@adobe/acc-js-sdk 1.1.62 → 1.2.0

package/.github/workflows/codeql-analysis.yml

@@ -17,6 +17,7 @@ on:
   pull_request:
     # The branches below must be a subset of the branches above
     branches: [ master ]
+  workflow_dispatch:
   schedule:
     - cron: '34 13 * * 4'
 
@@ -38,11 +39,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v2
+      uses: actions/checkout@v4
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v1
+      uses: github/codeql-action/init@v3
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -53,7 +54,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v1
+      uses: github/codeql-action/autobuild@v3
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -67,4 +68,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v1
+      uses: github/codeql-action/analyze@v3

package/.github/workflows/npm-publish.yml

@@ -9,11 +9,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout repository
-      uses: actions/checkout@master
+      uses: actions/checkout@v4
     - name: Set up Node.js
-      uses: actions/setup-node@master
+      uses: actions/setup-node@v4
       with:
-        node-version: 10.0.0
+        node-version: 20
     - name: Publish if version has been updated
       #uses: pascalgn/npm-publish-action@06e0830ea83eea10ed4a62654eeaedafb8bf50fc
       uses: mkiki/npm-publish-action@52879298d00c0a02781e1f02c9e917e01cff1bc7

package/AGENTS.md

@@ -0,0 +1,117 @@
+---
+last_compiled_date: 2026-04-04
+version: 1.0
+---
+
+# AGENTS.md — acc-js-sdk
+
+> Guide for AI coding agents. Module-specific rules live in `src/AGENTS.md` and `test/AGENTS.md`.
+> Nearest file to your edit takes precedence. Explicit user prompts override all files.
+
+## 1. Project Overview
+
+Adobe Campaign Classic JavaScript SDK. Provides a JavaScript-idiomatic async API over Campaign's SOAP/XML interface. Isomorphic — runs in Node.js (>=20) and browsers.
+
+### Entry Points
+- `src/index.js::SDK` — Public API surface: `init()`, `escapeXtk()`, `getSDKVersion()`
+- `src/client.js::Client` — Campaign client: NLWS Proxy, session management, SOAP dispatch
+
+### Project Structure
+
+| Module | Purpose | AGENTS.md |
+|--------|---------|-----------|
+| `src/` | Core SDK source (SOAP, caching, schemas, transport) | [`src/AGENTS.md`](src/AGENTS.md) |
+| `test/` | Unit tests (100% coverage, transport mocking) | [`test/AGENTS.md`](test/AGENTS.md) |
+| `samples/` | Usage examples (Node.js and browser) | — |
+| `docs/` | Jekyll documentation site (GitHub Pages) | — |
+| `ai-docs/` | Developer & AI agent reference docs (coding rules, tech stack) | — |
+| `openspec/` | OpenSpec change workflow artifacts | — |
+
+## 2. Architecture
+
+```
+User Code
+  └─ sdk.init(connectionParams) → Client
+       └─ client.NLWS.<namespace>.<method>()   (JS Proxy)
+            ├─ Schema lookup + method resolution
+            ├─ SoapMethodCall (build SOAP envelope)
+            ├─ Transport (axios on Node / fetch in browser)
+            ├─ Response parsing (XML → JSON via representation)
+            └─ Caching (schemas, methods, options, entities)
+```
+
+The SDK is **isomorphic**: `src/transport.js` branches on `Util.isBrowser()` to use axios (Node) or fetch (browser). The browser build is produced by `compile.js` which concatenates source files into `dist/bundle.js` using a custom module system (`src/web/bundler.js`).
+
+## 3. Technology Stack
+
+**Core Stack:**
+- **Language**: JavaScript (ES6/CommonJS modules, IIFE pattern)
+- **Runtime**: Node.js >= 20 + Browser (custom bundler)
+- **Protocol**: SOAP/XML over HTTP to Adobe Campaign Classic
+
+**Detailed tech stack:** See `ai-docs/tech-stack.md`
+
+## 4. Build and Development Commands
+
+```bash
+npm install                # Install dependencies
+npm run unit-tests         # Jest tests with 100% coverage enforcement
+npm run lint               # ESLint on src/
+npm run jsdoc              # Generate API docs in docs/jsdoc
+node compile.js            # Build browser bundle (dist/bundle.js)
+```
+
+## 5. Testing
+
+```bash
+npm run unit-tests         # Full test suite
+```
+
+**Test structure:**
+- Unit tests: `test/<module>.test.js` — transport mocked via `test/mock.js`
+- Coverage target: 100% (branches, lines, statements)
+- See `test/AGENTS.md` for mock patterns
+
+**Verify before commit:**
+- Tests pass: `npm run unit-tests`
+- Linting clean: `npm run lint`
+
+## 6. Critical Coding Rules
+
+- **IIFE + CommonJS only** — no ES modules; browser bundler requires this exact pattern
+- **Isomorphic safety** — guard Node-only APIs with `Util.isBrowser()`; guard browser-only APIs in `else` block
+- **Register new files in `compile.js`** — `resources` array, correct dependency order
+- **No new dependencies without approval** — only 3 runtime deps allowed (`axios`, `jsdom`, `qs-stringify`)
+- **100% test coverage** — every branch, line, and statement must be covered
+- **Adobe license header** on every source file
+
+**Full coding standards:** `ai-docs/coding-rules.md`
+
+## 7. Boundaries and Safety Gates
+
+- ✅ Safe to run: `npm run lint`, `npm run unit-tests`, `npm run jsdoc`, reading any file
+- ⚠️ Ask first: adding dependencies, modifying `compile.js` resource order, changing public API surface in `index.js`
+- 🚫 Never do: use ES modules (`import`/`export`), modify `package-lock.json` directly, push to npm without approval
+
+### Files Agents Should Not Modify
+- `dist/bundle.js` — auto-generated by `compile.js`
+- `package-lock.json` — managed by npm
+- `docs/jsdoc/` — auto-generated by JSDoc
+- `coverage/` — auto-generated by Jest
+
+## 8. Decision-Making Guidance
+
+| If you need to... | Do this |
+|---|---|
+| Add a new SOAP API wrapper | Check if NLWS Proxy handles it automatically; only add intercept in `clientHandler` if special logic needed |
+| Add a new source file | Follow IIFE pattern, register in `compile.js`, add tests for 100% coverage |
+| Handle XML/DOM | Use `DomUtil` methods from `src/domUtil.js`, never raw DOM APIs |
+| Cast between JS and XTK types | Use `XtkCaster` from `src/xtkCaster.js` |
+| Add platform-specific code | Follow `src/transport.js` pattern: `if (!Util.isBrowser()) { ... } else { ... }` |
+
+## 9. Anti-Patterns and Tribal Knowledge
+
+- The NLWS Proxy auto-capitalizes method names — `client.NLWS.xtkSession.getServerTime()` calls `GetServerTime`. Don't manually capitalize.
+- `CampaignException` redacts sensitive data via `Util.trim()` — never log raw SOAP responses containing session tokens
+- The browser bundler is not webpack/rollup — it's a simple concatenation script. Module load order in `compile.js` matters.
+- `var` still appears in older code but `const`/`let` should be used in new code

package/CLAUDE.md

@@ -0,0 +1,2 @@
+<!-- Bridge file for Claude Code. Keep shared instructions in the sibling AGENTS.md unless they are Claude-specific. -->
+@AGENTS.md

package/MIGRATION.md

@@ -1,5 +1,15 @@
 # Migration guide
 
+# Version 1.2.0
+
+In version 1.2.0, dependencies have been bumped to their latest versions to fix vulnerabilities. As a consequence, **Node.js version 20 or above is now required** to use the SDK.
+
+The following potentially breaking changes were introduced
+
+* The minimum supported Node.js version is now 20 (previously 14+)
+* Updated `jsdom` to version 29.x which requires Node.js 20+
+* Updated `@babel/core` and `@babel/preset-env` to version 7.29.x
+
 # Version 1.1.0
 
 In version 1.1.0, changes were made in the metadata API. The SDK lets you access schema as JSON objects (method `client.getSchema`) or provides an object model around schemas with typed objects, as in https://experienceleague.adobe.com/developer/campaign-api/api/c-Schema.html, which can be accessed with `application.getSchema`.

package/README.md

@@ -9,6 +9,10 @@ The API is fully asynchronous using promises and works as well on the server sid
 > **Extensive documentation is available**: https://opensource.adobe.com/acc-js-sdk/
 
 
+# Prerequisites
+
+The SDK requires **Node.js version 20** or above.
+
 # QuickStart
 
 
@@ -32,7 +36,7 @@ console.log(sdk.getSDKVersion());
 which will return the SDK name and version (the actual name and version number will depend on the version you have installed)
 ```
 {
-  version: "1.0.0",
+  version: "1.2.0",
   name: "@adobe/acc-js-sdk",
   description: "ACC Javascript SDK",
 }
@@ -94,7 +98,7 @@ node index.js
 
 It will display something like this
 ```
-ACC Javascript SDK version 1.0.0
+ACC Javascript SDK version 1.2.0
 Target mappings: {"deliveryMapping":[{"id":"1747","label":"Recipients","name":"mapRecipient","schema":"nms:recipient"},{"id":"1826","label":"Subscriptions","name":"mapSubscribe","schema":"nms:subscription"},{"id":"1827","label":"Operators","name":"mapOperator","schema":"xtk:operator"},{"id":"1828","label":"External file","name":"mapAny","schema":""},{"id":"1830","label":"Visitors","name":"mapVisitor","schema":"nms:visitor"},{"id":"2035","label":"Real time event","name":"mapRtEvent","schema":"nms:rtEvent"},{"id":"2036","label":"Batch event","name":"mapBatchEvent","schema":"nms:batchEvent"},{"id":"2070","label":"Subscriber applications","name":"mapAppSubscriptionRcp","schema":"nms:appSubscriptionRcp"}]}
 ````
 

package/ai-docs/coding-rules.md

@@ -0,0 +1,95 @@
+---
+last_compiled_date: 2026-04-04
+version: 1.0
+---
+
+# Coding Rules — acc-js-sdk
+
+## 1. Module Pattern (Critical)
+
+Every source file in `src/` uses the IIFE + CommonJS pattern. Never use ES modules (`import`/`export`).
+
+```js
+(function() {
+  "use strict";
+
+  const Foo = require('./foo.js').Foo;
+
+  class Bar { /* ... */ }
+
+  exports.Bar = Bar;
+  // or: module.exports = bar;
+})();
+```
+
+**Why**: The SDK is isomorphic. The custom browser bundler (`compile.js`) expects this exact pattern — it wraps each file in a synthetic CommonJS module scope. ES modules would break the browser build.
+
+## 2. Isomorphic Constraints (Critical)
+
+The SDK runs in **Node.js** (server) and **browsers** (via `compile.js` → `dist/bundle.js`).
+
+- Use `Util.isBrowser()` to branch platform-specific code (see `src/transport.js` for the canonical example)
+- Never use Node-only APIs (e.g., `fs`, `path`, `Buffer`) without a browser guard
+- Never use browser-only APIs (e.g., `fetch`, `Headers`, `Request`) without a Node guard
+- `axios` is the Node HTTP client; `fetch` is the browser equivalent
+- The `qs-stringify` package is bundled for browser use (`compile.js` resources list)
+
+## 3. Browser Bundler Registration (Critical)
+
+When adding a new source file, it **must** be registered in `compile.js` → `resources` array in the correct dependency order. Files are bundled sequentially — a file can only `require()` files listed above it.
+
+## 4. ESLint & Formatting
+
+- **Indent**: 2 spaces (enforced by ESLint)
+- **Unused vars**: Error, except args prefixed with `_` (pattern: `argsIgnorePattern: "^_"`)
+- **Environments**: `browser`, `commonjs`, `es2021`, `node`, `jest`
+- **Extends**: `eslint:recommended`
+- Run: `npm run lint`
+
+## 5. Testing
+
+- **Framework**: Jest with `babel-jest` transform
+- **Coverage**: 100% branches, lines, and statements (enforced in `test/jest.config.js`)
+- **Test naming**: `test/<module>.test.js` mirrors `src/<module>.js`
+- **Transport mocking**: Use `Mock.makeClient()` from `test/mock.js`, which creates a client with `client._transport = jest.fn()`. Mock responses with `client._transport.mockReturnValueOnce(...)`.
+- **Console mocking**: Use `Mock.withMockConsole(async () => { ... })` to capture `console.log` calls
+- **Run**: `npm run unit-tests`
+
+## 6. License Header
+
+Every source file must start with the Adobe Apache 2.0 license header:
+
+```
+/*
+Copyright 2020 Adobe. All rights reserved.
+This file is licensed to you under the Apache License, Version 2.0 (the "License");
+...
+*/
+```
+
+## 7. JSDoc
+
+Use JSDoc annotations for all public APIs. The project uses the `@namespace Campaign` convention for SDK-level types and `@memberof Campaign` to associate types/methods.
+
+Generate docs with: `npm run jsdoc`
+
+## 8. Error Handling
+
+- Use `CampaignException` / `makeCampaignException` from `src/campaign.js` for Campaign-specific errors
+- Use `HttpError` from `src/transport.js` for HTTP-level errors
+- Always include meaningful error messages; the SDK is used by third-party developers
+
+## 9. XML / SOAP
+
+- DOM utilities live in `src/domUtil.js` (`DomUtil` class) — use these, not raw DOM APIs
+- SOAP calls go through `src/soap.js` (`SoapMethodCall` class)
+- Type casting between JS and XTK types uses `src/xtkCaster.js` (`XtkCaster` class)
+- The SDK converts XML ↔ JSON using configurable representations (SimpleJson, BadgerFish, xml)
+
+## 10. Dependency Policy (Critical)
+
+External dependencies must be strictly limited. The SDK has only 3 runtime dependencies (`axios`, `jsdom`, `qs-stringify`). Never add a new dependency without explicit user confirmation. Prefer implementing functionality inline or using built-in Node.js/browser APIs over pulling in a new package.
+
+## 11. Sensitive Data
+
+Use `Util.trim()` to sanitize objects before logging — it redacts session tokens, passwords, and security tokens from SOAP payloads and objects.

package/ai-docs/tech-stack.md

@@ -0,0 +1,43 @@
+---
+last_compiled_date: 2026-04-04
+version: 1.0
+---
+
+# Technology Stack
+
+## Core
+- **Language**: JavaScript (ES6/ES2021, CommonJS modules)
+- **Runtime**: Node.js >= 20 (server) + Browser (via custom bundler)
+- **Framework**: None (standalone SDK library)
+- **Database**: N/A — SDK is a client library for Adobe Campaign Classic
+
+## Libraries & Tools
+
+| Technology | Category | Role in this repo | Files |
+|---|---|---|---|
+| axios ^1.7.8 | Web | HTTP client for Node.js transport | `src/transport.js` |
+| jsdom ^29.0.1 | Web | DOM/XML parsing in Node.js | `src/domUtil.js` |
+| qs-stringify ^1.2.1 | Web | Query string encoding (isomorphic) | `src/client.js` |
+| Jest ^29.3.1 | Testing | Unit test framework, 100% coverage | `test/` |
+| jest-junit ^15.0.0 | Testing | JUnit XML reporter for CI | `test/jest.config.js` |
+| Babel ^7.29.0 | Testing | Transpilation for Jest (preset-env) | `babel.config.js` |
+| ESLint ^8.7.0 | Quality | Linter (eslint:recommended + custom) | `.eslintrc.js` |
+| JSDoc ^4.0.0 | Docs | API documentation generation | `jsdoc.json` |
+| docdash ^2.0.0 | Docs | JSDoc template | `jsdoc.json` |
+
+**Inclusion criteria:**
+- Must be imported in application code (not just in manifest)
+- Cite >=1 file where it's used
+
+**Dependency policy:** External dependencies are strictly limited. Never add a new dependency without explicit user confirmation. Only 3 runtime dependencies exist.
+
+**Categories**: Web, Testing, Quality, Docs
+
+---
+
+## How to Update
+
+1. Add new dependency to `package.json` (requires explicit approval)
+2. Import and use in application code
+3. If used in browser, register in `compile.js` resources array
+4. Update `ai-docs/tech-stack.md` to reflect the new dependency

package/babel.config.js

@@ -0,0 +1,5 @@
+module.exports = {
+  presets: [
+    ['@babel/preset-env', { targets: { node: 'current' } }]
+  ]
+};

package/docs/changeLog.html

@@ -3,14 +3,40 @@ layout: page
 title: Change Log
 ---
 
+<section class="changelog"><h1>Version 1.2.0</h1>
+  <h2>2026/04/04</h2>
+  <li>
+    <b>Breaking change</b>: the minimum supported Node.js version is now <b>20</b>
+  </li>
+  <li>
+    Bumped <b>jsdom</b> from 20.x to 29.x to fix vulnerabilities (this is the dependency that requires Node.js 20)
+  </li>
+  <li>
+    Added <b>@babel/core</b> and <b>@babel/preset-env</b> to transpile ES module dependencies used by jsdom 29
+  </li>
+  <li>
+    Removed <b>jshint</b> dependency; linting is now done exclusively with ESLint (<b>npm run lint</b>)
+  </li>
+  <li>
+    Updated ESLint configuration to flag unused variables (with underscore-prefixed exceptions)
+  </li>
+  <li>
+    Fixed all warnings and log noise during test runs
+  </li>
+  <li>
+    AI-Enabled the repository with OpenSpec framework
+  </li>
+</section>
+
+
+
 <section class="changelog"><h1>Version 1.1.62</h1>
-  <h2>2025/09/16</h2>
+  <h2>2026/04/03</h2>
   <li>
     Add enableRequestId option to connection parameters to pass the x-request-id parameter. This was passed by default and causing the SDK to be incompatible with older campaign instances
   </li>
 </section>
 
-
 <section class="changelog"><h1>Version 1.1.61</h1>
   <h2>2025/09/16</h2>
   <li>

package/docs/checkList.html

@@ -20,7 +20,7 @@ title: Commit Checklist
     npm i
     npm run unit-tests
     npm audit
-    node_modules/jshint/bin/jshint src/
+    npm run lint
     npm run jsdoc
     open ./docs/jsdoc/index.html
     node ./compile.js
@@ -131,7 +131,7 @@ npm audit
 <p></p>
 
 <pre class="code">
-node_modules/jshint/bin/jshint src/
+npm run lint
 </pre>
 
 <p>

package/docs/quickstart.html

@@ -5,6 +5,7 @@ title: Quick Start
 
 Here's a small node.js application which displays all the target mappings in Campaign.
 
+<p class="info">The SDK requires <b>Node.js version 20</b> or above.</p>
 
 <p>Create a new node.js application</p>
 <pre class="code">
@@ -63,7 +64,7 @@ node index.js
 
 <p>It will display something like this</p>
 <pre class="code">
-ACC Javascript SDK version 1.1.9
+ACC Javascript SDK version 1.2.0
 Target mappings: {"deliveryMapping":[{"id":"1747","label":"Recipients","name":"mapRecipient","schema":"nms:recipient"},{"id":"1826","label":"Subscriptions","name":"mapSubscribe","schema":"nms:subscription"},{"id":"1827","label":"Operators","name":"mapOperator","schema":"xtk:operator"},{"id":"1828","label":"External file","name":"mapAny","schema":""},{"id":"1830","label":"Visitors","name":"mapVisitor","schema":"nms:visitor"},{"id":"2035","label":"Real time event","name":"mapRtEvent","schema":"nms:rtEvent"},{"id":"2036","label":"Batch event","name":"mapBatchEvent","schema":"nms:batchEvent"},{"id":"2070","label":"Subscriber applications","name":"mapAppSubscriptionRcp","schema":"nms:appSubscriptionRcp"}]}
 </pre>
 

package/docs/release.html

@@ -27,7 +27,7 @@ title: Releasing a new version
 npm i
 npm run unit-tests
 npm audit
-node_modules/jshint/bin/jshint src/
+npm run lint
 npm run jsdoc
 open ./docs/jsdoc/index.html
 node ./compile.js

package/openspec/config.yaml

@@ -0,0 +1,20 @@
+schema: spec-driven
+
+# Project context (optional)
+# This is shown to AI when creating artifacts.
+# Add your tech stack, conventions, style guides, domain knowledge, etc.
+# Example:
+#   context: |
+#     Tech stack: TypeScript, React, Node.js
+#     We use conventional commits
+#     Domain: e-commerce platform
+
+# Per-artifact rules (optional)
+# Add custom rules for specific artifacts.
+# Example:
+#   rules:
+#     proposal:
+#       - Keep proposals under 500 words
+#       - Always include a "Non-goals" section
+#     tasks:
+#       - Break tasks into chunks of max 2 hours