@tokenoftrust/storefront-runner 2.0.39 → 2.0.41

package/apps/storefront/public/platform/google-measurement/v2/entry.mjs

@@ -1,4 +1,4 @@
-/** Reviewed parent-side marker for the null-origin GA4 platform adapter. */
+/** Reviewed parent-side marker for the isolated-origin GA4 platform adapter. */
 export const platformAdapterEntry = Object.freeze({
   schemaVersion: 1,
   origin: "platform-adapter",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.0.39",
+  "version": "2.0.41",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/src/integration/csp-compiler.ts

@@ -63,9 +63,12 @@ export const INTEGRATION_CSP_PROFILES: Readonly<Record<string, CspSourceSet>> =
     "connect-src": ["https://cdn.usefathom.com"],
   },
 
-  // Google code and network authority live only in the null-origin sandbox. The
-  // parent needs no addition: base frame-src 'self' admits the versioned host.
-  "google-measurement": {},
+  // Google code and network authority live only in the isolated-origin sandbox. The
+  // hosted preview uses the dedicated tokenoftrust.store sibling. Custom-domain
+  // publication aliases are added from the validated canonical host at declaration time.
+  "google-measurement": {
+    "frame-src": ["https://analytics-frame.tokenoftrust.store"],
+  },
 
   // Meta pixel (fbevents.js). The loader is served from connect.facebook.net; the
   // pixel's collect endpoint is the facebook.com tracking origin. The tenant

package/packages/public-runtime/src/integration/lifecycle-boot.ts

@@ -16,7 +16,7 @@
  * constructs bundled platform code with host-owned capabilities. Every other entry goes
  * through the authority-tier loader: it loads ONLY an `elevated-parent` entry (whose
  * honest, review-only contract IS arbitrary parent-document JavaScript) and REFUSES every
- * other tier. A reviewed registry entry may construct its own null-origin iframe and
+ * other tier. A reviewed registry entry may construct its own isolated-origin iframe and
  * private typed MessagePort; arbitrary `sandbox`-tier entry modules remain refused by
  * the parent-realm loader, so their isolation is never silently downgraded. Loading is
  * also consent-gated: the binding reads
@@ -42,7 +42,7 @@ import type { NavigationCompletedEvent, NavigationKind } from "./events.js";
 import { CommerceEventBroker } from "./commerce-broker.js";
 import { validateBrowserEnvironment, BROWSER_ENVIRONMENT_GLOBAL, type BrowserEnvironment } from "./environment.js";
 import { makePlatformAdapterRuntimeLoader } from "./platform-adapter-runtime.js";
-import { NATIVE_GA4_SANDBOX_URL, type NativeGa4Transport } from "./native-ga4.js";
+import { resolveNativeGa4SandboxUrl, type NativeGa4Transport } from "./native-ga4.js";
 import {
   createBrowserNativeGa4SandboxHost,
   createNativeGa4SandboxTransport,
@@ -118,7 +118,7 @@ export interface BootLifecycleOptions {
   fetchCapability?: typeof fetch;
   /** Entry import capability; injectable for tests and non-browser hosts. */
   importModule?: (url: string) => Promise<unknown>;
-  /** Reviewed null-origin GA4 transport; injectable for DOM-free tests. */
+  /** Reviewed isolated-origin GA4 transport; injectable for DOM-free tests. */
   nativeGa4Transport?: NativeGa4Transport;
 }
 
@@ -326,7 +326,7 @@ export function bootIntegrationLifecycle(
       }
       return createNativeGa4SandboxTransport(
         createBrowserNativeGa4SandboxHost(document, MessageChannel),
-        NATIVE_GA4_SANDBOX_URL,
+        resolveNativeGa4SandboxUrl(win.location.href),
       );
     },
   });

package/packages/public-runtime/src/integration/native-ga4-sandbox-asset.d.mts

@@ -1,2 +1,4 @@
 export const NATIVE_GA4_SANDBOX_ASSET_PATH: "platform/google-measurement/v2/sandbox.html";
 export const NATIVE_GA4_SANDBOX_ASSET_URL: "/platform/google-measurement/v2/sandbox.html";
+export const NATIVE_GA4_SANDBOX_ORIGIN: "https://analytics-frame.tokenoftrust.store";
+export function resolveNativeGa4SandboxUrl(parentHref: string): string;

package/packages/public-runtime/src/integration/native-ga4-sandbox-asset.mjs

@@ -1,3 +1,28 @@
-/** Stable provider-neutral artifact path for the reviewed GA4 null-origin sandbox. */
+/** Stable provider-neutral artifact path for the reviewed GA4 transport frame. */
 export const NATIVE_GA4_SANDBOX_ASSET_PATH = "platform/google-measurement/v2/sandbox.html";
 export const NATIVE_GA4_SANDBOX_ASSET_URL = `/${NATIVE_GA4_SANDBOX_ASSET_PATH}`;
+export const NATIVE_GA4_SANDBOX_ORIGIN = "https://analytics-frame.tokenoftrust.store";
+
+/**
+ * Keep Google tag execution on a real, isolated origin. An opaque sandbox origin makes
+ * gtag.js load successfully but silently suppresses every collection request. Production
+ * uses a dedicated no-auth hostname for hosted surfaces and the tenant's paired apex/www
+ * publication alias for custom domains. Local development uses an analytics.localhost
+ * sibling while retaining the current dev-server port.
+ */
+export function resolveNativeGa4SandboxUrl(parentHref) {
+  const parent = new URL(parentHref);
+  if (parent.hostname === "localhost" || parent.hostname.endsWith(".localhost")) {
+    const sandbox = new URL(NATIVE_GA4_SANDBOX_ASSET_URL, parent);
+    sandbox.hostname = "analytics.localhost";
+    return sandbox.href;
+  }
+  if (parent.hostname === "tokenoftrust.store" || parent.hostname.endsWith(".tokenoftrust.store")) {
+    return new URL(NATIVE_GA4_SANDBOX_ASSET_URL, NATIVE_GA4_SANDBOX_ORIGIN).href;
+  }
+  const sandbox = new URL(NATIVE_GA4_SANDBOX_ASSET_URL, parent);
+  sandbox.hostname = parent.hostname.startsWith("www.")
+    ? parent.hostname.slice("www.".length)
+    : `www.${parent.hostname}`;
+  return sandbox.href;
+}

package/packages/public-runtime/src/integration/native-ga4-sandbox-entry.ts

@@ -64,11 +64,11 @@ export function startNativeGa4Sandbox(win: NativeGa4SandboxRuntimeWindow, doc: D
   const bind = (event: MessageEvent): void => {
     try {
       const data = plainRecord(event.data);
-      const ownOrigin = new URL(win.location.href).origin;
       if (
-        bound || event.source !== win.parent || event.origin !== ownOrigin || event.ports.length !== 1 ||
-        !data || !exactKeys(data, ["protocol", "type"]) ||
+        bound || event.source !== win.parent || event.ports.length !== 1 ||
+        !data || !exactKeys(data, ["protocol", "type", "parentOrigin"]) ||
         data["protocol"] !== NATIVE_GA4_SANDBOX_PROTOCOL || data["type"] !== "bind"
+        || !validOrigin(data["parentOrigin"]) || event.origin !== data["parentOrigin"]
       ) return;
       bound = true;
       win.removeEventListener("message", bind);
@@ -85,9 +85,8 @@ function runPort(port: MessagePort, win: NativeGa4SandboxRuntimeWindow, doc: Doc
   let active = false;
   let disposed = false;
   let canonicalOrigin = "";
-  let currentGroup = "";
+  let currentDestinations: string[] = [];
   let lastPageLocation = "";
-  let generation = 0;
   let tagLoaded = false;
 
   const dataLayer: unknown[] = [];
@@ -99,13 +98,14 @@ function runPort(port: MessagePort, win: NativeGa4SandboxRuntimeWindow, doc: Doc
 
   const configure = (message: Record<string, unknown>): void => {
     if (
-      !exactKeys(message, ["schemaVersion", "type", "destinationIds", "canonicalOrigin"]) ||
+      !exactKeys(message, ["schemaVersion", "type", "destinationIds", "canonicalOrigin", "analyticsConsent"]) ||
       message["schemaVersion"] !== 1 || message["type"] !== "configure" ||
+      message["analyticsConsent"] !== "granted" ||
       !validIds(message["destinationIds"]) || !validOrigin(message["canonicalOrigin"])
     ) return;
     const ids = message["destinationIds"];
     canonicalOrigin = message["canonicalOrigin"];
-    currentGroup = `tot_storefront_${++generation}`;
+    currentDestinations = [...ids];
     lastPageLocation = "";
     active = true;
 
@@ -119,9 +119,13 @@ function runPort(port: MessagePort, win: NativeGa4SandboxRuntimeWindow, doc: Doc
       });
       gtag("js", new Date());
     }
+    // This sandbox is created and configured only after the parent lifecycle's
+    // platform consent gate grants analytics. Mirror that granted state into Google's
+    // consent mode; leaving its default denied suppresses the explicit page_view that
+    // follows even though the platform correctly admitted it.
+    gtag("consent", "update", { analytics_storage: message["analyticsConsent"] });
     for (const id of ids) {
       gtag("config", id, {
-        groups: currentGroup,
         send_page_view: false,
         allow_google_signals: false,
         allow_ad_personalization_signals: false,
@@ -148,7 +152,6 @@ function runPort(port: MessagePort, win: NativeGa4SandboxRuntimeWindow, doc: Doc
       const pageLocation = `${canonicalOrigin}${message["path"]}`;
       lastPageLocation = pageLocation;
       const params: Record<string, unknown> = {
-        send_to: currentGroup,
         page_location: pageLocation,
         page_path: message["path"],
       };
@@ -160,7 +163,9 @@ function runPort(port: MessagePort, win: NativeGa4SandboxRuntimeWindow, doc: Doc
           if (campaign[key] !== undefined) params[`campaign_${ga4Key}`] = campaign[key];
         }
       }
-      gtag("event", "page_view", params);
+      for (const id of currentDestinations) {
+        gtag("event", "page_view", { ...params, send_to: id });
+      }
       return;
     }
     if (message["type"] === "action") {
@@ -169,7 +174,9 @@ function runPort(port: MessagePort, win: NativeGa4SandboxRuntimeWindow, doc: Doc
         typeof message["name"] !== "string" || !APPROVED_ACTIONS.has(message["name"]) ||
         message["pageLocation"] !== lastPageLocation || !lastPageLocation
       ) return;
-      gtag("event", message["name"], { send_to: currentGroup, page_location: lastPageLocation });
+      for (const id of currentDestinations) {
+        gtag("event", message["name"], { send_to: id, page_location: lastPageLocation });
+      }
     }
   };
 
@@ -181,6 +188,7 @@ function runPort(port: MessagePort, win: NativeGa4SandboxRuntimeWindow, doc: Doc
       if (message["type"] === "disable") {
         if (exactKeys(message, ["schemaVersion", "type"]) && message["schemaVersion"] === 1) {
           active = false;
+          currentDestinations = [];
           lastPageLocation = "";
         }
         return;
@@ -189,6 +197,7 @@ function runPort(port: MessagePort, win: NativeGa4SandboxRuntimeWindow, doc: Doc
         if (exactKeys(message, ["schemaVersion", "type"]) && message["schemaVersion"] === 1) {
           active = false;
           disposed = true;
+          currentDestinations = [];
           lastPageLocation = "";
           port.close();
         }

package/packages/public-runtime/src/integration/native-ga4-sandbox.ts

@@ -1,4 +1,4 @@
-/** Closed parent/iframe protocol for the reviewed GA4 null-origin sandbox. */
+/** Closed parent/iframe protocol for the reviewed GA4 isolated-origin sandbox. */
 export const NATIVE_GA4_SANDBOX_PROTOCOL = "tot.ga4-sandbox/1" as const;
 export const NATIVE_GA4_SANDBOX_MAX_DESTINATIONS = 4 as const;
 
@@ -6,6 +6,8 @@ export interface NativeGa4SandboxConfig {
   schemaVersion: 1;
   destinationIds: string[];
   canonicalOrigin: string;
+  /** The parent may configure GA4 only after the platform consent gate grants analytics. */
+  analyticsConsent: "granted";
 }
 
 export interface NativeGa4PageViewCommand {
@@ -52,6 +54,7 @@ export interface NativeGa4SandboxFrame {
 }
 
 export interface NativeGa4SandboxHost {
+  parentOrigin: string;
   createFrame(): NativeGa4SandboxFrame;
   appendFrame(frame: NativeGa4SandboxFrame): void;
   createChannel(): { port1: NativeGa4MessagePort; port2: Transferable };
@@ -71,6 +74,7 @@ export function createBrowserNativeGa4SandboxHost(
   messageChannel: typeof MessageChannel,
 ): NativeGa4SandboxHost {
   return {
+    parentOrigin: doc.location.origin,
     createFrame: () => doc.createElement("iframe"),
     appendFrame: (frame) => (doc.body ?? doc.documentElement).append(frame as HTMLIFrameElement),
     createChannel: () => new messageChannel(),
@@ -80,17 +84,21 @@ export function createBrowserNativeGa4SandboxHost(
 }
 
 /**
- * Mount one hidden same-origin iframe and transfer exactly one MessagePort after load.
- * The wildcard target is required because `allow-scripts` without `allow-same-origin`
- * gives the receiver an opaque origin; the exact iframe window and one-shot transfer
+ * Mount one hidden same-site, cross-origin iframe and transfer exactly one MessagePort
+ * after load. gtag suppresses collection in an opaque third-party frame, so the receiver
+ * needs a real same-site origin. The exact origin, iframe window, and one-shot transfer
  * are the authority boundary. No general parent `message` listener is installed.
  */
 export function createNativeGa4SandboxTransport(
   host: NativeGa4SandboxHost,
   sandboxUrl: string,
 ): NativeGa4SandboxTransport {
+  const sandboxOrigin = new URL(sandboxUrl, host.parentOrigin).origin;
+  if (!host.parentOrigin || sandboxOrigin === host.parentOrigin) {
+    throw new Error("ga4_sandbox_origin_not_isolated");
+  }
   const frame = host.createFrame();
-  frame.setAttribute("sandbox", "allow-scripts");
+  frame.setAttribute("sandbox", "allow-scripts allow-same-origin");
   frame.setAttribute("referrerpolicy", "no-referrer");
   frame.setAttribute("aria-hidden", "true");
   frame.setAttribute("tabindex", "-1");
@@ -119,8 +127,8 @@ export function createNativeGa4SandboxTransport(
     port = channel.port1;
     try {
       target.postMessage(
-        Object.freeze({ protocol: NATIVE_GA4_SANDBOX_PROTOCOL, type: "bind" }),
-        "*",
+        Object.freeze({ protocol: NATIVE_GA4_SANDBOX_PROTOCOL, type: "bind", parentOrigin: host.parentOrigin }),
+        sandboxOrigin,
         [channel.port2],
       );
     } catch {

package/packages/public-runtime/src/integration/native-ga4.ts

@@ -4,7 +4,7 @@
  * The adapter consumes only manually-authored page/action events from the scoped
  * lifecycle subscription. It never loads Google code into the regulated parent.
  * Instead, a closed command crosses one private MessagePort into the reviewed,
- * null-origin GA4 sandbox after consent and logical-event dedupe have passed.
+ * isolated-origin GA4 sandbox after consent and logical-event dedupe have passed.
  */
 import type { IntegrationLifecycleContext, IntegrationLifecycleModule, LifecycleUpdateReason } from "./lifecycle.js";
 import type { CommerceEventType } from "./events.js";
@@ -21,10 +21,14 @@ import type {
   NativeGa4SandboxCommand,
   NativeGa4SandboxConfig,
 } from "./native-ga4-sandbox.js";
-import { NATIVE_GA4_SANDBOX_ASSET_URL } from "./native-ga4-sandbox-asset.mjs";
+import {
+  NATIVE_GA4_SANDBOX_ASSET_URL,
+  resolveNativeGa4SandboxUrl,
+} from "./native-ga4-sandbox-asset.mjs";
 
 export const NATIVE_GA4_ENTRY_URL = "/platform/google-measurement/v2/entry.mjs" as const;
 export const NATIVE_GA4_SANDBOX_URL = NATIVE_GA4_SANDBOX_ASSET_URL;
+export { resolveNativeGa4SandboxUrl };
 export const NATIVE_GA4_ADAPTER_VERSION = "1.0.0" as const;
 export const NATIVE_GA4_RUNTIME_ID = "native-ga4-v2" as const;
 
@@ -223,6 +227,7 @@ export function createNativeGa4Module(options: NativeGa4ModuleOptions): Integrat
         schemaVersion: 1 as const,
         destinationIds: [...next.destinationIds],
         canonicalOrigin: next.canonicalOrigin,
+        analyticsConsent: "granted" as const,
       };
       runTransportEffect(transport?.configure ? () => transport.configure!(configuration) : undefined);
     } catch {

package/packages/public-runtime/src/integration/platform-adapters.ts

@@ -75,7 +75,7 @@ import {
 } from "./manifest.js";
 import type { IntegrationCspProfile } from "./csp-compiler.js";
 import { INTEGRATION_CSP_PROFILES } from "./csp-compiler.js";
-import { INTEGRATION_CSP_DIRECTIVES } from "./csp.js";
+import { INTEGRATION_CSP_DIRECTIVES, type CspSourceSet } from "./csp.js";
 import { digestValue } from "./digest.js";
 import type { EffectivePlan } from "./plan.js";
 import { resolveEffectivePlan, type IntegrationDeclarationInput } from "./resolve.js";
@@ -140,7 +140,7 @@ const AMPLITUDE_PROJECT_KEY = /^(?=[a-f0-9]{32}$)(?=.*[a-f])[a-f0-9]+$/i;
 
 /**
  * Native Google Analytics 4 measurement. Reviewed parent code sends a closed event
- * protocol to supported gtag.js inside a null-origin iframe. Google code and network
+ * protocol to supported gtag.js inside a same-site, cross-origin iframe. Google code and network
  * authority stay out of the parent document. It does not run a merchant-owned browser
  * container. Depends on analytics consent (ADR 0023 Q3).
  */
@@ -486,6 +486,13 @@ export function buildPlatformAdapterDeclaration(
     return blocked("validation-blocked", v.items);
   }
 
+  const cspSources: CspSourceSet = {};
+  if (def.adapterId === GOOGLE_MEASUREMENT_ADAPTER.adapterId) {
+    const canonicalHost = envResult.value.canonicalHost.toLowerCase();
+    const apexHost = canonicalHost.startsWith("www.") ? canonicalHost.slice(4) : canonicalHost;
+    cspSources["frame-src"] = [`https://${apexHost}`, `https://www.${apexHost}`];
+  }
+
   // Public config: one flat, primitive, PUBLIC id per configured stage. These are
   // public measurement ids (they ship in page HTML), never secret material.
   const publicConfig: Record<string, unknown> = {};
@@ -530,7 +537,7 @@ export function buildPlatformAdapterDeclaration(
         loadWhen: "all-declared-purposes-eligible",
         unknownState: "block",
       },
-      csp: { profiles: [def.cspProfile], sources: {} },
+      csp: { profiles: [def.cspProfile], sources: cspSources },
       permissions: { events: adapterEventTypes(def), data: [], actions: [], domIntent: "none" },
       performanceBudget: def.performanceBudget,
     },