@uipath/maestro-builder-sdk 6.40.1 → 6.41.0

package/dist/check.js

@@ -11,13 +11,13 @@ import { planContributionBindings } from './core/contribution-bindings.js';
 import { definitionHasErrorPort, errorPortRefusal } from './core/error-port.js';
 import { actionVersion, bundledActionNodeType, bundledContainerDefinition, bundledDefinition, perCallDefinition, resolveContributionDefinition } from './serialize.js';
 import { FORM_FIELD_TYPES, formFieldOptionsProblem, formFieldOptionsWhy, formFieldSettingProblems, formFieldTypeHint, formFieldTypeWhy, validFormFieldTypesText, } from './core/form-field-type.js';
-import { AGENTIC_PROCESS_FORMS } from './core/agentic-process-forms.js';
 import { checkEventResolution, checkEventSubscription, eventParamsFor, } from './core/event-checks.js';
 import { checkCookedEscapes } from './flow-expr-check.js';
 import { FLOW_EXPR_DIALECT, checkBindingLabels, checkBindingPresence, checkConnectorContract as coreCheckConnectorContract, checkConnectorLookups as coreCheckConnectorLookups, checkConnectorSchema as coreCheckConnectorSchema, collectConnectionUses, connectionConnectorConflicts, } from './core/connector-checks.js';
 import { prepareCommand } from './core/cli-spelling.js';
 import { commentText } from './core/comment-text.js';
 import { nearestName } from './core/edit-distance.js';
+import { renamedFieldMessage } from './core/process-resource.js';
 import { hitlDerivesOutcomeHandles, hitlExitModel, hitlRoutesPerOutcome, outcomeIdOf } from './core/hitl-routing.js';
 import { hasExits } from './core/step-ports.js';
 import { stopsAtEnd } from './flow-step-tree.js';
@@ -514,24 +514,16 @@ function checkFlow(built, ancestors, opts = {}, ledger = newResourceIdLedger())
                         });
                     }
                 }
-                if (s.spec.kind === 'rpaWorkflow')
-                    checkRpaWorkflow(s.name, s.spec.inputs, diags);
-                if (s.spec.kind === 'apiWorkflow') {
-                    checkApiWorkflow(s.name, s.spec.inputs, diags);
-                }
-                if (s.spec.kind === 'publishedFunction') {
-                    checkPublishedFunction(s.name, s.spec.inputs, diags);
-                }
                 if (s.spec.kind === 'createOutgoingCall' || s.spec.kind === 'endCall' || s.spec.kind === 'voiceAgent') {
                     checkVoice(s.name, s.spec.kind, s.spec.inputs, diags);
                 }
                 if (s.spec.kind === 'conversationalAgent') {
                     checkConversationalAgent(s.name, s.spec.inputs, diags);
                 }
-                if (s.spec.kind === 'agenticProcess') {
-                    checkAgenticProcess(s.name, s.spec.inputs, diags);
+                // The process family checks the step itself; the flow-level fire-and-forget
+                // read rule below needs to know which steps dispatch without waiting.
+                if (s.spec.kind === 'agenticProcess')
                     agenticProcesses.set(s.name, s.spec.inputs);
-                }
                 if (s.spec.kind === 'agent') {
                     checkAgent(s.name, s.spec.inputs, diags);
                 }
@@ -2106,161 +2098,6 @@ function codeOnly(src) {
     return out.join('');
 }
 const GUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-/**
- * The four published-resource factories once each named the release key
- * differently — `rpaWorkflow({process})`, `apiWorkflow({workflow})`,
- * `agenticProcess({process})`, `agent({agent})` — for one identical thing: the
- * GUID in a process's `Key` field. They are all `key` now.
- *
- * Flows authored against the old names would otherwise fail as "has no `key`",
- * which points at the wrong problem. When the retired field is the one carrying a
- * value, say so and name the replacement.
- */
-function renamedFieldMessage(label, step, oldField) {
-    return (`${label} step "${step}" uses \`${oldField}\`, which was renamed to \`key\`. All four ` +
-        `published-resource factories now take \`key\` — the GUID in the process's \`Key\` field ` +
-        `(\`uip or processes list\`) — so they read the same way. Rename \`${oldField}:\` to \`key:\`.`);
-}
-/**
- * Check an `rpaWorkflow(...)` call.
- *
- * WHAT THESE RULES CAN AND CANNOT SEE. Everything about a deployed process that
- * matters — which arguments it takes, what it returns, whether it exists —
- * lives on the tenant. So these rules cover exactly the mistakes that are
- * decidable from the call itself, and the doc says plainly that the rest shows
- * up as a faulted job on a live run. What is decidable:
- *
- *  - a missing/blank `key`, `name` or `folderPath`. Any of the three missing
- *    is fatal in a way no later rung reports usefully: without `key` the node
- *    has no type suffix, and without the other two nothing can resolve the node's
- *    `resourceBindings.name` — which reads as an engine error rather than an
- *    authoring one.
- *  - a `key` that is not a GUID. The commonest form of this is passing the
- *    process's NAME where its release key belongs, which produces a node type
- *    the platform cannot resolve to anything.
- *  - a `name` that looks like a path (contains "/"). The two are swappable, and
- *    the resulting `resourceKey` is wrong in a way that only surfaces as a 400
- *    from Orchestrator ("Folder does not exist"). That is v1's own 2026-06-26
- *    failure mode on this task. A single-segment `folderPath` is NOT decidable:
- *    root folders and personal workspaces are one segment, so it is not flagged.
- */
-function checkRpaWorkflow(step, inputs, diags) {
-    const at = (code, message, suggestion) => {
-        diags.push({ level: 'error', code, message, step, ...(suggestion ? { suggestion } : {}) });
-    };
-    const blank = (v) => v === undefined || v === null || (typeof v === 'string' && v.trim() === '');
-    if (blank(inputs?.key) && !blank(inputs?.process)) {
-        at('RPA_NO_KEY', renamedFieldMessage('RPA', step, 'process'), `key: ${JSON.stringify(inputs.process)}`);
-    }
-    else if (blank(inputs?.key)) {
-        at('RPA_NO_KEY', `RPA step "${step}" has no \`key\`. That is the published process's release key (a GUID), and `
-            + `it becomes part of the node's type — without it there is no process to start. Find it with `
-            + `\`uip or processes list --all-folders --process-type Process\` (the row's \`Key\`).`, `key: '486edc26-0658-4ac1-92c9-1ef953927151'`);
-    }
-    else if (!GUID_RE.test(String(inputs.key).trim())) {
-        at('RPA_KEY_NOT_KEY', `RPA step "${step}"'s \`key\` is ${JSON.stringify(inputs.key)}, which is not a release key. `
-            + `\`key\` is the GUID the tenant gives the published process (it becomes the node type's suffix); `
-            + `the process's NAME goes in \`name\` and its folder in \`folderPath\`.`, `key: '<guid>', name: ${JSON.stringify(inputs.key)}`);
-    }
-    if (blank(inputs?.name)) {
-        at('RPA_NO_NAME', `RPA step "${step}" has no \`name\`. The runtime starts the job by name + folder, not by the key in `
-            + `the node type, so without it the process cannot be resolved and the run fails before dispatch.`, `name: 'RPA Workflow'`);
-    }
-    const inSolution = inputs?.location === 'in-solution';
-    if (!inSolution && blank(inputs?.folderPath)) {
-        at('RPA_NO_FOLDER', `RPA step "${step}" has no \`folderPath\`. The runtime starts the job by name + folder, so the `
-            + `Orchestrator folder holding the process is required.`, `folderPath: 'Shared/uipath-maestro-flow/ProjectEuler RPA'`);
-    }
-    if (inSolution && blank(inputs?.projectId)) {
-        at('RPA_LOCAL_NO_PROJECT_ID', `In-solution RPA step "${step}" has no \`projectId\`. Read \`resource.projectKey\` from `
-            + `\`resources/solution_folder/process/process/<project>.json\`.`, `projectId: '<resource.projectKey>'`);
-    }
-    else if (inSolution && !GUID_RE.test(String(inputs.projectId).trim())) {
-        at('RPA_LOCAL_PROJECT_ID_NOT_GUID', `In-solution RPA step "${step}" has projectId ${JSON.stringify(inputs.projectId)}, which is not `
-            + `the sibling project's GUID. Read \`resource.projectKey\` from the generated resource file.`, `projectId: '<resource.projectKey>'`);
-    }
-    if (inSolution && !blank(inputs?.folderPath)) {
-        at('RPA_LOCAL_HAS_FOLDER', `In-solution RPA step "${step}" also sets \`folderPath\` ${JSON.stringify(inputs.folderPath)}. An `
-            + `in-solution sibling has no folder until the solution is deployed — the platform's own manifest `
-            + `writes \`""\` — so the value would be dropped. Remove it, or drop \`location: 'in-solution'\` to `
-            + `call the published copy.`);
-    }
-    // The two are swappable by shape, and swapping them is invisible until
-    // Orchestrator answers "Folder does not exist or the user does not have access".
-    const name = typeof inputs?.name === 'string' ? inputs.name.trim() : '';
-    if (name.includes('/')) {
-        at('RPA_NAME_IS_PATH', `RPA step "${step}"'s \`name\` is ${JSON.stringify(inputs.name)}, which is a folder path. \`name\` is `
-            + `the process's own name in Orchestrator; the path it lives in goes in \`folderPath\`. Together they `
-            + `form the resourceKey "<folderPath>.<name>", so swapping them points the job at nothing.`);
-    }
-}
-/**
- * Check an `apiWorkflow(...)` call.
- *
- * Same three-identifier shape as `rpaWorkflow`, so the same three mistakes are
- * decidable from the call itself (a blank field, a `key` that is not a key, and
- * the swappable `name`/`folderPath` pair). Two things differ, and both come from
- * the corpus rather than from the surface:
- *
- *  - the node type's GUID is the workflow's PROCESS key — the `Key` field of
- *    `uip or processes list`, whose `ProcessKey` for an API workflow reads
- *    `<name>.api.<name>` — so the command to name in the diagnostic is that one;
- *  - `returns` matters MORE here than for rpa, because this task's whole answer is
- *    a field of the job's output. A read with no `returns` has no schema to check (and
- *    a read of an undeclared field is `undefined` everywhere), so both are said at
- *    rung 1 instead — see `checkApiWorkflowRead`.
- *
- * What no rule here can see stays what it is: whether the workflow exists, whether
- * it takes these argument names, whether it returns these fields. Only the tenant
- * knows, and a wrong one is a faulted job on a live run — which is what the `job`
- * rung is for.
- */
-function checkApiWorkflow(step, inputs, diags) {
-    const at = (code, message, suggestion) => {
-        diags.push({ level: 'error', code, message, step, ...(suggestion ? { suggestion } : {}) });
-    };
-    const blank = (v) => v === undefined || v === null || (typeof v === 'string' && v.trim() === '');
-    if (blank(inputs?.key) && !blank(inputs?.workflow)) {
-        at('APIWF_NO_KEY', renamedFieldMessage('API workflow', step, 'workflow'), `key: ${JSON.stringify(inputs.workflow)}`);
-    }
-    else if (blank(inputs?.key)) {
-        at('APIWF_NO_KEY', `API workflow step "${step}" has no \`key\`. That is the published workflow's key (a GUID), and `
-            + `it becomes part of the node's type — without it there is no workflow to invoke. Find it with `
-            + `\`uip or processes list --all-folders\` (an API workflow's ProcessKey reads "<name>.api.<name>").`, `key: 'ce857908-ee1d-4392-b552-38bcea0be29c'`);
-    }
-    else if (!GUID_RE.test(String(inputs.key).trim())) {
-        at('APIWF_KEY_NOT_KEY', `API workflow step "${step}"'s \`key\` is ${JSON.stringify(inputs.key)}, which is not a key. `
-            + `\`key\` is the GUID the tenant gives the published workflow (it becomes the node type's suffix); `
-            + `the workflow's NAME goes in \`name\` and its folder in \`folderPath\`.`, `key: '<guid>', name: ${JSON.stringify(inputs.key)}`);
-    }
-    if (blank(inputs?.name)) {
-        at('APIWF_NO_NAME', `API workflow step "${step}" has no \`name\`. The runtime starts the job by name + folder, not by the `
-            + `key in the node type, so without it the workflow cannot be resolved and the run fails before dispatch.`, `name: 'NameToAgeFixed'`);
-    }
-    if (blank(inputs?.folderPath)) {
-        at('APIWF_NO_FOLDER', `API workflow step "${step}" has no \`folderPath\`. The runtime starts the job by name + folder, so the `
-            + `Orchestrator folder holding the workflow is required.`, `folderPath: 'Shared'`);
-    }
-    const name = typeof inputs?.name === 'string' ? inputs.name.trim() : '';
-    if (name.includes('/')) {
-        at('APIWF_NAME_IS_PATH', `API workflow step "${step}"'s \`name\` is ${JSON.stringify(inputs.name)}, which is a folder path. `
-            + `\`name\` is the workflow's own name in Orchestrator; the path it lives in goes in \`folderPath\`. `
-            + `Together they form the resourceKey "<folderPath>.<name>", so swapping them points the job at nothing.`);
-    }
-    // An empty `returns: {}` is a statement that the workflow returns nothing, which
-    // is legal — but it is almost always a half-finished edit, and the difference
-    // between it and a missing `returns` is invisible in the emitted file.
-    if (inputs?.returns && Object.keys(inputs.returns).length === 0) {
-        diags.push({
-            level: 'warning',
-            code: 'APIWF_EMPTY_RETURNS',
-            message: `API workflow step "${step}" declares \`returns: {}\` — an empty contract, which emits no output `
-                + `schema at all and so reads exactly like omitting it. If the workflow returns nothing, drop the `
-                + `key; if it returns something, name the fields.`,
-            step,
-        });
-    }
-}
 /**
  * A read of an API workflow's output: `out('<step>', '<field>')`.
  *
@@ -2401,88 +2238,6 @@ function checkVoice(step, kind, inputs, diags) {
         }
     }
 }
-/**
- * A published FUNCTION step (Phase 5B).
- *
- * The same four identity mistakes as its published siblings, in this family's
- * own vocabulary — and one of its own: a function is usually deployed into a
- * folder of its own name, so `folderPath: 'Shared'` when the tenant says
- * `Shared/<name>` points the binding's resourceKey at nothing.
- */
-function checkPublishedFunction(step, inputs, diags) {
-    const at = (code, message, suggestion) => {
-        diags.push({ level: 'error', code, message, step, ...(suggestion ? { suggestion } : {}) });
-    };
-    const blank = (v) => v === undefined || v === null || (typeof v === 'string' && v.trim() === '');
-    if (blank(inputs?.key)) {
-        at('FUNCTION_NO_KEY', `Function step "${step}" has no \`key\`. That is the published function's key (a GUID), and it becomes `
-            + `part of the node's type — without it there is no function to invoke. Find it with `
-            + `\`uip maestro flow registry search "uipath.core.function"\`.`, `key: '7059bdb5-fdd7-4e13-9d7b-1748aaeb129d'`);
-    }
-    else if (!GUID_RE.test(String(inputs.key).trim())) {
-        at('FUNCTION_KEY_NOT_KEY', `Function step "${step}"'s \`key\` is ${JSON.stringify(inputs.key)}, which is not a key. \`key\` is the `
-            + `GUID the tenant gives the published function (it becomes the node type's suffix); the function's NAME `
-            + `goes in \`name\` and its folder in \`folderPath\`.`, `key: '<guid>', name: ${JSON.stringify(inputs.key)}`);
-    }
-    if (blank(inputs?.name)) {
-        at('FUNCTION_NO_NAME', `Function step "${step}" has no \`name\`. The runtime resolves the function by name + folder, not by the `
-            + `key in the node type, so without it the dispatch fails before it starts.`, `name: 'acme-echo'`);
-    }
-    if (blank(inputs?.folderPath)) {
-        at('FUNCTION_NO_FOLDER', `Function step "${step}" has no \`folderPath\`. The runtime resolves the function by name + folder — and a `
-            + `function is often deployed into a folder of its OWN name, so read the folder from the tenant rather `
-            + `than assuming 'Shared'.`, `folderPath: 'Shared/acme-echo'`);
-    }
-    const name = typeof inputs?.name === 'string' ? inputs.name.trim() : '';
-    if (name.includes('/')) {
-        at('FUNCTION_NAME_IS_PATH', `Function step "${step}"'s \`name\` is ${JSON.stringify(inputs.name)}, which is a folder path. \`name\` is `
-            + `the function's own name; the path it lives in goes in \`folderPath\`. Together they form the `
-            + `resourceKey "<folderPath>.<name>", so swapping them points the dispatch at nothing.`);
-    }
-    if (inputs?.returns && Object.keys(inputs.returns).length === 0) {
-        diags.push({
-            level: 'warning', code: 'FUNCTION_EMPTY_RETURNS', step,
-            message: `Function step "${step}" declares \`returns: {}\` — an empty contract, which emits no output `
-                + `schema and so reads exactly like omitting it. If the function returns nothing, drop the key.`,
-        });
-    }
-}
-/** A read of a published function's result — the api-workflow rules, this family's codes. */
-function checkPublishedFunctionRead(name, field, rest, spec, step, diags) {
-    if (field !== undefined && field !== 'output') {
-        diags.push({
-            level: 'error', code: 'FUNCTION_READ_NOT_OUTPUT', step,
-            message: `Function "${name}" publishes its result under "output", but "$vars.${name}.${field}" `
-                + `(read in "${step}") asks for "${field}", which is undefined at run time.`,
-            suggestion: `out('${name}', '<field>')`,
-        });
-        return;
-    }
-    const declared = Object.keys(spec.returns ?? {});
-    const wanted = (rest ?? '').replace(/^\./, '').split('.')[0];
-    if (!wanted)
-        return; // `$vars.<name>.output` — the whole object.
-    if (declared.length === 0) {
-        diags.push({
-            level: 'error', code: 'FUNCTION_READ_WITHOUT_RETURNS', step,
-            message: `"$vars.${name}.output.${wanted}" (read in "${step}") reads a field of function "${name}"'s `
-                + `result, but the step declares no \`returns\` — so the node carries no output schema and nothing can `
-                + `tell a real field from a typo. The function's output arguments live on the tenant; declare the ones `
-                + `you read. \`uip maestro flow registry get uipath.core.function.${spec.key}\` shows what the platform `
-                + `synthesizes for it.`,
-            suggestion: `returns: { ${wanted}: 'string' }`,
-        });
-        return;
-    }
-    if (declared.includes(wanted))
-        return;
-    diags.push({
-        level: 'error', code: 'FUNCTION_READ_UNKNOWN_FIELD', step,
-        message: `"$vars.${name}.output.${wanted}" (read in "${step}") is not one of function "${name}"'s declared `
-            + `returns (${declared.map((d) => `"${d}"`).join(', ')}), so it resolves to undefined.`,
-        suggestion: `returns: { ${wanted}: 'string' }`,
-    });
-}
 /**
  * The read rule the process-shaped families share: the result is published
  * under `output`, keyed by a known field list — the author's `returns`, or a
@@ -2525,16 +2280,6 @@ function checkDeclaredOutputRead(o) {
         ...(nearest !== undefined ? { suggestion: `out('${name}', '${nearest}')` } : {}),
     });
 }
-function checkRpaWorkflowRead(name, field, rest, spec, step, diags) {
-    const declared = Object.keys(spec?.returns ?? {});
-    checkDeclaredOutputRead({
-        prefix: 'RPA', what: 'RPA process', name, field, rest, step, diags,
-        declared: declared.length ? declared : undefined,
-        withoutReturns: `The process's output arguments live on the tenant; declare the ones you read. `
-            + `\`uip maestro flow registry get uipath.core.rpa-workflow.${spec?.key}\` shows what the platform `
-            + `synthesizes for it.`,
-    });
-}
 /**
  * THE GATE (flow-builder-sdk#850). Each `returns`-bearing kind maps to the rule
  * that checks a read of its output, or to a stated reason it has none.
@@ -2549,10 +2294,10 @@ function checkRpaWorkflowRead(name, field, rest, spec, step, diags) {
  */
 const OUTPUT_READ_RULES = {
     http: { exempt: 'Registered: the http node types read their own output (nodes/http/flow, a `reader` contract).' },
-    rpaWorkflow: checkRpaWorkflowRead,
-    apiWorkflow: checkApiWorkflowRead,
-    publishedFunction: checkPublishedFunctionRead,
-    agenticProcess: checkAgenticProcessRead,
+    rpaWorkflow: { exempt: 'Registered: its node type states the fields a read may name (nodes/process/flow/, a `fields` output contract).' },
+    apiWorkflow: { exempt: 'Registered: its node type reads its own output (nodes/process/flow/, a `reader` contract).' },
+    publishedFunction: { exempt: 'Registered: its node type reads its own output (nodes/process/flow/, a `reader` contract).' },
+    agenticProcess: { exempt: 'Registered: its node type reads its own output (nodes/process/flow/, a `reader` contract).' },
     agent: checkAgentRead,
     inlineAgent: checkInlineAgentRead,
     queueItem: { exempt: 'Registered: its node type states the fields a read may name (nodes/queue/flow/, a `fields` output contract).' },
@@ -2562,230 +2307,6 @@ const OUTPUT_READ_RULES = {
             + 'its own false-positive sweep — flow-builder-sdk#855.',
     },
 };
-function checkApiWorkflowRead(name, field, rest, spec, step, diags) {
-    if (field === undefined)
-        return; // `out('call')` — the whole output object.
-    if (field === 'error')
-        return; // the error envelope every process node declares.
-    if (field !== 'output') {
-        diags.push({
-            level: 'error',
-            code: 'APIWF_READ_NOT_OUTPUT',
-            message: `API workflow "${name}" publishes the job's output arguments under "output", but `
-                + `"$vars.${name}.${field}" (read in "${step}") asks for "${field}", which is undefined at run time.`,
-            step,
-            suggestion: `out('${name}', '<field>')`,
-        });
-        return;
-    }
-    const declared = Object.keys(spec.returns ?? {});
-    const wanted = (rest ?? '').replace(/^\./, '').split('.')[0];
-    if (!wanted)
-        return; // `$vars.<name>.output` — the whole object.
-    if (declared.length === 0) {
-        diags.push({
-            level: 'error',
-            code: 'APIWF_READ_WITHOUT_RETURNS',
-            message: `"$vars.${name}.output.${wanted}" (read in "${step}") reads a field of API workflow "${name}"'s `
-                + `result, but the step declares no \`returns\` — so the node carries no output schema and nothing `
-                + `can tell a real field from a typo. The workflow's output arguments live on the tenant; declare `
-                + `the ones you read. \`uip maestro flow registry get uipath.core.api-workflow.${spec.key}\` `
-                + `shows what the platform synthesizes for it.`,
-            step,
-            suggestion: `returns: { ${wanted}: 'string' }`,
-        });
-        return;
-    }
-    if (declared.includes(wanted))
-        return;
-    const nearest = nearestName(wanted, declared);
-    diags.push({
-        level: 'error',
-        code: 'APIWF_READ_UNKNOWN_FIELD',
-        message: `API workflow "${name}" declares no output "${wanted}" (read as "$vars.${name}.output.${wanted}" in `
-            + `"${step}"). Its \`returns\` names: ${declared.join(', ')}. A read outside that set is undefined `
-            + `on every rung and on the platform.`,
-        step,
-        ...(nearest !== undefined ? { suggestion: `out('${name}', '${nearest}')` } : {}),
-    });
-}
-/**
- * Check an `agenticProcess(...)` call.
- *
- * The same three-identifier shape as `rpaWorkflow`/`apiWorkflow`, so the same
- * mistakes are decidable from the call itself. Two things are this family's own:
- *
- *  - the node type's GUID is the process's own key — the `Key` field of
- *    `uip or processes list`, whose `ProcessKey` for an agentic process reads
- *    `<name>.agentic.<name>` — so that is the command the diagnostic names. And it
- *    names the pagination, because `--all-folders` returns 50 rows with
- *    `Pagination.HasMore: true` and no warning: the tenant this was written against
- *    has 98 processes, and the agentic ones are not all in the first page.
- *  - `fireAndForget` is a RESERVED input. It is the platform's design-time switch
- *    (flow-v1's `FIRE_AND_FORGET_INPUT`), and its serializer destructures it OUT of
- *    the node's inputs before emitting, so a process argument that happens to be
- *    called `fireAndForget` never reaches the process — silently, with a green run
- *    locally, because a runner that passes the whole envelope through sees nothing
- *    wrong.
- *
- * What no rule here can see stays what it is: whether the process exists, whether
- * it takes these argument names, whether it returns these fields. Only the tenant
- * knows, and a wrong one is a faulted job on a live run — which is what the `job`
- * rung is for.
- */
-function checkAgenticProcess(step, inputs, diags) {
-    const at = (code, message, suggestion) => {
-        diags.push({ level: 'error', code, message, step, ...(suggestion ? { suggestion } : {}) });
-    };
-    const blank = (v) => v === undefined || v === null || (typeof v === 'string' && v.trim() === '');
-    if (blank(inputs?.key) && !blank(inputs?.process)) {
-        at('AGENTIC_NO_KEY', renamedFieldMessage('Agentic process', step, 'process'), `key: ${JSON.stringify(inputs.process)}`);
-    }
-    else if (blank(inputs?.key)) {
-        at('AGENTIC_NO_KEY', `Agentic process step "${step}" has no \`key\`. That is the published process's key (a GUID), `
-            + `and it becomes part of the node's type — without it there is no process to start. Find it with `
-            + `\`uip or processes list --all-folders --limit 100\` (an agentic process's ProcessKey reads `
-            + `"<name>.agentic.<name>"; the listing paginates at 50, so pass a limit or scope it to a folder).`, `key: '4fc450ab-89be-4462-8fc8-21ac4c1d6fb9'`);
-    }
-    else if (!GUID_RE.test(String(inputs.key).trim())) {
-        at('AGENTIC_KEY_NOT_KEY', `Agentic process step "${step}"'s \`key\` is ${JSON.stringify(inputs.key)}, which is not a key. `
-            + `\`key\` is the GUID the tenant gives the published process (it becomes the node type's suffix); `
-            + `the process's NAME goes in \`name\` and its folder in \`folderPath\`.`, `key: '<guid>', name: ${JSON.stringify(inputs.key)}`);
-    }
-    if (blank(inputs?.name)) {
-        at('AGENTIC_NO_NAME', `Agentic process step "${step}" has no \`name\`. The runtime starts the job by name + folder, not by `
-            + `the key in the node type, so without it the process cannot be resolved and the run fails before `
-            + `dispatch.`, `name: 'ProcurementProcess'`);
-    }
-    const inSolution = inputs?.location === 'in-solution';
-    if (!inSolution && blank(inputs?.folderPath)) {
-        // `registry list --local` shows an in-solution Flow sibling with folderPath: "".
-        // An explicit `form` other than 'flow' keeps the published hint: switching it would change the node type.
-        const meantInSolution = inputs?.form === 'flow'
-            || (typeof inputs?.folderPath === 'string' && inputs?.form === undefined);
-        if (meantInSolution) {
-            const formPart = inputs?.form === 'flow' ? '' : `, form: 'flow'`;
-            at('AGENTIC_NO_FOLDER', `Agentic process step "${step}" has an empty \`folderPath\`. If the process is an unpublished sibling `
-                + `Flow in this solution, call it in-solution: set \`location: 'in-solution'\`${formPart} and \`projectId\` `
-                + `(the sibling's \`resource.projectKey\` in \`resources/solution_folder/process/flow/<project>.json\`), and `
-                + `drop \`folderPath\`. If it is published, set \`folderPath\` to the Orchestrator folder that holds it — `
-                + `the runtime starts the job by name + folder.`, `location: 'in-solution'${formPart}, projectId: '<resource.projectKey>'`);
-        }
-        else {
-            at('AGENTIC_NO_FOLDER', `Agentic process step "${step}" has no \`folderPath\`. The runtime starts the job by name + folder, so `
-                + `the Orchestrator folder holding the process is required.`, `folderPath: 'Shared/uipath-agents/ProcurementProcess'`);
-        }
-    }
-    const form = inputs?.form ?? 'bpmn';
-    if (inSolution && form !== 'flow') {
-        at('AGENTIC_LOCAL_FORM_UNVERIFIED', `In-solution agentic process step "${step}" has \`form: ${JSON.stringify(form)}\`. Only \`form: 'flow'\` `
-            + `has been run against an in-solution sibling; the ${JSON.stringify(form)} shape is unproven. Call the `
-            + `published process instead (drop \`location\` and \`projectId\`, set \`folderPath\`), or use `
-            + `\`form: 'flow'\` if the sibling is a Flow.`, `location: 'published', folderPath: 'Shared/<folder>'`);
-    }
-    if (inSolution && blank(inputs?.projectId)) {
-        const folder = (ownEntry(AGENTIC_PROCESS_FORMS, inputs?.form ?? 'bpmn') ?? AGENTIC_PROCESS_FORMS.bpmn).solutionFolder;
-        at('AGENTIC_LOCAL_NO_PROJECT_ID', `In-solution agentic process step "${step}" has no \`projectId\`. Read \`resource.projectKey\` from `
-            + `\`resources/solution_folder/process/${folder}/<project>.json\`.`, `projectId: '<resource.projectKey>'`);
-    }
-    else if (inSolution && !GUID_RE.test(String(inputs.projectId).trim())) {
-        at('AGENTIC_LOCAL_PROJECT_ID_NOT_GUID', `In-solution agentic process step "${step}" has projectId ${JSON.stringify(inputs.projectId)}, which is not `
-            + `the sibling project's GUID. Read \`resource.projectKey\` from the generated resource file.`, `projectId: '<resource.projectKey>'`);
-    }
-    if (inSolution && !blank(inputs?.folderPath)) {
-        at('AGENTIC_LOCAL_HAS_FOLDER', `In-solution agentic process step "${step}" also sets \`folderPath\` ${JSON.stringify(inputs.folderPath)}. An `
-            + `in-solution sibling has no folder until the solution is deployed — the platform's own manifest `
-            + `writes \`""\` — so the value would be dropped. Remove it, or drop \`location: 'in-solution'\` to `
-            + `call the published copy.`);
-    }
-    const name = typeof inputs?.name === 'string' ? inputs.name.trim() : '';
-    if (name.includes('/')) {
-        at('AGENTIC_NAME_IS_PATH', `Agentic process step "${step}"'s \`name\` is ${JSON.stringify(inputs.name)}, which is a folder path. `
-            + `\`name\` is the process's own name in Orchestrator; the path it lives in goes in \`folderPath\`. `
-            + `Together they form the resourceKey "<folderPath>.<name>", so swapping them points the job at nothing.`);
-    }
-    // The platform's own design-time input, which its serializer strips before the
-    // node is emitted — so a process argument by this name is dropped on the way to
-    // the tenant and nothing local notices.
-    if (inputs?.inputs && Object.prototype.hasOwnProperty.call(inputs.inputs, 'fireAndForget')) {
-        at('AGENTIC_RESERVED_INPUT', `Agentic process step "${step}" passes an input called \`fireAndForget\`. That name is RESERVED: it is `
-            + `the platform's design-time switch for starting the process without waiting, and its serializer `
-            + `removes the key from the node's inputs before emitting — so a process argument of that name never `
-            + `arrives. Locally it would appear to work, because this engine passes the whole envelope through. `
-            + `Rename the argument, and note that this surface cannot author fire-and-forget at all (the engine `
-            + `always waits for the job).`);
-    }
-    // An empty `returns: {}` is a statement that the process returns nothing, which is
-    // legal — but it is almost always a half-finished edit, and the difference between
-    // it and a missing `returns` is invisible in the emitted file.
-    if (inputs?.returns && Object.keys(inputs.returns).length === 0) {
-        diags.push({
-            level: 'warning',
-            code: 'AGENTIC_EMPTY_RETURNS',
-            message: `Agentic process step "${step}" declares \`returns: {}\` — an empty contract, which emits no output `
-                + `schema at all and so reads exactly like omitting it. If the process returns nothing, drop the key; `
-                + `if it returns something, name the fields.`,
-            step,
-        });
-    }
-}
-/**
- * A read of an agentic process's output: `out('<step>', '<field>')`.
- *
- * `waitForJob` records the job's `OutputArguments` UNWRAPPED under `output`, so the
- * readable fields are exactly the ones `returns` declares. The three mistakes are
- * api-workflow's, and one of them has a sharper edge here: a process may DECLARE a
- * field and return it EMPTY (`ProcurementProcess` declares `{status: boolean}` and
- * answers `{"status": null}` on every job), so a declared read is checkable but a
- * non-empty VALUE is not something any offline gate can promise.
- */
-function checkAgenticProcessRead(name, field, rest, spec, step, diags) {
-    if (field === undefined)
-        return; // `out('call')` — the whole output object.
-    if (field === 'error')
-        return; // the error envelope every process node declares.
-    if (field !== 'output') {
-        diags.push({
-            level: 'error',
-            code: 'AGENTIC_READ_NOT_OUTPUT',
-            message: `Agentic process "${name}" publishes the job's output arguments under "output", but `
-                + `"$vars.${name}.${field}" (read in "${step}") asks for "${field}", which is undefined at run time.`,
-            step,
-            suggestion: `out('${name}', '<field>')`,
-        });
-        return;
-    }
-    const declared = Object.keys(spec.returns ?? {});
-    const wanted = (rest ?? '').replace(/^\./, '').split('.')[0];
-    if (!wanted)
-        return; // `$vars.<name>.output` — the whole object.
-    if (declared.length === 0) {
-        diags.push({
-            level: 'error',
-            code: 'AGENTIC_READ_WITHOUT_RETURNS',
-            message: `"$vars.${name}.output.${wanted}" (read in "${step}") reads a field of agentic process "${name}"'s `
-                + `result, but the step declares no \`returns\` — so the node carries no output schema and nothing can `
-                + `tell a real field from a typo. The process's output arguments live on the tenant; declare the ones `
-                + `you read. \`uip maestro flow registry get uipath.core.agentic-process.${spec.key}\` shows what `
-                + `the platform synthesizes for it.`,
-            step,
-            suggestion: `returns: { ${wanted}: 'string' }`,
-        });
-        return;
-    }
-    if (declared.includes(wanted))
-        return;
-    const nearest = nearestName(wanted, declared);
-    diags.push({
-        level: 'error',
-        code: 'AGENTIC_READ_UNKNOWN_FIELD',
-        message: `Agentic process "${name}" declares no output "${wanted}" (read as "$vars.${name}.output.${wanted}" in `
-            + `"${step}"). Its \`returns\` names: ${declared.join(', ')}. A read outside that set is undefined on `
-            + `every rung and on the platform.`,
-        step,
-        ...(nearest ? { suggestion: `out('${name}', '${nearest}')` } : {}),
-    });
-}
 /**
  * Check an `agent(...)` call — a published or in-solution agent (coded or
  * low-code).