@uipath/maestro-builder-sdk 6.17.5 → 6.18.0

package/dist/case/merge.js

@@ -48,9 +48,7 @@
  */
 import { collectPreservation } from './decompile.js';
 import { applyPreservation } from './serialize.js';
-function clone(value) {
-    return JSON.parse(JSON.stringify(value));
-}
+import { jsonClone } from '../core/json-file.js';
 /** Stage labels in a document, in order. */
 function stageLabels(document) {
     return (document.nodes ?? [])
@@ -102,11 +100,11 @@ function warnOrphanedIdentities(preservation, edited, warn) {
 export function mergeCase(original, edited, options = {}) {
     const preservation = collectPreservation(original);
     if (!preservation)
-        return clone(edited);
+        return jsonClone(edited);
     if (options.warn)
         warnOrphanedIdentities(preservation, edited, options.warn);
     // `applyPreservation` is what `compile` runs with the payload a source
     // carries. Handing it the ORIGINAL's payload and the EDITED graph is the whole
     // merge: same operation, different provenance.
-    return applyPreservation(clone(edited), preservation, { overwrite: true });
+    return applyPreservation(jsonClone(edited), preservation, { overwrite: true });
 }

package/dist/case/serialize.js

@@ -1414,7 +1414,7 @@ function emitCaseExit(c, i, ids, resolver) {
 }
 /** One `slaRules[]` entry: the deadline + its escalations. `id` (+ `displayName`
  * when named) is preallocated so a `sla-status-change` rule can reference it. */
-function emitSla(sla, index, count, ids, resolver) {
+function emitSla(sla, index, count, _ids, resolver) {
     const displayName = sla.displayName ?? (index === count - 1 ? 'Default SLA' : `Conditional SLA ${count - index - 1}`);
     const out = {
         id: resolver.slaId.get(sla),

package/dist/check.js

@@ -25,6 +25,7 @@ import { stopsAtEnd } from './flow-step-tree.js';
 import { FLOW_SCHEMA_VERSIONS } from './format-profile.js';
 import { compareSchemaVersions, schemaVersionRefusal } from './schema-version.js';
 import { planFlowGlobals, planSharedInputs, sharedInputRoots } from './flow-variables.js';
+import { ownEntry } from './core/own-entry.js';
 export function check(built, opts = {}) {
     let diags = [];
     const uses = collectConnectionUses(() => { diags = checkFlow(built, [], opts); });
@@ -1094,7 +1095,7 @@ function checkFlow(built, ancestors, opts = {}) {
             // per-family rules below, because the envelope carries the same fields
             // whatever the node publishes on its success path; which VARIABLE holds it
             // is a per-family runtime boundary `serialize` rewrites, not something the
-            // author writes (`errorEnvelopeVar`).
+            // author writes (`ERROR_ENVELOPE_VAR`).
             if (field === 'error') {
                 const tail = rest ? rest.slice(1).split('.')[0] : undefined;
                 if (tail !== undefined)
@@ -2394,14 +2395,16 @@ function checkVoice(step, kind, inputs, diags) {
                 'gpt-realtime-2': ['alloy', 'ash', 'ballad', 'coral', 'echo', 'sage', 'shimmer', 'verse'],
             };
             const model = typeof v.model === 'string' ? v.model : undefined;
-            if (model !== undefined && !(model in PERSONAS)) {
+            // An own-key read: `in` also matched 'toString', and `PERSONAS[model].includes` then threw.
+            const personas = model !== undefined ? ownEntry(PERSONAS, model) : undefined;
+            if (model !== undefined && personas === undefined) {
                 at('VOICE_MODEL_UNKNOWN', `voiceAgent step "${step}" names the voice model ${JSON.stringify(model)}. The platform's catalog `
                     + `today is ${Object.keys(PERSONAS).map((m) => `'${m}'`).join(' and ')} — a voice model, not one of `
                     + `the text models an inline agent takes.`);
             }
-            else if (typeof v.persona === 'string' && model !== undefined && !PERSONAS[model].includes(v.persona)) {
+            else if (typeof v.persona === 'string' && personas !== undefined && !personas.includes(v.persona)) {
                 at('VOICE_PERSONA_UNKNOWN', `voiceAgent step "${step}"'s persona ${JSON.stringify(v.persona)} is not one of `
-                    + `${JSON.stringify(model)}'s voices (${PERSONAS[model].join(', ')}). A persona belongs to its model.`);
+                    + `${JSON.stringify(model)}'s voices (${personas.join(', ')}). A persona belongs to its model.`);
             }
         }
     }
@@ -2813,7 +2816,7 @@ function checkAgenticProcess(step, inputs, diags) {
             + `\`form: 'flow'\` if the sibling is a Flow.`, `location: 'published', folderPath: 'Shared/<folder>'`);
     }
     if (inSolution && blank(inputs?.projectId)) {
-        const folder = (AGENTIC_PROCESS_FORMS[inputs?.form ?? 'bpmn'] ?? AGENTIC_PROCESS_FORMS.bpmn).solutionFolder;
+        const folder = (ownEntry(AGENTIC_PROCESS_FORMS, inputs?.form ?? 'bpmn') ?? AGENTIC_PROCESS_FORMS.bpmn).solutionFolder;
         at('AGENTIC_LOCAL_NO_PROJECT_ID', `In-solution agentic process step "${step}" has no \`projectId\`. Read \`resource.projectKey\` from `
             + `\`resources/solution_folder/process/${folder}/<project>.json\`.`, `projectId: '<resource.projectKey>'`);
     }
@@ -3605,6 +3608,13 @@ function checkInlineAgent(step, inputs, diags, opts = {}) {
                 at('INLINE_AGENT_ESCALATION_NO_FIELDS', `Inline agent step "${step}"'s quick-form escalation declares no \`fields\` — the reviewer gets an `
                     + `empty form.`);
             }
+            for (const f of Array.isArray(e.fields) ? e.fields : []) {
+                if (!FORM_FIELD_TYPES.includes(String(f?.type))) {
+                    at('INLINE_AGENT_ESCALATION_FIELD_TYPE_UNKNOWN', `Inline agent step "${step}"'s quick-form escalation gives the field "${String(f?.id ?? '?')}" the type `
+                        + `${JSON.stringify(f?.type)}, which the form does not recognize — it would be published as a plain `
+                        + `string. Valid: ${FORM_FIELD_TYPES.join(', ')}.`, formFieldTypeHint(f?.type));
+                }
+            }
             continue;
         }
         if (e?.fields !== undefined) {
@@ -4440,8 +4450,15 @@ function checkHttp(step, inputs, diags) {
         }
     }
 }
+/** Every FormFieldType, once; `Record<FormFieldType, …>` makes tsc refuse a missing or extra one. */
+const FORM_FIELD_TYPE_SET = { text: true, number: true, boolean: true, 'date-time': true };
 /** Form-field types the platform recognizes; anything else normalizes to text. */
-const FORM_FIELD_TYPES = ['text', 'number', 'boolean', 'date-time'];
+const FORM_FIELD_TYPES = Object.keys(FORM_FIELD_TYPE_SET);
+/** The `suggestion` for an unknown form-field type: the nearest valid one, else `type: 'text'`. */
+function formFieldTypeHint(type) {
+    const nearest = nearestName(String(type), FORM_FIELD_TYPES);
+    return nearest !== undefined ? `type: '${nearest}'` : `type: 'text'`;
+}
 /** Names the human task's own result already uses — an answer cannot claim one. */
 const RESERVED_ANSWER_IDS = new Set(['output', 'status', 'Action']);
 /**
@@ -4717,11 +4734,10 @@ function checkHitl(step, inputs, diags) {
             return;
         }
         if (!FORM_FIELD_TYPES.includes(String(f?.type))) {
-            const nearest = nearestName(String(f?.type), FORM_FIELD_TYPES);
             at('HITL_FIELD_TYPE_UNKNOWN', `Human task "${step}" gives the form field "${id}" the type ${JSON.stringify(f?.type)}, which `
                 + `the platform does not recognize — it normalizes an unknown type to text, so the reviewer `
                 + `gets a text box and the value comes back as a string. Valid: `
-                + `${FORM_FIELD_TYPES.join(', ')}.`, nearest !== undefined ? `type: '${nearest}'` : `type: 'text'`);
+                + `${FORM_FIELD_TYPES.join(', ')}.`, formFieldTypeHint(f?.type));
         }
         if (isAnswerField(f))
             answers++; // an `output`, or an `inOut` whose reviewed value comes back
@@ -5715,7 +5731,7 @@ function checkStepRefs(built, diags) {
         }
     };
     collect(built.steps, undefined, '', undefined);
-    for (const { target, port, from, after, scope, arm } of found) {
+    for (const { target, from, after, scope, arm } of found) {
         const where = from ? `after "${from}"` : 'at the start of the flow';
         const say = (level, code, message, suggestion) => {
             diags.push({ level, code, message, step: from ?? 'stepToRef', ...(suggestion ? { suggestion } : {}) });
@@ -5781,7 +5797,7 @@ function checkStepRefs(built, diags) {
  * checks and what it does not. It checks the FIELD NAME against the envelope's
  * own fields, which are the same on every family. It does NOT police the prefix:
  * `.error` vs `.output` is a per-family runtime boundary, measured per family and
- * rewritten by `serialize` (`errorEnvelopeVar`), so an author writing `.error`
+ * rewritten by `serialize` (`ERROR_ENVELOPE_VAR`), so an author writing `.error`
  * is right by construction and an author hand-writing `.output` is caught by
  * ERROR_ENVELOPE_VIA_OUTPUT instead.
  *

package/dist/core/ceql.js

@@ -33,6 +33,7 @@
  * rather than a wrong one.
  */
 import { stableId } from './stable-id.js';
+import { ownEntry } from './own-entry.js';
 /** Raised when an expression is not CEQL this parser can represent. */
 export class CeqlParseError extends Error {
     expression;
@@ -128,9 +129,11 @@ function readOperator(s) {
         }
     }
     const alias = /^([A-Za-z]+)\b/.exec(s.rest);
-    if (alias && ODATA_ALIASES[alias[1].toLowerCase()]) {
+    const word = alias?.[1].toLowerCase();
+    const odata = word !== undefined ? ownEntry(ODATA_ALIASES, word) : undefined;
+    if (alias && odata) {
         const wrong = alias[1];
-        throw new CeqlParseError(`\`${wrong}\` is an OData operator; CEQL uses \`${ODATA_ALIASES[wrong.toLowerCase()]}\`.`, s.src);
+        throw new CeqlParseError(`\`${wrong}\` is an OData operator; CEQL uses \`${odata}\`.`, s.src);
     }
     for (const [text, op] of SYMBOL_OPERATORS) {
         if (s.src.startsWith(text, s.pos)) {

package/dist/core/connector-inputs.js

@@ -28,6 +28,8 @@ import { editDistance } from './edit-distance.js';
 /** Flow's dialect, re-exported so `serialize.ts` need not reach past this module. */
 export { FLOW_EXPR_DIALECT } from './connector-checks.js';
 import { FLOW_EXPR_DIALECT as FLOW_DIALECT } from './connector-checks.js';
+import { ownEntry } from './own-entry.js';
+import { isRecord } from './node-envelope.js';
 /**
  * Validate a connector's activity inputs against its declared field list and
  * return them ROUTED to the wire slots the platform reads. Catches the three
@@ -155,7 +157,8 @@ export function buildConnectorInputs(rc, inputs, opts) {
             partValues.set(f.name, render(nested.value));
             continue;
         }
-        const slot = SLOT_FOR_LOCATION[f.location ?? 'body'] ?? 'bodyParameters';
+        const location = f.location ?? 'body';
+        const slot = ownEntry(SLOT_FOR_LOCATION, location) ?? 'bodyParameters';
         routed[slot][f.name] = render(nested.value);
     }
     if (errs.length) {
@@ -318,9 +321,6 @@ function place(target, parts, index, value) {
     target[part.key] = next;
     place(next, parts, index + 1, value);
 }
-function isRecord(value) {
-    return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
 function connectorPath(name) {
     return name.split('.').map((raw) => ({
         key: raw.endsWith('[*]') ? raw.slice(0, -3) : raw,

package/dist/core/event-checks.js

@@ -20,7 +20,7 @@
  */
 import { isLookupToken, resolvedValue, unresolvedLookupMessage, } from './lookups.js';
 import { prepareCommand } from './cli-spelling.js';
-import { EVENT_FILTER_OPERATORS, readEventFilter, eventFilterProblem } from './event-filters.js';
+import { EVENT_FILTER_OPERATORS, readEventFilter, eventFilterProblem, jmesStringProblem } from './event-filters.js';
 import { EVENT_BYOA_UNVERIFIED, byoaUnverified } from './byoa.js';
 /**
  * Ask the library what event parameters a subscription's operation declares.
@@ -228,6 +228,18 @@ export function checkEventSubscription(subscription, where, at, warn, eventParam
     const scopeObject = scopeEntries.find(([k]) => /^(objectName|entityName|object)$/i.test(k))?.[1];
     const object = typeof sub.object === 'string' && sub.object !== '' ? sub.object : undefined;
     const say = warn ?? at;
+    // A scope value is folded into the match expression as `k == '<value>'`, so it
+    // meets the same JMESPath backslash ambiguity a filter value does. A nested
+    // `where` (a dotted parameter written as an object) is checked leaf by leaf.
+    const scopeStrings = (value, path) => typeof value === 'string' ? [[path, value]]
+        : value && typeof value === 'object' && !Array.isArray(value)
+            ? Object.entries(value).flatMap(([k, v]) => scopeStrings(v, `${path}.${k}`))
+            : [];
+    for (const [path, value] of scopeEntries.flatMap(([k, v]) => scopeStrings(v, k))) {
+        const ambiguous = jmesStringProblem(value);
+        if (ambiguous)
+            at('EVENT_FILTER_BACKSLASH', `${where}'s \`where.${path}\`: ${ambiguous}`);
+    }
     // The OBJECT half of the contract. A GENERIC event (`record-created` on Data
     // Fabric, Salesforce, ServiceNow, Jira, …) fires for ONE object of the connection
     // and its library entry names none — so `object` is REQUIRED, and its absence is
@@ -313,8 +325,11 @@ export function checkEventSubscription(subscription, where, at, warn, eventParam
                     at('EVENT_FILTER_NO_VALUE', `${where}'s filters[${i}] gives \`${keys[0]}\` a value that is not a string, number or boolean.`);
                 }
                 else {
+                    const ambiguous = typeof read.value === 'string' ? jmesStringProblem(read.value) : undefined;
                     const problem = eventFilterProblem(read);
-                    if (problem)
+                    if (ambiguous)
+                        at('EVENT_FILTER_BACKSLASH', `${where}'s filters[${i}] on \`${read.field}\`: ${ambiguous}`);
+                    else if (problem)
                         at('EVENT_FILTER_BAD_VALUE', `${where}'s filters[${i}] on \`${read.field}\`: ${problem}`);
                 }
             });

package/dist/core/event-filters.d.ts

@@ -22,7 +22,10 @@
  * | … and `lessThanOrEqual` / `greaterThan` / `greaterThanOrEqual` likewise. |
  *
  * Literals follow the designer's `_formatLiteral`: a string is single-quoted, a
- * number or boolean is a JMESPath backtick literal. A DATE is the one case the
+ * number or boolean is a JMESPath backtick literal. A plain string keeps the
+ * designer's bytes; a `'` inside it is escaped (`jmesString`), where the designer
+ * would emit broken — or injectable — JMESPath, and a backslash no two engines read
+ * alike is refused. A DATE is the one case the
  * designer decides from the field's type (`DateTimeOffset` → `to_number(...)` on
  * both sides, because JMESPath compares only numbers). Offline the SDK has no
  * field types for a connection-scoped object, so the VALUE decides: an ISO-8601
@@ -97,11 +100,42 @@ export declare function readEventFilter(leaf: unknown): {
 };
 export declare function isIsoDateString(value: unknown): value is string;
 /**
- * Why a filter cannot be lowered, or `undefined` when it can. A comparison on a
- * plain string is the one refused shape: JMESPath `<`/`>` compare numbers only,
- * so the emitted expression would match nothing and nobody would be told.
+ * Why a filter cannot be lowered, or `undefined` when it can. Two shapes are
+ * refused. A comparison on a plain string: JMESPath `<`/`>` compare numbers only,
+ * so the emitted expression would match nothing and nobody would be told. A string
+ * value with a backslash the engines read differently (`jmesStringProblem`).
  */
 export declare function eventFilterProblem(read: ReadEventFilter): string | undefined;
+/**
+ * A JMESPath raw-string literal: `'…'` with each `'` written `\'`. A backslash is
+ * kept as it is, so a value without `'` keeps the designer's bytes.
+ *
+ * The designer's `_formatLiteral` (@uipath/maestro-sdk JmesHelper) splices the value
+ * unescaped, so `O'Brien` ends the literal early and the rest of the value is parsed
+ * as expression. Escaping `'` closes that.
+ *
+ * A backslash is the one character the readers disagree on. The specification's
+ * raw-string grammar reads `\\` as one backslash and keeps any other escaped
+ * character with its backslash (`preserved-escape`). The reference jmespath.js/py
+ * lexers keep `\\` as two characters. So `Finance\Q3` and `C:\tmp` read the same
+ * everywhere when emitted unchanged, while doubling them would make them miss on a
+ * reference engine. Which reader Integration Service runs is unconfirmed, so a value
+ * whose backslash HAS no common spelling is refused (`jmesStringProblem`): one before
+ * another `\`, before a `'`, or at the end. With those refused, an emitted `\'` is
+ * always an escaped quote under every reader, which is what keeps the literal from
+ * closing early (`x\' || `true` || '` is refused, not emitted). jmespath.js still
+ * unescapes only the first `\'`, so a value with two quotes reads differently there.
+ *
+ * This is the one spelling for Flow filters, Flow scope clauses and BPMN; FB011 holds
+ * every JMESPath string splice to it. It throws on a refused value: `check` reports
+ * one first (`EVENT_FILTER_BACKSLASH`), and serialize refuses it with the node's name.
+ */
+export declare function jmesString(value: string): string;
+/**
+ * Why `value` has no JMESPath raw-string spelling every reader agrees on, or
+ * `undefined` when it has one. See `jmesString`.
+ */
+export declare function jmesStringProblem(value: string): string | undefined;
 /**
  * The JMESPath condition for one filter — the grammar the designer emits,
  * without the outer parentheses (the caller groups conditions).

package/dist/core/event-filters.js

@@ -22,7 +22,10 @@
  * | … and `lessThanOrEqual` / `greaterThan` / `greaterThanOrEqual` likewise. |
  *
  * Literals follow the designer's `_formatLiteral`: a string is single-quoted, a
- * number or boolean is a JMESPath backtick literal. A DATE is the one case the
+ * number or boolean is a JMESPath backtick literal. A plain string keeps the
+ * designer's bytes; a `'` inside it is escaped (`jmesString`), where the designer
+ * would emit broken — or injectable — JMESPath, and a backslash no two engines read
+ * alike is refused. A DATE is the one case the
  * designer decides from the field's type (`DateTimeOffset` → `to_number(...)` on
  * both sides, because JMESPath compares only numbers). Offline the SDK has no
  * field types for a connection-scoped object, so the VALUE decides: an ISO-8601
@@ -31,6 +34,7 @@
  * strings is null), so `check` refuses it rather than emit a filter that never
  * matches.
  */
+import { ownEntry } from './own-entry.js';
 /** The designer's operator vocabulary this SDK emits, keyed by the authored key. */
 export const EVENT_FILTER_OPERATORS = {
     contains: { designer: 'Contains', kind: 'function', jmes: 'contains' },
@@ -82,12 +86,18 @@ export function isIsoDateString(value) {
     return typeof value === 'string' && ISO_DATE.test(value);
 }
 /**
- * Why a filter cannot be lowered, or `undefined` when it can. A comparison on a
- * plain string is the one refused shape: JMESPath `<`/`>` compare numbers only,
- * so the emitted expression would match nothing and nobody would be told.
+ * Why a filter cannot be lowered, or `undefined` when it can. Two shapes are
+ * refused. A comparison on a plain string: JMESPath `<`/`>` compare numbers only,
+ * so the emitted expression would match nothing and nobody would be told. A string
+ * value with a backslash the engines read differently (`jmesStringProblem`).
  */
 export function eventFilterProblem(read) {
     const op = EVENT_FILTER_OPERATORS[read.operator];
+    if (typeof read.value === 'string') {
+        const ambiguous = jmesStringProblem(read.value);
+        if (ambiguous)
+            return ambiguous;
+    }
     if (op.kind === 'function' && typeof read.value !== 'string') {
         return `\`${read.operator}\` is a text test, so its value must be a string — got ${JSON.stringify(read.value)}.`;
     }
@@ -99,9 +109,54 @@ export function eventFilterProblem(read) {
     }
     return undefined;
 }
+/**
+ * A JMESPath raw-string literal: `'…'` with each `'` written `\'`. A backslash is
+ * kept as it is, so a value without `'` keeps the designer's bytes.
+ *
+ * The designer's `_formatLiteral` (@uipath/maestro-sdk JmesHelper) splices the value
+ * unescaped, so `O'Brien` ends the literal early and the rest of the value is parsed
+ * as expression. Escaping `'` closes that.
+ *
+ * A backslash is the one character the readers disagree on. The specification's
+ * raw-string grammar reads `\\` as one backslash and keeps any other escaped
+ * character with its backslash (`preserved-escape`). The reference jmespath.js/py
+ * lexers keep `\\` as two characters. So `Finance\Q3` and `C:\tmp` read the same
+ * everywhere when emitted unchanged, while doubling them would make them miss on a
+ * reference engine. Which reader Integration Service runs is unconfirmed, so a value
+ * whose backslash HAS no common spelling is refused (`jmesStringProblem`): one before
+ * another `\`, before a `'`, or at the end. With those refused, an emitted `\'` is
+ * always an escaped quote under every reader, which is what keeps the literal from
+ * closing early (`x\' || `true` || '` is refused, not emitted). jmespath.js still
+ * unescapes only the first `\'`, so a value with two quotes reads differently there.
+ *
+ * This is the one spelling for Flow filters, Flow scope clauses and BPMN; FB011 holds
+ * every JMESPath string splice to it. It throws on a refused value: `check` reports
+ * one first (`EVENT_FILTER_BACKSLASH`), and serialize refuses it with the node's name.
+ */
+export function jmesString(value) {
+    const problem = jmesStringProblem(value);
+    if (problem)
+        throw new Error(`jmesString: ${problem}`);
+    return `'${value.replace(/'/g, "\\'")}'`;
+}
+/** A backslash whose raw-string reading depends on the engine: before `\` or `'`, or last. */
+const AMBIGUOUS_BACKSLASH = /\\(?=[\\']|$)/;
+/**
+ * Why `value` has no JMESPath raw-string spelling every reader agrees on, or
+ * `undefined` when it has one. See `jmesString`.
+ */
+export function jmesStringProblem(value) {
+    if (!AMBIGUOUS_BACKSLASH.test(value))
+        return undefined;
+    return `${JSON.stringify(value)} has a backslash at its end or before another \`\\\` or a \`'\`. JMESPath engines `
+        + `disagree on how to read that: the specification reads \`\\\\\` as one backslash, while the reference `
+        + `jmespath.js/py lexers keep two. Which one Integration Service runs is unconfirmed, so the subscription could `
+        + `silently never match. Remove that backslash, or narrow on a substring without it (\`contains\`). A backslash `
+        + `before any other character (\`C:\\tmp\`, \`Finance\\Q3\`) reads the same everywhere and is fine.`;
+}
 /** The JMESPath literal for one filter value, per the designer's `_formatLiteral`. */
 function jmesLiteral(value) {
-    return typeof value === 'string' ? `'${value}'` : `\`${JSON.stringify(value)}\``;
+    return typeof value === 'string' ? jmesString(value) : `\`${JSON.stringify(value)}\``;
 }
 /**
  * The JMESPath condition for one filter — the grammar the designer emits,
@@ -112,7 +167,7 @@ export function eventFilterJmes(read) {
     if (op.kind === 'function')
         return `${op.jmes}(${read.field},${jmesLiteral(read.value)})`;
     if (isIsoDateString(read.value))
-        return `to_number(${read.field})${op.jmes}to_number('${read.value}')`;
+        return `to_number(${read.field})${op.jmes}to_number(${jmesString(read.value)})`;
     return `${read.field}${op.jmes}${jmesLiteral(read.value)}`;
 }
 /** The designer's tree leaf for one filter — `uiId` is the caller's (it is what keeps a rebuild byte-identical). */
@@ -128,7 +183,8 @@ export function eventFilterTreeLeaf(read) {
  * Returns `undefined` for an operator this SDK does not author (`In`, `IsEmpty`, …).
  */
 export function eventFilterFromTreeLeaf(leaf) {
-    const key = DESIGNER_TO_KEY[String(leaf?.operator ?? '')];
+    const op = String(leaf?.operator ?? '');
+    const key = ownEntry(DESIGNER_TO_KEY, op);
     if (!key || typeof leaf?.id !== 'string')
         return undefined;
     const raw = leaf.value?.value;

package/dist/core/expr.d.ts

@@ -196,7 +196,7 @@ export type ErrorEnvelopeField = 'code' | 'message' | 'detail' | 'category' | 's
  *
  * So the author writes one shape, `.error.<field>`, and `serialize` rewrites it
  * to `.output.<field>` for the one family that publishes it there
- * (`errorEnvelopeVar` in `serialize.ts`). Do not hand-write either prefix: which
+ * (`ERROR_ENVELOPE_VAR` in `serialize.ts`). Do not hand-write either prefix: which
  * one is right is not a property of the expression, it is a property of the node
  * the step happens to be, and only the builder knows that.
  *

package/dist/core/expr.js

@@ -209,7 +209,7 @@ export function ran(step) {
  *
  * So the author writes one shape, `.error.<field>`, and `serialize` rewrites it
  * to `.output.<field>` for the one family that publishes it there
- * (`errorEnvelopeVar` in `serialize.ts`). Do not hand-write either prefix: which
+ * (`ERROR_ENVELOPE_VAR` in `serialize.ts`). Do not hand-write either prefix: which
  * one is right is not a property of the expression, it is a property of the node
  * the step happens to be, and only the builder knows that.
  *
@@ -258,7 +258,7 @@ export function ran(step) {
  */
 export function err(step, field) {
     // ONE shape for every family. `serialize` rewrites the prefix for the families
-    // that publish the envelope elsewhere — see `errorEnvelopeVar`.
+    // that publish the envelope elsewhere — see `ERROR_ENVELOPE_VAR`.
     return new Expr(`$vars.${step}.error${field ? '.' + field : ''}`);
 }
 /**
@@ -414,7 +414,7 @@ function segmentEscapes(raw, cooked) {
         let value;
         if (next === '\n' || next === '\u2028' || next === '\u2029')
             value = ''; // line continuation
-        else if (next in SINGLE_ESCAPES)
+        else if (Object.hasOwn(SINGLE_ESCAPES, next))
             value = SINGLE_ESCAPES[next];
         else if (next === '0' && !/[0-9]/.test(raw[i + 2] ?? ''))
             value = '\0';

package/dist/core/json-file.d.ts

@@ -1 +1,3 @@
 export declare function writeJsonFile(path: string, value: unknown): void;
+/** `JSON.parse(JSON.stringify(value))`: a deep copy of a JSON value that drops `undefined` and functions, the semantics every copy relied on. */
+export declare function jsonClone<T>(value: T): T;

package/dist/core/json-file.js

@@ -10,3 +10,7 @@ import { writeFileSync } from 'node:fs';
 export function writeJsonFile(path, value) {
     writeFileSync(path, JSON.stringify(value, null, 2) + '\n');
 }
+/** `JSON.parse(JSON.stringify(value))`: a deep copy of a JSON value that drops `undefined` and functions, the semantics every copy relied on. */
+export function jsonClone(value) {
+    return JSON.parse(JSON.stringify(value));
+}

package/dist/core/library.js

@@ -14,6 +14,7 @@ import { editDistance } from './edit-distance.js';
 import { loadListEnvelopes, lookupListEnvelope } from './list-envelope.js';
 import { lookupSpecOf } from './lookups.js';
 import { loadByoaLedger, loadInvariantCollections, loadLookupResolutions } from './lookup-store.js';
+import { ownEntry } from './own-entry.js';
 /**
  * The refusal {@link Library.resolve} throws, with a `code` for each reason.
  *
@@ -1265,7 +1266,7 @@ function readFields(v1def, entry) {
     const out = (v1def?.inputDefinition?.fields ?? []).map((f) => ({ ...f, location: 'body' }));
     for (const p of params) {
         const name = typeof p?.name === 'string' ? p.name : undefined;
-        const location = PARAM_LOCATIONS[p?.type];
+        const location = typeof p?.type === 'string' ? ownEntry(PARAM_LOCATIONS, p.type) : undefined;
         if (!name || !location)
             continue;
         const field = {

package/dist/core/node-envelope.d.ts

@@ -24,6 +24,7 @@
  * so a missing field is an SDK emit bug caught before a file is written — on
  * every path, `compile --no-check` and direct `serialize()` included.
  */
+export declare const isRecord: (v: unknown) => v is Record<string, unknown>;
 /** Every way `node` breaks the envelope, as `<field>: <problem>` strings. Empty when it conforms. */
 export declare function nodeEnvelopeProblems(node: unknown): string[];
 /**

package/dist/core/node-envelope.js

@@ -25,7 +25,7 @@
  * every path, `compile --no-check` and direct `serialize()` included.
  */
 const TYPE_VERSION_RE = /^\d+\.\d+(\.\d+)?$/;
-const isRecord = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
+export const isRecord = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
 const isNonEmptyString = (v) => typeof v === 'string' && v.length > 0;
 /** Every way `node` breaks the envelope, as `<field>: <problem>` strings. Empty when it conforms. */
 export function nodeEnvelopeProblems(node) {

package/dist/core/own-entry.d.ts

@@ -0,0 +1,9 @@
+/**
+ * A lookup table's OWN entry for `key`, or `undefined` — never an Object.prototype
+ * member. `TABLE[key]` on a plain object answers `toString`, `constructor` and
+ * `__proto__` with inherited functions, and `key in TABLE` says they are present;
+ * an untrusted key (a node type from a file, a field type from a registry) then
+ * reads a function where the caller expects data. FB012 refuses the unguarded
+ * forms; this is the guarded read every table shares. FB005 holds the name here.
+ */
+export declare function ownEntry<V>(table: Readonly<Record<string, V>>, key: string): V | undefined;

package/dist/core/own-entry.js

@@ -0,0 +1,11 @@
+/**
+ * A lookup table's OWN entry for `key`, or `undefined` — never an Object.prototype
+ * member. `TABLE[key]` on a plain object answers `toString`, `constructor` and
+ * `__proto__` with inherited functions, and `key in TABLE` says they are present;
+ * an untrusted key (a node type from a file, a field type from a registry) then
+ * reads a function where the caller expects data. FB012 refuses the unguarded
+ * forms; this is the guarded read every table shares. FB005 holds the name here.
+ */
+export function ownEntry(table, key) {
+    return Object.hasOwn(table, key) ? table[key] : undefined;
+}

package/dist/core/ts-literal.d.ts

@@ -0,0 +1,22 @@
+/**
+ * A value as an inert TypeScript literal in decompiled source.
+ *
+ * `JSON.stringify` escapes quotes, backslashes and control characters, so an
+ * untrusted `.flow`/`.bpmn`/caseplan value — a label, an expression, a URL — can
+ * never break out of the literal and become code in a file `compile` later
+ * executes. U+2028/U+2029 are escaped too: legal in JSON, illegal in pre-ES2019
+ * string literals. The three decompilers each carried a `str()`/`literal()` copy
+ * and two had drifted (only some escaped U+2028 in `literal`; one coerced null to
+ * `''`). FB005 holds `str`/`literal` to this file, and FB011 holds a decompiler's
+ * quoted call argument to these functions. `tsNumber` is the unquoted sibling for
+ * numbers: an untrusted `count` spliced with `String()` became code.
+ *
+ * A missing value is refused, as the decompilers' old `str()` did; the one place
+ * that writes the expression `undefined` (Flow's `emitVal`) says so itself.
+ */
+/** A TS expression for `value`: its JSON with U+2028/U+2029 escaped. Throws for `undefined`, and for a value JSON cannot carry (a function or symbol). */
+export declare function tsLiteral(value: unknown): string;
+/** `value` as a TS string literal, null and undefined as `""` (the BPMN decompiler's text fields). */
+export declare function tsText(value: unknown): string;
+/** `value` as a TS number literal: `Number(value)`, refused unless finite — a caseplan or `.flow` number is untrusted text until checked. */
+export declare function tsNumber(value: unknown): string;

package/dist/core/ts-literal.js

@@ -0,0 +1,37 @@
+/**
+ * A value as an inert TypeScript literal in decompiled source.
+ *
+ * `JSON.stringify` escapes quotes, backslashes and control characters, so an
+ * untrusted `.flow`/`.bpmn`/caseplan value — a label, an expression, a URL — can
+ * never break out of the literal and become code in a file `compile` later
+ * executes. U+2028/U+2029 are escaped too: legal in JSON, illegal in pre-ES2019
+ * string literals. The three decompilers each carried a `str()`/`literal()` copy
+ * and two had drifted (only some escaped U+2028 in `literal`; one coerced null to
+ * `''`). FB005 holds `str`/`literal` to this file, and FB011 holds a decompiler's
+ * quoted call argument to these functions. `tsNumber` is the unquoted sibling for
+ * numbers: an untrusted `count` spliced with `String()` became code.
+ *
+ * A missing value is refused, as the decompilers' old `str()` did; the one place
+ * that writes the expression `undefined` (Flow's `emitVal`) says so itself.
+ */
+const LINE_SEPARATORS = /[\u2028\u2029]/g;
+/** A TS expression for `value`: its JSON with U+2028/U+2029 escaped. Throws for `undefined`, and for a value JSON cannot carry (a function or symbol). */
+export function tsLiteral(value) {
+    if (value === undefined)
+        throw new Error('cannot write undefined as a TypeScript literal.');
+    const json = JSON.stringify(value);
+    if (json === undefined)
+        throw new Error(`cannot write a ${typeof value} as a TypeScript literal.`);
+    return json.replace(LINE_SEPARATORS, (c) => `\\u${c.charCodeAt(0).toString(16)}`);
+}
+/** `value` as a TS string literal, null and undefined as `""` (the BPMN decompiler's text fields). */
+export function tsText(value) {
+    return tsLiteral(String(value ?? ''));
+}
+/** `value` as a TS number literal: `Number(value)`, refused unless finite — a caseplan or `.flow` number is untrusted text until checked. */
+export function tsNumber(value) {
+    const n = Number(value);
+    if (!Number.isFinite(n))
+        throw new Error(`decompile: expected a number, got ${JSON.stringify(value)}.`);
+    return String(n);
+}

package/dist/core/typed-raw-node.js

@@ -3,6 +3,7 @@
  * the SDK has a typed factory for, and the Data Fabric input keys it may carry.
  * Not re-exported from the package entry point.
  */
+import { ownEntry } from './own-entry.js';
 /**
  * Every node type the SDK authors as a STEP through a typed factory, with the
  * factory to use. `raw-node-typed-family.test.ts` pins the key set to the
@@ -135,7 +136,7 @@ const DATAFABRIC_HINT = ' The factory writes the query and write keys: `filters`
 export function typedFamilyRawNodeWarning(nodeType) {
     if (typeof nodeType !== 'string')
         return undefined;
-    const entry = TYPED_FACTORIES[nodeType];
+    const entry = ownEntry(TYPED_FACTORIES, nodeType);
     if (entry === undefined)
         return undefined;
     const hint = nodeType.startsWith('core.datafabric.') ? DATAFABRIC_HINT : '';
@@ -182,9 +183,9 @@ export function dataFabricUnknownInputs(nodeType, version, inputs) {
     }
     if (unknown.length === 0)
         return undefined;
-    const bundled = TYPED_FACTORIES[nodeType]?.bundled.includes(version) ?? false;
+    const bundled = ownEntry(TYPED_FACTORIES, nodeType)?.bundled.includes(version) ?? false;
     const named = unknown.map((k) => `\`${k}\``).join(', ');
-    const factory = TYPED_FACTORIES[nodeType]?.factory;
+    const factory = ownEntry(TYPED_FACTORIES, nodeType)?.factory;
     const base = `${nodeType}@${version} carries ${named}, which the platform never reads: Data Fabric `
         + `nodes read only \`inputs.entityConfig\`, with the keys ${[...DATAFABRIC_ENTITY_CONFIG_KEYS].join(', ')} `
         + `(flow-workbench entity-vdo.ts \`EntityConfig\` and the entity panels). \`validate\` cannot see `