@enricai/barnacle 1.12.48 → 1.12.50

package/dist/recon/capture-filters.d.ts

@@ -47,13 +47,29 @@ export declare function isNoiseUrl(url: string): boolean;
  * public suffixes (e.g. `co.uk`), which this codebase does not target.
  */
 export declare function registrableDomain(hostname: string): string;
+/**
+ * Splits a URL path into lowercase word tokens, breaking on non-alphanumeric
+ * separators (`/`, `-`, `_`, `.`) and camelCase boundaries, then drops tokens
+ * that are too short (<3 chars) or too generic ({@link GENERIC_PATH_TOKENS})
+ * to signal endpoint-family relatedness on their own.
+ *
+ * Only tokens from a *compound* path segment (one that itself splits into 2+
+ * words, e.g. `listing-avail-vas`) are kept. A whole segment that is a single
+ * plain word (e.g. `search`, `list`, `detail`, `widget`) is dropped entirely:
+ * such words recur across unrelated endpoint families on the same host, so
+ * treating them as a relatedness signal produces false positives (a marketing
+ * `/promotions/search` call "matching" a booking flow's `.../v1/search` just
+ * because both happen to end in the common word "search"). Compound segments
+ * are where a real endpoint-family identifier lives.
+ */
+export declare function pathStructuralTokens(path: string): Set<string>;
 /**
  * True when `candidatePath` shares enough path-segment tokens with at least
  * one path in `referencePaths` to be judged part of the same endpoint
  * family, false when it is structurally unrelated to all of them.
  *
  * A literal prefix/substring check is too strict: real same-flow endpoint
- * families (e.g. `.../productavail-vas/...` and `.../sailingavailability-vas/...`)
+ * families (e.g. `.../listing-avail-vas/...` and `.../item-detail-vas/...`)
  * do not share a string prefix segment-for-segment, but do share the
  * `-vas` suffix and surrounding path structure once tokenized. Token overlap
  * on segment words — ignoring short/generic tokens — catches that relation
@@ -65,10 +81,36 @@ export declare function isStructurallyRelevantCapture(candidatePath: string, ref
  * True when `candidatePath` has a compound (multi-word) path segment whose
  * tokens share nothing with ANY other path in `poolPaths` — a same-host
  * capture whose own path structurally isolates it from every other member of
- * the pool it was admitted into. A plain single-word path (empty token set,
- * e.g. `/applicant`) is never flagged: most real endpoint chains are single-
- * word paths that share no tokens with each other either, so treating an
- * empty token set as isolation would flag the whole chain as noise.
+ * the pool it was admitted into.
+ *
+ * A path with no compound segment (empty token set) falls back to a raw
+ * segment-overlap check instead of an automatic pass, but only when the path
+ * has a {@link hasRepeatedMeaningfulSegment repeated segment} of its own
+ * (e.g. `widget` recurring in `/widget/api/promotions/widget/default`): a chain's
+ * own steps are plain-word paths that name a distinct action per step
+ * (`/applicant`, `/sections/name`, or a 3-segment `/user/profile/edit`) and
+ * so essentially never repeat a segment against themselves, even when they
+ * share no tokens — or even raw segments — with sibling steps (e.g. a real
+ * `create` -> `sections/name` -> `submit` sequence, none of whose plain-word
+ * steps share a segment with either of the others). A same-host
+ * marketing/promotions capture is commonly self-referential — its own
+ * resource identifier shows up twice in its own path — which is the signal
+ * that marks it as a templated/generated noise path rather than a genuine
+ * short (or not-so-short) single-word chain step, independent of segment
+ * count. Requiring it to also share no raw path segment with the pool closes
+ * the gap without penalizing genuine single-word chain steps of any depth.
+ * The overlap check drops the same short/generic segments
+ * {@link pathStructuralTokens} already excludes ({@link GENERIC_PATH_TOKENS},
+ * <3 chars): otherwise two completely unrelated endpoint families sharing
+ * only a boilerplate `/api/` segment would be judged "related" and the
+ * isolated capture would dodge exclusion the same way the empty-token-set
+ * exemption originally let it. Pool paths that are themselves self-referential
+ * ({@link hasRepeatedMeaningfulSegment}) are excluded from contributing to
+ * this overlap set: otherwise two co-occurring same-noise-family path
+ * variants (e.g. a POST and a GET/default variant of the same templated
+ * marketing endpoint) would mutually "vouch" for each other's segments and
+ * neither would be recognized as isolated — only a genuinely non-self-
+ * referential path can vouch for a candidate's relatedness.
  *
  * Anchored on {@link isStructurallyRelevantCapture}'s own token overlap rule
  * so "isolated" is exactly "not relevant to anything else in the pool" —
@@ -78,6 +120,131 @@ export declare function isStructurallyRelevantCapture(candidatePath: string, ref
  * unlike {@link isStructurallyRelevantCapture} which requires one.
  */
 export declare function isStructurallyIsolatedCapture(candidatePath: string, poolPaths: readonly string[]): boolean;
+/**
+ * True when `pathA` and `pathB` belong to the same structural path family:
+ * either they share a compound-segment token ({@link pathStructuralTokens}),
+ * or both are self-referential ({@link hasRepeatedMeaningfulSegment}) and
+ * share a raw meaningful segment (e.g. `widget` in both `/widget/api/promotions/widget`
+ * and `/widget/api/promotions/widget/default`).
+ *
+ * Generalizes {@link isStructurallyRelevantCapture}'s token-overlap rule to
+ * also cover the all-single-word-segment, self-referential shape that rule
+ * alone can't see (its token set is empty for a path with no compound
+ * segment) — the same shape {@link isStructurallyIsolatedCapture} already
+ * recognizes for pool-isolation. Exported so a caller reasoning about
+ * "is this OTHER capture part of the SAME noise family as an already-known
+ * noise capture" (rather than "is this capture isolated from a whole pool")
+ * can reuse the identical relatedness rule instead of re-deriving it.
+ */
+export declare function isSamePathFamily(pathA: string, pathB: string): boolean;
+/**
+ * True when `capture`'s response carries no business-relevant state: a
+ * non-JSON (or absent) content-type, a null/undefined body, a JSON body
+ * with no keys, or a JSON body whose every leaf value is already present in
+ * the request's own URL (query string or path). A page-load sensor/
+ * analytics beacon (an Akamai-style session-authenticator pixel, a polled
+ * non-JSON status ping, or one that echoes back the `clientId`/`siteId` the
+ * caller just sent it) answers every call with exactly this shape — unlike a
+ * real API response, which carries data a caller could not have already
+ * known before firing the request.
+ *
+ * The "echoes its own request" branch is what closes the gap a bare
+ * empty-body check misses: a response is technically non-empty JSON but
+ * every leaf is one of the fixed query's own values (or a path segment),
+ * so nothing in it is new information relative to what the caller already
+ * sent — it is not business-relevant just because it happens to be
+ * non-empty.
+ *
+ * Missing response metadata (unit-test callers that construct a capture
+ * without `responseHeaders`/`responseBody`) reads as "no business-relevant
+ * state" too: this predicate only ever narrows an already-recurring
+ * candidate — {@link isZeroVarianceRepeatCapture} (already-fixed-query) and
+ * `recon-generate.ts`'s own-repeat structural-isolation pass (already
+ * repeats identically, regardless of query shape) — so defaulting to the
+ * noise reading there costs nothing except in the caller that deliberately
+ * supplies a JSON response to prove the opposite.
+ *
+ * Exported (not just used internally by {@link isZeroVarianceRepeatCapture})
+ * because a same-host, fixed-request endpoint with NO query string at all
+ * (e.g. a polled feature-toggle feed with a single-compound-segment path)
+ * can be genuinely zero-business-value too, and query-key matching alone —
+ * this file's `hasFixedKey` signal — has nothing to key off when there is no
+ * query. Response business-value is the general, path/query-shape-independent
+ * signal for "this repeat carries nothing a caller could not already know,"
+ * so `recon-generate.ts` reuses it directly instead of the query-shape logic
+ * that cannot apply to a query-less endpoint.
+ */
+export declare function hasNoBusinessRelevantResponseState(capture: {
+    url: string;
+    responseHeaders?: Record<string, string>;
+    responseBody?: unknown;
+}): boolean;
+/**
+ * True when `candidate` carries at least one query key whose value stays
+ * identical across every occurrence of the same endpoint in `allCaptures`,
+ * and recurs at least once elsewhere at the same method and endpoint
+ * (origin + pathname) — proof the endpoint's identifying signal is a fixed
+ * query key, not the full query string. Any OTHER key that differs between
+ * occurrences (a cache-buster, a session nonce) is incidental and does not
+ * prevent the match, AND either the request body is also byte-identical
+ * across every occurrence, or the response carries no business-relevant
+ * state ({@link hasNoBusinessRelevantResponseState}).
+ *
+ * Grouping by the full URL string (byte-identical query) is too strict: a
+ * real beacon can carry one incidental varying query key (a cache-buster or
+ * session nonce that is never literally equal across calls) alongside its
+ * genuinely fixed identifying keys (`clientId`, `environment`, `siteId`),
+ * and requiring the entire string to match lets it escape exclusion
+ * entirely. Per-key comparison against the candidate's own keys — rather
+ * than requiring the whole set of keys or values to agree — is what
+ * recovers the beacon: the fixed keys still prove the endpoint's identity,
+ * the varying key is simply ignored because it never advances past
+ * "matches on at least one key."
+ *
+ * A key is "fixed" when the candidate's own value for it is the STRICT
+ * MAJORITY value across every same-endpoint occurrence in `allCaptures`
+ * (more than half, with at least two supporting occurrences) — not
+ * necessarily every single one. `allCaptures` is the full raw capture list,
+ * which can include an incidental earlier/differently-scoped occurrence of
+ * the same endpoint (a page load before the flow proper starts) that
+ * legitimately carries a different value for every candidate key. Requiring
+ * literal unanimity would let that one outlier veto the proof for the
+ * entire flow's worth of genuinely fixed repeats; requiring only a majority
+ * still refuses to flag a key that varies freely (no value would ever reach
+ * a majority) while tolerating the minority-outlier shape a real archive
+ * produces.
+ *
+ * The requirement that at least one key be fixed is deliberate, not an
+ * extension/host special-case: it is what separates this from a genuinely
+ * no-argument own endpoint that a flow legitimately polls with an identical
+ * body every time (a feature-toggle feed, an availability heartbeat) —
+ * those endpoints carry real business meaning and folding their repeats
+ * into a single call is the collapse mechanism's job, not this predicate's.
+ * A marketing/analytics beacon's own fixed identifying query is the tell a
+ * plain body-repetition check can't see on its own, and is exactly the
+ * shape {@link isStructurallyIsolatedCapture} can be fooled by — that
+ * check's reference pool is every OTHER admitted capture, so N copies of
+ * the same fixed-query request "vouch" for each other's path tokens and
+ * none of them reads as isolated.
+ *
+ * The response-state fallback exists because a byte-identical-body
+ * requirement alone misses a beacon whose body embeds a fingerprint,
+ * timestamp, or session nonce that differs on every fire even though the
+ * fixed query is the only signal that actually identifies the endpoint —
+ * the body varies, but the response never carries anything the flow could
+ * not already derive from the request itself.
+ */
+export declare function isZeroVarianceRepeatCapture(candidate: {
+    method: string;
+    url: string;
+    requestPostData: string | null;
+    responseHeaders?: Record<string, string>;
+    responseBody?: unknown;
+}, allCaptures: readonly {
+    method: string;
+    url: string;
+    requestPostData: string | null;
+}[]): boolean;
 /**
  * True when `hostname` is allowed as a fixture host: an exact match against
  * `ownBackendHostnames` when the flow declares any, otherwise a

package/dist/recon/capture-filters.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capture-filters.d.ts","sourceRoot":"","sources":["../../src/recon/capture-filters.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,EAAE,CAW/C;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,QAAyB,CAAC;AAmC9D;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAc/C;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAM1D;AAoCD;;;;;;;;;;;;GAYG;AACH,wBAAgB,6BAA6B,CAC3C,aAAa,EAAE,MAAM,EACrB,cAAc,EAAE,SAAS,MAAM,EAAE,GAChC,OAAO,CAUT;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6BAA6B,CAC3C,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,SAAS,MAAM,EAAE,GAC3B,OAAO,CAGT;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,mBAAmB,EAAE,MAAM,EAAE,EAC7B,cAAc,EAAE,MAAM,GAAG,IAAI,GAC5B,OAAO,CAKT"}
+{"version":3,"file":"capture-filters.d.ts","sourceRoot":"","sources":["../../src/recon/capture-filters.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,EAAE,CAW/C;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,QAAyB,CAAC;AAmC9D;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAc/C;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAM1D;AAKD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAc9D;AA+BD;;;;;;;;;;;;GAYG;AACH,wBAAgB,6BAA6B,CAC3C,aAAa,EAAE,MAAM,EACrB,cAAc,EAAE,SAAS,MAAM,EAAE,GAChC,OAAO,CAUT;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,wBAAgB,6BAA6B,CAC3C,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,SAAS,MAAM,EAAE,GAC3B,OAAO,CAWT;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAWtE;AAwCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAgB,kCAAkC,CAAC,OAAO,EAAE;IAC1D,GAAG,EAAE,MAAM,CAAC;IACZ,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,GAAG,OAAO,CAeV;AAoBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,wBAAgB,2BAA2B,CACzC,SAAS,EAAE;IACT,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,EACD,WAAW,EAAE,SAAS;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EAAE,GACtF,OAAO,CAkCT;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,mBAAmB,EAAE,MAAM,EAAE,EAC7B,cAAc,EAAE,MAAM,GAAG,IAAI,GAC5B,OAAO,CAKT"}

package/dist/recon/capture-filters.js

@@ -15,8 +15,12 @@ exports.ERROR_SINK_PATH_SEGMENT = void 0;
 exports.telemetryUrlPatterns = telemetryUrlPatterns;
 exports.isNoiseUrl = isNoiseUrl;
 exports.registrableDomain = registrableDomain;
+exports.pathStructuralTokens = pathStructuralTokens;
 exports.isStructurallyRelevantCapture = isStructurallyRelevantCapture;
 exports.isStructurallyIsolatedCapture = isStructurallyIsolatedCapture;
+exports.isSamePathFamily = isSamePathFamily;
+exports.hasNoBusinessRelevantResponseState = hasNoBusinessRelevantResponseState;
+exports.isZeroVarianceRepeatCapture = isZeroVarianceRepeatCapture;
 exports.isAllowedFixtureHost = isAllowedFixtureHost;
 /**
  * Path/URL substrings we always treat as analytics or logging noise. Site-specific
@@ -132,7 +136,7 @@ const GENERIC_PATH_TOKENS = new Set(["api", "app", "apps", "v1", "v2", "v3", "co
  * to signal endpoint-family relatedness on their own.
  *
  * Only tokens from a *compound* path segment (one that itself splits into 2+
- * words, e.g. `productavail-vas`) are kept. A whole segment that is a single
+ * words, e.g. `listing-avail-vas`) are kept. A whole segment that is a single
  * plain word (e.g. `search`, `list`, `detail`, `widget`) is dropped entirely:
  * such words recur across unrelated endpoint families on the same host, so
  * treating them as a relatedness signal produces false positives (a marketing
@@ -155,13 +159,40 @@ function pathStructuralTokens(path) {
         .filter((word) => word.length >= 3 && !GENERIC_PATH_TOKENS.has(word));
     return new Set(words);
 }
+/**
+ * Lowercased raw path segments, dropping the same short (<3 chars) and
+ * generic ({@link GENERIC_PATH_TOKENS}) ones {@link pathStructuralTokens}
+ * excludes from compound-segment tokens — so a raw-segment overlap check
+ * can't be satisfied by two paths sharing nothing but a boilerplate `/api/`
+ * or `/v1/` segment.
+ */
+function meaningfulPathSegments(path) {
+    return path
+        .split("/")
+        .filter(Boolean)
+        .map((segment) => segment.toLowerCase())
+        .filter((segment) => segment.length >= 3 && !GENERIC_PATH_TOKENS.has(segment));
+}
+/**
+ * True when some meaningful segment of `path` recurs elsewhere in the same
+ * path (e.g. `widget` in `/widget/api/promotions/widget/default`). Real action
+ * chains name each step for what it does (`/user/profile/edit`) and so
+ * rarely repeat a segment; a same-host marketing/promotions endpoint is
+ * commonly self-referential — its resource identifier shows up twice in its
+ * own path — which is what marks it as a templated/generated noise path
+ * rather than a genuine, if short, chain step.
+ */
+function hasRepeatedMeaningfulSegment(path) {
+    const segments = meaningfulPathSegments(path);
+    return new Set(segments).size < segments.length;
+}
 /**
  * True when `candidatePath` shares enough path-segment tokens with at least
  * one path in `referencePaths` to be judged part of the same endpoint
  * family, false when it is structurally unrelated to all of them.
  *
  * A literal prefix/substring check is too strict: real same-flow endpoint
- * families (e.g. `.../productavail-vas/...` and `.../sailingavailability-vas/...`)
+ * families (e.g. `.../listing-avail-vas/...` and `.../item-detail-vas/...`)
  * do not share a string prefix segment-for-segment, but do share the
  * `-vas` suffix and surrounding path structure once tokenized. Token overlap
  * on segment words — ignoring short/generic tokens — catches that relation
@@ -185,10 +216,36 @@ function isStructurallyRelevantCapture(candidatePath, referencePaths) {
  * True when `candidatePath` has a compound (multi-word) path segment whose
  * tokens share nothing with ANY other path in `poolPaths` — a same-host
  * capture whose own path structurally isolates it from every other member of
- * the pool it was admitted into. A plain single-word path (empty token set,
- * e.g. `/applicant`) is never flagged: most real endpoint chains are single-
- * word paths that share no tokens with each other either, so treating an
- * empty token set as isolation would flag the whole chain as noise.
+ * the pool it was admitted into.
+ *
+ * A path with no compound segment (empty token set) falls back to a raw
+ * segment-overlap check instead of an automatic pass, but only when the path
+ * has a {@link hasRepeatedMeaningfulSegment repeated segment} of its own
+ * (e.g. `widget` recurring in `/widget/api/promotions/widget/default`): a chain's
+ * own steps are plain-word paths that name a distinct action per step
+ * (`/applicant`, `/sections/name`, or a 3-segment `/user/profile/edit`) and
+ * so essentially never repeat a segment against themselves, even when they
+ * share no tokens — or even raw segments — with sibling steps (e.g. a real
+ * `create` -> `sections/name` -> `submit` sequence, none of whose plain-word
+ * steps share a segment with either of the others). A same-host
+ * marketing/promotions capture is commonly self-referential — its own
+ * resource identifier shows up twice in its own path — which is the signal
+ * that marks it as a templated/generated noise path rather than a genuine
+ * short (or not-so-short) single-word chain step, independent of segment
+ * count. Requiring it to also share no raw path segment with the pool closes
+ * the gap without penalizing genuine single-word chain steps of any depth.
+ * The overlap check drops the same short/generic segments
+ * {@link pathStructuralTokens} already excludes ({@link GENERIC_PATH_TOKENS},
+ * <3 chars): otherwise two completely unrelated endpoint families sharing
+ * only a boilerplate `/api/` segment would be judged "related" and the
+ * isolated capture would dodge exclusion the same way the empty-token-set
+ * exemption originally let it. Pool paths that are themselves self-referential
+ * ({@link hasRepeatedMeaningfulSegment}) are excluded from contributing to
+ * this overlap set: otherwise two co-occurring same-noise-family path
+ * variants (e.g. a POST and a GET/default variant of the same templated
+ * marketing endpoint) would mutually "vouch" for each other's segments and
+ * neither would be recognized as isolated — only a genuinely non-self-
+ * referential path can vouch for a candidate's relatedness.
  *
  * Anchored on {@link isStructurallyRelevantCapture}'s own token overlap rule
  * so "isolated" is exactly "not relevant to anything else in the pool" —
@@ -198,9 +255,252 @@ function isStructurallyRelevantCapture(candidatePath, referencePaths) {
  * unlike {@link isStructurallyRelevantCapture} which requires one.
  */
 function isStructurallyIsolatedCapture(candidatePath, poolPaths) {
-    if (pathStructuralTokens(candidatePath).size === 0)
+    const candidateTokens = pathStructuralTokens(candidatePath);
+    if (candidateTokens.size > 0)
+        return !isStructurallyRelevantCapture(candidatePath, poolPaths);
+    if (!hasRepeatedMeaningfulSegment(candidatePath))
+        return false;
+    const candidateSegments = meaningfulPathSegments(candidatePath);
+    const poolSegments = new Set(poolPaths
+        .filter((poolPath) => !hasRepeatedMeaningfulSegment(poolPath))
+        .flatMap((poolPath) => meaningfulPathSegments(poolPath)));
+    return !candidateSegments.some((segment) => poolSegments.has(segment));
+}
+/**
+ * True when `pathA` and `pathB` belong to the same structural path family:
+ * either they share a compound-segment token ({@link pathStructuralTokens}),
+ * or both are self-referential ({@link hasRepeatedMeaningfulSegment}) and
+ * share a raw meaningful segment (e.g. `widget` in both `/widget/api/promotions/widget`
+ * and `/widget/api/promotions/widget/default`).
+ *
+ * Generalizes {@link isStructurallyRelevantCapture}'s token-overlap rule to
+ * also cover the all-single-word-segment, self-referential shape that rule
+ * alone can't see (its token set is empty for a path with no compound
+ * segment) — the same shape {@link isStructurallyIsolatedCapture} already
+ * recognizes for pool-isolation. Exported so a caller reasoning about
+ * "is this OTHER capture part of the SAME noise family as an already-known
+ * noise capture" (rather than "is this capture isolated from a whole pool")
+ * can reuse the identical relatedness rule instead of re-deriving it.
+ */
+function isSamePathFamily(pathA, pathB) {
+    const tokensA = pathStructuralTokens(pathA);
+    const tokensB = pathStructuralTokens(pathB);
+    if (tokensA.size > 0 && tokensB.size > 0) {
+        for (const token of tokensA) {
+            if (tokensB.has(token))
+                return true;
+        }
+    }
+    if (!hasRepeatedMeaningfulSegment(pathA) || !hasRepeatedMeaningfulSegment(pathB))
+        return false;
+    const segmentsA = new Set(meaningfulPathSegments(pathA));
+    return meaningfulPathSegments(pathB).some((segment) => segmentsA.has(segment));
+}
+/**
+ * Every string/number/boolean leaf reachable from `value`, stringified, with
+ * `null`/`undefined` leaves skipped (they carry no derivable identifier to
+ * compare against the request).
+ */
+function collectLeafValues(value, out) {
+    if (value === null || value === undefined)
+        return;
+    if (typeof value === "object") {
+        for (const child of Array.isArray(value)
+            ? value
+            : Object.values(value)) {
+            collectLeafValues(child, out);
+        }
+        return;
+    }
+    out.push(String(value));
+}
+/**
+ * The set of raw values a request's own URL already exposes to the caller:
+ * every query-parameter value and every non-empty path segment. A response
+ * leaf that only ever echoes one of these tells the caller nothing it could
+ * not already derive from the request it just sent.
+ */
+function urlOwnValues(url) {
+    const values = new Set();
+    try {
+        const parsed = new URL(url);
+        for (const value of parsed.searchParams.values())
+            values.add(value);
+        for (const segment of parsed.pathname.split("/")) {
+            if (segment.length > 0)
+                values.add(decodeURIComponent(segment));
+        }
+    }
+    catch {
+        // unparsable URL contributes no derivable values
+    }
+    return values;
+}
+/**
+ * True when `capture`'s response carries no business-relevant state: a
+ * non-JSON (or absent) content-type, a null/undefined body, a JSON body
+ * with no keys, or a JSON body whose every leaf value is already present in
+ * the request's own URL (query string or path). A page-load sensor/
+ * analytics beacon (an Akamai-style session-authenticator pixel, a polled
+ * non-JSON status ping, or one that echoes back the `clientId`/`siteId` the
+ * caller just sent it) answers every call with exactly this shape — unlike a
+ * real API response, which carries data a caller could not have already
+ * known before firing the request.
+ *
+ * The "echoes its own request" branch is what closes the gap a bare
+ * empty-body check misses: a response is technically non-empty JSON but
+ * every leaf is one of the fixed query's own values (or a path segment),
+ * so nothing in it is new information relative to what the caller already
+ * sent — it is not business-relevant just because it happens to be
+ * non-empty.
+ *
+ * Missing response metadata (unit-test callers that construct a capture
+ * without `responseHeaders`/`responseBody`) reads as "no business-relevant
+ * state" too: this predicate only ever narrows an already-recurring
+ * candidate — {@link isZeroVarianceRepeatCapture} (already-fixed-query) and
+ * `recon-generate.ts`'s own-repeat structural-isolation pass (already
+ * repeats identically, regardless of query shape) — so defaulting to the
+ * noise reading there costs nothing except in the caller that deliberately
+ * supplies a JSON response to prove the opposite.
+ *
+ * Exported (not just used internally by {@link isZeroVarianceRepeatCapture})
+ * because a same-host, fixed-request endpoint with NO query string at all
+ * (e.g. a polled feature-toggle feed with a single-compound-segment path)
+ * can be genuinely zero-business-value too, and query-key matching alone —
+ * this file's `hasFixedKey` signal — has nothing to key off when there is no
+ * query. Response business-value is the general, path/query-shape-independent
+ * signal for "this repeat carries nothing a caller could not already know,"
+ * so `recon-generate.ts` reuses it directly instead of the query-shape logic
+ * that cannot apply to a query-less endpoint.
+ */
+function hasNoBusinessRelevantResponseState(capture) {
+    const headers = capture.responseHeaders ?? {};
+    const contentType = (Object.entries(headers).find(([key]) => key.toLowerCase() === "content-type")?.[1] ?? "").toLowerCase();
+    if (!contentType.includes("json"))
+        return true;
+    const body = capture.responseBody;
+    if (body === null || body === undefined)
+        return true;
+    if (typeof body !== "object")
+        return false;
+    if (Object.keys(body).length === 0)
+        return true;
+    const leaves = [];
+    collectLeafValues(body, leaves);
+    if (leaves.length === 0)
+        return true;
+    const ownValues = urlOwnValues(capture.url);
+    return leaves.every((leaf) => ownValues.has(leaf));
+}
+/**
+ * Identity of the endpoint a URL addresses, ignoring its query string, so
+ * recurrences of the same endpoint with a differently-ordered or
+ * incidentally-varying query string still group as "the same endpoint"
+ * instead of requiring the whole URL to be byte-identical. Mirrors
+ * `recon-generate.ts`'s own `endpointKey` (origin + pathname) — the same
+ * definition of "same endpoint" this codebase already uses for collapse and
+ * variance reasoning elsewhere.
+ */
+function endpointOrigin(url) {
+    try {
+        const parsed = new URL(url);
+        return `${parsed.origin}${parsed.pathname}`;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * True when `candidate` carries at least one query key whose value stays
+ * identical across every occurrence of the same endpoint in `allCaptures`,
+ * and recurs at least once elsewhere at the same method and endpoint
+ * (origin + pathname) — proof the endpoint's identifying signal is a fixed
+ * query key, not the full query string. Any OTHER key that differs between
+ * occurrences (a cache-buster, a session nonce) is incidental and does not
+ * prevent the match, AND either the request body is also byte-identical
+ * across every occurrence, or the response carries no business-relevant
+ * state ({@link hasNoBusinessRelevantResponseState}).
+ *
+ * Grouping by the full URL string (byte-identical query) is too strict: a
+ * real beacon can carry one incidental varying query key (a cache-buster or
+ * session nonce that is never literally equal across calls) alongside its
+ * genuinely fixed identifying keys (`clientId`, `environment`, `siteId`),
+ * and requiring the entire string to match lets it escape exclusion
+ * entirely. Per-key comparison against the candidate's own keys — rather
+ * than requiring the whole set of keys or values to agree — is what
+ * recovers the beacon: the fixed keys still prove the endpoint's identity,
+ * the varying key is simply ignored because it never advances past
+ * "matches on at least one key."
+ *
+ * A key is "fixed" when the candidate's own value for it is the STRICT
+ * MAJORITY value across every same-endpoint occurrence in `allCaptures`
+ * (more than half, with at least two supporting occurrences) — not
+ * necessarily every single one. `allCaptures` is the full raw capture list,
+ * which can include an incidental earlier/differently-scoped occurrence of
+ * the same endpoint (a page load before the flow proper starts) that
+ * legitimately carries a different value for every candidate key. Requiring
+ * literal unanimity would let that one outlier veto the proof for the
+ * entire flow's worth of genuinely fixed repeats; requiring only a majority
+ * still refuses to flag a key that varies freely (no value would ever reach
+ * a majority) while tolerating the minority-outlier shape a real archive
+ * produces.
+ *
+ * The requirement that at least one key be fixed is deliberate, not an
+ * extension/host special-case: it is what separates this from a genuinely
+ * no-argument own endpoint that a flow legitimately polls with an identical
+ * body every time (a feature-toggle feed, an availability heartbeat) —
+ * those endpoints carry real business meaning and folding their repeats
+ * into a single call is the collapse mechanism's job, not this predicate's.
+ * A marketing/analytics beacon's own fixed identifying query is the tell a
+ * plain body-repetition check can't see on its own, and is exactly the
+ * shape {@link isStructurallyIsolatedCapture} can be fooled by — that
+ * check's reference pool is every OTHER admitted capture, so N copies of
+ * the same fixed-query request "vouch" for each other's path tokens and
+ * none of them reads as isolated.
+ *
+ * The response-state fallback exists because a byte-identical-body
+ * requirement alone misses a beacon whose body embeds a fingerprint,
+ * timestamp, or session nonce that differs on every fire even though the
+ * fixed query is the only signal that actually identifies the endpoint —
+ * the body varies, but the response never carries anything the flow could
+ * not already derive from the request itself.
+ */
+function isZeroVarianceRepeatCapture(candidate, allCaptures) {
+    let candidateUrl;
+    try {
+        candidateUrl = new URL(candidate.url);
+    }
+    catch {
+        return false;
+    }
+    const candidateEndpoint = endpointOrigin(candidate.url);
+    if (candidateEndpoint === null)
+        return false;
+    const candidateKeys = [...candidateUrl.searchParams.keys()];
+    if (candidateKeys.length === 0)
+        return false;
+    const sameEndpoint = allCaptures.filter((c) => c.method === candidate.method && endpointOrigin(c.url) === candidateEndpoint);
+    if (sameEndpoint.length < 2)
+        return false;
+    const sameEndpointUrls = sameEndpoint
+        .map((c) => {
+        try {
+            return new URL(c.url);
+        }
+        catch {
+            return null;
+        }
+    })
+        .filter((u) => u !== null);
+    const hasFixedKey = candidateKeys.some((key) => {
+        const candidateValue = candidateUrl.searchParams.get(key);
+        const matchCount = sameEndpointUrls.filter((u) => u.searchParams.get(key) === candidateValue).length;
+        return matchCount >= 2 && matchCount > sameEndpointUrls.length / 2;
+    });
+    if (!hasFixedKey)
         return false;
-    return !isStructurallyRelevantCapture(candidatePath, poolPaths);
+    const bodyIdentical = sameEndpoint.every((c) => c.requestPostData === candidate.requestPostData);
+    return bodyIdentical || hasNoBusinessRelevantResponseState(candidate);
 }
 /**
  * True when `hostname` is allowed as a fixture host: an exact match against

package/dist/recon/capture-filters.js.map

@@ -1 +1 @@
-{"version":3,"file":"capture-filters.js","sourceRoot":"","sources":["../../src/recon/capture-filters.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;;;;;;;AAEH;;;;;;;GAOG;AACH;IACE,OAAO;QACL,4BAA4B;QAC5B,aAAa;QACb,yBAAyB;QACzB,sBAAsB;QACtB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,EAAE,CAAC;aAChD,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC;KACnB,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACU,QAAA,uBAAuB,GAAG,sBAAsB,CAAC;AAE9D;;;;;;;;GAQG;AACH,MAAM,uBAAuB,GAAG;IAC9B,eAAe;IACf,YAAY;IACZ,YAAY;IACZ,iBAAiB;IACjB,sBAAsB;IACtB,sBAAsB;IACtB,cAAc;IACd,cAAc;IACd,YAAY;IACZ,YAAY;IACZ,aAAa;IACb,eAAe;IACf,mBAAmB;IACnB,cAAc;IACd,YAAY;IACZ,YAAY;IACZ,gBAAgB;IAChB,uBAAuB;CACxB,CAAC;AAEF,8EAA8E;AAC9E,MAAM,eAAe,GAAG,gEAAgE,CAAC;AAEzF;;;;;;;GAOG;AACH,oBAA2B,GAAW;IACpC,MAAM,QAAQ,GAAG,oBAAoB,EAAE,CAAC;IACxC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IACvC,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3F,IAAI,QAAA,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,2BAAkC,QAAgB;IAChD,MAAM,MAAM,GAAG,QAAQ;SACpB,WAAW,EAAE;SACb,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvC,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5E,CAAC;AAED,0FAA0F;AAC1F,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAEpG;;;;;;;;;;;;;;GAcG;AACH,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI;SACf,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,OAAO,CAAC;SACf,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACnB,MAAM,KAAK,GAAG,OAAO;aAClB,KAAK,CAAC,eAAe,CAAC;aACtB,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;aACvD,MAAM,CAAC,OAAO,CAAC,CAAC;QACnB,OAAO,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACxC,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;SACjC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACxE,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;AACxB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,uCACE,aAAqB,EACrB,cAAiC;IAEjC,MAAM,eAAe,GAAG,oBAAoB,CAAC,aAAa,CAAC,CAAC;IAC5D,IAAI,eAAe,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,EAAE;QAC3C,MAAM,eAAe,GAAG,oBAAoB,CAAC,aAAa,CAAC,CAAC;QAC5D,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;YACpC,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC9C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,uCACE,aAAqB,EACrB,SAA4B;IAE5B,IAAI,oBAAoB,CAAC,aAAa,CAAC,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACjE,OAAO,CAAC,6BAA6B,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;GAOG;AACH,8BACE,QAAgB,EAChB,mBAA6B,EAC7B,cAA6B;IAE7B,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAClF,IAAI,gBAAgB,CAAC,IAAI,GAAG,CAAC;QAAE,OAAO,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjE,OAAO,cAAc,KAAK,IAAI,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,cAAc,CAAC;AAC/E,CAAC"}
+{"version":3,"file":"capture-filters.js","sourceRoot":"","sources":["../../src/recon/capture-filters.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;;;;;;;;;;;AAEH;;;;;;;GAOG;AACH;IACE,OAAO;QACL,4BAA4B;QAC5B,aAAa;QACb,yBAAyB;QACzB,sBAAsB;QACtB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,EAAE,CAAC;aAChD,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC;KACnB,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACU,QAAA,uBAAuB,GAAG,sBAAsB,CAAC;AAE9D;;;;;;;;GAQG;AACH,MAAM,uBAAuB,GAAG;IAC9B,eAAe;IACf,YAAY;IACZ,YAAY;IACZ,iBAAiB;IACjB,sBAAsB;IACtB,sBAAsB;IACtB,cAAc;IACd,cAAc;IACd,YAAY;IACZ,YAAY;IACZ,aAAa;IACb,eAAe;IACf,mBAAmB;IACnB,cAAc;IACd,YAAY;IACZ,YAAY;IACZ,gBAAgB;IAChB,uBAAuB;CACxB,CAAC;AAEF,8EAA8E;AAC9E,MAAM,eAAe,GAAG,gEAAgE,CAAC;AAEzF;;;;;;;GAOG;AACH,oBAA2B,GAAW;IACpC,MAAM,QAAQ,GAAG,oBAAoB,EAAE,CAAC;IACxC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IACvC,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3F,IAAI,QAAA,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,2BAAkC,QAAgB;IAChD,MAAM,MAAM,GAAG,QAAQ;SACpB,WAAW,EAAE;SACb,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvC,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5E,CAAC;AAED,0FAA0F;AAC1F,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAEpG;;;;;;;;;;;;;;GAcG;AACH,8BAAqC,IAAY;IAC/C,MAAM,KAAK,GAAG,IAAI;SACf,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,OAAO,CAAC;SACf,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACnB,MAAM,KAAK,GAAG,OAAO;aAClB,KAAK,CAAC,eAAe,CAAC;aACtB,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;aACvD,MAAM,CAAC,OAAO,CAAC,CAAC;QACnB,OAAO,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACxC,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;SACjC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACxE,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;AACxB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,sBAAsB,CAAC,IAAY;IAC1C,OAAO,IAAI;SACR,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;SACvC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;AACnF,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,4BAA4B,CAAC,IAAY;IAChD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC9C,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,uCACE,aAAqB,EACrB,cAAiC;IAEjC,MAAM,eAAe,GAAG,oBAAoB,CAAC,aAAa,CAAC,CAAC;IAC5D,IAAI,eAAe,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,EAAE;QAC3C,MAAM,eAAe,GAAG,oBAAoB,CAAC,aAAa,CAAC,CAAC;QAC5D,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;YACpC,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC9C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,uCACE,aAAqB,EACrB,SAA4B;IAE5B,MAAM,eAAe,GAAG,oBAAoB,CAAC,aAAa,CAAC,CAAC;IAC5D,IAAI,eAAe,CAAC,IAAI,GAAG,CAAC;QAAE,OAAO,CAAC,6BAA6B,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;IAC9F,IAAI,CAAC,4BAA4B,CAAC,aAAa,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/D,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,aAAa,CAAC,CAAC;IAChE,MAAM,YAAY,GAAG,IAAI,GAAG,CAC1B,SAAS;SACN,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,4BAA4B,CAAC,QAAQ,CAAC,CAAC;SAC7D,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAC3D,CAAC;IACF,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,0BAAiC,KAAa,EAAE,KAAa;IAC3D,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACzC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;QACtC,CAAC;IACH,CAAC;IACD,IAAI,CAAC,4BAA4B,CAAC,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/F,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC;IACzD,OAAO,sBAAsB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;AACjF,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,KAAc,EAAE,GAAa;IACtD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACtC,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC,EAAE,CAAC;YACpD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAChC,CAAC;QACD,OAAO;IACT,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE;YAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpE,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACjD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,iDAAiD;IACnD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,4CAAmD,OAIlD;IACC,MAAM,OAAO,GAAG,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC;IAC9C,MAAM,WAAW,GAAG,CAClB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CACzF,CAAC,WAAW,EAAE,CAAC;IAChB,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC;IAClC,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,MAAM,CAAC,IAAI,CAAC,IAA+B,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3E,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5C,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,cAAc,CAAC,GAAW;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,qCACE,SAMC,EACD,WAAuF;IAEvF,IAAI,YAAiB,CAAC;IACtB,IAAI,CAAC;QACH,YAAY,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,iBAAiB,GAAG,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,iBAAiB,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC7C,MAAM,aAAa,GAAG,CAAC,GAAG,YAAY,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5D,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,CACrC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,IAAI,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,iBAAiB,CACpF,CAAC;IACF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,gBAAgB,GAAG,YAAY;SAClC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,CAAC,EAAY,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IACvC,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;QAC7C,MAAM,cAAc,GAAG,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,CACxC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,cAAc,CAClD,CAAC,MAAM,CAAC;QACT,OAAO,UAAU,IAAI,CAAC,IAAI,UAAU,GAAG,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/B,MAAM,aAAa,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,SAAS,CAAC,eAAe,CAAC,CAAC;IACjG,OAAO,aAAa,IAAI,kCAAkC,CAAC,SAAS,CAAC,CAAC;AACxE,CAAC;AAED;;;;;;;GAOG;AACH,8BACE,QAAgB,EAChB,mBAA6B,EAC7B,cAA6B;IAE7B,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAClF,IAAI,gBAAgB,CAAC,IAAI,GAAG,CAAC;QAAE,OAAO,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjE,OAAO,cAAc,KAAK,IAAI,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,cAAc,CAAC;AAC/E,CAAC"}

package/dist/scraper/captcha-callback-capture.d.ts

@@ -1,4 +1,14 @@
-import type { Page } from "@browserbasehq/stagehand";
+/**
+ * Site-agnostic capture of hCaptcha's programmatic render config. When a
+ * site calls `hcaptcha.render(container, { sitekey, callback })` rather than
+ * declaring `data-callback` on the widget element, the callback only ever
+ * lives inside hCaptcha's own closure — nothing in the DOM names it. This
+ * module builds a page-init script (for `Page.addInitScript`) that
+ * monkeypatches `hcaptcha.render` before any site script runs, so every
+ * render call's `{ sitekey, widgetId, callback }` lands in a page-global
+ * registry a flow hook can query later, regardless of which plugin or site
+ * triggered the render.
+ */
 /** Page-global property name the capture script stores its registry under. */
 export declare const HCAPTCHA_CALLBACK_REGISTRY_GLOBAL = "__barnacleHcaptchaCallbacks";
 /**
@@ -9,25 +19,4 @@ export declare const HCAPTCHA_CALLBACK_REGISTRY_GLOBAL = "__barnacleHcaptchaCall
  * value or side effects.
  */
 export declare function buildHcaptchaCallbackCaptureScript(): string;
-/**
- * Re-asserts the capture script into every frame's own realm as it attaches
- * or navigates, closing the race where a same-origin iframe's own script
- * assigns `window.hcaptcha` and calls `render` before `context.addInitScript`'s
- * effect is observably in place in that frame's realm (a CDP round-trip race
- * under some session providers). Complements, rather than replaces, the
- * context-level install — that install remains the first line of defense for
- * the common case (fast frames, no race).
- *
- * Frame-agnostic: this listens for `Page.frameAttached`/`Page.frameNavigated`
- * on the main frame's CDP session and evaluates the (idempotent) capture
- * script into whichever frame each event names, regardless of which site or
- * plugin owns that frame.
- *
- * `Page.frameAttached`/`Page.frameNavigated` can fire before that frame's
- * main-world execution context exists, so the first `evaluate()` rejects
- * with "main world not ready for frame ...". Each fresh `evaluate()` call
- * re-arms stagehand's own wait for that context, so retrying the call
- * (rather than adding a bespoke listener) is what closes the race.
- */
-export declare function installHcaptchaCallbackCaptureOnAllFrames(page: Page): void;
 //# sourceMappingURL=captcha-callback-capture.d.ts.map

package/dist/scraper/captcha-callback-capture.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"captcha-callback-capture.d.ts","sourceRoot":"","sources":["../../src/scraper/captcha-callback-capture.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,0BAA0B,CAAC;AAsBrD,8EAA8E;AAC9E,eAAO,MAAM,iCAAiC,gCAAgC,CAAC;AAE/E;;;;;;GAMG;AACH,wBAAgB,kCAAkC,IAAI,MAAM,CAuE3D;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,yCAAyC,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAgC1E"}
+{"version":3,"file":"captcha-callback-capture.d.ts","sourceRoot":"","sources":["../../src/scraper/captcha-callback-capture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,8EAA8E;AAC9E,eAAO,MAAM,iCAAiC,gCAAgC,CAAC;AAE/E;;;;;;GAMG;AACH,wBAAgB,kCAAkC,IAAI,MAAM,CAuE3D"}