@camstack/types 1.2.436 → 1.2.437

package/CHANGELOG.md

@@ -7,6 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.2.437] - 2026-10-28
+
+### Changed
+
+- The vendor sign-in proxy keeps the vendor's session cookie when the vendor also deletes a same-named cookie on another domain
+- An AI profile can turn the model's thinking off or set its effort
+
 ## [1.2.436] - 2026-10-28
 
 ### Changed

package/dist/capabilities/llm.cap.d.ts

@@ -63,6 +63,12 @@ export declare const LlmProfileSchema: z.ZodObject<{
     topP: z.ZodOptional<z.ZodNumber>;
     topK: z.ZodOptional<z.ZodNumber>;
     maxTokens: z.ZodOptional<z.ZodNumber>;
+    reasoningEffort: z.ZodOptional<z.ZodEnum<{
+        high: "high";
+        low: "low";
+        medium: "medium";
+        off: "off";
+    }>>;
     contextLength: z.ZodOptional<z.ZodNumber>;
     systemPrompt: z.ZodOptional<z.ZodString>;
     timeoutMs: z.ZodDefault<z.ZodNumber>;
@@ -87,6 +93,7 @@ export declare const LlmProfileFieldSchema: z.ZodEnum<{
     firstTokenTimeoutMs: "firstTokenTimeoutMs";
     idleTimeoutMs: "idleTimeoutMs";
     maxTokens: "maxTokens";
+    reasoningEffort: "reasoningEffort";
     retry: "retry";
     systemPrompt: "systemPrompt";
     temperature: "temperature";
@@ -144,6 +151,7 @@ export declare const LlmProfileKindDescriptorSchema: z.ZodObject<{
         firstTokenTimeoutMs: "firstTokenTimeoutMs";
         idleTimeoutMs: "idleTimeoutMs";
         maxTokens: "maxTokens";
+        reasoningEffort: "reasoningEffort";
         retry: "retry";
         systemPrompt: "systemPrompt";
         temperature: "temperature";
@@ -527,6 +535,7 @@ export declare const llmCapability: {
                 firstTokenTimeoutMs: "firstTokenTimeoutMs";
                 idleTimeoutMs: "idleTimeoutMs";
                 maxTokens: "maxTokens";
+                reasoningEffort: "reasoningEffort";
                 retry: "retry";
                 systemPrompt: "systemPrompt";
                 temperature: "temperature";
@@ -556,6 +565,12 @@ export declare const llmCapability: {
             topP: z.ZodOptional<z.ZodNumber>;
             topK: z.ZodOptional<z.ZodNumber>;
             maxTokens: z.ZodOptional<z.ZodNumber>;
+            reasoningEffort: z.ZodOptional<z.ZodEnum<{
+                high: "high";
+                low: "low";
+                medium: "medium";
+                off: "off";
+            }>>;
             contextLength: z.ZodOptional<z.ZodNumber>;
             systemPrompt: z.ZodOptional<z.ZodString>;
             timeoutMs: z.ZodDefault<z.ZodNumber>;
@@ -582,6 +597,12 @@ export declare const llmCapability: {
                 topP: z.ZodOptional<z.ZodNumber>;
                 topK: z.ZodOptional<z.ZodNumber>;
                 maxTokens: z.ZodOptional<z.ZodNumber>;
+                reasoningEffort: z.ZodOptional<z.ZodEnum<{
+                    high: "high";
+                    low: "low";
+                    medium: "medium";
+                    off: "off";
+                }>>;
                 contextLength: z.ZodOptional<z.ZodNumber>;
                 systemPrompt: z.ZodOptional<z.ZodString>;
                 timeoutMs: z.ZodDefault<z.ZodNumber>;
@@ -607,6 +628,12 @@ export declare const llmCapability: {
             topP: z.ZodOptional<z.ZodNumber>;
             topK: z.ZodOptional<z.ZodNumber>;
             maxTokens: z.ZodOptional<z.ZodNumber>;
+            reasoningEffort: z.ZodOptional<z.ZodEnum<{
+                high: "high";
+                low: "low";
+                medium: "medium";
+                off: "off";
+            }>>;
             contextLength: z.ZodOptional<z.ZodNumber>;
             systemPrompt: z.ZodOptional<z.ZodString>;
             timeoutMs: z.ZodDefault<z.ZodNumber>;

package/dist/index.js

@@ -44650,6 +44650,17 @@ var LlmProfileSchema = zod.z.object({
 	*  field in its editor only when its descriptor lists it in `profileFields`. */
 	topK: zod.z.number().int().positive().optional(),
 	maxTokens: zod.z.number().int().positive().optional(),
+	/** How hard the model "thinks" before it answers. Omitted = the model's own
+	*  default. `off` matters for structured output: a thinking model can spend
+	*  the whole completion on reasoning and return an empty `content`. Carried
+	*  only by the wires that have it — a kind offers the field in its editor
+	*  only when its descriptor lists it in `profileFields`. */
+	reasoningEffort: zod.z.enum([
+		"off",
+		"low",
+		"medium",
+		"high"
+	]).optional(),
 	/** Prompt context window. Advisory for cloud kinds (they enforce their own). */
 	contextLength: zod.z.number().int().positive().optional(),
 	/** Default system prompt. A caller's `system` REPLACES it (never appends —
@@ -44688,6 +44699,7 @@ var LlmProfileFieldSchema = zod.z.enum([
 	"topP",
 	"topK",
 	"maxTokens",
+	"reasoningEffort",
 	"contextLength",
 	"systemPrompt",
 	"timeoutMs",
@@ -118280,6 +118292,29 @@ function rewriteSetCookie(cookie, route) {
 	return kept.join("; ");
 }
 /**
+* Every Set-Cookie of one vendor response, rewritten. Dropping `Domain` folds cookies
+* the vendor keeps apart (`session-id` on `.amazon.it` and on `.www.amazon.it`) into
+* one, so a past-dated set that only deleted the other domain's copy would delete the
+* live one the same response just set: that deletion is dropped.
+*/
+function rewriteSetCookies(cookies, route) {
+	const now = Date.now();
+	const liveNames = new Set(cookies.filter((c) => !isExpiredCookie(c, now)).map(cookieName));
+	return cookies.filter((c) => !(isExpiredCookie(c, now) && liveNames.has(cookieName(c)))).map((c) => rewriteSetCookie(c, route));
+}
+function cookieName(cookie) {
+	return cookie.split(";")[0]?.split("=")[0]?.trim() ?? "";
+}
+function isExpiredCookie(cookie, now) {
+	const attrs = cookie.split(";").slice(1).map((part) => part.trim());
+	const maxAge = attrs.find((a) => /^max-age=/i.test(a));
+	if (maxAge !== void 0) return Number(maxAge.slice(8)) <= 0;
+	const expires = attrs.find((a) => /^expires=/i.test(a));
+	if (expires === void 0) return false;
+	const at = Date.parse(expires.slice(8));
+	return Number.isFinite(at) && at <= now;
+}
+/**
 * A browser `Referer` that points into this proxy, turned back into the vendor URL it
 * stands for. A Referer that is not ours is dropped (null): it names the hub.
 */
@@ -118398,6 +118433,26 @@ async function readRequestBody(req) {
 	}
 	return Buffer.concat(chunks);
 }
+/** The path of the Referer sent upstream, or why none was sent — the query is never logged. */
+function forwardedRefererPath(forwarded, received) {
+	if (forwarded !== void 0) return URL.canParse(forwarded) ? new URL(forwarded).pathname : "unparsable";
+	return received === void 0 ? "absent" : "unmapped";
+}
+/** The form targets a vendor page posts to, path only (no query), so a lost path prefix is visible. */
+function formActionPaths(html) {
+	const actions = [...html.matchAll(/<form\b[^>]*\baction\s*=\s*["']([^"']*)["']/gi)].map((m) => (m[1] ?? "").split("?")[0] ?? "").slice(0, 5);
+	return actions.length === 0 ? "none" : actions.join(" | ");
+}
+/** Cookie NAMES only — values are session secrets and are never logged. */
+function cookieNames(header) {
+	if (header === void 0 || header.length === 0) return "none";
+	return header.split(";").map((part) => part.split("=")[0]?.trim() ?? "").join(",");
+}
+/** A Set-Cookie's name and attributes without its value, so a cookie the browser refuses is visible. */
+function setCookieShape(cookie) {
+	const [first, ...attrs] = cookie.split(";").map((part) => part.trim());
+	return [first?.split("=")[0] ?? "", ...attrs.filter((a) => !/^expires=/i.test(a))].join(";");
+}
 function sendPlain(res, status, text) {
 	res.writeHead(status, {
 		"content-type": "text/plain; charset=utf-8",
@@ -118533,7 +118588,11 @@ var VendorLoginProxy = class {
 			host: upstream.host,
 			path: target.pathname,
 			status: upstreamRes.status,
-			method
+			method,
+			refererPath: forwardedRefererPath(headers["referer"], req.headers["referer"]),
+			formActions: kind === "html" && text !== null ? formActionPaths(text) : void 0,
+			sentNames: cookieNames(headers["cookie"]),
+			vendorSets: setCookies.map(setCookieShape).join(" | ")
 		} });
 		const settled = await attempt.evaluate({
 			status: upstreamRes.status,
@@ -118555,7 +118614,7 @@ var VendorLoginProxy = class {
 		upstreamRes.headers.forEach((value, name) => {
 			if (!DROP_RESPONSE_HEADERS.has(name.toLowerCase())) out[name] = value;
 		});
-		if (setCookies.length > 0) out["set-cookie"] = setCookies.map((c) => rewriteSetCookie(c, route));
+		if (setCookies.length > 0) out["set-cookie"] = rewriteSetCookies(setCookies, route);
 		if (location !== null) out["location"] = rewriteLocation(location, upstream, route);
 		out["cache-control"] = "no-store";
 		if (text !== null && kind !== null) {

package/dist/index.mjs

@@ -44649,6 +44649,17 @@ var LlmProfileSchema = z.object({
 	*  field in its editor only when its descriptor lists it in `profileFields`. */
 	topK: z.number().int().positive().optional(),
 	maxTokens: z.number().int().positive().optional(),
+	/** How hard the model "thinks" before it answers. Omitted = the model's own
+	*  default. `off` matters for structured output: a thinking model can spend
+	*  the whole completion on reasoning and return an empty `content`. Carried
+	*  only by the wires that have it — a kind offers the field in its editor
+	*  only when its descriptor lists it in `profileFields`. */
+	reasoningEffort: z.enum([
+		"off",
+		"low",
+		"medium",
+		"high"
+	]).optional(),
 	/** Prompt context window. Advisory for cloud kinds (they enforce their own). */
 	contextLength: z.number().int().positive().optional(),
 	/** Default system prompt. A caller's `system` REPLACES it (never appends —
@@ -44687,6 +44698,7 @@ var LlmProfileFieldSchema = z.enum([
 	"topP",
 	"topK",
 	"maxTokens",
+	"reasoningEffort",
 	"contextLength",
 	"systemPrompt",
 	"timeoutMs",
@@ -118279,6 +118291,29 @@ function rewriteSetCookie(cookie, route) {
 	return kept.join("; ");
 }
 /**
+* Every Set-Cookie of one vendor response, rewritten. Dropping `Domain` folds cookies
+* the vendor keeps apart (`session-id` on `.amazon.it` and on `.www.amazon.it`) into
+* one, so a past-dated set that only deleted the other domain's copy would delete the
+* live one the same response just set: that deletion is dropped.
+*/
+function rewriteSetCookies(cookies, route) {
+	const now = Date.now();
+	const liveNames = new Set(cookies.filter((c) => !isExpiredCookie(c, now)).map(cookieName));
+	return cookies.filter((c) => !(isExpiredCookie(c, now) && liveNames.has(cookieName(c)))).map((c) => rewriteSetCookie(c, route));
+}
+function cookieName(cookie) {
+	return cookie.split(";")[0]?.split("=")[0]?.trim() ?? "";
+}
+function isExpiredCookie(cookie, now) {
+	const attrs = cookie.split(";").slice(1).map((part) => part.trim());
+	const maxAge = attrs.find((a) => /^max-age=/i.test(a));
+	if (maxAge !== void 0) return Number(maxAge.slice(8)) <= 0;
+	const expires = attrs.find((a) => /^expires=/i.test(a));
+	if (expires === void 0) return false;
+	const at = Date.parse(expires.slice(8));
+	return Number.isFinite(at) && at <= now;
+}
+/**
 * A browser `Referer` that points into this proxy, turned back into the vendor URL it
 * stands for. A Referer that is not ours is dropped (null): it names the hub.
 */
@@ -118397,6 +118432,26 @@ async function readRequestBody(req) {
 	}
 	return Buffer.concat(chunks);
 }
+/** The path of the Referer sent upstream, or why none was sent — the query is never logged. */
+function forwardedRefererPath(forwarded, received) {
+	if (forwarded !== void 0) return URL.canParse(forwarded) ? new URL(forwarded).pathname : "unparsable";
+	return received === void 0 ? "absent" : "unmapped";
+}
+/** The form targets a vendor page posts to, path only (no query), so a lost path prefix is visible. */
+function formActionPaths(html) {
+	const actions = [...html.matchAll(/<form\b[^>]*\baction\s*=\s*["']([^"']*)["']/gi)].map((m) => (m[1] ?? "").split("?")[0] ?? "").slice(0, 5);
+	return actions.length === 0 ? "none" : actions.join(" | ");
+}
+/** Cookie NAMES only — values are session secrets and are never logged. */
+function cookieNames(header) {
+	if (header === void 0 || header.length === 0) return "none";
+	return header.split(";").map((part) => part.split("=")[0]?.trim() ?? "").join(",");
+}
+/** A Set-Cookie's name and attributes without its value, so a cookie the browser refuses is visible. */
+function setCookieShape(cookie) {
+	const [first, ...attrs] = cookie.split(";").map((part) => part.trim());
+	return [first?.split("=")[0] ?? "", ...attrs.filter((a) => !/^expires=/i.test(a))].join(";");
+}
 function sendPlain(res, status, text) {
 	res.writeHead(status, {
 		"content-type": "text/plain; charset=utf-8",
@@ -118532,7 +118587,11 @@ var VendorLoginProxy = class {
 			host: upstream.host,
 			path: target.pathname,
 			status: upstreamRes.status,
-			method
+			method,
+			refererPath: forwardedRefererPath(headers["referer"], req.headers["referer"]),
+			formActions: kind === "html" && text !== null ? formActionPaths(text) : void 0,
+			sentNames: cookieNames(headers["cookie"]),
+			vendorSets: setCookies.map(setCookieShape).join(" | ")
 		} });
 		const settled = await attempt.evaluate({
 			status: upstreamRes.status,
@@ -118554,7 +118613,7 @@ var VendorLoginProxy = class {
 		upstreamRes.headers.forEach((value, name) => {
 			if (!DROP_RESPONSE_HEADERS.has(name.toLowerCase())) out[name] = value;
 		});
-		if (setCookies.length > 0) out["set-cookie"] = setCookies.map((c) => rewriteSetCookie(c, route));
+		if (setCookies.length > 0) out["set-cookie"] = rewriteSetCookies(setCookies, route);
 		if (location !== null) out["location"] = rewriteLocation(location, upstream, route);
 		out["cache-control"] = "no-store";
 		if (text !== null && kind !== null) {

package/dist/vendor-login-proxy/index.d.ts

@@ -1,3 +1,3 @@
 export { VendorLoginProxy, type LoginProxyAttemptSpec, type LoginProxyResponseView, type LoginProxyVerdict, type VendorLoginProxyOptions, } from './login-proxy.js';
-export { rewriteBody, rewriteLocation, rewriteReferer, rewriteFormBody, rewriteSetCookie, type LoginProxyRoute, type LoginProxyScheme, type LoginProxyUpstream, } from './url-rewrite.js';
+export { rewriteBody, rewriteLocation, rewriteReferer, rewriteFormBody, rewriteSetCookie, rewriteSetCookies, type LoginProxyRoute, type LoginProxyScheme, type LoginProxyUpstream, } from './url-rewrite.js';
 export { VENDOR_LOGIN_PROXY_PREFIX } from './prefix.js';

package/dist/vendor-login-proxy/url-rewrite.d.ts

@@ -59,6 +59,13 @@ export declare function rewriteBody(body: string, kind: BodyKind, currentUpstrea
  * origin), `Path` narrowed to this attempt's prefix, `Secure` kept (the hub is HTTPS).
  */
 export declare function rewriteSetCookie(cookie: string, route: LoginProxyRoute): string;
+/**
+ * Every Set-Cookie of one vendor response, rewritten. Dropping `Domain` folds cookies
+ * the vendor keeps apart (`session-id` on `.amazon.it` and on `.www.amazon.it`) into
+ * one, so a past-dated set that only deleted the other domain's copy would delete the
+ * live one the same response just set: that deletion is dropped.
+ */
+export declare function rewriteSetCookies(cookies: readonly string[], route: LoginProxyRoute): string[];
 /**
  * A browser `Referer` that points into this proxy, turned back into the vendor URL it
  * stands for. A Referer that is not ours is dropped (null): it names the hub.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/types",
-  "version": "1.2.436",
+  "version": "1.2.437",
   "description": "Shared types, interfaces, and model catalogs for the CamStack detection ecosystem",
   "keywords": [
     "camstack",