@tokenoftrust/storefront-runner 2.2.80 → 2.2.82

package/apps/storefront/src/config/devTenantSeed.ts

@@ -70,7 +70,11 @@ export function synthesizeDevTenant(
   const appDomain = hints.appDomain ?? id;
   // The tenant's OWN tree analytics.json → the render plane's declaration seam,
   // fail-closed (a missing/invalid file yields no declarations, never a throw).
-  const integrations = loadTenantAnalyticsDeclarations(hints.analyticsRaw, id, appDomain);
+  const { declarations: integrations, euUkVisitors } = loadTenantAnalyticsDeclarations(
+    hints.analyticsRaw,
+    id,
+    appDomain,
+  );
   const base: TenantConfig = {
     tenant_id: id,
     appDomain,
@@ -92,6 +96,7 @@ export function synthesizeDevTenant(
     // Only set when the tenant actually declared one — an undeclared tenant keeps
     // `integrations` absent, so its resolved plan is byte-identical to before.
     ...(integrations.length > 0 ? { integrations } : {}),
+    ...(euUkVisitors ? { euUkVisitors } : {}),
   };
   if (hints.hasCatalog) {
     // Catalog fixtures on disk → a real commerce tenant (siteType omitted ==

package/apps/storefront/src/lib/cspStaticHashes.ts

@@ -19,7 +19,7 @@ export const STATIC_SCRIPT_HASHES: readonly string[] = [
   "'sha256-YicfxUFBkKrQapZ/tzZKlaKTdNHgwVfv7y2Wa0NC6/k='",
   "'sha256-eIXWvAmxkr251LJZkjniEK5LcPF3NkapbJepohwYRIc='",
   "'sha256-elMLh/6Oubj8u9FRLwZLyRa6TqKikGs75mf0jfWcoxI='",
-  "'sha256-ZxqYN/PbpT0W68E87+IwdGfcYJuAVXNPNVxVb3VX0hw='",
+  "'sha256-bANHtvoDkw4GnpBynM5Ib1cxdoDeNsGkPhPnDEphW3Y='",
 ];
 
 export const STATIC_STYLE_HASHES: readonly string[] = [

package/apps/storefront/src/lib/integration/renderIntegrationState.ts

@@ -7,7 +7,7 @@ import {
   type CompiledIntegrationCsp,
   type EffectivePlan,
   type IntegrationDeclarationInput,
-  type ObligationTenant,
+  type InterimBridgeInput,
 } from "@tot/public-runtime";
 
 export interface IntegrationRenderState {
@@ -58,7 +58,7 @@ export function composeIntegrationDeclarations(
  */
 export function resolveIntegrationRenderState(input: {
   tenantPublicId: string;
-  tenant: ObligationTenant;
+  tenant: InterimBridgeInput["tenant"];
   environment: BrowserEnvironment;
   declarations: readonly IntegrationDeclarationInput[];
 }): IntegrationRenderState {

package/apps/storefront/src/lib/integration/tenantAnalyticsDeclarations.ts

@@ -36,11 +36,13 @@ import {
   buildPlatformAdapterDeclaration,
   ENVIRONMENT_SCHEMA_VERSION,
   Violations,
+  isEuUkVisitorPolicy,
   isPlainObject,
   rejectUnknownKeys,
   type BrowserEnvironment,
   type ContractViolation,
   type IntegrationDeclarationInput,
+  type TenantConfig,
 } from "@tot/public-runtime";
 
 /** The tenant-owned file that declares measurement destinations, in the tenant tree. */
@@ -63,6 +65,11 @@ export interface TenantAnalyticsMaterialization {
   ok: boolean;
   /** The materialized declarations, in declared order. Empty whenever `ok` is false. */
   declarations: readonly IntegrationDeclarationInput[];
+  /**
+   * The declared `euUkVisitors` policy when it is not the `count-only` default. Absent
+   * whenever `ok` is false, so an invalid file never widens EU/UK collection.
+   */
+  euUkVisitors?: TenantConfig["euUkVisitors"];
   /** Per-field violations for the publish surface. Empty whenever `ok` is true. */
   violations: readonly ContractViolation[];
 }
@@ -149,7 +156,15 @@ export function materializeTenantAnalyticsDeclarations(input: {
     v.add("(root)", "type", "analytics.json must be a JSON object with a `destinations` array.");
     return { ok: false, declarations: EMPTY, violations: v.items };
   }
-  rejectUnknownKeys(raw, ["schemaVersion", "destinations"], v, "");
+  rejectUnknownKeys(raw, ["schemaVersion", "destinations", "euUkVisitors"], v, "");
+  const euUkVisitors = raw["euUkVisitors"];
+  if ("euUkVisitors" in raw && !isEuUkVisitorPolicy(euUkVisitors)) {
+    v.add(
+      "euUkVisitors",
+      "unknown_enum",
+      'euUkVisitors must be "count-only" (the default), "full", or "none".',
+    );
+  }
   if ("schemaVersion" in raw && raw["schemaVersion"] !== TENANT_ANALYTICS_SCHEMA_VERSION) {
     v.add(
       "schemaVersion",
@@ -183,7 +198,12 @@ export function materializeTenantAnalyticsDeclarations(input: {
   });
 
   if (!v.ok) return { ok: false, declarations: EMPTY, violations: v.items };
-  return { ok: true, declarations, violations: [] };
+  return {
+    ok: true,
+    declarations,
+    violations: [],
+    ...(euUkVisitors === "full" || euUkVisitors === "none" ? { euUkVisitors } : {}),
+  };
 }
 
 /**
@@ -198,6 +218,11 @@ export function loadTenantAnalyticsDeclarations(
   raw: unknown,
   tenantPublicId: string,
   canonicalHost: string,
-): readonly IntegrationDeclarationInput[] {
-  return materializeTenantAnalyticsDeclarations({ raw, tenantPublicId, canonicalHost }).declarations;
+): Pick<TenantAnalyticsMaterialization, "declarations" | "euUkVisitors"> {
+  const { declarations, euUkVisitors } = materializeTenantAnalyticsDeclarations({
+    raw,
+    tenantPublicId,
+    canonicalHost,
+  });
+  return euUkVisitors ? { declarations, euUkVisitors } : { declarations };
 }

package/apps/storefront/src/lib/visitorRegionCookie.ts

@@ -0,0 +1,68 @@
+/**
+ * The Worker half of the visitor region signal (the CloudFront half is the
+ * viewer-response function in scripts/publish/cloudfront/csp-meta-emit.mjs).
+ *
+ * Every HTML document the Worker answers gets a class-only `tot_rgn` cookie derived
+ * from `request.cf.country`, appended after any edge-cache read or write, so cached
+ * bytes and cache keys stay region-invariant. The early consent boot reads it to apply
+ * the tenant's EU/UK visitor policy.
+ *
+ * No cookie is set on the GA4 sandbox frame document, which must keep its origin free
+ * of state, or when the Worker cannot see the viewer:
+ *   - a CloudFront-forwarded Tier 3 request (its `cf` describes CloudFront, not the
+ *     viewer);
+ *   - no `request.cf` at all (the local dev loop).
+ * The page then keeps whatever class it already holds, or none (count-only).
+ *
+ * The dev loop can exercise both branches with `?tot_region=eu|x|u`, honored only in a
+ * dev build (`import.meta.env.DEV`), never on a deployed Worker.
+ */
+import {
+  visitorRegionClass,
+  visitorRegionCookie,
+  type VisitorRegionClass,
+} from "@tot/public-runtime/integration/visitor-region";
+import { NATIVE_GA4_SANDBOX_ASSET_URL } from "@tot/public-runtime/integration/native-ga4-sandbox-asset";
+
+export const VISITOR_REGION_DEV_OVERRIDE_PARAM = "tot_region";
+
+function devOverride(url: URL): VisitorRegionClass | null {
+  const value = url.searchParams.get(VISITOR_REGION_DEV_OVERRIDE_PARAM);
+  return value === "eu" || value === "x" || value === "u" ? value : null;
+}
+
+/** The class this request's response should carry, or null to set none. */
+export function visitorRegionFor(
+  request: Request,
+  opts: { cdnForwarded: boolean; dev: boolean },
+): VisitorRegionClass | null {
+  const url = new URL(request.url);
+  if (url.pathname.endsWith(NATIVE_GA4_SANDBOX_ASSET_URL)) return null;
+  if (opts.dev) {
+    const override = devOverride(url);
+    if (override) return override;
+  }
+  if (opts.cdnForwarded) return null;
+  const cf = (request as Request & { cf?: { country?: unknown } }).cf;
+  if (!cf || typeof cf !== "object") return null;
+  return visitorRegionClass(cf.country);
+}
+
+/** Append the region cookie to an HTML document response; any other response is returned as is. */
+export function withVisitorRegionCookie(
+  response: Response,
+  regionClass: VisitorRegionClass | null,
+): Response {
+  if (!regionClass) return response;
+  if (!(response.headers.get("content-type") ?? "").toLowerCase().includes("text/html")) return response;
+  const cookie = visitorRegionCookie(regionClass);
+  try {
+    response.headers.append("set-cookie", cookie);
+    return response;
+  } catch {
+    // Immutable headers (a fetched or platform response): copy, then append.
+    const copy = new Response(response.body, response);
+    copy.headers.append("set-cookie", cookie);
+    return copy;
+  }
+}

package/apps/storefront/src/middleware/index.ts

@@ -20,6 +20,7 @@
  * Contract: docs/architecture/decisions/0013-public-serving-contract.md
  */
 import { defineMiddleware } from "astro:middleware";
+import type { APIContext, MiddlewareNext } from "astro";
 import { getTenantResolver } from "@/config/resolver";
 import { readEnv, readKv, readR2 } from "@/lib/runtimeEnv";
 import { resolveCdnForwardRouting, resolveTenantRouting } from "@/lib/tenantRouting";
@@ -28,6 +29,7 @@ import { compileRouteTierIndexV1, type RouteTierIndexV1 } from "@tot/public-runt
 import type { PublicationArtifactBucketV1, TenantConfig } from "@tot/public-runtime";
 import { DEV_DRAFT_COOKIE } from "@/lib/dev/devDraft";
 import { applySecurityHeaders } from "@/lib/securityHeaders";
+import { visitorRegionFor, withVisitorRegionCookie } from "@/lib/visitorRegionCookie";
 import { tryServeStaticBundle } from "./staticBundle.js";
 import { resolveCandidateContentPin } from "./candidatePin.js";
 import { parseGateMode } from "@/lib/auth/loginGate";
@@ -65,7 +67,24 @@ function routeTierIndexFor(tenant: TenantConfig): RouteTierIndexV1 {
   return compiled;
 }
 
+/**
+ * Every HTML document leaves with the visitor's region class (lib/visitorRegionCookie),
+ * appended after the branch has read or written any edge cache.
+ */
 export const onRequest = defineMiddleware(async (context, next) => {
+  const seen = { cdnForwarded: false };
+  const response = await serveRequest(context, next, seen);
+  return withVisitorRegionCookie(
+    response,
+    visitorRegionFor(context.request, { cdnForwarded: seen.cdnForwarded, dev: import.meta.env.DEV }),
+  );
+});
+
+async function serveRequest(
+  context: APIContext,
+  next: MiddlewareNext,
+  seen: { cdnForwarded: boolean },
+): Promise<Response> {
   const { request, locals } = context;
   const url = new URL(request.url);
   let host =
@@ -109,6 +128,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
   // host-keyed decision below (gates, canonical base, the origin check) then sees
   // the host the viewer addressed, never this Worker's own.
   const cdn = await verifyCdnForward(request.headers, await readEnv("CDN_ORIGIN_SECRET"));
+  seen.cdnForwarded = !!cdn;
   if (cdn) host = cdn.viewerHost;
   const origin = cdn ? `https://${cdn.viewerHost}` : url.origin;
   const crossSite = crossSiteFormRefusal(request, origin);
@@ -340,4 +360,4 @@ export const onRequest = defineMiddleware(async (context, next) => {
     applySecurityHeaders(response.headers);
     return response;
   }
-});
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.2.80",
+  "version": "2.2.82",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/package.json

@@ -20,7 +20,8 @@
     "./retention-holds": "./src/retention-holds.ts",
     "./tenant-embed-defaults": "./src/tenant-embed-defaults.mjs",
     "./integration/lifecycle-host-asset": "./src/integration/lifecycle-host-asset.mjs",
-    "./integration/native-ga4-sandbox-asset": "./src/integration/native-ga4-sandbox-asset.mjs"
+    "./integration/native-ga4-sandbox-asset": "./src/integration/native-ga4-sandbox-asset.mjs",
+    "./integration/visitor-region": "./src/integration/visitor-region.mjs"
   },
   "dependencies": {
     "css-tree": "2.2.1",

package/packages/public-runtime/src/integration/consent-broker.ts

@@ -29,6 +29,7 @@
 import { CONSENT_PURPOSES, type ConsentPurpose } from "../integration-capabilities.js";
 import { CONSENT_SNAPSHOT_SCHEMA_VERSION } from "./version.js";
 import type { EventConsentSnapshot } from "./events.js";
+import type { EuUkVisitorPolicy } from "./plan.js";
 
 /** The purpose that is always on and cannot be gated (charter floor). */
 const ESSENTIAL: ConsentPurpose = "essential";
@@ -476,7 +477,10 @@ export class ConsentBroker {
  * Viewer-owned analytics consent for the public storefront document.
  *
  * The tenant configuration supplies the analytics default and a stored viewer choice
- * overrides it. Global Privacy Control always denies analytics. The same synchronous
+ * overrides it. Global Privacy Control always denies analytics. Visitors the edge
+ * classes as EU/EEA/UK/CH, or cannot class, get the tenant's EU/UK visitor policy:
+ * `count-only` (default) keeps page views but stores nothing on the device, `none`
+ * denies analytics, and `full` applies the default behavior. The same synchronous
  * early boot runs in both document mounts before any integration or measurement loader
  * can execute.
  */
@@ -485,18 +489,32 @@ export const VIEWER_ANALYTICS_CONSENT_STORAGE_KEY = "tot.viewer-analytics-consen
 export const VIEWER_ANALYTICS_CONSENT_STATE_GLOBAL = "__TOT_VIEWER_ANALYTICS_CONSENT__";
 export const VIEWER_ANALYTICS_CONSENT_CHANGE_EVENT = "tot:viewer-analytics-consent-changed";
 export const VIEWER_ANALYTICS_CONSENT_RETENTION_DAYS = 180;
-export const VIEWER_ANALYTICS_REGION_POLICY = "universal-opt-in" as const;
 
 export type ViewerAnalyticsConsentDecision = "granted" | "denied";
 
 export interface ViewerAnalyticsConsentState {
   schemaVersion: 1;
   decision: ViewerAnalyticsConsentDecision;
-  source: "tenant-default" | "default-deny" | "stored" | "stored-invalid" | "global-privacy-control";
+  source:
+    | "tenant-default"
+    | "default-deny"
+    | "stored"
+    | "stored-invalid"
+    | "global-privacy-control"
+    | "eu-uk-policy";
   canGrant: boolean;
   expiresAt: number | null;
   retentionDays: typeof VIEWER_ANALYTICS_CONSENT_RETENTION_DAYS;
-  regionPolicy: typeof VIEWER_ANALYTICS_REGION_POLICY;
+  /** The edge's region class (`tot_rgn` cookie); `unknown` when absent or unreadable. */
+  region: "eu-uk" | "other" | "unknown";
+  /** The tenant's EU/UK visitor policy from the server-stamped plan. */
+  euUkVisitors: EuUkVisitorPolicy;
+  /**
+   * Whether analytics may keep a visitor and session on this device. `none` whenever
+   * analytics is ineligible or the EU/UK `count-only` policy applies; the lifecycle's
+   * visitor-continuity storage reads this and falls back to a per-page memory id.
+   */
+  visitorStorage: "persistent" | "none";
   tenantPublicId: string;
   environment: string;
   siteSurface: string;
@@ -547,6 +565,7 @@ export function applyEarlyViewerAnalyticsConsent(
     tenantPublicId?: unknown;
     environment?: unknown;
     siteSurface?: unknown;
+    euUkVisitors?: unknown;
   } | undefined;
   const candidateEligible = Array.isArray(current?.eligiblePurposes)
     ? current.eligiblePurposes.filter((purpose): purpose is string =>
@@ -595,6 +614,21 @@ export function applyEarlyViewerAnalyticsConsent(
   const tenantDefaultAnalytics = tenantApprovedAnalytics && rawEligible.includes("analytics");
   const globalPrivacyControl = win.navigator?.globalPrivacyControl === true;
 
+  // The edge sets a class-only `tot_rgn` cookie on every HTML response
+  // (visitor-region.mjs). An absent or unreadable class is unknown, and unknown gets
+  // the EU/UK policy until the region is known.
+  let regionClass = "u";
+  try {
+    const regionMatch = /(?:^|;\s*)tot_rgn=(eu|x|u)(?:;|$)/.exec(String(win.document?.cookie ?? ""));
+    if (regionMatch) regionClass = regionMatch[1] as string;
+  } catch {
+    // An unreadable cookie jar leaves the region unknown.
+  }
+  const euUkVisitors: EuUkVisitorPolicy =
+    plan?.euUkVisitors === "full" || plan?.euUkVisitors === "none" ? plan.euUkVisitors : "count-only";
+  const regionRestricted = regionClass !== "x" && euUkVisitors !== "full";
+  const regionDeniesAnalytics = regionRestricted && euUkVisitors === "none";
+
   let stored: { decision: ViewerAnalyticsConsentDecision; expiresAt: number } | null = null;
   // A stored record that is present but unreadable may have been a denial, so it denies
   // rather than falling through to a granting tenant default. Only a well-formed record
@@ -646,12 +680,14 @@ export function applyEarlyViewerAnalyticsConsent(
   }
 
   const decision: ViewerAnalyticsConsentDecision =
-    globalPrivacyControl || !tenantApprovedAnalytics || (!stored && storedInvalid)
+    globalPrivacyControl || !tenantApprovedAnalytics || regionDeniesAnalytics || (!stored && storedInvalid)
       ? "denied"
       : stored?.decision ?? (tenantDefaultAnalytics ? "granted" : "denied");
   const source: ViewerAnalyticsConsentState["source"] = globalPrivacyControl
     ? "global-privacy-control"
-    : stored
+    : regionDeniesAnalytics
+      ? "eu-uk-policy"
+      : stored
       ? "stored"
       : storedInvalid
         ? "stored-invalid"
@@ -659,18 +695,22 @@ export function applyEarlyViewerAnalyticsConsent(
           ? "tenant-default"
           : "default-deny";
 
+  // Under the EU/UK policy, marketing and personalization never run: neither can work
+  // without storing an identifier on the device.
   const eligible = canonicalPurposes.filter(
     (purpose) =>
       purpose === "essential" ||
       (purpose === "analytics"
         ? decision === "granted" && tenantApprovedAnalytics
-        : rawEligible.includes(purpose)),
+        : !regionRestricted && rawEligible.includes(purpose)),
   );
   const approved = canonicalPurposes.filter((purpose) => rawApproved.includes(purpose));
-  // Analytics ineligible here (denial, GPC, tenant not approved) forgets this context's
-  // Amplitude visitor id and session before any adapter can run. The key is the
-  // native-amplitude.ts VISITOR_CONTINUITY_STORAGE_KEY prefix over the same contextKey.
-  if (!eligible.includes("analytics")) {
+  const visitorStorage = eligible.includes("analytics") && !regionRestricted ? "persistent" : "none";
+  // Without persistent visitor storage (denial, GPC, tenant not approved, or the EU/UK
+  // policy) this context's visitor id and session are forgotten before any adapter can
+  // run. The key is the native-amplitude.ts VISITOR_CONTINUITY_STORAGE_KEY prefix over
+  // the same contextKey.
+  if (visitorStorage === "none") {
     try {
       win.localStorage?.removeItem?.(`tot.analytics-continuity.v1:${encodeURIComponent(contextKey)}`);
     } catch {
@@ -689,10 +729,12 @@ export function applyEarlyViewerAnalyticsConsent(
     schemaVersion: 1,
     decision,
     source,
-    canGrant: tenantApprovedAnalytics && !globalPrivacyControl,
+    canGrant: tenantApprovedAnalytics && !globalPrivacyControl && !regionDeniesAnalytics,
     expiresAt: stored?.expiresAt ?? null,
     retentionDays,
-    regionPolicy: "universal-opt-in",
+    region: regionClass === "eu" ? "eu-uk" : regionClass === "x" ? "other" : "unknown",
+    euUkVisitors,
+    visitorStorage,
     tenantPublicId,
     environment,
     siteSurface,

package/packages/public-runtime/src/integration/interim-bridge.ts

@@ -31,6 +31,7 @@ import type { BootDescriptorIntegration } from "./render-phases.js";
 import type { AssuranceSurface } from "./assurance.js";
 import { resolveEffectivePlan, type IntegrationDeclarationInput } from "./resolve.js";
 import type { ObligationTenant } from "../compliance-obligations.js";
+import type { TenantConfig } from "../tenant.js";
 import { isRegulated, resolveObligationSurface } from "../compliance-obligations.js";
 import {
   isRegulatedParentCertified,
@@ -86,8 +87,11 @@ export type InterimBridgeResult =
 /** Everything the bridge needs to decide eligibility and resolve the plan. */
 export interface InterimBridgeInput {
   tenantPublicId: string;
-  /** The tenant's authoritative config — the ONLY source of its regulated classification. */
-  tenant: ObligationTenant;
+  /**
+   * The tenant's authoritative config — the ONLY source of its regulated classification
+   * and of its EU/UK visitor policy.
+   */
+  tenant: ObligationTenant & Pick<TenantConfig, "euUkVisitors">;
   environment: BrowserEnvironment;
   declarations: readonly IntegrationDeclarationInput[];
   /**
@@ -187,6 +191,7 @@ export function resolveInterimBridgePlan(input: InterimBridgeInput): InterimBrid
     tenantPublicId: input.tenantPublicId,
     environment: input.environment,
     declarations: input.declarations,
+    euUkVisitors: input.tenant.euUkVisitors,
   });
   if (!result.ok) return { ok: false, reason: "invalid-plan", violations: result.violations };
   return { ok: true, plan: result.value };

package/packages/public-runtime/src/integration/lifecycle-boot.ts

@@ -36,7 +36,13 @@ import type { LifecycleObserver } from "./lifecycle-runtime.js";
 import type { IntegrationLifecycleModule } from "./lifecycle.js";
 import type { BootDescriptorIntegration, IntegrationBootDescriptor } from "./render-phases.js";
 import { INTEGRATION_PLAN_GLOBAL, INTEGRATION_CONSENT_GLOBAL } from "./render-phases.js";
-import { parseConsentSnapshot, defaultConsentSnapshot, type ConsentSnapshot } from "./consent-broker.js";
+import {
+  parseConsentSnapshot,
+  defaultConsentSnapshot,
+  VIEWER_ANALYTICS_CONSENT_STATE_GLOBAL,
+  type ConsentSnapshot,
+  type ViewerAnalyticsConsentState,
+} from "./consent-broker.js";
 import { integrationConsentEligible } from "./interim-bridge.js";
 import type { NavigationCompletedEvent, NavigationKind } from "./events.js";
 import { CommerceEventBroker } from "./commerce-broker.js";
@@ -334,7 +340,39 @@ function readBrowserEnvironment(win: LifecycleWindow): BrowserEnvironment | unde
 function defaultConsentGate(
   win: LifecycleWindow,
 ): (integration: BootDescriptorIntegration) => boolean {
-  return (integration) => integrationConsentEligible(integration, readConsentSnapshot(win));
+  return (integration) =>
+    integrationConsentEligible(integration, readConsentSnapshot(win)) &&
+    (integration.consent.loadWhen === "essential-only" ||
+      !euUkPolicyApplies(win) ||
+      storageFreeIntegration(integration));
+}
+
+/**
+ * Whether the tenant's EU/UK visitor policy governs this document: the edge classed the
+ * visitor as EU/EEA/UK/CH or could not class them, and the tenant has not taken `full`
+ * responsibility. A missing state global applies it (fail closed).
+ */
+function euUkPolicyApplies(win: LifecycleWindow): boolean {
+  const state = win[VIEWER_ANALYTICS_CONSENT_STATE_GLOBAL] as ViewerAnalyticsConsentState | undefined;
+  return !state || (state.region !== "other" && state.euUkVisitors !== "full");
+}
+
+/**
+ * Whether the early consent boot allows analytics to keep a visitor on this device.
+ * A missing state global allows nothing (fail closed).
+ */
+function persistentVisitorStorage(win: LifecycleWindow): boolean {
+  const state = win[VIEWER_ANALYTICS_CONSENT_STATE_GLOBAL] as ViewerAnalyticsConsentState | undefined;
+  return state?.visitorStorage === "persistent";
+}
+
+/**
+ * Under the EU/UK policy only a reviewed platform adapter may run: its
+ * visitor storage goes through this host's continuity seam, which then keeps nothing on
+ * the device. Tenant-local and managed-app code could write storage itself.
+ */
+function storageFreeIntegration(integration: BootDescriptorIntegration): boolean {
+  return integration.origin === "platform-adapter" && integration.executionTier === "platform-adapter";
 }
 
 /**
@@ -439,7 +477,9 @@ export function bootIntegrationLifecycle(
     fallback: ordinaryLoader,
     visitorContinuity: createVisitorContinuity({
       storage: options.visitorStorage ??
-        (() => win["localStorage"] as VisitorContinuityStorage | undefined),
+        (() => persistentVisitorStorage(win)
+          ? win["localStorage"] as VisitorContinuityStorage | undefined
+          : undefined),
     }),
     nativeGa4Transport: () => {
       if (options.nativeGa4Transport) return options.nativeGa4Transport;

package/packages/public-runtime/src/integration/native-ga4-sandbox-entry.ts

@@ -154,6 +154,18 @@ function seedSessionCookies(jar: Map<string, string>, ids: readonly string[], vi
   }
 }
 
+/**
+ * gtag's enhanced measurement runs inside this frame and reports the frame's own
+ * document: its URL, its title, and a `scroll` at 90% depth that a short hidden
+ * document reaches on load (measured 2026-10-06 on a live stream). A frame taller than
+ * any viewport never reaches that depth, so the fabricated scroll is never sent.
+ * Setting height through the CSSOM is outside the frame's style CSP, which governs markup.
+ */
+function suppressFrameScroll(doc: Document): void {
+  const root = doc.documentElement as HTMLElement | null | undefined;
+  if (root?.style) root.style.height = "1000000px";
+}
+
 function validCampaign(value: unknown): value is Record<string, string> {
   const record = plainRecord(value);
   if (!record || !exactKeys(record, ["source", "medium", "campaign", "term", "content"], [])) return false;
@@ -257,6 +269,7 @@ function runPort(port: MessagePort, win: NativeGa4SandboxRuntimeWindow, doc: Doc
       });
     }
     if (doc.querySelector('script[data-tot-ga4="1"]') === null) {
+      suppressFrameScroll(doc);
       const script = doc.createElement("script");
       script.async = true;
       script.src = `https://www.googletagmanager.com/gtag/js?id=${encodeURIComponent(ids[0]!)}`;
@@ -274,6 +287,10 @@ function runPort(port: MessagePort, win: NativeGa4SandboxRuntimeWindow, doc: Doc
       if (message["campaign"] !== undefined && !validCampaign(message["campaign"])) return;
       const pageLocation = `${canonicalOrigin}${message["path"]}`;
       lastPageLocation = pageLocation;
+      // Events gtag collects on its own (engagement, enhanced measurement) take the page
+      // from these defaults, not from the frame. The title crosses the boundary as the path:
+      // the frame's own title would label every page "Analytics transport".
+      gtag("set", { page_location: pageLocation, page_title: message["path"] });
       const params: Record<string, unknown> = {
         ...governedProperties,
         page_location: pageLocation,

package/packages/public-runtime/src/integration/plan.ts

@@ -80,12 +80,31 @@ export interface NormalizedContribution {
   source: SourceReference;
 }
 
+/**
+ * The tenant's analytics policy for visitors in the EU/EEA, the UK and Switzerland, and
+ * for visitors whose region is unknown:
+ *   - `count-only` (default): page views are delivered, nothing is stored on the device.
+ *   - `full`: the tenant takes responsibility for EU/UK consent; the default behavior applies.
+ *   - `none`: no analytics or marketing destination runs for those visitors.
+ */
+export const EU_UK_VISITOR_POLICIES = ["count-only", "full", "none"] as const;
+export type EuUkVisitorPolicy = (typeof EU_UK_VISITOR_POLICIES)[number];
+
+export function isEuUkVisitorPolicy(value: unknown): value is EuUkVisitorPolicy {
+  return typeof value === "string" && (EU_UK_VISITOR_POLICIES as readonly string[]).includes(value);
+}
+
 export interface EffectivePlan {
   schemaVersion: typeof EFFECTIVE_PLAN_SCHEMA_VERSION;
   environment: BrowserEnvironment;
   /** Participates in candidate/cache identity; changes when the resolved plan changes. */
   planRevision: string;
   tenantPublicId: string;
+  /**
+   * The tenant's {@link EuUkVisitorPolicy}, present only when it is not the
+   * `count-only` default. It participates in `planRevision`.
+   */
+  euUkVisitors?: Exclude<EuUkVisitorPolicy, "count-only">;
   integrations: PlanIntegration[];
   contributions: NormalizedContribution[];
   /** Resolved execution order over contribution ids. */

package/packages/public-runtime/src/integration/render-phases.ts

@@ -107,6 +107,11 @@ export interface IntegrationBootDescriptor {
   environment: EffectivePlan["environment"]["environment"];
   siteSurface: EffectivePlan["environment"]["siteSurface"];
   tenantPublicId: string;
+  /**
+   * The tenant's EU/UK visitor policy when it is not the `count-only` default. The
+   * early consent boot reads it together with the edge's region class.
+   */
+  euUkVisitors?: EffectivePlan["euUkVisitors"];
   integrations: BootDescriptorIntegration[];
   order: string[];
   phases: Record<string, string[]>;
@@ -295,6 +300,7 @@ function bootDescriptor(plan: EffectivePlan): IntegrationBootDescriptor {
     environment: plan.environment.environment,
     siteSurface: plan.environment.siteSurface,
     tenantPublicId: plan.tenantPublicId,
+    ...(plan.euUkVisitors ? { euUkVisitors: plan.euUkVisitors } : {}),
     integrations: plan.integrations.map((i) => ({
       origin: i.origin,
       appId: i.appId,

package/packages/public-runtime/src/integration/resolve.ts

@@ -40,7 +40,7 @@ import type {
 } from "./plan.js";
 import type { CommerceEventType } from "./events.js";
 import { fnv1a128Hex, stableStringify } from "./digest.js";
-import { assertPlanBrowserSafe } from "./plan.js";
+import { assertPlanBrowserSafe, isEuUkVisitorPolicy, type EuUkVisitorPolicy } from "./plan.js";
 import {
   INTEGRATION_CSP_DIRECTIVES,
   validateCspSourceSet,
@@ -68,6 +68,8 @@ export interface ResolvePlanInput {
   tenantPublicId: string;
   environment: BrowserEnvironment;
   declarations: readonly IntegrationDeclarationInput[];
+  /** The tenant's EU/UK visitor policy; absent means `count-only`. */
+  euUkVisitors?: EuUkVisitorPolicy;
 }
 
 const ORIGIN_RANK: Record<IntegrationOrigin, number> = {
@@ -95,6 +97,10 @@ export function resolveEffectivePlan(
     v.add("tenantPublicId", "type", "tenantPublicId must be a non-empty string.");
   }
 
+  if (input.euUkVisitors !== undefined && !isEuUkVisitorPolicy(input.euUkVisitors)) {
+    v.add("euUkVisitors", "unknown_enum", 'euUkVisitors must be "count-only", "full", or "none".');
+  }
+
   if (!Array.isArray(input.declarations)) {
     v.add("declarations", "type", "declarations must be an array.");
     return { ok: false, violations: v.items };
@@ -212,6 +218,9 @@ export function resolveEffectivePlan(
     schemaVersion: EFFECTIVE_PLAN_SCHEMA_VERSION,
     environment: envResult.ok ? envResult.value : input.environment,
     tenantPublicId: input.tenantPublicId,
+    ...(input.euUkVisitors === "full" || input.euUkVisitors === "none"
+      ? { euUkVisitors: input.euUkVisitors }
+      : {}),
     integrations,
     contributions,
     order,

package/packages/public-runtime/src/integration/visitor-region.d.mts

@@ -0,0 +1,6 @@
+export type VisitorRegionClass = "eu" | "x" | "u";
+export const EU_UK_COUNTRY_CODES: readonly string[];
+export const VISITOR_REGION_COOKIE: "tot_rgn";
+export const VISITOR_REGION_COOKIE_MAX_AGE: 3600;
+export function visitorRegionClass(country: unknown): VisitorRegionClass;
+export function visitorRegionCookie(regionClass: VisitorRegionClass): string;

package/packages/public-runtime/src/integration/visitor-region.mjs

@@ -0,0 +1,64 @@
+/**
+ * The visitor region class: the one non-identifying signal the edge hands the page so
+ * the early consent boot can apply the EU/UK analytics policy without a region-varying
+ * document.
+ *
+ * Both CDNs set it on every HTML response, after any cache: the Cloudflare Worker from
+ * `request.cf.country` and the CloudFront viewer-response function from
+ * `cloudfront-viewer-country`. The cookie carries only the class, never the country, so
+ * the page HTML and every cache key stay region-invariant (ADR 0013).
+ *
+ *   `eu` — EU/EEA, the UK, Switzerland, and their territories inside those regimes
+ *   `x`  — a known country outside them
+ *   `u`  — the edge could not geolocate the request
+ *
+ * The browser treats `eu`, `u`, and an absent or unreadable cookie alike (count-only),
+ * so a missing signal fails closed.
+ *
+ * `visitorRegionClass` is closure-free: the CloudFront generator serializes it with
+ * `Function.toString()` next to an injected `EU_UK_COUNTRY_CODES`, so the edge runs the
+ * logic the tests prove.
+ */
+
+/** ISO 3166-1 alpha-2 codes whose visitors get the EU/UK analytics policy. */
+export const EU_UK_COUNTRY_CODES = Object.freeze([
+  // EU member states
+  "AT", "BE", "BG", "HR", "CY", "CZ", "DK", "EE", "FI", "FR", "DE", "GR", "HU", "IE", "IT",
+  "LV", "LT", "LU", "MT", "NL", "PL", "PT", "RO", "SK", "SI", "ES", "SE",
+  // EU territories with their own ISO codes
+  "AX", "GF", "GP", "MQ", "RE", "YT", "MF",
+  // EEA
+  "IS", "LI", "NO",
+  // UK, Crown dependencies, Gibraltar
+  "GB", "GG", "JE", "IM", "GI",
+  // Switzerland
+  "CH",
+]);
+
+export const VISITOR_REGION_COOKIE = "tot_rgn";
+
+/** Seconds the class is kept; every HTML response refreshes it. */
+export const VISITOR_REGION_COOKIE_MAX_AGE = 3600;
+
+/**
+ * The region class for an edge-reported country code. A missing, malformed, or
+ * placeholder code (`XX` unknown, `T1` Tor) is `u`.
+ * @param {unknown} country
+ * @returns {"eu" | "x" | "u"}
+ */
+export function visitorRegionClass(country) {
+  if (typeof country !== "string") return "u";
+  var code = country.trim().toUpperCase();
+  if (!/^[A-Z]{2}$/.test(code) || code === "XX" || code === "T1") return "u";
+  return EU_UK_COUNTRY_CODES.indexOf(code) !== -1 ? "eu" : "x";
+}
+
+/**
+ * The `Set-Cookie` value for a region class: host-only, first-party, readable by the
+ * early consent boot, and short-lived.
+ * @param {"eu" | "x" | "u"} regionClass
+ * @returns {string}
+ */
+export function visitorRegionCookie(regionClass) {
+  return `${VISITOR_REGION_COOKIE}=${regionClass}; Path=/; Max-Age=${VISITOR_REGION_COOKIE_MAX_AGE}; SameSite=Lax; Secure`;
+}

package/packages/public-runtime/src/tenant.ts

@@ -9,6 +9,7 @@ import type { ManagedCheckoutConfig } from "./checkout.js";
 import type { CapabilityConfig } from "./capabilities.js";
 import type { AutopilotConfig, MembershipProgramConfig } from "./membership.js";
 import type { IntegrationDeclarationInput } from "./integration/resolve.js";
+import type { EuUkVisitorPolicy } from "./integration/plan.js";
 import type { PublicationSpaceManifestV1 } from "./publication-space.js";
 import type { HtmlCachePolicy } from "./html-cache-policy.js";
 
@@ -661,6 +662,12 @@ export interface TenantConfig {
    * complete self-owned declaration, not a reference into a vetted list.
    */
   integrations?: readonly IntegrationDeclarationInput[];
+  /**
+   * The tenant's analytics policy for EU/EEA/UK/CH visitors and visitors whose region
+   * is unknown, from its `analytics.json`. Absent means `count-only`; only `full` and
+   * `none` are ever set. It reaches the browser through the server-stamped plan.
+   */
+  euUkVisitors?: Exclude<EuUkVisitorPolicy, "count-only">;
 }
 
 /**