@tokenoftrust/storefront-runner 4.0.1 → 4.1.1

package/apps/storefront/src/lib/checkout/commerce/checkoutHandoffRoute.ts

@@ -32,6 +32,7 @@ import {
   withShippingPolicy,
   withReturnUrl,
   trustedCartReturnUrl,
+  CHECKOUT_NAVIGATION_REFERRER_POLICY,
   SHIPPING_UNAVAILABLE_CART_MESSAGE,
   ShippingPolicyUnavailableError,
   type CartDenialCode,
@@ -183,6 +184,7 @@ async function cartFormPost(context: APIContext): Promise<Response> {
     headers: {
       location,
       "cache-control": "no-store",
+      "referrer-policy": CHECKOUT_NAVIGATION_REFERRER_POLICY,
       "x-tot-payment-authorized": "false",
     },
   });
@@ -233,7 +235,7 @@ function sampleResponse(body: string | null, status: number, location?: string):
   return new Response(body, { status, headers: {
     "content-type": "application/json; charset=utf-8",
     "cache-control": "private, no-store",
-    "referrer-policy": "no-referrer",
+    "referrer-policy": location ? CHECKOUT_NAVIGATION_REFERRER_POLICY : "no-referrer",
     "x-robots-tag": "noindex, nofollow",
     "x-tot-payment-authorized": "false",
     ...(location ? { location } : {}),

package/apps/storefront/src/lib/checkout/shared/lazyCheckoutLoader.ts

@@ -38,6 +38,7 @@
  * published (CloudFront/S3) output — both render Layout.astro. The session id
  * is not part of that HTML.
  */
+import { CHECKOUT_NAVIGATION_REFERRER_POLICY } from "@tot/public-runtime";
 import { CART_UNAVAILABLE_MESSAGE } from "@/lib/checkout/commerce/cartSession";
 
 export const LAZY_CHECKOUT_LOADER_IDLE_MS = 8000;
@@ -77,6 +78,7 @@ export function lazyCheckoutLoaderJs(options: LazyCheckoutLoaderOptions): string
   var cartOrigin = ${literal(options.cartOrigin)};
   var sessionHref = ${literal(options.sessionHref)};
   var cookiePath = ${literal(options.cookiePath)};
+  var referrerPolicy = ${literal(CHECKOUT_NAVIGATION_REFERRER_POLICY)};
   var storeNotPublic = ${options.storeNotPublic ? "true" : "false"};
   var events = ${literal(LAZY_CHECKOUT_LOADER_EVENTS)};
   var state = 'idle';
@@ -87,6 +89,46 @@ export function lazyCheckoutLoaderJs(options: LazyCheckoutLoaderOptions): string
     if (!url) return false;
     try { return new URL(url, document.baseURI).origin === cartOrigin; } catch (e) { return false; }
   }
+  // Foxy copies the Referer onto cart_cancel_and_continue_link and ignores a
+  // continue parameter. The document policy stays strict-origin. A cart script
+  // snapshots the Referer while its src is assigned, so that assignment uses the
+  // store-home URL and restores the page before the turn ends. A cart navigation
+  // sends the full document URL through the element's referrerPolicy. That URL
+  // already includes the store origin and tenant path, and the history entry
+  // stays the page that opened the cart.
+  function storeHome() {
+    return location.origin + cookiePath;
+  }
+  function revealStoreHome() {
+    var home = storeHome();
+    if (location.href === home) return;
+    window.history.replaceState(window.history.state, "", home);
+  }
+  function restoreHref(current) {
+    if (location.href !== current) window.history.replaceState(window.history.state, "", current);
+  }
+  var origCreate = document.createElement;
+  document.createElement = function (name) {
+    var el = origCreate.apply(document, arguments);
+    if (String(name).toLowerCase() !== "script") return el;
+    var proto = window.HTMLScriptElement && window.HTMLScriptElement.prototype;
+    var srcDesc = proto && Object.getOwnPropertyDescriptor(proto, "src");
+    if (!srcDesc || !srcDesc.get || !srcDesc.set) return el;
+    Object.defineProperty(el, "src", {
+      configurable: true,
+      enumerable: true,
+      get: function () { return srcDesc.get.call(this); },
+      set: function (value) {
+        if (!targetsCart(value)) return srcDesc.set.call(this, value);
+        this.referrerPolicy = referrerPolicy;
+        var current = location.href;
+        revealStoreHome();
+        try { return srcDesc.set.call(this, value); }
+        finally { restoreHref(current); }
+      }
+    });
+    return el;
+  };
   function commerceReachable() {
     var nodes = document.querySelectorAll(${managedCart} + ', a[href], form[action]');
     for (var i = 0; i < nodes.length; i++) {
@@ -209,6 +251,7 @@ export function lazyCheckoutLoaderJs(options: LazyCheckoutLoaderOptions): string
     if (event.button !== 0 || event.metaKey || event.ctrlKey || event.shiftKey || event.altKey) return;
     var anchor = event.target && event.target.closest ? event.target.closest('a[href]') : null;
     if (!anchor || anchor.target === '_blank' || !targetsCart(anchor.href)) return;
+    anchor.referrerPolicy = referrerPolicy;
     if (state === 'ready') {
       stampAnchor(anchor);
       return;
@@ -268,7 +311,12 @@ export function lazyCheckoutLoaderJs(options: LazyCheckoutLoaderOptions): string
     var cartForm = targetsCart(form.getAttribute('action'));
     if (!managed && !cartForm) return;
     if (form.dataset.cartSession === '1') {
-      if (!cartForm || state === 'ready') return;
+      if (!cartForm || state === 'ready') {
+        if (!event.defaultPrevented && state === 'ready') {
+          form.referrerPolicy = referrerPolicy;
+        }
+        return;
+      }
       event.preventDefault();
       whenReady(function () { stampForm(form); resubmit(form); });
       return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "4.0.1",
+  "version": "4.1.1",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/src/checkout.ts

@@ -212,6 +212,22 @@ export const INTERNAL_CART_FIELDS = ["currency", "tenant", "verification", "ship
 /** The signed cart option the checkout store's Continue Shopping link reads (`withReturnUrl`). */
 export const RETURN_URL_CART_FIELD = "return_url";
 
+/**
+ * Referrer policy for a request the browser makes to the managed checkout (a cart
+ * script, a cart navigation, or the hop that follows a 303 onto the cart).
+ *
+ * Measured 2026-10-24 against tot-preview: Foxy sets `cart_cancel_and_continue_link`
+ * from the Referer and ignores a `continue` parameter. An origin-only Referer
+ * overwrites a fuller one; the first request with no Referer falls back to the
+ * store's configured store URL (the host root). `strict-origin-when-cross-origin`
+ * sends only that origin on a cross-origin checkout request, so empty-cart and
+ * receipt links drop the tenant path. This value sends the full URL on https and
+ * nothing on a downgrade. It is not the document policy: a redirect response's
+ * Referrer-Policy replaces the element's, and `no-referrer` on that response
+ * clears the path. The site-wide header stays strict-origin.
+ */
+export const CHECKOUT_NAVIGATION_REFERRER_POLICY = "no-referrer-when-downgrade";
+
 /** The signed cart option the checkout store reads the shipping charge from. */
 export const SHIPPING_POLICY_CART_FIELD = "shipping_policy";