@drip-apex/sdk 0.1.0 → 0.3.0

package/src/targeting.test.ts

@@ -82,6 +82,33 @@ describe("targeting", () => {
     expect(matchesTargeting(undefined, { url: "https://shop.test/p", attributes: {} })).toBe(true);
   });
 
+  it("never matches the invalid stored-targeting sentinel", () => {
+    const targeting: Targeting = {
+      attributes: [
+        {
+          attribute: "apex.internal.invalid_stored_targeting",
+          operator: "equals",
+          value: "experiment:exp_unsafe",
+        },
+      ],
+    };
+
+    expect(
+      matchesTargeting(targeting, {
+        url: "https://shop.test/products/shirt",
+        attributes: {},
+      }),
+    ).toBe(false);
+    expect(
+      matchesTargeting(targeting, {
+        url: "https://shop.test/products/shirt",
+        attributes: {
+          "apex.internal.invalid_stored_targeting": "experiment:exp_unsafe",
+        },
+      }),
+    ).toBe(false);
+  });
+
   it("evaluates Page rules before Audience rules and skips Audience on page mismatch", () => {
     const targeting: Targeting = {
       pageRules: [
@@ -208,6 +235,102 @@ describe("targeting", () => {
     ).toBe(true);
   });
 
+  it("scopes host-agnostic include rules to every configured public storefront origin", () => {
+    const targeting: Targeting = {
+      url: [{ type: "simple", pattern: "/products/*", include: true }],
+    };
+
+    expect(
+      matchesTargeting(targeting, {
+        url: "https://shop.test/products/source",
+        attributes: {},
+        hostAgnosticIncludeOrigin: [
+          "https://shop.test",
+          "https://de.shop.test",
+        ],
+      }),
+    ).toBe(true);
+    expect(
+      matchesTargeting(targeting, {
+        url: "https://de.shop.test/products/source",
+        attributes: {},
+        hostAgnosticIncludeOrigin: [
+          "https://shop.test",
+          "https://de.shop.test",
+        ],
+      }),
+    ).toBe(true);
+    expect(
+      matchesTargeting(targeting, {
+        url: "https://landing.test/products/destination",
+        attributes: {},
+        hostAgnosticIncludeOrigin: [
+          "https://shop.test",
+          "https://de.shop.test",
+        ],
+      }),
+    ).toBe(false);
+  });
+
+  it("keeps explicit-host include rules independent from the storefront origin", () => {
+    const targeting: Targeting = {
+      url: [
+        {
+          type: "simple",
+          pattern: "landing.test/products/*",
+          include: true,
+        },
+      ],
+    };
+
+    expect(
+      matchesTargeting(targeting, {
+        url: "https://landing.test/products/destination",
+        attributes: {},
+        hostAgnosticIncludeOrigin: "https://shop.test",
+      }),
+    ).toBe(true);
+  });
+
+  it("keeps regex-prefixed absolute include rules independent from the storefront origin", () => {
+    for (const pattern of [
+      "^https?:\\/\\/other\\.test/products/.*$",
+      "^(https?://other\\.test/products/.*)$",
+    ]) {
+      const targeting: Targeting = {
+        url: [{ type: "regex", pattern, include: true }],
+      };
+
+      expect(
+        matchesTargeting(targeting, {
+          url: "https://other.test/products/destination",
+          attributes: {},
+          hostAgnosticIncludeOrigin: "https://shop.test",
+        }),
+      ).toBe(true);
+    }
+  });
+
+  it("does not treat an embedded query-parameter URL as an explicit host", () => {
+    const targeting: Targeting = {
+      url: [
+        {
+          type: "simple",
+          pattern: "/products?return=https://example.com",
+          include: true,
+        },
+      ],
+    };
+
+    expect(
+      matchesTargeting(targeting, {
+        url: "https://other.test/products?return=https://example.com",
+        attributes: {},
+        hostAgnosticIncludeOrigin: "https://shop.test",
+      }),
+    ).toBe(false);
+  });
+
   it("normalizes legacy url_contains rules at runtime", () => {
     const targeting = {
       url: "https://www.abtestinglibrary.com/products/book",
@@ -424,6 +547,30 @@ describe("targeting", () => {
     ).toBe(false);
   });
 
+  it("matches not_in operator when value is outside the array", () => {
+    const targeting: Targeting = {
+      attributes: [
+        {
+          attribute: "device.type",
+          operator: "not_in",
+          value: ["desktop"],
+        },
+      ],
+    };
+    expect(
+      matchesTargeting(targeting, {
+        url: "https://shop.test/",
+        attributes: { "device.type": "mobile" },
+      }),
+    ).toBe(true);
+    expect(
+      matchesTargeting(targeting, {
+        url: "https://shop.test/",
+        attributes: { "device.type": "desktop" },
+      }),
+    ).toBe(false);
+  });
+
   it("rejects contains when value is not string", () => {
     const targeting: Targeting = {
       attributes: [{ attribute: "count", operator: "contains", value: "3" }],
@@ -586,6 +733,70 @@ describe("targeting", () => {
     );
   });
 
+  it("normalizes valid device overrides and falls back from empty or invalid overrides", () => {
+    setRuntimeEnv({
+      platform: "iPhone",
+      userAgent:
+        "Mozilla/5.0 (iPhone; CPU iPhone OS 17_2 like Mac OS X) AppleWebKit/605.1.15 Mobile/15E148 Safari/604.1",
+      width: 1440,
+    });
+    expect(
+      buildTargetingAttributes({ device: "" }, undefined, { persistSignals: false })["device.type"],
+    ).toBe("mobile");
+    expect(
+      buildTargetingAttributes({ device: "Desktop" }, undefined, { persistSignals: false })["device.type"],
+    ).toBe("desktop");
+    expect(
+      buildTargetingAttributes({ "device.type": " Tablet " }, undefined, { persistSignals: false })["device.type"],
+    ).toBe("tablet");
+
+    setRuntimeEnv({
+      platform: "Win32",
+      userAgent:
+        "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36",
+      width: 390,
+    });
+    expect(
+      buildTargetingAttributes({ device: "television" }, undefined, { persistSignals: false })["device.type"],
+    ).toBe("desktop");
+  });
+
+  it.each([
+    [
+      "desktop",
+      "Win32",
+      "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36",
+    ],
+    [
+      "mobile",
+      "iPhone",
+      "Mozilla/5.0 (iPhone; CPU iPhone OS 17_2 like Mac OS X) AppleWebKit/605.1.15 Mobile/15E148 Safari/604.1",
+    ],
+    [
+      "tablet",
+      "Linux armv8l",
+      "Mozilla/5.0 (Linux; Android 13; Pixel C) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36",
+    ],
+  ])("matches only the %s device audience for its detected user agent", (token, platform, userAgent) => {
+    setRuntimeEnv({ platform, userAgent, width: 1280 });
+    const attributes = buildTargetingAttributes({}, undefined, { persistSignals: false });
+    const targetingFor = (value: string): Targeting => ({
+      segmentRules: [{
+        id: `device-${value}`,
+        rules: {
+          version: 1,
+          operator: "and",
+          conditions: [{ signal: "device.type", operator: "equals", value }],
+        },
+      }],
+    });
+
+    expect(attributes["device.type"]).toBe(token);
+    expect(matchesTargeting(targetingFor(token), { url: "https://shop.test/", attributes })).toBe(true);
+    const mismatchedToken = token === "desktop" ? "mobile" : "desktop";
+    expect(matchesTargeting(targetingFor(mismatchedToken), { url: "https://shop.test/", attributes })).toBe(false);
+  });
+
   it("classifies Android client-hints with mobile=false as tablet, not desktop", () => {
     setRuntimeEnv({
       platform: "",

package/src/targeting.ts

@@ -10,142 +10,47 @@ import {
   UrlRule,
 } from "./types";
 import { createApexRuntimeTools } from "./runtime-tools";
-import { safeRegexTest } from "./safe-regex";
+import { evaluateUrlRule, matchSegmentConditionValues as matchCoreSegmentConditionValues, normalizeUrlRules, urlRuleExplicitlyNamesHost } from "@drip/event-schema/targeting-core";
 import { getSignals, rememberProduct } from "./signals";
 import { evaluateTargetingGatesWithConditionDiagnostics } from "./targeting-diagnostics";
 
 declare const __DRIP_QA_BUILD__: boolean;
 
-function evalSimpleUrlPart(actual: string, pattern: string, isPath: boolean): boolean {
-  try {
-    let escaped = pattern
-      .replace(/[*.+?^${}()|[\]\\]/g, "\\$&")
-      .replace(/_____/g, ".*");
-    if (isPath) {
-      escaped = "\\/?" + escaped.replace(/(^\/|\/$)/g, "") + "\\/?";
-    }
-    const regex = new RegExp("^" + escaped + "$", "i");
-    return regex.test(actual);
-  } catch {
-    return false;
-  }
-}
-
-function evalSimpleUrlTarget(actual: URL, pattern: string): boolean {
-  try {
-    const expected = new URL(
-      pattern.replace(/^([^:/?]*)\./i, "https://$1.").replace(/\*/g, "_____"),
-      "https://_____",
-    );
-    const comps: Array<[string, string, boolean]> = [
-      [actual.host, expected.host, false],
-      [actual.pathname, expected.pathname, true],
-    ];
-    if (expected.hash) comps.push([actual.hash, expected.hash, false]);
-    expected.searchParams.forEach((v, k) => {
-      comps.push([actual.searchParams.get(k) || "", v, false]);
-    });
-    return !comps.some((data) => !evalSimpleUrlPart(data[0], data[1], data[2]));
-  } catch {
-    return false;
-  }
-}
+const FAIL_CLOSED_TARGETING_ATTRIBUTE =
+  "apex.internal.invalid_stored_targeting";
 
-function unescapeRegexLiteral(value: string): string {
-  return value.replace(/\\([.*+?^${}()|[\]\\\/])/g, "$1");
-}
+export const evalUrlRule = evaluateUrlRule;
 
-export function evalUrlRule(url: string, rule: UrlRule): boolean {
-  try {
-    const parsed = new URL(url, "https://_");
-    const matchType = rule.matchType ?? rule.match_type;
-    if (matchType === "contains") {
-      const actual = parsed.href.toLowerCase();
-      const pattern = rule.pattern.toLowerCase();
-      return actual.includes(pattern) || actual.includes(unescapeRegexLiteral(pattern));
-    }
-    if (rule.type === "regex") {
-      const escaped = rule.pattern.replace(/([^\\])\//g, "$1\\/");
-      return safeRegexTest(escaped, parsed.href) || safeRegexTest(escaped, parsed.href.substring(parsed.origin.length));
-    }
-    return evalSimpleUrlTarget(parsed, rule.pattern);
-  } catch {
-    return false;
-  }
+export function normalizeRuntimeUrlRules(targeting: Targeting | undefined): UrlRule[] {
+  return normalizeUrlRules(targeting) as UrlRule[];
 }
 
-function normalizeRuntimeUrlRule(value: unknown): UrlRule | null {
-  if (typeof value === "string") {
-    const pattern = value.trim();
-    return pattern ? { type: "simple", pattern, include: true } : null;
+function normalizedHttpOrigins(value: string | string[] | undefined): Set<string> {
+  const origins = new Set<string>();
+  for (const candidate of Array.isArray(value) ? value : value ? [value] : []) {
+    try { const parsed = new URL(candidate); if (/^https?:$/.test(parsed.protocol)) origins.add(parsed.origin); } catch {}
   }
-  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
-
-  const raw = value as Record<string, unknown>;
-  const rawPattern = raw.pattern ?? raw.value ?? raw.url ?? raw.path;
-  const pattern = typeof rawPattern === "string" ? rawPattern.trim() : "";
-  if (!pattern) return null;
-
-  const include = typeof raw.include === "boolean" ? raw.include : true;
-  const matchType =
-    raw.matchType === "exact" ||
-    raw.matchType === "contains" ||
-    raw.matchType === "wildcard" ||
-    raw.matchType === "regex"
-      ? raw.matchType
-      : raw.match_type === "exact" ||
-          raw.match_type === "contains" ||
-          raw.match_type === "wildcard" ||
-          raw.match_type === "regex"
-        ? raw.match_type
-        : raw.type === "url_contains"
-          ? "contains"
-          : undefined;
-
-  if (raw.type === "url_contains") {
-    return { type: "simple", pattern, include, matchType: "contains" };
-  }
-  return {
-    type: raw.type === "regex" || raw.type === "url_regex" ? "regex" : "simple",
-    pattern,
-    include,
-    ...(matchType ? { matchType } : {}),
-  };
-}
-
-export function normalizeRuntimeUrlRules(targeting: Targeting | undefined): UrlRule[] {
-  const raw = targeting as unknown as Record<string, unknown> | undefined;
-  if (!raw || typeof raw !== "object") return [];
-
-  const urlSource = Array.isArray(raw.url)
-    ? raw.url
-    : raw.url === undefined || raw.url === null
-      ? []
-      : [raw.url];
-  const legacyRules = Array.isArray(raw.rules) ? raw.rules : [];
-
-  return urlSource
-    .concat(legacyRules)
-    .map(normalizeRuntimeUrlRule)
-    .filter((rule): rule is UrlRule => Boolean(rule));
+  return origins;
 }
 
-export function matchUrlRules(url: string, rules: UrlRule[]): boolean {
+export function matchUrlRules(url: string, rules: UrlRule[], hostAgnosticIncludeOrigin?: string | string[]): boolean {
   if (!rules.length) return true;
-  let hasInclude = false;
-  let included = false;
+  let hasInclude = false; let included = false;
   for (const rule of rules) {
-    const match = evalUrlRule(url, rule);
-    if (rule.include === false) {
-      if (match) return false;
-    } else {
-      hasInclude = true;
-      if (match) included = true;
-    }
+    const match = evalUrlRuleForIncludeOrigin(url, rule, hostAgnosticIncludeOrigin);
+    if (rule.include === false) { if (match) return false; }
+    else { hasInclude = true; if (match) included = true; }
   }
   return included || !hasInclude;
 }
 
+export function evalUrlRuleForIncludeOrigin(url: string, rule: UrlRule, origins?: string | string[]): boolean {
+  const allowed = normalizedHttpOrigins(origins);
+  let origin = "";
+  try { origin = new URL(url, "https://_").origin; } catch {}
+  return (rule.include === false || !allowed.size || urlRuleExplicitlyNamesHost(rule) || allowed.has(origin)) && evaluateUrlRule(url, rule);
+}
+
 function errorMessage(error: unknown): string {
   return error instanceof Error ? error.message : String(error);
 }
@@ -216,6 +121,10 @@ export function pageManualTriggerMatches(
   rule: PageTargetingRule,
   ctx: { attributes: Record<string, unknown> },
 ): boolean {
+  // Shop defaults map to page overrides as follows: direct -> immediate,
+  // url_change -> history/polling, dom_change -> dom, manual -> manual-*.
+  // Non-manual modes choose when this rule is checked; they are not an
+  // additional targeting condition.
   const mode = rule.trigger?.mode;
   if (mode !== "manual-callback" && mode !== "manual-api") return true;
   const signal = rule.trigger?.signal;
@@ -223,7 +132,7 @@ export function pageManualTriggerMatches(
   return ctx.attributes[signal] === true;
 }
 
-function matchPageTargetingRule(
+export function matchPageTargetingRule(
   rule: PageTargetingRule,
   ctx: { url: string; attributes: Record<string, unknown> },
 ): boolean {
@@ -234,6 +143,17 @@ function matchPageTargetingRule(
   return urlMatched && pageManualTriggerMatches(rule, ctx) && evaluatePageAdvancedCondition(rule, ctx);
 }
 
+export function matchedPageRuleIds(
+  rules: PageTargetingRule[],
+  ctx: { url: string; attributes: Record<string, unknown> },
+): Set<string> {
+  const ids = new Set<string>();
+  for (const rule of rules) {
+    if (rule.id && matchPageTargetingRule(rule, ctx)) ids.add(rule.id);
+  }
+  return ids;
+}
+
 function matchPageRules(
   rules: PageTargetingRule[],
   ctx: { url: string; attributes: Record<string, unknown> },
@@ -259,6 +179,7 @@ export function matchAttributeRule(
   attrs: Record<string, unknown>,
   rule: AttributeRule,
 ): boolean {
+  if (rule.attribute === FAIL_CLOSED_TARGETING_ATTRIBUTE) return false;
   const value = attrs[rule.attribute];
   switch (rule.operator) {
     case "exists":
@@ -271,6 +192,8 @@ export function matchAttributeRule(
         : false;
     case "in":
       return Array.isArray(rule.value) ? rule.value.includes(String(value)) : false;
+    case "not_in":
+      return Array.isArray(rule.value) ? !rule.value.includes(String(value)) : false;
     default:
       return false;
   }
@@ -377,6 +300,14 @@ function getDeviceType(): string {
   return "desktop";
 }
 
+const DEVICE_TYPE_TOKENS = new Set(["desktop", "mobile", "tablet"]);
+
+function normalizeDeviceType(value: unknown): string | undefined {
+  if (typeof value !== "string") return undefined;
+  const normalized = value.trim().toLowerCase();
+  return DEVICE_TYPE_TOKENS.has(normalized) ? normalized : undefined;
+}
+
 function browserInfoFromBrands(brands: unknown): BrowserInfo {
   if (!Array.isArray(brands)) return EMPTY_BROWSER_INFO;
 
@@ -559,7 +490,7 @@ function normalizeTrafficSource(utmSource: unknown, referrer: unknown): string {
   return "direct";
 }
 
-function readShopifySignal(signal: string): unknown {
+export function readShopifySignal(signal: string): unknown {
   if (typeof window === "undefined") return undefined;
   const root = (window as any).ShopifyAnalytics?.meta ?? (window as any).Shopify?.analytics?.meta;
   if (!root || typeof root !== "object") return undefined;
@@ -599,7 +530,8 @@ export function buildTargetingAttributes(
   attrs["utm.medium"] ??= baseAttributes.utm_medium ?? getPersistedUtmValue("utm_medium");
   attrs["utm.campaign"] ??= baseAttributes.utm_campaign ?? getPersistedUtmValue("utm_campaign");
   attrs.referrer ??= normalizeReferrer();
-  attrs["device.type"] ??= baseAttributes.device ?? getDeviceType();
+  const deviceTypeOverride = attrs["device.type"] ?? baseAttributes.device;
+  attrs["device.type"] = normalizeDeviceType(deviceTypeOverride) ?? normalizeDeviceType(getDeviceType()) ?? "";
   const browser = getBrowserInfo();
   attrs["device.browser"] ??= browser.name;
   attrs["device.browser.version"] ??= browser.version;
@@ -791,31 +723,6 @@ export function evaluateJsTriggerResult(
   }
 }
 
-function stringValues(value: unknown): string[] {
-  if (Array.isArray(value)) {
-    return value
-      .map((item) => String(item).trim())
-      .filter(Boolean);
-  }
-  if (value === undefined || value === null) return [];
-  return [String(value)];
-}
-
-function hasMeaningfulValue(value: unknown): boolean {
-  if (value === undefined || value === null) return false;
-  if (Array.isArray(value)) return value.length > 0;
-  if (typeof value === "string") return value.trim().length > 0;
-  return true;
-}
-
-function compareNumber(actual: unknown, expected: unknown, predicate: (a: number, b: number) => boolean): boolean {
-  const actualNumber = Number(Array.isArray(actual) ? actual[0] : actual);
-  const expectedNumber = Number(Array.isArray(expected) ? expected[0] : expected);
-  return Number.isFinite(actualNumber) &&
-    Number.isFinite(expectedNumber) &&
-    predicate(actualNumber, expectedNumber);
-}
-
 function matchSegmentCondition(
   condition: SegmentCondition,
   ctx: { url: string; attributes: Record<string, unknown> },
@@ -826,58 +733,9 @@ function matchSegmentCondition(
 }
 
 export function matchSegmentConditionValues(
-  condition: SegmentCondition,
-  actual: unknown,
-  expected: SegmentCondition["value"],
+  condition: SegmentCondition, actual: unknown, expected: SegmentCondition["value"],
 ): boolean {
-  const actualValues = stringValues(actual);
-  const expectedValues = stringValues(expected);
-  const firstExpected = expectedValues[0] ?? "";
-
-  switch (condition.operator) {
-    case "equals":
-      return actualValues.some((value) => value === String(expected ?? ""));
-    case "not_equals":
-      return !actualValues.some((value) => value === String(expected ?? ""));
-    case "contains":
-      return actualValues.some((value) =>
-        expectedValues.length > 1
-          ? expectedValues.includes(value)
-          : value.includes(firstExpected),
-      );
-    case "not_contains":
-      return !actualValues.some((value) =>
-        expectedValues.length > 1
-          ? expectedValues.includes(value)
-          : value.includes(firstExpected),
-      );
-    case "starts_with":
-      return actualValues.some((value) => value.startsWith(firstExpected));
-    case "ends_with":
-      return actualValues.some((value) => value.endsWith(firstExpected));
-    case "is_set":
-      return hasMeaningfulValue(actual);
-    case "is_empty":
-      return !hasMeaningfulValue(actual);
-    case "in":
-      return actualValues.some((value) => expectedValues.includes(value));
-    case "not_in":
-      return !actualValues.some((value) => expectedValues.includes(value));
-    case "matches_wildcard":
-      return actualValues.some((value) => safeRegexTest(wildcardToRegex(firstExpected), value));
-    case "matches_regex":
-      return actualValues.some((value) => safeRegexTest(firstExpected, value));
-    case "greater_than":
-      return compareNumber(actual, expected, (a, b) => a > b);
-    case "greater_than_or_equal":
-      return compareNumber(actual, expected, (a, b) => a >= b);
-    case "less_than":
-      return compareNumber(actual, expected, (a, b) => a < b);
-    case "less_than_or_equal":
-      return compareNumber(actual, expected, (a, b) => a <= b);
-    default:
-      return false;
-  }
+  return matchCoreSegmentConditionValues(condition, actual, expected);
 }
 
 function matchSegmentRule(
@@ -924,16 +782,23 @@ function matchSegmentRules(
 
 export function matchesTargeting(
   targeting: Targeting | undefined,
-  ctx: { url: string; attributes: Record<string, unknown> },
+  ctx: {
+    url: string;
+    attributes: Record<string, unknown>;
+    hostAgnosticIncludeOrigin?: string | string[];
+  },
 ): boolean {
   return evaluateTargetingGates(targeting, ctx).matched;
 }
 
 export function targetingHasJsTriggers(experiments: Experiment[]): boolean {
   return experiments.some((experiment) =>
-    (experiment.targeting?.pageRules ?? []).some((rule) =>
-      Boolean(rule.advancedCondition?.code?.trim()) ||
-        Boolean(rule.trigger?.triggerJs?.trim()),
+    [
+      ...(experiment.targeting?.pageRules ?? []),
+      ...(experiment.goalPageRules ?? []),
+    ].some((rule) =>
+      Boolean(rule.trigger?.triggerJs?.trim()) ||
+      Boolean(rule.advancedCondition?.code?.trim()),
     ) ||
       (experiment.targeting?.segmentRules ?? []).some((rule) =>
         (rule.rules?.conditions ?? []).some((condition) =>
@@ -945,7 +810,11 @@ export function targetingHasJsTriggers(experiments: Experiment[]): boolean {
 
 export function evaluateTargetingGatesDetailed(
   targeting: Targeting | undefined,
-  ctx: { url: string; attributes: Record<string, unknown> },
+  ctx: {
+    url: string;
+    attributes: Record<string, unknown>;
+    hostAgnosticIncludeOrigin?: string | string[];
+  },
 ): TargetingDiagnostics {
   if (!__DRIP_QA_BUILD__) {
     const aggregate = evaluateTargetingGates(targeting, ctx);
@@ -956,7 +825,11 @@ export function evaluateTargetingGatesDetailed(
 
 export function evaluateTargetingGates(
   targeting: Targeting | undefined,
-  ctx: { url: string; attributes: Record<string, unknown> },
+  ctx: {
+    url: string;
+    attributes: Record<string, unknown>;
+    hostAgnosticIncludeOrigin?: string | string[];
+  },
 ): { matched: boolean; gates: ActivationGateDiagnostic[] } {
   const gates: ActivationGateDiagnostic[] = [];
   if (!targeting) {
@@ -973,7 +846,11 @@ export function evaluateTargetingGates(
   const pageRules = targeting.pageRules ?? [];
   const pageHasRules = urlRules.length > 0 || pageRules.length > 0;
   const pageMatched = pageHasRules
-    ? matchUrlRules(ctx.url, urlRules) && matchPageRules(pageRules, ctx)
+    ? matchUrlRules(
+        ctx.url,
+        urlRules,
+        ctx.hostAgnosticIncludeOrigin,
+      ) && matchPageRules(pageRules, ctx)
     : true;
   gates.push({
     id: "page",
@@ -1004,15 +881,19 @@ export function evaluateTargetingGates(
   }
 
   const segmentRules = targeting.segmentRules ?? [];
-  const segmentRulesMatched = matchSegmentRules(segmentRules, ctx);
-  const audienceHasRules = attributeRules.length > 0 || segmentRules.length > 0;
+  const segmentRefs = targeting.segments ?? [];
+  const segmentsExpanded = segmentRefs.every((ref) =>
+    segmentRules.some((rule) => rule.id === ref.id)
+  );
+  const segmentRulesMatched = segmentsExpanded && matchSegmentRules(segmentRules, ctx);
+  const audienceHasRules = attributeRules.length > 0 || segmentRules.length > 0 || segmentRefs.length > 0;
   const audienceMatched = attributesMatched && segmentRulesMatched;
   gates.push({
     id: "audience",
     label: "Audience check",
     status: audienceHasRules ? (audienceMatched ? "passed" : "failed") : "skipped",
     reason: audienceHasRules
-      ? (audienceMatched ? "audience_matched" : !attributesMatched ? "attribute_mismatch" : "segment_mismatch")
+      ? (audienceMatched ? "audience_matched" : !segmentsExpanded ? "segments_unexpanded" : !attributesMatched ? "attribute_mismatch" : "segment_mismatch")
       : "no_audience_rules",
     detail: audienceHasRules ? { attributeRules: attributeRules.length, segmentRules: segmentRules.length } : undefined,
   });