@nextcommerce/campaigns-os 1.43.1 → 1.43.2

package/src/install-invocation.mjs

@@ -0,0 +1,29 @@
+// How this install spells the commands it prints. ROOT resolves `..` from this
+// file, so the module must stay directly under src/ to name the package root.
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { invocationPrefixFor } from "./install-mode.mjs";
+
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+
+// Every command this CLI PRODUCES for an operator or agent to copy is spelled
+// once, here, for the install it runs from (see install-mode.mjs): bare
+// `campaigns-os` from a checkout, `npx --no-install campaigns-os` from a
+// campaign folder that pins the toolkit, `npx --yes <spec>` from an npx cache.
+// Result payloads are never rewritten after the fact — a path, a quoted
+// argument or a data value that happens to contain the words is left exactly
+// as it is.
+function cmd(verb, rest = "") {
+  const prefix = invocationPrefixFor(ROOT);
+  return `${prefix} ${verb}${rest ? ` ${rest}` : ""}`;
+}
+
+// A registry command (gate actions, checkpoint remediations) is stored in its
+// canonical bare form so internal bookkeeping can match on it; this spells
+// it for the current install at the moment it is emitted.
+function asInvocation(command) {
+  if (typeof command !== "string" || !command.startsWith("campaigns-os ")) return command;
+  return `${invocationPrefixFor(ROOT)} ${command.slice("campaigns-os ".length)}`;
+}
+
+export { ROOT, cmd, asInvocation };

package/src/invocation.mjs

@@ -0,0 +1,179 @@
+// Invocation policy: which cross-cutting steps run around a command, and in
+// what order. One owner for rules that used to be restated at each step — the
+// pre-dispatch bypasses, the stale-session sweep and its root, the ambient
+// run-session read, the lifecycle wrapper, the journal exemptions, the
+// commands that implement --dry-run, and the QA auto-end trigger.
+//
+// The declaration below is data: a class, a sweep root kind and a few flags
+// per command, and per subcommand only where the subcommand differs from its
+// command. It describes kernel behaviour and is never a permission
+// interpreter: contracts/effects.v1.json is bound to it by a test, never read
+// here. The steps themselves (the sweep, the ambient read, the journal append,
+// the auto-end, every handler) stay in cli.mjs and are handed to
+// runInvocation() as functions; this module decides only whether and when each
+// runs. It imports nothing from cli.mjs.
+
+import { runWithRefusalScope, withCommandLifecycle } from "./lifecycle.mjs";
+
+// Frozen all the way down, so a caller handed a subcommand list cannot edit it.
+const frozen = (value) => { if (value && typeof value === "object") Object.values(value).forEach(frozen); return Object.freeze(value); };
+
+// The steps each pre-dispatch class runs. `auth` and `inline` commands run
+// their handler in place: no sweep, no ambient read, no wrapper, no journal.
+// `inspection` still resolves the ambient session and is wrapped, but never
+// sweeps or journals. `projection` (`readback`) is wrapped only: its --packet
+// is an override naming the Build Packet to project, not a session locator.
+// Read as one, the named file was loaded whole past readback's own size bound,
+// and a valid override exited 1 whenever some active session was bound to a
+// different packet; neither belongs to a command declared read-only.
+const CLASS_STEPS = frozen({
+  auth: [], inline: [],
+  inspection: ["wrapper", "ambient"],
+  projection: ["wrapper"],
+  standard: ["wrapper", "ambient", "sweep", "journal"],
+});
+
+// Every top-level command, in the order did-you-mean breaks ties. Fields:
+// `class` (default "standard"); `sweepRoot` ("target": the --target directory,
+// "session": the run-session root; default none); `dryRun` (the command
+// implements --dry-run); `journalExempt`; `journalExemptWhen` (exempt when the
+// `given` flag is set and the `unlessBare` flag is not bare: an inspection must
+// not append to a delivered campaign's active run);
+// `subcommands` (the only subcommand names that resolve; others inherit the
+// command's entry and are refused by the handler).
+//
+// `dryRun` marks only the commands that IMPLEMENT the flag. It reaches every
+// handler through a permissive parseArgs, and an exemption scoped to the flag
+// alone once fired on commands that ignore it: `qa run --dry-run` placed orders
+// while writing no journal entry, and carried the flag into its own auto-end,
+// which assembled no Run Record and left the session open. A command without
+// `dryRun` given --dry-run journals if it otherwise would, and is not refused.
+const COMMANDS = frozen({
+  help: { journalExempt: true },
+  login: { class: "auth" },
+  logout: { class: "auth" },
+  demo: { class: "inline" },
+  tooling: { subcommands: ["diagnose", "setup", "status"] },
+  sdk: { subcommands: ["storage-check"] },
+  readback: { class: "projection" },
+  start: { sweepRoot: "target" },
+  "prepare-build": { sweepRoot: "target" },
+  build: { sweepRoot: "target" },
+  doctor: { journalExemptWhen: { given: "packet", unlessBare: "write" } },
+  bundle: { subcommands: ["check"] },
+  standardize: {},
+  theme: { subcommands: ["generate", "inspect", "waive"] },
+  checkpoint: { subcommands: ["waive"] },
+  polish: { subcommands: ["capture"] },
+  "validate-assembly-report": {},
+  "install-agent-context": { dryRun: true },
+  "install-skills": { dryRun: true },
+  "page-kit": { subcommands: ["parity", "sync"] },
+  spec: { subcommands: ["derive"] },
+  next: { subcommands: ["build", "deploy", "polish", "qa", "setup"] },
+  qa: { subcommands: ["install-browser", "parity", "policy", "promote", "publish", "resolve", "run", "waive"] },
+  findings: { subcommands: ["add", "export", "harvest", "list"] },
+  "run-record": { dryRun: true },
+  telemetry: { subcommands: ["list", "off", "on", "status"] },
+  run: { subcommands: ["end", "start", "status"] },
+});
+
+// Where a subcommand's policy differs from its command's entry. Matched on the
+// explicit subcommand token only: bare `run` defaults to `status` inside its
+// handler, but is not `run status` here, so it journals.
+const SUBCOMMAND_OVERRIDES = frozen({
+  "tooling diagnose": { class: "inline" },
+  "tooling setup": { class: "inline" },
+  "sdk storage-check": { class: "inspection" },
+  "theme waive": { dryRun: true },
+  "checkpoint waive": { dryRun: true },
+  "page-kit sync": { dryRun: true },
+  "spec derive": { dryRun: true },
+  "qa publish": { dryRun: true },
+  "qa run": { autoEnd: true },
+  "run start": { sweepRoot: "session" },
+  "run end": { sweepRoot: "session", dryRun: true },
+  "run status": { journalExempt: true },
+});
+
+export const commandNames = () => Object.keys(COMMANDS);
+
+export const subcommandNames = (command) => (Object.hasOwn(COMMANDS, command) && COMMANDS[command].subcommands) || frozen([]);
+
+// A run opted out of sessions altogether: no stale sweep, and no intake
+// auto-start (which reads this predicate from here).
+export const optsOutOfRunSession = (args) => args["no-run-session"] === true;
+
+// The policy for one invocation. Two --dry-run predicates are deliberate and
+// differ: on a command implementing the flag, its PRESENCE suppresses the
+// sweep (a valued flag the handler will refuse still does nothing first), while
+// only a bare `--dry-run` exempts the journal (the install commands accept a
+// valued flag as a dry run and still journal it). The sweep writes a Run
+// Record, deletes the session file and (under consent) remits — every effect
+// --dry-run promises not to have — so the stale session stays stale until a
+// real invocation closes it. --no-write suppresses both too: inheriting it
+// into the closeout suppressed the Run Record but still deleted the session
+// file. A refused invocation never journals either; that rule is per outcome,
+// not per argv, and stays with the journal append.
+export function resolveInvocationPolicy(command, args) {
+  const subcommand = subcommandNames(command).includes(args._[1]) ? args._[1] : null;
+  const rule = { class: "standard", ...(Object.hasOwn(COMMANDS, command) && COMMANDS[command]), ...(subcommand && SUBCOMMAND_OVERRIDES[`${command} ${subcommand}`]) };
+  const steps = CLASS_STEPS[rule.class];
+  const noWrite = args["no-write"] === true;
+  const implementsDryRun = rule.dryRun === true;
+  const sweepSuppressed = optsOutOfRunSession(args) || noWrite || (Object.hasOwn(args, "dry-run") && implementsDryRun);
+  const inspection = Boolean(rule.journalExemptWhen && args[rule.journalExemptWhen.given] && args[rule.journalExemptWhen.unlessBare] !== true);
+  return Object.freeze({
+    class: rule.class,
+    wrapper: steps.includes("wrapper"), ambient: steps.includes("ambient"),
+    sweepRoot: steps.includes("sweep") && !sweepSuppressed ? rule.sweepRoot || null : null,
+    journalExempt: !steps.includes("journal") || rule.journalExempt === true || noWrite || (args["dry-run"] === true && implementsDryRun) || inspection,
+    implementsDryRun, autoEnd: rule.autoEnd === true,
+  });
+}
+
+// The sequence main() delegates to. `steps` are cli.mjs mechanisms:
+//   dispatch(command, args, { recorder?, ambient?, sessionHolder? }?)
+//   closeOutStaleRunSessions(rootKind, args) -> the closed-out stale sessions
+//   ambientRunSession(args) -> the active session, or null
+//   lifecycleIdentity(args, ambient) -> { argvShape, runId }
+//   persistLifecycle(args, command, lifecycle, sessionHolder, thrown)
+//   autoEndAfterQa(args, sessionHolder, thrown, implementsDryRun)
+// Order: normalise argv, open the refusal scope, run an unwrapped class in
+// place, else sweep, read the ambient session, and wrap dispatch; on finish
+// (success or error) journal unless exempt, then run the QA auto-end. The
+// sweep precedes the ambient read so a stale session at the root is closed out
+// (findRunSession ignores it) rather than abandoned with no Run Record. The
+// wrapper re-throws unchanged, so the exit code is the command's own; a
+// command that throws is recorded too. Persistence stays opt-in: with no
+// --lifecycle-journal, CAMPAIGNS_OS_LIFECYCLE_LOG or active session nothing is
+// written.
+export async function runInvocation(args, steps) {
+  // `npx … campaigns-os <command>` hands the bin its own name as the first
+  // positional: it is the program name, not a command.
+  if (args._[0] === "campaigns-os") args._.shift();
+  const command = args._[0] || "help";
+  const policy = resolveInvocationPolicy(command, args);
+  // One refusal scope per invocation, so a refusal is visible only to this
+  // invocation's persistence step.
+  return runWithRefusalScope(async () => {
+    if (!policy.wrapper) return steps.dispatch(command, args);
+    const sweptStale = policy.sweepRoot ? await steps.closeOutStaleRunSessions(policy.sweepRoot, args) : [];
+    const ambient = policy.ambient ? steps.ambientRunSession(args) : null;
+    // Per invocation, never module state: an intake that opens or joins a run
+    // session mid-command publishes it here, so this command's own entry is
+    // persisted into it.
+    const sessionHolder = { current: ambient, autoStarted: false, adopted: false, qaResult: null, sweptStale };
+    await withCommandLifecycle(
+      {
+        command,
+        ...steps.lifecycleIdentity(args, ambient),
+        onFinish: async (lifecycle, thrown) => {
+          if (!policy.journalExempt) steps.persistLifecycle(args, command, lifecycle, sessionHolder, thrown);
+          if (policy.autoEnd) await steps.autoEndAfterQa(args, sessionHolder, thrown, policy.implementsDryRun);
+        },
+      },
+      (recorder) => steps.dispatch(command, args, { recorder, ambient, sessionHolder }),
+    );
+  });
+}

package/src/private-template-source.mjs

@@ -83,7 +83,7 @@ function privateTemplateSourcesPath() {
 }
 
 // No caching, recomputed per call — matches certifiedTemplateFamilies()'s
-// existing convention (cli.mjs) so a long-lived process never serves a stale
+// existing convention (src/doctor/checks.mjs) so a long-lived process never serves a stale
 // allowlist after an edit.
 export function loadPrivateTemplateSources() {
   const path = privateTemplateSourcesPath();

package/src/progress-node.mjs

@@ -1,11 +1,12 @@
 import { campaignSpecIdentity, campaignIdentitiesMatch, localSpecIdentityFields } from "./spec-source-identity.mjs";
 // Best-effort producer adapter. Sanitized immutable bytes are durable before delivery.
 import {randomBytes,createHash} from 'node:crypto';
-import {mkdirSync,readFileSync,writeFileSync,renameSync,rmSync,readdirSync,lstatSync} from 'node:fs';
+import {mkdirSync,readFileSync,writeFileSync,renameSync,rmSync,readdirSync} from 'node:fs';
 import {join,resolve,dirname} from 'node:path';
 import {PROGRESS_SCHEMA_VERSION,PROGRESS_STAGES,PROGRESS_STAGE_STATUSES,PROGRESS_CONTINUATIONS,PROGRESS_ACTION_IDS,PROGRESS_GATE_IDS,canonicalProgressJson,progressSnapshotId,verifyProgressSnapshot} from './progress.mjs';
 import {specMaterialHash} from './spec-identity.mjs';
 import {sameFile} from './fs-identity.mjs';
+import {withDirectoryLock} from './directory-lock.mjs';
 import {resolveConsent,CANONICAL_REMIT_SCOPE,normalizeConsentScope,announceDefaultOnTelemetry} from './consent.mjs';
 import {boundedResponseText,isLoopbackHostname} from './remit.mjs';
 export const PROGRESS_OBSERVATION = Symbol('canonical progress observation');
@@ -71,39 +72,9 @@ export function projectProgressObservation({workspace,context,report,doctor,cont
     continuation:{stage,blocked:continuation?.ok!==true||(Array.isArray(continuation?.divergences)&&continuation.divergences.length>0)||stage==='unknown'||gates.some(gate=>['blocked','unknown'].includes(gate.state))||actions.includes('unknown'),divergent:Array.isArray(continuation?.divergences)&&continuation.divergences.length>0,action_ids:actions,gates},qa,
   };
 }
-async function lock(dir,fn,{budgetMs=1500}={}) {
-  const path=join(dir,'.allocation-lock'); const start=Date.now();const token=randomBytes(16).toString('hex');
-  const abandoned=(unownedMtime=null)=>{
-    try {
-      const stat=lstatSync(path);if(!stat.isDirectory()||stat.isSymbolicLink())return false;
-      const owner=read(join(path,'owner.json'));
-      if(Number.isInteger(owner?.pid)&&owner.pid>0&&typeof owner.token==='string') {
-        try {process.kill(owner.pid,0);return false;}catch(error){return error.code==='ESRCH';}
-      }
-      // A killed process can leave the directory before writing its owner.
-      // Give a live allocator ample time to finish that tiny synchronous gap.
-      return Date.now()-(unownedMtime??stat.mtimeMs)>10000;
-    }catch{return false;}
-  };
-  const recover=()=>{
-    if(!abandoned())return;
-    let originalMtime;try{originalMtime=lstatSync(path).mtimeMs;}catch{return;}
-    const claim=join(path,'.recovery');
-    // Only this exclusive claimant can rename the old lock. An interrupted
-    // recovery claim fails closed for explicit offline recovery; recursively
-    // stealing recovery claims would reintroduce a check/rename race.
-    try {mkdirSync(claim);atomic(join(claim,'owner.json'),{pid:process.pid,token});}catch{return;}
-    let moved=false;
-    try {
-      if(!abandoned(originalMtime))return;
-      const tomb=`${path}.abandoned-${token}`;
-      renameSync(path,tomb);moved=true;rmSync(tomb,{recursive:true,force:true});
-    }catch{}finally{if(!moved&&read(join(claim,'owner.json'))?.token===token){try{rmSync(claim,{recursive:true,force:true});}catch{}}}
-  };
-  while (true) {
-    try {mkdirSync(path);atomic(join(path,'owner.json'),{pid:process.pid,token});break;}catch(error){if(error.code!=='EEXIST'||Date.now()-start>=budgetMs)throw new Error('progress.lock_unavailable');recover();await new Promise(resolve=>setTimeout(resolve,20));}
-  }
-  try{return await fn();}finally{if(read(join(path,'owner.json'))?.token===token)rmSync(path,{recursive:true,force:true});}
+function lock(dir,fn,{budgetMs=1500}={}) {
+  const lockPath=join(dir,'.allocation-lock');
+  return withDirectoryLock(lockPath,fn,{budgetMs,unavailable:()=>Object.assign(new Error('progress.lock_unavailable'),{lockPath})});
 }
 export async function persistProgressObservation(observation,{dir,now=()=>new Date(),historyLimit=32}={}) {
   mkdirSync(dir,{recursive:true,mode:0o700});
@@ -171,7 +142,7 @@ export async function observeProgress(args,continuation,{qaResult=null,packageVe
     if(remit.state==='failed')warn('[campaigns-os] Progress delivery pending; the local observation is retained. Lifecycle result is unchanged.');
     return {...remit,snapshot_id:snapshot.snapshot_id,reused};
   } catch(error) {
-    if(error?.message==='progress.lock_unavailable')warn('[campaigns-os] Progress allocation lock occupied; wait for the current writer. For abandoned or interrupted recovery, stop target writers and follow the offline lock recovery in docs/progress-snapshots.md. Lifecycle result is unchanged.');
+    if(error?.message==='progress.lock_unavailable')warn(`[campaigns-os] Progress allocation lock occupied${error.lockPath?` at ${error.lockPath}`:''}; wait for the current writer. If it stays occupied (an abandoned, ownerless or interrupted lock), stop all campaigns-os writers for this target, then remove that lock directory (docs/progress-snapshots.md). Lifecycle result is unchanged.`);
     else warn('[campaigns-os] Progress observation unavailable; lifecycle result is unchanged.');
     return {state:'failed',reason:'capture_unavailable'};
   }

package/src/proof-policy.mjs

@@ -4,7 +4,7 @@
 //
 // `qa.proof_policy.order_path_depth` is seeded by prepare-build/start and
 // mirrored into `report.proof_policy` at the same moment. The two are compared
-// by `assessPurchaseProofCoverage` (cli.mjs): a disagreement is `unknown`,
+// by `assessPurchaseProofCoverage` (src/doctor/next-step.mjs): a disagreement is `unknown`,
 // never one side's value. Doctor, `next` and the coverage reason all describe
 // that state through the single action below, so the command an operator is
 // told to run is spelled once. A leaf: gate-actions only.

package/src/qa-analytics-correctness.mjs

@@ -228,6 +228,9 @@ export function assessReceiptPurchase(receiptAnalytics = {}, options = {}) {
     receipts.push({
       plan_id: planId,
       receipt_url: redactUrlQuery(attempt.receiptUrl),
+      // The settled document location the receipt capture was read from
+      // (#500); null when it was not recorded.
+      receipt_document_url: redactUrlQuery(attempt.receiptDocumentUrl) || null,
       measured,
       scope: measured ? scope : null,
       purchase_fired: measured && !!effective.fired,

package/src/qa-binding-evidence.mjs

@@ -1,6 +1,7 @@
 import { parse as parseHtml } from 'parse5';
 import { parse as parseJs } from 'acorn';
 import { createPageSourceLoader, resolveCommercialApiKey } from './qa-commercial-parity.mjs';
+import { HTML_NAMESPACE, baseInEffect, documentBases, frozenBaseUrl, parseFailureDiagnostic, scriptKind } from './built-script-syntax.mjs';
 
 export const BINDING_SCHEMA = 'campaigns-os-page-binding/v0';
 export const BINDING_LIMITS = Object.freeze({ scripts_per_page: 6, scripts_per_run: 24, script_bytes: 262144, timeout_ms: 5000 });
@@ -55,12 +56,15 @@ function literalObject(node) {
   if (node?.type === 'ObjectExpression') return node.properties.every(p => p.type === 'Property' && !p.computed && p.kind === 'init' && !p.method && !p.shorthand && literalObject(p.value));
   return false;
 }
-function declarations(text) {
+function declarations(text, { module = false } = {}) {
   // Only whole, unconditional literal assignments are accepted. No evaluation,
   // constant propagation, getters, spreads, callbacks, aliases, or branch guesses.
+  // A script that does not parse is not dynamic: the browser throws on it and
+  // nothing in it runs. It is its own state, reported with its position (#480).
   let ast;
-  try { ast = parseJs(text, { ecmaVersion: 2022, sourceType: 'script' }); }
-  catch { return { values: [], dynamic: true }; }
+  try { ast = parseJs(text, { ecmaVersion: 'latest', sourceType: module ? 'module' : 'script', locations: true }); }
+  // The message is a fixed category: acorn echoes source text into some.
+  catch (error) { return { values: [], dynamic: false, unparsable: parseFailureDiagnostic(error) }; }
   const values = [];
   let dynamic = false;
   for (const statement of ast.body) {
@@ -78,7 +82,23 @@ function declarations(text) {
   return { values, dynamic };
 }
 
-export async function observeBinding({ source, page, expected, scriptLoader }) {
+// A path for a script, for findings: never a full URL, query or fragment. A
+// script served from another origin keeps its host, so same-named files on two
+// CDNs stay distinguishable.
+function scriptPath(src, pageUrl) {
+  try {
+    const url = new URL(src, pageUrl);
+    let pageOrigin = null;
+    try { pageOrigin = new URL(pageUrl).origin; } catch {}
+    return pageOrigin && url.origin !== pageOrigin ? `${url.host}${url.pathname}` : url.pathname;
+  } catch { return null; }
+}
+
+// `parseFailures`, when given, receives one record per page script that does
+// not parse ({ source_kind, script, line, column, message }). It is kept off
+// the page-binding evidence, whose shape is a closed contract; the caller
+// reports it as its own assertion.
+export async function observeBinding({ source, page, expected, scriptLoader, parseFailures = null }) {
   const kinds = new Set();
   const result = (outcome, reason) => ({ schema_version: BINDING_SCHEMA, observation: 'static_declaration',
     outcome, reason, source_kinds: [...kinds].sort(), identity: 'not_verified' });
@@ -94,33 +114,68 @@ export async function observeBinding({ source, page, expected, scriptLoader }) {
   const values = [];
   const scripts = [];
   let dynamic = false;
+  let bases = [];
   const walk = node => {
     const attrs = Object.fromEntries((node.attrs || []).map(a => [a.name, a.value]));
     if (node.tagName === 'base' || Object.entries(attrs).some(([name, value]) => /^on/i.test(name) || /^\s*javascript:/i.test(value))) dynamic = true;
     if (node.tagName === 'meta' && attrs.name === 'next-api-key') { values.push(attrs.content ?? ''); kinds.add('meta'); }
-    if (node.tagName === 'script') scripts.push({ attrs, text: (node.childNodes || []).map(n => n.value || '').join('') });
+    // Each script keeps the <base href> in effect when the parser prepares it
+    // at its end tag (see baseInEffect; #502).
+    // Only an HTML-namespace <script> loads `src`. An SVG script runs from
+    // href / xlink:href or its inline text, which this static read does not
+    // model: it is not fetched and leaves the binding dynamic.
+    if (node.tagName === 'script' && node.namespaceURI !== HTML_NAMESPACE) dynamic = true;
+    else if (node.tagName === 'script') scripts.push({ attrs, base: baseInEffect(bases, node), text: (node.childNodes || []).map(n => n.value || '').join('') });
     // parse5 keeps template content separate; it is inert, as is noscript at boot.
     if (node.tagName !== 'noscript') for (const child of node.childNodes || []) walk(child);
   };
-  try { walk(parseHtml(source.html)); } catch { return result('unknown', 'dynamic_unresolved'); }
+  try {
+    const document = parseHtml(source.html, { sourceCodeLocationInfo: true });
+    bases = documentBases(document);
+    walk(document);
+  } catch { return result('unknown', 'dynamic_unresolved'); }
+  // A script src resolves against the base in effect when the script is
+  // prepared: the frozen base URL of that <base href>, where a
+  // data:, javascript: or unparsable base falls back to the page URL (HTML
+  // "set the frozen base URL"), else the page URL. The loader still scopes
+  // the result to the page origin, so a cross-origin base leaves those
+  // scripts unavailable.
+  const scriptRef = (src, base) => { try { return new URL(src, frozenBaseUrl(base, pageUrl)).href; } catch { return null; } };
   let count = 0, unavailable = false;
   for (const script of scripts) {
     const { attrs } = script;
+    // Classified as the browser does (type trimmed of ASCII whitespace,
+    // case-insensitive). A module script ignores nomodule; a classic nomodule
+    // script is never fetched or run by a module-capable browser, so it cannot
+    // fail on load there: not fetched, not parsed, still not static.
+    const scriptType = scriptKind(attrs);
+    const { nomodule: _nomodule, ...withoutNomodule } = attrs;
+    const classicNomodule = scriptType === null && 'nomodule' in attrs && scriptKind(withoutNomodule) === 'classic';
     // Data-block types (e.g. JSON-LD) are not fetched and consume no config-request budget.
-    if (attrs.type && !['text/javascript', 'application/javascript', 'module'].includes(attrs.type.toLowerCase())) continue;
-    if (attrs.src && SDK.test(attrs.src)) continue;
+    if (scriptType === null && !classicNomodule) continue;
+    // Matched on the URL as the parser reads it (tab and newline removed,
+    // host case-folded), against the base in effect for this script.
+    if (attrs.src && SDK.test(scriptRef(attrs.src, script.base) ?? attrs.src)) continue;
+    if (classicNomodule) { dynamic = true; continue; }
     let text = script.text;
     let kind = 'inline';
     if (attrs.src) {
       kind = 'config_script';
       if (++count > BINDING_LIMITS.scripts_per_page) { unavailable = true; continue; }
-      const loaded = await scriptLoader(attrs.src, pageUrl);
+      const ref = script.base === null ? attrs.src : scriptRef(attrs.src, script.base);
+      const loaded = ref ? await scriptLoader(ref, pageUrl) : { ok: false };
       if (!loaded.ok) { unavailable = true; continue; }
       text = loaded.html;
     }
-    const found = declarations(text);
+    const found = declarations(text, { module: scriptType === 'module' });
+    if (found.unparsable) {
+      // The declarations in an unparsable script are unavailable, not dynamic.
+      unavailable = true;
+      if (Array.isArray(parseFailures)) parseFailures.push({ source_kind: kind, script: attrs.src ? scriptPath(scriptRef(attrs.src, script.base) ?? attrs.src, pageUrl) : null, ...found.unparsable });
+      continue;
+    }
     if (found.values.length) { kinds.add(kind); values.push(...found.values); }
-    if (found.dynamic || 'async' in attrs || 'nomodule' in attrs || attrs.type === 'module') dynamic = true;
+    if (found.dynamic || 'async' in attrs || scriptType === 'module') dynamic = true;
   }
   if (new Set(values).size > 1) return result('unknown', 'conflicting_declarations');
   if (expected?.conflict) return result('unknown', 'conflicting_expected');
@@ -138,3 +193,13 @@ export function bindingAssertion(page, evidence) {
     ...(evidence.outcome === 'match' ? {} : { severity: evidence.outcome === 'mismatch' ? 'blocker' : 'warn' }),
     expected: 'expected credential declaration', actual: evidence.outcome, evidence };
 }
+
+// A page script that does not parse throws a SyntaxError on every load (#480).
+// One blocker per page, naming each script and the parse position.
+export function scriptParseAssertion(page, failures) {
+  if (!Array.isArray(failures) || failures.length === 0) return null;
+  const where = failures.map(f => `${f.script || 'inline script'}:${f.line}:${f.column}`).join(', ');
+  return { id: `script-parse:${page.page_id}`, family: 'api-metadata', page: page.page_id, status: 'fail', severity: 'blocker',
+    expected: 'every page script parses', actual: `unparsable: ${where}`,
+    evidence: { observation: 'static_parse', scripts: failures.map(f => ({ source_kind: f.source_kind, script: f.script, line: f.line, column: f.column, message: f.message })) } };
+}