@tokenoftrust/storefront-runner 2.2.26 → 2.2.28

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.2.26",
+  "version": "2.2.28",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/src/integration/native-amplitude.ts

@@ -7,11 +7,14 @@
  * as non-identifying storefront traffic; it is never derived from a browser,
  * person, account, persisted client value, network address, or device signal.
  *
- * Channel ATTRIBUTION (UTM tokens + the referrer's origin) is allowed through as
- * plain `event_properties`: it is a minimized, campaign-scoped label already
- * validated upstream (`events.ts` `validatePageAttribution`), not a visitor or
- * device signal, and this adapter re-screens each value for PII before sending
- * it regardless. A persistent/session identity is a different thing entirely —
+ * Page views also carry channel ATTRIBUTION (UTM tokens + the referrer's origin)
+ * and the page LOCATION (`page_hostname` / `page_url`, from the server-stamped
+ * canonical host plus the validated path), as plain `event_properties` named to
+ * match the merchant's existing website events so their channel rules and page-URL
+ * mappings apply unchanged. These are labels about the page and the campaign, not
+ * about the visitor: attribution is minimized and validated upstream
+ * (`events.ts` `validatePageAttribution`) and re-screened for PII here, and the
+ * host never comes from the browser. A persistent/session identity is a different thing entirely —
  * it stays out, on purpose: `device_id` remains the fixed, non-identifying value
  * below and there is still no `session_id`, `user_id`, or any persisted client
  * value anywhere in this file.
@@ -63,16 +66,24 @@ export type AmplitudeAttributionProperties = Partial<{
   utm_campaign: string;
   utm_term: string;
   utm_content: string;
-  referrer_origin: string;
+  /** The referring page's origin only (`https://host`), never its path or query. */
+  referrer: string;
 }>;
 
+/** Where a page view happened: `page_path` from the event, the host from the trusted environment. */
+export interface AmplitudePageLocationProperties {
+  page_path: string;
+  page_hostname: string;
+  page_url: string;
+}
+
 export interface AmplitudeHttpEvent {
   event_type: "page_view" | (typeof APPROVED_MARKETING_ACTION_NAMES)[number];
   device_id: typeof ANONYMOUS_DEVICE_ID;
   insert_id: string;
   /** Occurrence time, epoch milliseconds. */
   time: number;
-  event_properties: GovernedEventProperties & { page_path?: string } & AmplitudeAttributionProperties;
+  event_properties: GovernedEventProperties & Partial<AmplitudePageLocationProperties> & AmplitudeAttributionProperties;
 }
 
 export const AMPLITUDE_DEDUPE_CAPACITY = 512 as const;
@@ -154,7 +165,7 @@ function extractAttributionProperties(data: Record<string, unknown>): AmplitudeA
   if (isPlainObject(referrer)) {
     const origin = referrer["origin"];
     if (typeof origin === "string" && origin.length > 0 && !resemblesManagedAnalyticsPii(origin)) {
-      out.referrer_origin = origin;
+      out.referrer = origin;
     }
   }
 
@@ -223,11 +234,16 @@ export function mapCommerceEventToAmplitude(
   }
   const path = event.data["path"];
   if (!isSafePagePath(path)) return null;
-  const attribution = extractAttributionProperties(event.data);
+  const host = environmentResult.value.canonicalHost;
+  const location: AmplitudePageLocationProperties = {
+    page_path: path,
+    page_hostname: host,
+    page_url: `https://${host}${path}`,
+  };
   return {
     ...base,
     event_type: "page_view",
-    event_properties: { ...governed, page_path: path, ...attribution },
+    event_properties: { ...governed, ...location, ...extractAttributionProperties(event.data) },
   };
 }
 

package/scripts/tenant/validate.mjs

@@ -624,11 +624,15 @@ export const LARGE_PUBLIC_ASSET_IDEA_ID = "fb-1790956035713-snpovm";
 export const LARGE_PUBLIC_ASSET_FIX =
   `storing it under public/ will work, but every publish re-copies it into R2 and ` +
   `your Gitea repo keeps it forever — on a tenant with many of these, expect ` +
-  `slower publishes and slower clones over time. Today, host it on a shared drive ` +
-  `you control and tell us the URL so we can pull it in and serve it from R2 directly, ` +
-  `rather than committing it to the tenant repo. We're tracking a built-in fix ` +
-  `(automatic relocation to deduped storage, idea ${LARGE_PUBLIC_ASSET_IDEA_ID}) — ` +
-  `vote for it if you'd like this handled for you sooner.`;
+  `slower publishes and slower clones over time. If this is an image, you don't ` +
+  `need to do anything extra: reference its public URL directly in your <img>/ ` +
+  `background-image/srcset and our capture step pulls it into CDN storage ` +
+  `automatically on publish. For a PDF or other non-image file, that auto-capture ` +
+  `doesn't apply yet — linking straight to an external URL avoids the repo-size ` +
+  `problem entirely, or send us the URL and we'll pull it in manually. We're ` +
+  `tracking a built-in fix to auto-relocate large files of any type the same way ` +
+  `images already work (idea ${LARGE_PUBLIC_ASSET_IDEA_ID}) — vote for it if ` +
+  `you'd like this handled for you sooner.`;
 
 /**
  * The advisory rules LOUD enough to call out by NAME at `tot validate` / `tot