feat(marketing-sales): add Stamped.io reviews & loyalty connector

[andrei-hasna]

Summary

Adds @hasna/connect-stampedio, a first-class open-connectors package for the public Stamped.io REST API (product reviews, ratings, UGC, and loyalty for e-commerce). Rebuilt from public upstream API docs and existing open-connectors patterns (mirrors the recharge/reddit layout); no platform-alumia code was copied.

What's included

• Real API client (src/api/client.ts): HTTP Basic Auth (public key = username, private key = password), https://stamped.io/api base, /v2/{storeHash}/... merchant paths, plus an unauthenticated public widget request path (apiKey + storeUrl query params).
• Resources: reviews (dashboard list + public widget), customers (add), loyalty (award/deduct points via the transactions endpoint).
• CLI (connect-stampedio): commander entry with config, profile, reviews, customers, loyalty, whoami; json/table/pretty output; multi-store credential profiles under ~/.hasna/connectors/connect-stampedio/.
• Types/utils: typed models, profile-based config (env vars win), output formatting.
• Registry: stampedio registered under Marketing & Sales.
• Docs: README + CLAUDE.md. .env.example is placeholder-only.

Endpoints

Area	Method	Path	Auth
Reviews	GET	/v2/{storeHash}/dashboard/reviews	Basic
Reviews	GET	/widget/reviews	Public key
Customers	POST	/v2/{storeHash}/dashboard/customers/add	Basic
Loyalty	POST	/v2/{storeHash}/loyalty/transactions	Basic

Validation

• bun test (connector): 9 pass / 0 fail — fetch-stubbed transport tests assert Basic auth header, endpoints, and params.
• bunx tsc --noEmit: clean.
• bun run build: bundles src/index.ts + src/cli/index.ts.
• bun test src/lib/registry.test.ts src/index.test.ts: 84 pass / 0 fail (new registry entry resolves to connectors/stampedio/package.json v0.1.0).
• Risk checks: no browser-use/puppeteer/playwright dep, no alumia/internal references, no hardcoded secrets.

🤖 Generated with Claude Code

[andrei-hasna]

Blocked from automated merge after local validation and adversarial review.

Evidence checked:

• GitHub PR state: open, non-draft, MERGEABLE, merge state CLEAN; CI / build passed.
• Branch freshness: local refs show origin/main...origin/pr-288 = 295 1; a no-commit merge of origin/pr-288 onto current origin/main applied cleanly.
• Validation on the locally merged tree:
  • bun test connectors/stampedio/src/api/client.test.ts passed: 9 pass, 0 fail.
  • bun run typecheck in connectors/stampedio passed.
  • bun run build in connectors/stampedio passed.
  • root bun run typecheck passed.
  • root bun run build passed.
  • root bun test passed after build with isolated writable HOME: 2020 pass, 0 fail.
  • git diff --cached --check passed.
  • staged secret-pattern scan found no matches.

Blockers:

1. The connector auth model appears incompatible with current Stamped docs. connectors/stampedio/src/api/client.ts implements Basic Auth using publicKey:privateKey and sends Authorization: Basic ...; current Stamped docs say private API calls use StoreHash/ShopId plus private key in the stamped-api-key header.
2. Customer and loyalty paths appear incompatible with current docs. The PR uses /v2/{storeHash}/dashboard/customers/add and /v2/{storeHash}/loyalty/transactions; current docs show customer creation at /api/v3/merchant/shops/{shopId}/customers and points adjustment at /api/v3/loyalty/shops/{shopId}/customers/{customerId}/adjust-points.
3. Published package surface is broken. connectors/stampedio/package.json exports ./dist/index.js and ./dist/index.d.ts, but bun pm pack --dry-run includes bin/index.js and src/**, not dist/**, and the build script does not emit declarations.
4. Profile storage writes private credentials with default file permissions in connectors/stampedio/src/utils/config.ts; use owner-only mode (0o600) for files containing private API keys.
5. Tests currently lock in the disputed Basic Auth and endpoint paths, so the passing connector tests do not prove real API compatibility.
6. Policy note: the PR source commit contains a Co-Authored-By trailer. If this is later squash-merged, use a cleaned commit message without that trailer.

Recommendation: do not merge until auth/endpoints are corrected or justified against official Stamped legacy API references, package publish contents are fixed, credential file permissions are hardened, and tests are updated to validate the corrected contract.

[andrei-hasna]

Merge blocked after worker validation and independent adversarial review.

Validation performed on an integration merge against current origin/main:

• GitHub PR state: open, non-draft, mergeable/CLEAN; CI build check passed.
• Local integration merge: clean.
• bun test connectors/stampedio/src/api/client.test.ts: 9 pass / 0 fail.
• bun run --cwd connectors/stampedio typecheck: pass.
• bun run --cwd connectors/stampedio build: pass.
• bun run typecheck: pass.
• SKIP_DASHBOARD=1 bun run build: pass.
• Full bun test with isolated writable HOME=/tmp/open-connectors-pr288-home: 2063 pass / 0 fail.
• Secret/internal-reference/browser-automation scans over PR files: no hits.

Blockers:

1. Merchant auth contract appears wrong. Current Stamped docs say API access uses ShopId/StoreHash plus private API key in the stamped-api-key header, while this connector uses HTTP Basic auth built from public/private keys for merchant requests. Official docs: https://developers.stamped.io/docs/getting-started
2. Customer API path is current-doc incompatible. Current docs show POST https://stamped.io/api/v3/merchant/shops/#shopId/customers; this connector posts to /v2/{storeHash}/dashboard/customers/add. Official docs: https://developers.stamped.io/docs/customers-1
3. Loyalty point adjustment path/body is current-doc incompatible. Current docs show POST https://stamped.io/api/v3/loyalty/shops/#shopId/customers/*customerId/adjust-points with points/reason; this connector posts to /v2/{storeHash}/loyalty/transactions with email. Official docs: https://developers.stamped.io/docs/customer-actions-1
4. The source commit includes a Co-Authored-By trailer. Repo policy forbids those trailers, so after remediation this needs a sanitized squash/custom merge message or equivalent.

Follow-up task created for remediation: 1518e22a (Fix hasna/connectors#288 Stamped.io API contract before merge).