@nextcommerce/campaigns-os 1.37.3 → 1.43.1

package/skills.json

@@ -1,6 +1,7 @@
 {
   "name": "campaigns-os-skills",
-  "description": "Skills bundled with Campaigns OS. `skills.sh` installs these into the shared agent skill directories (~/.claude/skills, ~/.codex/skills), so each one is a versioned package: bump the version whenever a package changes.",
+  "description": "Skills bundled with Campaigns OS. `skills.sh` installs these into the shared agent skill directories (~/.claude/skills, ~/.codex/skills), so each one is a versioned package: bump the version whenever a package changes. `bundle_revision` identifies the bundle as a whole — `<package version>+skills.<n>`, where the prefix is this package's version and `<n>` counts the skill-text revisions published against it. It advances whenever ANY bundled skill changes, every SKILL.md states it on its first body line, and `campaigns-os tooling status --skills-revision <value>` compares the value an agent read from a skill against the bundle on disk. See docs/skills-revision.md.",
+  "bundle_revision": "1.43.1+skills.1",
   "homepage": "https://github.com/NextCommerceCo/campaigns-os",
   "retired_skills": [
     {
@@ -15,7 +16,7 @@
     {
       "id": "next-campaigns-os",
       "name": "Campaigns OS Lifecycle",
-      "version": "1.0.17",
+      "version": "1.0.27",
       "path": "skills/next-campaigns-os/SKILL.md",
       "domain": "campaigns",
       "description": "Coordinate Campaigns OS lifecycle workflows from CampaignSpec, Build Packet, starter-template contracts, stage reports, deploy evidence, and QA proof depth."
@@ -23,7 +24,7 @@
     {
       "id": "next-campaigns-os-setup",
       "name": "Campaigns OS Setup",
-      "version": "2.0.1",
+      "version": "2.0.10",
       "path": "skills/next-campaigns-os-setup/SKILL.md",
       "domain": "campaigns",
       "description": "Bootstrap or prepare a target page-kit campaign repo from a doctor-cleared Campaigns OS Build Packet before full build wiring. Formerly next-campaigns-setup; renamed to release that name to the published NextCommerceCo/skills scaffolder."
@@ -31,7 +32,7 @@
     {
       "id": "next-campaigns-build",
       "name": "Campaign Build",
-      "version": "1.0.3",
+      "version": "1.0.12",
       "path": "skills/next-campaigns-build/SKILL.md",
       "domain": "campaigns",
       "description": "Assemble a NEXT campaign from a doctor-cleared Build Packet, CampaignSpec/API values, prepared HTML/assets, page-kit, and starter-template contracts."
@@ -39,7 +40,7 @@
     {
       "id": "next-campaigns-polish",
       "name": "Campaign Polish",
-      "version": "1.1.2",
+      "version": "1.1.11",
       "path": "skills/next-campaigns-polish/SKILL.md",
       "domain": "campaigns",
       "description": "Run the visual/runtime polish pass after build and before QA for a Campaigns OS campaign."
@@ -47,10 +48,42 @@
     {
       "id": "next-campaigns-qa",
       "name": "Campaign QA",
-      "version": "1.3.2",
+      "version": "1.3.11",
       "path": "skills/next-campaigns-qa/SKILL.md",
       "domain": "campaigns",
-      "description": "Run spec-aware QA from a Campaign Map ID and tested campaign URL after build, polish, and deploy/local evidence exist, including Playwright typed-card test-order proof."
+      "description": "Run spec-aware QA from a saved Map or local-spec Build Packet and tested campaign URL after build, polish, and deploy/local evidence exist, including Playwright typed-card test-order proof."
+    },
+    {
+      "id": "campaign-lifecycle-orientation",
+      "name": "Campaign Lifecycle Orientation",
+      "version": "1.0.7",
+      "path": "skills/campaign-lifecycle-orientation/SKILL.md",
+      "domain": "campaigns",
+      "description": "Orient a reader to the Campaigns OS lifecycle artifacts a run has already emitted, without advancing their state: the shared vocabulary, doctor as a gate, the stage record, and the store-theme/Page Kit two-worlds trap."
+    },
+    {
+      "id": "campaign-run-evidence",
+      "name": "Campaign Run Evidence",
+      "version": "1.0.7",
+      "path": "skills/campaign-run-evidence/SKILL.md",
+      "domain": "campaigns",
+      "description": "Interpret existing doctor, QA verdict and proof-depth evidence without claiming more proof than the artifacts contain, and keep funnel proof apart from merchant launch readiness."
+    },
+    {
+      "id": "campaign-readback-classification",
+      "name": "Campaign Readback Classification",
+      "version": "1.0.7",
+      "path": "skills/campaign-readback-classification/SKILL.md",
+      "domain": "campaigns",
+      "description": "Classify a selected campaign from the campaigns-os-readback/v2 fields (artifacts, staleness.stale_keys, clean, doctor, divergences, skip_cascades) and write a read-only handoff without turning diagnosis into permission."
+    },
+    {
+      "id": "contribution-intake",
+      "name": "Contribution Intake",
+      "version": "1.0.7",
+      "path": "skills/contribution-intake/SKILL.md",
+      "domain": "campaigns",
+      "description": "Turn a suggestion about the agent surface into a classified, evidence-checked and redacted proposal, filed on this repository tracker only with attended approval."
     }
   ]
 }

package/src/admin-transport.mjs

@@ -0,0 +1,123 @@
+import { createCredentialStore } from './credential-store.mjs';
+import { GATEWAY, CLIENT_ID, RESOURCE, SCOPE, canonicalLoginStore, gatewayRequest, credentialFromResponse } from './login.mjs';
+
+const MAX_BYTES = 10 * 1048576; // custody consolidates at most ten bounded pages
+const MAX_ROWS = 2000;
+const REQUEST_MS = 15000, BUDGET_MS = 45000;
+const object = value => value !== null && typeof value === 'object' && !Array.isArray(value);
+const opaque = value => typeof value === 'string' && value.length > 0 && value.length <= 8192 && !/[\u0000-\u001f\u007f]/u.test(value);
+class ReadFailure extends Error {
+  constructor(status, detail) { super(detail); this.status = status; }
+}
+const storageUnavailable = () => new ReadFailure('credential_unavailable', 'Gateway credential storage is unavailable or busy. Check your user credential directory permissions and keychain access; wait for another campaigns-os process to finish. For an interrupted process, confirm no campaigns-os process is running before removing its stale .lock directory. No environment fallback was attempted.');
+const loginRequired = () => new ReadFailure('unauthorized', 'Gateway login is expired, revoked, or needs recovery. Run campaigns-os login --store <subdomain>.');
+const bindingFor = store => ({ gateway: GATEWAY, client_id: CLIENT_ID, store });
+function validate(record, binding) {
+  if (!record) throw new ReadFailure('credential_missing', 'No gateway login for this store. Run campaigns-os login --store <subdomain>.');
+  if (record.gateway !== binding.gateway || record.client_id !== binding.client_id || record.store !== binding.store || record.resource !== RESOURCE || record.scope !== SCOPE || record.schema_version !== 1 || record.token_type !== 'Bearer' || !opaque(record.access_token) || !opaque(record.refresh_token) || !opaque(record.grant_id) || !Number.isFinite(record.access_expires_at) || record.refresh_pending) throw loginRequired();
+  return record;
+}
+async function readJson(route, token, { fetchImpl, timeoutMs }) {
+  const controller = new AbortController(); let timer, reader;
+  const run = async () => {
+    const response = await fetchImpl(GATEWAY + route, { method: 'GET', headers: { Accept: 'application/json', Authorization: `Bearer ${token}` }, redirect: 'error', signal: controller.signal });
+    if (response.redirected || (response.url && response.url !== GATEWAY + route)) throw new ReadFailure('invalid', 'Gateway returned an unexpected redirect.');
+    if (response.status === 401) throw Object.assign(loginRequired(), { httpStatus: 401 });
+    if (response.status === 403) throw loginRequired();
+    if (response.status === 404) throw new ReadFailure('not_found', 'Gateway read route or store is unavailable.');
+    if (!response.ok) throw new ReadFailure('unreachable', 'Gateway read failed. No environment credential fallback was attempted.');
+    if (response.headers.get('content-type')?.split(';')[0] !== 'application/json') throw new ReadFailure('invalid', 'Gateway did not return a JSON profile.');
+    reader = response.body?.getReader(); if (!reader) throw new ReadFailure('invalid', 'Gateway returned an empty profile.');
+    const chunks = []; let size = 0;
+    for (;;) { const { value, done } = await reader.read(); if (done) break; size += value.byteLength; if (size > MAX_BYTES) throw new ReadFailure('invalid', 'Gateway response exceeded the read bound.'); chunks.push(value); }
+    let body; try { body = JSON.parse(Buffer.concat(chunks).toString('utf8')); } catch { throw new ReadFailure('invalid', 'Gateway response was not valid JSON.'); }
+    if (!object(body)) throw new ReadFailure('invalid', 'Gateway response was not the documented object.');
+    return body;
+  };
+  try {
+    if (timeoutMs <= 0) throw new ReadFailure('unreachable', 'Gateway read budget expired.');
+    return await Promise.race([run(), new Promise((_, reject) => { timer = setTimeout(() => { controller.abort(); reject(new ReadFailure('unreachable', 'Gateway read timed out.')); }, Math.min(REQUEST_MS, timeoutMs)); })]);
+  } catch (error) { throw error instanceof ReadFailure ? error : new ReadFailure('unreachable', 'Gateway is unreachable. No environment credential fallback was attempted.'); }
+  finally { clearTimeout(timer); controller.abort(); void reader?.cancel().catch(() => {}); }
+}
+
+// Caller owns the exclusive credential transaction. Logout uses this same
+// durable consumption boundary, including when interrupted before cleanup.
+export async function rotateLockedCredential(storage, current, { fetchImpl = globalThis.fetch, now = Date.now, timeoutMs = REQUEST_MS } = {}) {
+  if (current.refresh_pending) throw loginRequired();
+  storage.write({ ...current, refresh_pending: true });
+  try {
+    const started = now();
+    const data = await gatewayRequest('/token', { fetchImpl, timeoutMs, form: { grant_type: 'refresh_token', client_id: CLIENT_ID, resource: RESOURCE, refresh_token: current.refresh_token } });
+    if (data.expires_in === 0) throw new ReadFailure('unauthorized', 'Gateway grant has expired. Run campaigns-os login --store <subdomain>.');
+    if (data.grant_id !== current.grant_id) throw loginRequired();
+    const next = credentialFromResponse(data, current.store, started);
+    storage.write(next);
+    return next;
+  } catch (error) {
+    if (error instanceof ReadFailure) throw error;
+    const failure = loginRequired(); failure.httpStatus = error?.status; throw failure;
+  }
+}
+
+export async function readGatewayStoreProfile({ subdomain, credentials = createCredentialStore(), fetchImpl = globalThis.fetch, now = Date.now, budgetMs = BUDGET_MS, timeoutMs = REQUEST_MS } = {}) {
+  let binding;
+  try { binding = bindingFor(canonicalLoginStore(subdomain)); } catch { return { status: 'invalid', detail: 'Invalid store for gateway login.' }; }
+  const deadline = now() + Math.min(BUDGET_MS, budgetMs);
+  const remaining = () => Math.min(timeoutMs, deadline - now());
+  let record, refreshUsed = false;
+  const refresh = async loaded => {
+    if (refreshUsed) throw loginRequired();
+    refreshUsed = true;
+    const outcome = await credentials.transaction(binding, async storage => {
+      try {
+        const current = validate(storage.read(), binding);
+        if (current.refresh_token !== loaded.refresh_token || current.access_token !== loaded.access_token) return { record: current };
+        if (remaining() <= 0) throw new ReadFailure('unreachable', 'Gateway read budget expired before refresh.');
+        return { record: await rotateLockedCredential(storage, current, { fetchImpl, now, timeoutMs: remaining() }) };
+      } catch (error) { return { failure: error instanceof ReadFailure ? error : storageUnavailable() }; }
+    });
+    if (outcome.failure) throw outcome.failure;
+    return outcome.record;
+  };
+  const request = async route => {
+    if (record.access_expires_at <= now() + 60000) record = await refresh(record);
+    try { return await readJson(route, record.access_token, { fetchImpl, timeoutMs: remaining() }); }
+    catch (error) {
+      if (error.httpStatus !== 401) throw error;
+      record = await refresh(record);
+      return readJson(route, record.access_token, { fetchImpl, timeoutMs: remaining() });
+    }
+  };
+  try {
+    record = validate(await credentials.read(binding), binding);
+    const store = await request('/admin/store/');
+    // A projected sparse store is legitimate: pure derivation explains every
+    // missing field. Do not invent required profile fields here.
+    try {
+      const body = await request('/admin/pages/');
+      if (!Array.isArray(body.results) || body.results.length > MAX_ROWS || Object.hasOwn(body, 'next') || body.results.some(row => !object(row) || (row.slug != null && typeof row.slug !== 'string') || (row.title != null && typeof row.title !== 'string'))) throw new ReadFailure('invalid', 'Gateway returned an invalid consolidated page list.');
+      return { status: 'ok', store, pages: body.results.filter(row => typeof row.slug === 'string' && row.slug.trim()).map(({ slug, title }) => ({ slug, title: typeof title === 'string' ? title : '' })), pages_status: 'ok', pages_detail: null };
+    } catch (error) {
+      return { status: 'ok', store, pages: null, pages_status: 'unavailable', pages_detail: error instanceof ReadFailure ? error.message : storageUnavailable().message };
+    }
+  } catch (error) {
+    const failure = error instanceof ReadFailure ? error : storageUnavailable();
+    return { status: failure.status, detail: failure.message };
+  }
+}
+
+export async function gatewayLoginStatus({ credentials = createCredentialStore(), now = Date.now } = {}) {
+  try {
+    const bindings = await credentials.listBindings();
+    const accounts = [];
+    for (const binding of bindings) {
+      if (binding.gateway !== GATEWAY || binding.client_id !== CLIENT_ID) continue;
+      const record = await credentials.read(binding);
+      try { validate(record, binding); }
+      catch { accounts.push({ store: canonicalLoginStore(binding.store), state: 'login_required', access_expires_at: null, remaining_seconds: 0, gateway_version: null }); continue; }
+      accounts.push({ store: binding.store, state: record.access_expires_at > now() ? 'logged_in' : 'access_expired', access_expires_at: record.access_expires_at, remaining_seconds: Math.max(0, Math.floor((record.access_expires_at - now()) / 1000)), gateway_version: typeof record.gateway_version === 'string' && /^[a-zA-Z0-9][a-zA-Z0-9._+-]{0,127}$/.test(record.gateway_version) && ![record.access_token, record.refresh_token].some(token => record.gateway_version.includes(token)) ? record.gateway_version : null });
+    }
+    return { gateway: GATEWAY, checked: 'local_only', state: accounts.length ? 'available' : 'logged_out', accounts };
+  } catch { return { gateway: GATEWAY, checked: 'local_only', state: 'unavailable', accounts: [] }; }
+}