@enricai/barnacle 1.9.7 → 1.9.9

package/dist/scripts/recon-generate.js

@@ -1657,10 +1657,10 @@ function locateFormEnvelopePath(parsedBody) {
     if (candidates.length === 0)
         return [];
     const maxP = Math.max(...candidates.map((c) => c.primitives));
-    // The analytics blob (`eventData`) mirrors the form, so the object with the
+    // The analytics blob (`eventData`) parallels the form, so the object with the
     // MOST primitives can be a deep descendant of the true envelope. Pick the
     // SHALLOWEST primitive-rich object (≥ half the max) instead — that is the
-    // form envelope itself, whose analytics mirror sits below it. Tie-break on a
+    // form envelope itself, whose analytics copy sits below it. Tie-break on a
     // higher primitive count. Threshold is relative, not a magic key name.
     const rich = candidates.filter((c) => c.primitives >= Math.max(1, maxP / 2));
     // No object carries a scalar field (maxP === 0): the body root is the only
@@ -2147,20 +2147,7 @@ function resolveResponsePathValue(responseBody, path) {
  * 36-char UUID).
  */
 function interpolateStateValues(template, priorSteps, payloadAccessorByValue = new Map()) {
-    const varNameByValue = new Map();
-    for (const step of priorSteps) {
-        for (const p of step.produces) {
-            // Header/cookie-origin produces have no body path — their value never
-            // appears as a literal in a URL/body template (http-client's `bind`
-            // forwards it directly as a request header), so there's nothing to
-            // interpolate here.
-            if (p.kind === "header")
-                continue;
-            const value = resolveResponsePathValue(step.capture.responseBody, p.path);
-            if (value !== null)
-                varNameByValue.set(value, p.name);
-        }
-    }
+    const varNameByValue = deriveStateVarByValue(priorSteps);
     let result = template;
     // Pass 1: substitute state values (length-descending to avoid prefix
     // conflicts). `\$` is a literal dollar sign (NOT an interpolation);
@@ -2213,6 +2200,16 @@ function interpolateStateValues(template, priorSteps, payloadAccessorByValue = n
  * coordinate — and only WHOLE request-body leaves qualify, so every returned
  * value is one the whole-value pass will bind (and whose field must be declared).
  *
+ * A field is NOT a caller coordinate when it is a per-step POSITION CONSTANT — the
+ * step's own identifier that the harness varies as it walks the wizard (like
+ * `stepIndex`). Such a field is produced-and-re-sent on every step, so it looks
+ * like a coordinate, but each producer step echoes a DIFFERENT value; a genuine
+ * coordinate (a jobId) is echoed with the SAME value on every step and the
+ * per-value dedupe below leaves it a single entry. So any field bound to ≥2
+ * distinct values across its producer steps is dropped wholesale: each step keeps
+ * its own captured literal and the field is never declared as caller input.
+ * Site-agnostic — the signal is value cardinality per field, not any field name.
+ *
  * @param actions the compiled action steps (carry produces[] + request bodies)
  * @param alreadyBound capture value → existing accessor; a `payload.*` accessor
  *   is reused, a non-payload one (e.g. `txnId`) vetoes the value
@@ -2273,6 +2270,20 @@ function deriveProducerBoundaryBindings(actions, alreadyBound) {
             bindings.set(value, { accessor: `payload.${field}`, field, producerIndex: i });
         }
     }
+    // Drop per-step position constants: a field bound to ≥2 distinct values across
+    // its producer steps is the step's own identifier the harness walked, not a
+    // caller coordinate (which is echoed with one stable value). Removing every
+    // entry leaves each step's captured literal in place and undeclared.
+    const distinctValuesByField = new Map();
+    for (const [value, binding] of bindings) {
+        const values = distinctValuesByField.get(binding.field) ?? new Set();
+        values.add(value);
+        distinctValuesByField.set(binding.field, values);
+    }
+    for (const [value, binding] of [...bindings]) {
+        if ((distinctValuesByField.get(binding.field)?.size ?? 0) >= 2)
+            bindings.delete(value);
+    }
     return bindings;
 }
 /**
@@ -2319,6 +2330,132 @@ function applyWholeValuePayloadSubstitutions(template, parsedBody, producerScope
     }
     return result;
 }
+/** Maximum number of nested URL-encodings a query-param value is probed for
+ * before giving up. Real captures observed a doubly-encoded value (`%2520`); the
+ * extra headroom costs one cheap `decodeURIComponent` per level and stops runaway. */
+const MAX_URL_PARAM_DECODE_DEPTH = 3;
+/**
+ * Maps each response-produced value to the `${var}` name later steps thread it as.
+ * Shared by {@link interpolateStateValues} (the body/URL substitution) and the
+ * URL-param pass, so a threaded coordinate (e.g. a jobId a prior step produced)
+ * resolves to the same var in both — one source of truth, they can never diverge.
+ *
+ * Header/cookie-origin produces are skipped: they have no body path and their
+ * value never appears as a literal in a URL/body template (http-client's `bind`
+ * forwards it directly as a request header), so there is nothing to interpolate.
+ */
+function deriveStateVarByValue(priorSteps) {
+    const varNameByValue = new Map();
+    for (const step of priorSteps) {
+        for (const p of step.produces) {
+            if (p.kind === "header")
+                continue;
+            const value = resolveResponsePathValue(step.capture.responseBody, p.path);
+            if (value !== null)
+                varNameByValue.set(value, p.name);
+        }
+    }
+    return varNameByValue;
+}
+/** One `decodeURIComponent`, or null when the input is not validly percent-encoded
+ * (a stray `%` throws) — lets the progressive-decode loop stop instead of crash. */
+function safeDecodeOnce(value) {
+    try {
+        return decodeURIComponent(value);
+    }
+    catch {
+        return null;
+    }
+}
+/** True when a JSON string leaf is itself an http(s) URL, the only leaves whose
+ * query string this pass rewrites. Site-agnostic: a structural test, not a key name. */
+function isHttpUrlLeaf(value) {
+    if (!value.includes("://"))
+        return false;
+    try {
+        const u = new URL(value);
+        return u.protocol === "http:" || u.protocol === "https:";
+    }
+    catch {
+        return false;
+    }
+}
+/** Wraps an accessor expression in `encodeURIComponent(...)` `depth` times, so a
+ * value the capture stored URL-encoded is re-encoded to the same nesting at call
+ * time (a caller value with `&`/`=`/spaces then survives inside the query string). */
+function wrapEncode(expr, depth) {
+    let out = expr;
+    for (let d = 0; d < depth; d++)
+        out = `encodeURIComponent(${out})`;
+    return out;
+}
+/**
+ * Binds caller coordinates that were copied into a URL-valued body field's query
+ * string. Every other substitution pass matches whole leaf values, so a job
+ * coordinate re-encoded inside a redirect/thank-you URL stays frozen at the recon
+ * persona's value. This runs on the PRISTINE parsed body leaf — before state
+ * threading fragments a composite — and rewrites each query-param value that
+ * matches the unified binding table (after bounded progressive URL-decoding, so a
+ * double-encoded copy is caught) into a `${encodeURIComponent(<accessor>)}`
+ * fragment nested to the matched encode depth. Unmatched params (and the delimiters
+ * around them) stay byte-for-byte. Site-agnostic: keys off "leaf parses as an
+ * http(s) URL", never a field name.
+ */
+function applyUrlParamPayloadSubstitutions(template, parsedBody, bindings) {
+    if (bindings.size === 0)
+        return template;
+    let result = template;
+    for (const { value, path } of walkStringLeaves(parsedBody)) {
+        if (!isHttpUrlLeaf(value))
+            continue;
+        const qIdx = value.indexOf("?");
+        if (qIdx < 0)
+            continue;
+        const prefix = value.slice(0, qIdx + 1);
+        const rawQuery = value.slice(qIdx + 1);
+        let changed = false;
+        const newParams = rawQuery.split("&").map((pair) => {
+            const eq = pair.indexOf("=");
+            if (eq < 0)
+                return pair;
+            const name = pair.slice(0, eq);
+            const rawVal = pair.slice(eq + 1);
+            if (rawVal.length < MIN_STATE_VALUE_LENGTH)
+                return pair;
+            if (CACHE_BUSTER_QUERY_KEYS.has(name))
+                return pair;
+            let candidate = rawVal;
+            let matched = null;
+            let depth = 0;
+            for (let d = 0; d <= MAX_URL_PARAM_DECODE_DEPTH; d++) {
+                const accessor = bindings.get(candidate);
+                if (accessor !== undefined) {
+                    matched = accessor;
+                    depth = d;
+                    break;
+                }
+                const next = safeDecodeOnce(candidate);
+                if (next === null || next === candidate)
+                    break;
+                candidate = next;
+            }
+            if (matched === null)
+                return pair;
+            changed = true;
+            return `${name}=\${${wrapEncode(matched, depth)}}`;
+        });
+        if (!changed)
+            continue;
+        const newUrl = prefix + newParams.join("&");
+        const key = path[path.length - 1] ?? "";
+        if (key.length === 0)
+            continue;
+        const target = `"${key}":${JSON.stringify(value)}`;
+        const replacement = `"${key}":"${newUrl}"`;
+        result = result.split(target).join(replacement);
+    }
+    return result;
+}
 /**
  * Substitutes literal JSON key/value pairs in a body template with payload
  * interpolations. Catches short strings (e.g. Culture: "en"), booleans
@@ -2405,7 +2542,7 @@ function applyPayloadKeyValueSubstitutions(template, inputBody, additionalBodies
  * Documented closed set of JSON-key-name fragments (matched case-insensitively)
  * that mark a value as a per-request TIMESTAMP the plugin must generate fresh at
  * call time, not replay from the capture. Closed set per the no-regex-on-open-
- * sets feedback, mirroring {@link CACHE_BUSTER_QUERY_KEYS}'s posture. A frozen
+ * sets feedback, matching {@link CACHE_BUSTER_QUERY_KEYS}'s posture. A frozen
  * capture timestamp would make every submission claim the recon instant.
  */
 const VOLATILE_TIMESTAMP_KEY_FRAGMENTS = ["timestamp", "esign", "signeddate", "signedat"];
@@ -2766,8 +2903,28 @@ function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap
         const rawBodyWithProducerBoundary = parsedBody !== null
             ? applyWholeValuePayloadSubstitutions(rawBodyWithStructuredSubs, parsedBody, producerBoundaryBindings, entryUrlParams, i)
             : rawBodyWithStructuredSubs;
-        const bodyAfterStateAndKv = rawBodyWithProducerBoundary
-            ? applyPayloadKeyValueSubstitutions(interpolateStateValues(rawBodyWithProducerBoundary, prior, payloadAccessorByValue), inputBody, additionalBodies, outDiscoveredAdditionalBodyKeys)
+        // Coordinates copied into a URL-valued leaf's query string bind here, BEFORE
+        // interpolateStateValues — same discipline as the whole-value pass above. A
+        // composite (a jobSeqNo whose prefix a prior step produces as a state var)
+        // would otherwise be fragmented mid-URL by Pass 1's global split, stranding
+        // the tail frozen. The unified table is highest-priority-last: a per-step
+        // state var (jobId2) wins over the caller payload accessor for that same
+        // coordinate on steps that thread it, matching the top-level slot's behaviour.
+        const urlParamBindings = new Map(payloadAccessorByValue);
+        for (const [value, accessor] of entryUrlParams)
+            urlParamBindings.set(value, accessor);
+        for (const [value, binding] of producerBoundaryBindings) {
+            if (binding.producerIndex === i)
+                urlParamBindings.set(value, binding.accessor);
+        }
+        for (const [value, varName] of deriveStateVarByValue(prior)) {
+            urlParamBindings.set(value, varName);
+        }
+        const rawBodyWithUrlParams = parsedBody !== null
+            ? applyUrlParamPayloadSubstitutions(rawBodyWithProducerBoundary, parsedBody, urlParamBindings)
+            : rawBodyWithProducerBoundary;
+        const bodyAfterStateAndKv = rawBodyWithUrlParams
+            ? applyPayloadKeyValueSubstitutions(interpolateStateValues(rawBodyWithUrlParams, prior, payloadAccessorByValue), inputBody, additionalBodies, outDiscoveredAdditionalBodyKeys)
             : "";
         // Mechanism A — generic (plain-JSON, wire-key-anchored) dropdown label→code
         // rewrite. Runs AFTER interpolateStateValues + the payload-KV pass, not
@@ -2833,7 +2990,10 @@ function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap
     }
     // Identifier scan against the rendered text — captures `${foo}`, `${foo.bar}`,
     // etc. The first segment (anchored at `${`) is the binding's name. Closed
-    // grammar (template-literal syntax we generated ourselves).
+    // grammar (template-literal syntax we generated ourselves). The optional
+    // `encodeURIComponent(` prefixes let the URL-param pass wrap a bound accessor
+    // (`${encodeURIComponent(jobTitle2)}`) without hiding the inner state var from
+    // this scan — otherwise its `const` would be pruned and the reference dangle.
     // For multipart steps the bodyArg isn't emitted (the body is a FormData
     // built inline), but the URL and headers ARE in executable code — scan
     // only those two haystacks for multipart.
@@ -2844,7 +3004,7 @@ function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap
             ? [r.url, r.headersExpr]
             : [r.url, r.headersExpr, r.bodyArg];
         for (const haystack of haystacks) {
-            for (const match of haystack.matchAll(/\$\{([A-Za-z_$][A-Za-z0-9_$]*)/g)) {
+            for (const match of haystack.matchAll(/\$\{(?:encodeURIComponent\()*([A-Za-z_$][A-Za-z0-9_$]*)/g)) {
                 referencedNames.add(match[1]);
             }
         }
@@ -3163,7 +3323,7 @@ function emitContractTs(opts) {
         : "";
     // optionSchemaExtension is appended LAST so option enums show up at the
     // end of the payload type — the section ordering (base, multipart fields,
-    // form-schema fields, option enums, raw-option fields) mirrors the body
+    // form-schema fields, option enums, raw-option fields) matches the body
     // emit order and keeps the generated payload type readable.
     const payloadSchemaExpr = hasMultipartStep
         ? `${basePayloadSchemaExpr}.extend({\n  Resume: z.instanceof(Buffer),\n  ResumeContentType: z.string(),\n  ResumeFilename: z.string(),\n})${formFieldsExtension}${splicedFieldsExtension}${optionSchemaExtension}${rawOptionSchemaExtension}${additionalBodyKeysExtension}${structuredKeysExtension}`