@uipath/maestro-builder-sdk 6.16.6 → 6.16.8

package/dist/bpmn/bpmn-expr-check.d.ts

@@ -22,7 +22,7 @@
  * Variables are SCOPED: a sub-process sees the enclosing variables plus its own.
  */
 import { type ExprDiagnostic } from '../core/expr-check.js';
-import { type BuiltBpmn } from './bpmn-sdk.js';
+import type { BuiltBpmn } from './bpmn-sdk.js';
 /** A diagnostic plus the element it was found in. */
 export interface BpmnLocatedDiagnostic extends ExprDiagnostic {
     where: string;

package/dist/bpmn/bpmn-expr-check.js

@@ -22,7 +22,7 @@
  * Variables are SCOPED: a sub-process sees the enclosing variables plus its own.
  */
 import { checkExpression } from '../core/expr-check.js';
-import { nodeDeclaredVars } from './bpmn-sdk.js';
+import { nodeDeclaredVars } from './declared-vars.js';
 const NOUN = 'variable';
 const NAMESPACE = 'vars';
 const BINDING_NOUN = 'binding';

package/dist/bpmn/bpmn-sdk.d.ts

@@ -27,6 +27,7 @@ import { type DataServiceOperation } from './data-service.js';
 export type { DataServiceOperation } from './data-service.js';
 export { BpmnBuildError } from './bpmn-expr-check.js';
 export type { BpmnLocatedDiagnostic } from './bpmn-expr-check.js';
+export { connectorOutputVars, nodeDeclaredVars, typedNodeDeclaredVars } from './declared-vars.js';
 /** ISO-8601 timer specification (one of duration / date / cycle). */
 export interface TimerSpec {
     /** Fire after this ISO-8601 duration, e.g. `'PT30S'`. */
@@ -3135,58 +3136,6 @@ export type BpmnConnectorOpts = ConnectorOpts & ActivityOpts & {
      */
     outputVar?: string;
 };
-/**
- * The variables a connector task's output rows land in.
- *
- * Per-node by default, because a `uipath:output`'s `var` IS the variable
- * declaration as far as the platform is concerned (its canvas model maps every
- * node output to a variable keyed by `var`). A shared name would therefore mean
- * two connectors writing one variable, with the second silently clobbering the
- * first — and it is the reason both the serializer and the expression check need
- * the same answer, hence one function.
- *
- * @param n - The connector node.
- * @returns The response and error variable names.
- *
- * @internal
- */
-export declare function connectorOutputVars(n: Extract<BpmnNode, {
-    kind: 'connector';
-}>): {
-    response: string;
-    error: string;
-};
-/**
- * The variables a typed node writes — the ONE definition of that set.
- *
- * It had grown three: this one (what an expression may read), `implicitNodeVars` in
- * serialize (what gets declared in `uipath:variables`), and `derivedVariableIds` in
- * decompile (what a decompiled file must NOT re-declare). All three must agree, and
- * adding `outputRows` proved they do not stay agreed on their own: two were updated,
- * this one was missed, and a human task's mapped output stopped being visible to the
- * expression checker — `vars.decision` reported undeclared for a variable the node
- * plainly writes. So serialize now calls this instead of repeating it, and only
- * decompile's copy is separate, which its own comment already flags as load-bearing.
- *
- * @param n - The typed node.
- * @returns The variable ids its output rows write.
- * @internal
- */
-export declare function typedNodeDeclaredVars(n: Extract<BpmnNode, {
-    kind: 'typed';
-}>): string[];
-/**
- * Every variable name a node DECLARES by writing to it — the platform counts a
- * node's output `var` as a declaration, so a downstream `=vars.<name>` resolves
- * against it without any `uipath:variables` entry. The expression check mirrors
- * that, or it would reject reads the platform accepts.
- *
- * @param n - The node to inspect.
- * @returns The variable names it declares, if any.
- *
- * @internal
- */
-export declare function nodeDeclaredVars(n: BpmnNode): string[];
 /** A sub-process body: the same graph methods, plus an internal node builder. */
 export declare class SubProcessBuilder extends ScopeBuilder {
     /**

package/dist/bpmn/bpmn-sdk.js

@@ -2,9 +2,11 @@ import { connector as makeConnector } from '../core/actions.js';
 import { checkBpmnExpressions, BpmnBuildError } from './bpmn-expr-check.js';
 import { BPMN_SCHEMA_VERSIONS } from './format-profile.js';
 import { schemaVersionRefusal } from '../schema-version.js';
-import { bindingRequiredFields, REGISTRY_GAPS, registryType, typedNodeOutputVar } from './typed-node.js';
+import { bindingRequiredFields, REGISTRY_GAPS, registryType } from './typed-node.js';
 import { DATA_SERVICE_ACTIVITY_TYPE, DATA_SERVICE_CONNECTOR_KEY, dataServiceWire } from './data-service.js';
 export { BpmnBuildError } from './bpmn-expr-check.js';
+// @internal helpers kept on the published /bpmn subpath; SDK code imports declared-vars.js.
+export { connectorOutputVars, nodeDeclaredVars, typedNodeDeclaredVars } from './declared-vars.js';
 function normTimer(t) {
     return typeof t === 'string' ? { duration: t } : t;
 }
@@ -2264,47 +2266,6 @@ class ScopeBuilder {
         return this;
     }
 }
-/**
- * The variables a connector task's output rows land in.
- *
- * Per-node by default, because a `uipath:output`'s `var` IS the variable
- * declaration as far as the platform is concerned (its canvas model maps every
- * node output to a variable keyed by `var`). A shared name would therefore mean
- * two connectors writing one variable, with the second silently clobbering the
- * first — and it is the reason both the serializer and the expression check need
- * the same answer, hence one function.
- *
- * @param n - The connector node.
- * @returns The response and error variable names.
- *
- * @internal
- */
-export function connectorOutputVars(n) {
-    return { response: n.outputVar ?? `${n.id}_response`, error: `${n.id}_Error` };
-}
-/**
- * The variables a typed node writes — the ONE definition of that set.
- *
- * It had grown three: this one (what an expression may read), `implicitNodeVars` in
- * serialize (what gets declared in `uipath:variables`), and `derivedVariableIds` in
- * decompile (what a decompiled file must NOT re-declare). All three must agree, and
- * adding `outputRows` proved they do not stay agreed on their own: two were updated,
- * this one was missed, and a human task's mapped output stopped being visible to the
- * expression checker — `vars.decision` reported undeclared for a variable the node
- * plainly writes. So serialize now calls this instead of repeating it, and only
- * decompile's copy is separate, which its own comment already flags as load-bearing.
- *
- * @param n - The typed node.
- * @returns The variable ids its output rows write.
- * @internal
- */
-export function typedNodeDeclaredVars(n) {
-    // Spelled-out rows REPLACE the derived pair, so they are the whole answer.
-    if (n.outputRows)
-        return n.outputRows.map((r) => r.var).filter((v) => v !== undefined);
-    const v = typedNodeOutputVar(n.id, n.type, n.outputVar, n.spec);
-    return [...(v ? [v] : []), ...Object.keys(n.outputs ?? {})];
-}
 /**
  * Fill in `activity` on a connector task from the `operation` beside it.
  *
@@ -2348,30 +2309,6 @@ function defaultActivityIdentityRows(type, context, rows) {
         return rows;
     return [...rows, { name: 'activity', type: 'string', value: operation }];
 }
-/**
- * Every variable name a node DECLARES by writing to it — the platform counts a
- * node's output `var` as a declaration, so a downstream `=vars.<name>` resolves
- * against it without any `uipath:variables` entry. The expression check mirrors
- * that, or it would reject reads the platform accepts.
- *
- * @param n - The node to inspect.
- * @returns The variable names it declares, if any.
- *
- * @internal
- */
-export function nodeDeclaredVars(n) {
-    if (n.kind === 'connector') {
-        const { response, error } = connectorOutputVars(n);
-        return [response, error];
-    }
-    if (n.kind === 'typed')
-        return typedNodeDeclaredVars(n);
-    if (n.kind === 'scriptTask')
-        return Object.keys(n.outputs);
-    if (n.kind === 'task')
-        return Object.keys(n.set);
-    return [];
-}
 /** A sub-process body: the same graph methods, plus an internal node builder. */
 export class SubProcessBuilder extends ScopeBuilder {
     /**

package/dist/bpmn/check.d.ts

@@ -15,7 +15,7 @@
  * implicit join — the diagnostic is a `warning`, and its comment says which
  * platform rule it corresponds to and how the two differ.
  */
-import { type BuiltBpmn } from './bpmn-sdk.js';
+import type { BuiltBpmn } from './bpmn-sdk.js';
 import { type ConnectorCheckOpts } from '../core/connector-checks.js';
 import { type EventCheckOpts } from '../core/event-checks.js';
 export interface Diagnostic {

package/dist/bpmn/check.js

@@ -1,21 +1,4 @@
-/**
- * bpmn/check — fast static validation of a BuiltBpmn before serialization.
- *
- * Surfaces the common Maestro canvas-rule failures early (dangling flow refs,
- * duplicate ids, a gateway branch with no condition, a superfluous gateway, an
- * implicit join, a missing start event, a boundary event attached to nothing, an
- * empty timer) so authoring gets instant feedback. The authoritative gate is
- * still `uip maestro bpmn validate` (`validateBpmnCanvas`) on the emitted
- * `.bpmn`.
- *
- * **An `error` here must mirror a real platform rule.** Being stricter than
- * `validate` is worse than being looser: it refuses processes that deploy and run
- * correctly, and the author has no way to appeal. Where this file is deliberately
- * stricter than the platform — an unconditioned inclusive-gateway branch, an
- * implicit join — the diagnostic is a `warning`, and its comment says which
- * platform rule it corresponds to and how the two differ.
- */
-import { nodeDeclaredVars } from './bpmn-sdk.js';
+import { nodeDeclaredVars } from './declared-vars.js';
 import { allNodes, folderCompanionKeys, implicitNodeVars, processId } from './serialize.js';
 import { KNOWN_METHOD_SET } from './known-methods.js';
 import { EQUALS_EXPR_DIALECT, checkConnectorContract, checkConnectorLookups, checkConnectorSchema, checkBindingLabels, } from '../core/connector-checks.js';

package/dist/bpmn/connector.d.ts

@@ -20,7 +20,7 @@
  */
 import type BpmnModdle from 'bpmn-moddle';
 import type { ModdleElement } from 'bpmn-moddle';
-import { type BpmnNode } from './bpmn-sdk.js';
+import type { BpmnNode } from './bpmn-sdk.js';
 import type { Library } from '../core/library.js';
 import type { Bindings } from '../core/bindings.js';
 type El = ModdleElement;

package/dist/bpmn/connector.js

@@ -1,4 +1,4 @@
-import { connectorOutputVars } from './bpmn-sdk.js';
+import { connectorOutputVars } from './declared-vars.js';
 import { EQUALS_EXPR_DIALECT } from '../core/connector-checks.js';
 import { buildConnectorInputs, nestConnectorBody, transportHttpMethod } from '../core/connector-inputs.js';
 export function createConnectorTask(ctx, n) {

package/dist/bpmn/declared-vars.d.ts

@@ -0,0 +1,60 @@
+/**
+ * bpmn/declared-vars — which variables a BPMN node declares by writing to them.
+ *
+ * The builder, the expression check and the serializer all need the one answer.
+ * It lives outside `bpmn-sdk.ts` so the checker does not import the builder back
+ * (the runtime import cycle FB003 reported).
+ */
+import type { BpmnNode } from './bpmn-sdk.js';
+/**
+ * The variables a connector task's output rows land in.
+ *
+ * Per-node by default, because a `uipath:output`'s `var` IS the variable
+ * declaration as far as the platform is concerned (its canvas model maps every
+ * node output to a variable keyed by `var`). A shared name would therefore mean
+ * two connectors writing one variable, with the second silently clobbering the
+ * first — and it is the reason both the serializer and the expression check need
+ * the same answer, hence one function.
+ *
+ * @param n - The connector node.
+ * @returns The response and error variable names.
+ *
+ * @internal
+ */
+export declare function connectorOutputVars(n: Extract<BpmnNode, {
+    kind: 'connector';
+}>): {
+    response: string;
+    error: string;
+};
+/**
+ * The variables a typed node writes — the ONE definition of that set.
+ *
+ * It had grown three: this one (what an expression may read), `implicitNodeVars` in
+ * serialize (what gets declared in `uipath:variables`), and `derivedVariableIds` in
+ * decompile (what a decompiled file must NOT re-declare). All three must agree, and
+ * adding `outputRows` proved they do not stay agreed on their own: two were updated,
+ * this one was missed, and a human task's mapped output stopped being visible to the
+ * expression checker — `vars.decision` reported undeclared for a variable the node
+ * plainly writes. So serialize now calls this instead of repeating it, and only
+ * decompile's copy is separate, which its own comment already flags as load-bearing.
+ *
+ * @param n - The typed node.
+ * @returns The variable ids its output rows write.
+ * @internal
+ */
+export declare function typedNodeDeclaredVars(n: Extract<BpmnNode, {
+    kind: 'typed';
+}>): string[];
+/**
+ * Every variable name a node DECLARES by writing to it — the platform counts a
+ * node's output `var` as a declaration, so a downstream `=vars.<name>` resolves
+ * against it without any `uipath:variables` entry. The expression check mirrors
+ * that, or it would reject reads the platform accepts.
+ *
+ * @param n - The node to inspect.
+ * @returns The variable names it declares, if any.
+ *
+ * @internal
+ */
+export declare function nodeDeclaredVars(n: BpmnNode): string[];

package/dist/bpmn/declared-vars.js

@@ -0,0 +1,66 @@
+import { typedNodeOutputVar } from './typed-node.js';
+/**
+ * The variables a connector task's output rows land in.
+ *
+ * Per-node by default, because a `uipath:output`'s `var` IS the variable
+ * declaration as far as the platform is concerned (its canvas model maps every
+ * node output to a variable keyed by `var`). A shared name would therefore mean
+ * two connectors writing one variable, with the second silently clobbering the
+ * first — and it is the reason both the serializer and the expression check need
+ * the same answer, hence one function.
+ *
+ * @param n - The connector node.
+ * @returns The response and error variable names.
+ *
+ * @internal
+ */
+export function connectorOutputVars(n) {
+    return { response: n.outputVar ?? `${n.id}_response`, error: `${n.id}_Error` };
+}
+/**
+ * The variables a typed node writes — the ONE definition of that set.
+ *
+ * It had grown three: this one (what an expression may read), `implicitNodeVars` in
+ * serialize (what gets declared in `uipath:variables`), and `derivedVariableIds` in
+ * decompile (what a decompiled file must NOT re-declare). All three must agree, and
+ * adding `outputRows` proved they do not stay agreed on their own: two were updated,
+ * this one was missed, and a human task's mapped output stopped being visible to the
+ * expression checker — `vars.decision` reported undeclared for a variable the node
+ * plainly writes. So serialize now calls this instead of repeating it, and only
+ * decompile's copy is separate, which its own comment already flags as load-bearing.
+ *
+ * @param n - The typed node.
+ * @returns The variable ids its output rows write.
+ * @internal
+ */
+export function typedNodeDeclaredVars(n) {
+    // Spelled-out rows REPLACE the derived pair, so they are the whole answer.
+    if (n.outputRows)
+        return n.outputRows.map((r) => r.var).filter((v) => v !== undefined);
+    const v = typedNodeOutputVar(n.id, n.type, n.outputVar, n.spec);
+    return [...(v ? [v] : []), ...Object.keys(n.outputs ?? {})];
+}
+/**
+ * Every variable name a node DECLARES by writing to it — the platform counts a
+ * node's output `var` as a declaration, so a downstream `=vars.<name>` resolves
+ * against it without any `uipath:variables` entry. The expression check mirrors
+ * that, or it would reject reads the platform accepts.
+ *
+ * @param n - The node to inspect.
+ * @returns The variable names it declares, if any.
+ *
+ * @internal
+ */
+export function nodeDeclaredVars(n) {
+    if (n.kind === 'connector') {
+        const { response, error } = connectorOutputVars(n);
+        return [response, error];
+    }
+    if (n.kind === 'typed')
+        return typedNodeDeclaredVars(n);
+    if (n.kind === 'scriptTask')
+        return Object.keys(n.outputs);
+    if (n.kind === 'task')
+        return Object.keys(n.set);
+    return [];
+}

package/dist/bpmn/serialize.js

@@ -15,11 +15,10 @@
  */
 import BpmnModdle from 'bpmn-moddle';
 import { createRequire } from 'node:module';
-import { connectorOutputVars, } from './bpmn-sdk.js';
 import { createConnectorTask } from './connector.js';
 import { createConnectorEvent, createExternalTask, intsvcOutputVar } from './intsvc.js';
 import { createExtensionPayload, createTypedNode, rowDeclaration, typedNodeOutputVar, verbatimOutputRows } from './typed-node.js';
-import { typedNodeDeclaredVars } from './bpmn-sdk.js';
+import { connectorOutputVars, typedNodeDeclaredVars } from './declared-vars.js';
 const require = createRequire(import.meta.url);
 const uipathDescriptor = require('./uipath-moddle.v1.json');
 const NS = {

package/dist/case/compile-cli.js

@@ -12,7 +12,6 @@
 import { reportResult } from '../cli-result.js';
 import { writeFileSync, readFileSync, existsSync } from 'node:fs';
 import { join, dirname, basename, resolve } from 'node:path';
-import { createHash } from 'node:crypto';
 import { resolveCaseFile, loadBuiltCase } from './load.js';
 import { serialize } from './serialize.js';
 import { check } from './check.js';
@@ -23,6 +22,7 @@ import { defaultBindingsFile } from '../workdir.js';
 import { flagValue, runWhenInvokedDirectly } from '../cli-run.js';
 import { ensureTypeScriptRuntime } from '../node-runtime.js';
 import { CASE_FORMAT_PROFILE } from './format-profile.js';
+import { sha256Uuid } from '../core/stable-id.js';
 export async function run(argv) {
     if (argv.length === 0 || argv[0] === '-h' || argv[0] === '--help') {
         console.error('usage: compile <case.ts | BaseName> [-o caseplan.json]');
@@ -128,7 +128,7 @@ function syncEntryPoints(caseplan, outPath) {
         const { input, output } = entryPointIO(caseplan.variables, n.id);
         return {
             filePath: `/content/${base}.bpmn#${n.id}`,
-            uniqueId: prev?.uniqueId ?? stableUuid(`entrypoint:${n.id}`),
+            uniqueId: prev?.uniqueId ?? sha256Uuid(`entrypoint:${n.id}`),
             type: 'CaseManagement',
             input,
             output,
@@ -279,9 +279,4 @@ function isRecord(value) {
 function stringValue(value) {
     return typeof value === 'string' && value.length > 0 ? value : undefined;
 }
-/** A deterministic UUID-shaped id (not a real v4 — the schema only needs a stable string). */
-function stableUuid(seed) {
-    const h = createHash('sha256').update(seed).digest('hex');
-    return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20, 32)}`;
-}
 runWhenInvokedDirectly(import.meta.url, 'compile', run);

package/dist/case/decompile-cli.js

@@ -17,7 +17,7 @@
  */
 import { reportResult } from '../cli-result.js';
 import { mkdirSync, existsSync, readFileSync, writeFileSync } from 'node:fs';
-import { resolveLibraryDir } from '../registry/cache.js';
+import { resolveLibraryDir } from '../core/library-cache.js';
 import { basename, join, resolve } from 'node:path';
 import { defaultSourceOut, workDirBeside, writeSource } from '../workdir.js';
 import { flagValue, runWhenInvokedDirectly } from '../cli-run.js';

package/dist/check.js

@@ -14,7 +14,8 @@ import { prepareCommand } from './core/cli-spelling.js';
 import { editDistance } from './core/edit-distance.js';
 import { isAnswerField } from './core/hitl-answers.js';
 import { hitlDerivesOutcomeHandles, hitlExitModel, hitlRoutesPerOutcome } from './core/hitl-routing.js';
-import { childStepLists, declaredExits, hasExits, stopsAtEnd } from './core/step-ports.js';
+import { declaredExits, hasExits } from './core/step-ports.js';
+import { childStepLists, stopsAtEnd } from './flow-step-tree.js';
 import { FLOW_SCHEMA_VERSIONS } from './format-profile.js';
 import { compareSchemaVersions, schemaVersionRefusal } from './schema-version.js';
 import { planFlowGlobals, planSharedInputs, sharedInputRoots } from './flow-variables.js';

package/dist/core/cli-library.js

@@ -17,7 +17,7 @@
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { Library } from './library.js';
-import { resolveLibraryDir } from '../registry/cache.js';
+import { resolveLibraryDir } from './library-cache.js';
 import { flagValue } from '../cli-run.js';
 import { defaultOverlayDir } from '../workdir.js';
 import { EQUALS_EXPR_DIALECT } from './connector-checks.js';

package/dist/core/stable-id.d.ts

@@ -24,5 +24,38 @@
  * cannot read as a uuid. Coercing to unsigned first is the whole repair; the
  * hash itself is unchanged, so a seed that produced a WELL-FORMED id still
  * produces exactly that id.
+ *
+ * ## Three seed → uuid algorithms live here, and they are NOT interchangeable
+ *
+ * `stableId` (connector filter trees, event subscriptions), `fnv1aX4Uuid` (Flow
+ * inline-agent resource ids) and `sha256Uuid` (Case entry-point `uniqueId`) each
+ * produce ids that are already in shipped artifacts. Replacing one with another
+ * renames those resources on the next compile of every existing project. They are
+ * owned here so there is one place to look. The golden table in
+ * `tests/stable-id.test.ts` pins what each function returns, not which one a call
+ * site uses; `tests/cli.test.ts` pins the Case entry point's `uniqueId`. Change one
+ * only deliberately, updating that table and any byte-lock fixture it moves.
  */
+/** A uuid-shaped id derived from `seed`. Every segment is unsigned, including the `>>> 0` fix explained above. */
 export declare function stableId(seed: string): string;
+/**
+ * A deterministic v4-shaped uuid from a string.
+ *
+ * Used for an inline agent's `source` when the author does not pass one. It has to
+ * LOOK like a uuid (the platform treats it as an opaque directory name and the
+ * designer shows it as a folder) and it has to be STABLE, because a random one would
+ * make every recompile a diff of the `.flow` and a rename of a directory. FNV-1a
+ * ×4 with the version/variant nibbles pinned — not a cryptographic hash, and it does
+ * not need to be: the only requirement is that two different (flow, step) pairs do
+ * not collide within one project.
+ *
+ * Consumer: Flow inline-agent resource ids in `serialize.ts`.
+ */
+export declare function fnv1aX4Uuid(seed: string): string;
+/**
+ * A deterministic UUID-shaped id (not a real v4 — the schema only needs a stable string):
+ * the first 128 bits of SHA-256(`seed`), no version or variant bits set.
+ *
+ * Consumer: a Case entry point's `uniqueId` in `entry-points.json` (`case/compile-cli.ts`).
+ */
+export declare function sha256Uuid(seed: string): string;

package/dist/core/stable-id.js

@@ -24,7 +24,20 @@
  * cannot read as a uuid. Coercing to unsigned first is the whole repair; the
  * hash itself is unchanged, so a seed that produced a WELL-FORMED id still
  * produces exactly that id.
+ *
+ * ## Three seed → uuid algorithms live here, and they are NOT interchangeable
+ *
+ * `stableId` (connector filter trees, event subscriptions), `fnv1aX4Uuid` (Flow
+ * inline-agent resource ids) and `sha256Uuid` (Case entry-point `uniqueId`) each
+ * produce ids that are already in shipped artifacts. Replacing one with another
+ * renames those resources on the next compile of every existing project. They are
+ * owned here so there is one place to look. The golden table in
+ * `tests/stable-id.test.ts` pins what each function returns, not which one a call
+ * site uses; `tests/cli.test.ts` pins the Case entry point's `uniqueId`. Change one
+ * only deliberately, updating that table and any byte-lock fixture it moves.
  */
+import { createHash } from 'node:crypto';
+/** A uuid-shaped id derived from `seed`. Every segment is unsigned, including the `>>> 0` fix explained above. */
 export function stableId(seed) {
     let h1 = 0x811c9dc5;
     let h2 = 0x01000193;
@@ -35,3 +48,46 @@ export function stableId(seed) {
     const hex = (n, len) => (n >>> 0).toString(16).padStart(8, '0').slice(0, len);
     return `${hex(h1, 8)}-${hex(h2, 4)}-4${hex(h1 >>> 8, 3)}-8${hex(h2 >>> 8, 3)}-${hex(h1 ^ h2, 8)}${hex(h2, 4)}`;
 }
+/**
+ * A deterministic v4-shaped uuid from a string.
+ *
+ * Used for an inline agent's `source` when the author does not pass one. It has to
+ * LOOK like a uuid (the platform treats it as an opaque directory name and the
+ * designer shows it as a folder) and it has to be STABLE, because a random one would
+ * make every recompile a diff of the `.flow` and a rename of a directory. FNV-1a
+ * ×4 with the version/variant nibbles pinned — not a cryptographic hash, and it does
+ * not need to be: the only requirement is that two different (flow, step) pairs do
+ * not collide within one project.
+ *
+ * Consumer: Flow inline-agent resource ids in `serialize.ts`.
+ */
+export function fnv1aX4Uuid(seed) {
+    const words = [];
+    for (let i = 0; i < 4; i++) {
+        let h = 0x811c9dc5 ^ (i * 0x9e3779b9);
+        const s = `${seed}#${i}`;
+        for (let j = 0; j < s.length; j++) {
+            h ^= s.charCodeAt(j);
+            h = Math.imul(h, 0x01000193) >>> 0;
+        }
+        words.push(h >>> 0);
+    }
+    const hex = words.map((w) => w.toString(16).padStart(8, '0')).join('');
+    return [
+        hex.slice(0, 8),
+        hex.slice(8, 12),
+        `4${hex.slice(13, 16)}`,
+        `${((parseInt(hex.slice(16, 17), 16) & 0x3) | 0x8).toString(16)}${hex.slice(17, 20)}`,
+        hex.slice(20, 32),
+    ].join('-');
+}
+/**
+ * A deterministic UUID-shaped id (not a real v4 — the schema only needs a stable string):
+ * the first 128 bits of SHA-256(`seed`), no version or variant bits set.
+ *
+ * Consumer: a Case entry point's `uniqueId` in `entry-points.json` (`case/compile-cli.ts`).
+ */
+export function sha256Uuid(seed) {
+    const h = createHash('sha256').update(seed).digest('hex');
+    return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20, 32)}`;
+}

package/dist/core/step-ports.d.ts

@@ -1,4 +1,3 @@
-import type { Step } from '../flow-sdk.js';
 /** One author-named exit: the value an arm matches on, and the port it wires. */
 export interface DeclaredExit {
     /** What `.stepSwitch()`'s arm `value` matches — the outcome or branch NAME. */
@@ -35,23 +34,4 @@ type SpecLike = {
 export declare function declaredExits(spec: SpecLike | undefined, pinnedVersion?: string): DeclaredExit[] | NoExits;
 /** Narrowing helper — `declaredExits` returns one or the other. */
 export declare function hasExits(r: DeclaredExit[] | NoExits): r is DeclaredExit[];
-/**
- * Whether a step list that hands on no tail got there by reaching an End — a
- * `.return()`, on some path — rather than by stopping the whole run
- * (`.terminate`) or leaving a loop (`.break`). Only the first leaves a sibling
- * `.parallel` join waiting: a terminate ends the run, join included.
- */
-export declare function stopsAtEnd(steps: readonly Step[]): boolean;
-/**
- * The step lists nested DIRECTLY inside `step` — the bodies a walk over this
- * flow's own tree must descend into. Exhaustive over `Step['kind']`, so a new
- * container kind fails to compile here instead of being silently skipped by
- * every walker. That is how `check`'s return scan came to miss `.stepSwitch`
- * arms and `.stepToList` / `.onError` bodies, and warned NO_RETURN on flows
- * whose every path ends in `.return()` (UV-16855).
- *
- * A subflow's child flow is deliberately NOT a child here: it is another
- * flow's tree, and its returns say nothing about whether THIS flow ends.
- */
-export declare function childStepLists(step: Step): readonly Step[][];
 export {};

package/dist/core/step-ports.js

@@ -94,53 +94,3 @@ export function declaredExits(spec, pinnedVersion) {
 export function hasExits(r) {
     return Array.isArray(r);
 }
-/**
- * Whether a step list that hands on no tail got there by reaching an End — a
- * `.return()`, on some path — rather than by stopping the whole run
- * (`.terminate`) or leaving a loop (`.break`). Only the first leaves a sibling
- * `.parallel` join waiting: a terminate ends the run, join included.
- */
-export function stopsAtEnd(steps) {
-    const has = (list, kinds) => list.some((st) => kinds.has(st.kind)
-        || (st.kind === 'branch' && (has(st.then, kinds) || has(st.otherwise, kinds)))
-        || ((st.kind === 'switch' || st.kind === 'stepSwitch') && st.cases.some((c) => has(c.body, kinds)))
-        || (st.kind === 'switch' && st.default !== undefined && has(st.default, kinds)));
-    return has(steps, new Set(['return'])) && !has(steps, new Set(['terminate', 'break']));
-}
-/**
- * The step lists nested DIRECTLY inside `step` — the bodies a walk over this
- * flow's own tree must descend into. Exhaustive over `Step['kind']`, so a new
- * container kind fails to compile here instead of being silently skipped by
- * every walker. That is how `check`'s return scan came to miss `.stepSwitch`
- * arms and `.stepToList` / `.onError` bodies, and warned NO_RETURN on flows
- * whose every path ends in `.return()` (UV-16855).
- *
- * A subflow's child flow is deliberately NOT a child here: it is another
- * flow's tree, and its returns say nothing about whether THIS flow ends.
- */
-export function childStepLists(step) {
-    switch (step.kind) {
-        case 'branch':
-            return [step.then, step.otherwise];
-        case 'switch':
-            return [...step.cases.map((c) => c.body), ...(step.default ? [step.default] : [])];
-        case 'stepSwitch':
-            return step.cases.map((c) => c.body);
-        case 'loop':
-        case 'doWhile':
-        case 'stepToList':
-            return [step.body];
-        case 'parallel':
-            return step.arms;
-        case 'action':
-        case 'break':
-        case 'terminate':
-        case 'stepToRef':
-        case 'return':
-            return [];
-        default: {
-            const unhandled = step;
-            throw new Error(`childStepLists: unhandled step kind ${JSON.stringify(unhandled.kind)}`);
-        }
-    }
-}

package/dist/emit.js

@@ -30,7 +30,7 @@ import { dirname, join } from 'node:path';
 import { serialize } from './serialize.js';
 import { Library } from './library.js';
 import { Bindings } from './bindings.js';
-import { resolveLibraryDir } from './registry/cache.js';
+import { resolveLibraryDir } from './core/library-cache.js';
 import { defaultBindingsFile } from './workdir.js';
 /**
  * Resolve the connector library the same way `compile-cli` does: only load it