@nextcommerce/campaigns-os 1.48.0 → 1.52.0

package/src/progress-node.mjs

@@ -14,6 +14,10 @@ export const PROGRESS_ENDPOINT = '/api/progress';
 // A projection keeps the first PROGRESS_GATE_LIMIT continuation gates (the snapshot schema's gates maxItems).
 export const PROGRESS_GATE_LIMIT = 16;
 const accepted = (value,values,fallback='unknown')=>values.includes(value)?value:fallback;
+// A next action that is a variant of a fixed action projects onto it: the
+// order-bump QA run is a QA run. Without this, the closed v0 vocabulary would
+// read it as unknown and mark a ready QA continuation blocked.
+const PROGRESS_ACTION_ALIASES = new Map([['qa_run_bump','qa_run']]);
 const hash = value=>typeof value==='string'&&/^(?:sha256:)?[0-9a-f]{64}$/i.test(value)?`sha256:${value.replace(/^sha256:/i,'').toLowerCase()}`:null;
 const id = value=>typeof value==='string'&&/^[A-Za-z0-9_-]{1,64}$/.test(value)?value:null;
 const digest = value=>`sha256:${createHash('sha256').update(value).digest('hex')}`;
@@ -63,7 +67,7 @@ export function projectProgressObservation({workspace,context,report,doctor,cont
   // here (never pass).
   const gateState=status=>accepted(status==='carried_forward'?'not_applicable':status,['pass','blocked','waived','not_applicable']);
   const gates=(Array.isArray(continuation?.gates)?continuation.gates:[]).slice(0,PROGRESS_GATE_LIMIT).map(gate=>({id:accepted(gate?.id,PROGRESS_GATE_IDS),state:PROGRESS_GATE_IDS.includes(gate?.id)?gateState(gate?.status):'unknown'}));
-  const actions=[...new Set((Array.isArray(continuation?.next_actions)?continuation.next_actions:[]).slice(0,64).map(action=>accepted(action?.id,PROGRESS_ACTION_IDS)))];
+  const actions=[...new Set((Array.isArray(continuation?.next_actions)?continuation.next_actions:[]).slice(0,64).map(action=>accepted(PROGRESS_ACTION_ALIASES.get(action?.id)||action?.id,PROGRESS_ACTION_IDS)))];
   const stage=accepted(continuation?.stage,PROGRESS_CONTINUATIONS);
   const preview=typeof packet?.deploy?.preview_url==='string'&&packet.deploy.preview_url?packet.deploy.preview_url:null;
   return {

package/src/qa-binding-evidence.mjs

@@ -188,6 +188,27 @@ export async function observeBinding({ source, page, expected, scriptLoader, par
   return result(values[0] === expected.value ? 'match' : 'mismatch', 'credential_comparison');
 }
 
+// The Campaign Cart SDK sends the page's raw key, with no scheme, as
+// `Authorization` on every Campaigns API call, so the browser pass can see the
+// key a page actually uses, whatever its scripts look like. The value is
+// compared as sent: if the SDK ever adds a scheme, every page reads mismatch
+// rather than passing. The API host is matched by its shape,
+// campaigns.apps.<name>.com, without naming it.
+const SDK_API_HOST = /^campaigns\.apps\.[a-z0-9-]+\.com$/;
+export function isSdkApiRequest(url) {
+  try { const parsed = new URL(url); return parsed.protocol === 'https:' && SDK_API_HOST.test(parsed.hostname) && parsed.pathname.startsWith('/api/'); } catch { return false; }
+}
+
+// The keys a page sent are compared here and dropped; only the outcome is
+// kept. With nothing sent, or no single expected key, the static read stands
+// (null).
+export function sentBinding(sentKeys, expected) {
+  if (!sentKeys.length || expected?.conflict || !expected?.value) return null;
+  return { schema_version: BINDING_SCHEMA, observation: 'sdk_request',
+    outcome: sentKeys.every(value => value === expected.value) ? 'match' : 'mismatch',
+    reason: 'credential_comparison', source_kinds: ['sdk_request'], identity: 'not_verified' };
+}
+
 export function bindingAssertion(page, evidence) {
   // No source URLs, values, hashes, masked fragments, or inferred App IDs.
   return { id: `page-binding:${page.page_id}`, family: 'api-metadata', page: page.page_id,