@enricai/barnacle 1.12.20 → 1.12.21

package/dist/scripts/recon-generate.js

@@ -1414,16 +1414,24 @@ function resolveManifestActionSequence(runRoot, captures) {
  * JWT refresh, reference-lookup) that a browser fires incidentally. Absent
  * patterns preserve the noise heuristic exactly.
  *
+ * When the flow declares a `foldReturnSpec`, a GET whose URL matches its
+ * `endpointPattern` is admitted despite the GET drop above — the same scoped
+ * rule `buildFoldPlanFromSpec` later uses to resolve the fold plan, so a
+ * spec-declared GET drill-down survives to reach it instead of being
+ * dropped before the fold pipeline ever sees it. Every other GET is still
+ * dropped.
+ *
  * Exported for tests: this predicate decides what a generated plugin will POST
  * at a live site, and it is the only gate between a browser's incidental
  * chatter and the emitted hot path.
  */
-function extractActionSequence(captures, submitPatterns = null) {
+function extractActionSequence(captures, submitPatterns = null, foldReturnSpec = null) {
     const matchesSubmit = compileSubmitMatcher(submitPatterns);
+    const matchesFoldReturn = compileFoldReturnEndpointMatcher(foldReturnSpec);
     return captures
         .map((capture, index) => ({ capture, index }))
         .filter(({ capture }) => {
-        if (capture.method === "GET")
+        if (capture.method === "GET" && !matchesFoldReturn(capture))
             return false;
         if (capture.status < 200 || capture.status >= 300)
             return false;
@@ -1445,11 +1453,23 @@ function extractActionSequence(captures, submitPatterns = null) {
  * what let a chronologically-first fallback pick an unrelated query. Host is
  * NOT a filter criterion, matching {@link extractActionSequence}.
  *
+ * When the flow declares a `foldReturnSpec`, a non-mutation capture whose
+ * URL matches its `endpointPattern` is admitted despite the query drop
+ * above, mirroring {@link extractActionSequence}'s GET admission. So is a
+ * non-mutation capture whose response resolves the spec's own `resultsPath`
+ * — the GraphQL-primary read op the drill-down folds onto, which
+ * `endpointPattern` (naming the drill, not the primary) never matches on its
+ * own; without this a declared spec would admit the drill-down but leave
+ * `resolveFoldPlan` with no primary capture to resolve `resultsPath`
+ * against. Every other non-mutation capture is still dropped.
+ *
  * Exported for tests: this predicate decides what a generated GraphQL plugin
  * will send at a live site.
  */
-function extractGraphQLActionSequence(captures, submitPatterns = null) {
+function extractGraphQLActionSequence(captures, submitPatterns = null, foldReturnSpec = null) {
     const matchesSubmit = compileSubmitMatcher(submitPatterns);
+    const matchesFoldReturn = compileFoldReturnEndpointMatcher(foldReturnSpec);
+    const matchesFoldReturnResults = compileFoldReturnResultsMatcher(foldReturnSpec);
     return captures
         .map((capture, index) => ({ capture, index }))
         .filter(({ capture }) => {
@@ -1459,7 +1479,9 @@ function extractGraphQLActionSequence(captures, submitPatterns = null) {
             return false;
         if (!matchesSubmit(capture))
             return false;
-        return capture.query !== null && /^\s*mutation\b/.test(capture.query);
+        if (capture.query !== null && /^\s*mutation\b/.test(capture.query))
+            return true;
+        return matchesFoldReturn(capture) || matchesFoldReturnResults(capture);
     });
 }
 /**
@@ -1530,8 +1552,10 @@ function jsonBodyLeafValues(requestPostData) {
     if (parsed === undefined)
         return null;
     const values = [];
-    for (const { value } of walkStringLeaves(parsed))
-        values.push(value);
+    for (const { value } of walkAllPrimitiveLeaves(parsed)) {
+        if (value !== null)
+            values.push(String(value));
+    }
     return values;
 }
 /**
@@ -2622,11 +2646,29 @@ function* walkSetCookiePairs(rawSetCookie) {
  * Exception: values in `PLACEHOLDER_STATE_VALUES` are skipped entirely so
  * the LATER non-placeholder occurrence at the same JSON path becomes the
  * canonical binding instead.
+ *
+ * `forceIncludeValues` (see {@link collectDependentDrillDownChainValues})
+ * bypasses `MIN_STATE_VALUE_LENGTH` for the specific values it names — a
+ * value already confirmed, by the fold-chain detector itself, to be threaded
+ * from one dependent-drill-down chain hop's response into the next hop's
+ * request is exactly as legitimate a produced state value as a long one; a
+ * length floor exists to keep an UNRELATED short value (an enum code, a page
+ * number) from being mistaken for reused state by blind substring/value
+ * matching, and a value the chain detector already confirmed is threaded
+ * carries no such ambiguity. Every other filter (MAX length, placeholder,
+ * shielded UUID, GET-non-UUID) still applies.
  */
 /** Exported for unit testing — lets tests exercise the produces[] walk (body
  * AND header/cookie origins) directly against synthetic Capture sequences. */
-function indexStateValues(captures, shieldedUuids = new Set(), actionCaptureIndices = new Set()) {
+function indexStateValues(captures, shieldedUuids = new Set(), actionCaptureIndices = new Set(), forceIncludeValues = new Set()) {
     const index = new Map();
+    // Computed structurally off the SAME captures being indexed (no
+    // foldReturnSpec available at this layer) — a spec-declared fold's own
+    // chain values reach here via the caller-supplied `forceIncludeValues`
+    // (see recon-generate's top-level `collectDependentDrillDownChainValues`
+    // call), so this indexes a chain-produced value regardless of whether the
+    // fold plan that confirmed it is structural or spec-declared.
+    const chainForceIncludeValues = collectDependentDrillDownChainValues(captures.map((capture) => ({ capture })), null);
     // First pass: identify the earliest origin among ACTION captures for each
     // value. Action-only earliest-origin tracking is what compileActionSteps'
     // produces[] check needs — it ignores non-action captures (telemetry GETs,
@@ -2645,7 +2687,13 @@ function indexStateValues(captures, shieldedUuids = new Set(), actionCaptureIndi
         const rawSetCookie = Object.entries(c.responseHeaders).find(([k]) => k.toLowerCase() === "set-cookie")?.[1];
         if (rawSetCookie !== undefined) {
             for (const { name, value } of walkSetCookiePairs(rawSetCookie)) {
-                if (value.length < MIN_STATE_VALUE_LENGTH)
+                // Same chain/force exemption as the body-value MIN_STATE_VALUE_LENGTH
+                // floor below: a cookie-sourced value the fold-chain detector already
+                // confirmed is threaded into a later hop's request is exactly as
+                // legitimate as a long one, so it must not be dropped for being short.
+                if (value.length < MIN_STATE_VALUE_LENGTH &&
+                    !chainForceIncludeValues.has(value) &&
+                    !forceIncludeValues.has(value))
                     continue;
                 if (value.length > MAX_COOKIE_STATE_VALUE_LENGTH)
                     continue;
@@ -2661,6 +2709,31 @@ function indexStateValues(captures, shieldedUuids = new Set(), actionCaptureIndi
                 }
             }
         }
+        // Non-cookie response headers are only indexed for values the fold-chain
+        // detector already confirmed are threaded from this hop's response into a
+        // later hop's request (`chainForceIncludeValues`) — unlike Set-Cookie,
+        // which is always a plausible token mint, an arbitrary header (e.g.
+        // `X-Conversation-Id`) is indexed as producible state only when chain
+        // detection itself has already established that reuse, so this never
+        // sweeps every header value as noise.
+        for (const [headerName, headerValue] of Object.entries(c.responseHeaders)) {
+            if (headerName.toLowerCase() === "set-cookie")
+                continue;
+            if (!chainForceIncludeValues.has(headerValue))
+                continue;
+            if (headerValue.length > MAX_COOKIE_STATE_VALUE_LENGTH)
+                continue;
+            if (PLACEHOLDER_STATE_VALUES.has(headerValue))
+                continue;
+            if (!index.has(headerValue)) {
+                index.set(headerValue, {
+                    value: headerValue,
+                    originIndex: i,
+                    path: [],
+                    headerOrigin: { sourceHeader: headerName },
+                });
+            }
+        }
         if (c.responseBody === undefined || c.responseBody === null)
             continue;
         // For GET captures, only index UUID-shaped strings. GET captures (today,
@@ -2671,8 +2744,13 @@ function indexStateValues(captures, shieldedUuids = new Set(), actionCaptureIndi
         // e.g. "candidate" as a state value gets substituted INSIDE an already-
         // emitted ${candidateId} interpolation, producing ${${entityTypeCode}Id}.
         const isGet = c.method === "GET";
-        for (const { value, path } of walkStringLeaves(c.responseBody)) {
-            if (value.length < MIN_STATE_VALUE_LENGTH)
+        for (const { value: rawValue, path } of walkAllPrimitiveLeaves(c.responseBody)) {
+            if (rawValue === null)
+                continue;
+            const value = String(rawValue);
+            if (value.length < MIN_STATE_VALUE_LENGTH &&
+                !chainForceIncludeValues.has(value) &&
+                !forceIncludeValues.has(value))
                 continue;
             if (value.length > MAX_STATE_VALUE_LENGTH)
                 continue;
@@ -2685,7 +2763,16 @@ function indexStateValues(captures, shieldedUuids = new Set(), actionCaptureIndi
             // corrupt T2/T3's already-substituted Values.
             if (shieldedUuids.has(value))
                 continue;
-            if (isGet && !UUID_REGEX.test(value))
+            // Same chain/force exemption as the MIN_STATE_VALUE_LENGTH floor above:
+            // a value the fold-chain detector already confirmed is threaded from
+            // this GET hop's response into a later hop's request is exactly as
+            // legitimate as a UUID anchor, so it must not be dropped just because
+            // this hop happens to be a GET rather than every existing fixture's
+            // POST.
+            if (isGet &&
+                !UUID_REGEX.test(value) &&
+                !chainForceIncludeValues.has(value) &&
+                !forceIncludeValues.has(value))
                 continue;
             if (!index.has(value)) {
                 index.set(value, { value, originIndex: i, path });
@@ -2891,8 +2978,48 @@ function compileActionSteps(actions, stateIndex) {
                 });
             }
         }
+        // Non-cookie response-header-origin produces — mirrors the Set-Cookie
+        // block above but for a plain header (e.g. `X-Price-Token`) whose value
+        // `indexStateValues` indexed with `headerOrigin.sourceHeader` set to the
+        // real header name. Only emitted when the value is actually consumed as
+        // a REQUEST HEADER downstream (`usedValueTargetHeader`) — `createHttpClient`'s
+        // `bind` option (see http-client.ts) is the only mechanism that can
+        // thread a header-origin value forward, since the emitted response
+        // variable never exposes response headers to the rest of the generated
+        // code the way it exposes the parsed body.
+        for (const [headerName, headerValue] of Object.entries(capture.responseHeaders)) {
+            if (headerName.toLowerCase() === "set-cookie")
+                continue;
+            if (!usedValues.has(headerValue))
+                continue;
+            const sv = stateIndex.get(headerValue);
+            if (!sv || sv.originIndex !== index || !sv.headerOrigin)
+                continue;
+            const targetHeader = usedValueTargetHeader.get(headerValue);
+            if (!targetHeader)
+                continue;
+            let name = `${headerName.replace(/[^A-Za-z0-9]/g, "")}Header`;
+            if (!/^[A-Za-z_$]/.test(name))
+                name = `_${name}`;
+            let suffix = 1;
+            while (seenNames.has(name)) {
+                suffix++;
+                name = `${headerName.replace(/[^A-Za-z0-9]/g, "")}Header${suffix}`;
+            }
+            seenNames.add(name);
+            produces.push({
+                kind: "header",
+                name,
+                sourceHeader: sv.headerOrigin.sourceHeader,
+                cookieName: sv.headerOrigin.cookieName,
+                targetHeader,
+            });
+        }
         if (capture.responseBody !== undefined && capture.responseBody !== null) {
-            for (const { value, path } of walkStringLeaves(capture.responseBody)) {
+            for (const { value: rawValue, path } of walkAllPrimitiveLeaves(capture.responseBody)) {
+                if (rawValue === null)
+                    continue;
+                const value = String(rawValue);
                 if (!usedValues.has(value))
                     continue;
                 const sv = stateIndex.get(value);
@@ -2977,7 +3104,9 @@ function resolveResponsePathValue(responseBody, path) {
             return null;
         }
     }
-    return typeof cursor === "string" ? cursor : null;
+    return typeof cursor === "string" || typeof cursor === "number" || typeof cursor === "boolean"
+        ? String(cursor)
+        : null;
 }
 /**
  * Replaces occurrences of state values in `template` with `${varName}`
@@ -3738,7 +3867,8 @@ function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap
                     const matchesJoinField = target.joinFields.some((field) => {
                         const value = readValueAtPath(firstItem, field.split("."));
                         return ((typeof value === "string" && value.length > 0 && value === headerValue) ||
-                            (typeof value === "number" && String(value) === headerValue));
+                            ((typeof value === "number" || typeof value === "boolean") &&
+                                String(value) === headerValue));
                     });
                     if (matchesJoinField)
                         headerNames.add(headerName);
@@ -3750,7 +3880,7 @@ function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap
                     const value = readValueAtPath(firstItem, field.split("."));
                     if (typeof value === "string" && value.length > 0)
                         joinValues.add(value);
-                    else if (typeof value === "number")
+                    else if (typeof value === "number" || typeof value === "boolean")
                         joinValues.add(String(value));
                 }
                 if (joinValues.size > 0)
@@ -4056,7 +4186,7 @@ function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap
                     const value = readValueAtPath(firstItem, field.split("."));
                     const stringValue = typeof value === "string" && value.length > 0
                         ? value
-                        : typeof value === "number"
+                        : typeof value === "number" || typeof value === "boolean"
                             ? String(value)
                             : null;
                     return stringValue !== null
@@ -4539,14 +4669,14 @@ function collectRequestStringValues(capture) {
     })();
     if (parsedBody !== undefined) {
         for (const { value } of walkAllPrimitiveLeaves(parsedBody)) {
-            if (typeof value === "number")
+            if (typeof value === "number" || typeof value === "boolean")
                 values.add(String(value));
         }
     }
     return values;
 }
 /**
- * Yields every string/numeric leaf reachable from `item` by walking nested
+ * Yields every string/numeric/boolean leaf reachable from `item` by walking nested
  * plain objects only (not arrays — a join key is a scalar field of the item
  * or one of its nested objects, never an element drawn from a nested array),
  * paired with its dot-separated path from `item`'s root. A bare top-level
@@ -4565,8 +4695,8 @@ function* walkItemFieldPaths(item, path = []) {
     }
 }
 /**
- * Finds the ordered list of an array item's string/numeric field paths whose
- * values are threaded into `drillCapture`'s outbound request — the join key a
+ * Finds the ordered list of an array item's string/numeric/boolean field
+ * paths whose values are threaded into `drillCapture`'s outbound request — the join key a
  * dependent drill-down call was built from. Each entry is a dot-separated
  * path (see {@link readValueAtPath} / {@link pathToAccessor}), so a bare
  * top-level field stays a single segment (e.g. `"sku"`) and a field nested
@@ -4582,23 +4712,31 @@ function findThreadedJoinFields(item, drillCapture) {
         return [];
     return [...walkItemFieldPaths(item)]
         .filter(({ value: v }) => (typeof v === "string" && v.length > 0 && requestValues.has(v)) ||
-        (typeof v === "number" && requestValues.has(String(v))))
+        (typeof v === "number" && requestValues.has(String(v))) ||
+        (typeof v === "boolean" && requestValues.has(String(v))))
         .map(({ path }) => path.join("."));
 }
-/** Every string and numeric leaf value present anywhere in a response body —
+/** Every string, numeric, and boolean leaf value present anywhere in a response —
  * the set a chained drill-down step's request must overlap with for that
  * step to count as depending on this response. Deliberately walks the WHOLE
  * body (not just object-array items, unlike {@link findThreadedJoinFields})
  * since a chained step can thread any response value, not only a per-item
- * join field. */
-function collectResponseLeafValues(responseBody) {
+ * join field. Also walks every response HEADER value, mirroring
+ * {@link collectRequestValuesIncludingHeaders} on the request side, since a
+ * chain hop can just as easily mint its join token in a response header
+ * (e.g. a `Location` or custom correlation header) as in the body. */
+function collectResponseLeafValues(capture) {
     const values = new Set();
-    for (const { value } of walkAllPrimitiveLeaves(responseBody)) {
+    for (const { value } of walkAllPrimitiveLeaves(capture.responseBody)) {
         if (typeof value === "string" && value.length > 0)
             values.add(value);
         if (typeof value === "number")
             values.add(String(value));
+        if (typeof value === "boolean")
+            values.add(String(value));
     }
+    for (const v of Object.values(capture.responseHeaders))
+        values.add(v);
     return values;
 }
 /**
@@ -4657,7 +4795,7 @@ function computeFoldChain(actions, drillStepIndex, drillArrayPath) {
         const requestValues = collectRequestValuesIncludingHeaders(candidate.capture);
         const dependsOnChain = chain.some((chainIndex) => {
             const chainStepCapture = actions[chainIndex].capture;
-            const responseValues = collectResponseLeafValues(chainStepCapture.responseBody);
+            const responseValues = collectResponseLeafValues(chainStepCapture);
             const echoedValues = collectRequestValuesIncludingHeaders(chainStepCapture);
             return [...responseValues].some((v) => !echoedValues.has(v) && requestValues.has(v));
         });
@@ -4725,7 +4863,7 @@ function directPrimitiveChildCountExcludingEchoed(obj, requestValues) {
     let n = 0;
     for (const v of Object.values(obj)) {
         if (v === null || (typeof v !== "object" && typeof v !== "function")) {
-            if (typeof v === "string" || typeof v === "number") {
+            if (typeof v === "string" || typeof v === "number" || typeof v === "boolean") {
                 if (requestValues.has(String(v)))
                     continue;
             }
@@ -5051,12 +5189,52 @@ function resolveSpecMatchedPrimaryItemIndex(primaryItems, joinFields, drillCaptu
     const matchedIndex = primaryItems.findIndex((item) => joinFields.every((field) => {
         const value = readValueAtPath(item, field.split("."));
         return ((typeof value === "string" && value.length > 0 && requestValues.has(value)) ||
-            (typeof value === "number" && requestValues.has(String(value))));
+            (typeof value === "number" && requestValues.has(String(value))) ||
+            (typeof value === "boolean" && requestValues.has(String(value))));
     }));
     return matchedIndex === -1 ? null : matchedIndex;
 }
-function buildFoldPlanFromSpec(actions, spec) {
-    const primaryArrayPath = spec.resultsPath.split(".");
+/** Like {@link resolveSpecMatchedPrimaryItemIndex}, but also looks upstream of
+ * `drillStepIndex` for the join key when `drillStepIndex`'s own request
+ * doesn't carry it — a `foldReturn` spec's `endpointPattern` naturally names
+ * the chain TERMINAL (the response actually holding the data an author wants
+ * folded), not the opaque entry hop that carries the join key onward (e.g.
+ * as a header-threaded token). Walks every earlier step back to
+ * `primaryStepIndex`, in reverse so the closest (least ambiguous) candidate
+ * wins first, and accepts one only once {@link computeFoldChain} confirms it
+ * actually chains FORWARD to `drillStepIndex` — otherwise an unrelated
+ * earlier step matching the join key by coincidence could hijack the fold.
+ * Returns the resolved `entryIndex` alongside the matched item index so the
+ * caller can build the fold's `chain` starting from the step that ACTUALLY
+ * carries the join key, not from `drillStepIndex` — a chain built from
+ * `drillStepIndex` alone would never include this upstream entry hop, so it
+ * would never be re-executed (header-parameterized) per primary item at
+ * runtime. */
+function resolveSpecMatchedPrimaryItemIndexAlongChain(actions, primaryItems, joinFields, primaryStepIndex, drillStepIndex) {
+    for (let entryIndex = drillStepIndex; entryIndex > primaryStepIndex; entryIndex--) {
+        const matched = resolveSpecMatchedPrimaryItemIndex(primaryItems, joinFields, actions[entryIndex].capture);
+        if (matched === null)
+            continue;
+        if (entryIndex === drillStepIndex)
+            return { entryIndex, primaryMatchedItemIndex: matched };
+        const { chain } = computeFoldChain(actions, entryIndex, []);
+        if (chain.includes(drillStepIndex))
+            return { entryIndex, primaryMatchedItemIndex: matched };
+    }
+    return null;
+}
+/**
+ * Compiles a flow-declared {@link FoldReturnSpec.endpointPattern} into a
+ * capture predicate, or a predicate that always returns `false` when `spec`
+ * is `null` or its pattern isn't a valid regex — the same null-safe
+ * try/catch shape {@link buildFoldPlanFromSpec} already applied inline,
+ * shared here so the action-sequence extractors can admit a spec-matched
+ * drill-down capture under the identical rule that later resolves its fold
+ * plan, instead of dropping it before the fold pipeline ever sees it.
+ */
+function compileFoldReturnEndpointMatcher(spec) {
+    if (spec === null)
+        return () => false;
     const endpointRx = (() => {
         try {
             return new RegExp(spec.endpointPattern);
@@ -5066,7 +5244,31 @@ function buildFoldPlanFromSpec(actions, spec) {
         }
     })();
     if (endpointRx === null)
-        return null;
+        return () => false;
+    return (capture) => endpointRx.test(capture.url);
+}
+/**
+ * A capture predicate matching whichever capture actually holds
+ * {@link FoldReturnSpec.resultsPath}'s object array — the flow's own PRIMARY
+ * results source, as opposed to {@link compileFoldReturnEndpointMatcher}'s
+ * `endpointPattern` match (the drill-down). REST's `extractActionSequence`
+ * never needs this: a REST primary is a POST/non-GET and is admitted
+ * unconditionally regardless of `foldReturnSpec`. GraphQL's primary is
+ * always a `query`, and `extractGraphQLActionSequence` drops every
+ * non-mutation capture by default, so without this predicate a declared
+ * `foldReturnSpec` would admit only the drill-down capture and never the
+ * read op whose response the drill-down folds onto — leaving
+ * `buildFoldPlanFromSpec` with no `primaryStepIndex` to resolve against.
+ */
+function compileFoldReturnResultsMatcher(spec) {
+    if (spec === null)
+        return () => false;
+    const resultsPath = spec.resultsPath.split(".");
+    return (capture) => objectItemsAtPath(capture.responseBody, resultsPath) !== null;
+}
+function buildFoldPlanFromSpec(actions, spec) {
+    const primaryArrayPath = spec.resultsPath.split(".");
+    const matchesFoldReturnEndpoint = compileFoldReturnEndpointMatcher(spec);
     let freshestPlan = null;
     for (let primaryStepIndex = 0; primaryStepIndex < actions.length; primaryStepIndex++) {
         const primaryItems = objectItemsAtPath(actions[primaryStepIndex].capture.responseBody, primaryArrayPath);
@@ -5074,7 +5276,7 @@ function buildFoldPlanFromSpec(actions, spec) {
             continue;
         for (let drillStepIndex = primaryStepIndex + 1; drillStepIndex < actions.length; drillStepIndex++) {
             const drill = actions[drillStepIndex];
-            if (!endpointRx.test(drill.capture.url))
+            if (!matchesFoldReturnEndpoint(drill.capture))
                 continue;
             // Widened to a flat (non-array) object response the same way the
             // structural heuristic is (see findAllObjectArrayFieldsOrWholeObject):
@@ -5090,17 +5292,31 @@ function buildFoldPlanFromSpec(actions, spec) {
             // now does (see detectDrillDownFoldPlan). Validated after the chain
             // resolves, below, since `[]` is a valid empty baseline for
             // computeFoldChain but not a valid final drillArrayPath on its own.
+            const matchResult = resolveSpecMatchedPrimaryItemIndexAlongChain(actions, primaryItems, spec.joinFields, primaryStepIndex, drillStepIndex);
+            if (matchResult === null)
+                continue;
+            const { entryIndex, primaryMatchedItemIndex } = matchResult;
+            // Rooted at `entryIndex` — the step whose request ACTUALLY carries the
+            // join key — not `drillStepIndex`, so an upstream entry hop the join
+            // key was only resolvable through (e.g. a header-threaded token) is
+            // itself part of `chain` and gets re-executed (join-parameterized) per
+            // primary item at runtime, same as every structurally-detected chain.
+            // `drillResultsPath`, when given, still targets `drillStepIndex`'s own
+            // response specifically (the endpoint the spec names); it is otherwise
+            // left for computeFoldChain's own forward richness walk to resolve,
+            // exactly as it does for every step beyond the chain's entry.
             const drillArrayPath = (() => {
+                if (entryIndex !== drillStepIndex) {
+                    return (findObjectArrayFieldOrWholeObject(actions[entryIndex].capture.responseBody)?.path ??
+                        null);
+                }
                 if (spec.drillResultsPath === undefined) {
                     return findObjectArrayFieldOrWholeObject(drill.capture.responseBody)?.path ?? null;
                 }
                 const path = spec.drillResultsPath.split(".");
                 return objectItemsAtPath(drill.capture.responseBody, path) ? path : null;
             })();
-            const primaryMatchedItemIndex = resolveSpecMatchedPrimaryItemIndex(primaryItems, spec.joinFields, drill.capture);
-            if (primaryMatchedItemIndex === null)
-                continue;
-            const { chain, chainArrayPath, chainTerminalIndex } = computeFoldChain(actions, drillStepIndex, drillArrayPath ?? []);
+            const { chain, chainArrayPath, chainTerminalIndex } = computeFoldChain(actions, entryIndex, drillArrayPath ?? []);
             // The chain's resolved terminal must actually hold foldable data —
             // an intermediate drill step with neither its own candidate NOR a
             // later chained step that resolves one has nothing to merge, so it
@@ -5114,7 +5330,7 @@ function buildFoldPlanFromSpec(actions, spec) {
                 targets: [
                     {
                         joinFields: spec.joinFields,
-                        drillStepIndex,
+                        drillStepIndex: entryIndex,
                         drillArrayPath: drillArrayPath ?? [],
                         primaryMatchedItemIndex,
                         chain,
@@ -5207,6 +5423,62 @@ function mergeSpecPlanOntoSamePrimary(structuralPlans, actions, foldReturnSpec)
  * plan that survives multipart disqualification, letting every downstream
  * emitter/shape-inference caller fold each of them.
  */
+/**
+ * Every value ACTUALLY threaded from one dependent-drill-down chain hop's
+ * response into a LATER chain hop's own request/headers — the same overlap
+ * `computeFoldChain`'s `dependsOnChain` check already computes to decide a
+ * step belongs in the chain at all — across every fold target
+ * `detectDrillDownFoldPlan` / `buildFoldPlanFromSpec` resolve. These are the
+ * values `indexStateValues` must index as producible state regardless of
+ * `MIN_STATE_VALUE_LENGTH`, so `compileActionSteps` can thread a
+ * chain-produced join value into the next hop's request even when that
+ * value is a short one (e.g. a bare numeric status token).
+ *
+ * Deliberately NOT "every leaf value on a chain hop's response" — a chain
+ * terminal's response commonly ECHOES the primary item's own join field
+ * back (e.g. `sku` on the folded record), and that echoed value is a
+ * PRIMARY-ITEM field the fold loop's own per-item render already threads
+ * literally (see {@link findThreadedJoinFields}'s docstring); sweeping it
+ * into state-threading's single-earliest-origin index would collapse every
+ * item's distinct value onto whichever item's capture was indexed first.
+ * Restricting to values that themselves reappear in a STRICTLY LATER chain
+ * hop's own request — real cross-call threading, not an echo sitting still
+ * in one response — keeps this exact to the shape state-threading is
+ * actually needed for.
+ *
+ * Runs directly off raw actions (not `resolveFoldPlan`, which needs
+ * `isMultipart` — unavailable before `compileActionSteps` has run) since
+ * fold-plan DETECTION depends only on each action's `capture`.
+ */
+function collectDependentDrillDownChainValues(actions, foldReturnSpec) {
+    const structuralPlans = detectDrillDownFoldPlan(actions);
+    const specPlan = foldReturnSpec === null ? null : buildFoldPlanFromSpec(actions, foldReturnSpec);
+    const plans = structuralPlans.length > 0 ? structuralPlans : specPlan === null ? [] : [specPlan];
+    const values = new Set();
+    for (const plan of plans) {
+        for (const target of plan.targets) {
+            for (let j = 0; j < target.chain.length; j++) {
+                const priorIndex = target.chain[j];
+                const priorCapture = actions[priorIndex]?.capture;
+                if (!priorCapture)
+                    continue;
+                const responseValues = collectResponseLeafValues(priorCapture);
+                const echoedValues = collectRequestValuesIncludingHeaders(priorCapture);
+                for (let k = j + 1; k < target.chain.length; k++) {
+                    const laterCapture = actions[target.chain[k]]?.capture;
+                    if (!laterCapture)
+                        continue;
+                    const laterRequestValues = collectRequestValuesIncludingHeaders(laterCapture);
+                    for (const v of responseValues) {
+                        if (!echoedValues.has(v) && laterRequestValues.has(v))
+                            values.add(v);
+                    }
+                }
+            }
+        }
+    }
+    return values;
+}
 function resolveFoldPlan(actions, foldReturnSpec = null) {
     const structuralPlans = detectDrillDownFoldPlan(actions);
     const plans = structuralPlans.length > 0
@@ -6573,7 +6845,9 @@ async function main() {
     // Hoisted so both the primary-operation gate below and rawActionCaptures
     // (further down) read the same computed sequence instead of calling the
     // extractor twice.
-    const graphqlActionSequence = gql ? extractGraphQLActionSequence(captures, submitPatterns) : [];
+    const graphqlActionSequence = gql
+        ? extractGraphQLActionSequence(captures, submitPatterns, foldReturnSpec)
+        : [];
     const primaryGraphQLOperation = gql && graphqlActionSequence.length === 0
         ? selectPrimaryGraphQLOperation(captures, flowSteps, vocabulary, process.env, ownBackendHostnames, fallbackDomain)
         : null;
@@ -6624,7 +6898,7 @@ async function main() {
     // heuristic extraction finds.
     const patternedHeuristicActionCaptures = gql
         ? graphqlActionSequence
-        : collapseRedundantPatches(extractActionSequence(captures, submitPatterns));
+        : collapseRedundantPatches(extractActionSequence(captures, submitPatterns, foldReturnSpec));
     // The same undercount hazard applies one layer below the manifest: a
     // flow-declared submitEndpointPattern that matches only one section's URL
     // (the natural way to describe "the button that finishes the wizard")
@@ -6637,8 +6911,8 @@ async function main() {
     const unfilteredHeuristicActionCaptures = submitPatterns.endpoint === null && submitPatterns.body === null
         ? patternedHeuristicActionCaptures
         : gql
-            ? extractGraphQLActionSequence(captures, null)
-            : collapseRedundantPatches(extractActionSequence(captures, null));
+            ? extractGraphQLActionSequence(captures, null, foldReturnSpec)
+            : collapseRedundantPatches(extractActionSequence(captures, null, foldReturnSpec));
     const patternUndercounts = patternedHeuristicActionCaptures.length < unfilteredHeuristicActionCaptures.length;
     if (patternUndercounts) {
         logger.info(`submission selection: ignoring submitEndpointPattern/submitBodyPattern (${patternedHeuristicActionCaptures.length} capture(s)) as an undercount of the unfiltered heuristic action sequence (${unfilteredHeuristicActionCaptures.length} capture(s))`);
@@ -6669,8 +6943,8 @@ async function main() {
     const rawUnfilteredActionCaptures = submitEndpointPattern === null
         ? null
         : gql
-            ? extractGraphQLActionSequence(captures, null)
-            : collapseRedundantPatches(extractActionSequence(captures, null));
+            ? extractGraphQLActionSequence(captures, null, foldReturnSpec)
+            : collapseRedundantPatches(extractActionSequence(captures, null, foldReturnSpec));
     // Form-schema detection runs BEFORE state-indexing so the field-id/option-id
     // UUIDs can be shielded from indexing — those UUIDs are stable schema
     // anchors that T2/T3 substitution depends on remaining literal in body
@@ -6718,8 +6992,16 @@ async function main() {
         ];
     })();
     const actionCaptureIndices = new Set(actionCaptures.map((a) => a.index));
+    // Resolved off raw actionCaptures — fold-plan DETECTION depends only on
+    // each action's capture, so this runs before compileActionSteps/
+    // indexStateValues even exist — so a short numeric join value threaded
+    // through a dependent-drill-down chain hop still gets indexed as
+    // producible state (see collectDependentDrillDownChainValues).
+    const dependentDrillDownChainValues = actionCaptures.length > 1
+        ? collectDependentDrillDownChainValues(actionCaptures, foldReturnSpec)
+        : new Set();
     const stateIndex = actionCaptures.length > 1
-        ? indexStateValues(captures, shieldedUuids, actionCaptureIndices)
+        ? indexStateValues(captures, shieldedUuids, actionCaptureIndices, dependentDrillDownChainValues)
         : new Map();
     const actionSteps = actionCaptures.length > 1 ? compileActionSteps(actionCaptures, stateIndex) : [];
     const isSubmissionFlow = actionSteps.length > 1;