,3 +271,37 @@ export function startWebVitals(
     inpObs.disconnect();
   };
 }
+
+/**
+ * Keep field telemetry behind the same authenticated viewer-consent snapshot as
+ * every managed analytics adapter. Withdrawal tears down observers before they
+ * can flush; a later grant starts a fresh collector for the current document.
+ */
+export function startConsentGatedWebVitals(
+  start: () => () => void = () => startWebVitals(),
+): () => void {
+  if (typeof window === "undefined") return () => {};
+  const win = window as unknown as Record<string, unknown>;
+  let stopCollector: (() => void) | null = null;
+  let disposed = false;
+  const sync = () => {
+    if (disposed) return;
+    const snapshot = parseConsentSnapshot(win[INTEGRATION_CONSENT_GLOBAL]);
+    const eligible = snapshot !== null && isPurposeEligible(snapshot, "analytics");
+    if (eligible && !stopCollector) {
+      stopCollector = start();
+    } else if (!eligible && stopCollector) {
+      const stop = stopCollector;
+      stopCollector = null;
+      stop();
+    }
+  };
+  window.addEventListener(VIEWER_ANALYTICS_CONSENT_CHANGE_EVENT, sync);
+  sync();
+  return () => {
+    disposed = true;
+    window.removeEventListener(VIEWER_ANALYTICS_CONSENT_CHANGE_EVENT, sync);
+    stopCollector?.();
+    stopCollector = null;
+  };
+}

package/apps/storefront/src/lib/integration/tenantDeclarations.ts

@@ -69,7 +69,7 @@ const DEMO_ANALYTICS_MANIFEST: IntegrationManifest = {
     digest: `sha256:${DEMO_ANALYTICS_APP_ID}-${DEMO_ANALYTICS_VERSION}`,
     publisher: "Token of Trust",
   },
-  compatibility: { storefrontBrowserContract: ">=2.0.0 <3.0.0", configurationSchemaVersion: 1 },
+  compatibility: { storefrontBrowserContract: ">=3.0.0 <4.0.0", configurationSchemaVersion: 1 },
   browser: {
     executionTier: "sandbox",
     entry: { asset: DEMO_ANALYTICS_ENTRY_URL, format: "module", phase: "document.deferred" },

package/apps/storefront/src/lib/monitoring/manifest.ts

@@ -258,8 +258,7 @@ export const MONITORS: readonly Monitor[] = [
     runbook: "bad-content-policy",
     wiring: "needs-external",
     notes:
-      "Reference F14's RUM signal by name; do NOT edit F14's analytics files. Cloudflare Web Analytics " +
-      "(PUBLIC_CF_ANALYTICS_TOKEN, injected in Layout.astro) gives field CWV today; F14's beacon gives per-template detail.",
+      "Reference F14's consent-gated RUM signal by name; do not duplicate its analytics implementation.",
   },
 ] as const;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.0.31",
+  "version": "2.0.33",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/src/csp.ts

@@ -78,7 +78,7 @@ export const CSP_REPORT_GROUP = "csp-endpoint";
  * origin) per request.
  */
 export const STOREFRONT_CSP_ALLOWLIST = {
-  scriptSrc: ["https://static.cloudflareinsights.com"],
+  scriptSrc: [],
   // Web fonts are self-hosted (@fontsource, bundled same-origin) — no
   // fonts.googleapis.com stylesheet or fonts.gstatic.com woff2 to allowlist;
   // 'self' + `data:` (both added by buildCsp) cover style-src + font-src,
@@ -87,7 +87,7 @@ export const STOREFRONT_CSP_ALLOWLIST = {
   fontSrc: [],
   // Product imagery is rehosted to R2 or served from remote CDNs.
   imgSrc: ["https:"],
-  connectSrc: ["https://cloudflareinsights.com"],
+  connectSrc: [],
 } as const;
 
 /**

package/packages/public-runtime/src/integration/consent-broker.ts

@@ -92,13 +92,16 @@ export interface ConsentDestination {
 
 /**
  * The versioned, browser-safe consent snapshot — the single value client and server
- * destinations filter against. `eligiblePurposes` is in canonical purpose order and
- * always contains `essential`. `unknownState` is always `"block"` (fail closed).
+ * destinations filter against. `eligiblePurposes` and `approvedPurposes` are in
+ * canonical purpose order and always contain `essential`; approval is deliberately
+ * separate from current viewer eligibility. `unknownState` is always `"block"`.
  */
 export interface ConsentSnapshot {
   schemaVersion: typeof CONSENT_SNAPSHOT_SCHEMA_VERSION;
   snapshotId: string;
   eligiblePurposes: ConsentPurpose[];
+  /** Purposes the tenant approved to exist, whether or not this viewer granted them. */
+  approvedPurposes: ConsentPurpose[];
   unknownState: "block";
 }
 
@@ -113,20 +116,32 @@ function fnv1a32Hex(input: string): string {
   return (h >>> 0).toString(16).padStart(8, "0");
 }
 
-/** Content-addressed snapshot id: identical eligibility → identical id on client and server. */
-function computeSnapshotId(eligible: readonly ConsentPurpose[]): string {
-  return `cs1-${fnv1a32Hex(`${CONSENT_SNAPSHOT_SCHEMA_VERSION}:${eligible.join(",")}`)}`;
+/** Content-addressed snapshot id: identical eligibility + approval → identical id on client and server. */
+function computeSnapshotId(
+  eligible: readonly ConsentPurpose[],
+  approved: readonly ConsentPurpose[],
+): string {
+  return `cs${CONSENT_SNAPSHOT_SCHEMA_VERSION}-${fnv1a32Hex(
+    `${CONSENT_SNAPSHOT_SCHEMA_VERSION}:${eligible.join(",")}:${approved.join(",")}`,
+  )}`;
 }
 
 /** Build a snapshot from an eligible set, forcing `essential` on and canonicalizing order. */
-function makeSnapshot(eligible: Iterable<ConsentPurpose>): ConsentSnapshot {
+function makeSnapshot(
+  eligible: Iterable<ConsentPurpose>,
+  approved: Iterable<ConsentPurpose> = eligible,
+): ConsentSnapshot {
   const set = new Set<ConsentPurpose>(eligible);
   set.add(ESSENTIAL);
+  const approvedSet = new Set<ConsentPurpose>(approved);
+  approvedSet.add(ESSENTIAL);
   const eligiblePurposes = CONSENT_PURPOSES.filter((p) => set.has(p));
+  const approvedPurposes = CONSENT_PURPOSES.filter((p) => approvedSet.has(p));
   return {
     schemaVersion: CONSENT_SNAPSHOT_SCHEMA_VERSION,
-    snapshotId: computeSnapshotId(eligiblePurposes),
+    snapshotId: computeSnapshotId(eligiblePurposes, approvedPurposes),
     eligiblePurposes,
+    approvedPurposes,
     unknownState: "block",
   };
 }
@@ -137,7 +152,7 @@ function makeSnapshot(eligible: Iterable<ConsentPurpose>): ConsentSnapshot {
  * granted. This is what precedes every vendor loader.
  */
 export function defaultConsentSnapshot(): ConsentSnapshot {
-  return makeSnapshot([ESSENTIAL]);
+  return makeSnapshot([ESSENTIAL], [ESSENTIAL]);
 }
 
 /**
@@ -204,9 +219,8 @@ export function serializeConsentSnapshot(snapshot: ConsentSnapshot): string {
 
 /**
  * Parse a serialized snapshot fail-closed: an unknown schema version, a non-block
- * unknown state, an unknown purpose, a missing `essential`, or an id that does not
- * match the eligible set yields `null` — a caller cannot smuggle in a forged or
- * tampered snapshot.
+ * unknown state, an unknown purpose, a missing `essential`, eligibility outside the
+ * tenant-approved set, or an id that does not match both sets yields `null`.
  */
 export function parseConsentSnapshot(raw: unknown): ConsentSnapshot | null {
   let obj: unknown = raw;
@@ -230,7 +244,14 @@ export function parseConsentSnapshot(raw: unknown): ConsentSnapshot | null {
   }
   const eligible = CONSENT_PURPOSES.filter((p) => (eligibleRaw as string[]).includes(p));
   if (!eligible.includes(ESSENTIAL)) return null;
-  const canonical = makeSnapshot(eligible);
+  const approvedRaw = s["approvedPurposes"];
+  if (!Array.isArray(approvedRaw)) return null;
+  for (const p of approvedRaw) {
+    if (typeof p !== "string" || !known.has(p)) return null;
+  }
+  const approved = CONSENT_PURPOSES.filter((p) => (approvedRaw as string[]).includes(p));
+  if (!approved.includes(ESSENTIAL) || eligible.some((p) => !approved.includes(p))) return null;
+  const canonical = makeSnapshot(eligible, approved);
   if (canonical.snapshotId !== s["snapshotId"]) return null;
   return canonical;
 }
@@ -423,7 +444,7 @@ export class ConsentBroker {
 
   private compute(): ConsentSnapshot {
     const eligible = CONSENT_PURPOSES.filter((p) => this.effective(p) === "granted");
-    return makeSnapshot(eligible);
+    return makeSnapshot(eligible, [ESSENTIAL, ...this.approved.keys()]);
   }
 
   private update(): ConsentSnapshot {
@@ -450,3 +471,339 @@ export class ConsentBroker {
     }
   }
 }
+
+/**
+ * Viewer-owned analytics consent for the public storefront document.
+ *
+ * The tenant configuration says which purposes may exist; it never speaks for the
+ * viewer. This controller therefore removes a baked analytics grant until the viewer
+ * has made an explicit, unexpired choice. The same synchronous early boot runs in both
+ * document mounts before any integration or measurement loader can execute.
+ */
+
+export const VIEWER_ANALYTICS_CONSENT_STORAGE_KEY = "tot.viewer-analytics-consent.v1";
+export const VIEWER_ANALYTICS_CONSENT_STATE_GLOBAL = "__TOT_VIEWER_ANALYTICS_CONSENT__";
+export const VIEWER_ANALYTICS_CONSENT_CHANGE_EVENT = "tot:viewer-analytics-consent-changed";
+export const VIEWER_ANALYTICS_CONSENT_RETENTION_DAYS = 180;
+export const VIEWER_ANALYTICS_REGION_POLICY = "universal-opt-in" as const;
+
+export type ViewerAnalyticsConsentDecision = "granted" | "denied";
+
+export interface ViewerAnalyticsConsentState {
+  schemaVersion: 1;
+  decision: ViewerAnalyticsConsentDecision;
+  source: "default-deny" | "stored" | "global-privacy-control";
+  canGrant: boolean;
+  expiresAt: number | null;
+  retentionDays: typeof VIEWER_ANALYTICS_CONSENT_RETENTION_DAYS;
+  regionPolicy: typeof VIEWER_ANALYTICS_REGION_POLICY;
+  tenantPublicId: string;
+  environment: string;
+  siteSurface: string;
+}
+
+interface ViewerConsentWindow {
+  navigator?: { globalPrivacyControl?: boolean };
+  localStorage?: {
+    getItem(key: string): string | null;
+    setItem(key: string, value: string): void;
+  };
+  document?: Document;
+  addEventListener?: (type: string, listener: (event: { key?: string | null }) => void) => void;
+  dispatchEvent?: (event: Event) => boolean;
+  CustomEvent?: typeof CustomEvent;
+  [key: string]: unknown;
+}
+
+/**
+ * Apply the effective viewer decision before any analytics loader runs.
+ *
+ * This function is deliberately closure-free: its runtime source is also serialized
+ * into the renderer's early-head script, keeping the tested function and emitted boot
+ * byte-for-byte one implementation rather than two drifting copies.
+ */
+export function applyEarlyViewerAnalyticsConsent(
+  win: ViewerConsentWindow,
+  now: number = Date.now(),
+  override?: ViewerAnalyticsConsentDecision,
+): ViewerAnalyticsConsentState {
+  const consentGlobal = "__TOT_INTEGRATION_CONSENT__";
+  const planGlobal = "__TOT_INTEGRATION_PLAN__";
+  const stateGlobal = "__TOT_VIEWER_ANALYTICS_CONSENT__";
+  const storageKey = "tot.viewer-analytics-consent.v1";
+  const retentionDays = 180;
+  const retentionMs = retentionDays * 24 * 60 * 60 * 1000;
+  const canonicalPurposes = ["essential", "analytics", "marketing", "personalization"];
+
+  const current = win[consentGlobal] as {
+    schemaVersion?: unknown;
+    snapshotId?: unknown;
+    eligiblePurposes?: unknown;
+    approvedPurposes?: unknown;
+    unknownState?: unknown;
+  } | undefined;
+  const plan = win[planGlobal] as {
+    tenantPublicId?: unknown;
+    environment?: unknown;
+    siteSurface?: unknown;
+  } | undefined;
+  const candidateEligible = Array.isArray(current?.eligiblePurposes)
+    ? current.eligiblePurposes.filter((purpose): purpose is string =>
+        typeof purpose === "string" && canonicalPurposes.includes(purpose))
+    : [];
+  const candidateApproved = Array.isArray(current?.approvedPurposes)
+    ? current.approvedPurposes.filter((purpose): purpose is string =>
+        typeof purpose === "string" && canonicalPurposes.includes(purpose))
+    : [];
+  const snapshotIdFor = (eligible: readonly string[], approved: readonly string[]) => {
+    let hash = 0x811c9dc5;
+    const digestInput = `2:${eligible.join(",")}:${approved.join(",")}`;
+    for (let index = 0; index < digestInput.length; index += 1) {
+      const code = digestInput.charCodeAt(index);
+      hash = Math.imul(hash ^ (code & 0xff), 0x01000193);
+      hash = Math.imul(hash ^ ((code >> 8) & 0xff), 0x01000193);
+    }
+    return `cs2-${(hash >>> 0).toString(16).padStart(8, "0")}`;
+  };
+  const snapshotValid =
+    current?.schemaVersion === 2 &&
+    current.unknownState === "block" &&
+    Array.isArray(current.eligiblePurposes) &&
+    candidateEligible.length === current.eligiblePurposes.length &&
+    Array.isArray(current.approvedPurposes) &&
+    candidateApproved.length === current.approvedPurposes.length &&
+    candidateEligible.join(",") ===
+      canonicalPurposes.filter((purpose) => candidateEligible.includes(purpose)).join(",") &&
+    candidateApproved.join(",") ===
+      canonicalPurposes.filter((purpose) => candidateApproved.includes(purpose)).join(",") &&
+    candidateEligible.includes("essential") &&
+    candidateApproved.includes("essential") &&
+    candidateEligible.every((purpose) => candidateApproved.includes(purpose)) &&
+    current.snapshotId === snapshotIdFor(candidateEligible, candidateApproved);
+  const rawEligible = snapshotValid ? candidateEligible : ["essential"];
+  const rawApproved = snapshotValid ? candidateApproved : ["essential"];
+  const tenantPublicId = typeof plan?.tenantPublicId === "string" ? plan.tenantPublicId : "";
+  const environment = typeof plan?.environment === "string" ? plan.environment : "";
+  const siteSurface = typeof plan?.siteSurface === "string" ? plan.siteSurface : "";
+  const contextKey = `${tenantPublicId}:${environment}:${siteSurface}`;
+  const scopedStorageKey = `${storageKey}:${encodeURIComponent(contextKey)}`;
+  // A manifest's consentNeeds and mutable viewer state are requests, never tenant
+  // approval. Only the current authenticated server-rendered snapshot may grant.
+  const contextComplete = tenantPublicId.length > 0 && environment.length > 0 && siteSurface.length > 0;
+  const tenantApprovedAnalytics = contextComplete && rawApproved.includes("analytics");
+  const globalPrivacyControl = win.navigator?.globalPrivacyControl === true;
+
+  let stored: { decision: ViewerAnalyticsConsentDecision; expiresAt: number } | null = null;
+  if (override) {
+    stored = { decision: override, expiresAt: now + retentionMs };
+  } else {
+    try {
+      const raw = win.localStorage?.getItem(scopedStorageKey);
+      if (raw) {
+        const parsed = JSON.parse(raw) as Record<string, unknown>;
+        const keys = Object.keys(parsed).sort();
+        const decidedAt = parsed["decidedAt"];
+        const expiresAt = parsed["expiresAt"];
+        const decision = parsed["decision"];
+        if (
+          keys.join(",") === "decidedAt,decision,environment,expiresAt,schemaVersion,siteSurface,tenantPublicId" &&
+          parsed["schemaVersion"] === 1 &&
+          parsed["tenantPublicId"] === tenantPublicId &&
+          parsed["environment"] === environment &&
+          parsed["siteSurface"] === siteSurface &&
+          (decision === "granted" || decision === "denied") &&
+          typeof decidedAt === "number" &&
+          Number.isFinite(decidedAt) &&
+          typeof expiresAt === "number" &&
+          Number.isFinite(expiresAt) &&
+          decidedAt <= now &&
+          expiresAt > now &&
+          expiresAt - decidedAt === retentionMs
+        ) {
+          stored = { decision, expiresAt };
+        }
+      }
+    } catch {
+      // Storage denial, malformed data, and hostile access all fail closed.
+    }
+  }
+
+  const decision: ViewerAnalyticsConsentDecision =
+    globalPrivacyControl || !tenantApprovedAnalytics
+      ? "denied"
+      : stored?.decision ?? "denied";
+  const source: ViewerAnalyticsConsentState["source"] = globalPrivacyControl
+    ? "global-privacy-control"
+    : stored
+      ? "stored"
+      : "default-deny";
+
+  const eligible = canonicalPurposes.filter(
+    (purpose) =>
+      purpose === "essential" ||
+      (purpose === "analytics"
+        ? decision === "granted" && tenantApprovedAnalytics
+        : rawEligible.includes(purpose)),
+  );
+  const approved = canonicalPurposes.filter((purpose) => rawApproved.includes(purpose));
+  win[consentGlobal] = Object.freeze({
+    schemaVersion: 2,
+    snapshotId: snapshotIdFor(eligible, approved),
+    eligiblePurposes: Object.freeze(eligible),
+    approvedPurposes: Object.freeze(approved),
+    unknownState: "block",
+  });
+
+  const state: ViewerAnalyticsConsentState = Object.freeze({
+    schemaVersion: 1,
+    decision,
+    source,
+    canGrant: tenantApprovedAnalytics && !globalPrivacyControl,
+    expiresAt: stored?.expiresAt ?? null,
+    retentionDays,
+    regionPolicy: "universal-opt-in",
+    tenantPublicId,
+    environment,
+    siteSurface,
+  });
+  win[stateGlobal] = state;
+  return state;
+}
+
+/** The exact synchronous script rendered after the plan + consent globals in `<head>`. */
+export const VIEWER_ANALYTICS_CONSENT_EARLY_BOOT_JS =
+  `(${applyEarlyViewerAnalyticsConsent.toString()})(window);`;
+
+function writeDecision(
+  win: ViewerConsentWindow,
+  decision: ViewerAnalyticsConsentDecision,
+  now: number,
+): void {
+  const retentionMs = VIEWER_ANALYTICS_CONSENT_RETENTION_DAYS * 24 * 60 * 60 * 1000;
+  try {
+    const plan = win["__TOT_INTEGRATION_PLAN__"] as {
+      tenantPublicId?: unknown;
+      environment?: unknown;
+      siteSurface?: unknown;
+    } | undefined;
+    const tenantPublicId = typeof plan?.tenantPublicId === "string" ? plan.tenantPublicId : "";
+    const environment = typeof plan?.environment === "string" ? plan.environment : "";
+    const siteSurface = typeof plan?.siteSurface === "string" ? plan.siteSurface : "";
+    const contextKey = `${tenantPublicId}:${environment}:${siteSurface}`;
+    win.localStorage?.setItem(
+      `${VIEWER_ANALYTICS_CONSENT_STORAGE_KEY}:${encodeURIComponent(contextKey)}`,
+      JSON.stringify({
+        schemaVersion: 1,
+        decision,
+        decidedAt: now,
+        expiresAt: now + retentionMs,
+        tenantPublicId,
+        environment,
+        siteSurface,
+      }),
+    );
+  } catch {
+    // The in-memory decision still applies to this document; the next load fails closed.
+  }
+}
+
+function notifyViewerAnalyticsConsentChanged(
+  win: ViewerConsentWindow,
+  state: ViewerAnalyticsConsentState,
+): void {
+  const EventCtor = win.CustomEvent ?? (typeof CustomEvent === "function" ? CustomEvent : undefined);
+  if (EventCtor && win.dispatchEvent) {
+    win.dispatchEvent(new EventCtor(VIEWER_ANALYTICS_CONSENT_CHANGE_EVENT, {
+      detail: Object.freeze({ decision: state.decision }),
+    }));
+  }
+
+  const lifecycle = win["__TOT_INTEGRATION_LIFECYCLE__"] as
+    | { update?: (reason: "consent-changed") => unknown }
+    | undefined;
+  try {
+    const updated = lifecycle?.update?.("consent-changed");
+    if (updated && typeof (updated as Promise<unknown>).catch === "function") {
+      void (updated as Promise<unknown>).catch(() => {});
+    }
+  } catch {
+    // Consent state is already deny/grant; an integration cannot make the control fail.
+  }
+}
+
+/** Apply a viewer action, update every broker reader, and notify the live lifecycle. */
+export function setViewerAnalyticsConsent(
+  win: ViewerConsentWindow,
+  decision: ViewerAnalyticsConsentDecision,
+  now: number = Date.now(),
+): ViewerAnalyticsConsentState {
+  if (!(decision === "granted" && win.navigator?.globalPrivacyControl === true)) {
+    writeDecision(win, decision, now);
+  }
+  const state = applyEarlyViewerAnalyticsConsent(win, now, decision);
+  notifyViewerAnalyticsConsentChanged(win, state);
+  return state;
+}
+
+function renderControlState(root: HTMLElement, state: ViewerAnalyticsConsentState): void {
+  const status = root.querySelector<HTMLElement>("[data-tot-analytics-consent-status]");
+  const grant = root.querySelector<HTMLButtonElement>('[data-tot-analytics-consent-decision="granted"]');
+  const deny = root.querySelector<HTMLButtonElement>('[data-tot-analytics-consent-decision="denied"]');
+  if (status) {
+    status.textContent = state.source === "global-privacy-control"
+      ? "Analytics off — Global Privacy Control"
+      : state.decision === "granted"
+        ? "Analytics on"
+        : "Analytics off";
+  }
+  if (grant) {
+    grant.disabled = !state.canGrant || state.decision === "granted";
+    grant.setAttribute("aria-pressed", String(state.decision === "granted"));
+  }
+  if (deny) {
+    deny.disabled = state.decision === "denied";
+    deny.setAttribute("aria-pressed", String(state.decision === "denied"));
+  }
+}
+
+/** Bind the renderer-owned control once; safe when a document contains no analytics plan. */
+export function bootViewerAnalyticsConsentControl(
+  win: ViewerConsentWindow,
+  now: () => number = Date.now,
+): void {
+  const roots = win.document?.querySelectorAll<HTMLElement>("[data-tot-analytics-consent-control]");
+  const current = (win[VIEWER_ANALYTICS_CONSENT_STATE_GLOBAL] as ViewerAnalyticsConsentState | undefined) ??
+    applyEarlyViewerAnalyticsConsent(win, now());
+  roots?.forEach((root) => {
+    renderControlState(root, current);
+    if (root.dataset["totAnalyticsConsentBound"] === "true") return;
+    root.dataset["totAnalyticsConsentBound"] = "true";
+    root.addEventListener("click", (event) => {
+      const target = event.target;
+      if (!(target instanceof Element)) return;
+      const button = target.closest<HTMLButtonElement>("[data-tot-analytics-consent-decision]");
+      const decision = button?.dataset["totAnalyticsConsentDecision"];
+      if (decision !== "granted" && decision !== "denied") return;
+      renderControlState(root, setViewerAnalyticsConsent(win, decision, now()));
+    });
+  });
+
+  const storageBoundGlobal = "__TOT_VIEWER_ANALYTICS_CONSENT_STORAGE_BOUND__";
+  if (win.addEventListener && win[storageBoundGlobal] !== true) {
+    win[storageBoundGlobal] = true;
+    win.addEventListener("storage", (event) => {
+      // `key === null` is the browser signal for localStorage.clear(). It clears
+      // this context too, so recompute to default-deny and notify immediately.
+      if (event.key !== null && !event.key?.startsWith(`${VIEWER_ANALYTICS_CONSENT_STORAGE_KEY}:`)) return;
+      const next = applyEarlyViewerAnalyticsConsent(win, now());
+      roots?.forEach((root) => renderControlState(root, next));
+      notifyViewerAnalyticsConsentChanged(win, next);
+    });
+  }
+}
+
+/** Browser entry used by the shared lifecycle host asset. */
+export function bootViewerAnalyticsConsentFromDocument(): void {
+  if (typeof window === "undefined") return;
+  bootViewerAnalyticsConsentControl(window as unknown as ViewerConsentWindow);
+}

package/packages/public-runtime/src/integration/contact-sales-action-source.ts

@@ -6,6 +6,7 @@
  * selectors supplied by a caller, event detail, or arbitrary DOM data.
  */
 import type { PlatformManagedActionActivation, PlatformManagedActionSource } from "./managed-analytics-bridge.js";
+import { managedAnalyticsOpaqueRevision } from "./managed-analytics-value-safety.js";
 
 /** The only reviewed CTA identities that may raise this marketing action. */
 export const CONTACT_SALES_ACTION_SOURCES = [
@@ -42,6 +43,7 @@ export function createContactSalesActionSource(
 ): PlatformManagedActionSource {
   const document = options.document;
   const now = options.now ?? Date.now;
+  const revisionId = managedAnalyticsOpaqueRevision(options.planRevision);
   let sequence = 0;
 
   return {
@@ -55,10 +57,10 @@ export function createContactSalesActionSource(
             sequence += 1;
             const at = now();
             const activation: PlatformManagedActionActivation = {
-              logicalId: `${source.logicalId}-${options.planRevision}-${sequence}`,
+              logicalId: `${source.logicalId}-${revisionId}-${sequence}`,
               name: CONTACT_SALES_ACTION_NAME,
               correlation: {
-                id: `contact-sales-${options.planRevision}`,
+                id: `contact-sales-${revisionId}`,
                 expiresAt: new Date(at + CORRELATION_TTL_MS).toISOString(),
               },
               sequence,

package/packages/public-runtime/src/integration/interaction-tracking-gate.ts

@@ -13,8 +13,7 @@
  *     ({@link isPurposeEligible}, `consent-broker.ts`). A missing or tampered
  *     `window.__TOT_INTEGRATION_CONSENT__` global fails closed to the
  *     default-deny snapshot, same as every other consumer of that global
- *     (`lifecycle-boot.ts`, the Cloudflare Web Analytics loader in
- *     `Layout.astro`).
+ *     (`lifecycle-boot.ts` and the managed analytics adapters).
  *   - ENVIRONMENT: the renderer-published four-stage environment
  *     (`resolveBrowserEnvironment`, `environment.ts`) must resolve AND must not
  *     be `candidate`. A per-change candidate render is a preview — it is never

package/packages/public-runtime/src/integration/lifecycle-boot.ts

@@ -49,6 +49,7 @@ import {
 } from "./native-ga4-sandbox.js";
 import { ManagedAnalyticsEventBrokerBridge } from "./managed-analytics-bridge.js";
 import { minimizePageAttribution, type ManagedPageViewInput } from "./managed-analytics.js";
+import { managedAnalyticsOpaqueRevision } from "./managed-analytics-value-safety.js";
 import {
   createContactSalesActionSource,
   type ContactSalesActionDocument,
@@ -238,7 +239,7 @@ function documentPageView(
     referrerUrl: win.document?.referrer ?? null,
     routeUrl: win.location.href,
   });
-  const id = `pageview-${descriptor.planRevision}`;
+  const id = `pageview-${managedAnalyticsOpaqueRevision(descriptor.planRevision)}`;
   return {
     logicalId: id,
     path: win.location.pathname,

package/packages/public-runtime/src/integration/lifecycle-host-entry.ts

@@ -12,5 +12,7 @@
  * self-invoking module there would boot the lifecycle on any server-side import.
  */
 import { bootIntegrationLifecycleFromDocument } from "./lifecycle-boot.js";
+import { bootViewerAnalyticsConsentFromDocument } from "./consent-broker.js";
 
+bootViewerAnalyticsConsentFromDocument();
 bootIntegrationLifecycleFromDocument();

package/packages/public-runtime/src/integration/lifecycle-runtime.ts

@@ -160,6 +160,13 @@ type LifecycleState = "idle" | "initializing" | "initialized" | "disposing" | "d
 interface ActiveIntegration {
   integration: BootDescriptorIntegration;
   module: IntegrationLifecycleModule;
+  eligible: boolean;
+}
+
+/** A module whose init hook has started but has not yet settled. */
+interface StartingIntegration extends ActiveIntegration {
+  cancelled: boolean;
+  disposed: boolean;
 }
 
 function messageOf(error: unknown): string {
@@ -195,8 +202,16 @@ export function sanitizeNavigationUrl(raw: string, keepHash: boolean): string {
 export class IntegrationLifecycle {
   private state: LifecycleState = "idle";
   private readonly active: ActiveIntegration[] = [];
+  /** Modules visible to an interrupting consent withdrawal while init is unresolved. */
+  private readonly starting: StartingIntegration[] = [];
   /** Integrations held back by the consent gate; re-evaluated on each `update`. */
   private deferred: BootDescriptorIntegration[] = [];
+  /** Updates arriving during async initialization, replayed before bootstrap emission. */
+  private readonly pendingUpdates: LifecycleUpdateReason[] = [];
+  /** An atomic withdrawal/grant seen during init needs only deferred-load reconciliation. */
+  private pendingGrantReconciliation = false;
+  /** Serializes ordinary post-init updates; consent withdrawal interrupts an unresolved grant. */
+  private updateQueue: Promise<void> = Promise.resolve();
   private eventCounter = 0;
   private readonly opts: IntegrationLifecycleOptions;
 
@@ -220,16 +235,26 @@ export class IntegrationLifecycle {
     if (this.state !== "idle") return;
     this.state = "initializing";
     for (const integration of this.opts.descriptor.integrations) {
+      if (this.state !== "initializing") break;
       if (!this.eligible(integration)) {
         // Consent precedes the loader: hold it back, do not load, and record why.
         this.deferred.push(integration);
         this.observe({ stage: "gate", integration, ok: false });
         continue;
       }
-      await this.initOne(integration);
+      const remainDeferred = await this.initOne(integration);
+      if (this.state !== "initializing") break;
+      if (remainDeferred) this.deferred.push(integration);
     }
     // A dispose that raced in during an await leaves us terminal; otherwise we are live.
     if (this.state === "initializing") this.state = "initialized";
+    if (this.state === "initialized" && this.pendingGrantReconciliation) {
+      this.pendingGrantReconciliation = false;
+      await this.loadNewlyEligible();
+    }
+    if (this.state === "initialized") {
+      for (const reason of this.pendingUpdates.splice(0)) await this.update(reason);
+    }
     // Last, so every adapter that just subscribed is registered when this emits: the
     // broker has no replay, so a page view emitted before their `init` reaches nobody.
     if (this.state === "initialized") this.emitBootstrapPageView();
@@ -250,6 +275,7 @@ export class IntegrationLifecycle {
    * throwing integration.
    */
   private emitBootstrapPageView(): void {
+    if (this.state !== "initialized") return;
     const managed = this.opts.managedAnalytics;
     if (!managed || managed.bridge.isInitialized || managed.bridge.isDisposed) return;
     if (this.opts.commerceBroker?.isConsentEligible("analytics") === false) return;
@@ -265,6 +291,11 @@ export class IntegrationLifecycle {
     return this.opts.isEligible ? this.opts.isEligible(integration) : true;
   }
 
+  /** Read terminal state across async hook boundaries without relying on stale narrowing. */
+  private isTerminal(): boolean {
+    return this.state === "disposing" || this.state === "disposed";
+  }
+
   /**
    * Load any consent-deferred integration that has since become eligible, in the
    * plan's resolved order. Called from `update` so a consent grant loads the
@@ -273,31 +304,179 @@ export class IntegrationLifecycle {
   private async loadNewlyEligible(): Promise<void> {
     if (this.deferred.length === 0) return;
     const stillDeferred: BootDescriptorIntegration[] = [];
+    const candidates: BootDescriptorIntegration[] = [];
     for (const integration of this.deferred) {
-      if (this.eligible(integration)) await this.initOne(integration);
-      else stillDeferred.push(integration);
+      (this.eligible(integration) ? candidates : stillDeferred).push(integration);
     }
+    // Reserve eligible entries before the first await so an interrupting consent
+    // transition cannot start a duplicate load of the same adapter.
     this.deferred = stillDeferred;
+    for (const integration of candidates) {
+      if (this.isTerminal()) break;
+      let remainDeferred = await this.initOne(integration);
+      // A rapid withdrawal can cancel this reserved init, then a regrant can arrive
+      // before it settles. Retry with a fresh module as soon as the cancelled attempt
+      // returns; otherwise that regrant has no later update left to wake it.
+      while (
+        remainDeferred
+        && this.state !== "disposing"
+        && this.state !== "disposed"
+        && this.eligible(integration)
+      ) {
+        remainDeferred = await this.initOne(integration);
+      }
+      if (remainDeferred && this.state !== "disposing" && this.state !== "disposed") {
+        this.deferred.push(integration);
+      }
+    }
   }
 
-  private async initOne(integration: BootDescriptorIntegration): Promise<void> {
+  /** Returns true when consent changed during loading and the entry remains deferred. */
+  private async initOne(integration: BootDescriptorIntegration): Promise<boolean> {
+    if (this.isTerminal()) return false;
     let module: IntegrationLifecycleModule;
     try {
       module = await this.opts.loadModule(integration);
     } catch (error) {
       this.observe({ stage: "load", integration, ok: false, error: messageOf(error) });
-      return;
+      return false;
+    }
+    if (this.state === "disposing" || this.state === "disposed") return false; // torn down mid-load: do not init.
+    // Consent may be withdrawn while the asynchronous loader is in flight. Recheck
+    // before calling tenant/vendor code; an entry must never initialize after denial.
+    if (!this.eligible(integration)) {
+      this.observe({ stage: "gate", integration, ok: false });
+      return true;
     }
-    if (this.state === "disposing" || this.state === "disposed") return; // torn down mid-load: do not init.
+    const starting: StartingIntegration = {
+      integration,
+      module,
+      eligible: true,
+      cancelled: false,
+      disposed: false,
+    };
+    this.starting.push(starting);
+    let remainDeferred = false;
     try {
       await module.init(this.buildContext(integration));
-      this.active.push({ integration, module });
-      this.observe({ stage: "init", integration, ok: true });
+      // A consent withdrawal may arrive while vendor/sandbox init is unresolved. Its
+      // interrupt marks the module cancelled and invokes teardown immediately; never
+      // publish that late init as active, and load a fresh module on a later grant.
+      remainDeferred = starting.cancelled
+        || this.isTerminal()
+        || !this.eligible(integration);
+      if (!remainDeferred) {
+        this.active.push({ integration, module, eligible: true });
+        this.observe({ stage: "init", integration, ok: true });
+      }
     } catch (error) {
+      remainDeferred = starting.cancelled
+        || this.isTerminal()
+        || !this.eligible(integration);
       this.observe({ stage: "init", integration, ok: false, error: messageOf(error) });
+    } finally {
+      const index = this.starting.indexOf(starting);
+      if (index >= 0) this.starting.splice(index, 1);
+    }
+    return remainDeferred;
+  }
+
+  /**
+   * Interrupt a consent grant whose module init has not settled. Calling update and
+   * dispose synchronously gives the module/sandbox its immediate stop signal; returned
+   * promises are observed in the background so a hostile or stuck hook cannot delay the
+   * viewer's withdrawal. The late init is kept out of `active` by `cancelled` above.
+   */
+  private interruptWithdrawnStarts(reason: LifecycleUpdateReason): boolean {
+    const withdrawn = this.starting.filter(({ integration }) => !this.eligible(integration));
+    if (withdrawn.length === 0) return false;
+    for (const entry of withdrawn) {
+      if (entry.cancelled) continue;
+      entry.cancelled = true;
+      if (entry.module.update) {
+        try {
+          const result = entry.module.update(reason, this.buildContext(entry.integration));
+          void Promise.resolve(result).then(
+            () => this.observe({ stage: "update", integration: entry.integration, ok: true, reason }),
+            (error) => this.observe({
+              stage: "update", integration: entry.integration, ok: false, reason, error: messageOf(error),
+            }),
+          );
+        } catch (error) {
+          this.observe({
+            stage: "update", integration: entry.integration, ok: false, reason, error: messageOf(error),
+          });
+        }
+      }
+      if (entry.module.dispose && !entry.disposed) {
+        entry.disposed = true;
+        try {
+          const result = entry.module.dispose();
+          void Promise.resolve(result).then(
+            () => this.observe({ stage: "dispose", integration: entry.integration, ok: true }),
+            (error) => this.observe({
+              stage: "dispose", integration: entry.integration, ok: false, error: messageOf(error),
+            }),
+          );
+        } catch (error) {
+          this.observe({ stage: "dispose", integration: entry.integration, ok: false, error: messageOf(error) });
+        }
+      }
+    }
+    return true;
+  }
+
+  /** Deliver an update to a fixed set of active modules without loading deferred work. */
+  private async updateActive(
+    reason: LifecycleUpdateReason,
+    entries: readonly ActiveIntegration[],
+  ): Promise<void> {
+    for (const { integration, module } of entries) {
+      if (this.state !== "initialized") return;
+      if (!module.update) continue;
+      try {
+        await module.update(reason, this.buildContext(integration));
+        this.observe({ stage: "update", integration, ok: true, reason });
+      } catch (error) {
+        this.observe({ stage: "update", integration, ok: false, reason, error: messageOf(error) });
+      }
+    }
+  }
+
+  /**
+   * Signal every active module synchronously during a withdrawal. Returned promises
+   * are observed in the background so one stuck adapter cannot delay the stop signal
+   * for another adapter or keep the viewer's withdrawal request pending.
+   */
+  private interruptActiveUpdates(
+    reason: LifecycleUpdateReason,
+    entries: readonly ActiveIntegration[],
+  ): void {
+    for (const { integration, module } of entries) {
+      if (!module.update) continue;
+      try {
+        const result = module.update(reason, this.buildContext(integration));
+        void Promise.resolve(result).then(
+          () => this.observe({ stage: "update", integration, ok: true, reason }),
+          (error) => this.observe({ stage: "update", integration, ok: false, reason, error: messageOf(error) }),
+        );
+      } catch (error) {
+        this.observe({ stage: "update", integration, ok: false, reason, error: messageOf(error) });
+      }
     }
   }
 
+  /** Record current eligibility and report whether this consent change withdrew an active entry. */
+  private updateActiveEligibility(): boolean {
+    let withdrew = false;
+    for (const entry of this.active) {
+      const eligible = this.eligible(entry.integration);
+      if (entry.eligible && !eligible) withdrew = true;
+      entry.eligible = eligible;
+    }
+    return withdrew;
+  }
+
   /**
    * Build the typed context handed to `init`/`update`: this integration's own
    * resolved public config (never another integration's), the document's
@@ -349,26 +528,59 @@ export class IntegrationLifecycle {
 
   /**
    * Deliver an in-place `update(reason)` to every initialized integration that implements
-   * it. Used for a consent change, a config change, or a rollback — never a re-init. A no-op
-   * before init or after dispose. One integration's throwing `update` is isolated.
+   * it. Used for a consent change, a config change, or a rollback — never a re-init. An
+   * update during async initialization is replayed before bootstrap emission; calls before
+   * initialization starts or after dispose are no-ops. One throwing `update` is isolated.
    */
   async update(reason: LifecycleUpdateReason): Promise<void> {
     if (!LIFECYCLE_UPDATE_REASONS.includes(reason)) return;
+    if (this.state !== "initializing" && this.state !== "initialized") return;
+    // Withdrawal is a safety interrupt, including while the document's initial
+    // lifecycle boot is still awaiting module.init().
+    let interruptedWithdrawal = false;
+    if (reason === "consent-changed") {
+      interruptedWithdrawal = this.interruptWithdrawnStarts(reason);
+      interruptedWithdrawal = this.updateActiveEligibility() || interruptedWithdrawal;
+    }
+    if (interruptedWithdrawal) {
+      // A mixed initial state can have earlier entries active while a later analytics
+      // entry is still starting. Stop both groups now; returning before this delivery
+      // would leave an active sibling subscribed under a withdrawn snapshot.
+      this.interruptActiveUpdates(reason, [...this.active]);
+      // One atomic consent snapshot may withdraw one purpose and grant another.
+      // Once initial traversal is complete, start those grants without making
+      // withdrawal wait for loader/vendor code. During traversal, queue the grant
+      // reconciliation so it cannot duplicate an entry the init loop has not reached.
+      if (this.state === "initializing") {
+        this.pendingGrantReconciliation = true;
+      } else {
+        void this.loadNewlyEligible().then(
+          () => this.emitBootstrapPageView(),
+          () => {},
+        );
+      }
+      return;
+    }
+    if (this.state === "initializing") {
+      this.pendingUpdates.push(reason);
+      return;
+    }
+    if (this.state !== "initialized") return;
+    const run = this.updateQueue.then(() => this.applyUpdate(reason));
+    this.updateQueue = run.catch(() => {});
+    await run;
+  }
+
+  private async applyUpdate(reason: LifecycleUpdateReason): Promise<void> {
     if (this.state !== "initialized") return;
     // A consent/config change may make a gated integration eligible: load it now
     // (init), then deliver the update only to integrations that were already live —
     // a just-loaded entry gets `init`, not an immediate redundant `update`.
     const alreadyActive = [...this.active];
     await this.loadNewlyEligible();
-    for (const { integration, module } of alreadyActive) {
-      if (!module.update) continue;
-      try {
-        await module.update(reason, this.buildContext(integration));
-        this.observe({ stage: "update", integration, ok: true, reason });
-      } catch (error) {
-        this.observe({ stage: "update", integration, ok: false, reason, error: messageOf(error) });
-      }
-    }
+    if (this.state !== "initialized") return;
+    await this.updateActive(reason, alreadyActive);
+    if (this.state !== "initialized") return;
     // A consent grant is the case that matters: it both loads a previously-gated adapter
     // (above) and makes the held-back bootstrap page view emittable, so the document the
     // visitor consented ON is still counted rather than only its successors.
@@ -378,16 +590,38 @@ export class IntegrationLifecycle {
   /**
    * Dispose every initialized integration on teardown. Idempotent — a second dispose is a
    * no-op — and terminal: after it, `update` and a late `init` do nothing. One integration's
-   * throwing `dispose` is isolated; every other integration is still disposed.
+   * throwing or unresolved `dispose` is isolated; every other integration is still signalled.
    */
   async dispose(): Promise<void> {
     if (this.state === "disposed" || this.state === "disposing") return;
     this.state = "disposing";
+    // Starting modules are already executing tenant/vendor code but are not yet in
+    // `active`. Cancel and signal teardown synchronously so a late init settlement
+    // cannot publish after this terminal transition.
+    for (const entry of this.starting) {
+      entry.cancelled = true;
+      if (!entry.module.dispose || entry.disposed) continue;
+      entry.disposed = true;
+      try {
+        const result = entry.module.dispose();
+        void Promise.resolve(result).then(
+          () => this.observe({ stage: "dispose", integration: entry.integration, ok: true }),
+          (error) => this.observe({
+            stage: "dispose", integration: entry.integration, ok: false, error: messageOf(error),
+          }),
+        );
+      } catch (error) {
+        this.observe({ stage: "dispose", integration: entry.integration, ok: false, error: messageOf(error) });
+      }
+    }
     for (const { integration, module } of this.active) {
       if (!module.dispose) continue;
       try {
-        await module.dispose();
-        this.observe({ stage: "dispose", integration, ok: true });
+        const result = module.dispose();
+        void Promise.resolve(result).then(
+          () => this.observe({ stage: "dispose", integration, ok: true }),
+          (error) => this.observe({ stage: "dispose", integration, ok: false, error: messageOf(error) }),
+        );
       } catch (error) {
         this.observe({ stage: "dispose", integration, ok: false, error: messageOf(error) });
       }

package/packages/public-runtime/src/integration/managed-analytics-value-safety.ts

@@ -1,9 +1,11 @@
 /** Shared PII-value canary for managed browser events and their diagnostics. */
 import { MANAGED_ANALYTICS_PII_VALUE_PATTERN } from "./managed-analytics-api-v1-safety.mjs";
+import { fnv1a128Hex } from "./digest.js";
 
 const MANAGED_ANALYTICS_PII_VALUE = new RegExp(MANAGED_ANALYTICS_PII_VALUE_PATTERN);
 const MANAGED_ANALYTICS_PROTECTED_VALUE =
   /(?:@|\d{7,}|(?:^|[./_~-])(?:bearer|password|secret|token|authorization|preview)(?:$|[./_~-]))/i;
+const OPAQUE_HEX_ALPHABET = "abcdefghijklmnop";
 
 /** True when a public string resembles an email, SSN, payment card, or phone number. */
 export function resemblesManagedAnalyticsPii(value: unknown): boolean {
@@ -17,6 +19,22 @@ export function resemblesManagedAnalyticsProtectedValue(value: unknown): boolean
   );
 }
 
+/**
+ * Derive a stable letters-only token for managed-event ids from a public revision.
+ *
+ * Revisions are hexadecimal content identities and can therefore contain a run of
+ * seven digits by chance. Copying one directly into an event id trips the deliberate
+ * phone/card canary and silently rejects an otherwise safe event. Hashing once more
+ * and encoding each nibble as `a`-`p` retains deterministic revision scoping while
+ * making a numeric/credential-looking result impossible by construction.
+ */
+export function managedAnalyticsOpaqueRevision(value: string): string {
+  return Array.from(
+    fnv1a128Hex(value),
+    (nibble) => OPAQUE_HEX_ALPHABET[Number.parseInt(nibble, 16)]!,
+  ).join("");
+}
+
 /** Defense-in-depth for identifiers copied into structured broker observations. */
 export function safeManagedAnalyticsDiagnosticId(value: string): string {
   return resemblesManagedAnalyticsPii(value) ? "[redacted]" : value;

package/packages/public-runtime/src/integration/render-phases.ts

@@ -40,6 +40,7 @@ import {
 } from "./environment.js";
 import { defaultConsentSnapshot, type ConsentSnapshot } from "./consent-broker.js";
 import { LIFECYCLE_HOST_ASSET_URL } from "./lifecycle-host-asset.mjs";
+import { VIEWER_ANALYTICS_CONSENT_EARLY_BOOT_JS } from "./consent-broker.js";
 
 /** Re-exported so consumers and tests read the host URL from the engine that emits it. */
 export { LIFECYCLE_HOST_ASSET_PATH, LIFECYCLE_HOST_ASSET_URL } from "./lifecycle-host-asset.mjs";
@@ -163,10 +164,14 @@ export function renderIntegrationPhases(
     phaseBoundary("consent.defaults") +
     inlineFrozenGlobal(INTEGRATION_CONSENT_GLOBAL, consentSnapshot, nonce) +
     phaseBoundary("head.early") +
-    inlineFrozenGlobal(INTEGRATION_PLAN_GLOBAL, bootDescriptor(plan), nonce);
+    inlineFrozenGlobal(INTEGRATION_PLAN_GLOBAL, bootDescriptor(plan), nonce) +
+    inlineScript(VIEWER_ANALYTICS_CONSENT_EARLY_BOOT_JS, nonce) +
+    viewerAnalyticsConsentStyle(nonce);
 
   const bodyStart =
-    phaseBoundary("body.start") + `<div data-tot-integration-root hidden></div>`;
+    phaseBoundary("body.start") +
+    `<div data-tot-integration-root hidden></div>` +
+    viewerAnalyticsConsentControl();
 
   const bodyDeferred =
     phaseBoundary("document.deferred") +
@@ -196,6 +201,27 @@ function lifecycleHostScript(): string {
   return `<script type="module" src="${LIFECYCLE_HOST_ASSET_URL}"></script>`;
 }
 
+function inlineScript(source: string, nonce: string): string {
+  const nonceAttr = nonce ? ` nonce="${nonce}"` : "";
+  return `<script${nonceAttr}>${source}</script>`;
+}
+
+/** Renderer-owned, provider-neutral viewer control: identical in both document mounts. */
+function viewerAnalyticsConsentStyle(nonce: string): string {
+  const style = `.tot-analytics-consent{position:fixed;z-index:900;right:1rem;bottom:1rem;display:flex;max-width:min(30rem,calc(100vw - 2rem));align-items:center;gap:.65rem;padding:.7rem .8rem;border:1px solid var(--color-border,#cbd5e1);border-radius:.75rem;background:var(--color-bg,#fff);color:var(--color-text,#111827);box-shadow:0 8px 30px rgba(15,23,42,.18);font:500 .75rem/1.25 system-ui,sans-serif}.tot-analytics-consent__copy{display:grid;gap:.15rem;min-width:8rem}.tot-analytics-consent__detail{color:var(--color-muted,#475569);font-size:.68rem}.tot-analytics-consent__actions{display:flex;gap:.4rem}.tot-analytics-consent button{border:1px solid currentColor;border-radius:999px;background:transparent;color:inherit;padding:.4rem .65rem;font:inherit;cursor:pointer}.tot-analytics-consent button:disabled{cursor:default;opacity:.45}@media(max-width:34rem){.tot-analytics-consent{left:1rem;right:1rem;align-items:flex-start;flex-direction:column}.tot-analytics-consent__actions{width:100%}.tot-analytics-consent button{flex:1}}`;
+  return `<style${nonce ? ` nonce="${nonce}"` : ""}>${style}</style>`;
+}
+
+function viewerAnalyticsConsentControl(): string {
+  return `<aside class="tot-analytics-consent" data-tot-analytics-consent-control aria-label="Analytics privacy settings">` +
+    `<span class="tot-analytics-consent__copy"><strong data-tot-analytics-consent-status aria-live="polite">Analytics off</strong>` +
+    `<span class="tot-analytics-consent__detail">Choose whether anonymous analytics may run.</span></span>` +
+    `<span class="tot-analytics-consent__actions">` +
+    `<button type="button" data-tot-analytics-consent-decision="granted" aria-pressed="false" disabled>Allow</button>` +
+    `<button type="button" data-tot-analytics-consent-decision="denied" aria-pressed="true" disabled>Decline</button>` +
+    `</span></aside>`;
+}
+
 /**
  * Replace every {@link INTEGRATION_NONCE_PLACEHOLDER} in `text` (an HTML body or a
  * CSP header value) with one fresh per-response `nonce`. Idempotent on text with no

package/packages/public-runtime/src/integration/version.ts

@@ -11,13 +11,13 @@
  * schema versions fail closed.
  */
 
-export const BROWSER_INTEGRATION_CONTRACT_VERSION = "2.0.0" as const;
+export const BROWSER_INTEGRATION_CONTRACT_VERSION = "3.0.0" as const;
 
 export const ENVIRONMENT_SCHEMA_VERSION = 1 as const;
 export const INTEGRATION_MANIFEST_SCHEMA_VERSION = 2 as const;
 export const EFFECTIVE_PLAN_SCHEMA_VERSION = 1 as const;
 export const COMMERCE_EVENT_STOREFRONT_SCHEMA_VERSION = 1 as const;
-export const CONSENT_SNAPSHOT_SCHEMA_VERSION = 1 as const;
+export const CONSENT_SNAPSHOT_SCHEMA_VERSION = 2 as const;
 export const RECEIPT_MEASUREMENT_GRANT_SCHEMA_VERSION = 1 as const;
 export const CONSENT_CONFIG_SCHEMA_VERSION = 1 as const;
 export const ASSURANCE_RECORD_SCHEMA_VERSION = 1 as const;

package/packages/public-runtime/tests/fixtures/integration/commerce-event.example.json

@@ -21,7 +21,7 @@
     "expiresAt": "2026-08-28T21:15:30.000Z"
   },
   "consent": {
-    "schemaVersion": 1,
+    "schemaVersion": 2,
     "snapshotId": "consent_public_01J6EXAMPLE",
     "eligiblePurposes": [
       "essential",

package/packages/public-runtime/tests/fixtures/integration/commerce-order-event.example.json

@@ -20,7 +20,7 @@
     "expiresAt": "2026-08-28T21:15:30.000Z"
   },
   "consent": {
-    "schemaVersion": 1,
+    "schemaVersion": 2,
     "snapshotId": "consent_public_01J6EXAMPLE",
     "eligiblePurposes": [
       "essential",

package/packages/public-runtime/tests/fixtures/integration/integration-manifest-v2.example.json

@@ -11,7 +11,7 @@
     "supportUrl": "https://support.example.invalid/storefront"
   },
   "compatibility": {
-    "storefrontBrowserContract": ">=2.0.0 <3.0.0",
+    "storefrontBrowserContract": ">=3.0.0 <4.0.0",
     "configurationSchemaVersion": 3
   },
   "browser": {

package/packages/public-runtime/tests/fixtures/integration/tenant-local-example/manifest.json

@@ -10,7 +10,7 @@
     "supportUrl": "https://acme.example/support"
   },
   "compatibility": {
-    "storefrontBrowserContract": ">=2.0.0 <3.0.0",
+    "storefrontBrowserContract": ">=3.0.0 <4.0.0",
     "configurationSchemaVersion": 2
   },
   "browser": {

package/scripts/tenant/lint-embeds.mjs

@@ -41,12 +41,6 @@ export const KNOWN_EMBEDS = Object.entries(EMBED_PROVIDERS).map(([slug, p]) => (
   origins: [...new Set([...(p.scriptSrc ?? []), ...(p.connectSrc ?? []), ...(p.frameSrc ?? [])])],
 }));
 
-/** Hosts the platform always allows (self is implicit); embeds to these are fine. */
-const ALWAYS_ALLOWED_HOSTS = new Set([
-  "static.cloudflareinsights.com",
-  "cloudflareinsights.com",
-]);
-
 // Only <script src> and <iframe src> load executable/frameable content the CSP
 // gates (script-src / frame-src). We deliberately DON'T scan generic URLs
 // (canonical links, JSON-LD @context, <a href>, og:url) — those aren't embeds
@@ -79,8 +73,6 @@ export function scanHtmlForEmbeds(html) {
   while ((m = SRC_RE.exec(html))) {
     const origin = originOf(m[1]);
     if (!origin) continue;
-    const host = new URL(origin).hostname;
-    if (ALWAYS_ALLOWED_HOSTS.has(host)) continue;
     external.add(origin);
   }
   // An external origin is "unknown" if no catalog provider claims it.