@nextcommerce/campaigns-os 1.55.0 → 1.59.0

package/contracts/effects.v1.json

@@ -6267,8 +6267,8 @@
       "sends": [
         {
           "destination": "{base-url}",
-          "what": "a GET for each built page under the served URL, to prove the local preview answers before it is recorded",
-          "when": "the packet's deploy target is local-serve and --base-url is a loopback origin naming the campaign's route root",
+          "what": "a GET for each built page under the served URL, to prove the preview answers before it is recorded, and on a hosted target a GET for each script and stylesheet the built pages load from that origin, to compare its bytes with the built output",
+          "when": "--base-url names the campaign's route root on a loopback origin (deploy target local-serve) or an https origin (any other deploy target; plain http only on a loopback host)",
           "requires_consent": false,
           "observed_in": [
             "no_session",
@@ -6281,7 +6281,7 @@
       ],
       "effect_test": "effects: record deploy",
       "test_scope": "full",
-      "notes": "Destructive: it replaces stages.deploy, stamped with the build fingerprint it probed, and the packet's deploy.preview_url. The requests stay on this machine: --base-url must be a loopback origin. Refused, writing nothing but the lifecycle entry, when the packet is not local-serve, the URL is not loopback or not the campaign's route root, a built page does not answer 2xx, polish is not recorded, build or Polish is owed again after a brief or CampaignSpec change or its record does not say which content it was made against, the built output changed since build was recorded, or the theme gate is blocked. The Build Context is read, not written."
+      "notes": "Destructive: it replaces stages.deploy, stamped with the build fingerprint it probed, and the packet's deploy.preview_url. On a local-serve packet the requests stay on this machine: --base-url must be a loopback origin. On any other deploy target --base-url is an https origin and the served scripts and stylesheets are compared by sha256 with the built output (HTML is not compared). Refused, writing nothing but the lifecycle entry, when the URL breaks those rules or is not the campaign's route root, a built page does not answer (2xx locally, 200 hosted), a served asset is missing or differs, polish is not recorded, build or Polish is owed again after a brief or CampaignSpec change or its record does not say which content it was made against, the built output changed since build was recorded or a record build of other output lands between the probe and the write (on either deploy target), or the theme gate is blocked. The Build Context is read, not written."
     },
     {
       "command": "record",
@@ -6300,8 +6300,8 @@
       "sends": [
         {
           "destination": "{base-url}",
-          "what": "a GET for each built page under the served URL, to prove the local preview answers before it is recorded",
-          "when": "the packet's deploy target is local-serve and --base-url is a loopback origin naming the campaign's route root",
+          "what": "a GET for each built page under the served URL, to prove the preview answers before it is recorded, and on a hosted target a GET for each script and stylesheet the built pages load from that origin, to compare its bytes with the built output",
+          "when": "--base-url names the campaign's route root on a loopback origin (deploy target local-serve) or an https origin (any other deploy target; plain http only on a loopback host)",
           "requires_consent": false,
           "observed_in": [
             "no_session",

package/contracts/fixtures/runtime-recipe/accept/current.json

@@ -3,7 +3,7 @@
   "_growth_note": "When a bound below is genuinely reached, the answer is to find out why before raising it. A dependency install that exceeds its bound on a warm machine is a supply-chain change, not a slow morning; an output inventory that exceeds its file or byte bound is a build that went wrong, not a package that grew 50x overnight. Raising a bound is the fallback, it advances recipe_revision, and it owes a release-ledger entry. Widening the accepted npm range follows the same path, and its trigger is external and checkable: widen when a Node release line ships that npm major by default, not when a particular machine happens to have it installed.",
   "schema": "campaigns-os-runtime-recipe/v1",
   "recipe_kind": "campaigns-os-node-v1",
-  "recipe_revision": "1.0.2",
+  "recipe_revision": "1.0.3",
   "refusal_reason_code": "runtime_recipe_refused",
   "fail_closed": true,
   "unperformable_check_disposition": "failed",
@@ -106,6 +106,7 @@
     "fingerprint_algorithm": "sha256",
     "files": [
       "campaign-spec/analytics-vocabulary.ts",
+      "campaign-spec/checkout-flow.ts",
       "campaign-spec/index.ts",
       "campaign-spec/normalize.ts",
       "campaign-spec/package.json",
@@ -113,7 +114,9 @@
       "campaign-spec/rules/analytics-contract-shape.ts",
       "campaign-spec/rules/assembly-hints-shape.ts",
       "campaign-spec/rules/campaign-metadata.ts",
+      "campaign-spec/rules/checkout-forward-target.ts",
       "campaign-spec/rules/checkout-has-success-url.ts",
+      "campaign-spec/rules/checkout-step-reaches-checkout.ts",
       "campaign-spec/rules/cycle-detection.ts",
       "campaign-spec/rules/design-source-shape.ts",
       "campaign-spec/rules/downsell-without-upsell.ts",
@@ -124,9 +127,11 @@
       "campaign-spec/rules/funnel-weight-sum.ts",
       "campaign-spec/rules/index.ts",
       "campaign-spec/rules/offer-ref-integrity.ts",
+      "campaign-spec/rules/one-checkout-per-path.ts",
       "campaign-spec/rules/package-pricing-sanity.ts",
       "campaign-spec/rules/page-count.ts",
       "campaign-spec/rules/page-id-uniqueness.ts",
+      "campaign-spec/rules/pre-payment-forward-target.ts",
       "campaign-spec/rules/promo-code-input-validation.ts",
       "campaign-spec/rules/promo-codes-shape.ts",
       "campaign-spec/rules/route-field-ignored-for-page-type.ts",

package/contracts/fixtures/runtime-recipe/accept/minimal.json

@@ -1,7 +1,7 @@
 {
   "schema": "campaigns-os-runtime-recipe/v1",
   "recipe_kind": "campaigns-os-node-v1",
-  "recipe_revision": "1.0.2",
+  "recipe_revision": "1.0.3",
   "refusal_reason_code": "runtime_recipe_refused",
   "fail_closed": true,
   "unperformable_check_disposition": "failed",
@@ -101,6 +101,7 @@
     "fingerprint_algorithm": "sha256",
     "files": [
       "campaign-spec/analytics-vocabulary.ts",
+      "campaign-spec/checkout-flow.ts",
       "campaign-spec/index.ts",
       "campaign-spec/normalize.ts",
       "campaign-spec/package.json",
@@ -108,7 +109,9 @@
       "campaign-spec/rules/analytics-contract-shape.ts",
       "campaign-spec/rules/assembly-hints-shape.ts",
       "campaign-spec/rules/campaign-metadata.ts",
+      "campaign-spec/rules/checkout-forward-target.ts",
       "campaign-spec/rules/checkout-has-success-url.ts",
+      "campaign-spec/rules/checkout-step-reaches-checkout.ts",
       "campaign-spec/rules/cycle-detection.ts",
       "campaign-spec/rules/design-source-shape.ts",
       "campaign-spec/rules/downsell-without-upsell.ts",
@@ -119,9 +122,11 @@
       "campaign-spec/rules/funnel-weight-sum.ts",
       "campaign-spec/rules/index.ts",
       "campaign-spec/rules/offer-ref-integrity.ts",
+      "campaign-spec/rules/one-checkout-per-path.ts",
       "campaign-spec/rules/package-pricing-sanity.ts",
       "campaign-spec/rules/page-count.ts",
       "campaign-spec/rules/page-id-uniqueness.ts",
+      "campaign-spec/rules/pre-payment-forward-target.ts",
       "campaign-spec/rules/promo-code-input-validation.ts",
       "campaign-spec/rules/promo-codes-shape.ts",
       "campaign-spec/rules/route-field-ignored-for-page-type.ts",

package/contracts/fixtures/runtime-recipe/dist-states.json

@@ -2,7 +2,7 @@
   "_note": "Declarative descriptions of the prepared-runtime states an output-check implementation must distinguish. A test builds each state from the accepted recipe rather than from paths written down here, so adding a module to the input set cannot leave a fixture describing an inventory that no longer exists.",
   "schema": "campaigns-os-runtime-recipe-dist-states/v1",
   "directory": "campaign-spec/dist",
-  "expected_file_count": 76,
+  "expected_file_count": 86,
   "states": [
     {
       "id": "healthy",

package/contracts/fixtures/runtime-recipe/reject/advisory-enforcement.json

@@ -3,7 +3,7 @@
   "_growth_note": "When a bound below is genuinely reached, the answer is to find out why before raising it. A dependency install that exceeds its bound on a warm machine is a supply-chain change, not a slow morning; an output inventory that exceeds its file or byte bound is a build that went wrong, not a package that grew 50x overnight. Raising a bound is the fallback, it advances recipe_revision, and it owes a release-ledger entry. Widening the accepted npm range follows the same path, and its trigger is external and checkable: widen when a Node release line ships that npm major by default, not when a particular machine happens to have it installed.",
   "schema": "campaigns-os-runtime-recipe/v1",
   "recipe_kind": "campaigns-os-node-v1",
-  "recipe_revision": "1.0.2",
+  "recipe_revision": "1.0.3",
   "refusal_reason_code": "runtime_recipe_refused",
   "fail_closed": false,
   "unperformable_check_disposition": "failed",
@@ -106,6 +106,7 @@
     "fingerprint_algorithm": "sha256",
     "files": [
       "campaign-spec/analytics-vocabulary.ts",
+      "campaign-spec/checkout-flow.ts",
       "campaign-spec/index.ts",
       "campaign-spec/normalize.ts",
       "campaign-spec/package.json",
@@ -113,7 +114,9 @@
       "campaign-spec/rules/analytics-contract-shape.ts",
       "campaign-spec/rules/assembly-hints-shape.ts",
       "campaign-spec/rules/campaign-metadata.ts",
+      "campaign-spec/rules/checkout-forward-target.ts",
       "campaign-spec/rules/checkout-has-success-url.ts",
+      "campaign-spec/rules/checkout-step-reaches-checkout.ts",
       "campaign-spec/rules/cycle-detection.ts",
       "campaign-spec/rules/design-source-shape.ts",
       "campaign-spec/rules/downsell-without-upsell.ts",
@@ -124,9 +127,11 @@
       "campaign-spec/rules/funnel-weight-sum.ts",
       "campaign-spec/rules/index.ts",
       "campaign-spec/rules/offer-ref-integrity.ts",
+      "campaign-spec/rules/one-checkout-per-path.ts",
       "campaign-spec/rules/package-pricing-sanity.ts",
       "campaign-spec/rules/page-count.ts",
       "campaign-spec/rules/page-id-uniqueness.ts",
+      "campaign-spec/rules/pre-payment-forward-target.ts",
       "campaign-spec/rules/promo-code-input-validation.ts",
       "campaign-spec/rules/promo-codes-shape.ts",
       "campaign-spec/rules/route-field-ignored-for-page-type.ts",

package/contracts/fixtures/runtime-recipe/reject/allowlist-without-hosts.json

@@ -3,7 +3,7 @@
   "_growth_note": "When a bound below is genuinely reached, the answer is to find out why before raising it. A dependency install that exceeds its bound on a warm machine is a supply-chain change, not a slow morning; an output inventory that exceeds its file or byte bound is a build that went wrong, not a package that grew 50x overnight. Raising a bound is the fallback, it advances recipe_revision, and it owes a release-ledger entry. Widening the accepted npm range follows the same path, and its trigger is external and checkable: widen when a Node release line ships that npm major by default, not when a particular machine happens to have it installed.",
   "schema": "campaigns-os-runtime-recipe/v1",
   "recipe_kind": "campaigns-os-node-v1",
-  "recipe_revision": "1.0.2",
+  "recipe_revision": "1.0.3",
   "refusal_reason_code": "runtime_recipe_refused",
   "fail_closed": true,
   "unperformable_check_disposition": "failed",
@@ -104,6 +104,7 @@
     "fingerprint_algorithm": "sha256",
     "files": [
       "campaign-spec/analytics-vocabulary.ts",
+      "campaign-spec/checkout-flow.ts",
       "campaign-spec/index.ts",
       "campaign-spec/normalize.ts",
       "campaign-spec/package.json",
@@ -111,7 +112,9 @@
       "campaign-spec/rules/analytics-contract-shape.ts",
       "campaign-spec/rules/assembly-hints-shape.ts",
       "campaign-spec/rules/campaign-metadata.ts",
+      "campaign-spec/rules/checkout-forward-target.ts",
       "campaign-spec/rules/checkout-has-success-url.ts",
+      "campaign-spec/rules/checkout-step-reaches-checkout.ts",
       "campaign-spec/rules/cycle-detection.ts",
       "campaign-spec/rules/design-source-shape.ts",
       "campaign-spec/rules/downsell-without-upsell.ts",
@@ -122,9 +125,11 @@
       "campaign-spec/rules/funnel-weight-sum.ts",
       "campaign-spec/rules/index.ts",
       "campaign-spec/rules/offer-ref-integrity.ts",
+      "campaign-spec/rules/one-checkout-per-path.ts",
       "campaign-spec/rules/package-pricing-sanity.ts",
       "campaign-spec/rules/page-count.ts",
       "campaign-spec/rules/page-id-uniqueness.ts",
+      "campaign-spec/rules/pre-payment-forward-target.ts",
       "campaign-spec/rules/promo-code-input-validation.ts",
       "campaign-spec/rules/promo-codes-shape.ts",
       "campaign-spec/rules/route-field-ignored-for-page-type.ts",

package/contracts/fixtures/runtime-recipe/reject/committed-output-claim.json

@@ -3,7 +3,7 @@
   "_growth_note": "When a bound below is genuinely reached, the answer is to find out why before raising it. A dependency install that exceeds its bound on a warm machine is a supply-chain change, not a slow morning; an output inventory that exceeds its file or byte bound is a build that went wrong, not a package that grew 50x overnight. Raising a bound is the fallback, it advances recipe_revision, and it owes a release-ledger entry. Widening the accepted npm range follows the same path, and its trigger is external and checkable: widen when a Node release line ships that npm major by default, not when a particular machine happens to have it installed.",
   "schema": "campaigns-os-runtime-recipe/v1",
   "recipe_kind": "campaigns-os-node-v1",
-  "recipe_revision": "1.0.2",
+  "recipe_revision": "1.0.3",
   "refusal_reason_code": "runtime_recipe_refused",
   "fail_closed": true,
   "unperformable_check_disposition": "failed",
@@ -106,6 +106,7 @@
     "fingerprint_algorithm": "sha256",
     "files": [
       "campaign-spec/analytics-vocabulary.ts",
+      "campaign-spec/checkout-flow.ts",
       "campaign-spec/index.ts",
       "campaign-spec/normalize.ts",
       "campaign-spec/package.json",
@@ -113,7 +114,9 @@
       "campaign-spec/rules/analytics-contract-shape.ts",
       "campaign-spec/rules/assembly-hints-shape.ts",
       "campaign-spec/rules/campaign-metadata.ts",
+      "campaign-spec/rules/checkout-forward-target.ts",
       "campaign-spec/rules/checkout-has-success-url.ts",
+      "campaign-spec/rules/checkout-step-reaches-checkout.ts",
       "campaign-spec/rules/cycle-detection.ts",
       "campaign-spec/rules/design-source-shape.ts",
       "campaign-spec/rules/downsell-without-upsell.ts",
@@ -124,9 +127,11 @@
       "campaign-spec/rules/funnel-weight-sum.ts",
       "campaign-spec/rules/index.ts",
       "campaign-spec/rules/offer-ref-integrity.ts",
+      "campaign-spec/rules/one-checkout-per-path.ts",
       "campaign-spec/rules/package-pricing-sanity.ts",
       "campaign-spec/rules/page-count.ts",
       "campaign-spec/rules/page-id-uniqueness.ts",
+      "campaign-spec/rules/pre-payment-forward-target.ts",
       "campaign-spec/rules/promo-code-input-validation.ts",
       "campaign-spec/rules/promo-codes-shape.ts",
       "campaign-spec/rules/route-field-ignored-for-page-type.ts",

package/contracts/fixtures/runtime-recipe/reject/engines-disagreement-warns.json

@@ -3,7 +3,7 @@
   "_growth_note": "When a bound below is genuinely reached, the answer is to find out why before raising it. A dependency install that exceeds its bound on a warm machine is a supply-chain change, not a slow morning; an output inventory that exceeds its file or byte bound is a build that went wrong, not a package that grew 50x overnight. Raising a bound is the fallback, it advances recipe_revision, and it owes a release-ledger entry. Widening the accepted npm range follows the same path, and its trigger is external and checkable: widen when a Node release line ships that npm major by default, not when a particular machine happens to have it installed.",
   "schema": "campaigns-os-runtime-recipe/v1",
   "recipe_kind": "campaigns-os-node-v1",
-  "recipe_revision": "1.0.2",
+  "recipe_revision": "1.0.3",
   "refusal_reason_code": "runtime_recipe_refused",
   "fail_closed": true,
   "unperformable_check_disposition": "failed",
@@ -106,6 +106,7 @@
     "fingerprint_algorithm": "sha256",
     "files": [
       "campaign-spec/analytics-vocabulary.ts",
+      "campaign-spec/checkout-flow.ts",
       "campaign-spec/index.ts",
       "campaign-spec/normalize.ts",
       "campaign-spec/package.json",
@@ -113,7 +114,9 @@
       "campaign-spec/rules/analytics-contract-shape.ts",
       "campaign-spec/rules/assembly-hints-shape.ts",
       "campaign-spec/rules/campaign-metadata.ts",
+      "campaign-spec/rules/checkout-forward-target.ts",
       "campaign-spec/rules/checkout-has-success-url.ts",
+      "campaign-spec/rules/checkout-step-reaches-checkout.ts",
       "campaign-spec/rules/cycle-detection.ts",
       "campaign-spec/rules/design-source-shape.ts",
       "campaign-spec/rules/downsell-without-upsell.ts",
@@ -124,9 +127,11 @@
       "campaign-spec/rules/funnel-weight-sum.ts",
       "campaign-spec/rules/index.ts",
       "campaign-spec/rules/offer-ref-integrity.ts",
+      "campaign-spec/rules/one-checkout-per-path.ts",
       "campaign-spec/rules/package-pricing-sanity.ts",
       "campaign-spec/rules/page-count.ts",
       "campaign-spec/rules/page-id-uniqueness.ts",
+      "campaign-spec/rules/pre-payment-forward-target.ts",
       "campaign-spec/rules/promo-code-input-validation.ts",
       "campaign-spec/rules/promo-codes-shape.ts",
       "campaign-spec/rules/route-field-ignored-for-page-type.ts",

package/contracts/fixtures/runtime-recipe/reject/lifecycle-scripts-enabled.json

@@ -3,7 +3,7 @@
   "_growth_note": "When a bound below is genuinely reached, the answer is to find out why before raising it. A dependency install that exceeds its bound on a warm machine is a supply-chain change, not a slow morning; an output inventory that exceeds its file or byte bound is a build that went wrong, not a package that grew 50x overnight. Raising a bound is the fallback, it advances recipe_revision, and it owes a release-ledger entry. Widening the accepted npm range follows the same path, and its trigger is external and checkable: widen when a Node release line ships that npm major by default, not when a particular machine happens to have it installed.",
   "schema": "campaigns-os-runtime-recipe/v1",
   "recipe_kind": "campaigns-os-node-v1",
-  "recipe_revision": "1.0.2",
+  "recipe_revision": "1.0.3",
   "refusal_reason_code": "runtime_recipe_refused",
   "fail_closed": true,
   "unperformable_check_disposition": "failed",
@@ -106,6 +106,7 @@
     "fingerprint_algorithm": "sha256",
     "files": [
       "campaign-spec/analytics-vocabulary.ts",
+      "campaign-spec/checkout-flow.ts",
       "campaign-spec/index.ts",
       "campaign-spec/normalize.ts",
       "campaign-spec/package.json",
@@ -113,7 +114,9 @@
       "campaign-spec/rules/analytics-contract-shape.ts",
       "campaign-spec/rules/assembly-hints-shape.ts",
       "campaign-spec/rules/campaign-metadata.ts",
+      "campaign-spec/rules/checkout-forward-target.ts",
       "campaign-spec/rules/checkout-has-success-url.ts",
+      "campaign-spec/rules/checkout-step-reaches-checkout.ts",
       "campaign-spec/rules/cycle-detection.ts",
       "campaign-spec/rules/design-source-shape.ts",
       "campaign-spec/rules/downsell-without-upsell.ts",
@@ -124,9 +127,11 @@
       "campaign-spec/rules/funnel-weight-sum.ts",
       "campaign-spec/rules/index.ts",
       "campaign-spec/rules/offer-ref-integrity.ts",
+      "campaign-spec/rules/one-checkout-per-path.ts",
       "campaign-spec/rules/package-pricing-sanity.ts",
       "campaign-spec/rules/page-count.ts",
       "campaign-spec/rules/page-id-uniqueness.ts",
+      "campaign-spec/rules/pre-payment-forward-target.ts",
       "campaign-spec/rules/promo-code-input-validation.ts",
       "campaign-spec/rules/promo-codes-shape.ts",
       "campaign-spec/rules/route-field-ignored-for-page-type.ts",

package/contracts/fixtures/runtime-recipe/reject/missing-required-field.json

@@ -3,7 +3,7 @@
   "_growth_note": "When a bound below is genuinely reached, the answer is to find out why before raising it. A dependency install that exceeds its bound on a warm machine is a supply-chain change, not a slow morning; an output inventory that exceeds its file or byte bound is a build that went wrong, not a package that grew 50x overnight. Raising a bound is the fallback, it advances recipe_revision, and it owes a release-ledger entry. Widening the accepted npm range follows the same path, and its trigger is external and checkable: widen when a Node release line ships that npm major by default, not when a particular machine happens to have it installed.",
   "schema": "campaigns-os-runtime-recipe/v1",
   "recipe_kind": "campaigns-os-node-v1",
-  "recipe_revision": "1.0.2",
+  "recipe_revision": "1.0.3",
   "refusal_reason_code": "runtime_recipe_refused",
   "fail_closed": true,
   "unperformable_check_disposition": "failed",

package/contracts/fixtures/runtime-recipe/reject/unknown-kind.json

@@ -3,7 +3,7 @@
   "_growth_note": "When a bound below is genuinely reached, the answer is to find out why before raising it. A dependency install that exceeds its bound on a warm machine is a supply-chain change, not a slow morning; an output inventory that exceeds its file or byte bound is a build that went wrong, not a package that grew 50x overnight. Raising a bound is the fallback, it advances recipe_revision, and it owes a release-ledger entry. Widening the accepted npm range follows the same path, and its trigger is external and checkable: widen when a Node release line ships that npm major by default, not when a particular machine happens to have it installed.",
   "schema": "campaigns-os-runtime-recipe/v1",
   "recipe_kind": "campaigns-os-node-v2",
-  "recipe_revision": "1.0.2",
+  "recipe_revision": "1.0.3",
   "refusal_reason_code": "runtime_recipe_refused",
   "fail_closed": true,
   "unperformable_check_disposition": "failed",
@@ -106,6 +106,7 @@
     "fingerprint_algorithm": "sha256",
     "files": [
       "campaign-spec/analytics-vocabulary.ts",
+      "campaign-spec/checkout-flow.ts",
       "campaign-spec/index.ts",
       "campaign-spec/normalize.ts",
       "campaign-spec/package.json",
@@ -113,7 +114,9 @@
       "campaign-spec/rules/analytics-contract-shape.ts",
       "campaign-spec/rules/assembly-hints-shape.ts",
       "campaign-spec/rules/campaign-metadata.ts",
+      "campaign-spec/rules/checkout-forward-target.ts",
       "campaign-spec/rules/checkout-has-success-url.ts",
+      "campaign-spec/rules/checkout-step-reaches-checkout.ts",
       "campaign-spec/rules/cycle-detection.ts",
       "campaign-spec/rules/design-source-shape.ts",
       "campaign-spec/rules/downsell-without-upsell.ts",
@@ -124,9 +127,11 @@
       "campaign-spec/rules/funnel-weight-sum.ts",
       "campaign-spec/rules/index.ts",
       "campaign-spec/rules/offer-ref-integrity.ts",
+      "campaign-spec/rules/one-checkout-per-path.ts",
       "campaign-spec/rules/package-pricing-sanity.ts",
       "campaign-spec/rules/page-count.ts",
       "campaign-spec/rules/page-id-uniqueness.ts",
+      "campaign-spec/rules/pre-payment-forward-target.ts",
       "campaign-spec/rules/promo-code-input-validation.ts",
       "campaign-spec/rules/promo-codes-shape.ts",
       "campaign-spec/rules/route-field-ignored-for-page-type.ts",

package/contracts/fixtures/runtime-recipe/reject/unknown-network-policy.json

@@ -3,7 +3,7 @@
   "_growth_note": "When a bound below is genuinely reached, the answer is to find out why before raising it. A dependency install that exceeds its bound on a warm machine is a supply-chain change, not a slow morning; an output inventory that exceeds its file or byte bound is a build that went wrong, not a package that grew 50x overnight. Raising a bound is the fallback, it advances recipe_revision, and it owes a release-ledger entry. Widening the accepted npm range follows the same path, and its trigger is external and checkable: widen when a Node release line ships that npm major by default, not when a particular machine happens to have it installed.",
   "schema": "campaigns-os-runtime-recipe/v1",
   "recipe_kind": "campaigns-os-node-v1",
-  "recipe_revision": "1.0.2",
+  "recipe_revision": "1.0.3",
   "refusal_reason_code": "runtime_recipe_refused",
   "fail_closed": true,
   "unperformable_check_disposition": "failed",
@@ -106,6 +106,7 @@
     "fingerprint_algorithm": "sha256",
     "files": [
       "campaign-spec/analytics-vocabulary.ts",
+      "campaign-spec/checkout-flow.ts",
       "campaign-spec/index.ts",
       "campaign-spec/normalize.ts",
       "campaign-spec/package.json",
@@ -113,7 +114,9 @@
       "campaign-spec/rules/analytics-contract-shape.ts",
       "campaign-spec/rules/assembly-hints-shape.ts",
       "campaign-spec/rules/campaign-metadata.ts",
+      "campaign-spec/rules/checkout-forward-target.ts",
       "campaign-spec/rules/checkout-has-success-url.ts",
+      "campaign-spec/rules/checkout-step-reaches-checkout.ts",
       "campaign-spec/rules/cycle-detection.ts",
       "campaign-spec/rules/design-source-shape.ts",
       "campaign-spec/rules/downsell-without-upsell.ts",
@@ -124,9 +127,11 @@
       "campaign-spec/rules/funnel-weight-sum.ts",
       "campaign-spec/rules/index.ts",
       "campaign-spec/rules/offer-ref-integrity.ts",
+      "campaign-spec/rules/one-checkout-per-path.ts",
       "campaign-spec/rules/package-pricing-sanity.ts",
       "campaign-spec/rules/page-count.ts",
       "campaign-spec/rules/page-id-uniqueness.ts",
+      "campaign-spec/rules/pre-payment-forward-target.ts",
       "campaign-spec/rules/promo-code-input-validation.ts",
       "campaign-spec/rules/promo-codes-shape.ts",
       "campaign-spec/rules/route-field-ignored-for-page-type.ts",

package/contracts/fixtures/runtime-recipe/reject/unknown-output-check.json

@@ -3,7 +3,7 @@
   "_growth_note": "When a bound below is genuinely reached, the answer is to find out why before raising it. A dependency install that exceeds its bound on a warm machine is a supply-chain change, not a slow morning; an output inventory that exceeds its file or byte bound is a build that went wrong, not a package that grew 50x overnight. Raising a bound is the fallback, it advances recipe_revision, and it owes a release-ledger entry. Widening the accepted npm range follows the same path, and its trigger is external and checkable: widen when a Node release line ships that npm major by default, not when a particular machine happens to have it installed.",
   "schema": "campaigns-os-runtime-recipe/v1",
   "recipe_kind": "campaigns-os-node-v1",
-  "recipe_revision": "1.0.2",
+  "recipe_revision": "1.0.3",
   "refusal_reason_code": "runtime_recipe_refused",
   "fail_closed": true,
   "unperformable_check_disposition": "failed",
@@ -106,6 +106,7 @@
     "fingerprint_algorithm": "sha256",
     "files": [
       "campaign-spec/analytics-vocabulary.ts",
+      "campaign-spec/checkout-flow.ts",
       "campaign-spec/index.ts",
       "campaign-spec/normalize.ts",
       "campaign-spec/package.json",
@@ -113,7 +114,9 @@
       "campaign-spec/rules/analytics-contract-shape.ts",
       "campaign-spec/rules/assembly-hints-shape.ts",
       "campaign-spec/rules/campaign-metadata.ts",
+      "campaign-spec/rules/checkout-forward-target.ts",
       "campaign-spec/rules/checkout-has-success-url.ts",
+      "campaign-spec/rules/checkout-step-reaches-checkout.ts",
       "campaign-spec/rules/cycle-detection.ts",
       "campaign-spec/rules/design-source-shape.ts",
       "campaign-spec/rules/downsell-without-upsell.ts",
@@ -124,9 +127,11 @@
       "campaign-spec/rules/funnel-weight-sum.ts",
       "campaign-spec/rules/index.ts",
       "campaign-spec/rules/offer-ref-integrity.ts",
+      "campaign-spec/rules/one-checkout-per-path.ts",
       "campaign-spec/rules/package-pricing-sanity.ts",
       "campaign-spec/rules/page-count.ts",
       "campaign-spec/rules/page-id-uniqueness.ts",
+      "campaign-spec/rules/pre-payment-forward-target.ts",
       "campaign-spec/rules/promo-code-input-validation.ts",
       "campaign-spec/rules/promo-codes-shape.ts",
       "campaign-spec/rules/route-field-ignored-for-page-type.ts",

package/contracts/fixtures/runtime-recipe/reject/unknown-revision.json

@@ -106,6 +106,7 @@
     "fingerprint_algorithm": "sha256",
     "files": [
       "campaign-spec/analytics-vocabulary.ts",
+      "campaign-spec/checkout-flow.ts",
       "campaign-spec/index.ts",
       "campaign-spec/normalize.ts",
       "campaign-spec/package.json",
@@ -113,7 +114,9 @@
       "campaign-spec/rules/analytics-contract-shape.ts",
       "campaign-spec/rules/assembly-hints-shape.ts",
       "campaign-spec/rules/campaign-metadata.ts",
+      "campaign-spec/rules/checkout-forward-target.ts",
       "campaign-spec/rules/checkout-has-success-url.ts",
+      "campaign-spec/rules/checkout-step-reaches-checkout.ts",
       "campaign-spec/rules/cycle-detection.ts",
       "campaign-spec/rules/design-source-shape.ts",
       "campaign-spec/rules/downsell-without-upsell.ts",
@@ -124,9 +127,11 @@
       "campaign-spec/rules/funnel-weight-sum.ts",
       "campaign-spec/rules/index.ts",
       "campaign-spec/rules/offer-ref-integrity.ts",
+      "campaign-spec/rules/one-checkout-per-path.ts",
       "campaign-spec/rules/package-pricing-sanity.ts",
       "campaign-spec/rules/page-count.ts",
       "campaign-spec/rules/page-id-uniqueness.ts",
+      "campaign-spec/rules/pre-payment-forward-target.ts",
       "campaign-spec/rules/promo-code-input-validation.ts",
       "campaign-spec/rules/promo-codes-shape.ts",
       "campaign-spec/rules/route-field-ignored-for-page-type.ts",

package/contracts/fixtures/runtime-recipe/reject/unknown-step-id.json

@@ -3,7 +3,7 @@
   "_growth_note": "When a bound below is genuinely reached, the answer is to find out why before raising it. A dependency install that exceeds its bound on a warm machine is a supply-chain change, not a slow morning; an output inventory that exceeds its file or byte bound is a build that went wrong, not a package that grew 50x overnight. Raising a bound is the fallback, it advances recipe_revision, and it owes a release-ledger entry. Widening the accepted npm range follows the same path, and its trigger is external and checkable: widen when a Node release line ships that npm major by default, not when a particular machine happens to have it installed.",
   "schema": "campaigns-os-runtime-recipe/v1",
   "recipe_kind": "campaigns-os-node-v1",
-  "recipe_revision": "1.0.2",
+  "recipe_revision": "1.0.3",
   "refusal_reason_code": "runtime_recipe_refused",
   "fail_closed": true,
   "unperformable_check_disposition": "failed",
@@ -106,6 +106,7 @@
     "fingerprint_algorithm": "sha256",
     "files": [
       "campaign-spec/analytics-vocabulary.ts",
+      "campaign-spec/checkout-flow.ts",
       "campaign-spec/index.ts",
       "campaign-spec/normalize.ts",
       "campaign-spec/package.json",
@@ -113,7 +114,9 @@
       "campaign-spec/rules/analytics-contract-shape.ts",
       "campaign-spec/rules/assembly-hints-shape.ts",
       "campaign-spec/rules/campaign-metadata.ts",
+      "campaign-spec/rules/checkout-forward-target.ts",
       "campaign-spec/rules/checkout-has-success-url.ts",
+      "campaign-spec/rules/checkout-step-reaches-checkout.ts",
       "campaign-spec/rules/cycle-detection.ts",
       "campaign-spec/rules/design-source-shape.ts",
       "campaign-spec/rules/downsell-without-upsell.ts",
@@ -124,9 +127,11 @@
       "campaign-spec/rules/funnel-weight-sum.ts",
       "campaign-spec/rules/index.ts",
       "campaign-spec/rules/offer-ref-integrity.ts",
+      "campaign-spec/rules/one-checkout-per-path.ts",
       "campaign-spec/rules/package-pricing-sanity.ts",
       "campaign-spec/rules/page-count.ts",
       "campaign-spec/rules/page-id-uniqueness.ts",
+      "campaign-spec/rules/pre-payment-forward-target.ts",
       "campaign-spec/rules/promo-code-input-validation.ts",
       "campaign-spec/rules/promo-codes-shape.ts",
       "campaign-spec/rules/route-field-ignored-for-page-type.ts",

package/contracts/fixtures/runtime-recipe/reject/unperformable-check-skipped.json

@@ -3,7 +3,7 @@
   "_growth_note": "When a bound below is genuinely reached, the answer is to find out why before raising it. A dependency install that exceeds its bound on a warm machine is a supply-chain change, not a slow morning; an output inventory that exceeds its file or byte bound is a build that went wrong, not a package that grew 50x overnight. Raising a bound is the fallback, it advances recipe_revision, and it owes a release-ledger entry. Widening the accepted npm range follows the same path, and its trigger is external and checkable: widen when a Node release line ships that npm major by default, not when a particular machine happens to have it installed.",
   "schema": "campaigns-os-runtime-recipe/v1",
   "recipe_kind": "campaigns-os-node-v1",
-  "recipe_revision": "1.0.2",
+  "recipe_revision": "1.0.3",
   "refusal_reason_code": "runtime_recipe_refused",
   "fail_closed": true,
   "unperformable_check_disposition": "skipped",
@@ -106,6 +106,7 @@
     "fingerprint_algorithm": "sha256",
     "files": [
       "campaign-spec/analytics-vocabulary.ts",
+      "campaign-spec/checkout-flow.ts",
       "campaign-spec/index.ts",
       "campaign-spec/normalize.ts",
       "campaign-spec/package.json",
@@ -113,7 +114,9 @@
       "campaign-spec/rules/analytics-contract-shape.ts",
       "campaign-spec/rules/assembly-hints-shape.ts",
       "campaign-spec/rules/campaign-metadata.ts",
+      "campaign-spec/rules/checkout-forward-target.ts",
       "campaign-spec/rules/checkout-has-success-url.ts",
+      "campaign-spec/rules/checkout-step-reaches-checkout.ts",
       "campaign-spec/rules/cycle-detection.ts",
       "campaign-spec/rules/design-source-shape.ts",
       "campaign-spec/rules/downsell-without-upsell.ts",
@@ -124,9 +127,11 @@
       "campaign-spec/rules/funnel-weight-sum.ts",
       "campaign-spec/rules/index.ts",
       "campaign-spec/rules/offer-ref-integrity.ts",
+      "campaign-spec/rules/one-checkout-per-path.ts",
       "campaign-spec/rules/package-pricing-sanity.ts",
       "campaign-spec/rules/page-count.ts",
       "campaign-spec/rules/page-id-uniqueness.ts",
+      "campaign-spec/rules/pre-payment-forward-target.ts",
       "campaign-spec/rules/promo-code-input-validation.ts",
       "campaign-spec/rules/promo-codes-shape.ts",
       "campaign-spec/rules/route-field-ignored-for-page-type.ts",

package/contracts/fixtures/runtime-recipe/reject/unpinned-lockfile.json

@@ -3,7 +3,7 @@
   "_growth_note": "When a bound below is genuinely reached, the answer is to find out why before raising it. A dependency install that exceeds its bound on a warm machine is a supply-chain change, not a slow morning; an output inventory that exceeds its file or byte bound is a build that went wrong, not a package that grew 50x overnight. Raising a bound is the fallback, it advances recipe_revision, and it owes a release-ledger entry. Widening the accepted npm range follows the same path, and its trigger is external and checkable: widen when a Node release line ships that npm major by default, not when a particular machine happens to have it installed.",
   "schema": "campaigns-os-runtime-recipe/v1",
   "recipe_kind": "campaigns-os-node-v1",
-  "recipe_revision": "1.0.2",
+  "recipe_revision": "1.0.3",
   "refusal_reason_code": "runtime_recipe_refused",
   "fail_closed": true,
   "unperformable_check_disposition": "failed",
@@ -106,6 +106,7 @@
     "fingerprint_algorithm": "sha256",
     "files": [
       "campaign-spec/analytics-vocabulary.ts",
+      "campaign-spec/checkout-flow.ts",
       "campaign-spec/index.ts",
       "campaign-spec/normalize.ts",
       "campaign-spec/package.json",
@@ -113,7 +114,9 @@
       "campaign-spec/rules/analytics-contract-shape.ts",
       "campaign-spec/rules/assembly-hints-shape.ts",
       "campaign-spec/rules/campaign-metadata.ts",
+      "campaign-spec/rules/checkout-forward-target.ts",
       "campaign-spec/rules/checkout-has-success-url.ts",
+      "campaign-spec/rules/checkout-step-reaches-checkout.ts",
       "campaign-spec/rules/cycle-detection.ts",
       "campaign-spec/rules/design-source-shape.ts",
       "campaign-spec/rules/downsell-without-upsell.ts",
@@ -124,9 +127,11 @@
       "campaign-spec/rules/funnel-weight-sum.ts",
       "campaign-spec/rules/index.ts",
       "campaign-spec/rules/offer-ref-integrity.ts",
+      "campaign-spec/rules/one-checkout-per-path.ts",
       "campaign-spec/rules/package-pricing-sanity.ts",
       "campaign-spec/rules/page-count.ts",
       "campaign-spec/rules/page-id-uniqueness.ts",
+      "campaign-spec/rules/pre-payment-forward-target.ts",
       "campaign-spec/rules/promo-code-input-validation.ts",
       "campaign-spec/rules/promo-codes-shape.ts",
       "campaign-spec/rules/route-field-ignored-for-page-type.ts",