@tokenoftrust/storefront-runner 2.0.33 → 2.0.35

package/apps/storefront/src/components/plp/SortSelect.astro

@@ -4,9 +4,17 @@
  * a framework, stays URL-addressable. The current query's other params ride
  * along as hidden inputs so sort doesn't drop active filters.
  *
- * Auto-submit is wired by a nonce'd `is:inline` <script> rather than an inline
- * `onchange=` handler, so a strict, ENFORCED CSP allows it without 'unsafe-inline'
- * / 'unsafe-hashes' (Epic S2). The <noscript> Apply button covers the no-JS case.
+ * Auto-submit is wired by a nonce'd `is:inline` script element rather than an
+ * inline `onchange=` handler, so a strict, ENFORCED CSP allows it without
+ * 'unsafe-inline' / 'unsafe-hashes' (Epic S2). The noscript Apply button covers
+ * the no-JS case.
+ *
+ * Never write a literal script tag (angle brackets) in this file's frontmatter
+ * comment: the .astro dependency scanner matches it as a real tag, pairs it with
+ * the closing tag of the actual block below, and parses the prose between them as
+ * JavaScript. That fails the whole scan, and Vite's response is to skip dependency
+ * pre-bundling for the entire app rather than to error — which silently disables
+ * the SSR prebundle that `astro.config.mjs` relies on.
  */
 import type { ListProductsQuery } from "@tot/public-runtime";
 

package/apps/storefront/src/pages/index.astro

@@ -41,7 +41,7 @@ const marketing = !features.catalog;
 
 // Raw-HTML home (vendor-injected): serve the tenant's own self-contained
 // document VERBATIM, bypassing the block Layout entirely. Its inline
-// <style>/<script> get this request's CSP nonce so the strict policy still
+// style/script elements get this request's CSP nonce so the strict policy still
 // allows them. This route stays fully inside Astro — middleware already applied
 // tenant resolution + canonical host, and on the way out applies security
 // headers, the CSP, and (in prod) the edge page cache. SEO title/meta/canonical/

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.0.33",
+  "version": "2.0.35",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",