@tokenoftrust/storefront-runner 2.0.26 → 2.0.28

package/packages/public-runtime/src/integration/native-ga4.ts

@@ -6,12 +6,21 @@
  * or persist browser identity. A reviewed direct POST sends a closed, anonymous
  * payload to one exact collection origin after the shared broker has applied consent
  * and logical-event dedupe.
+ *
+ * A stage may configure SEVERAL measurement ids (a primary plus a rollup). GA4 has no
+ * multi-property hit — `tid` names exactly one measurement id — so one logical event
+ * becomes one POST per id, identical but for `tid`. The fan-out sits below the broker's
+ * dedupe, so a logical action is still measured exactly once per property.
  */
 import type { IntegrationLifecycleContext, IntegrationLifecycleModule, LifecycleUpdateReason } from "./lifecycle.js";
 import type { CommerceEvent, CommerceEventType } from "./events.js";
 import { APPROVED_MARKETING_ACTION_NAMES, validateCommerceEvent } from "./events.js";
 import { isPurposeEligible, parseConsentSnapshot } from "./consent-broker.js";
-import { destinationIdConfigKey, GOOGLE_MEASUREMENT_ADAPTER } from "./platform-adapters.js";
+import {
+  destinationIdConfigKey,
+  GOOGLE_MEASUREMENT_ADAPTER,
+  resolveAdapterDestinationIds,
+} from "./platform-adapters.js";
 import { INTEGRATION_ENVIRONMENTS, type IntegrationEnvironment } from "./environment.js";
 import { resemblesManagedAnalyticsPii } from "./managed-analytics-value-safety.js";
 
@@ -63,7 +72,8 @@ export interface NativeGa4ModuleOptions {
 }
 
 interface ActiveGa4Config {
-  destinationId: string;
+  /** Every measurement id this stage collects to, in configured order. */
+  destinationIds: readonly string[];
   environment: IntegrationEnvironment;
   siteSurface: IntegrationLifecycleContext["environment"]["siteSurface"];
 }
@@ -84,24 +94,28 @@ function configuredFor(ctx: IntegrationLifecycleContext): ActiveGa4Config | null
     if (!CONFIG_KEYS.has(key)) return null;
   }
 
-  const liveId = ctx.config[destinationIdConfigKey("live")];
-  if (typeof liveId !== "string" || !GOOGLE_MEASUREMENT_ADAPTER.validateId(liveId)) return null;
+  // Every stage present must decode to a valid, in-cap set, and no non-live stage may
+  // reuse ANY live id — checked across the whole config, not just the active stage, so a
+  // misconfigured neighbour resolves the entire integration to nothing rather than
+  // collecting from a page whose other stages would leak.
+  const liveIds = resolveAdapterDestinationIds(GOOGLE_MEASUREMENT_ADAPTER, ctx.config, "live");
+  if (liveIds.length === 0) return null;
+  const live = new Set(liveIds);
   for (const environment of INTEGRATION_ENVIRONMENTS) {
-    const value = ctx.config[destinationIdConfigKey(environment)];
-    if (value === undefined) continue;
-    if (typeof value !== "string" || !GOOGLE_MEASUREMENT_ADAPTER.validateId(value)) return null;
-    if (environment !== "live" && value === liveId) return null;
+    if (ctx.config[destinationIdConfigKey(environment)] === undefined) continue;
+    const ids = resolveAdapterDestinationIds(GOOGLE_MEASUREMENT_ADAPTER, ctx.config, environment);
+    if (ids.length === 0) return null;
+    if (environment !== "live" && ids.some((id) => live.has(id))) return null;
   }
 
-  const destinationId = ctx.config[destinationIdConfigKey(ctx.environment.environment)];
-  if (
-    typeof destinationId !== "string" ||
-    !GOOGLE_MEASUREMENT_ADAPTER.validateId(destinationId)
-  ) {
-    return null;
-  }
+  const destinationIds = resolveAdapterDestinationIds(
+    GOOGLE_MEASUREMENT_ADAPTER,
+    ctx.config,
+    ctx.environment.environment,
+  );
+  if (destinationIds.length === 0) return null;
   return {
-    destinationId,
+    destinationIds,
     environment: ctx.environment.environment,
     siteSurface: ctx.environment.siteSurface,
   };
@@ -134,28 +148,37 @@ function exactKeys(value: Record<string, unknown>, allowed: readonly string[]):
   return actual.length <= allowed.length && actual.every((key) => allowed.includes(key));
 }
 
-function mapEvent(config: ActiveGa4Config, input: unknown): NativeGa4CollectRequest | null {
+/**
+ * Build the collect requests one event becomes — ONE per configured measurement id.
+ *
+ * GA4 has no multi-property hit: `tid` names exactly one measurement id, so reaching a
+ * primary and a rollup means repeating the same closed payload with a different `tid`.
+ * Returns an empty list when the event does not map, so a caller cannot mistake "not
+ * measured" for "measured once".
+ */
+function mapEvent(config: ActiveGa4Config, input: unknown): NativeGa4CollectRequest[] {
   const validated = validateCommerceEvent(input);
-  if (!validated.ok) return null;
+  if (!validated.ok) return [];
   const event = validated.value;
-  if (!NATIVE_GA4_EVENT_SET.has(event.type)) return null;
-  if (event.storefront.emitter !== "browser") return null;
-  if (event.storefront.environment !== config.environment) return null;
-  if (event.storefront.siteSurface !== config.siteSurface) return null;
-  if (!event.consent.eligiblePurposes.includes("analytics")) return null;
-
+  if (!NATIVE_GA4_EVENT_SET.has(event.type)) return [];
+  if (event.storefront.emitter !== "browser") return [];
+  if (event.storefront.environment !== config.environment) return [];
+  if (event.storefront.siteSurface !== config.siteSurface) return [];
+  if (!event.consent.eligiblePurposes.includes("analytics")) return [];
+
+  // `tid` is the one field that differs between the fan-out requests; it is added per
+  // destination below.
   const fields: Record<string, string> = {
     v: "2",
-    tid: config.destinationId,
     cid: anonymousClientId(event),
   };
 
   if (event.type === "storefront.page.viewed.v1") {
-    if (!exactKeys(event.data, ["path"]) || typeof event.data["path"] !== "string") return null;
+    if (!exactKeys(event.data, ["path"]) || typeof event.data["path"] !== "string") return [];
     fields["en"] = "page_view";
     fields["ep.page_path"] = event.data["path"];
   } else if (event.type === "storefront.page.viewed.v2") {
-    if (!exactKeys(event.data, ["path", "attribution"]) || typeof event.data["path"] !== "string") return null;
+    if (!exactKeys(event.data, ["path", "attribution"]) || typeof event.data["path"] !== "string") return [];
     fields["en"] = "page_view";
     fields["ep.page_path"] = event.data["path"];
     const attribution = event.data["attribution"];
@@ -175,13 +198,16 @@ function mapEvent(config: ActiveGa4Config, input: unknown): NativeGa4CollectRequ
       }
     }
   } else {
-    if (!exactKeys(event.data, ["name"])) return null;
+    if (!exactKeys(event.data, ["name"])) return [];
     const name = event.data["name"];
-    if (typeof name !== "string" || !APPROVED_ACTION_SET.has(name)) return null;
+    if (typeof name !== "string" || !APPROVED_ACTION_SET.has(name)) return [];
     fields["en"] = name;
   }
 
-  return Object.freeze({ endpoint: GA4_COLLECTION_ENDPOINT, fields: Object.freeze(fields) });
+  return config.destinationIds.map((tid) => Object.freeze({
+    endpoint: GA4_COLLECTION_ENDPOINT,
+    fields: Object.freeze({ ...fields, tid }),
+  }));
 }
 
 /**
@@ -237,8 +263,8 @@ export function createNativeGa4Module(options: NativeGa4ModuleOptions): Integrat
             observeSafely(options.observe, "duplicate_suppressed");
             return;
           }
-          const request = mapEvent(current, event);
-          if (!request) {
+          const requests = mapEvent(current, event);
+          if (requests.length === 0) {
             observeSafely(options.observe, "event_rejected");
             return;
           }
@@ -248,13 +274,18 @@ export function createNativeGa4Module(options: NativeGa4ModuleOptions): Integrat
             const oldest = deliveredOrder.shift();
             if (oldest !== undefined) delivered.delete(oldest);
           }
-          try {
-            const result = options.transport(request);
-            if (result && typeof result.then === "function") {
-              void result.catch(() => observeSafely(options.observe, "transport_failed"));
+          // One logical event, one send per configured measurement id. Each send is
+          // independent: a destination whose transport fails is observed on its own and
+          // never suppresses the others.
+          for (const request of requests) {
+            try {
+              const result = options.transport(request);
+              if (result && typeof result.then === "function") {
+                void result.catch(() => observeSafely(options.observe, "transport_failed"));
+              }
+            } catch {
+              observeSafely(options.observe, "transport_failed");
             }
-          } catch {
-            observeSafely(options.observe, "transport_failed");
           }
         },
       },

package/packages/public-runtime/src/integration/platform-adapters.ts

@@ -23,10 +23,18 @@
  *     Meta each measure a logical page/cart/checkout action exactly once — never a
  *     duplicate, even with multiple adapters live.
  *
+ * A stage may name SEVERAL destinations, up to the adapter's own
+ * {@link PlatformAdapterDefinition.maxDestinationsPerStage}: a vendor that natively
+ * receives one event at several properties (a GA4 primary plus a rollup) fans one logical
+ * action out to each, while a single-valued adapter declares 1 and refuses a second id at
+ * config time. Fan-out happens strictly BELOW the broker, so dedupe is unaffected — the
+ * broker still delivers a logical action once, and the adapter turns that one delivery
+ * into one call per destination.
+ *
  * NON-LIVE SAFETY — by construction, two independent guards:
- *   1. Destination ids are per-ENVIRONMENT. {@link resolveAdapterDestinationId} returns
- *      the id for the CURRENT stage only, and {@link buildPlatformAdapterDeclaration}
- *      REFUSES a config where a non-live stage reuses the live id — so candidate/staged
+ *   1. Destination ids are per-ENVIRONMENT. {@link resolveAdapterDestinationIds} returns
+ *      the ids for the CURRENT stage only, and {@link buildPlatformAdapterDeclaration}
+ *      REFUSES a config where a non-live stage reuses ANY live id — so candidate/staged
  *      traffic can never reach the live property. A stage with no configured id fires
  *      nothing.
  *   2. Real conversions fire only on `live`. A conversion-class mapping
@@ -109,6 +117,15 @@ export interface PlatformAdapterDefinition {
   performanceBudget: PerformanceBudget;
   /** Human hint for the public destination-id field (e.g. "GA4 measurement id"). */
   idLabel: string;
+  /**
+   * How many destination ids ONE stage of this adapter may hold. `1` means
+   * single-valued: the adapter's runtime sends each event to exactly one destination and
+   * a second id is refused at config time. Above 1 the runtime fans one event out to
+   * every configured id for the active stage, which costs one vendor request each — so
+   * the cap must stay within {@link PlatformAdapterDefinition.performanceBudget}'s
+   * `maxAdditionalRequests`, and a test holds it there.
+   */
+  maxDestinationsPerStage: number;
   /** Validates the shape of a public destination id for this vendor. */
   validateId(id: string): boolean;
   /** The semantic commerce events this adapter measures, and their vendor mapping. */
@@ -142,6 +159,10 @@ export const GOOGLE_MEASUREMENT_ADAPTER: PlatformAdapterDefinition = Object.free
     mustBeAsyncOrDeferred: true,
   }),
   idLabel: "GA4 measurement id (e.g. G-XXXXXXX)",
+  // GA4 natively receives one event at several properties (a primary plus a rollup); the
+  // wire shape is one `/g/collect` request per measurement id, so the ceiling is the
+  // budget's own `maxAdditionalRequests`.
+  maxDestinationsPerStage: 4,
   validateId: (id: string) => GOOGLE_MEASUREMENT_ID.test(id),
   eventMap: Object.freeze({
     "storefront.page.viewed.v1": { vendorEvent: "page_view", isConversion: false },
@@ -172,6 +193,9 @@ export const META_PIXEL_ADAPTER: PlatformAdapterDefinition = Object.freeze({
     mustBeAsyncOrDeferred: true,
   }),
   idLabel: "Meta pixel id (15–16 digits)",
+  // Single-valued: this adapter's runtime initializes and sends to one pixel. Multi-pixel
+  // fbq is a separate reviewed change, not a config the merchant can reach today.
+  maxDestinationsPerStage: 1,
   validateId: (id: string) => META_PIXEL_ID.test(id),
   eventMap: Object.freeze({
     "storefront.page.viewed.v1": { vendorEvent: "PageView", isConversion: false },
@@ -203,6 +227,9 @@ export const AMPLITUDE_HTTP_ADAPTER: PlatformAdapterDefinition = Object.freeze({
     mustBeAsyncOrDeferred: true,
   }),
   idLabel: "Amplitude project API key (32 hexadecimal characters)",
+  // Single-valued: the reviewed HTTP transport carries one `api_key` per request and the
+  // budget allows one additional request, so a second project key has nowhere to go.
+  maxDestinationsPerStage: 1,
   validateId: (id: string) => AMPLITUDE_PROJECT_KEY.test(id),
   eventMap: Object.freeze({
     "storefront.page.viewed.v1": { vendorEvent: "page_view", isConversion: false },
@@ -242,22 +269,53 @@ export function destinationIdConfigKey(environment: IntegrationEnvironment): str
   return `${DESTINATION_ID_CONFIG_PREFIX}_${environment}`;
 }
 
+/**
+ * The separator that packs one stage's destination ids into ONE primitive public-config
+ * value.
+ *
+ * Browser public config is deliberately closed to primitives — `publicConfigSchema` in
+ * the shared manifest contract admits only string/number/integer/boolean, so no tenant
+ * can put structure into browser config. A multi-id stage therefore travels as a joined
+ * string rather than by widening that contract for every integration in the system.
+ * The encoding is unambiguous because no adapter's `validateId` accepts a value
+ * containing this character, and {@link resolveAdapterDestinationIds} re-validates every
+ * decoded element — so a hostile or malformed value fails closed exactly as one id does.
+ */
+export const DESTINATION_ID_SEPARATOR = "," as const;
+
 /** A merchant's per-environment public destination ids. `live` is required to publish. */
-export type DestinationIdsByEnvironment = Partial<Record<IntegrationEnvironment, string>>;
+export type DestinationIdsByEnvironment = Partial<Record<IntegrationEnvironment, readonly string[]>>;
+
+/** Pack one stage's ids into the single primitive public-config value they travel as. */
+export function encodeDestinationIds(ids: readonly string[]): string {
+  return ids.join(DESTINATION_ID_SEPARATOR);
+}
 
 /**
- * Resolve the destination id that fires for a specific stage from resolved public
- * config — the current stage's id ONLY. A stage with no configured id returns null,
- * so nothing fires there; because {@link buildPlatformAdapterDeclaration} refuses a
- * non-live stage that reuses the live id, this can never return the live id off a
- * non-live stage. This is the first non-live guard.
+ * Resolve the destination ids that fire for a specific stage from resolved public
+ * config — the current stage's ids ONLY, in configured order (index 0 is the primary).
+ * A stage with no configured ids returns an empty list, so nothing fires there; because
+ * {@link buildPlatformAdapterDeclaration} refuses a non-live stage that reuses any live
+ * id, this can never return a live id off a non-live stage. This is the first non-live
+ * guard.
+ *
+ * Fails CLOSED as a unit: if any decoded element is not a valid id for this adapter, or
+ * there are more than the adapter's declared cap, the whole stage resolves to nothing
+ * rather than to the subset that happened to parse — a partial fan-out would under-report
+ * while looking configured.
  */
-export function resolveAdapterDestinationId(
+export function resolveAdapterDestinationIds(
+  adapter: PlatformAdapterDefinition,
   publicConfig: Record<string, unknown>,
   environment: IntegrationEnvironment,
-): string | null {
+): readonly string[] {
   const value = publicConfig[destinationIdConfigKey(environment)];
-  return typeof value === "string" && value.length > 0 ? value : null;
+  if (typeof value !== "string" || value.length === 0) return [];
+  const ids = value.split(DESTINATION_ID_SEPARATOR);
+  if (ids.length > adapter.maxDestinationsPerStage) return [];
+  if (new Set(ids).size !== ids.length) return [];
+  if (!ids.every((id) => adapter.validateId(id))) return [];
+  return Object.freeze(ids);
 }
 
 // ── Declaration builder ───────────────────────────────────────────────────────
@@ -265,7 +323,7 @@ export function resolveAdapterDestinationId(
 /** What the admin surface supplies to configure one first-class adapter. */
 export interface PlatformAdapterConfigInput {
   adapterId: string;
-  /** Public destination ids per environment. `live` is required; non-live stages take SEPARATE test ids. */
+  /** Public destination ids per environment. `live` is required; non-live stages take SEPARATE test ids. One stage may name several, up to the adapter's cap. */
   ids: DestinationIdsByEnvironment;
   /** The tenant this adapter is configured for (server-resolved, never browser-set). */
   tenantPublicId: string;
@@ -281,6 +339,8 @@ export interface PlatformAdapterCard {
   publisher: string;
   supportUrl: string;
   idLabel: string;
+  /** How many destinations one stage may name — 1 for a single-valued adapter. */
+  maxDestinationsPerStage: number;
   /** Consent purposes the destination depends on — visible before publish. */
   consentPurposes: ConsentPurpose[];
   /** The performance budget the adapter must fit — visible before publish. */
@@ -296,8 +356,10 @@ export interface PlatformAdapterCard {
 /** One stage's measurement disposition — makes the non-live safety visible in the read model. */
 export interface AdapterStageBehavior {
   environment: IntegrationEnvironment;
-  /** True when a destination id is configured for this stage. */
+  /** True when at least one destination id is configured for this stage. */
   configured: boolean;
+  /** How many destinations one event fans out to on this stage. */
+  destinationCount: number;
   /** True only on `live`: the stage where real conversions fire. */
   firesRealConversions: boolean;
 }
@@ -326,11 +388,15 @@ function profileOrigins(profile: IntegrationCspProfile): string[] {
 
 /** The per-stage destination behavior, in canonical environment order. */
 function stageBehavior(ids: DestinationIdsByEnvironment): AdapterStageBehavior[] {
-  return INTEGRATION_ENVIRONMENTS.map((environment) => ({
-    environment,
-    configured: typeof ids[environment] === "string" && (ids[environment] as string).length > 0,
-    firesRealConversions: isLiveEnvironment(environment) && typeof ids[environment] === "string",
-  }));
+  return INTEGRATION_ENVIRONMENTS.map((environment) => {
+    const count = ids[environment]?.length ?? 0;
+    return {
+      environment,
+      configured: count > 0,
+      destinationCount: count,
+      firesRealConversions: isLiveEnvironment(environment) && count > 0,
+    };
+  });
 }
 
 /** Build the read-model card for an adapter definition + a merchant's configured ids. */
@@ -345,6 +411,7 @@ export function buildPlatformAdapterCard(
     publisher: def.publisher,
     supportUrl: def.supportUrl,
     idLabel: def.idLabel,
+    maxDestinationsPerStage: def.maxDestinationsPerStage,
     consentPurposes: [def.consentPurpose],
     performanceBudget: def.performanceBudget,
     cspOrigins: profileOrigins(def.cspProfile),
@@ -414,10 +481,10 @@ export function buildPlatformAdapterDeclaration(
   const schemaProps: Record<string, { type: string }> = {};
   const requiredKeys: string[] = [];
   for (const environment of INTEGRATION_ENVIRONMENTS) {
-    const id = ids[environment];
-    if (id === undefined) continue;
+    const stageIds = ids[environment];
+    if (stageIds === undefined || stageIds.length === 0) continue;
     const key = destinationIdConfigKey(environment);
-    publicConfig[key] = id;
+    publicConfig[key] = encodeDestinationIds(stageIds);
     schemaProps[key] = { type: "string" };
     requiredKeys.push(key);
   }
@@ -492,8 +559,12 @@ export function buildPlatformAdapterDeclaration(
 
 /**
  * Validate the per-environment public ids. `live` is required; every provided id must
- * match the adapter's shape; and NO non-live stage may reuse the live id — that is the
- * config-time guard that keeps candidate/staged traffic off the live property.
+ * match the adapter's shape; a stage may hold no more ids than the adapter declares; and
+ * NO non-live stage may reuse ANY live id — that is the config-time guard that keeps
+ * candidate/staged traffic off the live property.
+ *
+ * A failing id is named by its exact index, so a merchant with four ids learns which one
+ * is wrong rather than that the stage is wrong.
  */
 function validateDestinationIds(
   value: unknown,
@@ -501,7 +572,7 @@ function validateDestinationIds(
   v: Violations,
 ): DestinationIdsByEnvironment | undefined {
   if (!isPlainObject(value)) {
-    v.add("ids", "type", "ids must be an object of { environment: destinationId }.");
+    v.add("ids", "type", "ids must be an object of { environment: destinationId[] }.");
     return undefined;
   }
 
@@ -511,30 +582,60 @@ function validateDestinationIds(
       v.add(`ids.${key}`, "unknown_enum", `Unknown environment "${key}"; one of: ${INTEGRATION_ENVIRONMENTS.join(", ")}.`);
       continue;
     }
-    if (typeof raw !== "string" || raw.length === 0) {
-      v.add(`ids.${key}`, "type", "A destination id must be a non-empty string.");
+    if (!Array.isArray(raw)) {
+      v.add(`ids.${key}`, "type", "A stage's destination ids must be an array.");
+      continue;
+    }
+    if (raw.length === 0) {
+      v.add(`ids.${key}`, "empty", "A configured stage must name at least one destination id.");
+      continue;
+    }
+    if (raw.length > def.maxDestinationsPerStage) {
+      v.add(
+        `ids.${key}`,
+        "too_many_destinations",
+        def.maxDestinationsPerStage === 1
+          ? `${def.name} sends to one destination per stage; "${key}" names ${raw.length}.`
+          : `The "${key}" stage names ${raw.length} destinations; ${def.name} accepts at most ${def.maxDestinationsPerStage} per stage.`,
+      );
       continue;
     }
-    if (!def.validateId(raw)) {
-      v.add(`ids.${key}`, "format", `"${raw}" is not a valid ${def.idLabel}.`);
+    let stageOk = true;
+    raw.forEach((id, index) => {
+      if (typeof id !== "string" || id.length === 0) {
+        v.add(`ids.${key}[${index}]`, "type", "A destination id must be a non-empty string.");
+        stageOk = false;
+        return;
+      }
+      if (!def.validateId(id)) {
+        v.add(`ids.${key}[${index}]`, "format", `"${id}" is not a valid ${def.idLabel}.`);
+        stageOk = false;
+      }
+    });
+    if (!stageOk) continue;
+    const ids = raw as string[];
+    if (new Set(ids).size !== ids.length) {
+      v.add(`ids.${key}`, "duplicate", `The "${key}" stage names the same destination id twice; each event would be counted once per duplicate.`);
       continue;
     }
-    out[key as IntegrationEnvironment] = raw;
+    out[key as IntegrationEnvironment] = ids;
   }
 
-  const liveId = out["live"];
-  if (liveId === undefined) {
+  const liveIds = out["live"];
+  if (liveIds === undefined) {
     v.add("ids.live", "required", "A live destination id is required to publish this adapter.");
   } else {
+    const live = new Set(liveIds);
     for (const environment of INTEGRATION_ENVIRONMENTS) {
       if (environment === "live") continue;
-      if (out[environment] === liveId) {
+      (out[environment] ?? []).forEach((id, index) => {
+        if (!live.has(id)) return;
         v.add(
-          `ids.${environment}`,
+          `ids.${environment}[${index}]`,
           "non_live_reuses_live_id",
-          `The "${environment}" stage reuses the live destination id; non-live traffic must never reach the live property. Use a separate test id or leave it unset.`,
+          `The "${environment}" stage reuses live destination id "${id}"; non-live traffic must never reach the live property. Use a separate test id or leave it unset.`,
         );
-      }
+      });
     }
   }
 
@@ -553,7 +654,7 @@ function blocked(
 /** One mapped vendor call the adapter's entry module makes. */
 export interface VendorCall {
   adapterId: string;
-  /** The public destination id for the CURRENT stage this call targets. */
+  /** The ONE public destination id, for the CURRENT stage, this call targets. */
   destinationId: string;
   /** The vendor's own event name. */
   vendorEvent: string;
@@ -589,9 +690,9 @@ export interface CreateAdapterDestinationInput {
  * broker's, shared with every other destination.
  *
  * The handler is the non-live enforcement point: it fires only to the CURRENT stage's
- * destination id (never the live id off a non-live stage), and drops conversion-class
+ * destination ids (never a live id off a non-live stage), and drops conversion-class
  * events on every non-live stage — so a candidate/staged page never fires a real
- * conversion.
+ * conversion. One delivered event becomes one dispatch per configured destination.
  */
 export function createAdapterDestination(
   input: CreateAdapterDestinationInput,
@@ -604,30 +705,32 @@ export function createAdapterDestination(
     sink: {
       kind: "callback",
       handler: (event: CommerceEvent) => {
-        const call = mapCommerceEventToVendorCall(adapter, publicConfig, environment, event);
-        if (call) dispatch(call);
+        for (const call of mapCommerceEventToVendorCalls(adapter, publicConfig, environment, event)) {
+          dispatch(call);
+        }
       },
     },
   };
 }
 
 /**
- * Map one delivered commerce event to a vendor call, applying both non-live guards.
- * Returns null (no vendor call) when: the current stage has no destination id; the
- * event type is not in the adapter's map; or the mapping is a conversion on a non-live
- * stage. Pure — exported so the mapping + non-live gating are directly testable.
+ * Map one delivered commerce event to the vendor calls it becomes — ONE per destination
+ * id configured for the current stage, in configured order — applying both non-live
+ * guards. Returns an empty list when: the current stage has no destination ids; the event
+ * type is not in the adapter's map; or the mapping is a conversion on a non-live stage.
+ * Pure — exported so the mapping, fan-out, and non-live gating are directly testable.
  */
-export function mapCommerceEventToVendorCall(
+export function mapCommerceEventToVendorCalls(
   adapter: PlatformAdapterDefinition,
   publicConfig: Record<string, unknown>,
   environment: BrowserEnvironment,
   event: CommerceEvent,
-): VendorCall | null {
-  const destinationId = resolveAdapterDestinationId(publicConfig, environment.environment);
-  if (!destinationId) return null;
+): VendorCall[] {
+  const destinationIds = resolveAdapterDestinationIds(adapter, publicConfig, environment.environment);
+  if (destinationIds.length === 0) return [];
 
   const mapping = adapter.eventMap[event.type];
-  if (!mapping) return null;
+  if (!mapping) return [];
 
   let vendorEvent = mapping.vendorEvent;
   if (
@@ -638,15 +741,15 @@ export function mapCommerceEventToVendorCall(
     if (
       typeof name !== "string" ||
       !(APPROVED_MARKETING_ACTION_NAMES as readonly string[]).includes(name)
-    ) return null;
+    ) return [];
     vendorEvent = name;
   }
 
   // Guard 2: real conversions fire only on live. A non-live stage never fires a real
   // conversion, even to a configured test id.
-  if (mapping.isConversion && !isLiveEnvironment(environment.environment)) return null;
+  if (mapping.isConversion && !isLiveEnvironment(environment.environment)) return [];
 
-  return {
+  return destinationIds.map((destinationId) => ({
     adapterId: adapter.adapterId,
     destinationId,
     vendorEvent,
@@ -654,7 +757,7 @@ export function mapCommerceEventToVendorCall(
     logicalId: event.id,
     data: event.data,
     isConversion: mapping.isConversion,
-  };
+  }));
 }
 
 /**

package/packages/public-runtime/tests/fixtures/integration/managed-analytics-v1/fake-adapter-catalog.json

@@ -16,19 +16,27 @@
             "label": "Dataset id",
             "description": "Public identifier for the fake dataset.",
             "kind": "string",
-            "required": true
+            "required": true,
+            "maxEntries": 1
           },
           {
             "key": "sampleRate",
             "label": "Sample rate",
             "description": "Integer sampling percentage.",
             "kind": "integer",
-            "required": false
+            "required": false,
+            "maxEntries": 1
           }
         ],
-        "eventTypes": ["storefront.page.viewed.v1"],
-        "consentPurposes": ["analytics"],
-        "collectionOrigins": ["https://collector.invalid"]
+        "eventTypes": [
+          "storefront.page.viewed.v1"
+        ],
+        "consentPurposes": [
+          "analytics"
+        ],
+        "collectionOrigins": [
+          "https://collector.invalid"
+        ]
       }
     ]
   }