@enricai/barnacle 1.12.51 → 1.12.54

package/dist/scripts/recon-generate.js

@@ -3803,19 +3803,20 @@ function unknownValueAccessor(varName, path) {
 }
 /**
  * Builds a nested TypeScript assertion type matching a JSON path. e.g.
- *   ["Auth","Token"] -> `{ Auth: { Token: string } }`
- *   ["Sections","SectionIds","0"] -> `{ Sections: { SectionIds: { "0": string } } }`
- * The leaf is always `string` because produces[] entries are only emitted for
- * string leaves (see compileActionSteps + walkStringLeaves). Used to keep
- * emitted code free of `any` casts while still letting nested-path access
- * compile against `Record<string, unknown>`-typed response variables.
- */
-function pathToAssertionType(path) {
+ *   ["Auth","Token"], "string" -> `{ Auth: { Token: string } }`
+ *   ["Sections","Complete","0"], "boolean" -> `{ Sections: { Complete: { "0": boolean } } }`
+ * The leaf type is the produce's actual captured {@link BodyProduce.leafType}
+ * (string/number/boolean), so this always agrees with the same field's
+ * schema-inferred Zod type from {@link inferZodSchemaFromSamples}. Used to
+ * keep emitted code free of `any` casts while still letting nested-path
+ * access compile against `Record<string, unknown>`-typed response variables.
+ */
+function pathToAssertionType(path, leafType) {
     if (path.length === 0)
-        return "string";
+        return leafType;
     const segment = path[0];
     const key = isValidJsIdentifier(segment) ? segment : JSON.stringify(segment);
-    return `{ ${key}: ${pathToAssertionType(path.slice(1))} }`;
+    return `{ ${key}: ${pathToAssertionType(path.slice(1), leafType)} }`;
 }
 /**
  * Same nesting as {@link pathToAssertionType} but the leaf types as
@@ -4112,7 +4113,18 @@ function compileActionSteps(actions, stateIndex) {
                     name = `${pathToVarName(path)}${suffix}`;
                 }
                 seenNames.add(name);
-                produces.push({ kind: "body", name, path, eligibleConsumers: sv.eligibleConsumers });
+                const leafType = typeof rawValue === "number"
+                    ? "number"
+                    : typeof rawValue === "boolean"
+                        ? "boolean"
+                        : "string";
+                produces.push({
+                    kind: "body",
+                    name,
+                    path,
+                    leafType,
+                    eligibleConsumers: sv.eligibleConsumers,
+                });
             }
         }
         const ct = Object.entries(capture.requestHeaders).find(([k]) => k.toLowerCase() === "content-type");
@@ -4380,8 +4392,35 @@ function replaceGuardedAgainstExistingPlaceholders(text, pattern, bindingByValue
  * bare-value splice into either is exactly the name-free URL-path-segment
  * threading the eligibility gate already intends to allow, so callers
  * rendering those pass `false` (the default).
- */
-function interpolateStateValues(template, priorSteps, targetCapture, payloadAccessorByValue = new Map(), isJsonBody = false) {
+ *
+ * A value already bound to a `payload.<field>` accessor keeps that accessor
+ * on EVERY call EXCEPT the value's own producing step, where
+ * {@link deriveProducerBoundaryBindings} has deliberately scoped a binding to
+ * THAT step (`producerIndex === stepIndex`, threaded in as `stepIndex` below):
+ * the producer cannot thread its own not-yet-existent response, so its own
+ * request body needs the ordinary produced-value handling elsewhere (see
+ * {@link applyWholeValuePayloadSubstitutions}'s docstring) rather than a second,
+ * redundant payload bind here. Every OTHER step — including every step AFTER
+ * the producer that re-sends the same coordinate — keeps payload precedence:
+ * a value legitimately sourced from `payload.<field>` on one call must resolve
+ * to that same accessor on every call that re-sends it, never fall back to the
+ * coincidentally-equal scraped `${var}` just because the value also happens to
+ * qualify as a producer-boundary coordinate. A value with no producer-boundary
+ * binding at all is a coincidental echo — never re-sent by the step whose
+ * response produced it — so payload precedence is unconditional for it.
+ *
+ * `topLevelPayloadKvValues` extends that same precedence to values too SHORT
+ * to ever enter `payloadAccessorByValue` (which only registers inputBody
+ * string leaves >= MIN_STATE_VALUE_LENGTH): a short top-level scalar
+ * (`{"currency":"usd"}`) is still unconditionally payload-ified by the later
+ * `applyPayloadKeyValueSubstitutions` key/value pass, but only if its literal
+ * survives THIS pass untouched. Without this set, a short value that also
+ * clears the chain/force-include exemption as a coincidentally-equal
+ * response-produced state var on an intervening call gets spliced here
+ * first, and the literal is gone by the time the KV pass runs — masking
+ * payload precedence on every call after the one that scraped it.
+ */
+function interpolateStateValues(template, priorSteps, targetCapture, payloadAccessorByValue = new Map(), isJsonBody = false, producerBoundaryBindings = new Map(), stepIndex = -1, topLevelPayloadKvValues = new Set()) {
     const stateBindings = deriveStateVarByValue(priorSteps, targetCapture);
     const bindingByValue = new Map();
     for (const [value, accessor] of payloadAccessorByValue) {
@@ -4391,6 +4430,11 @@ function interpolateStateValues(template, priorSteps, targetCapture, payloadAcce
     const unconditionalValues = new Set();
     const sourceNameByValue = new Map();
     for (const [value, binding] of stateBindings) {
+        const isProducerStep = producerBoundaryBindings.get(value)?.producerIndex === stepIndex;
+        if (payloadAccessorByValue.has(value) && !isProducerStep)
+            continue;
+        if (topLevelPayloadKvValues.has(value) && !isProducerStep)
+            continue;
         bindingByValue.set(value, `\${${binding.varName}}`);
         sourceNameByValue.set(value, binding.sourceName);
         if (binding.restricted)
@@ -4569,11 +4613,14 @@ function deriveProducerBoundaryBindings(actions, alreadyBound) {
  * the exact `"<key>":` slot, so it only fires on a value's own JSON slot.
  *
  * `producerScoped` bindings fire only on their producing step
- * (`producerIndex === stepIndex`): a later step re-sending the same coordinate
- * threads the produced state var, the established behavior; only the producer,
- * which cannot thread its own not-yet-existent response, needs the payload bind.
- * `entryUrlBindings` (a caller coordinate lifted from the entry URL) fire on
- * EVERY step — they are the caller's data on every request, never a produced var.
+ * (`producerIndex === stepIndex`): only the producer, which cannot thread its
+ * own not-yet-existent response, needs this whole-value bind. A later step
+ * re-sending the same coordinate still resolves to `payload.<field>` — via
+ * {@link interpolateStateValues}'s own producer-scoped exemption, which lets
+ * the produced state var win ONLY on the producing step itself — never via a
+ * second whole-value bind here. `entryUrlBindings` (a caller coordinate lifted
+ * from the entry URL) fire on EVERY step — they are the caller's data on every
+ * request, never a produced var.
  */
 function applyWholeValuePayloadSubstitutions(template, parsedBody, producerScoped, entryUrlBindings, stepIndex) {
     if (producerScoped.size === 0 && entryUrlBindings.size === 0)
@@ -5207,6 +5254,32 @@ pascalName = null) {
             // skip non-JSON bodies (e.g. multipart raw bytes)
         }
     }
+    // Every value `applyPayloadKeyValueSubstitutions` will unconditionally
+    // payload-ify from the ENTRY payload's own top-level key/value pairs,
+    // gathered here so {@link interpolateStateValues} can give it payload
+    // precedence too, regardless of MIN_STATE_VALUE_LENGTH — see
+    // {@link interpolateStateValues}'s `topLevelPayloadKvValues` docstring for
+    // why this must run BEFORE that later pass, not just alongside it.
+    // `inputBody` only, deliberately NOT `additionalBodies`: a later call's own
+    // top-level field is exactly as likely to be a genuinely re-sent
+    // response-produced state value (draftId minted by an earlier call and
+    // resent as that later call's own `applicationDraftId`) as a caller-
+    // supplied literal, so extending precedence to it would wrongly freeze
+    // real cross-step state threading. Only the caller's OWN entry payload is
+    // an unambiguous non-state origin.
+    const topLevelPayloadKvValues = new Set();
+    if (inputBody !== undefined && inputBody !== null && !Array.isArray(inputBody)) {
+        for (const { value, path } of walkAllPrimitiveLeaves(inputBody)) {
+            if (path.length !== 1)
+                continue;
+            const key = path[0];
+            if (!isValidJsIdentifier(key))
+                continue;
+            if (value === null)
+                continue;
+            topLevelPayloadKvValues.add(String(value));
+        }
+    }
     // Detect the flow's THREADED transaction id: a single UUID the site mints
     // once (on page load) and reuses across every submit body to correlate the
     // multi-step wizard — observed on real ATS flows where one such id spans
@@ -5314,7 +5387,7 @@ pascalName = null) {
         // length/chain-eligibility scoping doesn't happen to catch the coincidence.
         const url = (0, capture_filters_1.isZeroVarianceRepeatCapture)(cap, actions.map((a) => a.capture))
             ? cap.url
-            : interpolateStateValues(cap.url, prior, cap, payloadAccessorByValue);
+            : interpolateStateValues(cap.url, prior, cap, payloadAccessorByValue, false, producerBoundaryBindings, i);
         // Form-schema substitution runs first on the raw recon body so its
         // field-id-anchored matches see the original JSON. State-threading and
         // payload key-value passes then run on top. Option-id substitution runs
@@ -5384,7 +5457,7 @@ pascalName = null) {
             ? applyUrlParamPayloadSubstitutions(rawBodyWithProducerBoundary, parsedBody, urlParamBindings)
             : rawBodyWithProducerBoundary;
         const bodyAfterStateAndKv = rawBodyWithUrlParams
-            ? applyPayloadKeyValueSubstitutions(interpolateStateValues(rawBodyWithUrlParams, prior, cap, payloadAccessorByValue, true), inputBody, additionalBodies, outDiscoveredAdditionalBodyKeys)
+            ? applyPayloadKeyValueSubstitutions(interpolateStateValues(rawBodyWithUrlParams, prior, cap, payloadAccessorByValue, true, producerBoundaryBindings, i, topLevelPayloadKvValues), inputBody, additionalBodies, outDiscoveredAdditionalBodyKeys)
             : "";
         // Mechanism A — generic (plain-JSON, wire-key-anchored) dropdown label→code
         // rewrite. Runs AFTER interpolateStateValues + the payload-KV pass, not
@@ -5412,8 +5485,22 @@ pascalName = null) {
         const perCallHeaders = {};
         for (const [k, v] of Object.entries(cap.requestHeaders)) {
             const lower = k.toLowerCase();
-            if (lower === "api-token" || lower === "authorization" || joinCarryingHeaderNames?.has(k)) {
-                perCallHeaders[k] = interpolateStateValues(v, prior, cap, payloadAccessorByValue);
+            const interpolated = interpolateStateValues(v, prior, cap, payloadAccessorByValue, false, producerBoundaryBindings, i);
+            // Authorization/Api-Token and a structurally-detected join-carrying
+            // header are always emitted per-call (even when interpolation finds
+            // nothing to thread, matching this gate's prior behavior exactly).
+            // Any OTHER header name also gets a per-call entry once interpolation
+            // actually recognizes its value as a prior step's produced state var
+            // — interpolateStateValues itself is the source of truth for whether
+            // a value is genuinely threadable; restricting that recognition to a
+            // closed set of header names left every other header name frozen as
+            // a literal BASE_HEADERS entry (or dropped per-call) even when its
+            // captured value was a real, already-produced response field.
+            if (lower === "api-token" ||
+                lower === "authorization" ||
+                joinCarryingHeaderNames?.has(k) ||
+                interpolated !== v) {
+                perCallHeaders[k] = interpolated;
             }
         }
         // G1: emit baseUrl-derived headers (Origin, Referer) per-call from
@@ -5677,23 +5764,10 @@ pascalName = null) {
                     // find it. Rebinding by structure, not value, lets referencesItemVar
                     // (below) correctly stay false so the fetch hoists above the
                     // per-item loop instead of pinning to it.
-                    // Pairs each raw threaded field (whose VALUE is what's actually
-                    // present in the captured text — the only thing a literal-value
-                    // search can ever find) with the accessor it should render as.
-                    // For an ancestor-scoped rebind these deliberately diverge: the
-                    // literal search must still key off the item's own field (that's
-                    // the value textually present), while the emitted accessor points
-                    // at the ancestor's structurally-corresponding field instead —
-                    // searching for the ANCESTOR field's (different) value would never
-                    // match anything in `text` and silently freeze the literal.
-                    const threadedFieldPairs = isAncestorScoped
-                        ? rawThreadedFields.map((tf) => ({
-                            valueField: tf,
-                            accessorField: tf.varName === itemVar
-                                ? (findStructurallyCorrespondingAncestorField(ancestorScopes, tf.field) ?? tf)
-                                : tf,
-                        }))
-                        : rawThreadedFields.map((tf) => ({ valueField: tf, accessorField: tf }));
+                    // See buildThreadedFieldPairs's doc for why the literal-value
+                    // search and the rendered accessor deliberately diverge for a
+                    // proven ancestor-scoped rebind.
+                    const threadedFieldPairs = buildThreadedFieldPairs(isAncestorScoped, rawThreadedFields, itemVar, ancestorScopes);
                     // Accessor swap first: rewrites an already-templated `${payload.X}`
                     // reference (from applyPayloadKeyValueSubstitutions) to this field's
                     // real accessor. Each target (`${payload.X}`) is a unique, fully
@@ -5701,6 +5775,7 @@ pascalName = null) {
                     // never re-shaped into `${payload.X}` form) can't re-match, so a
                     // sequential pass here carries none of the reentrancy risk the
                     // literal-value pass below has.
+                    let swapFiredForItemBoundField = false;
                     const swapped = threadedFieldPairs.reduce((acc, { valueField, accessorField }) => {
                         const replacement = `\${${scopedAccessor(accessorField.varName, accessorField.field)}}`;
                         // applyPayloadKeyValueSubstitutions only ever names a payload
@@ -5714,10 +5789,16 @@ pascalName = null) {
                         // reference behind once the literal value itself has already
                         // been replaced by the payload-key-value pass.
                         const lastSegment = valueField.field.split(".").pop();
+                        const payloadFieldPlaceholder = `\${payload.${valueField.field}}`;
+                        const payloadLastSegmentPlaceholder = `\${payload.${lastSegment}}`;
+                        if (accessorField.varName === itemVar &&
+                            (acc.includes(payloadFieldPlaceholder) || acc.includes(payloadLastSegmentPlaceholder))) {
+                            swapFiredForItemBoundField = true;
+                        }
                         return acc
-                            .split(`\${payload.${valueField.field}}`)
+                            .split(payloadFieldPlaceholder)
                             .join(replacement)
-                            .split(`\${payload.${lastSegment}}`)
+                            .split(payloadLastSegmentPlaceholder)
                             .join(replacement);
                     }, text);
                     // Literal-value substitution: ONE guarded regex-alternation pass over
@@ -5740,6 +5821,7 @@ pascalName = null) {
                             : {
                                 value: stringValue,
                                 replacement: `\${${scopedAccessor(accessorField.varName, accessorField.field)}}`,
+                                isItemBound: accessorField.varName === itemVar,
                             };
                     })
                         .filter((b) => b !== null);
@@ -5754,6 +5836,25 @@ pascalName = null) {
                     const filteredValueBindings = isProvenInvariant
                         ? valueBindings.filter((b) => isGenuineVaryingQueryValue(b.value, chainCapture, allCaptures))
                         : valueBindings;
+                    // Ground truth for the hoist gate, computed per FIELD from what
+                    // this call actually spliced into the request, rather than
+                    // inferred after the fact by re-scanning the fully rendered text
+                    // for `itemVar`: a target's OTHER join fields can independently
+                    // prove isAncestorScoped and rebind cleanly while THIS field's own
+                    // rebind attempt still falls back to `?? tf` (no structurally-
+                    // corresponding ancestor field exists for it). Deriving
+                    // `referencesItemVar` straight from the same value/placeholder
+                    // bindings that feed the splice below — rather than relying
+                    // solely on the post-hoc itemVar word-boundary scan — closes the
+                    // gap where a fallback accessor's occurrence in the final text
+                    // could otherwise be missed. A binding whose value never survives
+                    // to `filteredValueBindings` (unresolved, or excluded by the
+                    // zero-variance guard) is correctly excluded here too — it never
+                    // reaches the rendered request, so it can't leak an out-of-scope
+                    // identifier into it.
+                    if (swapFiredForItemBoundField || filteredValueBindings.some((b) => b.isItemBound)) {
+                        referencesItemVar = true;
+                    }
                     const result = substituteThreadedValues(swapped, filteredValueBindings);
                     const withDrillParamBindings = applyDrillParamBindings(foldReturnSpec, chainCapture, result);
                     // The frozen-varying-param safety net exists to catch a
@@ -5785,7 +5886,15 @@ pascalName = null) {
                 // there is no ancestor loop to hoist into in the first place (a
                 // flat, single-level fold), so it is treated as item-scoped too —
                 // existing flat folds must keep emitting byte-identical code.
-                const itemVarRefPattern = new RegExp(`\\$\\{${itemVar}[.[]`);
+                // Word-boundary match on the bare identifier — not anchored to
+                // `${itemVar` — because `scopedAccessor`/`unknownValueAccessor`
+                // wraps every non-leaf hop in a `(itemVar.field as Record<string,
+                // unknown>)` cast for a nested field path, so the identifier can
+                // appear as `${(itemVar...` rather than immediately after `${`. An
+                // anchored pattern misses that shape entirely and lets a genuinely
+                // item-scoped reference get hoisted above the item loop, where
+                // `itemVar` is never declared.
+                const itemVarRefPattern = new RegExp(`\\b${itemVar}\\b`);
                 let referencesItemVar = ancestorVars.length === 0;
                 for (const chainIndex of target.chain) {
                     const chainStep = actions[chainIndex];
@@ -5814,7 +5923,7 @@ pascalName = null) {
                         if (!referencedNames.has(p.name))
                             continue;
                         chainDeclared.add(p.name);
-                        const assertion = pathToAssertionType(p.path);
+                        const assertion = pathToAssertionType(p.path, p.leafType);
                         chainLines.push(`      const ${p.name} = (${chainStep.varName} as ${assertion})${pathToAccessor(p.path, { assertNonNull: false })};`);
                     }
                 }
@@ -5856,7 +5965,7 @@ pascalName = null) {
             if (!referencedNames.has(p.name))
                 continue;
             declaredNames.add(p.name);
-            const assertion = pathToAssertionType(p.path);
+            const assertion = pathToAssertionType(p.path, p.leafType);
             produceLines.push(`    const ${p.name} = (${step.varName} as ${assertion})${pathToAccessor(p.path, { assertNonNull: false })};`);
         }
         const bindResponse = referencedNames.has(step.varName) || produceLines.length > 0;
@@ -5883,8 +5992,14 @@ pascalName = null) {
             const perCallHeaderEntries = [];
             for (const [k, v] of Object.entries(cap.requestHeaders)) {
                 const lower = k.toLowerCase();
-                if (lower === "api-token" || lower === "authorization") {
-                    perCallHeaderEntries.push(`${JSON.stringify(k)}: \`${interpolateStateValues(v, actions.slice(0, i), cap, payloadAccessorByValue)}\``);
+                const interpolated = interpolateStateValues(v, actions.slice(0, i), cap, payloadAccessorByValue, false, producerBoundaryBindings, i);
+                // Mirrors the non-multipart per-call header builder above: any
+                // header name (not just Authorization/Api-Token) that interpolation
+                // recognizes as a prior step's produced state var must thread
+                // per-call too, or its custom name freezes into an invariant
+                // BASE_HEADERS-equivalent literal.
+                if (lower === "api-token" || lower === "authorization" || interpolated !== v) {
+                    perCallHeaderEntries.push(`${JSON.stringify(k)}: \`${interpolated}\``);
                 }
             }
             // G1+G2: include tenant-derived headers in the multipart fetch too.
@@ -6934,29 +7049,44 @@ function findStructurallyCorrespondingAncestorField(ancestorScopes, field) {
     }
     return null;
 }
-/** Recursively searches `obj` for the first array-valued property whose
- * first element (itself a plain object) contains `lastSegment` as one of
- * its own field paths' trailing segments, returning the full dot-path from
- * `obj`'s root through the array's `0` index down to that field (e.g.
- * `["entries", "0", "code"]`) — an accessor {@link pathToAccessor} renders
- * as `.entries["0"].code`, valid whether the numeric segment is treated as
- * a bracketed literal key or an array index. */
+/** Recursively searches `obj` for an array-valued property holding an
+ * element (itself a plain object) that contains `lastSegment` as one of its
+ * own field paths' trailing segments, returning the full dot-path from
+ * `obj`'s root through the array's index down to that field (e.g.
+ * `["entries", "1", "code"]`) — an accessor {@link pathToAccessor} renders
+ * as `.entries["1"].code`, valid whether the numeric segment is treated as
+ * a bracketed literal key or an array index. Scans every element of a
+ * candidate array, not only the first: a sparse first element (e.g. a
+ * sold-out entry missing an optional nested object that every OTHER sibling
+ * genuinely carries) must not silently defeat a structural correspondence
+ * that a later element in the same array would prove. This applies equally
+ * to the recursive descent into a NESTED array-within-array: it also walks
+ * every sibling element rather than only element `0`, so a sparse first
+ * element one level up can't hide a match that lives in a nested array on a
+ * later sibling. */
 function findFieldInFirstArrayElement(obj, lastSegment, path = []) {
     for (const [key, value] of Object.entries(obj)) {
         const childPath = [...path, key];
         if (Array.isArray(value)) {
-            const first = value[0];
-            if (first === null || typeof first !== "object" || Array.isArray(first))
-                continue;
-            const firstObj = first;
-            for (const { path: subPath } of walkItemFieldPaths(firstObj)) {
-                if (subPath[subPath.length - 1] === lastSegment) {
-                    return [...childPath, "0", ...subPath];
+            for (let i = 0; i < value.length; i++) {
+                const candidate = value[i];
+                if (candidate === null || typeof candidate !== "object" || Array.isArray(candidate))
+                    continue;
+                const candidateObj = candidate;
+                for (const { path: subPath } of walkItemFieldPaths(candidateObj)) {
+                    if (subPath[subPath.length - 1] === lastSegment) {
+                        return [...childPath, String(i), ...subPath];
+                    }
                 }
             }
-            const nested = findFieldInFirstArrayElement(firstObj, lastSegment, [...childPath, "0"]);
-            if (nested)
-                return nested;
+            for (let i = 0; i < value.length; i++) {
+                const candidate = value[i];
+                if (candidate === null || typeof candidate !== "object" || Array.isArray(candidate))
+                    continue;
+                const nested = findFieldInFirstArrayElement(candidate, lastSegment, [...childPath, String(i)]);
+                if (nested)
+                    return nested;
+            }
             continue;
         }
         if (value !== null && typeof value === "object") {
@@ -6967,6 +7097,34 @@ function findFieldInFirstArrayElement(obj, lastSegment, path = []) {
     }
     return null;
 }
+/** Pairs each raw threaded field (whose VALUE is what a drill request's
+ * captured text actually contains — the only thing a literal-value search
+ * can ever find) with the accessor it should render as, shared by
+ * {@link emitMultiStepExecuteHttp} and {@link emitContractTs}'s identical
+ * fold-hoist rebind so the two emitters can never drift on this logic (see
+ * this module's fold-plan investigation notes on the two call sites having
+ * previously diverged). For a proven-ancestor-scoped target these
+ * deliberately diverge: the literal search must still key off the item's own
+ * field (the value textually present in the captured request), while the
+ * emitted accessor points at the ancestor's structurally-corresponding field
+ * instead — searching for the ANCESTOR field's (different) value would never
+ * match anything in the rendered text and silently freeze the literal. When
+ * no structurally-corresponding ancestor field exists, the accessor stays
+ * item-bound (`?? tf`) — safe only because every caller's own itemVar
+ * word-boundary scan over the FINAL rendered text (after this pairing feeds
+ * substitution) is what actually decides whether the target may hoist above
+ * its item loop, not this function. */
+function buildThreadedFieldPairs(isAncestorScoped, rawThreadedFields, itemVar, ancestorScopes) {
+    if (!isAncestorScoped) {
+        return rawThreadedFields.map((tf) => ({ valueField: tf, accessorField: tf }));
+    }
+    return rawThreadedFields.map((tf) => ({
+        valueField: tf,
+        accessorField: tf.varName === itemVar
+            ? (findStructurallyCorrespondingAncestorField(ancestorScopes, tf.field) ?? tf)
+            : tf,
+    }));
+}
 /** Every string, numeric, and boolean leaf value present anywhere in a response —
  * the set a chained drill-down step's request must overlap with for that
  * step to count as depending on this response. Deliberately walks the WHOLE
@@ -9180,7 +9338,11 @@ const httpClient = createHttpClient({ schema: ${pascal}ResponseSchema, bottlenec
             // Every target's join/merge — plus any non-hoistable target's own
             // chain fetch — goes here, spliced inside the item loop.
             const itemScopedLines = [];
-            const itemVarRefPattern = new RegExp(`\\$\\{${itemVar}[.[]`);
+            // Word-boundary match — see emitMultiStepExecuteHttp's identical
+            // `itemVarRefPattern` for why an anchored `${itemVar` pattern misses a
+            // nested field path's `${(itemVar.field as Record<string,
+            // unknown>)...}` cast wrapper.
+            const itemVarRefPattern = new RegExp(`\\b${itemVar}\\b`);
             for (const [targetIndex, target] of foldPlan.targets.entries()) {
                 const matchedPrimaryItem = primaryItemsWithAncestors[target.primaryMatchedItemIndex];
                 if (!matchedPrimaryItem) {
@@ -9250,29 +9412,11 @@ const httpClient = createHttpClient({ schema: ${pascal}ResponseSchema, bottlenec
                         ...target.joinFields.map((field) => ({ varName: itemVar, field })),
                         ...findThreadedJoinFields(threadingScopes, chainCapture, allCaptures),
                     ]);
-                    // Mirrors emitMultiStepExecuteHttp's identical rebind (see
-                    // isAncestorScoped above): a proven ancestor-scoped drill still
-                    // rebinds fields findThreadedJoinFields left on itemVar purely
-                    // because the matched item's own field was the only object in
-                    // scope whose value equalled the captured literal.
-                    // Pairs each raw threaded field (whose VALUE is what's actually
-                    // present in `rawUrl` — the only thing a literal-value search can
-                    // ever find) with the accessor it should render as. For an
-                    // ancestor-scoped rebind these deliberately diverge: the literal
-                    // search must still key off the item's own field (that's the
-                    // value textually present in the URL), while the emitted accessor
-                    // points at the ancestor's structurally-corresponding field
-                    // instead — searching for the ANCESTOR field's (different) value
-                    // would never match anything in the URL and silently freeze the
-                    // literal.
-                    const threadedFieldPairs = isAncestorScoped
-                        ? rawThreadedFields.map((tf) => ({
-                            valueField: tf,
-                            accessorField: tf.varName === itemVar
-                                ? (findStructurallyCorrespondingAncestorField(ancestorScopes, tf.field) ?? tf)
-                                : tf,
-                        }))
-                        : rawThreadedFields.map((tf) => ({ valueField: tf, accessorField: tf }));
+                    // Mirrors emitMultiStepExecuteHttp's identical rebind — see
+                    // buildThreadedFieldPairs's doc for why the literal-value search
+                    // and the rendered accessor deliberately diverge for a proven
+                    // ancestor-scoped rebind.
+                    const threadedFieldPairs = buildThreadedFieldPairs(isAncestorScoped, rawThreadedFields, itemVar, ancestorScopes);
                     // ONE guarded regex-alternation pass over `withBase` for every
                     // threaded field's value, longest first — see substituteThreadedValues's
                     // doc for why a per-field sequential `.replace()` loop here (the bug
@@ -9294,6 +9438,7 @@ const httpClient = createHttpClient({ schema: ${pascal}ResponseSchema, bottlenec
                             : {
                                 value: stringValue,
                                 replacement: `\${${scopedAccessor(accessorField.varName, accessorField.field)}}`,
+                                isItemBound: accessorField.varName === itemVar,
                             };
                     })
                         .filter((b) => b !== null);
@@ -9306,6 +9451,20 @@ const httpClient = createHttpClient({ schema: ${pascal}ResponseSchema, bottlenec
                     const filteredValueBindings = isProvenInvariant
                         ? valueBindings.filter((b) => isGenuineVaryingQueryValue(b.value, chainCapture, allCaptures))
                         : valueBindings;
+                    // Mirrors emitMultiStepExecuteHttp's identical ground-truth hoist
+                    // signal: derive `referencesItemVar` straight from the same
+                    // value bindings that feed the splice below, rather than relying
+                    // solely on the post-hoc itemVar word-boundary scan — a target's
+                    // OTHER join fields can independently prove isAncestorScoped and
+                    // rebind cleanly while THIS field's own rebind attempt still
+                    // falls back to `?? tf` (no structurally-corresponding ancestor
+                    // field exists for it). A binding excluded from
+                    // `filteredValueBindings` (unresolved, or dropped by the
+                    // zero-variance guard) never reaches the rendered URL, so it's
+                    // correctly excluded here too.
+                    if (filteredValueBindings.some((b) => b.isItemBound)) {
+                        referencesItemVar = true;
+                    }
                     const result = substituteThreadedValues(withBase, filteredValueBindings);
                     const withDrillParamBindings = applyDrillParamBindings(foldReturnSpec, chainCapture, result);
                     // See emitMultiStepExecuteHttp's identical guard: the frozen-