@enricai/barnacle 1.6.1 → 1.6.3

package/dist/scripts/recon-generate.d.ts

@@ -4,15 +4,19 @@
  * coding is required between running recon and registering the plugin.
  *
  * Usage:
- *   pnpm run recon:generate -- --site-id my-site [--force]
+ *   pnpm run recon:generate -- --site-id my-site [--run-dir <path>] [--force]
  *
  * --force overwrites an existing src/sites/<siteId>/ directory.
+ * --run-dir selects which run root to read; defaults to the most recently
+ * modified run root under the recon output base dir (see
+ * {@link resolveLatestReconRunRoot}), so the existing two-command
+ * "recon, then generate" workflow keeps working unchanged.
  *
- * Reads from:
- *   /tmp/recon/graphql/*.json        — Capture[] from recon-browser.ts
- *   /tmp/recon/replays/*.json        — ReplayResult[] from recon-http.ts
- *   /tmp/recon/replays/rate-limit.json
- *   /tmp/recon/aux/*.json            — static fixture files
+ * Reads from (under the resolved run root):
+ *   graphql/*.json        — Capture[] from recon-browser.ts
+ *   replays/*.json        — ReplayResult[] from recon-http.ts
+ *   replays/rate-limit.json
+ *   aux/*.json            — static fixture files
  *   src/sites/<siteId>/recon-flow.json — plain-English flow steps
  */
 import type { ReconFormSchema } from "../recon/form-schema";
@@ -158,6 +162,21 @@ export declare function detectFormSchemaFieldNames(captures: Capture[], formSche
     fieldOptionsMap: FieldOptionsMap;
     allSchemaUuids: Set<string>;
 };
+/**
+ * Splits a raw `Set-Cookie` response-header string into `name`/`value` pairs.
+ * Captures store `responseHeaders` as a flat `Record<string, string>`
+ * (see recon-shared.ts's `Capture`), so multiple `Set-Cookie` headers from the
+ * same response are folded by the recon browser's CDP session into one
+ * newline-delimited string — each line is one cookie's `name=value; attrs...`.
+ * This walks every newline-delimited line and recovers the name/value pair
+ * from before that line's first `;`, skipping any line with no `=`.
+ */
+/** Exported for unit testing — lets tests exercise the newline-fold parsing
+ * directly against synthetic multi-cookie strings. */
+export declare function walkSetCookiePairs(rawSetCookie: string): Generator<{
+    name: string;
+    value: string;
+}>;
 /**
  * Walks every capture's response (including GETs — formHistoryId-style values
  * may originate in a state-load GET, not a POST). Indexes every string leaf
@@ -167,7 +186,9 @@ export declare function detectFormSchemaFieldNames(captures: Capture[], formSche
  * Also indexes response-header/cookie-origin values (e.g. a `Set-Cookie`
  * auth token) the same way, tagged with `headerOrigin` instead of a body
  * `path` — this is what lets a stateful API's token-mint response feed a
- * later call's `Cookie` header via `compileActionSteps`.
+ * later call's `Cookie` header via `compileActionSteps`. Cookie-origin values
+ * are capped by `MAX_COOKIE_STATE_VALUE_LENGTH`, not `MAX_STATE_VALUE_LENGTH`
+ * — session JWTs routinely exceed the body-blob cap.
  *
  * The index is intentionally permissive — it doesn't try to shape-match
  * "what looks like a token" because token shapes are an open set across the
@@ -226,6 +247,30 @@ interface ActionStep {
  */
 /** Exported for unit testing — see `indexStateValues`. */
 export declare function compileActionSteps(actions: ActionCapture[], stateIndex: Map<string, StateValue>): ActionStep[];
+/**
+ * Collects every header/cookie-origin produce across an action sequence, in
+ * step order — this is what `emitContractTs` renders as `createHttpClient`'s
+ * `bind` option so the generated `executeHttp` actually forwards a value like
+ * disneycruise's `Set-Cookie: __pa=<jwt>` mint to the stateful call that 401s
+ * without it. Deduped by `targetHeader.toLowerCase()` + `cookieName` (HTTP
+ * header names are case-insensitive, and compileActionSteps derives
+ * `targetHeader` verbatim from observed request-header casing, so the same
+ * logical target can show up as e.g. `Cookie` on one step and `cookie` on
+ * another): the `Cookie` request header carries many cookies by design, so
+ * every distinct cookie-origin produce targeting it must survive (the
+ * runtime accumulates them into one `Cookie` header per binding — see
+ * http-client.ts); only a produce that re-mints the SAME cookie on a later
+ * step collapses to its earliest occurrence. Non-cookie targets (e.g.
+ * `X-Conversation-Id`) still keep first-wins, since `HttpResponseBinding` is
+ * one binding per target header there and two steps producing the same
+ * non-cookie target (even under differing casing) would otherwise race with
+ * no defined winner.
+ *
+ * Exported for unit testing (as `walkSetCookiePairs` is) — lets tests exercise
+ * the produce → bind collection step directly against synthetic ActionStep
+ * sequences.
+ */
+export declare function collectHeaderBindings(actionSteps: ActionStep[]): HeaderProduce[];
 /**
  * Maps a site's screening-question prompts to the payload field that answers
  * them, as `{ payloadField: [keyword, …] }`.

package/dist/scripts/recon-generate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"recon-generate.d.ts","sourceRoot":"","sources":["../../src/scripts/recon-generate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAiBH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAG3D,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAGL,KAAK,OAAO,EAKb,MAAM,wBAAwB,CAAC;AA2EhC;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,OAAO,EACnB,UAAU,GAAE,eAAmD,GAC9D,MAAM,GAAG,IAAI,CAoBf;AAUD,UAAU,SAAS;IACjB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,SAAS,OAAO,EAAE,EAC3B,KAAK,SAAI,EACT,MAAM,SAAK,EACX,IAAI,GAAE,SAAc,GACnB,MAAM,CA+DR;AAoCD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,SAAS;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,GAAG,IAAI,CAqBjG;AA4HD,UAAU,aAAa;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,GAAG,aAAa,EAAE,CAuB3F;AAyBD,UAAU,UAAU;IAClB,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAC;IACd,gFAAgF;IAChF,WAAW,EAAE,MAAM,CAAC;IACpB;4DACwD;IACxD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf;;uEAEmE;IACnE,YAAY,CAAC,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9D;AAmFD,UAAU,YAAY;IACpB;iFAC6E;IAC7E,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC;;uDAEmD;IACnD,gBAAgB,EAAE,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrE;AAiFD;;;;;GAKG;AACH,KAAK,YAAY,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAExC;;;;;;;;GAQG;AACH,UAAU,mBAAmB;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AACD,KAAK,eAAe,GAAG,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;AAkDxD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,OAAO,EAAE,EACnB,UAAU,EAAE,eAAe,GAAG,IAAI,GACjC;IACD,YAAY,EAAE,YAAY,CAAC;IAC3B,eAAe,EAAE,eAAe,CAAC;IACjC,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAC7B,CAYA;AA6bD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH;8EAC8E;AAC9E,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,OAAO,EAAE,EACnB,aAAa,GAAE,GAAG,CAAC,MAAM,CAAa,EACtC,oBAAoB,GAAE,GAAG,CAAC,MAAM,CAAa,GAC5C,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CA4DzB;AAED;4EAC4E;AAC5E,UAAU,WAAW;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED;;;;;;0BAM0B;AAC1B,UAAU,aAAa;IACrB,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,KAAK,OAAO,GAAG,WAAW,GAAG,aAAa,CAAC;AAE3C,UAAU,UAAU;IAClB,4CAA4C;IAC5C,OAAO,EAAE,OAAO,CAAC;IACjB,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB;;sFAEkF;IAClF,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,yEAAyE;IACzE,WAAW,EAAE,OAAO,CAAC;IACrB,kFAAkF;IAClF,aAAa,EAAE,OAAO,CAAC;CACxB;AAmDD;;;;GAIG;AACH,0DAA0D;AAC1D,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,aAAa,EAAE,EACxB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAClC,UAAU,EAAE,CAoGd;AAwKD;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CASrE;AAwQD;6DAC6D;AAC7D,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,UAAU,EAAE,EACrB,SAAS,EAAE,OAAO,EAClB,YAAY,EAAE,YAAY,EAC1B,YAAY,EAAE,YAAY,EAC1B,mBAAmB,EAAE,GAAG,CAAC,MAAM,CAAC,EAChC,eAAe,EAAE,eAAe,EAChC,yBAAyB,EAAE,GAAG,CAAC,MAAM,CAAC,EACtC,4BAA4B,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EACjD,+BAA+B,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC,EAC7E,OAAO,EAAE,MAAM,EACf,qBAAqB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAC1C,sBAAsB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3C,mBAAmB,GAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAa,EACpD,UAAU,GAAE,eAAe,GAAG,IAAW,GACxC,MAAM,CA6TR;AAkCD;yEACyE;AACzE,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,OAAO,CAAC;IACtB,GAAG,EAAE,OAAO,CAAC;IACb,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,iGAAiG;IACjG,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mGAAmG;IACnG,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,gGAAgG;IAChG,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;qDAEiD;IACjD,oBAAoB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC;;;oCAGgC;IAChC,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC;sEACkE;IAClE,sBAAsB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACrC;;;;sDAIkD;IAClD,yBAAyB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChD;;4EAEwE;IACxE,4BAA4B,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC,CAAC;IAC5E;;;+DAG2D;IAC3D,iBAAiB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAChC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;sEAGkE;IAClE,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC;CAClC,GAAG,MAAM,CAmUT;AAED,qFAAqF;AACrF,KAAK,aAAa,GACd,MAAM,GACN;IACE,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,CAAC;AAyFN;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,kFAAkF;IAClF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,gFAAgF;IAChF,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,MAAM,CA2ET;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,UAAU,CAAC,EAAE,eAAe,CAAC;CAC9B,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAAE,CAiInD;AAED;mEACmE;AACnE,wBAAgB,WAAW,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAgB5E"}
+{"version":3,"file":"recon-generate.d.ts","sourceRoot":"","sources":["../../src/scripts/recon-generate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAiBH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAG3D,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EACL,KAAK,OAAO,EAKb,MAAM,wBAAwB,CAAC;AA2EhC;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,OAAO,EACnB,UAAU,GAAE,eAAmD,GAC9D,MAAM,GAAG,IAAI,CAoBf;AAUD,UAAU,SAAS;IACjB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,SAAS,OAAO,EAAE,EAC3B,KAAK,SAAI,EACT,MAAM,SAAK,EACX,IAAI,GAAE,SAAc,GACnB,MAAM,CA+DR;AAoCD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,SAAS;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,GAAG,IAAI,CAqBjG;AA4HD,UAAU,aAAa;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,GAAG,aAAa,EAAE,CAuB3F;AAyBD,UAAU,UAAU;IAClB,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAC;IACd,gFAAgF;IAChF,WAAW,EAAE,MAAM,CAAC;IACpB;4DACwD;IACxD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf;;uEAEmE;IACnE,YAAY,CAAC,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9D;AAmFD,UAAU,YAAY;IACpB;iFAC6E;IAC7E,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC;;uDAEmD;IACnD,gBAAgB,EAAE,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrE;AAiFD;;;;;GAKG;AACH,KAAK,YAAY,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAExC;;;;;;;;GAQG;AACH,UAAU,mBAAmB;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AACD,KAAK,eAAe,GAAG,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;AAkDxD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,OAAO,EAAE,EACnB,UAAU,EAAE,eAAe,GAAG,IAAI,GACjC;IACD,YAAY,EAAE,YAAY,CAAC;IAC3B,eAAe,EAAE,eAAe,CAAC;IACjC,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAC7B,CAYA;AAmbD;;;;;;;;GAQG;AACH;sDACsD;AACtD,wBAAiB,kBAAkB,CACjC,YAAY,EAAE,MAAM,GACnB,SAAS,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAS5C;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH;8EAC8E;AAC9E,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,OAAO,EAAE,EACnB,aAAa,GAAE,GAAG,CAAC,MAAM,CAAa,EACtC,oBAAoB,GAAE,GAAG,CAAC,MAAM,CAAa,GAC5C,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CA4DzB;AAED;4EAC4E;AAC5E,UAAU,WAAW;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED;;;;;;0BAM0B;AAC1B,UAAU,aAAa;IACrB,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,KAAK,OAAO,GAAG,WAAW,GAAG,aAAa,CAAC;AAE3C,UAAU,UAAU;IAClB,4CAA4C;IAC5C,OAAO,EAAE,OAAO,CAAC;IACjB,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB;;sFAEkF;IAClF,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,yEAAyE;IACzE,WAAW,EAAE,OAAO,CAAC;IACrB,kFAAkF;IAClF,aAAa,EAAE,OAAO,CAAC;CACxB;AAmDD;;;;GAIG;AACH,0DAA0D;AAC1D,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,aAAa,EAAE,EACxB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAClC,UAAU,EAAE,CAoGd;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,UAAU,EAAE,GAAG,aAAa,EAAE,CAUhF;AAoJD;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CASrE;AAwQD;6DAC6D;AAC7D,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,UAAU,EAAE,EACrB,SAAS,EAAE,OAAO,EAClB,YAAY,EAAE,YAAY,EAC1B,YAAY,EAAE,YAAY,EAC1B,mBAAmB,EAAE,GAAG,CAAC,MAAM,CAAC,EAChC,eAAe,EAAE,eAAe,EAChC,yBAAyB,EAAE,GAAG,CAAC,MAAM,CAAC,EACtC,4BAA4B,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EACjD,+BAA+B,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC,EAC7E,OAAO,EAAE,MAAM,EACf,qBAAqB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAC1C,sBAAsB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3C,mBAAmB,GAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAa,EACpD,UAAU,GAAE,eAAe,GAAG,IAAW,GACxC,MAAM,CA6TR;AAkCD;yEACyE;AACzE,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,OAAO,CAAC;IACtB,GAAG,EAAE,OAAO,CAAC;IACb,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,iGAAiG;IACjG,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mGAAmG;IACnG,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,gGAAgG;IAChG,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;qDAEiD;IACjD,oBAAoB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC;;;oCAGgC;IAChC,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC;sEACkE;IAClE,sBAAsB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACrC;;;;sDAIkD;IAClD,yBAAyB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChD;;4EAEwE;IACxE,4BAA4B,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC,CAAC;IAC5E;;;+DAG2D;IAC3D,iBAAiB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAChC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;sEAGkE;IAClE,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC;CAClC,GAAG,MAAM,CAmUT;AAED,qFAAqF;AACrF,KAAK,aAAa,GACd,MAAM,GACN;IACE,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,CAAC;AAyFN;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,kFAAkF;IAClF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,gFAAgF;IAChF,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,MAAM,CA2ET;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,UAAU,CAAC,EAAE,eAAe,CAAC;CAC9B,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAAE,CAiInD;AAED;mEACmE;AACnE,wBAAgB,WAAW,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAgB5E"}

package/dist/scripts/recon-generate.js

@@ -5,15 +5,19 @@
  * coding is required between running recon and registering the plugin.
  *
  * Usage:
- *   pnpm run recon:generate -- --site-id my-site [--force]
+ *   pnpm run recon:generate -- --site-id my-site [--run-dir <path>] [--force]
  *
  * --force overwrites an existing src/sites/<siteId>/ directory.
+ * --run-dir selects which run root to read; defaults to the most recently
+ * modified run root under the recon output base dir (see
+ * {@link resolveLatestReconRunRoot}), so the existing two-command
+ * "recon, then generate" workflow keeps working unchanged.
  *
- * Reads from:
- *   /tmp/recon/graphql/*.json        — Capture[] from recon-browser.ts
- *   /tmp/recon/replays/*.json        — ReplayResult[] from recon-http.ts
- *   /tmp/recon/replays/rate-limit.json
- *   /tmp/recon/aux/*.json            — static fixture files
+ * Reads from (under the resolved run root):
+ *   graphql/*.json        — Capture[] from recon-browser.ts
+ *   replays/*.json        — ReplayResult[] from recon-http.ts
+ *   replays/rate-limit.json
+ *   aux/*.json            — static fixture files
  *   src/sites/<siteId>/recon-flow.json — plain-English flow steps
  */
 Object.defineProperty(exports, "__esModule", { value: true });
@@ -22,8 +26,10 @@ exports.inferZodSchemaFromSamples = inferZodSchemaFromSamples;
 exports.selectPayloadAction = selectPayloadAction;
 exports.extractActionSequence = extractActionSequence;
 exports.detectFormSchemaFieldNames = detectFormSchemaFieldNames;
+exports.walkSetCookiePairs = walkSetCookiePairs;
 exports.indexStateValues = indexStateValues;
 exports.compileActionSteps = compileActionSteps;
+exports.collectHeaderBindings = collectHeaderBindings;
 exports.loadQuestionPromptKeywords = loadQuestionPromptKeywords;
 exports.emitMultiStepExecuteHttp = emitMultiStepExecuteHttp;
 exports.emitContractTs = emitContractTs;
@@ -1070,6 +1076,12 @@ function applyRawOptionIdPayloadSubstitutions(rawBody, fieldNameMap, fieldOption
 /** Maximum length to guard against indexing massive blobs (HTML fragments,
  * embedded base64 images, etc.) that aren't candidates for state threading. */
 const MAX_STATE_VALUE_LENGTH = 256;
+/** Maximum length for `Set-Cookie`-origin values, distinct from
+ * `MAX_STATE_VALUE_LENGTH`. Auth tokens (JWTs) legitimately exceed the
+ * body-blob cap — a 272-char session cookie is normal, not a massive blob —
+ * so cookie origins get their own, more permissive ceiling. Still bounded so
+ * a pathological cookie can't blow up the index. */
+const MAX_COOKIE_STATE_VALUE_LENGTH = 4096;
 /** Canonical "uninitialized" sentinel values that some REST APIs return as
  * placeholders before a downstream call populates the real identifier. An ATS
  * whose `/user/create` returns these for CandidateId/ApplicationId/
@@ -1084,19 +1096,24 @@ const PLACEHOLDER_STATE_VALUES = new Set(["00000000-0000-0000-0000-000000000000"
  * Splits a raw `Set-Cookie` response-header string into `name`/`value` pairs.
  * Captures store `responseHeaders` as a flat `Record<string, string>`
  * (see recon-shared.ts's `Capture`), so multiple `Set-Cookie` headers from the
- * same response — if the recon browser's CDP session folds them together —
- * would already have lost their individual boundaries before reaching here;
- * this only recovers name/value pairs from whatever single string survives.
+ * same response are folded by the recon browser's CDP session into one
+ * newline-delimited string — each line is one cookie's `name=value; attrs...`.
+ * This walks every newline-delimited line and recovers the name/value pair
+ * from before that line's first `;`, skipping any line with no `=`.
  */
+/** Exported for unit testing — lets tests exercise the newline-fold parsing
+ * directly against synthetic multi-cookie strings. */
 function* walkSetCookiePairs(rawSetCookie) {
-    const pair = rawSetCookie.split(";", 1)[0] ?? "";
-    const eq = pair.indexOf("=");
-    if (eq === -1)
-        return;
-    const name = pair.slice(0, eq).trim();
-    const value = pair.slice(eq + 1).trim();
-    if (name && value)
-        yield { name, value };
+    for (const line of rawSetCookie.split("\n")) {
+        const pair = line.split(";", 1)[0] ?? "";
+        const eq = pair.indexOf("=");
+        if (eq === -1)
+            continue;
+        const name = pair.slice(0, eq).trim();
+        const value = pair.slice(eq + 1).trim();
+        if (name && value)
+            yield { name, value };
+    }
 }
 /**
  * Walks every capture's response (including GETs — formHistoryId-style values
@@ -1107,7 +1124,9 @@ function* walkSetCookiePairs(rawSetCookie) {
  * Also indexes response-header/cookie-origin values (e.g. a `Set-Cookie`
  * auth token) the same way, tagged with `headerOrigin` instead of a body
  * `path` — this is what lets a stateful API's token-mint response feed a
- * later call's `Cookie` header via `compileActionSteps`.
+ * later call's `Cookie` header via `compileActionSteps`. Cookie-origin values
+ * are capped by `MAX_COOKIE_STATE_VALUE_LENGTH`, not `MAX_STATE_VALUE_LENGTH`
+ * — session JWTs routinely exceed the body-blob cap.
  *
  * The index is intentionally permissive — it doesn't try to shape-match
  * "what looks like a token" because token shapes are an open set across the
@@ -1143,7 +1162,7 @@ function indexStateValues(captures, shieldedUuids = new Set(), actionCaptureIndi
             for (const { name, value } of walkSetCookiePairs(rawSetCookie)) {
                 if (value.length < MIN_STATE_VALUE_LENGTH)
                     continue;
-                if (value.length > MAX_STATE_VALUE_LENGTH)
+                if (value.length > MAX_COOKIE_STATE_VALUE_LENGTH)
                     continue;
                 if (PLACEHOLDER_STATE_VALUES.has(value))
                     continue;
@@ -1347,21 +1366,36 @@ function compileActionSteps(actions, stateIndex) {
  * step order — this is what `emitContractTs` renders as `createHttpClient`'s
  * `bind` option so the generated `executeHttp` actually forwards a value like
  * disneycruise's `Set-Cookie: __pa=<jwt>` mint to the stateful call that 401s
- * without it. Deduped by `targetHeader`: `HttpResponseBinding` (http-client.ts)
- * is one binding per target header, so if two steps somehow produced the same
- * target the earliest wins.
+ * without it. Deduped by `targetHeader.toLowerCase()` + `cookieName` (HTTP
+ * header names are case-insensitive, and compileActionSteps derives
+ * `targetHeader` verbatim from observed request-header casing, so the same
+ * logical target can show up as e.g. `Cookie` on one step and `cookie` on
+ * another): the `Cookie` request header carries many cookies by design, so
+ * every distinct cookie-origin produce targeting it must survive (the
+ * runtime accumulates them into one `Cookie` header per binding — see
+ * http-client.ts); only a produce that re-mints the SAME cookie on a later
+ * step collapses to its earliest occurrence. Non-cookie targets (e.g.
+ * `X-Conversation-Id`) still keep first-wins, since `HttpResponseBinding` is
+ * one binding per target header there and two steps producing the same
+ * non-cookie target (even under differing casing) would otherwise race with
+ * no defined winner.
+ *
+ * Exported for unit testing (as `walkSetCookiePairs` is) — lets tests exercise
+ * the produce → bind collection step directly against synthetic ActionStep
+ * sequences.
  */
 function collectHeaderBindings(actionSteps) {
-    const byTarget = new Map();
+    const byKey = new Map();
     for (const step of actionSteps) {
         for (const p of step.produces) {
             if (p.kind !== "header")
                 continue;
-            if (!byTarget.has(p.targetHeader))
-                byTarget.set(p.targetHeader, p);
+            const key = `${p.targetHeader.toLowerCase()}\0${p.cookieName ?? ""}`;
+            if (!byKey.has(key))
+                byKey.set(key, p);
         }
     }
-    return [...byTarget.values()];
+    return [...byKey.values()];
 }
 /**
  * Replaces occurrences of state values in `template` with `${varName}`
@@ -2655,6 +2689,7 @@ async function main() {
     let emit = "ts";
     let vocabularySpecifier = "";
     let formSchemaSpecifier = "";
+    let runDir;
     for (let i = 0; i < args.length; i++) {
         if (args[i] === "--site-id" && args[i + 1])
             siteId = args[++i];
@@ -2662,6 +2697,8 @@ async function main() {
             vocabularySpecifier = args[++i];
         else if (args[i] === "--form-schema" && args[i + 1])
             formSchemaSpecifier = args[++i];
+        else if (args[i] === "--run-dir" && args[i + 1])
+            runDir = args[++i];
         else if (args[i] === "--force")
             force = true;
         else if (args[i] === "--emit" && args[i + 1]) {
@@ -2687,14 +2724,19 @@ async function main() {
         logger.error(`${manifestPath} already exists — pass --force to overwrite`);
         process.exit(1);
     }
-    const captures = (0, recon_shared_1.readJsonDir)(recon_shared_1.CAPTURES_DIR);
-    const replays = (0, recon_shared_1.readJsonDir)(recon_shared_1.REPLAYS_DIR, [
+    const runRoot = (0, recon_shared_1.resolveLatestReconRunRoot)(runDir);
+    logger.info(`reading recon artifacts from ${runRoot}`);
+    const capturesDir = (0, node_path_1.join)(runRoot, "graphql");
+    const replaysDir = (0, node_path_1.join)(runRoot, "replays");
+    const auxDir = (0, node_path_1.join)(runRoot, "aux");
+    const captures = (0, recon_shared_1.readJsonDir)(capturesDir);
+    const replays = (0, recon_shared_1.readJsonDir)(replaysDir, [
         "rate-limit.json",
         "introspection-schema.json",
     ]);
     const rateLimits = (() => {
         try {
-            return JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(recon_shared_1.REPLAYS_DIR, "rate-limit.json"), "utf8"));
+            return JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(replaysDir, "rate-limit.json"), "utf8"));
         }
         catch {
             return [];
@@ -2702,7 +2744,7 @@ async function main() {
     })();
     const auxFiles = (() => {
         try {
-            return (0, node_fs_1.readdirSync)(recon_shared_1.AUX_DIR)
+            return (0, node_fs_1.readdirSync)(auxDir)
                 .filter((f) => f.endsWith(".json"))
                 .sort();
         }
@@ -3017,7 +3059,7 @@ async function main() {
     if (auxFiles.length > 0) {
         (0, node_fs_1.mkdirSync)(`${outDir}/fixtures`, { recursive: true });
         for (const f of auxFiles) {
-            (0, node_fs_1.copyFileSync)((0, node_path_1.join)(recon_shared_1.AUX_DIR, f), `${outDir}/fixtures/${f}`);
+            (0, node_fs_1.copyFileSync)((0, node_path_1.join)(auxDir, f), `${outDir}/fixtures/${f}`);
         }
         logger.info(`copied ${auxFiles.length} fixture(s) to ${outDir}/fixtures/`);
     }