@tokenoftrust/storefront-runner 2.0.32 → 2.0.34

package/apps/storefront/astro.config.mjs

@@ -133,6 +133,14 @@ export default defineConfig({
         "@astrojs/cloudflare/entrypoints/preview.js",
       ],
     },
+    // The Cloudflare dev worker keeps its SSR module graph across Vite optimizer
+    // turns. Prebundle Preact's renderer before that graph is loaded so it never
+    // retains a URL for a superseded .vite/deps_ssr chunk.
+    ssr: {
+      optimizeDeps: {
+        include: ["@astrojs/preact/server.js"],
+      },
+    },
     // Dev-only: let the dev server accept tenant Host headers so host-based
     // tenant routing can be tested locally (e.g. curl -H 'Host: sample-store.example').
     // Prod runs on Cloudflare Workers, which has no such allowlist.

package/apps/storefront/src/components/plp/SortSelect.astro

@@ -4,9 +4,17 @@
  * a framework, stays URL-addressable. The current query's other params ride
  * along as hidden inputs so sort doesn't drop active filters.
  *
- * Auto-submit is wired by a nonce'd `is:inline` <script> rather than an inline
- * `onchange=` handler, so a strict, ENFORCED CSP allows it without 'unsafe-inline'
- * / 'unsafe-hashes' (Epic S2). The <noscript> Apply button covers the no-JS case.
+ * Auto-submit is wired by a nonce'd `is:inline` script element rather than an
+ * inline `onchange=` handler, so a strict, ENFORCED CSP allows it without
+ * 'unsafe-inline' / 'unsafe-hashes' (Epic S2). The noscript Apply button covers
+ * the no-JS case.
+ *
+ * Never write a literal script tag (angle brackets) in this file's frontmatter
+ * comment: the .astro dependency scanner matches it as a real tag, pairs it with
+ * the closing tag of the actual block below, and parses the prose between them as
+ * JavaScript. That fails the whole scan, and Vite's response is to skip dependency
+ * pre-bundling for the entire app rather than to error — which silently disables
+ * the SSR prebundle that `astro.config.mjs` relies on.
  */
 import type { ListProductsQuery } from "@tot/public-runtime";
 

package/apps/storefront/src/pages/index.astro

@@ -41,7 +41,7 @@ const marketing = !features.catalog;
 
 // Raw-HTML home (vendor-injected): serve the tenant's own self-contained
 // document VERBATIM, bypassing the block Layout entirely. Its inline
-// <style>/<script> get this request's CSP nonce so the strict policy still
+// style/script elements get this request's CSP nonce so the strict policy still
 // allows them. This route stays fully inside Astro — middleware already applied
 // tenant resolution + canonical host, and on the way out applies security
 // headers, the CSP, and (in prod) the edge page cache. SEO title/meta/canonical/

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.0.32",
+  "version": "2.0.34",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/src/integration/contact-sales-action-source.ts

@@ -6,6 +6,7 @@
  * selectors supplied by a caller, event detail, or arbitrary DOM data.
  */
 import type { PlatformManagedActionActivation, PlatformManagedActionSource } from "./managed-analytics-bridge.js";
+import { managedAnalyticsOpaqueRevision } from "./managed-analytics-value-safety.js";
 
 /** The only reviewed CTA identities that may raise this marketing action. */
 export const CONTACT_SALES_ACTION_SOURCES = [
@@ -42,6 +43,7 @@ export function createContactSalesActionSource(
 ): PlatformManagedActionSource {
   const document = options.document;
   const now = options.now ?? Date.now;
+  const revisionId = managedAnalyticsOpaqueRevision(options.planRevision);
   let sequence = 0;
 
   return {
@@ -55,10 +57,10 @@ export function createContactSalesActionSource(
             sequence += 1;
             const at = now();
             const activation: PlatformManagedActionActivation = {
-              logicalId: `${source.logicalId}-${options.planRevision}-${sequence}`,
+              logicalId: `${source.logicalId}-${revisionId}-${sequence}`,
               name: CONTACT_SALES_ACTION_NAME,
               correlation: {
-                id: `contact-sales-${options.planRevision}`,
+                id: `contact-sales-${revisionId}`,
                 expiresAt: new Date(at + CORRELATION_TTL_MS).toISOString(),
               },
               sequence,

package/packages/public-runtime/src/integration/lifecycle-boot.ts

@@ -49,6 +49,7 @@ import {
 } from "./native-ga4-sandbox.js";
 import { ManagedAnalyticsEventBrokerBridge } from "./managed-analytics-bridge.js";
 import { minimizePageAttribution, type ManagedPageViewInput } from "./managed-analytics.js";
+import { managedAnalyticsOpaqueRevision } from "./managed-analytics-value-safety.js";
 import {
   createContactSalesActionSource,
   type ContactSalesActionDocument,
@@ -238,7 +239,7 @@ function documentPageView(
     referrerUrl: win.document?.referrer ?? null,
     routeUrl: win.location.href,
   });
-  const id = `pageview-${descriptor.planRevision}`;
+  const id = `pageview-${managedAnalyticsOpaqueRevision(descriptor.planRevision)}`;
   return {
     logicalId: id,
     path: win.location.pathname,

package/packages/public-runtime/src/integration/managed-analytics-value-safety.ts

@@ -1,9 +1,11 @@
 /** Shared PII-value canary for managed browser events and their diagnostics. */
 import { MANAGED_ANALYTICS_PII_VALUE_PATTERN } from "./managed-analytics-api-v1-safety.mjs";
+import { fnv1a128Hex } from "./digest.js";
 
 const MANAGED_ANALYTICS_PII_VALUE = new RegExp(MANAGED_ANALYTICS_PII_VALUE_PATTERN);
 const MANAGED_ANALYTICS_PROTECTED_VALUE =
   /(?:@|\d{7,}|(?:^|[./_~-])(?:bearer|password|secret|token|authorization|preview)(?:$|[./_~-]))/i;
+const OPAQUE_HEX_ALPHABET = "abcdefghijklmnop";
 
 /** True when a public string resembles an email, SSN, payment card, or phone number. */
 export function resemblesManagedAnalyticsPii(value: unknown): boolean {
@@ -17,6 +19,22 @@ export function resemblesManagedAnalyticsProtectedValue(value: unknown): boolean
   );
 }
 
+/**
+ * Derive a stable letters-only token for managed-event ids from a public revision.
+ *
+ * Revisions are hexadecimal content identities and can therefore contain a run of
+ * seven digits by chance. Copying one directly into an event id trips the deliberate
+ * phone/card canary and silently rejects an otherwise safe event. Hashing once more
+ * and encoding each nibble as `a`-`p` retains deterministic revision scoping while
+ * making a numeric/credential-looking result impossible by construction.
+ */
+export function managedAnalyticsOpaqueRevision(value: string): string {
+  return Array.from(
+    fnv1a128Hex(value),
+    (nibble) => OPAQUE_HEX_ALPHABET[Number.parseInt(nibble, 16)]!,
+  ).join("");
+}
+
 /** Defense-in-depth for identifiers copied into structured broker observations. */
 export function safeManagedAnalyticsDiagnosticId(value: string): string {
   return resemblesManagedAnalyticsPii(value) ? "[redacted]" : value;