@tokenoftrust/storefront-runner 4.0.0 → 4.1.0

package/apps/storefront/src/lib/checkout/commerce/checkoutHandoffRoute.ts

@@ -32,6 +32,7 @@ import {
   withShippingPolicy,
   withReturnUrl,
   trustedCartReturnUrl,
+  CHECKOUT_NAVIGATION_REFERRER_POLICY,
   SHIPPING_UNAVAILABLE_CART_MESSAGE,
   ShippingPolicyUnavailableError,
   type CartDenialCode,
@@ -183,6 +184,7 @@ async function cartFormPost(context: APIContext): Promise<Response> {
     headers: {
       location,
       "cache-control": "no-store",
+      "referrer-policy": CHECKOUT_NAVIGATION_REFERRER_POLICY,
       "x-tot-payment-authorized": "false",
     },
   });
@@ -233,7 +235,7 @@ function sampleResponse(body: string | null, status: number, location?: string):
   return new Response(body, { status, headers: {
     "content-type": "application/json; charset=utf-8",
     "cache-control": "private, no-store",
-    "referrer-policy": "no-referrer",
+    "referrer-policy": location ? CHECKOUT_NAVIGATION_REFERRER_POLICY : "no-referrer",
     "x-robots-tag": "noindex, nofollow",
     "x-tot-payment-authorized": "false",
     ...(location ? { location } : {}),

package/apps/storefront/src/lib/checkout/shared/lazyCheckoutLoader.ts

@@ -38,6 +38,7 @@
  * published (CloudFront/S3) output — both render Layout.astro. The session id
  * is not part of that HTML.
  */
+import { CHECKOUT_NAVIGATION_REFERRER_POLICY } from "@tot/public-runtime";
 import { CART_UNAVAILABLE_MESSAGE } from "@/lib/checkout/commerce/cartSession";
 
 export const LAZY_CHECKOUT_LOADER_IDLE_MS = 8000;
@@ -77,6 +78,7 @@ export function lazyCheckoutLoaderJs(options: LazyCheckoutLoaderOptions): string
   var cartOrigin = ${literal(options.cartOrigin)};
   var sessionHref = ${literal(options.sessionHref)};
   var cookiePath = ${literal(options.cookiePath)};
+  var referrerPolicy = ${literal(CHECKOUT_NAVIGATION_REFERRER_POLICY)};
   var storeNotPublic = ${options.storeNotPublic ? "true" : "false"};
   var events = ${literal(LAZY_CHECKOUT_LOADER_EVENTS)};
   var state = 'idle';
@@ -87,6 +89,44 @@ export function lazyCheckoutLoaderJs(options: LazyCheckoutLoaderOptions): string
     if (!url) return false;
     try { return new URL(url, document.baseURI).origin === cartOrigin; } catch (e) { return false; }
   }
+  // Foxy copies the Referer onto cart_cancel_and_continue_link and a later
+  // origin-only Referer overwrites it. The document policy stays strict-origin.
+  // Checkout requests opt into the full store-home URL, then the address is put back
+  // when the request snapshots it synchronously (a cart script). A navigation
+  // snapshots after this turn, so that path leaves the store-home URL in place.
+  function storeHome() {
+    return location.origin + cookiePath;
+  }
+  function revealStoreHome() {
+    var home = storeHome();
+    if (location.href === home) return;
+    window.history.replaceState(window.history.state, "", home);
+  }
+  function restoreHref(current) {
+    if (location.href !== current) window.history.replaceState(window.history.state, "", current);
+  }
+  var origCreate = document.createElement;
+  document.createElement = function (name) {
+    var el = origCreate.apply(document, arguments);
+    if (String(name).toLowerCase() !== "script") return el;
+    var proto = window.HTMLScriptElement && window.HTMLScriptElement.prototype;
+    var srcDesc = proto && Object.getOwnPropertyDescriptor(proto, "src");
+    if (!srcDesc || !srcDesc.get || !srcDesc.set) return el;
+    Object.defineProperty(el, "src", {
+      configurable: true,
+      enumerable: true,
+      get: function () { return srcDesc.get.call(this); },
+      set: function (value) {
+        if (!targetsCart(value)) return srcDesc.set.call(this, value);
+        this.referrerPolicy = referrerPolicy;
+        var current = location.href;
+        revealStoreHome();
+        try { return srcDesc.set.call(this, value); }
+        finally { restoreHref(current); }
+      }
+    });
+    return el;
+  };
   function commerceReachable() {
     var nodes = document.querySelectorAll(${managedCart} + ', a[href], form[action]');
     for (var i = 0; i < nodes.length; i++) {
@@ -209,8 +249,10 @@ export function lazyCheckoutLoaderJs(options: LazyCheckoutLoaderOptions): string
     if (event.button !== 0 || event.metaKey || event.ctrlKey || event.shiftKey || event.altKey) return;
     var anchor = event.target && event.target.closest ? event.target.closest('a[href]') : null;
     if (!anchor || anchor.target === '_blank' || !targetsCart(anchor.href)) return;
+    anchor.referrerPolicy = referrerPolicy;
     if (state === 'ready') {
       stampAnchor(anchor);
+      if (!event.defaultPrevented) revealStoreHome();
       return;
     }
     if (event.defaultPrevented) return;
@@ -268,7 +310,13 @@ export function lazyCheckoutLoaderJs(options: LazyCheckoutLoaderOptions): string
     var cartForm = targetsCart(form.getAttribute('action'));
     if (!managed && !cartForm) return;
     if (form.dataset.cartSession === '1') {
-      if (!cartForm || state === 'ready') return;
+      if (!cartForm || state === 'ready') {
+        if (!event.defaultPrevented && state === 'ready') {
+          form.referrerPolicy = referrerPolicy;
+          revealStoreHome();
+        }
+        return;
+      }
       event.preventDefault();
       whenReady(function () { stampForm(form); resubmit(form); });
       return;

package/apps/storefront/src/lib/content/seo/faqItems.ts

@@ -40,14 +40,28 @@ function detailsPair(block: string): FaqItem | null {
   return { q, a: textOf(rest) };
 }
 
-/** FAQ pairs from sanitized body HTML: question-phrased h2–h4, plus every details/summary pair. */
+/** A heading inside details is that pair's question, not a second heading pair. */
+function insideDetails(index: number, ranges: Array<{ start: number; end: number }>): boolean {
+  return ranges.some((range) => index >= range.start && index < range.end);
+}
+
+/** FAQ pairs from sanitized body HTML: question-phrased h2–h4 outside details, plus every details/summary pair. */
 export function faqFromHtml(html: string | undefined): FaqItem[] {
   if (!html) return [];
+  const ranges = [...html.matchAll(/<details\b[^>]*>[\s\S]*?<\/details>/gi)].map((match) => ({
+    start: match.index ?? 0,
+    end: (match.index ?? 0) + match[0].length,
+  }));
   const parts = html.split(/(<h[2-4][^>]*>[\s\S]*?<\/h[2-4]>)/i);
   const items: FaqItem[] = [];
-  for (let i = 1; i < parts.length; i += 2) {
-    const q = textOf(parts[i]!);
-    if (isQuestion(q)) items.push({ q, a: textOf(parts[i + 1] ?? "") });
+  let offset = 0;
+  for (let i = 0; i < parts.length; i++) {
+    const part = parts[i] ?? "";
+    if (i % 2 === 1) {
+      const q = textOf(part);
+      if (isQuestion(q) && !insideDetails(offset, ranges)) items.push({ q, a: textOf(parts[i + 1] ?? "") });
+    }
+    offset += part.length;
   }
   for (const block of html.matchAll(/<details\b[^>]*>[\s\S]*?<\/details>/gi)) {
     const pair = detailsPair(block[0]);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "4.0.0",
+  "version": "4.1.0",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/src/checkout.ts

@@ -212,6 +212,22 @@ export const INTERNAL_CART_FIELDS = ["currency", "tenant", "verification", "ship
 /** The signed cart option the checkout store's Continue Shopping link reads (`withReturnUrl`). */
 export const RETURN_URL_CART_FIELD = "return_url";
 
+/**
+ * Referrer policy for a request the browser makes to the managed checkout (a cart
+ * script, a cart navigation, or the hop that follows a 303 onto the cart).
+ *
+ * Measured 2026-10-24 against tot-preview: Foxy sets `cart_cancel_and_continue_link`
+ * from the Referer and ignores a `continue` parameter. An origin-only Referer
+ * overwrites a fuller one; the first request with no Referer falls back to the
+ * store's configured store URL (the host root). `strict-origin-when-cross-origin`
+ * sends only that origin on a cross-origin checkout request, so empty-cart and
+ * receipt links drop the tenant path. This value sends the full URL on https and
+ * nothing on a downgrade. It is not the document policy: a redirect response's
+ * Referrer-Policy replaces the element's, and `no-referrer` on that response
+ * clears the path. The site-wide header stays strict-origin.
+ */
+export const CHECKOUT_NAVIGATION_REFERRER_POLICY = "no-referrer-when-downgrade";
+
 /** The signed cart option the checkout store reads the shipping charge from. */
 export const SHIPPING_POLICY_CART_FIELD = "shipping_policy";