@nextcommerce/campaigns-os 1.50.0 → 1.52.0

package/contracts/commerce-surface-catalog.json

@@ -849,8 +849,8 @@
       },
       "verification": {
         "sdk_version": "0.4.40",
-        "verified_at": "2026-10-01T16:01:10Z",
-        "evidence": "sdk-0.4.40-2026-10-01.2",
+        "verified_at": "2026-10-04T02:15:52Z",
+        "evidence": "sdk-0.4.40-2026-10-04",
         "status": "certified",
         "source": "template-verification.json"
       }
@@ -861,7 +861,7 @@
         "id": "template-reference-apollo",
         "family": "apollo",
         "version": "sdk-0.4.38-composable-upsells-2026-09-25",
-        "source_commit": "6c96525b6416872ad0e51918fe6ec82a9673808c",
+        "source_commit": "80f0e30f873b5a13a5232ffd76b20da53480ae57",
         "provenance_url": "https://raw.githubusercontent.com/NextCommerceCo/campaign-cart-starter-templates/main/docs/template-references/apollo/README.md",
         "contract_path": "contracts/commerce-surface-catalog.json",
         "standard_viewport_refs": [
@@ -1273,8 +1273,8 @@
       },
       "verification": {
         "sdk_version": "0.4.40",
-        "verified_at": "2026-10-01T16:01:10Z",
-        "evidence": "sdk-0.4.40-2026-10-01.2",
+        "verified_at": "2026-10-04T02:15:52Z",
+        "evidence": "sdk-0.4.40-2026-10-04",
         "status": "certified",
         "source": "template-verification.json"
       }
@@ -1584,8 +1584,8 @@
       },
       "verification": {
         "sdk_version": "0.4.40",
-        "verified_at": "2026-10-01T16:01:10Z",
-        "evidence": "sdk-0.4.40-2026-10-01.2",
+        "verified_at": "2026-10-04T02:15:52Z",
+        "evidence": "sdk-0.4.40-2026-10-04",
         "status": "certified",
         "source": "template-verification.json"
       }
@@ -1887,8 +1887,8 @@
       },
       "verification": {
         "sdk_version": "0.4.40",
-        "verified_at": "2026-10-01T16:01:10Z",
-        "evidence": "sdk-0.4.40-2026-10-01.2",
+        "verified_at": "2026-10-04T02:15:52Z",
+        "evidence": "sdk-0.4.40-2026-10-04",
         "status": "certified",
         "source": "template-verification.json"
       }
@@ -2228,8 +2228,8 @@
       },
       "verification": {
         "sdk_version": "0.4.40",
-        "verified_at": "2026-10-01T16:01:10Z",
-        "evidence": "sdk-0.4.40-2026-10-01.2",
+        "verified_at": "2026-10-04T02:15:52Z",
+        "evidence": "sdk-0.4.40-2026-10-04",
         "status": "certified",
         "source": "template-verification.json"
       }
@@ -2667,8 +2667,8 @@
       },
       "verification": {
         "sdk_version": "0.4.40",
-        "verified_at": "2026-10-01T16:01:10Z",
-        "evidence": "sdk-0.4.40-2026-10-01.2",
+        "verified_at": "2026-10-04T02:15:52Z",
+        "evidence": "sdk-0.4.40-2026-10-04",
         "status": "certified",
         "source": "template-verification.json"
       }
@@ -3024,8 +3024,8 @@
       },
       "verification": {
         "sdk_version": "0.4.40",
-        "verified_at": "2026-10-01T16:01:10Z",
-        "evidence": "sdk-0.4.40-2026-10-01.2",
+        "verified_at": "2026-10-04T02:15:52Z",
+        "evidence": "sdk-0.4.40-2026-10-04",
         "status": "certified",
         "source": "template-verification.json"
       }
@@ -3314,8 +3314,8 @@
       },
       "verification": {
         "sdk_version": "0.4.40",
-        "verified_at": "2026-10-01T16:01:10Z",
-        "evidence": "sdk-0.4.40-2026-10-01.2",
+        "verified_at": "2026-10-04T02:15:52Z",
+        "evidence": "sdk-0.4.40-2026-10-04",
         "status": "certified",
         "source": "template-verification.json"
       }
@@ -3334,30 +3334,15 @@
           {
             "families": [
               "olympus",
-              "apollo"
-            ],
-            "note": "Single-package check-style bump."
-          },
-          {
-            "families": [
+              "apollo",
+              "demeter",
               "olympus-mv-single-step",
               "apollo-mv-single-step",
-              "olympus-mv-two-step"
-            ],
-            "note": "MV/configurable bump: quantity sync via data-next-product-sync (product_id), so it sums across variant swaps (SDK 0.4.25+). See CLAUDE.md."
-          },
-          {
-            "families": [
+              "olympus-mv-two-step",
               "shop-single-step",
               "shop-three-step"
             ],
-            "note": "Shop bump layout for selector-less checkouts."
-          },
-          {
-            "families": [
-              "demeter"
-            ],
-            "note": "Editorial bump styling."
+            "note": "GENERATED from _shared/checkout/_includes/ (sync:shared, byte-identical by construction, lint:shared-enforced) since the #194 consolidation — edit the _shared source, never a family copy. Superset contract: pricing_mode + legacy show_* bools; package_sync/sync_quantity AND product_sync (product_id match for MV mains, wins when both set); per-family demo values live in page frontmatter (order_bump.check01)."
           }
         ]
       },
@@ -3375,30 +3360,25 @@
               "shop-single-step",
               "shop-three-step"
             ],
-            "note": "Shared unsynced product-card bump with optional PackageToggle line-item property field (SDK 0.4.27+)."
+            "note": "GENERATED from _shared/checkout/_includes/ (sync:shared, byte-identical by construction, lint:shared-enforced) since the #194 consolidation — edit the _shared source, never a family copy. Unsynced product-card bump with optional PackageToggle line-item property field (SDK 0.4.27+)."
           }
         ]
       },
       "bump-switch01.html": {
         "surface": "orderBump",
         "lineages": [
-          {
-            "families": [
-              "demeter"
-            ],
-            "note": "Switch-style bump with demeter styling."
-          },
           {
             "families": [
               "olympus",
               "apollo",
+              "demeter",
               "olympus-mv-single-step",
               "apollo-mv-single-step",
               "olympus-mv-two-step",
               "shop-single-step",
               "shop-three-step"
             ],
-            "note": "Shared switch-style bump."
+            "note": "GENERATED from _shared/checkout/_includes/ (sync:shared, byte-identical by construction, lint:shared-enforced) since the #194 consolidation — edit the _shared source, never a family copy. Switch-style bump; intentionally never quantity-synced."
           }
         ]
       },
@@ -3524,6 +3504,6 @@
     }
   },
   "_synced_from_repo": "NextCommerceCo/campaign-cart-starter-templates",
-  "_synced_from_ref": "main",
-  "_synced_from_sha": "37a8d945db4c360739ded98348814cfd632da94f"
+  "_synced_from_ref": "2c618942391ae398fb4812f36fc93e6632054874",
+  "_synced_from_sha": "2c618942391ae398fb4812f36fc93e6632054874"
 }

package/contracts/effects.v1.json

@@ -362,6 +362,29 @@
       "test_scope": "full",
       "notes": "qa publish --dry-run runs every check the real invocation runs and prints what it would do; it writes nothing under the target, appends no lifecycle entry (the command is declared `dryRun` in src/invocation.mjs) and runs no stale-session closeout. Local-spec packets are refused before publication because they have no saved Map destination."
     },
+    {
+      "command": "checkpoint",
+      "subcommand": "accept",
+      "flags": [
+        "--dry-run"
+      ],
+      "annotations": {
+        "readOnlyHint": true,
+        "destructiveHint": false,
+        "openWorldHint": false,
+        "idempotentHint": true
+      },
+      "tier": "none",
+      "writes": [],
+      "sends": [],
+      "effect_test": "effects: checkpoint accept --dry-run (preflight)",
+      "test_scope": "preflight",
+      "notes": "checkpoint accept --dry-run runs every check the real invocation runs and prints the accepts it would record; it writes nothing under the target, does not mark the doctor sidecar stale, appends no lifecycle entry (the command is declared `dryRun` in src/invocation.mjs) and runs no stale-session closeout. PREFLIGHT-PROVED: doctor, Polish and QA checks produce accept-eligible warnings, but the offline fixture names a synthetic result ref that matches no current result, so its dry run is refused (changed_since_handoff) before it reaches an accept that passes its checks; the case proves the refused dry run writes nothing and contacts nothing.",
+      "preflight": {
+        "may_write": [],
+        "may_contact": []
+      }
+    },
     {
       "command": "checkpoint",
       "subcommand": "waive",
@@ -2731,11 +2754,19 @@
           "requires_consent": false,
           "observed_in": [],
           "not_observed_reason": "the offline fixture is blocked at the theme/proof gate before a served page is read, so there is no page to compare and the live campaign is not read"
+        },
+        {
+          "destination": "the http(s) store policy URLs the CampaignSpec configures (campaign.store_terms, campaign.store_privacy, campaign.store_returns, campaign.store_shipping, and campaign.store_contact when it is an http(s) URL), and the redirects they answer with; a mailto: campaign.store_contact is checked for presence only and is never requested",
+          "what": "GET requests that read headers only: at most 5 configured URLs, at most 6 requests per URL (the URL and up to 5 redirects), at most 30 per run",
+          "when": "--browser runs the page checks and the CampaignSpec configures at least one http(s) store policy URL",
+          "requires_consent": false,
+          "observed_in": [],
+          "not_observed_reason": "the offline fixture's browser run is blocked at the gate before any page is checked, so no store policy URL is requested"
         }
       ],
       "effect_test": "effects: qa run --browser (preflight)",
       "test_scope": "preflight",
-      "notes": "PREFLIGHT-PROVED: --browser needs an installed Chromium and a reachable campaign, neither of which exists offline. The case proves the attempt is blocked at the same gate as the node run and writes exactly the blocked-attempt evidence. It SENDS on a blocked attempt too: the verdict is published to {proxy-base}/api/qa/verdicts and the QA stage progress observation to {proxy-base}/api/progress, both under persisted consent for the endpoint. Publishing rides the telemetry consent seam rather than a flag of its own, so the four consent-off conditions saw neither request. Local-spec packets retain verdicts in the repository and never send a QA verdict or progress to the Map portal, even with --post-verdict. When a served page was read and a public Campaigns API key resolves, it also makes one read-only GET of {proxy-base}/api/campaign under X-Campaign-Key to check the served pages' shipping and package refs against the live campaign (#533); without a key or a page, or on a failed read, the verdict records the check as not_run with its reason. --no-live-refs skips that read (its own row).",
+      "notes": "PREFLIGHT-PROVED: --browser needs an installed Chromium and a reachable campaign, neither of which exists offline. The case proves the attempt is blocked at the same gate as the node run and writes exactly the blocked-attempt evidence. It SENDS on a blocked attempt too: the verdict is published to {proxy-base}/api/qa/verdicts and the QA stage progress observation to {proxy-base}/api/progress, both under persisted consent for the endpoint. Publishing rides the telemetry consent seam rather than a flag of its own, so the four consent-off conditions saw neither request. Local-spec packets retain verdicts in the repository and never send a QA verdict or progress to the Map portal, even with --post-verdict. When a served page was read and a public Campaigns API key resolves, it also makes one read-only GET of {proxy-base}/api/campaign under X-Campaign-Key to check the served pages' shipping and package refs against the live campaign (#533); without a key or a page, or on a failed read, the verdict records the check as not_run with its reason. --no-live-refs skips that read (its own row). Once the page checks run, it also sends the header-only GETs to the configured http(s) store policy URLs (their own row) to check the served pages' policy links; offline the run is blocked at the gate before any page is checked, so none is sent.",
       "preflight": {
         "may_write": [
           "{target}/qa-output/**",
@@ -3357,11 +3388,19 @@
           "observed_in": [
             "persisted_consent"
           ]
+        },
+        {
+          "destination": "the http(s) store policy URLs the CampaignSpec configures (campaign.store_terms, campaign.store_privacy, campaign.store_returns, campaign.store_shipping, and campaign.store_contact when it is an http(s) URL), and the redirects they answer with; a mailto: campaign.store_contact is checked for presence only and is never requested",
+          "what": "GET requests that read headers only: at most 5 configured URLs, at most 6 requests per URL (the URL and up to 5 redirects), at most 30 per run",
+          "when": "--browser runs the page checks and the CampaignSpec configures at least one http(s) store policy URL",
+          "requires_consent": false,
+          "observed_in": [],
+          "not_observed_reason": "the offline fixture's browser run is blocked at the gate before any page is checked, so no store policy URL is requested"
         }
       ],
       "effect_test": "effects: qa run --browser --no-live-refs (preflight)",
       "test_scope": "preflight",
-      "notes": "PREFLIGHT-PROVED like `qa run --browser`: no installed Chromium or reachable campaign offline. The `qa run --browser` row's writes and sends, without the {proxy-base}/api/campaign read: the verdict records the live-campaign-refs check skipped with reason disabled, never a pass. The other sends keep their own conditions and opt-outs.",
+      "notes": "PREFLIGHT-PROVED like `qa run --browser`: no installed Chromium or reachable campaign offline. The `qa run --browser` row's writes and sends, without the {proxy-base}/api/campaign read: the verdict records the live-campaign-refs check skipped with reason disabled, never a pass. The other sends keep their own conditions and opt-outs. The header-only GETs to the configured http(s) store policy URLs are sent as in the `qa run --browser` row, and offline none is sent.",
       "preflight": {
         "may_write": [
           "{target}/qa-output/**",
@@ -4076,6 +4115,46 @@
         ]
       }
     },
+    {
+      "command": "checkpoint",
+      "subcommand": "accept",
+      "flags": [],
+      "annotations": {
+        "readOnlyHint": false,
+        "destructiveHint": false,
+        "openWorldHint": false,
+        "idempotentHint": false
+      },
+      "tier": "B",
+      "writes": [
+        {
+          "path": "{target}/.campaign-runtime/assembly-report.json",
+          "when": "an accept is recorded — every listed result is a current accept-eligible warning that was on record before the command; the accepts are appended to qc_accepts[] and evidence[], and nothing already there is replaced",
+          "observed_in": [],
+          "not_observed_reason": "the offline fixture names a synthetic result ref that matches no current result, so its accept is refused (changed_since_handoff) before the one write; the case proves the refusal writes nothing"
+        },
+        {
+          "path": "{target}/.campaign-runtime/doctor-output.json",
+          "when": "an accept is recorded; it marks the retained doctor sidecar stale",
+          "observed_in": [],
+          "not_observed_reason": "the offline fixture names a synthetic result ref that matches no current result, so its accept is refused (changed_since_handoff) before the one write; the case proves the refusal writes nothing"
+        },
+        {
+          "path": "{lifecycle-journal}",
+          "when": "a lifecycle journal is selected for the invocation — an active run session, --lifecycle-journal, or CAMPAIGNS_OS_LIFECYCLE_LOG; the entry records the attempt and its exit status, whether the accept was recorded or the handler failed (such as on malformed packet JSON). A refused invocation journals nothing: a typed accept refusal (any refusal_code), or any other refusal the command raises — a missing, repeated or malformed flag, a missing assembly report, or a qc_accepts or evidence value that is not an array",
+          "observed_in": [],
+          "not_observed_reason": "the offline fixture reaches neither a recorded accept nor a handler failure: it names a synthetic result ref that matches no current result, so its accept is refused (changed_since_handoff), and the case proves that refusal journals nothing"
+        }
+      ],
+      "sends": [],
+      "effect_test": "effects: checkpoint accept (preflight)",
+      "test_scope": "preflight",
+      "notes": "Tier B, not C: tier C means the invocation overwrites, clears or discards state that was already there, and `checkpoint waive` is tier C because a waiver overrides a blocking gate. An accept appends, overrides no gate and changes no readiness, and the doctor-sidecar stale stamp is the same write `theme generate` makes at tier B. Not idempotent: a repeat appends another record. It reads only what is already on disk and sends nothing. PREFLIGHT-PROVED: doctor, Polish and QA checks produce accept-eligible warnings, but the offline fixture names a synthetic result ref that matches no current result, so its accept is refused (changed_since_handoff) before the write; the case proves the refused accept writes nothing — no report, no stale stamp, no journal entry — and contacts nothing.",
+      "preflight": {
+        "may_write": [],
+        "may_contact": []
+      }
+    },
     {
       "command": "checkpoint",
       "subcommand": "waive",