VAG Connect v2.10.9

Follow-up to v2.10.8 - Arno-MA-73's v2.10.8 trace on #388 surfaced that the HTML hidden-input regex was missing state tokens when the SPA bundle shipped attributes in value=... before name=... order.

What's new

Fixed

• Data Act portal SPA: attribute-order-agnostic state extraction + forensic logs (#388 Arno-MA-73 v2.10.8 trace). v2.10.7's regex required name to appear before value in the markup; some Auth0 SPA bundles ship the attributes in the opposite order and the v2.10.7 path silently missed those. Now walks every <input ...> tag and captures name + value as two independent regex matches the way idk.py:_parse_csrf_robust already does for the main BFF flow. Adds data-state="..." attribute as a third extraction path.

  Plus DEBUG forensic logs at every step of the SPA branch so the next failing trace surfaces exactly what shape the portal HTML actually ships: entry log with URLs + HTML lengths, per-source state extraction attempt with source label, first-200-char dump of password HTML when nothing matches, final state source + first 12 chars on success, title + key-marker presence in the warn-level no-state path.

Full diff vs v2.10.8

v2.10.8...v2.10.9