@tokenoftrust/storefront-runner 2.4.77 → 2.4.78

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.4.77",
+  "version": "2.4.78",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/src/product-details.ts

@@ -47,9 +47,37 @@ const DEFAULT_SPEC_HEADING = "Product Details";
 const DEFAULT_FAQ_HEADING = "Frequently Asked Questions";
 const DEFAULT_BOX_CONTENTS_LABEL = "What's in the box";
 
+/**
+ * True for a metafield that carries an unresolved platform reference rather
+ * than displayable content — a Shopify metaobject/product/variant/file/
+ * collection/page reference (bare or `list.*`), surfaced either through its
+ * declared `type` or, when type is absent/untrusted, through the `gid://`
+ * shape of its value itself (bare or as a JSON array of them, the `list.*`
+ * on-disk form). No declared section may render one: a raw `gid://...`
+ * identifier is never product content, no matter which section asked for it.
+ */
+function isUnresolvedReference(m: Metafield): boolean {
+  if (m.type && /_reference$/.test(m.type)) return true;
+  const v = m.value?.trim();
+  if (!v) return false;
+  if (v.startsWith("gid://")) return true;
+  if (v.startsWith("[")) {
+    try {
+      const parsed = JSON.parse(v);
+      if (Array.isArray(parsed) && parsed.length > 0 && parsed.every((x) => typeof x === "string" && x.startsWith("gid://"))) {
+        return true;
+      }
+    } catch {
+      /* not JSON — fall through, not a reference by this check */
+    }
+  }
+  return false;
+}
+
 function metafieldLookup(metafields: readonly Metafield[]): (namespace: string, key: string) => string | undefined {
   const map = new Map<string, string>();
   for (const m of metafields) {
+    if (isUnresolvedReference(m)) continue;
     const v = m.value?.trim();
     if (v) map.set(`${m.namespace}.${m.key}`, v);
   }