@enricai/barnacle 1.12.69 → 1.12.70

package/dist/scripts/recon-generate.js

@@ -1142,8 +1142,16 @@ function deriveRequestHeaders(captures, replays, baseUrl, submitPatterns = null,
     }
     return baseline;
 }
-function isGraphQL(captures) {
-    return captures.some((c) => c.operationName !== null || (0, capture_filters_1.parsedOperationName)(c.query ?? "") !== null);
+/**
+ * Classifies the flow as GraphQL only from own-backend-host traffic, so a
+ * third-party host (chat widget, analytics SDK) making real GraphQL calls
+ * never flips a plain REST/JSON backend's classification.
+ */
+function isGraphQL(captures, ownBackendHostnames = [], fallbackDomain = null) {
+    const hasHostProvenance = ownBackendHostnames.length > 0 || fallbackDomain !== null;
+    return captures.some((c) => (!hasHostProvenance ||
+        (0, capture_filters_1.isAllowedFixtureHost)(captureHostname(c.url), ownBackendHostnames, fallbackDomain)) &&
+        (c.operationName !== null || (0, capture_filters_1.parsedOperationName)(c.query ?? "") !== null));
 }
 /**
  * The single own-backend capture the raw GraphQL fallback (no
@@ -1225,9 +1233,12 @@ function operationGroupKey(capture) {
  * never independently resolve a different primary.
  */
 function computeEmittedPrimaryAnchor(gql, endpointPath, gqlOperationName, gqlQuery) {
-    if (!gql)
+    // Mirrors emitContractTs's own isGqlEmission gate: `gql` alone can be true
+    // with a null gqlQuery (see gqlQuery's `?? null` fallback), in which case
+    // emitContractTs falls through to REST emission — this anchor must agree.
+    if (!gql || gqlQuery === null)
         return null;
-    const name = gqlOperationName ?? (0, capture_filters_1.parsedOperationName)(gqlQuery ?? "") ?? "anonymous";
+    const name = gqlOperationName ?? (0, capture_filters_1.parsedOperationName)(gqlQuery) ?? "anonymous";
     return `${endpointPath}::${name}`;
 }
 /**
@@ -1584,8 +1595,26 @@ function resolveManifestActionSequence(runRoot, captures) {
  * Exported for tests: this predicate decides what a generated plugin will POST
  * at a live site, and it is the only gate between a browser's incidental
  * chatter and the emitted hot path.
- */
-function extractActionSequence(captures, submitPatterns = null, foldReturnSpec = null, ownBackendHostnames = [], fallbackDomain = null) {
+ *
+ * `applyFinalAnchorNarrowing` lets a caller that will itself truncate the
+ * result via {@link truncateActionSequenceAtSubmitPattern} opt out of the
+ * final structural-relevance anchor pass, which can drop a genuine earlier
+ * chain step that shares no token with the terminal submit endpoint.
+ */
+function extractActionSequence(captures, submitPatterns = null, foldReturnSpec = null, ownBackendHostnames = [], fallbackDomain = null, 
+// The final structural-relevance anchor pass below (guarded on
+// hasSubmitEndpointAnchor) is tuned for isolating a submission from
+// same-URL incidental chrome, not for pruning a genuine multi-step chain:
+// an earlier plain single-word step (e.g. `/lodging/hold/`) that shares no
+// compound token with the terminal submit endpoint reads as "unrelated" to
+// it and gets dropped, even though it's a real prior step whose body the
+// caller still needs. truncateActionSequenceAtSubmitPattern's own
+// index-slice already does the right, less-aggressive narrowing (keep
+// everything up to and including the last submit/fold match) — so a caller
+// that immediately truncates this result opts out with `false` to keep
+// earlier chain steps intact while still getting the structural-isolation
+// exemption above.
+applyFinalAnchorNarrowing = true) {
     const matchesFoldReturn = compileFoldReturnEndpointMatcher(foldReturnSpec);
     // Callers with no host-provenance data (the exported function's unit
     // tests) pass neither ownBackendHostnames nor fallbackDomain — in that
@@ -1607,6 +1636,14 @@ function extractActionSequence(captures, submitPatterns = null, foldReturnSpec =
     // the submission from same-URL chrome" behavior).
     const hasSubmitEndpointAnchor = hasHostProvenance && submitPatterns !== null && submitPatterns.endpoint !== null;
     const matchesSubmit = compileSubmitMatcher(hasSubmitEndpointAnchor ? { endpoint: null, body: submitPatterns.body } : submitPatterns);
+    // Compiled once, ahead of structural isolation below, so a capture matching
+    // the flow's own declared submitEndpointPattern can be exempted there the
+    // same way a declared foldReturn endpointPattern already is — both are
+    // author-declared, both are authoritative by construction, so the isolation
+    // pass (which exists to catch INCIDENTAL same-host noise the flow never
+    // named) must not treat one differently from the other.
+    const declaredSubmitEndpointRx = submitPatterns?.endpoint != null ? new RegExp(submitPatterns.endpoint) : null;
+    const matchesDeclaredSubmitEndpoint = (capture) => declaredSubmitEndpointRx?.test(capture.url) ?? false;
     const hostGated = captures
         .map((capture, index) => ({ capture, index }))
         .filter(({ capture }) => {
@@ -1630,9 +1667,14 @@ function extractActionSequence(captures, submitPatterns = null, foldReturnSpec =
     // (e.g. a marketing/promotions endpoint fired incidentally by a page load,
     // admitted above because it too is a 2xx own-backend POST). Drop a
     // structurally-isolated member of the pool first — a compound-path capture
-    // (e.g. `/site-banner`) sharing no token with anything else host-gated in,
-    // regardless of whether a submitEndpointPattern is declared. Guarded to
-    // pools of 3+: a real chain's own steps are usually plain single-word
+    // (e.g. `/site-banner`) sharing no token with anything else host-gated in
+    // — unless it matches the flow's own declared submitEndpointPattern (see
+    // the exemption below): a densely-tokenized real submission path (e.g.
+    // `available-sailings`) can look exactly as isolated as incidental noise
+    // by path shape alone, and dropping it here would strip it out before the
+    // structural-relevance anchor pass further down ever gets to treat it as
+    // authoritative. Guarded to pools of 3+: a real chain's own steps are
+    // usually plain single-word
     // paths with no tokens of their own (never flagged, see
     // isStructurallyIsolatedCapture), so this only ever removes a capture that
     // is BOTH compound-path AND unrelated to every other admitted capture —
@@ -1663,11 +1705,14 @@ function extractActionSequence(captures, submitPatterns = null, foldReturnSpec =
                 .filter((h, j) => denselyNameSpaced ? safeUrlPathname(h.capture.url) !== path : j !== i)
                 .map((h) => safeUrlPathname(h.capture.url));
             // A capture admitted via the flow's own declared foldReturnSpec
-            // endpointPattern (the drill-down target) is authoritative by
-            // construction — the flow author named it explicitly — so it is
+            // endpointPattern (the drill-down target), or matching the flow's
+            // own declared submitEndpointPattern, is authoritative by
+            // construction — the flow author named it explicitly — so both are
             // exempt from token-overlap isolation, which exists to catch
             // INCIDENTAL same-host captures the flow never declared.
-            return matchesFoldReturn(capture) || !(0, capture_filters_1.isStructurallyIsolatedCapture)(path, otherPaths);
+            return (matchesFoldReturn(capture) ||
+                matchesDeclaredSubmitEndpoint(capture) ||
+                !(0, capture_filters_1.isStructurallyIsolatedCapture)(path, otherPaths));
         })
         : hostGated;
     // Narrow further using structural relevance, anchored on whichever
@@ -1677,15 +1722,14 @@ function extractActionSequence(captures, submitPatterns = null, foldReturnSpec =
     // authoritative reference, so this pass is a no-op — mirroring
     // compileSubmitMatcher's own null-pattern passthrough — rather than
     // guessing at a reference set.
-    if (!hasSubmitEndpointAnchor)
+    if (!hasSubmitEndpointAnchor || !applyFinalAnchorNarrowing)
         return structurallyGated;
-    const endpointRx = new RegExp(submitPatterns.endpoint);
     const referencePaths = structurallyGated
-        .filter(({ capture }) => endpointRx.test(capture.url))
+        .filter(({ capture }) => matchesDeclaredSubmitEndpoint(capture))
         .map(({ capture }) => safeUrlPathname(capture.url));
     if (referencePaths.length === 0)
         return structurallyGated;
-    return structurallyGated.filter(({ capture }) => endpointRx.test(capture.url) ||
+    return structurallyGated.filter(({ capture }) => matchesDeclaredSubmitEndpoint(capture) ||
         (0, capture_filters_1.isStructurallyRelevantCapture)(safeUrlPathname(capture.url), referencePaths));
 }
 /**
@@ -9005,31 +9049,30 @@ primaryIdentityAnchor = null) {
             specPlan,
         ];
     }
-    // Keyed by the (primaryStepIndex, primaryArrayPath) pair, not
-    // primaryStepIndex alone — a structural plan only ever consumed ITS OWN
-    // array on that step, not the whole step. A spec whose resultsPath names
-    // a second, structurally-undetected array on that exact same primary step
-    // has already been proven independent by the samePrimaryPlan lookup above
-    // (its primaryArrayPath differs from every structural plan's), so keying
-    // solely on the step index would wrongly treat it as already consumed and
-    // silently drop it. consumedIndices tracks only the steps a plan folds
-    // FROM (each target's drillStepIndex), not its whole replay chain — a
-    // target's chain threads through steps it depends on to reach per-item
-    // data, but only its drillStepIndex is the call it actually folds from,
-    // so sweeping the whole chain would falsely claim steps the spec never
-    // contends for.
-    const consumedIndices = new Set();
+    // Keyed by the (primaryStepIndex, primaryArrayPath) pair, not raw step
+    // indices: that pair is the only thing that identifies whether the spec
+    // describes a primary a structural plan ALREADY owns. A structural
+    // target's own `drillStepIndex` (or any index in its replay chain)
+    // coinciding with a step the spec's own resolution happens to touch is
+    // not, on its own, evidence of a real conflict — an unrelated,
+    // independent primary/drill pair can legitimately enter through (or
+    // replay) the exact same underlying capture the spec's chain does (e.g.
+    // a shared session/auth bootstrap call reused by two unrelated
+    // features), and both targets replaying it per their own items is
+    // exactly what {@link resolveSpecMatchedPrimaryItemIndexAlongChain}'s
+    // multi-hop resolution expects — see the shared-bootstrap-hop-noise
+    // regression test. Excluding on raw index overlap (as an earlier version
+    // of this check did, for BOTH the spec's `drillStepIndex` and its whole
+    // `chain`) silently dropped a real, resolvable declared join whenever
+    // some unrelated noisy structural plan merely touched the same index by
+    // coincidence, which is exactly the "declared fold rejected" failure
+    // mode this function exists to prevent.
     const consumedPrimarySteps = new Set();
     for (const plan of structuralPlansWithPerOccurrenceOverrides) {
         const planPrimaryEndpointKey = endpointKey(actions[plan.primaryStepIndex].capture.url);
         consumedPrimarySteps.add(`${planPrimaryEndpointKey}:${JSON.stringify(plan.primaryArrayPath)}`);
-        for (const target of plan.targets) {
-            consumedIndices.add(target.drillStepIndex);
-        }
     }
-    const specConsumesOnlyItsOwnIndices = !consumedIndices.has(specPlan.primaryStepIndex) &&
-        !consumedPrimarySteps.has(`${specPrimaryEndpointKey}:${JSON.stringify(specPlan.primaryArrayPath)}`) &&
-        specPlan.targets.every((target) => target.chain.every((chainIndex) => !consumedIndices.has(chainIndex)));
+    const specConsumesOnlyItsOwnIndices = !consumedPrimarySteps.has(`${specPrimaryEndpointKey}:${JSON.stringify(specPlan.primaryArrayPath)}`);
     if (specConsumesOnlyItsOwnIndices)
         return [...structuralPlansWithPerOccurrenceOverrides, specPlan];
     // The spec's primary endpoint/array is already consumed by a structural
@@ -9677,6 +9720,11 @@ function buildContractChecklist(opts) {
 function emitContractTs(opts) {
     const { siteId, displayName, pascal, baseUrl, baseHeaders, minTime, safeRps, hasRateLimitProbeData = false, responseBody, responseBodySamples = [responseBody], gql, gqlQuery, endpointPath, gqlOperationName, gqlVariables, allCaptures = [], auxFiles, multiStepBody, omitExecuteHttp = false, isSubmissionFlow = false, inputBody, hasMultipartStep = false, actionSteps = [], foldReturnSpec = null, discoveredFormFields, fieldOptionsMap, discoveredOptionFields, discoveredRawOptionFields, discoveredAdditionalBodyKeys, discoveredStructuredKeys, valueConstraints = value_constraints_1.EMPTY_VALUE_CONSTRAINTS, payloadFieldNames, optionalPayloadFieldNames = new Set(), headerBindings = [], unpopulatedDeclaredVariables = [], fallbackGateSpec = {}, } = opts;
     const { browserFallbackGate, httpTimeoutMs } = fallbackGateSpec;
+    /** Single source of truth for every GraphQL-emission decision below
+     * (clientImport, gqlCacheBlock, queryConst, and both executeHttpBody
+     * fetch-call sites) — `gql` alone can be true with a null `gqlQuery`,
+     * which would emit a `${PASCAL}_QUERY` reference with no declaration. */
+    const isGqlEmission = gql && gqlQuery !== null;
     /** Rendered `meta.browserFallbackGate` literal: `false` verbatim, a
      * list-derived arrow-function predicate matching against `error.name`, or
      * "" (omitted) when the flow declared no gate — preserving byte-identical
@@ -10134,15 +10182,15 @@ function emitContractTs(opts) {
     // `noUnusedVariables`.
     const clientImport = omitExecuteHttp
         ? ""
-        : gql
+        : isGqlEmission
             ? `import { createGraphqlClient } from "${ENGINE_PKG}/scraper/graphql-client";${needsFoldHttpClient ? `\nimport { createHttpClient } from "${ENGINE_PKG}/scraper/http-client";` : ""}`
             : `import { createHttpClient } from "${ENGINE_PKG}/scraper/http-client";`;
-    const queryConst = !omitExecuteHttp && gql && gqlQuery
+    const queryConst = !omitExecuteHttp && isGqlEmission
         ? `\n// Lifted verbatim from recon capture. The adjacent response schema is drift-tolerant by construction (dropped __typename, .loose() objects), so this query text is not hand-trimmed.\nconst ${pascal.toUpperCase()}_QUERY = \`${gqlQuery.trim()}\`;\n`
         : "";
     const gqlCacheBlock = omitExecuteHttp
         ? ""
-        : gql
+        : isGqlEmission
             ? `
 type GqlFn = (operationName: string, query: string, variables: Record<string, unknown>) => Promise<${pascal}Response>;
 
@@ -10491,7 +10539,7 @@ const httpClient = createHttpClient({ schema: ${pascal}ResponseSchema, bottlenec
                 signal: paginationSignal,
                 foldMergeLines: paginatedFoldMergeLines,
                 valueConstraints,
-                fetchCall: gql
+                fetchCall: isGqlEmission
                     ? {
                         kind: "gql",
                         gqlOperationNameExpr,
@@ -10499,7 +10547,7 @@ const httpClient = createHttpClient({ schema: ${pascal}ResponseSchema, bottlenec
                     }
                     : { kind: "rest", endpointPath },
             })
-            : gql
+            : isGqlEmission
                 ? `    const data = await getGql(context.baseUrl)(${gqlOperationNameExpr}, ${pascal.toUpperCase()}_QUERY, ${gqlVariablesExpr});
 ${dataFoldMergeBlock}    return { data };`
                 : `    const data = await httpClient(\`\${context.baseUrl}${endpointPath}\`, {
@@ -11591,7 +11639,7 @@ async function main() {
         const minTime = deriveMinTime(rateLimits);
         const hasRateLimitProbeData = rateLimits.some((f) => f.safeRps !== null);
         const safeRps = rateLimits.find((f) => f.safeRps !== null)?.safeRps ?? Math.floor(1000 / minTime);
-        const gql = isGraphQL(activeCaptures);
+        const gql = isGraphQL(activeCaptures, ownBackendHostnames, fallbackDomain);
         // Hoisted so both the primary-operation gate below and rawActionCaptures
         // (further down) read the same computed sequence instead of calling the
         // extractor twice. Computed unfiltered (submitPatterns: null) — a
@@ -11669,9 +11717,25 @@ async function main() {
         // keeps that whole chain; the gap between this and the unfiltered
         // sequence is logged below for visibility, but the declared pattern is
         // never overridden by the richer unfiltered sequence.
+        //
+        // Truncated against a pool RE-EXTRACTED with the declared pattern passed
+        // through (not against unfilteredHeuristicActionCaptures, which is built
+        // with submitPatterns forced to null purely to get an unbiased baseline
+        // for the disagreement check below). extractActionSequence's own
+        // noise/structural-isolation passes have no visibility into the declared
+        // pattern when it's withheld, so on an archive noisy enough to make a
+        // genuine submission capture look structurally isolated, that capture
+        // can be dropped before truncation ever sees it — a real match then
+        // reads as "0 captures" even though the archive contains plenty. Passing
+        // submitPatterns through lets extractActionSequence's own submit-anchor
+        // narrowing (REST) / per-capture submit match (GraphQL) keep the
+        // genuine captures amid that noise, so truncation has them to find.
+        const patternedExtractedActionCaptures = gql
+            ? dedupRedundantSameOperationCaptures(extractGraphQLActionSequence(activeCaptures, submitPatterns, foldReturnSpec, ownBackendHostnames, fallbackDomain), primaryGraphQLOperation)
+            : collapseRedundantSameEndpointCaptures(collapseRedundantPatches(extractActionSequence(activeCaptures, submitPatterns, foldReturnSpec, ownBackendHostnames, fallbackDomain, false)));
         const patternedHeuristicActionCaptures = submitPatterns.endpoint === null && submitPatterns.body === null
             ? unfilteredHeuristicActionCaptures
-            : truncateActionSequenceAtSubmitPattern(unfilteredHeuristicActionCaptures, submitPatterns, foldReturnSpec);
+            : truncateActionSequenceAtSubmitPattern(patternedExtractedActionCaptures, submitPatterns, foldReturnSpec);
         const patternUndercounts = patternedHeuristicActionCaptures.length < unfilteredHeuristicActionCaptures.length;
         if (patternUndercounts && requireSubmitEndpointMatch) {
             // Distinct wording from the non-required case below: this pattern is never