@enricai/barnacle 1.6.1 → 1.6.3

package/README.md

@@ -29,7 +29,7 @@ Human involvement is one recon run up front and a small PR when things change.
 
 | Phase | What runs | What you get |
 |-------|-----------|--------------|
-| **1 — Browser recon** | `pnpm run recon:browser` | Every API call the site makes, captured to `/tmp/recon/graphql/*.json` |
+| **1 — Browser recon** | `pnpm run recon:browser` | Every API call the site makes, captured to `<run-dir>/graphql/*.json` |
 | **2–3 — HTTP replay + probing** | `pnpm run recon:http` | Proof each endpoint works without a browser; rate-limit ceiling; static fixtures |
 | **4 — Plugin generation** | `pnpm run recon:generate` | A complete plugin: Zod schemas, headers, Bottleneck config, hot-path client, Stagehand fallback |
 | **5+ — Runtime** | `pnpm start` | Direct HTTP hot path, automatic browser fallback, nightly smoke test, drift detection |
@@ -100,17 +100,19 @@ pnpm run recon:browser -- --url https://example.com
 
 Drives a real Stagehand + Steel browser through your flow. Captures are wired via a single CDP session-level listener (`page.getSessionForFrame().on(...)`) — Stagehand V3 enables the Network domain internally, so attaching our `Network.requestWillBeSent` / `responseReceived` / `loadingFinished` listeners on the main session catches every response, including the early ones that fire before any page-level handler could be wired.
 
-Captures every network call matching `/graph`, `/api/`, `/graphql`, `/v1/`, or `*.json` to `/tmp/recon/graphql/<NNN>-<phase>-<operationName>.json` — one file per call, diffable and greppable. Use `--capture-all` for sites with non-standard API paths; it captures every response, producing more noise but missing nothing. Omitting both `--flow` and `--flow-file` runs zero interaction steps and captures only the network activity that fires during page navigation — useful for pure GET-style SPAs that fetch everything they need on load.
+Captures every network call matching `/graph`, `/api/`, `/graphql`, `/v1/`, or `*.json` to `<run-dir>/graphql/<NNN>-<phase>-<operationName>.json` — one file per call, diffable and greppable. Use `--capture-all` for sites with non-standard API paths; it captures every response, producing more noise but missing nothing. Omitting both `--flow` and `--flow-file` runs zero interaction steps and captures only the network activity that fires during page navigation — useful for pure GET-style SPAs that fetch everything they need on load.
 
-Each step runs through a self-healing cascade (`act` → `observe + act` → `observe + act` with `ignoreSelectors` → Anthropic-SDK rephrase) verified by network-counter delta or URL change. The script's `main()` attempts up to two global flow replans before giving up; terminal failures dump a diagnostic bundle to `/tmp/recon/step-failures/`. See [docs/playbook.md#1c--self-healing-cascade](./docs/playbook.md#1c--self-healing-cascade) for the full design.
+Each step runs through a self-healing cascade (`act` → `observe + act` → `observe + act` with `ignoreSelectors` → Anthropic-SDK rephrase) verified by network-counter delta or URL change. The script's `main()` attempts up to two global flow replans before giving up; terminal failures dump a diagnostic bundle to `<run-dir>/step-failures/`. See [docs/playbook.md#1c--self-healing-cascade](./docs/playbook.md#1c--self-healing-cascade) for the full design.
 
 Total runtime: 20–40 minutes for a typical flow (longer if healing or replans fire), fully unattended.
 
+Every artifact — captures, cookie-jar snapshots, step-failure dumps, DOM dumps — is rooted under one run-scoped directory resolved once at startup: `<run-dir>` defaults to `/tmp/recon/<runId>`, where `<runId>` is a timestamp + random suffix generated per process (e.g. `20260718-120326-a1b2`). Set `RECON_RUN_ID` to pin a deterministic runId (e.g. for tests or replaying a known run) and `RECON_OUT_DIR` to override the base directory runs are rooted under. This keeps concurrent or repeated runs from intermixing files — the startup log line prints both the resolved `runId` and `out=<run-dir>`.
+
 #### Cookie-jar snapshots
 
 Alongside the network captures, every run snapshots the browser's complete cookie jar (via CDP `Network.getAllCookies`, which returns the whole-browser jar regardless of the current page's URL — unlike `document.cookie` or `Page.getCookies`, it also sees HttpOnly cookies) at each phase boundary: the initial goto, immediately before each flow step (`pre-step`), immediately after each flow step completes (`post-step`), and once more at run completion (`run-complete`).
 
-Snapshots land in `/tmp/recon/cookies/<NNN>-<label>-<phase>.json` — one file per boundary, using the same zero-padded chronological index convention as the network captures. `<label>` is the boundary kind (`goto`, `pre-step`, `post-step`, `run-complete`); `<phase>` is the current step's slugified instruction (e.g. `click-the-apply-button`), or `home` before the first step starts.
+Snapshots land in `<run-dir>/cookies/<NNN>-<label>-<phase>.json` — one file per boundary, using the same zero-padded chronological index convention as the network captures. `<label>` is the boundary kind (`goto`, `pre-step`, `post-step`, `run-complete`); `<phase>` is the current step's slugified instruction (e.g. `click-the-apply-button`), or `home` before the first step starts.
 
 Each file is a JSON object:
 
@@ -122,9 +124,9 @@ Each file is a JSON object:
   "timestamp": "2026-07-18T12:34:56.789Z",
   "cookies": [
     {
-      "name": "_appcast_attr",
+      "name": "_acme_attr",
       "value": "abc123",
-      "domain": ".appcast.io",
+      "domain": ".acme.example",
       "path": "/",
       "expires": 1234567890,
       "size": 20,
@@ -142,7 +144,7 @@ Field reference (mirrors CDP's `Network.Cookie` type verbatim — no remapping b
 | Field | Meaning |
 | --- | --- |
 | `name` / `value` | The cookie's name and value. |
-| `domain` | Scope, e.g. `.appcast.io` (all subdomains) vs. `apply.appcast.io` (exact host) — the detail needed to tell a click-domain cookie from an apply-domain cookie. |
+| `domain` | Scope, e.g. `.acme.example` (all subdomains) vs. `apply.acme.example` (exact host) — the detail needed to tell a click-domain cookie from an apply-domain cookie. |
 | `path` | Cookie path scope. |
 | `expires` | Raw CDP epoch-seconds number; `-1` means a session cookie (also reflected in `session: true`). Not reformatted — read it as CDP reports it. |
 | `size` | Cookie size in bytes, as reported by CDP. |
@@ -152,14 +154,14 @@ Field reference (mirrors CDP's `Network.Cookie` type verbatim — no remapping b
 
 If the CDP call fails, the file still writes but with an empty `cookies` array and an `error` string field carrying the failure message — cookie telemetry is best-effort and never aborts the run.
 
-**Diffing what a phase established:** to isolate what a specific traversal (e.g. the click.appcast.io redirect) minted, diff its `post-step` snapshot against the `pre-step` snapshot for the *next* step — cookies present in the later file but absent from the earlier one were established during that step:
+**Diffing what a phase established:** to isolate what a specific traversal (e.g. a tracking-click redirect) minted, diff its `post-step` snapshot against the `pre-step` snapshot for the *next* step — cookies present in the later file but absent from the earlier one were established during that step:
 
 ```bash
-diff <(jq -S .cookies /tmp/recon/cookies/004-post-step-click-the-apply-button.json) \
-     <(jq -S .cookies /tmp/recon/cookies/005-pre-step-fill-in-your-name.json)
+diff <(jq -S .cookies <run-dir>/cookies/004-post-step-click-the-apply-button.json) \
+     <(jq -S .cookies <run-dir>/cookies/005-pre-step-fill-in-your-name.json)
 ```
 
-**Cookies actually sent per request:** the jar snapshot shows what's *available*, not what's *sent*. Each network capture in `/tmp/recon/graphql/` separately carries the outgoing `Cookie` header in its `requestHeaders` (recovered via CDP's `Network.requestWillBeSentExtraInfo`, since `requestWillBeSent` omits it by design) — cross-reference that capture's `requestHeaders.Cookie` against a jar snapshot to see which of the available cookies a given request, e.g. the application submit, actually sent.
+**Cookies actually sent per request:** the jar snapshot shows what's *available*, not what's *sent*. Each network capture in `<run-dir>/graphql/` separately carries the outgoing `Cookie` header in its `requestHeaders` (recovered via CDP's `Network.requestWillBeSentExtraInfo`, since `requestWillBeSent` omits it by design) — cross-reference that capture's `requestHeaders.Cookie` against a jar snapshot to see which of the available cookies a given request, e.g. the application submit, actually sent.
 
 **Caveat on `Set-Cookie`:** response captures fold `responseReceivedExtraInfo` headers (which is where `Set-Cookie` actually appears — `responseReceived` omits it) into `responseHeaders` as a flat `Record<string, string>`. CDP does not guarantee multiple `Set-Cookie` values on one response stay distinguishable once folded into that shape — if a single response mints more than one cookie, treat the jar snapshot (not the response capture's `Set-Cookie` header) as the source of truth for what actually landed.
 
@@ -169,7 +171,7 @@ diff <(jq -S .cookies /tmp/recon/cookies/004-post-step-click-the-apply-button.js
 pnpm run recon:http
 ```
 
-Replays every capture via plain `fetch()` — no browser, no AI — to prove endpoints work standalone. Every replay returning 200 proves the browser is unnecessary for production. Also runs GraphQL introspection, auxiliary fixture detection (static JSON to commit as fixtures), and a rate-limit probe at 1→3→5 rps (run last — if it triggers a ban, all captures are already saved). Results land in `/tmp/recon/replays/`.
+Replays every capture via plain `fetch()` — no browser, no AI — to prove endpoints work standalone. Every replay returning 200 proves the browser is unnecessary for production. Also runs GraphQL introspection, auxiliary fixture detection (static JSON to commit as fixtures), and a rate-limit probe at 1→3→5 rps (run last — if it triggers a ban, all captures are already saved). Results land under the run-scoped root resolved by `resolveReconRunDir()` — `/tmp/recon/<runId>/replays/` by default, rooted elsewhere via `--out-dir <path>` or `RECON_OUT_DIR`.
 
 See [docs/playbook.md](./docs/playbook.md#interpreting-replay-failures) for the full troubleshooting decision matrix when replays fail.
 
@@ -179,7 +181,7 @@ See [docs/playbook.md](./docs/playbook.md#interpreting-replay-failures) for the
 pnpm run recon:generate -- --site-id my-site
 ```
 
-Reads every artifact from Phases 1–3 — `/tmp/recon/graphql/*.json` (captures), `/tmp/recon/replays/*.json` (replay results), `/tmp/recon/replays/rate-limit.json` (probe findings), `/tmp/recon/aux/*.json` (static fixtures), and `src/sites/my-site/recon-flow.json` — and writes a complete plugin to `src/sites/my-site/`:
+Reads every artifact from Phases 1–3 — `<run-dir>/graphql/*.json` (captures), `<run-dir>/replays/*.json` (replay results), `<run-dir>/replays/rate-limit.json` (probe findings), `<run-dir>/aux/*.json` (static fixtures), and `src/sites/my-site/recon-flow.json` — and writes a complete plugin to `src/sites/my-site/`. Pass `--run-dir <path>` to read a specific run's artifacts instead of the most recently modified run root under `/tmp/recon` (or `RECON_OUT_DIR`, if set):
 
 - `contract.ts` — Zod schemas inferred from captured JSON, load-bearing headers, Bottleneck ceiling, and `executeHttp` / `execute` implementations
 - `flows/browser-flow.ts` — Stagehand fallback wired to your `recon-flow.json` steps
@@ -276,7 +278,7 @@ Optionally generate the human-readable findings doc alongside:
 pnpm run recon:summarize -- --site-id my-site
 ```
 
-Writes `docs/my-site-recon.md` with: endpoints found, replay status, rate-limit ceiling, header frequency table, and hazards (Akamai, Cloudflare). Without `--site-id`, the default output path is `docs/target-recon.md`.
+Writes `docs/my-site-recon.md` with: endpoints found, replay status, rate-limit ceiling, header frequency table, and hazards (Akamai, Cloudflare). Without `--site-id`, the default output path is `docs/target-recon.md`. Accepts `--run-dir <path>` the same way `recon:generate` does.
 
 ### Phase 5 — Register the plugin
 
@@ -485,7 +487,7 @@ Add a step to `.github/workflows/smoke.yml`:
 
 ### Maintenance loop
 
-When the smoke test fails: re-run `pnpm run recon:browser` → diff `/tmp/recon/graphql/*<operationName>*.json` against `src/sites/<id>/contract.ts` → update query / headers / Zod schema → ship. See [docs/playbook.md](./docs/playbook.md#phase-6--drift-detection) for the full maintenance loop and change severity table.
+When the smoke test fails: re-run `pnpm run recon:browser` → diff `<run-dir>/graphql/*<operationName>*.json` against `src/sites/<id>/contract.ts` → update query / headers / Zod schema → ship. See [docs/playbook.md](./docs/playbook.md#phase-6--drift-detection) for the full maintenance loop and change severity table.
 
 ## Runtime internals
 
@@ -499,8 +501,7 @@ When the smoke test fails: re-run `pnpm run recon:browser` → diff `/tmp/recon/
 | `HttpBotChallengeError` | 401 / 403 | **Yes** | Residential proxy IP may get through |
 | `HttpServerError` | 5xx | **Yes** | Server-side outage; recovery strategy is the same |
 | `HttpRateLimitError` | 429 | **No** | A 429 means the configured rps ceiling is too high. Routing to the browser path would just hit the same ceiling and waste a Steel session. The right response is to lower the Bottleneck `minTime` in `contract.ts` and re-deploy. |
-| `HttpUrlLockedError` | 429 | **No** | Oracle HCM returned `ORA_URL_LOCKED` — the requisition URL is locked at Oracle's end. Neither a retry nor a browser session can succeed; the caller must back off and surface a "retry later" state. |
-| `OracleTokenExpiredError` | Any | **No** | Oracle HCM returned a plain-text `ORA_IRC_TOKEN_EXPIRED` sentinel. Retryable so p-retry keeps retrying, but distinct from `UnknownScraperError` so the encompass http-flow can catch exactly this class and re-mint the AccessCode before retrying. |
+| `HttpUrlLockedError` | 429 | **No** | A plugin's `classifyResponseBody` detected a terminal resource-lock sentinel — the URL is locked at the target's end. Neither a retry nor a browser session can succeed; the caller must back off and surface a "retry later" state. |
 | `UnknownScraperError` | Any | **No** | Transient network failure or unclassified non-JSON response. `createHttpClient` retries up to 2 times internally; if all attempts fail, the error propagates as `ScrapeFailureError`. |
 
 ### Cache deduplication
@@ -904,8 +905,8 @@ Every response — success or error — uses the same envelope shape so clients
 | 2003 | `SCRAPE_FAILURE` | Browser automation failed after retries |
 | 2004 | `CAPTCHA_ENCOUNTERED` | CAPTCHA challenge could not be resolved |
 | 2005 | `EMPTY_RESULTS` | Scrape succeeded but returned no data |
-| 2006 | `VERIFICATION_TRIGGER_FAILED` | OTP trigger to Oracle HCM failed |
-| 2007 | `RESUME_INVALID_OTP` | Provided OTP was rejected by Oracle HCM |
+| 2006 | `VERIFICATION_TRIGGER_FAILED` | OTP trigger to the target site failed |
+| 2007 | `RESUME_INVALID_OTP` | Provided OTP was rejected by the target site |
 | 2008 | `URL_LOCKED` | Upstream vendor locked the target URL; back off and retry later |
 
 Full definitions: `src/api/schemas/common.ts`.
@@ -926,16 +927,22 @@ Each registered plugin exposes a POST route following the default convention:
 answers are absent (e.g. Gender, Degree, EducationLevel, SignatureFullName) or
 a repeat-applicant OTP challenge, `/run` returns HTTP 200 with
 `{ needsUserInfo: true, missingFields: [{ field, question }], requiresOtp }`
-instead of a submission result, so Vivian can collect the gaps and hand back.
-
-Plugin-specific extra routes (registered via `meta.extraRoutes` in each plugin):
-
-Encompass Health:
-- `POST /v1/encompasshealth/trigger-otp` — body `{ offerId, email }`; triggers Oracle HCM to email an OTP to a repeat applicant; returns `{ success: true }` or a `2006 VERIFICATION_TRIGGER_FAILED` error envelope
-- `POST /v1/encompasshealth/resume` — body = the full original candidate payload plus `collectedData` and `otpCode`; re-runs the hot path with the collected answers and/or OTP; returns the same `{ verified }` envelope as `/run`, or `2007 RESUME_INVALID_OTP` if the OTP is rejected
-
-Appcast:
-- `POST /v1/appcast/resume` — body = the full original candidate payload plus `collectedData` (no `otpCode` — Appcast has no OTP challenge); re-runs the hot path with the chat-collected answers merged in; returns the same `{ verified, response }` envelope as `/run`
+instead of a submission result, so the caller can collect the gaps and hand back.
+
+Plugins declare their own extra routes via `meta.extraRoutes`, which core registers
+uniformly — the engine has no per-site knowledge. Route paths are declared as
+`:siteId` templates, so the concrete path is whatever the plugin's `siteId` is. Two
+conventional shapes a plugin may add:
+
+- `POST /v1/<siteId>/resume` — body = the full original candidate payload plus
+  `collectedData` (and `otpCode` where the site issues an OTP challenge); re-runs the
+  hot path with the collected answers merged in; returns the same `{ verified }`
+  envelope as `/run`, or `2007 RESUME_INVALID_OTP` if the OTP is rejected
+- `POST /v1/<siteId>/trigger-otp` — body `{ offerId, email }`; asks the target site to
+  email an OTP to a repeat applicant; returns `{ success: true }` or a
+  `2006 VERIFICATION_TRIGGER_FAILED` error envelope
+
+See `examples/plugins/acme-jobs.plugin.json` for a runnable declaration.
 
 Operational routes:
 - `GET /healthz` — liveness probe

package/dist/api/errors.d.ts

@@ -71,9 +71,9 @@ export declare class EmptyResultsApiError extends ApiError {
     constructor(message?: string);
 }
 /**
- * The OTP a candidate supplied to /resume was rejected by Oracle HCM, which
- * surfaces as a 401/403 on the first AccessCode-authed call. Distinct from a
- * generic scrape failure so Vivian can re-prompt for the code rather than
+ * The OTP a candidate supplied to /resume was rejected by the target site, which
+ * typically surfaces as a 401/403 on the first authenticated call. Distinct from a
+ * generic scrape failure so the caller can re-prompt for the code rather than
  * treating the resume as terminally failed.
  */
 export declare class InvalidOtpError extends ApiError {

package/dist/api/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/api/errors.ts"],"names":[],"mappings":"AAGA,OAAO,EAAwC,KAAK,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAE5F;;;;GAIG;AACH,UAAU,eAAe;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,UAAU,gBAAgB;IACxB,MAAM,EAAE;QACN,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,eAAe,EAAE,CAAC;KAC5B,CAAC;CACH;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,CAgCzD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAQvD;AAED;;;;GAIG;AACH,qBAAa,QAAS,SAAQ,KAAK;IACjC,SAAgB,IAAI,EAAE,SAAS,CAAC;IAChC,SAAgB,UAAU,EAAE,MAAM,CAAC;IAEnC,YAAY,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,SAAU,EAKjE;CACF;AAED,qBAAa,iBAAkB,SAAQ,QAAQ;IAC7C,YAAY,OAAO,SAA4C,EAE9D;CACF;AAED,qBAAa,mBAAoB,SAAQ,QAAQ;IAC/C,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED,qBAAa,qBAAsB,SAAQ,QAAQ;IACjD,YAAY,OAAO,SAAwB,EAE1C;CACF;AAED;;;;GAIG;AACH,qBAAa,cAAe,SAAQ,QAAQ;IAC1C,YAAY,OAAO,SAA2D,EAE7E;CACF;AAED,qBAAa,kBAAmB,SAAQ,QAAQ;IAC9C,YAAY,OAAO,SAA0C,EAE5D;CACF;AAED,qBAAa,uBAAwB,SAAQ,QAAQ;IACnD,YAAY,OAAO,SAA2C,EAE7D;CACF;AAED,qBAAa,oBAAqB,SAAQ,QAAQ;IAChD,YAAY,OAAO,SAA6C,EAE/D;CACF;AAED;;;;;GAKG;AACH,qBAAa,eAAgB,SAAQ,QAAQ;IAC3C,YAAY,OAAO,SAA4C,EAE9D;CACF;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,SAAS,EACf,OAAO,EAAE,MAAM,EACf,UAAU,SAAU,GACnB,gBAAgB,CAgBlB"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/api/errors.ts"],"names":[],"mappings":"AAGA,OAAO,EAAwC,KAAK,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAE5F;;;;GAIG;AACH,UAAU,eAAe;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,UAAU,gBAAgB;IACxB,MAAM,EAAE;QACN,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,eAAe,EAAE,CAAC;KAC5B,CAAC;CACH;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,CAgCzD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAQvD;AAED;;;;GAIG;AACH,qBAAa,QAAS,SAAQ,KAAK;IACjC,SAAgB,IAAI,EAAE,SAAS,CAAC;IAChC,SAAgB,UAAU,EAAE,MAAM,CAAC;IAEnC,YAAY,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,SAAU,EAKjE;CACF;AAED,qBAAa,iBAAkB,SAAQ,QAAQ;IAC7C,YAAY,OAAO,SAA4C,EAE9D;CACF;AAED,qBAAa,mBAAoB,SAAQ,QAAQ;IAC/C,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED,qBAAa,qBAAsB,SAAQ,QAAQ;IACjD,YAAY,OAAO,SAAwB,EAE1C;CACF;AAED;;;;GAIG;AACH,qBAAa,cAAe,SAAQ,QAAQ;IAC1C,YAAY,OAAO,SAA2D,EAE7E;CACF;AAED,qBAAa,kBAAmB,SAAQ,QAAQ;IAC9C,YAAY,OAAO,SAA0C,EAE5D;CACF;AAED,qBAAa,uBAAwB,SAAQ,QAAQ;IACnD,YAAY,OAAO,SAA2C,EAE7D;CACF;AAED,qBAAa,oBAAqB,SAAQ,QAAQ;IAChD,YAAY,OAAO,SAA6C,EAE/D;CACF;AAED;;;;;GAKG;AACH,qBAAa,eAAgB,SAAQ,QAAQ;IAC3C,YAAY,OAAO,SAAiD,EAEnE;CACF;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,SAAS,EACf,OAAO,EAAE,MAAM,EACf,UAAU,SAAU,GACnB,gBAAgB,CAgBlB"}

package/dist/api/errors.js

@@ -129,13 +129,13 @@ class EmptyResultsApiError extends ApiError {
 }
 exports.EmptyResultsApiError = EmptyResultsApiError;
 /**
- * The OTP a candidate supplied to /resume was rejected by Oracle HCM, which
- * surfaces as a 401/403 on the first AccessCode-authed call. Distinct from a
- * generic scrape failure so Vivian can re-prompt for the code rather than
+ * The OTP a candidate supplied to /resume was rejected by the target site, which
+ * typically surfaces as a 401/403 on the first authenticated call. Distinct from a
+ * generic scrape failure so the caller can re-prompt for the code rather than
  * treating the resume as terminally failed.
  */
 class InvalidOtpError extends ApiError {
-    constructor(message = "provided OTP was rejected by Oracle HCM") {
+    constructor(message = "provided OTP was rejected by the target site") {
         super(common_1.ERROR_CODES.RESUME_INVALID_OTP, message);
     }
 }

package/dist/api/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/api/errors.ts"],"names":[],"mappings":";;;;;;AAAA,uCAAqC;AACrC,yDAAiE;AAEjE,iDAA4F;AAsB5F;;;;;;;;GAQG;AACH,2BAAkC,IAAe;IAC/C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,oBAAW,CAAC,uBAAuB;YACtC,OAAO,+BAAW,CAAC,eAAe,CAAC;QACrC,KAAK,oBAAW,CAAC,mBAAmB;YAClC,OAAO,+BAAW,CAAC,YAAY,CAAC;QAClC,KAAK,oBAAW,CAAC,cAAc,CAAC;QAChC,KAAK,oBAAW,CAAC,eAAe,CAAC;QACjC,KAAK,oBAAW,CAAC,aAAa;YAC5B,OAAO,+BAAW,CAAC,WAAW,CAAC;QACjC,KAAK,oBAAW,CAAC,kBAAkB,CAAC;QACpC,KAAK,oBAAW,CAAC,eAAe;YAC9B,OAAO,+BAAW,CAAC,SAAS,CAAC;QAC/B,KAAK,oBAAW,CAAC,iBAAiB,CAAC;QACnC,KAAK,oBAAW,CAAC,UAAU;YACzB,OAAO,+BAAW,CAAC,iBAAiB,CAAC;QACvC,KAAK,oBAAW,CAAC,QAAQ;YACvB,OAAO,+BAAW,CAAC,eAAe,CAAC;QACrC,KAAK,oBAAW,CAAC,aAAa;YAC5B,OAAO,+BAAW,CAAC,SAAS,CAAC;QAC/B,KAAK,oBAAW,CAAC,iBAAiB,CAAC;QACnC,KAAK,oBAAW,CAAC,aAAa,CAAC;QAC/B,KAAK,oBAAW,CAAC,YAAY,CAAC;QAC9B,KAAK,oBAAW,CAAC,cAAc,CAAC;QAChC,KAAK,oBAAW,CAAC,mBAAmB,CAAC;QACrC,KAAK,oBAAW,CAAC,2BAA2B;YAC1C,OAAO,+BAAW,CAAC,qBAAqB,CAAC;QAC3C,KAAK,oBAAW,CAAC,kBAAkB;YACjC,OAAO,+BAAW,CAAC,WAAW,CAAC;QACjC;YACE,OAAO,+BAAW,CAAC,qBAAqB,CAAC;IAC7C,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,0BAAiC,MAAc;IAC7C,IAAI,CAAC;QACH,OAAO,IAAA,mCAAe,EAAC,MAAM,CAAC;aAC3B,WAAW,EAAE;aACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,MAAM,EAAE,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,cAAsB,SAAQ,KAAK;IACjB,IAAI,CAAY;IAChB,UAAU,CAAS;IAEnC,YAAY,IAAe,EAAE,OAAe,EAAE,UAAU,GAAG,OAAO;QAChE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;;AAED,uBAA+B,SAAQ,QAAQ;IAC7C,YAAY,OAAO,GAAG,yCAAyC;QAC7D,KAAK,CAAC,oBAAW,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;CACF;;AAED,yBAAiC,SAAQ,QAAQ;IAC/C,YAAY,OAAe;QACzB,KAAK,CAAC,oBAAW,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;CACF;;AAED,2BAAmC,SAAQ,QAAQ;IACjD,YAAY,OAAO,GAAG,qBAAqB;QACzC,KAAK,CAAC,oBAAW,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;CACF;;AAED;;;;GAIG;AACH,oBAA4B,SAAQ,QAAQ;IAC1C,YAAY,OAAO,GAAG,wDAAwD;QAC5E,KAAK,CAAC,oBAAW,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;CACF;;AAED,wBAAgC,SAAQ,QAAQ;IAC9C,YAAY,OAAO,GAAG,uCAAuC;QAC3D,KAAK,CAAC,oBAAW,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;CACF;;AAED,6BAAqC,SAAQ,QAAQ;IACnD,YAAY,OAAO,GAAG,wCAAwC;QAC5D,KAAK,CAAC,oBAAW,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;CACF;;AAED,0BAAkC,SAAQ,QAAQ;IAChD,YAAY,OAAO,GAAG,0CAA0C;QAC9D,KAAK,CAAC,oBAAW,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;CACF;;AAED;;;;;GAKG;AACH,qBAA6B,SAAQ,QAAQ;IAC3C,YAAY,OAAO,GAAG,yCAAyC;QAC7D,KAAK,CAAC,oBAAW,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;CACF;;AAED;;;;GAIG;AACH,4BACE,IAAe,EACf,OAAe,EACf,UAAU,GAAG,OAAO;IAEpB,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC3C,OAAO;QACL,MAAM,EAAE;YACN,UAAU,EAAE,gBAAgB,CAAC,UAAU,CAAC;YACxC,QAAQ,EAAE,IAAA,oBAAS,EAAC,IAAI,IAAI,EAAE,CAAC;YAC/B,OAAO,EAAE;gBACP;oBACE,IAAI;oBACJ,eAAe,EAAE,gCAAuB,CAAC,IAAI,CAAC;oBAC9C,UAAU;oBACV,OAAO;iBACR;aACF;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/api/errors.ts"],"names":[],"mappings":";;;;;;AAAA,uCAAqC;AACrC,yDAAiE;AAEjE,iDAA4F;AAsB5F;;;;;;;;GAQG;AACH,2BAAkC,IAAe;IAC/C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,oBAAW,CAAC,uBAAuB;YACtC,OAAO,+BAAW,CAAC,eAAe,CAAC;QACrC,KAAK,oBAAW,CAAC,mBAAmB;YAClC,OAAO,+BAAW,CAAC,YAAY,CAAC;QAClC,KAAK,oBAAW,CAAC,cAAc,CAAC;QAChC,KAAK,oBAAW,CAAC,eAAe,CAAC;QACjC,KAAK,oBAAW,CAAC,aAAa;YAC5B,OAAO,+BAAW,CAAC,WAAW,CAAC;QACjC,KAAK,oBAAW,CAAC,kBAAkB,CAAC;QACpC,KAAK,oBAAW,CAAC,eAAe;YAC9B,OAAO,+BAAW,CAAC,SAAS,CAAC;QAC/B,KAAK,oBAAW,CAAC,iBAAiB,CAAC;QACnC,KAAK,oBAAW,CAAC,UAAU;YACzB,OAAO,+BAAW,CAAC,iBAAiB,CAAC;QACvC,KAAK,oBAAW,CAAC,QAAQ;YACvB,OAAO,+BAAW,CAAC,eAAe,CAAC;QACrC,KAAK,oBAAW,CAAC,aAAa;YAC5B,OAAO,+BAAW,CAAC,SAAS,CAAC;QAC/B,KAAK,oBAAW,CAAC,iBAAiB,CAAC;QACnC,KAAK,oBAAW,CAAC,aAAa,CAAC;QAC/B,KAAK,oBAAW,CAAC,YAAY,CAAC;QAC9B,KAAK,oBAAW,CAAC,cAAc,CAAC;QAChC,KAAK,oBAAW,CAAC,mBAAmB,CAAC;QACrC,KAAK,oBAAW,CAAC,2BAA2B;YAC1C,OAAO,+BAAW,CAAC,qBAAqB,CAAC;QAC3C,KAAK,oBAAW,CAAC,kBAAkB;YACjC,OAAO,+BAAW,CAAC,WAAW,CAAC;QACjC;YACE,OAAO,+BAAW,CAAC,qBAAqB,CAAC;IAC7C,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,0BAAiC,MAAc;IAC7C,IAAI,CAAC;QACH,OAAO,IAAA,mCAAe,EAAC,MAAM,CAAC;aAC3B,WAAW,EAAE;aACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,MAAM,EAAE,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,cAAsB,SAAQ,KAAK;IACjB,IAAI,CAAY;IAChB,UAAU,CAAS;IAEnC,YAAY,IAAe,EAAE,OAAe,EAAE,UAAU,GAAG,OAAO;QAChE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;;AAED,uBAA+B,SAAQ,QAAQ;IAC7C,YAAY,OAAO,GAAG,yCAAyC;QAC7D,KAAK,CAAC,oBAAW,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;CACF;;AAED,yBAAiC,SAAQ,QAAQ;IAC/C,YAAY,OAAe;QACzB,KAAK,CAAC,oBAAW,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;CACF;;AAED,2BAAmC,SAAQ,QAAQ;IACjD,YAAY,OAAO,GAAG,qBAAqB;QACzC,KAAK,CAAC,oBAAW,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;CACF;;AAED;;;;GAIG;AACH,oBAA4B,SAAQ,QAAQ;IAC1C,YAAY,OAAO,GAAG,wDAAwD;QAC5E,KAAK,CAAC,oBAAW,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;CACF;;AAED,wBAAgC,SAAQ,QAAQ;IAC9C,YAAY,OAAO,GAAG,uCAAuC;QAC3D,KAAK,CAAC,oBAAW,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;CACF;;AAED,6BAAqC,SAAQ,QAAQ;IACnD,YAAY,OAAO,GAAG,wCAAwC;QAC5D,KAAK,CAAC,oBAAW,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;CACF;;AAED,0BAAkC,SAAQ,QAAQ;IAChD,YAAY,OAAO,GAAG,0CAA0C;QAC9D,KAAK,CAAC,oBAAW,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;CACF;;AAED;;;;;GAKG;AACH,qBAA6B,SAAQ,QAAQ;IAC3C,YAAY,OAAO,GAAG,8CAA8C;QAClE,KAAK,CAAC,oBAAW,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;CACF;;AAED;;;;GAIG;AACH,4BACE,IAAe,EACf,OAAe,EACf,UAAU,GAAG,OAAO;IAEpB,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC3C,OAAO;QACL,MAAM,EAAE;YACN,UAAU,EAAE,gBAAgB,CAAC,UAAU,CAAC;YACxC,QAAQ,EAAE,IAAA,oBAAS,EAAC,IAAI,IAAI,EAAE,CAAC;YAC/B,OAAO,EAAE;gBACP;oBACE,IAAI;oBACJ,eAAe,EAAE,gCAAuB,CAAC,IAAI,CAAC;oBAC9C,UAAU;oBACV,OAAO;iBACR;aACF;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/api/helpers/reply.d.ts

@@ -3,7 +3,7 @@ import type { ErrorCode } from "../../api/schemas/common";
 import type { DispatchMetrics } from "../../types/dispatch-metrics";
 /**
  * Sends a standard error envelope on the given reply, optionally including
- * dispatch metrics so Vivian can forward step-level detail even on failures.
+ * dispatch metrics so the caller can forward step-level detail even on failures.
  */
 export declare function replyWithError(reply: FastifyReply, code: ErrorCode, message: string, detailType?: string, statusOverride?: number, metrics?: DispatchMetrics): void;
 //# sourceMappingURL=reply.d.ts.map

package/dist/api/helpers/reply.js

@@ -4,7 +4,7 @@ exports.replyWithError = replyWithError;
 const errors_1 = require("../../api/errors");
 /**
  * Sends a standard error envelope on the given reply, optionally including
- * dispatch metrics so Vivian can forward step-level detail even on failures.
+ * dispatch metrics so the caller can forward step-level detail even on failures.
  */
 function replyWithError(reply, code, message, detailType, statusOverride, metrics) {
     const envelope = (0, errors_1.buildErrorEnvelope)(code, message, detailType);

package/dist/cache/keyed-ttl-cache.d.ts

@@ -1,8 +1,8 @@
 /**
  * Generic per-key TTL cache factory with single-flight warmup coalescing.
  *
- * Why this exists: both `src/cache/response-cache.ts` and
- * `src/sites/appcast/tokens/cache.ts` independently hand-roll the same
+ * Why this exists: both `src/cache/response-cache.ts` and a plugin's
+ * `tokens/cache.ts` independently hand-roll the same
  * inFlight Map + LRUCache wiring. Any future site needing a per-key token
  * or session cache would copy it a third time. This factory captures the
  * shared invariant — promise registered synchronously before any yield so
@@ -33,8 +33,8 @@ export interface KeyedTtlCache<T extends object> {
  * in-flight promise is written to the map *synchronously* — before any
  * microtask yield — guaranteeing that every concurrent caller for the same
  * key awaits the same promise instead of kicking off a duplicate warmup.
- * See the same pattern at `response-cache.ts:108-111` and
- * `appcast/tokens/cache.ts:124-125`.
+ * See the same pattern at `response-cache.ts:108-111` and a plugin's
+ * `tokens/cache.ts:124-125`.
  *
  * `getOrWarm` returns `{ ...value }` (a shallow copy) to each caller so
  * that an in-place mutation of the master cache entry (e.g. rotating a

package/dist/cache/keyed-ttl-cache.js

@@ -13,8 +13,8 @@ const lru_cache_1 = require("lru-cache");
  * in-flight promise is written to the map *synchronously* — before any
  * microtask yield — guaranteeing that every concurrent caller for the same
  * key awaits the same promise instead of kicking off a duplicate warmup.
- * See the same pattern at `response-cache.ts:108-111` and
- * `appcast/tokens/cache.ts:124-125`.
+ * See the same pattern at `response-cache.ts:108-111` and a plugin's
+ * `tokens/cache.ts:124-125`.
  *
  * `getOrWarm` returns `{ ...value }` (a shallow copy) to each caller so
  * that an in-place mutation of the master cache entry (e.g. rotating a

package/dist/lib/applicant-payload.d.ts

@@ -1,9 +1,9 @@
 /**
  * Shared Zod schema for the applicant identity, address, and resume fields
- * that AppCast-powered ATS plugins require on every submission. Both AppCast
- * and Encompass Health declare the same 13 fields; this module is the single
- * source of truth so a field-type change propagates to every AppCast-shaped
- * plugin from one place.
+ * that JSON-envelope ATS plugins require on every submission. Multiple
+ * production plugins declare the same 13 fields; this module is the single
+ * source of truth so a field-type change propagates to every plugin of this
+ * shape from one place.
  *
  * Diverging fields (Email, BaseUrl, ClickUrl, JobId, Answers) stay in each
  * plugin's own contract because their types or presence differ across plugins.

package/dist/lib/applicant-payload.js

@@ -1,10 +1,10 @@
 "use strict";
 /**
  * Shared Zod schema for the applicant identity, address, and resume fields
- * that AppCast-powered ATS plugins require on every submission. Both AppCast
- * and Encompass Health declare the same 13 fields; this module is the single
- * source of truth so a field-type change propagates to every AppCast-shaped
- * plugin from one place.
+ * that JSON-envelope ATS plugins require on every submission. Multiple
+ * production plugins declare the same 13 fields; this module is the single
+ * source of truth so a field-type change propagates to every plugin of this
+ * shape from one place.
  *
  * Diverging fields (Email, BaseUrl, ClickUrl, JobId, Answers) stay in each
  * plugin's own contract because their types or presence differ across plugins.

package/dist/lib/application-address.d.ts

@@ -1,7 +1,7 @@
 /**
- * Shared Zod fragment for the six address fields that AppCast-powered plugins
- * (AppCast, Encompass Health) require on every submission. Extracted so a
- * field-type change propagates from one place to every consumer.
+ * Shared Zod fragment for the six address fields that multiple production ATS
+ * plugins require on every submission. Extracted so a field-type change
+ * propagates from one place to every consumer.
  */
 import { z } from "zod/v4";
 export declare const ApplicantAddressSchema: z.ZodObject<{

package/dist/lib/application-address.js

@@ -1,8 +1,8 @@
 "use strict";
 /**
- * Shared Zod fragment for the six address fields that AppCast-powered plugins
- * (AppCast, Encompass Health) require on every submission. Extracted so a
- * field-type change propagates from one place to every consumer.
+ * Shared Zod fragment for the six address fields that multiple production ATS
+ * plugins require on every submission. Extracted so a field-type change
+ * propagates from one place to every consumer.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ApplicantAddressSchema = void 0;
@@ -13,8 +13,8 @@ exports.ApplicantAddressSchema = v4_1.z.object({
     State: v4_1.z.string().min(1),
     PostalCode: v4_1.z.string().min(1),
     Country: v4_1.z.string().min(1),
-    /** Applicant's home county. Required by some tenants (Encompass Health and
-     * similar) before submit unlocks. */
+    /** Applicant's home county. Required by some tenants before submit
+     * unlocks. */
     County: v4_1.z.string().min(1),
 });
 //# sourceMappingURL=application-address.js.map

package/dist/lib/application-address.js.map

@@ -1 +1 @@
-{"version":3,"file":"application-address.js","sourceRoot":"","sources":["../../src/lib/application-address.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEH,+BAA2B;AAEd,QAAA,sBAAsB,GAAG,MAAC,CAAC,MAAM,CAAC;IAC7C,WAAW,EAAE,MAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,IAAI,EAAE,MAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,MAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,UAAU,EAAE,MAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,OAAO,EAAE,MAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B;yCACqC;IACrC,MAAM,EAAE,MAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1B,CAAC,CAAC"}
+{"version":3,"file":"application-address.js","sourceRoot":"","sources":["../../src/lib/application-address.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEH,+BAA2B;AAEd,QAAA,sBAAsB,GAAG,MAAC,CAAC,MAAM,CAAC;IAC7C,WAAW,EAAE,MAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,IAAI,EAAE,MAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,MAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,UAAU,EAAE,MAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,OAAO,EAAE,MAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B;kBACc;IACd,MAAM,EAAE,MAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1B,CAAC,CAAC"}

package/dist/lib/application-resume.d.ts

@@ -1,14 +1,14 @@
 /**
- * Shared Zod schema for the resume attachment block that AppCast-powered ATS
- * plugins require on every submission. AppCast and Encompass Health both declare
+ * Shared Zod schema for the resume attachment block that JSON-envelope ATS
+ * plugins require on every submission. Multiple production plugins declare
  * the same four fields; this fragment is extracted so the Buffer/instanceof
  * constraint and the base64 twin are defined once and propagate to every
- * AppCast-shaped plugin from one source of truth.
+ * plugin of this shape from one source of truth.
  *
  * `Resume` must be a real Node.js Buffer — multipart form builders call
  * `fd.append("Resume", payload.Resume, ...)` which requires an actual Buffer
  * instance, not a base64 string. `ResumeBase64` carries the same bytes
- * pre-encoded for JSON payloads (e.g. the AppCast `interruption_check` body).
+ * pre-encoded for JSON payloads (e.g. the `interruption_check` body).
  */
 import { z } from "zod/v4";
 export declare const ApplicantResumeSchema: z.ZodObject<{

package/dist/lib/application-resume.js

@@ -1,15 +1,15 @@
 "use strict";
 /**
- * Shared Zod schema for the resume attachment block that AppCast-powered ATS
- * plugins require on every submission. AppCast and Encompass Health both declare
+ * Shared Zod schema for the resume attachment block that JSON-envelope ATS
+ * plugins require on every submission. Multiple production plugins declare
  * the same four fields; this fragment is extracted so the Buffer/instanceof
  * constraint and the base64 twin are defined once and propagate to every
- * AppCast-shaped plugin from one source of truth.
+ * plugin of this shape from one source of truth.
  *
  * `Resume` must be a real Node.js Buffer — multipart form builders call
  * `fd.append("Resume", payload.Resume, ...)` which requires an actual Buffer
  * instance, not a base64 string. `ResumeBase64` carries the same bytes
- * pre-encoded for JSON payloads (e.g. the AppCast `interruption_check` body).
+ * pre-encoded for JSON payloads (e.g. the `interruption_check` body).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ApplicantResumeSchema = void 0;

package/dist/lib/dispatch-metrics.js

@@ -5,7 +5,7 @@ exports.MetricsCollector = void 0;
  * Lightweight step-timing accumulator for a single dispatch invocation.
  * Instantiated per-request in the dispatch layer, threaded through
  * SitePluginContext, and finalized into a DispatchMetrics payload that
- * ships in the response body for Vivian → Segment forwarding.
+ * ships in the response body for caller → Segment forwarding.
  */
 const date_fns_1 = require("date-fns");
 /** Accumulates step-level timing for a single dispatch, producing a DispatchMetrics payload for the response. */

package/dist/lib/llm/judges/verify-submit.d.ts

@@ -7,7 +7,7 @@
  * Empirically validated 2026-06-11 on two production failure cases:
  *  - Case A (was wrongly flagged as failure by the regex): verdict=true,
  *    correctly identified dom_signal="uapp-universal-submitted-page" and
- *    url_signal="/applyboard/applied".
+ *    url_signal="/<vendor>/applied".
  *  - Case B (genuinely stuck, 10 ng-invalid markers, no success DOM):
  *    verdict=false with a coherent reason about why submission failed.
  *

package/dist/lib/llm/judges/verify-submit.js

@@ -8,7 +8,7 @@
  * Empirically validated 2026-06-11 on two production failure cases:
  *  - Case A (was wrongly flagged as failure by the regex): verdict=true,
  *    correctly identified dom_signal="uapp-universal-submitted-page" and
- *    url_signal="/applyboard/applied".
+ *    url_signal="/<vendor>/applied".
  *  - Case B (genuinely stuck, 10 ng-invalid markers, no success DOM):
  *    verdict=false with a coherent reason about why submission failed.
  *

package/dist/lib/llm/schemas.js

@@ -38,9 +38,9 @@ exports.RECON_FLOW_STEP_SCHEMA = v4_1.z.union([
          * When true, the step is treated as the canonical submit click for the
          * `submitEndpointPattern` verifier even when its position in the flow
          * is not the last index. The pre-2026-06-15 implementation gated the
-         * pre-submit DOM probe on `isFinalStep` only, but real AppCast flows
-         * put the submit click in the middle of the step list (UVA Verona's
-         * Submit was at index 55/328) and follow it with post-submit
+         * pre-submit DOM probe on `isFinalStep` only, but real production flows
+         * put the submit click in the middle of the step list (one measured
+         * tenant's Submit was at index 55/328) and follow it with post-submit
          * verification steps. With this flag set, the probe + verifier fire
          * at the actual submit click, not at the unrelated last step.
          */

package/dist/lib/phone.d.ts

@@ -1,6 +1,6 @@
 /**
  * Parses a US phone string into area code and subscriber number.
- * Oracle HCM requires the phone split into `areaCode` (first 3 digits) and
+ * Some ATS backends require the phone split into `areaCode` (first 3 digits) and
  * `number` (remaining digits). Inputs shorter than 10 digits get an empty
  * `areaCode` so the partial number is still submitted as-is.
  */

package/dist/lib/phone.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.parsePhone = parsePhone;
 /**
  * Parses a US phone string into area code and subscriber number.
- * Oracle HCM requires the phone split into `areaCode` (first 3 digits) and
+ * Some ATS backends require the phone split into `areaCode` (first 3 digits) and
  * `number` (remaining digits). Inputs shorter than 10 digits get an empty
  * `areaCode` so the partial number is still submitted as-is.
  */

package/dist/lib/telemetry/call-types.d.ts

@@ -26,7 +26,7 @@ export declare const CALL_TYPE_STAGEHAND_EXTRACT = "stagehand-extract";
 /**
  * Haiku 4.5 judge for submit-success verification. Replaces the per-site
  * regex (`submitEndpointPattern`) that mislabeled successful submits as
- * failures whenever AppCast used a different POST URL than the regex
+ * failures whenever a site used a different POST URL than the regex
  * expected. The judge receives evidence (recent network captures, page
  * URL/title, unfocused observe, site criteria) and returns a discriminated
  * verdict — verified=true requires multi-signal corroboration to prevent

package/dist/lib/telemetry/call-types.js

@@ -29,7 +29,7 @@ exports.CALL_TYPE_STAGEHAND_EXTRACT = "stagehand-extract";
 /**
  * Haiku 4.5 judge for submit-success verification. Replaces the per-site
  * regex (`submitEndpointPattern`) that mislabeled successful submits as
- * failures whenever AppCast used a different POST URL than the regex
+ * failures whenever a site used a different POST URL than the regex
  * expected. The judge receives evidence (recent network captures, page
  * URL/title, unfocused observe, site criteria) and returns a discriminated
  * verdict — verified=true requires multi-signal corroboration to prevent

package/dist/lib/tracking-click.d.ts

@@ -1,9 +1,11 @@
 /**
- * Fire-and-forget background click for Appcast vivclid tracking URLs.
+ * Fire-and-forget background click for vendor click-tracking URLs.
  * After a successful submission, Barnacle navigates to the tracking URL
- * in a short-lived Browserbase session so Appcast records the Click event.
+ * in a short-lived Browserbase session so the tracking vendor records the
+ * Click event.
  *
- * Navigation pattern is proven against click.appcast.io with advancedStealth.
+ * Navigation pattern is proven against production click-tracking domains
+ * with advancedStealth.
  * No CDP behavioral signals are needed; those are only required when extracting
  * DataDome tokens for subsequent Node HTTP requests.
  */

package/dist/lib/tracking-click.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tracking-click.d.ts","sourceRoot":"","sources":["../../src/lib/tracking-click.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA0DH;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAK3E;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,SAAS,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAO3E"}
+{"version":3,"file":"tracking-click.d.ts","sourceRoot":"","sources":["../../src/lib/tracking-click.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AA0DH;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAK3E;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,SAAS,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAO3E"}

package/dist/lib/tracking-click.js

@@ -1,10 +1,12 @@
 "use strict";
 /**
- * Fire-and-forget background click for Appcast vivclid tracking URLs.
+ * Fire-and-forget background click for vendor click-tracking URLs.
  * After a successful submission, Barnacle navigates to the tracking URL
- * in a short-lived Browserbase session so Appcast records the Click event.
+ * in a short-lived Browserbase session so the tracking vendor records the
+ * Click event.
  *
- * Navigation pattern is proven against click.appcast.io with advancedStealth.
+ * Navigation pattern is proven against production click-tracking domains
+ * with advancedStealth.
  * No CDP behavioral signals are needed; those are only required when extracting
  * DataDome tokens for subsequent Node HTTP requests.
  */

package/dist/lib/tracking-click.js.map

@@ -1 +1 @@
-{"version":3,"file":"tracking-click.js","sourceRoot":"","sources":["../../src/lib/tracking-click.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;;AAEH,iDAK0B;AAC1B,yCAA8C;AAC9C,2CAA0C;AAC1C,uEAAgF;AAEhF,MAAM,MAAM,GAAG,IAAA,mBAAS,EAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;AAErD,MAAM,mBAAmB,GAAG,MAAM,CAAC;AACnC,MAAM,cAAc,GAAG,KAAK,CAAC;AAC7B,MAAM,mCAAmC,GAAG,GAAG,CAAC;AAEhD,MAAM,cAAc,GAAG,IAAI,GAAG,EAAiB,CAAC;AAEhD;;;;GAIG;AACH,KAAK,UAAU,oBAAoB,CAAC,WAAmB,EAAE,MAAc;IACrE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAA,uCAA0B,EAAC,MAAM,CAAC,CAAC;IAEnC,IAAI,OAAgF,CAAC;IACrF,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,IAAA,qDAA+B,EAAC;YAC9C,eAAe,EAAE,IAAI;YACrB,8BAA8B,EAAE,EAAE,OAAO,EAAE,mCAAmC,EAAE;SACjF,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;QAC/D,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,kBAAkB,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAChG,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;QAE1C,IAAA,uCAA0B,EAAC,MAAM,CAAC,CAAC;QACnC,MAAM,CAAC,IAAI,CACT,+BAA+B,MAAM,QAAQ,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,eAAe,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAC9G,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAA,uCAA0B,EAAC,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5F,MAAM,CAAC,IAAI,CACT,8BAA8B,MAAM,QAAQ,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,IAAA,uBAAc,EAAC,GAAG,CAAC,EAAE,CAChG,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,IAAA,wCAA2B,EAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC;QAC5D,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,EAAE;gBACvC,MAAM,CAAC,IAAI,CAAC,wCAAwC,IAAA,uBAAc,EAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAClF,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,2BAAkC,WAAmB,EAAE,MAAc;IACnE,MAAM,OAAO,GAAG,oBAAoB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;QACrE,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IACH,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACI,KAAK,8BAA8B,SAAS,GAAG,MAAM;IAC1D,IAAI,cAAc,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO;IACtC,MAAM,CAAC,IAAI,CAAC,YAAY,cAAc,CAAC,IAAI,8BAA8B,CAAC,CAAC;IAC3E,MAAM,OAAO,CAAC,IAAI,CAAC;QACjB,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC;QACvC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;KAC/D,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"tracking-click.js","sourceRoot":"","sources":["../../src/lib/tracking-click.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;;AAEH,iDAK0B;AAC1B,yCAA8C;AAC9C,2CAA0C;AAC1C,uEAAgF;AAEhF,MAAM,MAAM,GAAG,IAAA,mBAAS,EAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;AAErD,MAAM,mBAAmB,GAAG,MAAM,CAAC;AACnC,MAAM,cAAc,GAAG,KAAK,CAAC;AAC7B,MAAM,mCAAmC,GAAG,GAAG,CAAC;AAEhD,MAAM,cAAc,GAAG,IAAI,GAAG,EAAiB,CAAC;AAEhD;;;;GAIG;AACH,KAAK,UAAU,oBAAoB,CAAC,WAAmB,EAAE,MAAc;IACrE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAA,uCAA0B,EAAC,MAAM,CAAC,CAAC;IAEnC,IAAI,OAAgF,CAAC;IACrF,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,IAAA,qDAA+B,EAAC;YAC9C,eAAe,EAAE,IAAI;YACrB,8BAA8B,EAAE,EAAE,OAAO,EAAE,mCAAmC,EAAE;SACjF,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;QAC/D,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,kBAAkB,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAChG,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;QAE1C,IAAA,uCAA0B,EAAC,MAAM,CAAC,CAAC;QACnC,MAAM,CAAC,IAAI,CACT,+BAA+B,MAAM,QAAQ,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,eAAe,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAC9G,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAA,uCAA0B,EAAC,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5F,MAAM,CAAC,IAAI,CACT,8BAA8B,MAAM,QAAQ,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,IAAA,uBAAc,EAAC,GAAG,CAAC,EAAE,CAChG,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,IAAA,wCAA2B,EAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC;QAC5D,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,EAAE;gBACvC,MAAM,CAAC,IAAI,CAAC,wCAAwC,IAAA,uBAAc,EAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAClF,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,2BAAkC,WAAmB,EAAE,MAAc;IACnE,MAAM,OAAO,GAAG,oBAAoB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;QACrE,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IACH,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACI,KAAK,8BAA8B,SAAS,GAAG,MAAM;IAC1D,IAAI,cAAc,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO;IACtC,MAAM,CAAC,IAAI,CAAC,YAAY,cAAc,CAAC,IAAI,8BAA8B,CAAC,CAAC;IAC3E,MAAM,OAAO,CAAC,IAAI,CAAC;QACjB,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC;QACvC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;KAC/D,CAAC,CAAC;AACL,CAAC"}

package/dist/lib/us-states.d.ts

@@ -1,6 +1,6 @@
 /**
  * Shared US state and territory name→abbreviation map. Extracted from
- * site-specific copies in appcast and encompasshealth so any plugin can
+ * site-specific copies in multiple plugins so any plugin can
  * resolve a full state name (or a 2-letter code) to an uppercase abbreviation
  * without duplicating this data.
  *

package/dist/lib/us-states.js

@@ -1,7 +1,7 @@
 "use strict";
 /**
  * Shared US state and territory name→abbreviation map. Extracted from
- * site-specific copies in appcast and encompasshealth so any plugin can
+ * site-specific copies in multiple plugins so any plugin can
  * resolve a full state name (or a 2-letter code) to an uppercase abbreviation
  * without duplicating this data.
  *

package/dist/plugins/loader.js

@@ -278,8 +278,8 @@ async function registerRoutes(app, cfg, plugins) {
 }
 /**
  * Fastify registers each `method+url` exactly once, but several plugins declare
- * the SAME parameterized extra route (e.g. `POST /v1/:siteId/resume` for both
- * appcast and encompasshealth). Registering per-plugin throws
+ * the SAME parameterized extra route (e.g. `POST /v1/:siteId/resume` for two
+ * or more sibling plugins). Registering per-plugin throws
  * `FST_ERR_DUPLICATED_ROUTE` and crashes boot.
  *
  * We group extra routes by `method+path` and register each unique path once.

package/dist/scraper/cookie-jar.d.ts

@@ -2,8 +2,8 @@
  * Cookie-jar snapshot capture via CDP `Network.getAllCookies`. `document.cookie`
  * and Stagehand's own cookie helpers can't see HttpOnly cookies, and
  * `Page.getCookies`/`Network.getCookies` only return cookies scoped to the
- * current frame's URLs — a journey that navigated click.appcast.io ->
- * apply.appcast.io would miss the click-domain cookies once on the apply
+ * current frame's URLs — a journey that navigated a click-tracking domain ->
+ * an apply domain would miss the click-domain cookies once on the apply
  * page. `Network.getAllCookies` returns the whole-browser jar regardless of
  * the page's current URL, which is what attribution analysis needs.
  */

package/dist/scraper/cookie-jar.js

@@ -3,8 +3,8 @@
  * Cookie-jar snapshot capture via CDP `Network.getAllCookies`. `document.cookie`
  * and Stagehand's own cookie helpers can't see HttpOnly cookies, and
  * `Page.getCookies`/`Network.getCookies` only return cookies scoped to the
- * current frame's URLs — a journey that navigated click.appcast.io ->
- * apply.appcast.io would miss the click-domain cookies once on the apply
+ * current frame's URLs — a journey that navigated a click-tracking domain ->
+ * an apply domain would miss the click-domain cookies once on the apply
  * page. `Network.getAllCookies` returns the whole-browser jar regardless of
  * the page's current URL, which is what attribution analysis needs.
  */