@tokenoftrust/storefront-runner 2.2.79 → 2.2.81

package/apps/storefront/src/lib/cspStaticHashes.ts

@@ -19,7 +19,7 @@ export const STATIC_SCRIPT_HASHES: readonly string[] = [
   "'sha256-YicfxUFBkKrQapZ/tzZKlaKTdNHgwVfv7y2Wa0NC6/k='",
   "'sha256-eIXWvAmxkr251LJZkjniEK5LcPF3NkapbJepohwYRIc='",
   "'sha256-elMLh/6Oubj8u9FRLwZLyRa6TqKikGs75mf0jfWcoxI='",
-  "'sha256-ZxqYN/PbpT0W68E87+IwdGfcYJuAVXNPNVxVb3VX0hw='",
+  "'sha256-bANHtvoDkw4GnpBynM5Ib1cxdoDeNsGkPhPnDEphW3Y='",
 ];
 
 export const STATIC_STYLE_HASHES: readonly string[] = [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.2.79",
+  "version": "2.2.81",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/src/integration/native-ga4-sandbox-entry.ts

@@ -154,6 +154,18 @@ function seedSessionCookies(jar: Map<string, string>, ids: readonly string[], vi
   }
 }
 
+/**
+ * gtag's enhanced measurement runs inside this frame and reports the frame's own
+ * document: its URL, its title, and a `scroll` at 90% depth that a short hidden
+ * document reaches on load (measured 2026-10-06 on a live stream). A frame taller than
+ * any viewport never reaches that depth, so the fabricated scroll is never sent.
+ * Setting height through the CSSOM is outside the frame's style CSP, which governs markup.
+ */
+function suppressFrameScroll(doc: Document): void {
+  const root = doc.documentElement as HTMLElement | null | undefined;
+  if (root?.style) root.style.height = "1000000px";
+}
+
 function validCampaign(value: unknown): value is Record<string, string> {
   const record = plainRecord(value);
   if (!record || !exactKeys(record, ["source", "medium", "campaign", "term", "content"], [])) return false;
@@ -257,6 +269,7 @@ function runPort(port: MessagePort, win: NativeGa4SandboxRuntimeWindow, doc: Doc
       });
     }
     if (doc.querySelector('script[data-tot-ga4="1"]') === null) {
+      suppressFrameScroll(doc);
       const script = doc.createElement("script");
       script.async = true;
       script.src = `https://www.googletagmanager.com/gtag/js?id=${encodeURIComponent(ids[0]!)}`;
@@ -274,6 +287,10 @@ function runPort(port: MessagePort, win: NativeGa4SandboxRuntimeWindow, doc: Doc
       if (message["campaign"] !== undefined && !validCampaign(message["campaign"])) return;
       const pageLocation = `${canonicalOrigin}${message["path"]}`;
       lastPageLocation = pageLocation;
+      // Events gtag collects on its own (engagement, enhanced measurement) take the page
+      // from these defaults, not from the frame. The title crosses the boundary as the path:
+      // the frame's own title would label every page "Analytics transport".
+      gtag("set", { page_location: pageLocation, page_title: message["path"] });
       const params: Record<string, unknown> = {
         ...governedProperties,
         page_location: pageLocation,