@nextcommerce/campaigns-os 1.61.0 → 1.63.0

package/src/qa-sidecar.mjs

@@ -1,12 +1,14 @@
 import { localSpecIdentityFields } from "./spec-source-identity.mjs";
 import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { randomUUID } from "node:crypto";
-import { dirname, join, resolve } from "node:path";
+import { basename, dirname, join, resolve } from "node:path";
 
+import { packetRuntimeRelPath } from "./campaign-workspace.mjs";
 import { deriveExceptions, validateVerdict } from "./qa-verdict.mjs";
 
 // The committed QA verdict sidecar: `.campaign-runtime/qa-verdict.json` beside
-// the Build Packet, the artifact campaigns-agent's readback projects. Full
+// the Build Packet (under the packet's own runtime directory when it is one
+// of several funnels in its project), the artifact campaigns-agent's readback projects. Full
 // verdicts under qa-output/ are gitignored because they carry live storefront
 // URLs, request evidence, and order references; the sidecar is committed to
 // merchant repos, so it is an allowlist PROJECTION of one verdict, never a
@@ -100,8 +102,18 @@ export function projectVerdictForSidecar(verdict, { generatedAt }) {
   };
 }
 
-export function sidecarPathForPacket(packetPath) {
-  return join(dirname(resolve(packetPath)), SIDECAR_RELATIVE_PATH);
+// `packet` is read from `packetPath` when not given; an unreadable packet
+// names the project-level location, which the writers refuse before using.
+export function sidecarPathForPacket(packetPath, packet = readPacketOrNull(packetPath)) {
+  return join(dirname(resolve(packetPath)), packetRuntimeRelPath(packet), basename(SIDECAR_RELATIVE_PATH));
+}
+
+function readPacketOrNull(packetPath) {
+  try {
+    return JSON.parse(readFileSync(resolve(packetPath), "utf8"));
+  } catch {
+    return null;
+  }
 }
 
 const PACKET_SCHEMA = "campaign-runtime-build-packet/v0";

package/src/qa-vendor-beacons.mjs

@@ -0,0 +1,232 @@
+// Keeping test orders out of vendor data (campaigns-os#689, #683 item 5).
+//
+// A `qa run --test-order` run places real orders, and the page under test
+// reports each purchase to every analytics vendor the campaign configures. By
+// default every browser context the run opens answers requests to the listed
+// vendor beacon endpoints (qa-vendor-endpoints.mjs) with a local 204, so they
+// never reach the vendor. Loader scripts pass through. `--vendor-beacons live`
+// turns that off.
+//
+// Either way each request to a listed endpoint is recorded, and the verdict
+// carries the record as evidence: per vendor, how many requests, whether one
+// named a purchase, the ids and event names, plus the configured vendors never
+// seen and the vendors the list does not intercept. It is evidence only
+// (decided 2026-10-29): "the page sent it" is never vendor purchase proof and
+// never a blocker, since an answered request proves the page sent it, not that
+// the vendor received it. Purchase proof stays with effectivePurchase.
+//
+// The intercepted requests still reach the page's own request listeners, so
+// attachAnalyticsCapture's tagFires (via classifyTagFire) see them too.
+//
+// Page-method-only, like qa-analytics-parity.mjs: no playwright import.
+
+import { refused } from "./lifecycle.mjs";
+import { SEVERITY, STATUS } from "./qa-verdict.mjs";
+import { configuredVendors, INTERCEPTED_VENDORS, NOT_INTERCEPTED_VENDORS, readVendorBeacon, VENDOR_KEYS, vendorBeaconFor } from "./qa-vendor-endpoints.mjs";
+
+// The run's ledger rides on args under this key, like QA_RUN_CURRENCY, so every
+// browser leg of one `qa run` records into the same one.
+export const QA_VENDOR_BEACONS = Symbol("qa run --vendor-beacons");
+
+export const VENDOR_BEACON_MODES = Object.freeze({
+  INTERCEPT: "intercept",
+  LIVE: "live",
+});
+
+// Kept per vendor; past these the counts still grow but no new value is kept.
+const MAX_VALUES = 10;
+
+// "intercept" or "live" for a run that drives browser test orders, null for
+// one that does not (nothing is routed or recorded then). Any --vendor-beacons
+// value but `live` is refused before anything runs, and so is the flag on a
+// run with no browser test order, where it would do nothing.
+export function vendorBeaconMode(args = {}) {
+  const flagged = Object.hasOwn(args, "vendor-beacons");
+  if (flagged) {
+    const value = args["vendor-beacons"];
+    if (typeof value !== "string" || value.trim().toLowerCase() !== VENDOR_BEACON_MODES.LIVE) {
+      const got = typeof value === "string" && value !== "" ? JSON.stringify(value) : "no value";
+      throw refused(`--vendor-beacons takes one value, live, which lets test-order runs send to the analytics vendors (got ${got}). Leave the flag off to answer vendor beacons locally.`);
+    }
+  }
+  const testOrder = String(args["test-order"] ?? "off").toLowerCase();
+  if (!testOrder || testOrder === "off" || testOrder === "false") {
+    if (flagged) throw refused("--vendor-beacons live applies only to a browser test-order run (--test-order <mode>); this run places no browser test orders and routes no vendor beacons. Drop --vendor-beacons, or add --test-order.");
+    return null;
+  }
+  return flagged ? VENDOR_BEACON_MODES.LIVE : VENDOR_BEACON_MODES.INTERCEPT;
+}
+
+// The per-run record. `configured` is the vendor keys the CampaignSpec
+// analytics block declares.
+export function createVendorBeaconLedger({ mode, analytics = null } = {}) {
+  const vendors = new Map();
+  return {
+    mode,
+    configured: configuredVendors(analytics),
+    vendors,
+    record(read) {
+      if (!read) return;
+      let entry = vendors.get(read.vendor);
+      if (!entry) {
+        entry = { requests: 0, purchase: read.purchase === null ? null : false, ids: new Set(), events: new Set(), endpoints: new Set() };
+        vendors.set(read.vendor, entry);
+      }
+      entry.requests += 1;
+      if (read.purchase === true) entry.purchase = true;
+      const keep = (set, values) => { for (const value of values) if (set.size < MAX_VALUES) set.add(value); };
+      keep(entry.ids, read.ids);
+      keep(entry.events, read.events);
+      keep(entry.endpoints, [read.endpoint]);
+    },
+  };
+}
+
+// The ledger to record into for this run, or null when nothing is routed.
+export function vendorBeaconLedgerFor(args) {
+  return args?.[QA_VENDOR_BEACONS] || null;
+}
+
+function postDataOf(request) {
+  try {
+    const body = typeof request.postData === "function" ? request.postData() : null;
+    return typeof body === "string" ? body : null;
+  } catch {
+    return null;
+  }
+}
+
+function headerOf(request, name) {
+  try {
+    const headers = typeof request.headers === "function" ? request.headers() : {};
+    return headers?.[name] || null;
+  } catch {
+    return null;
+  }
+}
+
+// The local answer: 204 with CORS headers for the requesting origin, so a
+// beacon sent by fetch or XHR with credentials settles as a success rather
+// than an error the vendor script retries.
+function localAnswer(request) {
+  const origin = headerOf(request, "origin");
+  return {
+    status: 204,
+    headers: {
+      ...(origin
+        ? { "access-control-allow-origin": origin, "access-control-allow-credentials": "true", vary: "Origin" }
+        : { "access-control-allow-origin": "*" }),
+      "access-control-allow-methods": "GET, POST, OPTIONS",
+      "access-control-allow-headers": headerOf(request, "access-control-request-headers") || "content-type",
+    },
+    body: "",
+  };
+}
+
+function methodOf(request) {
+  try { return String(request.method()).toUpperCase(); } catch { return "GET"; }
+}
+
+// Route one browser context for the run. Intercept mode answers every request
+// to a listed beacon endpoint locally and records it; anything else falls
+// through to the context's other routes or the network. Live mode routes
+// nothing and records the requests as they go out. Routing a context turns off
+// its HTTP cache, which no QA check relies on (each leg opens a fresh context).
+export async function routeVendorBeacons(context, ledger) {
+  if (!context || !ledger) return context;
+  const recordRequest = (request) => {
+    if (methodOf(request) === "OPTIONS") return;
+    ledger.record(readVendorBeacon(request.url(), postDataOf(request)));
+  };
+  if (ledger.mode === VENDOR_BEACON_MODES.LIVE) {
+    context.on("request", (request) => {
+      if (vendorBeaconFor(request.url())) recordRequest(request);
+    });
+    return context;
+  }
+  await context.route((url) => Boolean(vendorBeaconFor(url.href)), async (route) => {
+    const request = route.request();
+    recordRequest(request);
+    await route.fulfill(localAnswer(request));
+  });
+  return context;
+}
+
+// A browser whose every new context is routed for the run. The browser itself
+// comes back unchanged when the run routes nothing. In intercept mode the
+// context also blocks service workers: context.route does not see a request a
+// service worker handles, so a page's worker could otherwise pass a beacon
+// through to the vendor.
+export function withVendorBeaconRouting(browser, ledger) {
+  if (!browser || !ledger) return browser;
+  const newContext = browser.newContext.bind(browser);
+  const intercept = ledger.mode !== VENDOR_BEACON_MODES.LIVE;
+  return new Proxy(browser, {
+    get(target, key, receiver) {
+      if (key === "newContext") {
+        return async (options, ...rest) => routeVendorBeacons(
+          await newContext(intercept ? { ...(options || {}), serviceWorkers: "block" } : options, ...rest),
+          ledger,
+        );
+      }
+      const value = Reflect.get(target, key, receiver);
+      return typeof value === "function" ? value.bind(target) : value;
+    },
+  });
+}
+
+// The verdict's evidence for the run.
+export function vendorBeaconEvidence(ledger) {
+  const vendors = {};
+  for (const [vendor, entry] of ledger.vendors) {
+    vendors[vendor] = {
+      requests: entry.requests,
+      purchase_seen: entry.purchase,
+      ids: [...entry.ids],
+      events: [...entry.events],
+      endpoints: [...entry.endpoints],
+    };
+  }
+  // Only a vendor with listed beacon endpoints can be seen; a configured vendor
+  // without them (GTM, Northbeam) is named under configured_not_observable,
+  // never as one that sent nothing.
+  const observable = (vendor) => INTERCEPTED_VENDORS.includes(vendor);
+  const unlisted = new Map(NOT_INTERCEPTED_VENDORS.map((entry) => [entry.vendor, entry.reason]));
+  return {
+    mode: ledger.mode,
+    vendors,
+    configured: [...ledger.configured],
+    configured_not_seen: ledger.configured.filter((vendor) => observable(vendor) && !ledger.vendors.has(vendor)),
+    configured_not_observable: ledger.configured.filter((vendor) => !observable(vendor)),
+    // In live mode nothing is intercepted, so every vendor is listed; the
+    // unlisted ones keep their own reason.
+    not_intercepted: ledger.mode === VENDOR_BEACON_MODES.LIVE
+      ? VENDOR_KEYS.map((vendor) => ({ vendor, reason: unlisted.get(vendor) || "--vendor-beacons live" }))
+      : NOT_INTERCEPTED_VENDORS.map((entry) => ({ ...entry })),
+  };
+}
+
+function list(values) {
+  return values.length ? values.join(", ") : "none";
+}
+
+// One informational row on the verdict. It never fails and never blocks.
+export function vendorBeaconAssertion(ledger) {
+  const evidence = vendorBeaconEvidence(ledger);
+  const seen = Object.entries(evidence.vendors).map(([vendor, entry]) => `${vendor} ${entry.requests}${entry.purchase_seen ? " (purchase)" : ""}`);
+  const live = ledger.mode === VENDOR_BEACON_MODES.LIVE;
+  const configured = new Set(evidence.configured);
+  const notIntercepted = live ? "" : `; not intercepted: ${list(evidence.not_intercepted.map((entry) => `${entry.vendor}${configured.has(entry.vendor) ? " (configured)" : ""}`))}`;
+  return {
+    id: "browser-test-order:vendor-beacons",
+    family: "browser-test-order",
+    page: "campaign",
+    status: STATUS.PASS,
+    severity: SEVERITY.INFO,
+    expected: live
+      ? "vendor beacons sent to the vendors (--vendor-beacons live); requests recorded as evidence, not purchase proof"
+      : "vendor beacons answered locally, so test orders stay out of vendor data; requests recorded as evidence, not purchase proof",
+    actual: `${live ? "sent" : "answered locally"}: ${list(seen)}; configured, never seen: ${list(evidence.configured_not_seen)}${notIntercepted}`,
+    evidence,
+  };
+}

package/src/qa-vendor-endpoints.mjs

@@ -0,0 +1,306 @@
+// The analytics vendor endpoints a `qa run --test-order` run holds back
+// (campaigns-os#689, #683 item 5): one list, read by the browser router that
+// answers the beacons locally and by classifyTagFire, so the tag inventory,
+// parity and the verdict's vendor evidence all read the same requests.
+//
+// Vendor keys are the `analytics.vendors` keys Map Builder emits for the
+// starter-template vendor adapters (its Route C vendor registry), plus `gtm`
+// and `meta` for the SDK providers.
+//
+// Each entry:
+//   - loaders: requests that load the vendor's script. They always pass
+//     through: a blocked loader means the vendor function never exists, the
+//     adapter stays inactive and the run proves nothing.
+//   - beacons: requests that send data to the vendor, matched by host (or a
+//     subdomain of it) plus a path prefix, because some hosts serve both
+//     (analytics.tiktok.com). A loader match always wins over a beacon match.
+//   - id / event: the parameter carrying the vendor id and the event name,
+//     read from the query string first and then from the request body (a JSON
+//     object or array, dotted paths allowed, or URL-encoded lines). `idPath`
+//     reads the id from the URL path instead. null when the request does not
+//     name it in a field we could confirm.
+//   - purchaseEvents: the event names that mean a purchase for that vendor,
+//     as the starter-template adapters send them.
+//   - source: where the beacon endpoints were confirmed. Only an endpoint read
+//     from the vendor's public loader source or public documentation is wired
+//     in; a vendor with none is reported as not intercepted, by name, with
+//     `reason`.
+//
+// Loader sources were fetched read-only with curl on 2026-10-29 and read, never
+// executed.
+
+export const VENDOR_KEYS = Object.freeze([
+  "gtm",
+  "meta",
+  "ga4",
+  "axon",
+  "taboola",
+  "triplewhale",
+  "tiktok",
+  "northbeam",
+  "snap",
+  "pinterest",
+]);
+
+export const VENDOR_ENDPOINTS = Object.freeze([
+  {
+    vendor: "gtm",
+    loaders: [{ host: "www.googletagmanager.com", path: "/gtm.js" }],
+    beacons: [],
+    id: null,
+    event: null,
+    purchaseEvents: [],
+    reason: "GTM sends no beacon of its own; each tag it loads sends to that tag's vendor, held back here only when the vendor is listed",
+  },
+  {
+    vendor: "meta",
+    loaders: [{ host: "connect.facebook.net", path: "/" }],
+    beacons: [
+      { host: "www.facebook.com", path: "/tr" },
+      { host: "www.facebook.com", path: "/privacy_sandbox/" },
+    ],
+    id: "id",
+    event: "ev",
+    purchaseEvents: ["Purchase"],
+    source: "fbevents.js (connect.facebook.net/en_US/fbevents.js) sends to https://www.facebook.com/tr and https://www.facebook.com/privacy_sandbox/…; id is the pixel id, ev the event name",
+  },
+  {
+    vendor: "ga4",
+    loaders: [{ host: "www.googletagmanager.com", path: "/gtag/js" }],
+    beacons: [
+      { host: "google-analytics.com", path: "/g/" },
+      { host: "analytics.google.com", path: "/g/" },
+      { host: "stats.g.doubleclick.net", path: "/g/" },
+      { host: "www.google.com", path: "/g/collect" },
+    ],
+    id: "tid",
+    event: "en",
+    purchaseEvents: ["purchase", "upsell_purchase"],
+    source: "gtag.js (www.googletagmanager.com/gtag/js) builds https://<region>.google-analytics.com/g/collect, https://analytics.google.com/g/collect and https://stats.g.doubleclick.net/g/collect, and retries a failed send at https://www.google.com/g/collect; tid is the measurement id, en the event name (batched events carry one en per body line)",
+  },
+  {
+    vendor: "axon",
+    loaders: [
+      { host: "s.axon.ai", path: "/" },
+      { host: "c.albss.com", path: "/" },
+      { host: "res4.applovin.com", path: "/" },
+    ],
+    beacons: [{ host: "b.applovin.com", path: "/v1/pixel" }],
+    id: "event_key",
+    // The payload is built through an obfuscated string table, so the field
+    // carrying the event name could not be confirmed.
+    event: null,
+    purchaseEvents: ["purchase"],
+    source: "pixel.js (s.axon.ai/pixel.js) sends to https://b.applovin.com/v1/pixel?event_key=<key>; loader.iife.js (c.albss.com) only loads scripts from res4.applovin.com",
+  },
+  {
+    vendor: "taboola",
+    loaders: [{ host: "cdn.taboola.com", path: "/" }],
+    beacons: [{ host: "trc.taboola.com", path: "/" }],
+    id: null,
+    idPath: /^\/(\d+)\//,
+    event: "en",
+    purchaseEvents: ["make_purchase", "upsell_purchase"],
+    source: "tfa.js (cdn.taboola.com/libtrc/unip/<account>/tfa.js) sends to https://trc.taboola.com/<account>/log/3/<type> and trc.taboola.com/sg/; the event name rides as en",
+  },
+  {
+    vendor: "triplewhale",
+    // /first returns the pixel source the base snippet evals; conf. serves its
+    // config model.
+    loaders: [
+      { host: "api.config-security.com", path: "/first" },
+      { host: "conf.config-security.com", path: "/" },
+    ],
+    // The purchase request's path is not readable in the obfuscated pixel, so
+    // every non-loader path on the API host is held back.
+    beacons: [
+      { host: "api.config-security.com", path: "/" },
+      { host: "api.whaledb.io", path: "/keep-alive" },
+    ],
+    id: "host",
+    event: "action",
+    purchaseEvents: ["Purchase", "UpsellPurchase"],
+    source: "the Triple Pixel headless base snippet (starter-template analytics-head.html) POSTs JSON {action, host, …} to https://api.config-security.com/event and loads the pixel from /first; the pixel's decoded string table names https://api.config-security.com and https://api.whaledb.io/keep-alive",
+  },
+  {
+    vendor: "tiktok",
+    loaders: [{ host: "analytics.tiktok.com", path: "/i18n/pixel/" }],
+    beacons: [
+      { host: "analytics.tiktok.com", path: "/api/v2/" },
+      { host: "analytics-ipv6.tiktokw.us", path: "/" },
+    ],
+    id: "context.pixel.code",
+    event: "event",
+    purchaseEvents: ["Purchase", "CompletePayment"],
+    source: "the TikTok pixel main script (analytics.tiktok.com/i18n/pixel/static/main.<id>.js) sends to https://analytics.tiktok.com/api/v2/pixel (and /api/v2/performance, /interaction, /monitor, /pixel/act) and https://analytics-ipv6.tiktokw.us/ipv6/enrich_ipv6; the JSON body carries event and context.pixel.code",
+  },
+  {
+    vendor: "northbeam",
+    loaders: [{ host: "j.northbeam.io", path: "/" }],
+    beacons: [],
+    id: null,
+    event: null,
+    purchaseEvents: [],
+    reason: "beacon endpoint unconfirmed: the loader (j.northbeam.io/ota-sp/<client id>.js) is per client and the public Northbeam docs name no beacon host",
+  },
+  {
+    vendor: "snap",
+    loaders: [{ host: "sc-static.net", path: "/" }],
+    beacons: [
+      { host: "tr.snapchat.com", path: "/" },
+      { host: "tr6.snapchat.com", path: "/" },
+      { host: "tr-shadow.snapchat.com", path: "/" },
+    ],
+    id: "pid",
+    event: "ev",
+    purchaseEvents: ["PURCHASE"],
+    source: "scevent.min.js (sc-static.net/scevent.min.js) sends to https://tr.snapchat.com (tr6. and tr-shadow. variants) at /p and /cm/*; the JSON body carries pid and ev",
+  },
+  {
+    vendor: "pinterest",
+    loaders: [
+      { host: "s.pinimg.com", path: "/" },
+      { host: "ct.pinterest.com", path: "/static/" },
+      { host: "ct.pinterest.com", path: "/ct.html" },
+    ],
+    beacons: [
+      { host: "ct.pinterest.com", path: "/v3/" },
+      { host: "ct.pinterest.com", path: "/user/" },
+      { host: "ct.pinterest.com", path: "/stats/" },
+    ],
+    id: "tid",
+    event: "event",
+    purchaseEvents: ["checkout"],
+    source: "core.js (s.pinimg.com/ct/core.js) loads s.pinimg.com/ct/lib/main.<hash>.js, which sends to https://ct.pinterest.com/v3/, /user/ and /stats/; Pinterest's base-code docs give the fallback https://ct.pinterest.com/v3/?event=init&tid=<tag id>",
+  },
+]);
+
+const BY_VENDOR = new Map(VENDOR_ENDPOINTS.map((entry) => [entry.vendor, entry]));
+
+// The vendors whose beacons are held back, and the ones that are not, with why.
+export const INTERCEPTED_VENDORS = Object.freeze(VENDOR_ENDPOINTS.filter((entry) => entry.beacons.length > 0).map((entry) => entry.vendor));
+export const NOT_INTERCEPTED_VENDORS = Object.freeze(
+  VENDOR_ENDPOINTS.filter((entry) => entry.beacons.length === 0).map((entry) => ({ vendor: entry.vendor, reason: entry.reason })),
+);
+
+// Bounds on what one request can contribute: the body read and the ids and
+// event names kept from it.
+const MAX_BODY_CHARS = 64 * 1024;
+const MAX_FIELD_CHARS = 128;
+
+export function vendorEndpoint(vendor) {
+  return BY_VENDOR.get(vendor) || null;
+}
+
+function hostMatches(host, suffix) {
+  return host === suffix || host.endsWith(`.${suffix}`);
+}
+
+// A path prefix matches whole segments: "/tr" is /tr and /tr/…, never /trust.
+function matches(matcher, host, path) {
+  if (!hostMatches(host, matcher.host)) return false;
+  const prefix = matcher.path;
+  return path === prefix || path.startsWith(prefix.endsWith("/") ? prefix : `${prefix}/`);
+}
+
+function parseUrl(value) {
+  try {
+    const url = new URL(String(value));
+    return url.protocol === "http:" || url.protocol === "https:" ? url : null;
+  } catch {
+    return null;
+  }
+}
+
+// The listed vendor whose BEACON this URL is, or null. A loader is never a
+// beacon, even on a host that also serves beacons.
+export function vendorBeaconFor(urlValue) {
+  const url = parseUrl(urlValue);
+  if (!url) return null;
+  const host = url.hostname.toLowerCase();
+  const path = url.pathname;
+  if (VENDOR_ENDPOINTS.some((entry) => entry.loaders.some((loader) => matches(loader, host, path)))) return null;
+  return VENDOR_ENDPOINTS.find((entry) => entry.beacons.some((beacon) => matches(beacon, host, path))) || null;
+}
+
+function boundedText(value) {
+  if (value === null || value === undefined) return null;
+  if (typeof value !== "string" && typeof value !== "number") return null;
+  const text = String(value).trim();
+  return text ? text.slice(0, MAX_FIELD_CHARS) : null;
+}
+
+// A request body as records: each JSON object (a top-level array is a batch)
+// or each URL-encoded line (GA4 batches one event per line).
+function bodyRecords(body) {
+  if (typeof body !== "string" || !body) return [];
+  const text = body.length > MAX_BODY_CHARS ? body.slice(0, MAX_BODY_CHARS) : body;
+  try {
+    const parsed = JSON.parse(text);
+    const list = Array.isArray(parsed) ? parsed : [parsed];
+    return list.filter((item) => item && typeof item === "object" && !Array.isArray(item)).map((item) => ({ json: item }));
+  } catch {
+    return text.split(/\r?\n/).filter(Boolean).map((line) => ({ params: new URLSearchParams(line) }));
+  }
+}
+
+function recordField(record, name) {
+  if (record.params) return record.params.get(name);
+  let value = record.json;
+  for (const key of name.split(".")) {
+    if (!value || typeof value !== "object") return null;
+    value = value[key];
+  }
+  return value;
+}
+
+// One request to a listed beacon endpoint, read for evidence: the vendor, the
+// ids and event names it carries, and whether one of those events is a
+// purchase (null when the entry reads no event name). Nothing else from the
+// URL or body is kept; `endpoint` is origin + path only.
+export function readVendorBeacon(urlValue, body = null) {
+  const entry = vendorBeaconFor(urlValue);
+  if (!entry) return null;
+  const url = parseUrl(urlValue);
+  const records = bodyRecords(body);
+  const read = (name) => {
+    if (!name) return [];
+    const values = [url.searchParams.get(name), ...records.map((record) => recordField(record, name))];
+    return [...new Set(values.map(boundedText).filter(Boolean))];
+  };
+  const ids = entry.idPath ? [boundedText(url.pathname.match(entry.idPath)?.[1])].filter(Boolean) : read(entry.id);
+  const events = read(entry.event);
+  return {
+    vendor: entry.vendor,
+    endpoint: `${url.origin}${url.pathname}`,
+    ids,
+    events,
+    purchase: entry.event ? events.some((event) => entry.purchaseEvents.includes(event)) : null,
+  };
+}
+
+// The vendors a CampaignSpec analytics block configures, as vendor keys:
+// analytics.vendors (the Map Builder shape), providers
+// keyed by vendor (facebook is meta) and out-of-band pixels. Disabled entries
+// and an analytics block switched off configure nothing.
+const VENDOR_ALIASES = Object.freeze({ facebook: "meta", triplepixel: "triplewhale", snapchat: "snap" });
+
+export function configuredVendors(analytics) {
+  if (!analytics || typeof analytics !== "object" || Array.isArray(analytics)) return [];
+  if (analytics.enabled === false || analytics.mode === "disabled") return [];
+  const found = new Set();
+  const add = (name) => {
+    const key = VENDOR_ALIASES[String(name).toLowerCase()] || String(name).toLowerCase();
+    if (BY_VENDOR.has(key)) found.add(key);
+  };
+  for (const block of [analytics.vendors, analytics.providers]) {
+    if (!block || typeof block !== "object" || Array.isArray(block)) continue;
+    for (const [name, value] of Object.entries(block)) {
+      if (value && typeof value === "object" && value.enabled !== false) add(name);
+    }
+  }
+  for (const pixel of Array.isArray(analytics.out_of_band_pixels) ? analytics.out_of_band_pixels : []) {
+    if (pixel?.vendor) add(pixel.vendor);
+  }
+  return VENDOR_KEYS.filter((key) => found.has(key));
+}

package/src/qc-accept.mjs

@@ -439,6 +439,34 @@ function readabilityReviewCrop(row) {
   return typeof ref?.path === "string" ? ref.path : undefined;
 }
 
+// A layout.conventions warning in words, from its observation: each
+// floating CTA container that holds more than its control, with what else it
+// holds, or each CTA label under the minimum size with its measured size.
+// Null for any other row.
+function layoutSummary(row) {
+  if (row?.check !== "layout.conventions" || row.result !== "warning" || !isPlainObject(row.observation)) return null;
+  const flagged = new Set((Array.isArray(row.members) ? row.members : []).filter((member) => member?.result === "warning").map((member) => member.key));
+  const where = `${row.subject?.page ?? "(no page)"}${row.subject?.viewport ? ` ${row.subject.viewport}` : ""}`;
+  if (row.subject?.key === "floating_cta") {
+    const containers = (Array.isArray(row.observation.containers) ? row.observation.containers : []).filter((entry) => flagged.has(entry?.selector_path));
+    if (!containers.length) return null;
+    const texts = containers.map((entry) => {
+      const controls = Array.isArray(entry.controls) ? entry.controls.length : 0;
+      const other = Array.isArray(entry.other_text) ? entry.other_text : [];
+      const more = Number.isInteger(entry.other_text_count) && entry.other_text_count > other.length ? `, +${entry.other_text_count - other.length} more` : "";
+      const text = entry.other_text_count ? `; other text ${other.join(", ")}${more}` : "";
+      return `${entry.selector_path} (${entry.position}) holds ${controls} control${controls === 1 ? "" : "s"}${text}`;
+    });
+    return `${where}: floating CTA should hold its control alone: ${texts.join(" | ")}`;
+  }
+  if (row.subject?.key === "cta_label_size") {
+    const small = (Array.isArray(row.observation.members) ? row.observation.members : []).filter((member) => flagged.has(member?.selector_path));
+    if (!small.length) return null;
+    return `${where}: CTA label under ${row.observation.min_font_size_px}px: ${small.map((member) => `${member.selector_path} ${member.font_size_px}px (${member.role})`).join(", ")}`;
+  }
+  return null;
+}
+
 function visualSummary(row) {
   const item = row.observation;
   if (!item || !row.check?.startsWith("visual.")) return null;
@@ -467,7 +495,7 @@ function handoffEntry(row) {
     reason_code: row.reason_code,
     accept_eligible: row.accept_eligible === true,
     members: Array.isArray(row.members) ? row.members : [],
-    summary: designAccessSummary(row) ?? parityRowSummary(row) ?? visualSummary(row) ?? readabilityPairSummary([row]) ?? `${row.check} ${row.result}${row.reason_code ? ` (${row.reason_code})` : ""} on ${row.subject?.page ?? "(no page)"}${row.subject?.key == null ? "" : `: ${row.subject.key}`}`,
+    summary: designAccessSummary(row) ?? parityRowSummary(row) ?? visualSummary(row) ?? layoutSummary(row) ?? readabilityPairSummary([row]) ?? `${row.check} ${row.result}${row.reason_code ? ` (${row.reason_code})` : ""} on ${row.subject?.page ?? "(no page)"}${row.subject?.key == null ? "" : `: ${row.subject.key}`}`,
     ...(crop === undefined ? {} : { crop }),
   };
 }

package/src/qc-check-registry.mjs

@@ -13,7 +13,8 @@
 // - Polish checks: the record's rules, {thresholds, vocabulary,
 //   evaluate(cell, thresholds) => Derived[]} (MEDIA_WEIGHT_QC_RULES for
 //   media_weight; READABILITY_QC_RULES for readability, which also carries
-//   the record's fixed producer values, limits and route set).
+//   the record's fixed producer values, limits and route set;
+//   LAYOUT_QC_RULES for the layout conventions read from the same record).
 // - Doctor checks recompute from the built HTML on every read and are called
 //   by doctor itself; their entries name the evaluator for completeness.
 //
@@ -39,6 +40,9 @@ export const QC_CHECK_REGISTRY = Object.freeze({
   "policy.availability": Object.freeze({ leg: "qa", unit: "1.4", module: "./qa-policy-links.mjs", rederive: "rederiveQcResult" }),
   // Text readability
   "readability.contrast": Object.freeze({ leg: "polish", unit: "2.4", module: "./polish-readability.mjs", rederive: "READABILITY_QC_RULES", record: "readability" }),
+  // Layout conventions (shared commerce brand contract), read from the
+  // readability record
+  "layout.conventions": Object.freeze({ leg: "polish", unit: "2.5", module: "./polish-readability.mjs", rederive: "LAYOUT_QC_RULES", record: "readability" }),
   "visual.reference": Object.freeze({ leg: "polish", unit: "3.2", module: "./polish-visual.mjs", rederive: "VISUAL_QC_RULES", record: "captures" }),
   "visual.diff": Object.freeze({ leg: "polish", unit: "3.4", module: "./polish-visual.mjs", rederive: "VISUAL_QC_RULES", record: "captures" }),
   // Element parity against the source HTML