@uipath/maestro-tool 1.202.2 → 1.203.0-preview.180

package/dist/flow-validate-service-02e21w4d.js

@@ -0,0 +1,3555 @@
+import {
+  UI_ONLY_NODE_TYPES
+} from "./packager-tool-2c1rbj85.js";
+import {
+  checkForwardMigration
+} from "./packager-tool-j00gcgbs.js";
+import {
+  connectorNodeValidator,
+  crossNodeBindingValidator,
+  isConnectorTriggerType,
+  isConnectorWaitForEventType,
+  isEventDrivenConnectorType,
+  readEssentialConfiguration
+} from "./packager-tool-2q1mffef.js";
+import {
+  ERROR_SOURCE_PORT,
+  deriveHandleCustomizationSourceOverride,
+  deriveOutcomeHandleIds,
+  expandHandleIds,
+  isHandleVisible,
+  isTemplatedHandleId,
+  parseVisibleInputKey,
+  portMatchesTemplate
+} from "./packager-tool-19030vpg.js";
+import {
+  collectNodeBindingResourceKeys,
+  isProcessNode,
+  resolveProcessTarget
+} from "./packager-tool-q2gwvnf5.js";
+import {
+  isRecord
+} from "./packager-tool-mfrdmqmt.js";
+import {
+  findNodeDefinition
+} from "./packager-tool-7msx23gd.js";
+import {
+  loadRegistry,
+  parse
+} from "./packager-tool-2xrng5ff.js";
+import"./packager-tool-dqxz5v18.js";
+import"./packager-tool-d2813z49.js";
+import"./packager-tool-9pccpz3r.js";
+import {
+  resolveProjectFlowFile
+} from "./packager-tool-zzxt99e4.js";
+import"./packager-tool-cr0z8cbj.js";
+import"./packager-tool-ygrrb1zh.js";
+import"./packager-tool-eypvc2kv.js";
+import"./packager-tool-ydg78w9z.js";
+import"./packager-tool-8qp60s20.js";
+import"./packager-tool-fq7wtkd3.js";
+import"./packager-tool-dh5nppv4.js";
+import {
+  ManifestClient,
+  buildErrorHandle
+} from "./packager-tool-vck7ct1e.js";
+import"./packager-tool-paq9c70w.js";
+import"./packager-tool-4r35ye9r.js";
+import {
+  getLoginStatusAsync
+} from "./packager-tool-yrsrzz1a.js";
+import"./packager-tool-0gctz400.js";
+import"./packager-tool-qa9gftnj.js";
+import"./packager-tool-yc4kw997.js";
+import"./packager-tool-095jzn8v.js";
+import"./packager-tool-mj89jhvb.js";
+import"./packager-tool-s1466723.js";
+import {
+  findNearestParentUipxFile,
+  readSolutionManifest
+} from "./packager-tool-wynrdnqj.js";
+import"./packager-tool-kb554twx.js";
+import"./packager-tool-h8x54cvx.js";
+import {
+  canonicalAgentInputPath,
+  collectAgentInputLeaves,
+  createFlowRefResolver,
+  resolveWorkflowRefs
+} from "./packager-tool-te6rrpsz.js";
+import"./packager-tool-6rsegsby.js";
+import"./packager-tool-wd01egnx.js";
+import"./packager-tool-2513jrxr.js";
+import"./packager-tool-khm7zsm8.js";
+import"./packager-tool-vcjq9xkc.js";
+import"./packager-tool-b803sdfp.js";
+import"./packager-tool-nkrmjr3a.js";
+import"./packager-tool-rs6jm14d.js";
+import"./packager-tool-hk1gxnth.js";
+import"./packager-tool-7q6z6npd.js";
+import"./packager-tool-sc961w0q.js";
+import"./packager-tool-gpwec9sp.js";
+import"./packager-tool-vqcnvaae.js";
+import"./packager-tool-gbgfwx8f.js";
+import"./packager-tool-d88rqwk8.js";
+import"./packager-tool-jysvpt8p.js";
+import {
+  AGENT_NODE_TYPES,
+  DECISION_NODE_TYPE,
+  SYNTHETIC_GATEWAY_OUTPUT_KEYS,
+  cliRules,
+  conditionExpressionRule,
+  decodeLiteral,
+  getJsExpressionBody,
+  isBlockingSeverity,
+  isExpressionValue,
+  isStartEventNode,
+  isVoiceAgentNodeType,
+  parseWorkflowJson,
+  runRules,
+  toSerializedNodes
+} from "./packager-tool-fvm2dddf.js";
+import {
+  registerFlowSchemaI18n
+} from "./packager-tool-p79yh9ww.js";
+import {
+  instance
+} from "./packager-tool-vdc8r21p.js";
+import"./packager-tool-z83pga0z.js";
+import"./packager-tool-6ejqwbw9.js";
+import"./packager-tool-mcaf4ewf.js";
+import {
+  OutputFormatter,
+  RESULTS,
+  catchError,
+  extractErrorMessageSync,
+  logger
+} from "./packager-tool-z6nkdv48.js";
+import {
+  getFileSystem
+} from "./packager-tool-0v3s8r01.js";
+import"./packager-tool-4mna26cc.js";
+import"./packager-tool-c23zrhj8.js";
+import {
+  __require
+} from "./packager-tool-1yh8g550.js";
+
+// ../flow-tool/src/services/connector-binding-validator.ts
+var STATIC_CONNECTOR_KEYWORDS = [
+  "slack",
+  "gmail",
+  "outlook",
+  "office365",
+  "exchange",
+  "jira",
+  "confluence",
+  "salesforce",
+  "sfdc",
+  "hubspot",
+  "servicenow",
+  "zendesk",
+  "intercom",
+  "notion",
+  "asana",
+  "trello",
+  "monday",
+  "github",
+  "gitlab",
+  "bitbucket",
+  "discord",
+  "teams",
+  "sharepoint",
+  "onedrive",
+  "dropbox",
+  "box",
+  "googledrive",
+  "docusign",
+  "adobesign",
+  "mailchimp",
+  "sendgrid",
+  "twilio",
+  "stripe",
+  "shopify",
+  "quickbooks",
+  "xero",
+  "workday",
+  "successfactors",
+  "bamboohr",
+  "sap",
+  "netsuite",
+  "oracle",
+  "marketo",
+  "pardot",
+  "segment",
+  "snowflake",
+  "bigquery",
+  "redshift",
+  "databricks",
+  "tableau",
+  "powerbi"
+];
+var ACTION_VERBS = [
+  "send",
+  "post",
+  "create",
+  "update",
+  "delete",
+  "get",
+  "fetch",
+  "list",
+  "read",
+  "write",
+  "upload",
+  "download",
+  "find",
+  "add",
+  "remove",
+  "query",
+  "search",
+  "notify",
+  "publish",
+  "subscribe",
+  "trigger",
+  "watch",
+  "share",
+  "invite",
+  "schedule",
+  "assign",
+  "close",
+  "open",
+  "reply",
+  "forward",
+  "archive"
+];
+var MANAGED_HTTP_NODE_TYPE = "core.action.http.v2";
+async function loadConnectorCatalog() {
+  const keywords = new Set(STATIC_CONNECTOR_KEYWORDS);
+  const activityTokenBags = [];
+  const [err, registry] = await catchError(loadRegistry());
+  if (err) {
+    logger.debug(`Connector-binding validator: could not load IS catalog cache (${err.message}); falling back to static keyword list.`);
+    return { keywords, activityTokenBags };
+  }
+  if (!registry) {
+    return { keywords, activityTokenBags };
+  }
+  for (const connector of registry.discovered.connectors) {
+    addConnectorKeywords(connector, keywords);
+    for (const activity of connector.activities) {
+      const tokens = tokenize(activity.displayName);
+      if (tokens.size > 0) {
+        activityTokenBags.push({
+          connectorKey: connector.key,
+          connectorName: connector.name,
+          tokens
+        });
+      }
+    }
+  }
+  return { keywords, activityTokenBags };
+}
+function addConnectorKeywords(connector, out) {
+  const keyParts = connector.key.toLowerCase().split("-").filter((p) => p && p !== "uipath");
+  for (const part of keyParts)
+    out.add(part);
+  for (const t of tokenize(connector.name))
+    out.add(t);
+}
+function tokenize(label) {
+  if (!label)
+    return new Set;
+  const tokens = label.toLowerCase().split(/[^a-z0-9]+/).filter((t) => t.length > 1);
+  return new Set(tokens);
+}
+function readNodeLabel(node) {
+  const fromDisplay = node.display?.label;
+  if (typeof fromDisplay === "string" && fromDisplay.length > 0) {
+    return fromDisplay;
+  }
+  const fromName = node.name;
+  if (typeof fromName === "string" && fromName.length > 0) {
+    return fromName;
+  }
+  return;
+}
+function hasConnectorBinding(node) {
+  const detail = node.inputs?.detail;
+  if (!detail || typeof detail !== "object" || Array.isArray(detail)) {
+    return false;
+  }
+  const d = detail;
+  const authentication = d.authentication;
+  if (authentication === "connector") {
+    const connectionId = d.connectionId;
+    const targetConnector = d.targetConnector;
+    return typeof connectionId === "string" && connectionId.length > 0 && connectionId !== "ImplicitConnection" && typeof targetConnector === "string" && targetConnector.length > 0;
+  }
+  if (authentication === "manual") {
+    const url = d.url;
+    return typeof url === "string" && url.length > 0;
+  }
+  return false;
+}
+function classifyLabel(label, catalog) {
+  const tokens = tokenize(label);
+  if (tokens.size === 0)
+    return null;
+  for (const bag of catalog.activityTokenBags) {
+    let overlap = 0;
+    for (const t of bag.tokens) {
+      if (tokens.has(t))
+        overlap += 1;
+    }
+    if (overlap >= 2) {
+      const keyword = pickConnectorKeyword(tokens, catalog.keywords);
+      return {
+        connectorKeyword: keyword ?? bag.connectorKey,
+        matchedActivity: {
+          connectorKey: bag.connectorKey,
+          connectorName: bag.connectorName
+        }
+      };
+    }
+  }
+  const matchedKeyword = pickConnectorKeyword(tokens, catalog.keywords);
+  if (!matchedKeyword)
+    return null;
+  const hasVerb = [...tokens].some((t) => ACTION_VERBS.includes(t));
+  if (!hasVerb)
+    return null;
+  return { connectorKeyword: matchedKeyword };
+}
+function pickConnectorKeyword(tokens, keywords) {
+  for (const t of tokens) {
+    if (keywords.has(t))
+      return t;
+  }
+  return;
+}
+function buildDiagnosticMessage(label, classification, strict) {
+  const connectorHint = classification.matchedActivity ? `looks like a "${classification.matchedActivity.connectorName}" connector activity` : `mentions the "${classification.connectorKeyword}" connector keyword`;
+  const strictNote = strict ? " (--strict-bindings promoted this to an error.)" : " Pass `--strict-bindings` to fail validation on this.";
+  const connectorDetail = `{"authentication":"connector",` + `"targetConnector":"${classification.connectorKeyword}",` + `"connectionId":"<uuid>","folderKey":"<uuid>","method":"GET","url":"<path>"}`;
+  const manualDetail = `{"authentication":"manual","method":"GET","url":"https://…"}`;
+  return `Node "${label}" ${connectorHint} but uses the generic Managed HTTP type \`${MANAGED_HTTP_NODE_TYPE}\` ` + "with no connection binding. The runtime will issue a raw HTTP call to an undefined endpoint. " + `Either bind a real Integration Service connection with \`uip maestro flow node configure <file> <node-id> --detail '${connectorDetail}'\`, ` + `or configure manual-mode HTTP with \`--detail '${manualDetail}'\`. ` + "If this node is intentionally a raw HTTP call, rename it so the label doesn't " + `imply a connector binding.${strictNote}`;
+}
+var MCP_CONNECTOR_KEY = "uipath-uipath-mcp";
+function readDetail(node) {
+  const detail = node.inputs?.detail;
+  if (!detail || typeof detail !== "object" || Array.isArray(detail)) {
+    return;
+  }
+  return detail;
+}
+var MCP_RUN_TOOL_SEGMENT = /run[-_]?a?[-_]?tool/;
+var MCP_RUN_TOOL_OBJECT = "mcp_request";
+function isMcpRunToolNode(node) {
+  const type = typeof node.type === "string" ? node.type : "";
+  const detail = readDetail(node);
+  const connector = typeof detail?.connector === "string" ? detail.connector : "";
+  if (connector !== MCP_CONNECTOR_KEY && !type.includes(MCP_CONNECTOR_KEY)) {
+    return false;
+  }
+  const endpoint = typeof detail?.endpoint === "string" ? detail.endpoint : "";
+  const objectName = detail ? readEssentialConfiguration(detail)?.objectName : undefined;
+  return MCP_RUN_TOOL_SEGMENT.test(type) || endpoint.includes(MCP_RUN_TOOL_OBJECT) || objectName === MCP_RUN_TOOL_OBJECT;
+}
+function definitionRequiresToolName(definitions, node) {
+  const def = findNodeDefinition(definitions, node);
+  const input = def?.inputDefinition;
+  const detail = input?.properties?.detail;
+  const body = detail?.properties?.bodyParameters;
+  return Array.isArray(body?.required) && body.required.includes("toolName");
+}
+function readToolName(node) {
+  const detail = readDetail(node);
+  const body = detail?.bodyParameters;
+  if (!body || typeof body !== "object" || Array.isArray(body)) {
+    return;
+  }
+  return body.toolName;
+}
+function hasSelectedTool(node) {
+  const toolName = readToolName(node);
+  return typeof toolName === "string" && toolName.trim().length > 0;
+}
+function hasMcpConnectionBinding(node) {
+  const detail = readDetail(node);
+  for (const key of ["connectionId", "connectionResourceId"]) {
+    const value = detail?.[key];
+    if (typeof value === "string" && value.trim().length > 0)
+      return true;
+  }
+  return false;
+}
+function validateConnectorBindings(workflow, catalog, options = {}) {
+  const issues = [];
+  const severity = options.strict ? "error" : "warning";
+  const checkNode = (node, scope) => {
+    if (isMcpRunToolNode(node)) {
+      const toolName = readToolName(node);
+      const schemaCatchesIt = (typeof toolName !== "string" || toolName === "") && definitionRequiresToolName(workflow.definitions, node);
+      if (hasMcpConnectionBinding(node) && !hasSelectedTool(node) && !schemaCatchesIt) {
+        issues.push({
+          path: `${scope}nodes[${node.id}].inputs.detail.bodyParameters.toolName`,
+          severity,
+          message: `MCP "Run a Tool" node "${readNodeLabel(node) ?? node.id}" has no selected tool — ` + "`inputs.detail.bodyParameters.toolName` is empty or missing. Studio blocks publish " + 'with "Available Tools is required" and the runtime fails with ' + "`AGENT_RUNTIME.HTTP_ERROR: Not Found`. Select a tool for this node in Studio, or " + "set `inputs.detail.bodyParameters.toolName` to the tool's name." + (options.strict === true ? "" : " Pass `--strict-bindings` to fail validation on this.")
+        });
+      }
+      return;
+    }
+    if (node.type !== MANAGED_HTTP_NODE_TYPE)
+      return;
+    if (hasConnectorBinding(node))
+      return;
+    const label = readNodeLabel(node);
+    if (!label)
+      return;
+    const classification = classifyLabel(label, catalog);
+    if (!classification)
+      return;
+    issues.push({
+      path: `${scope}nodes[${node.id}].inputs.detail`,
+      severity,
+      message: buildDiagnosticMessage(label, classification, options.strict === true)
+    });
+  };
+  for (const node of workflow.nodes) {
+    checkNode(node, "");
+  }
+  for (const [subflowId, sub] of Object.entries(workflow.subflows ?? {})) {
+    for (const node of sub.nodes ?? []) {
+      checkNode(node, `subflows[${subflowId}].`);
+    }
+  }
+  return issues;
+}
+
+// ../flow-tool/src/services/expression-validator.ts
+var catalogRegistered = false;
+async function ensureCatalogRegistered() {
+  if (catalogRegistered || !instance.isInitialized)
+    return;
+  try {
+    const { registerFlowExpressionModelI18n } = await import("./localization-y790z9vm.js");
+    registerFlowExpressionModelI18n(instance);
+  } catch (error) {
+    logger.warn(`Expression type checking localization unavailable, falling back to English: ${extractErrorMessageSync(error)}`);
+  }
+  catalogRegistered = true;
+}
+var headlessModule;
+function loadHeadless() {
+  headlessModule ??= import("./headless-627q5my5.js").then((mod) => {
+    logger.info(`Expression type checking: @uipath/flow-expression-model (TypeScript ${mod.HEADLESS_TYPESCRIPT_VERSION})`);
+    return mod;
+  }).catch((error) => {
+    logger.warn(`Expression type checking unavailable, skipping: ${extractErrorMessageSync(error)}`);
+    return null;
+  });
+  return headlessModule;
+}
+function findingPath(finding) {
+  if (!finding.nodeId)
+    return finding.fieldPath ?? "(workflow)";
+  if (!finding.fieldPath)
+    return `nodes[${finding.nodeId}]`;
+  return `nodes[${finding.nodeId}].${finding.fieldPath}`;
+}
+async function validateExpressions(graph, pathPrefix, strict = false) {
+  await ensureCatalogRegistered();
+  const headless = await loadHeadless();
+  if (!headless)
+    return [];
+  const [error, findings] = await catchError(headless.checkWorkflowExpressionsHeadless(graph));
+  if (error || !findings) {
+    logger.warn(`Expression type checking failed, skipping: ${extractErrorMessageSync(error)}`);
+    return [];
+  }
+  return findings.map((finding) => ({
+    path: `${pathPrefix}${findingPath(finding)}`,
+    message: `[${finding.code}] ${finding.message}`,
+    severity: strict ? "error" : "warning"
+  }));
+}
+
+// ../flow-tool/src/services/node-validators/activity-type-id-validator.ts
+var activityTypeIdValidator = {
+  id: "activity-type-id",
+  appliesTo: (node) => {
+    const t = node.type;
+    if (!t)
+      return false;
+    return t === "core.action.http.v2" || t.startsWith("uipath.connector.");
+  },
+  validate: (node) => {
+    const rawDetail = node.inputs?.detail;
+    if (!rawDetail || typeof rawDetail !== "object" || Array.isArray(rawDetail)) {
+      return [];
+    }
+    const detail = rawDetail;
+    if (Object.keys(detail).length === 0)
+      return [];
+    const activityTypeId = detail.uiPathActivityTypeId;
+    if (typeof activityTypeId === "string" && activityTypeId.length > 0) {
+      return [];
+    }
+    const nodeKind = node.type === "core.action.http.v2" ? "Managed HTTP node" : isConnectorTriggerType(node.type) ? "Connector trigger node" : isConnectorWaitForEventType(node.type) ? "Connector wait-for-event node" : "Connector activity node";
+    const quotedType = shellSingleQuote(node.type);
+    const quotedId = shellSingleQuote(node.id);
+    return [
+      {
+        path: `nodes[${node.id}].inputs.detail.uiPathActivityTypeId`,
+        severity: "error",
+        message: `${nodeKind} (\`${node.type}\`): \`inputs.detail.uiPathActivityTypeId\` is missing — Studio Web crashes when opening this flow. ` + `Fix: refresh the embedded definition without re-IDing the node — \`uip maestro flow registry get ${quotedType} --output json\`, replace the matching entry in \`definitions[]\` with the returned node object (preserve \`typeVersion\` exactly as returned), ` + `then \`uip maestro flow node configure <file> ${quotedId} --detail <json>\` to re-populate \`inputs.detail.uiPathActivityTypeId\` from the fresh manifest.`
+      }
+    ];
+  }
+};
+function shellSingleQuote(value) {
+  return `'${value.replace(/'/g, "'\\''")}'`;
+}
+
+// ../flow-tool/src/services/node-validators/ceql-query-validator.ts
+var CEQL_SYMBOL_OPERATORS = ["=", "!=", "<", "<=", ">", ">="];
+var CEQL_WORD_OPERATORS = [
+  "In",
+  "Not In",
+  "Like",
+  "Not Like",
+  "Contains",
+  "Not Contains",
+  "Starts With",
+  "Not Starts With",
+  "Ends With",
+  "Not Ends With",
+  "Is Null",
+  "Is Not Null"
+];
+var CEQL_OPERATOR_ALIASES = {
+  eq: "=",
+  ne: "!=",
+  gt: ">",
+  ge: ">=",
+  lt: "<",
+  le: "<="
+};
+var byLengthDescending = (a, b) => b.length - a.length;
+var escapeRegexToken = (token) => token.replace(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`);
+var toWordOperatorPattern = (token) => token.split(/\s+/).map(escapeRegexToken).join(String.raw`\s+`);
+var CEQL_SYMBOL_OPERATOR_ALTERNATION = [...CEQL_SYMBOL_OPERATORS].sort(byLengthDescending).map(escapeRegexToken).join("|");
+var CEQL_WORD_OPERATOR_ALTERNATION = [...CEQL_WORD_OPERATORS].sort(byLengthDescending).map(toWordOperatorPattern).join("|");
+var CEQL_OPERATOR = String.raw`(?:${CEQL_SYMBOL_OPERATOR_ALTERNATION}|(?:${CEQL_WORD_OPERATOR_ALTERNATION})\b)`;
+var CEQL_OPERATOR_ALIAS_ALTERNATION = Object.keys(CEQL_OPERATOR_ALIASES).map(escapeRegexToken).join("|");
+var CEQL_FIELD_OPERATOR = String.raw`(?:${CEQL_OPERATOR}|(?:${CEQL_OPERATOR_ALIAS_ALTERNATION})\b)`;
+var CEQL_FILTER_PARAMETERS = new Set(["where", "queryExpression"]);
+var CEQL_REFERENCE = 'See uipath-maestro-flow skill — plugins/connector/impl.md, "Hand-authored CEQL strings".';
+var HOLE = "\x00";
+var JS_PREFIX = "=js:";
+function collectFragments(root, fragments) {
+  const pending = [root];
+  while (pending.length > 0) {
+    const item = pending.pop();
+    if (!("type" in item)) {
+      fragments.push(item);
+      continue;
+    }
+    switch (item.type) {
+      case "Literal":
+        fragments.push(typeof item.value === "string" ? { kind: "text", text: item.value } : { kind: "hole" });
+        continue;
+      case "BinaryExpression":
+        if (item.operator !== "+") {
+          fragments.push({ kind: "hole" });
+          continue;
+        }
+        pending.push(item.right, item.left);
+        continue;
+      case "TemplateLiteral":
+        for (let i = item.quasis.length - 1;i >= 0; i--) {
+          if (i < item.expressions.length)
+            pending.push({ kind: "hole" });
+          pending.push({
+            kind: "text",
+            text: item.quasis[i].value.cooked ?? ""
+          });
+        }
+        continue;
+      default:
+        fragments.push({ kind: "hole" });
+    }
+  }
+}
+function isStringConcatShape(node) {
+  if (node.type === "TemplateLiteral")
+    return true;
+  if (node.type === "Literal")
+    return typeof node.value === "string";
+  return node.type === "BinaryExpression" && node.operator === "+";
+}
+function lexCeqlFilterValue(value) {
+  const trimmed = value.trim();
+  if (!trimmed.startsWith(JS_PREFIX)) {
+    if (trimmed.startsWith("="))
+      return;
+    return [{ kind: "text", text: value }];
+  }
+  let program;
+  try {
+    program = parse(`(${trimmed.slice(JS_PREFIX.length)}
+)`, {
+      ecmaVersion: 2020,
+      sourceType: "script"
+    });
+  } catch {
+    return;
+  }
+  const statement = program.body[0];
+  if (statement?.type !== "ExpressionStatement")
+    return;
+  if (!isStringConcatShape(statement.expression))
+    return;
+  const fragments = [];
+  collectFragments(statement.expression, fragments);
+  return fragments;
+}
+function buildSkeleton(fragments) {
+  let text = "";
+  const holeAt = [];
+  for (const fragment of fragments) {
+    if (fragment.kind === "hole") {
+      text += HOLE;
+      holeAt.push(true);
+      continue;
+    }
+    text += fragment.text;
+    for (let i = 0;i < fragment.text.length; i++)
+      holeAt.push(false);
+  }
+  return { text, holeAt };
+}
+function singleQuoteOpenBefore(skeleton) {
+  const openBefore = new Array(skeleton.length);
+  let open = false;
+  for (let i = 0;i < skeleton.length; i++) {
+    openBefore[i] = open;
+    if (skeleton[i] === "'")
+      open = !open;
+  }
+  return openBefore;
+}
+function renderSkeletonSlice(skeleton, start, length) {
+  let rendered = "";
+  for (let i = start;i < start + length; i++) {
+    rendered += skeleton.holeAt[i] ? "<expression>" : skeleton.text[i];
+  }
+  return rendered;
+}
+var CEQL_QUOTED_FIELD_RE = new RegExp(String.raw`(?:^|\bAND\b|\bOR\b|\()\s*'([^']*)'\s*(?=${CEQL_FIELD_OPERATOR})`, "gi");
+var CEQL_DOUBLE_QUOTED_VALUE_RE = new RegExp(String.raw`(${CEQL_OPERATOR})\s*"`, "gi");
+var CEQL_OPERATOR_ALIAS_RE = new RegExp(String.raw`[A-Za-z0-9_.)\]']\s+(${CEQL_OPERATOR_ALIAS_ALTERNATION})(?!\s*(?:${CEQL_OPERATOR}))(?=\s)`, "gi");
+function findQuotedFields(skeleton, openBefore) {
+  const matches = [];
+  for (const match of skeleton.matchAll(CEQL_QUOTED_FIELD_RE)) {
+    const openIndex = match.index + match[0].indexOf("'");
+    if (openBefore[openIndex])
+      continue;
+    matches.push({ name: match[1], openIndex });
+  }
+  return matches;
+}
+function unquoteFields(value, fields) {
+  const quoteIndexes = fields.flatMap((field) => [
+    field.openIndex,
+    field.openIndex + field.name.length + 1
+  ]).sort((a, b) => b - a);
+  let fixed = value;
+  for (const index of quoteIndexes) {
+    fixed = fixed.slice(0, index) + fixed.slice(index + 1);
+  }
+  if (!fixed.trim().startsWith(JS_PREFIX) && fixed.includes("${")) {
+    const escaped = fixed.replace(/\\/g, "\\\\").replace(/`/g, "\\`");
+    return `=js:\`${escaped}\``;
+  }
+  return fixed;
+}
+function quotedFieldMessage(token, fixedValue) {
+  const fix = fixedValue ? `Write "${fixedValue}" instead.` : "Remove the quotes around the field name.";
+  return `Quoted token '${token}' where CEQL expects a bare field name — ` + "Integration Service rejects this with [102003] Expected a field name " + `expression but got 'StringValue'. ${fix} ${CEQL_REFERENCE}`;
+}
+function doubleQuotedValueMessage(operator) {
+  return `Double-quoted value after '${operator}' — CEQL quotes a value with ` + "single quotes. Integration Service rejects this with [102003] " + `"Unsupported value expression 'Column' on field ...". Write the ` + `value in single quotes. ${CEQL_REFERENCE}`;
+}
+function operatorAliasMessage(alias) {
+  const symbol = CEQL_OPERATOR_ALIASES[alias.toLowerCase()];
+  return `Operator '${alias}' is not CEQL — write '${symbol}'. Integration ` + "Service rejects this with [102003] Integration Services bad request. " + CEQL_REFERENCE;
+}
+function findCeqlFilterIssues(value) {
+  const fragments = lexCeqlFilterValue(value);
+  if (!fragments)
+    return [];
+  const skeleton = buildSkeleton(fragments);
+  const openBefore = singleQuoteOpenBefore(skeleton.text);
+  const issues = [];
+  const quotedFields = findQuotedFields(skeleton.text, openBefore);
+  if (quotedFields.length > 0) {
+    const fixedValue = value.trim().startsWith(JS_PREFIX) ? undefined : unquoteFields(value, quotedFields);
+    for (const field of quotedFields) {
+      const token = renderSkeletonSlice(skeleton, field.openIndex + 1, field.name.length);
+      issues.push({
+        rule: "quoted-field",
+        token,
+        fixedValue,
+        message: quotedFieldMessage(token, fixedValue)
+      });
+    }
+  }
+  for (const match of skeleton.text.matchAll(CEQL_DOUBLE_QUOTED_VALUE_RE)) {
+    const quoteIndex = match.index + match[0].length - 1;
+    if (openBefore[quoteIndex])
+      continue;
+    const operator = match[1].replace(/\s+/g, " ");
+    issues.push({
+      rule: "double-quoted-value",
+      token: operator,
+      message: doubleQuotedValueMessage(operator)
+    });
+  }
+  for (const match of skeleton.text.matchAll(CEQL_OPERATOR_ALIAS_RE)) {
+    const aliasIndex = match.index + match[0].length - match[1].length;
+    if (openBefore[aliasIndex])
+      continue;
+    issues.push({
+      rule: "operator-alias",
+      token: match[1],
+      message: operatorAliasMessage(match[1])
+    });
+  }
+  return issues;
+}
+function scanContainerForCeqlFilterIssues(obj, path, severity, issues) {
+  if (typeof obj === "string") {
+    for (const issue of findCeqlFilterIssues(obj)) {
+      issues.push({ path, severity, message: issue.message });
+    }
+    return;
+  }
+  if (Array.isArray(obj)) {
+    for (let i = 0;i < obj.length; i++) {
+      scanContainerForCeqlFilterIssues(obj[i], `${path}[${i}]`, severity, issues);
+    }
+    return;
+  }
+  if (obj && typeof obj === "object") {
+    for (const [key, value] of Object.entries(obj)) {
+      scanContainerForCeqlFilterIssues(value, `${path}.${key}`, severity, issues);
+    }
+  }
+}
+var ceqlQueryValidator = {
+  id: "ceql-query",
+  appliesTo: (node) => {
+    const t = node.type;
+    if (!t)
+      return false;
+    if (isEventDrivenConnectorType(t))
+      return false;
+    return t.startsWith("uipath.connector.");
+  },
+  validate: (node, context) => {
+    const rawDetail = node.inputs?.detail;
+    if (!rawDetail || typeof rawDetail !== "object" || Array.isArray(rawDetail)) {
+      return [];
+    }
+    const queryParameters = rawDetail.queryParameters;
+    if (!queryParameters || typeof queryParameters !== "object" || Array.isArray(queryParameters)) {
+      return [];
+    }
+    const severity = context.strictBindings ? "error" : "warning";
+    const issues = [];
+    for (const [key, value] of Object.entries(queryParameters)) {
+      if (!CEQL_FILTER_PARAMETERS.has(key))
+        continue;
+      scanContainerForCeqlFilterIssues(value, `nodes[${node.id}].inputs.detail.queryParameters.${key}`, severity, issues);
+    }
+    return issues;
+  }
+};
+
+// ../flow-tool/src/services/node-validators/expression-prefix-validator.ts
+var expressionPrefixValidator = {
+  id: "expression-prefix",
+  appliesTo: (node) => {
+    const t = node.type;
+    if (!t)
+      return false;
+    if (isEventDrivenConnectorType(t))
+      return false;
+    return t.startsWith("uipath.connector.") || t === "core.action.http" || t === "core.action.http.v2" || t === "core.action.script";
+  },
+  validate: (node) => {
+    const issues = [];
+    if (node.type === "core.action.script") {
+      scanScriptSource(node.id, node.inputs, issues);
+      return issues;
+    }
+    const rawDetail = node.inputs?.detail;
+    if (!rawDetail || typeof rawDetail !== "object" || Array.isArray(rawDetail)) {
+      return [];
+    }
+    const detail = rawDetail;
+    for (const containerKey of [
+      "bodyParameters",
+      "queryParameters",
+      "pathParameters"
+    ]) {
+      const container = detail[containerKey];
+      if (!container || typeof container !== "object" || Array.isArray(container)) {
+        continue;
+      }
+      scanForUnprefixedExpressions(container, `nodes[${node.id}].inputs.detail.${containerKey}`, issues);
+    }
+    return issues;
+  }
+};
+function scanScriptSource(nodeId, inputs, issues) {
+  if (!inputs)
+    return;
+  const source = inputs.source;
+  if (typeof source !== "string")
+    return;
+  const trimmed = source.trimStart();
+  if (!trimmed.startsWith("=js:"))
+    return;
+  issues.push({
+    path: `nodes[${nodeId}].inputs.source`,
+    severity: "error",
+    message: 'Script node `inputs.source` begins with `"=js:"` — that is the ' + "property-level expression-mode marker for connector / HTTP / " + "End-output / subflow-input fields, not JavaScript syntax. The " + "Script node's `source` field is the function body; runtime treats " + 'this value as literal source code, so e.g. `"=js:vars.X.Y"` ' + "compiles into a string-reversed gibberish output. Replace with a " + 'JavaScript expression that returns the value, e.g. `"return ' + '$vars.X.Y"` or a multi-statement function body. See ' + "uipath-maestro-flow skill — script-node reference (MST-9265)."
+  });
+}
+var BARE_DOLLAR_REF_RE = /^\$(vars|metadata|self)\b/;
+var INVENTED_NODES_REF_RE = /^nodes\.[A-Za-z_$][\w$]*\.output\b/;
+function scanForUnprefixedExpressions(obj, path, issues) {
+  if (typeof obj === "string") {
+    const trimmed = obj.trimStart();
+    if (trimmed.startsWith("="))
+      return;
+    if (BARE_DOLLAR_REF_RE.test(trimmed)) {
+      issues.push({
+        path,
+        severity: "error",
+        message: `Value "${obj}" references a runtime variable but is missing the "=js:" prefix. Use "=js:${obj}" so the runtime evaluates it; without the prefix, the value ships as a literal string and the activity input is bound to "${obj.replace(/^\$vars\b/, "vars").replace(/^\$metadata\b/, "metadata").replace(/^\$self\b/, "self")}". See uipath-maestro-flow skill — node-output-wiring.md (MST-9107).`
+      });
+      return;
+    }
+    if (INVENTED_NODES_REF_RE.test(trimmed)) {
+      const fixed = trimmed.replace(/^nodes\./, "=js:$vars.");
+      issues.push({
+        path,
+        severity: "error",
+        message: `Value "${obj}" looks like an invented "nodes.<id>.output" reference. There is no such syntax — variable references use "$vars". Write "${fixed}" instead. See uipath-maestro-flow skill — node-output-wiring.md (MST-9107).`
+      });
+      return;
+    }
+    return;
+  }
+  if (Array.isArray(obj)) {
+    for (let i = 0;i < obj.length; i++) {
+      scanForUnprefixedExpressions(obj[i], `${path}[${i}]`, issues);
+    }
+    return;
+  }
+  if (obj && typeof obj === "object") {
+    for (const [key, value] of Object.entries(obj)) {
+      scanForUnprefixedExpressions(value, `${path}.${key}`, issues);
+    }
+  }
+}
+
+// ../flow-tool/src/services/node-validators/ixp-node-validator.ts
+var FORBIDDEN_INPUT_FIELDS = [
+  "digitizationMode",
+  "documentTaxonomy",
+  "attachmentId",
+  "fileName",
+  "mimeType"
+];
+var FILE_REF_PATTERN = /^=js:\$vars\.[A-Za-z_$]/;
+var ixpNodeValidator = {
+  id: "ixp-node",
+  appliesTo: (node) => typeof node.type === "string" && node.type.startsWith("uipath.ixp."),
+  validate: (node, _context) => {
+    const issues = [];
+    const inputs = node.inputs ?? {};
+    const outputs = node.outputs ?? {};
+    const base = `nodes[${node.id}]`;
+    const model = inputs.model;
+    const isNonEmptyString = (v) => typeof v === "string" && v.length > 0;
+    if (typeof model !== "object" || model === null || Array.isArray(model) || !isNonEmptyString(model.modelName) || !isNonEmptyString(model.folderKey)) {
+      issues.push({
+        path: `${base}.inputs.model`,
+        severity: "error",
+        message: "inputs.model must be an object with non-empty string " + "`modelName` and `folderKey`. Studio Web's property " + "panel destructures these and crashes when either is " + "missing or not a string."
+      });
+    }
+    const fileRef = inputs.fileRef;
+    if (typeof fileRef !== "string" || !FILE_REF_PATTERN.test(fileRef)) {
+      issues.push({
+        path: `${base}.inputs.fileRef`,
+        severity: "error",
+        message: "inputs.fileRef must be a `=js:$vars.…` expression. " + "The canonical form for an upstream node output is " + "`=js:$vars.<upstream>.output.<field>`. Without the " + "`=js:` prefix the BPMN serializer treats the value " + "as a literal string at runtime."
+      });
+    }
+    for (const port of ["output", "error"]) {
+      if (!(port in outputs)) {
+        issues.push({
+          path: `${base}.outputs.${port}`,
+          severity: "error",
+          message: `outputs.${port} must be present on the instance. ` + `Without it, downstream $vars.${node.id}.${port} ` + "references will not resolve at runtime."
+        });
+      }
+    }
+    const topLevelModel = node.model;
+    if (topLevelModel != null) {
+      issues.push({
+        path: `${base}.model`,
+        severity: "error",
+        message: "Top-level `model` block is forbidden on IxP node " + "instances. The manifest's slim model " + "({ type, serviceType }) lives only in `definitions[]`."
+      });
+    }
+    const legacy = FORBIDDEN_INPUT_FIELDS.filter((k) => (k in inputs));
+    if (legacy.length > 0) {
+      issues.push({
+        path: `${base}.inputs`,
+        severity: "error",
+        message: "Forbidden legacy fields in inputs: " + `${legacy.join(", ")}. These keys were removed from ` + "the current standalone IxP schema and are not " + "returned by `registry get`."
+      });
+    }
+    return issues;
+  }
+};
+
+// ../flow-tool/src/services/node-validators/js-expression-syntax-validator.ts
+var jsExpressionSyntaxValidator = {
+  id: "js-expression-syntax",
+  appliesTo: (node) => {
+    const t = node.type;
+    if (!t)
+      return false;
+    if (isEventDrivenConnectorType(t))
+      return false;
+    return t.startsWith("uipath.connector.") || t === "core.action.http" || t === "core.action.http.v2" || t === "core.action.script";
+  },
+  validate: (node, context) => {
+    const issues = [];
+    const severity = context.strictBindings ? "error" : "warning";
+    if (node.type === "core.action.script") {
+      scanScriptBody(node.id, node.inputs, severity, issues);
+      return issues;
+    }
+    const rawDetail = node.inputs?.detail;
+    if (!rawDetail || typeof rawDetail !== "object" || Array.isArray(rawDetail)) {
+      return [];
+    }
+    const detail = rawDetail;
+    for (const containerKey of [
+      "bodyParameters",
+      "queryParameters",
+      "pathParameters",
+      "filterVariables"
+    ]) {
+      const container = detail[containerKey];
+      if (!container || typeof container !== "object" || Array.isArray(container)) {
+        continue;
+      }
+      scanForInvalidJsExpressions(container, `nodes[${node.id}].inputs.detail.${containerKey}`, severity, issues);
+    }
+    return issues;
+  }
+};
+function scanScriptBody(nodeId, inputs, severity, issues) {
+  if (!inputs)
+    return;
+  const rawScript = inputs.script;
+  const script = typeof rawScript === "string" ? rawScript : isExpressionValue(rawScript) && rawScript.type === "literal" ? decodeLiteral(rawScript) : undefined;
+  if (typeof script !== "string")
+    return;
+  if (script.trim() === "")
+    return;
+  const error = syntaxErrorFrom(() => parse(script, {
+    ecmaVersion: 2020,
+    sourceType: "script",
+    allowReturnOutsideFunction: true
+  }));
+  if (!error)
+    return;
+  issues.push({
+    path: `nodes[${nodeId}].inputs.script`,
+    severity,
+    message: `Script body has a JavaScript syntax error: ${error.message}.`
+  });
+}
+function scanForInvalidJsExpressions(obj, path, severity, issues) {
+  const expression = getJsExpressionBody(typeof obj === "string" ? obj.trimStart() : obj);
+  if (expression !== undefined) {
+    reportInvalidExpression(expression, path, severity, issues);
+    return;
+  }
+  if (isExpressionValue(obj))
+    return;
+  if (typeof obj === "string")
+    return;
+  if (Array.isArray(obj)) {
+    for (let i = 0;i < obj.length; i++) {
+      scanForInvalidJsExpressions(obj[i], `${path}[${i}]`, severity, issues);
+    }
+    return;
+  }
+  if (obj && typeof obj === "object") {
+    for (const [key, value] of Object.entries(obj)) {
+      scanForInvalidJsExpressions(value, `${path}.${key}`, severity, issues);
+    }
+  }
+}
+function reportInvalidExpression(expression, path, severity, issues) {
+  if (expression.trim() === "")
+    return;
+  const error = syntaxErrorFrom(() => parse(`(${expression}
+)`, {
+    ecmaVersion: 2020,
+    sourceType: "script"
+  }));
+  if (!error)
+    return;
+  issues.push({
+    path,
+    severity,
+    message: `Expression at this field is not valid JavaScript: ${error.message}. Fix the syntax — validate cannot otherwise catch JavaScript expression errors; they surface only at flow debug.`
+  });
+}
+function syntaxErrorFrom(parseSource) {
+  try {
+    parseSource();
+    return;
+  } catch (err) {
+    return err instanceof Error ? err : new Error(String(err));
+  }
+}
+
+// ../flow-tool/src/services/node-validators/model-source-validator.ts
+var modelSourceValidator = {
+  id: "model-source",
+  appliesTo: () => true,
+  validate: (node, context) => {
+    const definition = context.definitions.find((d) => d.nodeType === node.type);
+    if (!definition)
+      return [];
+    const requiresModelSource = readModelSourceFlag(definition);
+    if (!requiresModelSource)
+      return [];
+    const legacySource = readLegacyModelSource(node);
+    if (legacySource !== undefined) {
+      return [
+        {
+          path: `nodes[${node.id}].model.source`,
+          severity: "error",
+          message: `Node type "${node.type}" carries the deprecated ` + `"model.source" UUID on the node instance. ` + `flow-core 0.2.50+ requires the canvas-generated ` + `UUID at "inputs.source"; remove "model.source" ` + `from the node and place the value under ` + `"inputs": { "source": "<uuid>" } instead. ` + `See uipath-maestro-flow skill — ` + `inline-agent/impl.md (MST-9265).`
+        }
+      ];
+    }
+    const inputsSource = node.inputs?.source;
+    if (typeof inputsSource === "string" && inputsSource.length > 0) {
+      return [];
+    }
+    return [
+      {
+        path: `nodes[${node.id}].inputs.source`,
+        severity: "error",
+        message: `Node type "${node.type}" requires a stable UUID at ` + `"inputs.source" — the agent's ProjectId for inline ` + `agent nodes, or the resource id from the parent inline ` + `agent's "resources[]" for agent-tool resource nodes. ` + `Set "inputs": { "source": "<uuid>" } on the node ` + `(use the ProjectId returned by ` + `"uip agent init --inline-in-flow" for inline agents). ` + `See uipath-maestro-flow skill — inline-agent/impl.md ` + `(MST-9265).`
+      }
+    ];
+  }
+};
+function readModelSourceFlag(definition) {
+  const model = definition.model;
+  if (!model || typeof model !== "object" || Array.isArray(model)) {
+    return false;
+  }
+  const source = model.source;
+  return source === true;
+}
+function readLegacyModelSource(node) {
+  const model = node.model;
+  if (!model || typeof model !== "object" || Array.isArray(model)) {
+    return;
+  }
+  const source = model.source;
+  if (typeof source === "string" && source.length > 0) {
+    return source;
+  }
+  return;
+}
+
+// ../flow-tool/src/services/node-validators/index.ts
+var defaultNodeValidators = [
+  activityTypeIdValidator,
+  ceqlQueryValidator,
+  connectorNodeValidator,
+  crossNodeBindingValidator,
+  expressionPrefixValidator,
+  jsExpressionSyntaxValidator,
+  ixpNodeValidator,
+  modelSourceValidator
+];
+
+// ../flow-tool/src/services/vars-reference-rule.ts
+var VARS_REF_RE = /(?<![\w$])\$vars((?:\s*\??\.\s*[A-Za-z_$][\w$]*|\s*(?:\?\.\s*)?\[\s*(?:'[^']*'|"[^"]*")\s*\])+)/g;
+var VARS_STEP_RE = /(\??\.)\s*([A-Za-z_$][\w$]*)|(?:(\?\.)\s*)?\[\s*(?:'([^']*)'|"([^"]*)")\s*\]/g;
+var JS_EXPRESSION_PREFIX = "=js:";
+var ARRAY_MEMBERS = new Set([
+  "length",
+  "at",
+  "concat",
+  "copyWithin",
+  "entries",
+  "every",
+  "fill",
+  "filter",
+  "find",
+  "findIndex",
+  "findLast",
+  "findLastIndex",
+  "flat",
+  "flatMap",
+  "forEach",
+  "includes",
+  "indexOf",
+  "join",
+  "keys",
+  "lastIndexOf",
+  "map",
+  "pop",
+  "push",
+  "reduce",
+  "reduceRight",
+  "reverse",
+  "shift",
+  "slice",
+  "some",
+  "sort",
+  "splice",
+  "toLocaleString",
+  "toReversed",
+  "toSorted",
+  "toSpliced",
+  "toString",
+  "unshift",
+  "values",
+  "with"
+]);
+var LOOP_NODE_TYPE = "core.logic.loop";
+var LOOP_BACK_TARGET_PORT = "loopBack";
+var SCRIPT_NODE_TYPE = "core.action.script";
+var JS_EXPRESSION_TYPE = "jsExpression";
+var DECISION_UNPOPULATED_OUTPUTS = new Set(SYNTHETIC_GATEWAY_OUTPUT_KEYS);
+function undefinedSafe(ref, k) {
+  return ref.guarded.has(k + 1);
+}
+function inRanges(ranges, index) {
+  for (const [start, end] of ranges) {
+    if (index < start)
+      return false;
+    if (index < end)
+      return true;
+  }
+  return false;
+}
+var CONTROL_FLOW_HEADS = new Set(["for", "if", "while", "with"]);
+var REGEX_PRECEDING_KEYWORDS = new Set([
+  "await",
+  "case",
+  "delete",
+  "do",
+  "else",
+  "in",
+  "instanceof",
+  "new",
+  "of",
+  "return",
+  "throw",
+  "typeof",
+  "void",
+  "yield"
+]);
+function scanJsText(source) {
+  const n = source.length;
+  let out = "";
+  let i = 0;
+  const proseRanges = [];
+  const pushProse = (start) => {
+    if (out.length > start)
+      proseRanges.push([start, out.length]);
+  };
+  const copyQuoted = (quote) => {
+    const start = out.length;
+    let j = i + 1;
+    while (j < n && source[j] !== quote) {
+      if (source[j] === "\\")
+        j++;
+      else if (source[j] === `
+`)
+        break;
+      j++;
+    }
+    out += source.slice(i, Math.min(j + 1, n));
+    pushProse(start);
+    i = j + 1;
+  };
+  const proseStartAt = (k) => {
+    for (let r = proseRanges.length - 1;r >= 0; r--) {
+      const [start, end] = proseRanges[r];
+      if (k >= end)
+        return;
+      if (k >= start)
+        return start;
+    }
+    return;
+  };
+  const prevSignificant = (from) => {
+    let k = from;
+    while (k >= 0) {
+      const proseStart = proseStartAt(k);
+      if (proseStart !== undefined) {
+        k = proseStart - 1;
+        continue;
+      }
+      if (!/\s/.test(out[k]))
+        return k;
+      k--;
+    }
+    return -1;
+  };
+  const standaloneKeywordEndingAt = (end) => {
+    if (end < 0 || !/[\w$]/.test(out[end]))
+      return;
+    let s = end;
+    while (s >= 0 && /[\w$]/.test(out[s]))
+      s--;
+    let p = s;
+    while (p >= 0 && /\s/.test(out[p]))
+      p--;
+    if (p >= 0 && out[p] === ".")
+      return;
+    return out.slice(s + 1, end + 1);
+  };
+  const closesControlFlowHead = (closeIdx) => {
+    let depth = 0;
+    let k = closeIdx;
+    while (k >= 0) {
+      const proseStart = proseStartAt(k);
+      if (proseStart !== undefined) {
+        k = proseStart - 1;
+        continue;
+      }
+      const ch = out[k];
+      if (ch === ")")
+        depth++;
+      else if (ch === "(") {
+        depth--;
+        if (depth === 0)
+          break;
+      }
+      k--;
+    }
+    if (k < 0)
+      return false;
+    const word = standaloneKeywordEndingAt(prevSignificant(k - 1));
+    return word !== undefined && CONTROL_FLOW_HEADS.has(word);
+  };
+  const regexStartsHere = () => {
+    let k = out.length - 1;
+    while (k >= 0 && /\s/.test(out[k]))
+      k--;
+    if (k < 0)
+      return true;
+    if (proseStartAt(k) !== undefined)
+      return false;
+    const prev = out[k];
+    if (prev === ")")
+      return closesControlFlowHead(k);
+    if (prev === "]")
+      return false;
+    if (/[\w$]/.test(prev)) {
+      const word = standaloneKeywordEndingAt(k);
+      return word !== undefined && REGEX_PRECEDING_KEYWORDS.has(word);
+    }
+    return true;
+  };
+  const copyRegex = () => {
+    const start = out.length;
+    let j = i + 1;
+    let inClass = false;
+    while (j < n) {
+      const ch = source[j];
+      if (ch === "\\") {
+        j += 2;
+        continue;
+      }
+      if (ch === `
+`)
+        break;
+      if (ch === "[")
+        inClass = true;
+      else if (ch === "]")
+        inClass = false;
+      else if (ch === "/" && !inClass)
+        break;
+      j++;
+    }
+    let end = Math.min(j + 1, n);
+    while (end < n && /[a-z]/i.test(source[end]))
+      end++;
+    out += source.slice(i, end);
+    pushProse(start);
+    i = end;
+  };
+  const copyCode = (opts) => {
+    let depth = 0;
+    while (i < n) {
+      const c = source[i];
+      const next = source[i + 1];
+      if (c === "/" && next === "/") {
+        if (opts.stripComments) {
+          while (i < n && source[i] !== `
+`)
+            i++;
+          continue;
+        }
+        const start = out.length;
+        while (i < n && source[i] !== `
+` && source[i] !== "}") {
+          out += source[i];
+          i++;
+        }
+        pushProse(start);
+        continue;
+      }
+      if (c === "/" && next === "*") {
+        const end = source.indexOf("*/", i + 2);
+        const stop = end === -1 ? n : end + 2;
+        if (opts.stripComments) {
+          out += " ";
+        } else {
+          const start = out.length;
+          out += source.slice(i, stop);
+          pushProse(start);
+        }
+        i = stop;
+        continue;
+      }
+      if (c === "'" || c === '"') {
+        copyQuoted(c);
+        continue;
+      }
+      if (c === "`") {
+        copyTemplate();
+        continue;
+      }
+      if (c === "/" && regexStartsHere()) {
+        copyRegex();
+        continue;
+      }
+      if (opts.stopAtBrace) {
+        if (c === "{")
+          depth++;
+        else if (c === "}") {
+          if (depth === 0)
+            return;
+          depth--;
+        }
+      }
+      out += c;
+      i++;
+    }
+  };
+  const copyTemplate = () => {
+    let start = out.length;
+    out += source[i];
+    i++;
+    while (i < n) {
+      const c = source[i];
+      if (c === "\\") {
+        out += source.slice(i, i + 2);
+        i += 2;
+        continue;
+      }
+      if (c === "`") {
+        out += c;
+        i++;
+        pushProse(start);
+        return;
+      }
+      if (c === "$" && source[i + 1] === "{") {
+        pushProse(start);
+        out += "${";
+        i += 2;
+        copyCode({ stopAtBrace: true, stripComments: false });
+        if (i < n) {
+          out += source[i];
+          i++;
+        }
+        start = out.length;
+        continue;
+      }
+      out += c;
+      i++;
+    }
+    pushProse(start);
+  };
+  copyCode({ stopAtBrace: false, stripComments: true });
+  return { text: out, proseRanges };
+}
+function isExpressionObject(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v) && typeof v.expression === "string" && typeof v.type === "string";
+}
+function isWorkflowVarsRoot(text, index) {
+  if (index === 0 || text[index - 1] !== ".")
+    return true;
+  return index >= 3 && text.slice(index - 3, index) === "...";
+}
+function parseRefs(text, proseRanges = []) {
+  const refs = [];
+  for (const m of text.matchAll(VARS_REF_RE)) {
+    if (!isWorkflowVarsRoot(text, m.index))
+      continue;
+    const chain = m[1];
+    const segments = [];
+    const guarded = new Set;
+    for (const step of chain.matchAll(VARS_STEP_RE)) {
+      if (step[1] === "?." || step[3] === "?.") {
+        guarded.add(segments.length);
+      }
+      const key = step[2] ?? step[4] ?? step[5] ?? "";
+      for (const part of key.split(".")) {
+        if (part)
+          segments.push(part);
+      }
+    }
+    if (segments.length > 0) {
+      refs.push({
+        segments,
+        text: `$vars${chain.replace(/\s+/g, "")}`,
+        guarded,
+        inProse: inRanges(proseRanges, m.index)
+      });
+    }
+  }
+  return refs;
+}
+function scanNodeFields(node, updates) {
+  const out = [];
+  const walk = (val, path, underAgentBinding) => {
+    const isScriptBody = node.type === SCRIPT_NODE_TYPE && path === "inputs.script";
+    if (typeof val === "string") {
+      if (!val.includes("$vars"))
+        return;
+      out.push({
+        fieldPath: path,
+        isAgentBinding: underAgentBinding,
+        isJs: isScriptBody || val.startsWith(JS_EXPRESSION_PREFIX),
+        text: val
+      });
+      return;
+    }
+    if (isExpressionObject(val)) {
+      if (!val.expression.includes("$vars"))
+        return;
+      out.push({
+        fieldPath: `${path}.expression`,
+        isAgentBinding: underAgentBinding,
+        isJs: isScriptBody || val.type === JS_EXPRESSION_TYPE,
+        text: val.expression
+      });
+      return;
+    }
+    if (Array.isArray(val)) {
+      for (const [i, v] of val.entries()) {
+        walk(v, `${path}[${i}]`, underAgentBinding);
+      }
+      return;
+    }
+    if (val && typeof val === "object") {
+      for (const [k, v] of Object.entries(val)) {
+        if (path === "inputs.detail" && k === "configuration")
+          continue;
+        walk(v, `${path}.${k}`, underAgentBinding || path === "inputs" && k === "agentInputVariables");
+      }
+    }
+  };
+  if (node.inputs)
+    walk(node.inputs, "inputs", false);
+  if (node.outputs)
+    walk(node.outputs, "outputs", false);
+  if (Array.isArray(updates)) {
+    for (const [i, u] of updates.entries()) {
+      const expr = u?.expression;
+      if (typeof expr === "string" || isExpressionObject(expr)) {
+        walk(expr, `variableUpdates[${i}]`, false);
+      }
+    }
+  }
+  return out;
+}
+function collectVarsRefs(nodes, updatesByNode = {}) {
+  const out = [];
+  for (const node of nodes) {
+    for (const field of scanNodeFields(node, updatesByNode[node.id])) {
+      const scanned = field.isJs ? scanJsText(field.text) : { text: field.text, proseRanges: [] };
+      const text = scanned.text;
+      const bareValue = text.replace(/^=(js:)?/, "").replace(/\s+/g, "");
+      for (const ref of parseRefs(text, scanned.proseRanges)) {
+        out.push({
+          nodeId: node.id,
+          fieldPath: field.fieldPath,
+          isAgentBinding: field.isAgentBinding,
+          embedded: bareValue !== ref.text,
+          ref
+        });
+      }
+    }
+  }
+  return out;
+}
+function buildAncestors(flow) {
+  const preds = new Map;
+  for (const e of flow.edges) {
+    const set = preds.get(e.targetNodeId) ?? new Set;
+    set.add(e.sourceNodeId);
+    preds.set(e.targetNodeId, set);
+  }
+  const result = new Map;
+  for (const n of flow.nodes) {
+    const seen = new Set;
+    const stack = [...preds.get(n.id) ?? []];
+    while (stack.length > 0) {
+      const x = stack.pop();
+      if (seen.has(x))
+        continue;
+      seen.add(x);
+      for (const p of preds.get(x) ?? [])
+        stack.push(p);
+    }
+    result.set(n.id, seen);
+  }
+  return result;
+}
+function buildMustRun(flow, modelTypeOf) {
+  const nodesById = new Map(flow.nodes.map((n) => [n.id, n]));
+  const incoming = new Map;
+  for (const e of flow.edges) {
+    if (e.targetPort === LOOP_BACK_TARGET_PORT && nodesById.get(e.targetNodeId)?.type === LOOP_NODE_TYPE) {
+      continue;
+    }
+    const list = incoming.get(e.targetNodeId) ?? [];
+    list.push(e.sourceNodeId);
+    incoming.set(e.targetNodeId, list);
+  }
+  const memo = new Map;
+  const visiting = new Set;
+  const mustRun = (id) => {
+    const hit = memo.get(id);
+    if (hit)
+      return hit;
+    if (visiting.has(id))
+      return new Set;
+    visiting.add(id);
+    const ins = incoming.get(id) ?? [];
+    let acc = new Set;
+    if (ins.length > 0) {
+      const sets = ins.map((s) => new Set([...mustRun(s), s]));
+      const node = nodesById.get(id);
+      const isJoin = node !== undefined && (node.type === "core.logic.merge" || modelTypeOf(node) === "bpmn:ParallelGateway");
+      if (isJoin) {
+        for (const s of sets)
+          for (const x of s)
+            acc.add(x);
+      } else {
+        acc = new Set(sets[0]);
+        for (const s of sets.slice(1)) {
+          for (const x of [...acc])
+            if (!s.has(x))
+              acc.delete(x);
+        }
+      }
+    }
+    acc.add(id);
+    visiting.delete(id);
+    memo.set(id, acc);
+    return acc;
+  };
+  return mustRun;
+}
+function declaredOutputs(node, definition) {
+  const names = new Set;
+  if (node.outputs && typeof node.outputs === "object") {
+    for (const k of Object.keys(node.outputs))
+      names.add(k);
+  }
+  const outDef = definition?.outputDefinition;
+  if (outDef && typeof outDef === "object") {
+    for (const k of Object.keys(outDef))
+      names.add(k);
+  }
+  if (node.type === "core.subflow")
+    names.add("output");
+  const isListOutput = node.type.startsWith("uipath.connector.") && connectorOperation(node) === "list";
+  const declaredType = (name) => {
+    const entry = outDef?.[name];
+    const t = entry?.type;
+    return typeof t === "string" ? t : undefined;
+  };
+  const typeOf = (name) => name === "output" && isListOutput ? "array" : declaredType(name);
+  const whyArray = (name) => declaredType(name) === "array" ? 'declared type "array"' : 'a list operation — inputMetadata.operation is "list", the response is the bare array of records';
+  return { names, typeOf, whyArray };
+}
+function connectorOperation(node) {
+  const detail = node.inputs?.detail;
+  const op = detail?.inputMetadata?.operation;
+  return typeof op === "string" ? op.toLowerCase() : undefined;
+}
+function boundedEditDistance(a, b, max) {
+  if (Math.abs(a.length - b.length) > max)
+    return max + 1;
+  let prev = Array.from({ length: b.length + 1 }, (_, j) => j);
+  for (let i = 1;i <= a.length; i++) {
+    const cur = [i];
+    let rowMin = i;
+    for (let j = 1;j <= b.length; j++) {
+      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+      cur[j] = Math.min(prev[j] + 1, cur[j - 1] + 1, prev[j - 1] + cost);
+      rowMin = Math.min(rowMin, cur[j]);
+    }
+    if (rowMin > max)
+      return max + 1;
+    prev = cur;
+  }
+  return prev[b.length];
+}
+var HINT_MAX_EDITS = 2;
+var HINT_MIN_PREFIX = 3;
+function nearestNodeId(root, ids) {
+  const lower = root.toLowerCase();
+  let best;
+  let bestScore = Number.POSITIVE_INFINITY;
+  for (const id of ids) {
+    const l = id.toLowerCase();
+    if (l === lower)
+      return id;
+    if (lower.length < HINT_MIN_PREFIX)
+      continue;
+    let score = boundedEditDistance(lower, l, HINT_MAX_EDITS);
+    if (score > HINT_MAX_EDITS) {
+      const [short, long] = lower.length <= l.length ? [lower, l] : [l, lower];
+      const isPrefix = short.length >= HINT_MIN_PREFIX && short.length * 2 >= long.length && long.startsWith(short);
+      if (!isPrefix)
+        continue;
+      score = HINT_MAX_EDITS + (long.length - short.length);
+    }
+    if (score < bestScore) {
+      best = id;
+      bestScore = score;
+    }
+  }
+  return best;
+}
+function labelOf(node) {
+  return node.display?.label ?? node.id;
+}
+function arrayMemberIssue(args) {
+  const { names, typeOf, whyArray } = declaredOutputs(args.producer, args.definition);
+  if (!names.has(args.second) || typeOf(args.second) !== "array") {
+    return;
+  }
+  if (/^\d+$/.test(args.third) || ARRAY_MEMBERS.has(args.third)) {
+    return;
+  }
+  const { root, second, third } = args;
+  return {
+    path: args.path,
+    severity: args.undefinedSafe || args.embedded ? "warning" : args.severity,
+    message: `"${args.reader}" reads "${args.refText}", but "$vars.${root}.${second}" is an array (${whyArray(second)}), so ".${third}" is undefined. ` + `Iterate it (a Loop's collection is "$vars.${root}.${second}" itself), index it ("[0].${third}"), or use an Array method.`
+  };
+}
+function decisionUnpopulatedOutputIssue(args) {
+  if (args.producer.type !== DECISION_NODE_TYPE || !DECISION_UNPOPULATED_OUTPUTS.has(args.second)) {
+    return;
+  }
+  const { root, second } = args;
+  return {
+    path: args.path,
+    severity: "error",
+    message: `"${args.reader}" reads "${args.refText}", but a Decision never populates its "${second}" output at runtime — the packed flow emits the gateway with no output mapping, so "$vars.${root}.${second}" is always null (a branch or value chosen from it silently takes the wrong path). ` + `Route logic from the Decision's own output branches instead, or compute the value in an upstream node and read that.`
+  };
+}
+function validateVarsReferences(flow, options = {}) {
+  const issues = [];
+  const nodesById = new Map(flow.nodes.map((n) => [n.id, n]));
+  if (nodesById.size === 0)
+    return issues;
+  const knownRoots = new Set(options.extraKnownRoots ?? []);
+  const variables = flow.variables;
+  for (const g of variables?.globals ?? []) {
+    if (typeof g?.id === "string")
+      knownRoots.add(g.id);
+  }
+  const updatesByNode = variables?.variableUpdates ?? {};
+  const defByKey = new Map;
+  const defByType = new Map;
+  for (const d of flow.definitions) {
+    defByKey.set(`${d.nodeType}:${d.version}`, d);
+    if (!defByType.has(d.nodeType))
+      defByType.set(d.nodeType, d);
+  }
+  const definitionOf = (n) => (n.typeVersion ? defByKey.get(`${n.type}:${n.typeVersion}`) : undefined) ?? defByType.get(n.type);
+  const modelTypeOf = (n) => typeof n.model?.type === "string" ? n.model.type : definitionOf(n)?.model?.type;
+  const ancestors = buildAncestors(flow);
+  const mustRun = buildMustRun(flow, modelTypeOf);
+  const reported = new Set;
+  for (const occurrence of collectVarsRefs(flow.nodes, updatesByNode)) {
+    const node = nodesById.get(occurrence.nodeId);
+    if (!node)
+      continue;
+    const { ref, embedded } = occurrence;
+    const reader = labelOf(node);
+    const path = `nodes[${node.id}].${occurrence.fieldPath}`;
+    const severity = occurrence.fieldPath.startsWith("inputs") ? "error" : "warning";
+    const [root, second, third] = ref.segments;
+    const key = `${node.id}|${occurrence.fieldPath}|${ref.segments.join(".")}`;
+    if (reported.has(key))
+      continue;
+    reported.add(key);
+    if (root === node.id)
+      continue;
+    if (knownRoots.has(root))
+      continue;
+    const producer = nodesById.get(root);
+    const anc = ancestors.get(node.id) ?? new Set;
+    if (occurrence.isAgentBinding) {
+      if (producer && anc.size > 0 && anc.has(root)) {
+        if (!mustRun(node.id).has(root)) {
+          issues.push({
+            path,
+            severity: undefinedSafe(ref, 0) ? "warning" : severity,
+            message: `Agent "${reader}" input binds "${ref.text}", but "${root}" runs only on some of the paths that reach "${node.id}" (it sits behind a Decision or Switch branch the agent does not depend on). ` + "On the other paths the input is undefined and the agent invocation faults ([400300] Error evaluating expression in activity inputs). " + "Bind a node that runs on every path to the agent, or compute the value on each branch before they rejoin."
+          });
+        } else if (second !== undefined) {
+          const decisionIssue = decisionUnpopulatedOutputIssue({
+            producer,
+            root,
+            second,
+            reader,
+            refText: ref.text,
+            path
+          });
+          if (decisionIssue) {
+            issues.push(decisionIssue);
+          } else if (third !== undefined) {
+            const issue = arrayMemberIssue({
+              producer,
+              definition: definitionOf(producer),
+              root,
+              second,
+              third,
+              reader,
+              refText: ref.text,
+              path,
+              undefinedSafe: undefinedSafe(ref, 2),
+              embedded,
+              severity
+            });
+            if (issue)
+              issues.push(issue);
+          }
+        }
+      }
+      continue;
+    }
+    if (!producer) {
+      const hint = nearestNodeId(root, nodesById.keys());
+      issues.push({
+        path,
+        severity: undefinedSafe(ref, 0) ? "warning" : severity,
+        message: `"${reader}" reads "${ref.text}", but no node or workflow variable named "${root}" exists in this flow` + (hint ? ` (did you mean node "${hint}"?)` : "") + ". At runtime the reference resolves to nothing — a Script reading it faults ([300501]), a Decision or Switch faults ([400302]), a Transform or connector input silently gets an empty value. Fix the id or declare the variable under variables.globals."
+      });
+      continue;
+    }
+    if (anc.size > 0 && !anc.has(root)) {
+      const runsAfter = (ancestors.get(root) ?? new Set).has(node.id);
+      const why = runsAfter ? `"${root}" runs AFTER "${node.id}" (it is downstream of it)` : `"${root}" is not on any path that reaches "${node.id}" (another branch, or not connected)`;
+      issues.push({
+        path,
+        severity: undefinedSafe(ref, 0) ? "warning" : severity,
+        message: `"${reader}" reads "${ref.text}", but ${why}, so "${root}" has not produced a value when this expression is evaluated ` + "(Decision/Switch: [400302]; Script: [300501]; agent or connector input: [400300]/empty value). " + `Reference a node that runs earlier on this path, or move "${node.id}" after "${root}".`
+      });
+      continue;
+    }
+    if (second !== undefined) {
+      const decisionIssue = decisionUnpopulatedOutputIssue({
+        producer,
+        root,
+        second,
+        reader,
+        refText: ref.text,
+        path
+      });
+      if (decisionIssue) {
+        issues.push(decisionIssue);
+        continue;
+      }
+      const { names } = declaredOutputs(producer, definitionOf(producer));
+      const declaresOutputs = [...names].some((n) => n !== "error");
+      if (declaresOutputs && !names.has(second)) {
+        const available = [...names].sort((a, b) => a.localeCompare(b)).join(", ");
+        issues.push({
+          path,
+          severity: undefinedSafe(ref, 1) ? "warning" : severity,
+          message: `"${reader}" reads "${ref.text}", but node "${root}" has no output named "${second}" — its outputs are: ${available}. ` + `Read "$vars.${root}.<one of those>" (e.g. a Decision exposes "$vars.${root}.matchedCaseId", not ".output.matchedCaseId").`
+        });
+        continue;
+      }
+      if (third !== undefined) {
+        const issue = arrayMemberIssue({
+          producer,
+          definition: definitionOf(producer),
+          root,
+          second,
+          third,
+          reader,
+          refText: ref.text,
+          path,
+          undefinedSafe: undefinedSafe(ref, 2),
+          embedded,
+          severity
+        });
+        if (issue)
+          issues.push(issue);
+      }
+    }
+  }
+  return issues;
+}
+
+// ../flow-tool/src/services/flow-validate-service.ts
+if (!instance.isInitialized) {
+  instance.init({
+    lng: "en",
+    fallbackLng: "en",
+    defaultNS: "validation",
+    resources: {},
+    interpolation: { escapeValue: false }
+  });
+}
+registerFlowSchemaI18n(instance);
+function extractPromptVariables(content) {
+  const vars = new Set;
+  const re = /\{\{([^}]*)\}\}/g;
+  let m = re.exec(content);
+  while (m !== null) {
+    vars.add(m[1]);
+    m = re.exec(content);
+  }
+  return [...vars];
+}
+var VARS_NODE_OUTPUT_RE = /^=?\$vars\.([A-Za-z0-9_$]+)\.output\.([A-Za-z0-9_$]+)/;
+function getProducerOutputFields(node) {
+  if (AGENT_NODE_TYPES.includes(node.type)) {
+    const vars = node.inputs?.agentOutputVariables;
+    if (!Array.isArray(vars) || vars.length === 0)
+      return;
+    const fields = new Set;
+    for (const v of vars) {
+      const id = v?.id;
+      if (typeof id === "string")
+        fields.add(id);
+    }
+    return fields.size > 0 ? fields : undefined;
+  }
+  const output = node.outputs?.output;
+  const props = output?.properties;
+  if (props && typeof props === "object") {
+    return new Set(Object.keys(props));
+  }
+  return;
+}
+function decodeSchemaKeyNodeRef(key) {
+  const segments = key.split("__");
+  if (segments.length < 3)
+    return;
+  if (segments[0] === "metadata" || segments[1] !== "output")
+    return;
+  if (segments[0].length === 0)
+    return;
+  return { nodeId: segments[0], field: segments[2] || undefined };
+}
+function collectAgentInputVarIds(raw) {
+  const ids = new Set;
+  if (!Array.isArray(raw))
+    return ids;
+  for (const entry of raw) {
+    if (!entry || typeof entry !== "object")
+      continue;
+    const e = entry;
+    if (typeof e.id === "string" && e.id.length > 0)
+      ids.add(e.id);
+  }
+  return ids;
+}
+function readAgentSourceId(node) {
+  const fromInputs = node.inputs?.source;
+  if (typeof fromInputs === "string" && fromInputs.length > 0) {
+    return fromInputs;
+  }
+  return;
+}
+function formatHydrationHint(diag, flowDir) {
+  if (diag.sourceLocation === "missing") {
+    return "inline-agent source key not set on the node. Add `inputs.source = <projectId-uuid>` (canonical post-flow-core-0.2.50 location — the legacy `model.source` location is deprecated and rejected by validate) and ensure the colocated `<projectId>/agent.json` carries non-empty `messages[].content` for both system and user roles.";
+  }
+  const sourceId = diag.sourceId ?? "<projectId>";
+  const expectedAgentJson = diag.agentJsonPath ?? `${flowDir}/${sourceId}/agent.json`;
+  if (!diag.agentJsonExists) {
+    const dirPart = diag.agentDirExists ? "directory exists but" : "directory not found and";
+    return `agent.json not found at \`${expectedAgentJson}\` (${dirPart} agent.json file is missing). Re-run \`uip agent init "${flowDir}" --inline-in-flow\` and verify the returned ProjectId matches \`${diag.sourceLocation} = ${sourceId}\`.`;
+  }
+  if (!diag.messagesPresent) {
+    return `\`${expectedAgentJson}\` parsed but has no \`messages\` array. Restore the scaffold shape: \`messages: [{ role: "system", content: "..." }, { role: "user", content: "..." }]\`.`;
+  }
+  if (!diag.systemPromptPopulated && !diag.userPromptPopulated) {
+    return `\`${expectedAgentJson}\` has \`messages[]\` but both \`system\` and \`user\` content strings are empty (\`uip agent init --inline-in-flow\` scaffolds them empty by design). Populate \`messages[0].content\` (system) and \`messages[1].content\` (user) and rebuild \`contentTokens\` to match.`;
+  }
+  if (!diag.systemPromptPopulated) {
+    return `\`${expectedAgentJson}\` is missing or has empty \`messages[].content\` for role=\`system\`. Populate \`messages[0].content\`.`;
+  }
+  if (!diag.userPromptPopulated) {
+    return `\`${expectedAgentJson}\` is missing or has empty \`messages[].content\` for role=\`user\`. Populate \`messages[1].content\`.`;
+  }
+  return `inline-agent hydration ran but the validator still flagged \`${diag.sourceLocation}\`-resolved prompts as empty. This is unexpected — file an issue with the .flow and agent.json contents.`;
+}
+function collectNodeExpressionStrings(nodes) {
+  const expressions = [];
+  const collect = (val) => {
+    if (typeof val === "string") {
+      expressions.push(val);
+    } else if (Array.isArray(val)) {
+      for (const v of val)
+        collect(v);
+    } else if (val && typeof val === "object") {
+      for (const v of Object.values(val))
+        collect(v);
+    }
+  };
+  for (const n of nodes) {
+    collect(n.inputs);
+    collect(n.outputs);
+  }
+  return expressions;
+}
+function extractSupportsErrorHandling(content) {
+  const map = new Map;
+  let raw;
+  try {
+    raw = JSON.parse(content);
+  } catch {
+    return map;
+  }
+  if (!raw || typeof raw !== "object")
+    return map;
+  const defs = raw.definitions;
+  if (!Array.isArray(defs))
+    return map;
+  for (const def of defs) {
+    if (!def || typeof def !== "object")
+      continue;
+    const d = def;
+    if (typeof d.nodeType === "string" && typeof d.version === "string" && d.supportsErrorHandling === true) {
+      map.set(`${d.nodeType}:${d.version}`, true);
+    }
+  }
+  return map;
+}
+function normalizeManifestVersion(version) {
+  const raw = version ?? "1.0.0";
+  const parts = raw.split(".");
+  if (!parts.every((p) => /^\d+$/.test(p))) {
+    return raw;
+  }
+  while (parts.length > 2 && parts[parts.length - 1] === "0") {
+    parts.pop();
+  }
+  return parts.join(".");
+}
+function manifestVersionMatchesNode(nodeVersion, manifestVersion) {
+  return normalizeManifestVersion(nodeVersion) === normalizeManifestVersion(manifestVersion);
+}
+function formatHandleList(concrete, templates) {
+  const ports = [
+    ...concrete.keys(),
+    ...templates.map((t) => t.templateId.replace("{item.id}", "{id}"))
+  ];
+  return ports.length > 0 ? ports.join(", ") : "(none)";
+}
+function validationErrorToIssue(error) {
+  let path;
+  if (error.nodeId) {
+    path = error.fieldPath ? `nodes[${error.nodeId}].${error.fieldPath}` : `nodes[${error.nodeId}]`;
+  } else {
+    path = error.fieldPath ?? "(workflow)";
+  }
+  return {
+    path,
+    message: `[${error.code}] ${error.message}`,
+    severity: isBlockingSeverity(error.severity) ? "error" : "warning"
+  };
+}
+function buildValidationContext(flow) {
+  const nodes = toSerializedNodes(flow.nodes);
+  const edges = flow.edges.map((e) => ({
+    id: e.id,
+    source: e.sourceNodeId,
+    sourceHandle: e.sourcePort ?? null,
+    target: e.targetNodeId,
+    targetHandle: e.targetPort ?? null
+  }));
+  const manifests = new Map;
+  for (const def of flow.definitions) {
+    manifests.set(`${def.nodeType}:${def.version}`, {
+      nodeType: def.nodeType,
+      version: def.version,
+      category: def.category,
+      display: def.display,
+      handleConfiguration: def.handleConfiguration,
+      inputDefinition: def.inputDefinition,
+      outputDefinition: def.outputDefinition,
+      tags: def.tags
+    });
+  }
+  const outputVariableIds = [];
+  const variables = flow.variables;
+  if (variables?.globals) {
+    for (const v of variables.globals) {
+      if (v.direction === "out" || v.direction === "inout") {
+        outputVariableIds.push(v.id);
+      }
+    }
+  }
+  return {
+    nodes,
+    edges,
+    manifests,
+    outputVariableIds
+  };
+}
+function splitSchemaParseError(parseError) {
+  const header = "Schema validation failed:";
+  if (!parseError.startsWith(header)) {
+    return null;
+  }
+  const body = parseError.slice(header.length);
+  const lines = body.split(`
+`);
+  const issues = [];
+  for (const rawLine of lines) {
+    const match = /^\s*-\s+(.+?):\s(.*)$/.exec(rawLine);
+    if (!match)
+      continue;
+    const [, path, message] = match;
+    if (!path || !message)
+      continue;
+    issues.push({ path, message });
+  }
+  return issues.length > 0 ? issues : null;
+}
+
+class FlowValidateService {
+  fs;
+  extraRules;
+  nodeValidators;
+  governanceEnforcements;
+  availableModelNames;
+  validateCurrentManifests;
+  currentManifestOverrides;
+  strictBindings;
+  strictExpressions;
+  connectorCatalogOverride;
+  currentManifestCache;
+  connectorCatalogCache;
+  constructor(options = {}) {
+    this.fs = getFileSystem();
+    this.extraRules = options.extraRules ?? [];
+    this.nodeValidators = [
+      ...defaultNodeValidators,
+      ...options.extraNodeValidators ?? []
+    ];
+    this.governanceEnforcements = options.governanceEnforcements;
+    this.availableModelNames = options.availableModelNames;
+    this.validateCurrentManifests = options.validateCurrentManifests === true || options.currentManifests !== undefined;
+    this.currentManifestOverrides = options.currentManifests;
+    this.strictBindings = options.strictBindings === true;
+    this.strictExpressions = options.strictExpressions === true;
+    this.connectorCatalogOverride = options.connectorCatalog;
+  }
+  async execute(flowFilePath) {
+    const [error, result] = await catchError(this.validateFile(flowFilePath));
+    if (error) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: "Flow validation failed",
+        Instructions: error.message
+      });
+      if (error.stack) {
+        logger.error("Stack trace:");
+        logger.error(error.stack);
+      }
+      return 1;
+    }
+    if (!result.success) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: `Validation failed for ${result.filePath}`,
+        Instructions: `Found ${result.issues.filter((i) => i.severity === "error").length} error(s):
+${result.issues.map((i) => `  - [${i.severity}] [${i.path}] ${i.message}`).join(`
+`)}`
+      });
+      return 1;
+    }
+    const warnings = result.issues.filter((i) => i.severity === "warning");
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "FlowValidate",
+      Data: {
+        File: result.filePath,
+        Status: "Valid",
+        ...warnings.length > 0 && {
+          Warnings: `${warnings.length} warning(s):
+${warnings.map((i) => `  - [${i.path}] ${i.message}`).join(`
+`)}`
+        }
+      }
+    });
+    return 0;
+  }
+  async loadCurrentManifestMap() {
+    this.currentManifestCache ??= this.loadCurrentManifestMapUncached();
+    return this.currentManifestCache;
+  }
+  async loadCurrentManifestMapUncached() {
+    const manifests = this.currentManifestOverrides;
+    if (manifests) {
+      return new Map(manifests.map((m) => [m.nodeType.toLowerCase(), m]));
+    }
+    const [loginError, loginStatus] = await catchError(getLoginStatusAsync());
+    if (loginError) {
+      logger.warn(`Could not read login status for current manifest validation; using OOTB manifests: ${loginError.message}`);
+    }
+    const client = new ManifestClient({
+      baseUrl: loginStatus?.baseUrl || "localhost"
+    });
+    const auth = loginStatus?.loginStatus === "Logged in" && loginStatus.accessToken && loginStatus.tenantId && loginStatus.organizationId ? {
+      accessToken: loginStatus.accessToken,
+      tenantId: loginStatus.tenantId,
+      organizationId: loginStatus.organizationId
+    } : undefined;
+    const [error, manifest] = await catchError(client.getManifest({
+      ...auth && { auth },
+      inlineAgentNodes: true
+    }));
+    if (error || !manifest?.nodes) {
+      logger.warn(`Could not load current OOTB node manifests; skipping stale-handle validation: ${error?.message ?? "manifest response did not include nodes"}`);
+      return new Map;
+    }
+    return new Map(manifest.nodes.map((m) => [
+      m.nodeType.toLowerCase(),
+      m
+    ]));
+  }
+  async validateFile(flowFilePath) {
+    let absolutePath = this.fs.path.resolve(flowFilePath);
+    if (!await this.fs.exists(absolutePath)) {
+      throw new Error(`File not found: ${absolutePath}`);
+    }
+    const stats = await this.fs.stat(absolutePath);
+    if (stats?.isDirectory()) {
+      absolutePath = await resolveProjectFlowFile(absolutePath);
+    }
+    if (!absolutePath.endsWith(".flow")) {
+      throw new Error(`Expected a .flow file but got: ${this.fs.path.basename(absolutePath)}`);
+    }
+    logger.info(`
+Validating: ${absolutePath}
+`);
+    const content = await this.fs.readFile(absolutePath, "utf-8");
+    if (!content) {
+      throw new Error(`Could not read file: ${absolutePath}`);
+    }
+    const issues = [];
+    const parsed = parseWorkflowJson(content);
+    const { workflow, parseError, parseIssues } = parsed;
+    if (parseError || !workflow) {
+      const recoveredIssues = parseIssues && parseIssues.length > 0 ? parseIssues : parseError ? splitSchemaParseError(parseError) : null;
+      const fallback = [
+        {
+          path: "(root)",
+          message: parseError ?? "File is not valid JSON",
+          severity: "error"
+        }
+      ];
+      return {
+        success: false,
+        filePath: absolutePath,
+        issues: recoveredIssues && recoveredIssues.length > 0 ? recoveredIssues.map((pi) => ({
+          path: pi.path,
+          message: pi.message,
+          severity: "error"
+        })) : fallback
+      };
+    }
+    const rawDefErrorHandling = extractSupportsErrorHandling(content);
+    const currentManifests = this.validateCurrentManifests ? await this.loadCurrentManifestMap() : new Map;
+    const flowDir = this.fs.path.dirname(absolutePath);
+    const hydrationDiagnoses = await this.resolveAgentPrompts(workflow.nodes, flowDir);
+    issues.push(...await this.validateForwardMigration(content, absolutePath));
+    issues.push(...this.validateGraph(workflow, "", rawDefErrorHandling, currentManifests));
+    issues.push(...this.validateGlobalVariableUniqueness(workflow, ""));
+    issues.push(...this.validateGlobalTriggerBindings(workflow, ""));
+    issues.push(...this.validateTriggerScopedBareVarReads(workflow, ""));
+    issues.push(...this.validateUnboundInputGlobals(workflow, ""));
+    issues.push(...this.validateResourceBindings(workflow));
+    issues.push(...this.validateConnectionIdReuse(workflow));
+    issues.push(...this.validateDuplicateProcessTargets(workflow));
+    issues.push(...await this.validateConnectorBindingShapes(workflow));
+    issues.push(...this.validateAgentInputBindings(workflow, hydrationDiagnoses, ""));
+    issues.push(...this.validateAgentPromptInputRefs(workflow, hydrationDiagnoses, ""));
+    issues.push(...this.validateAgentInputScopeRefs(workflow, hydrationDiagnoses, ""));
+    issues.push(...this.validateVoiceAgentSettings(workflow, hydrationDiagnoses, ""));
+    issues.push(...await this.validateSolutionRegistrationAndLayout(absolutePath));
+    issues.push(...await validateExpressions(workflow, "", this.strictExpressions));
+    const subflows = workflow.subflows ?? {};
+    for (const [subflowId, entry] of Object.entries(subflows)) {
+      const subNodes = entry.nodes;
+      const subDiagnoses = await this.resolveAgentPrompts(subNodes, flowDir);
+      for (const [k, v] of subDiagnoses)
+        hydrationDiagnoses.set(k, v);
+      const subGraph = {
+        nodes: subNodes,
+        edges: entry.edges,
+        definitions: workflow.definitions,
+        variables: entry.variables
+      };
+      const prefix = `subflows[${subflowId}].`;
+      issues.push(...this.validateGraph(subGraph, prefix, rawDefErrorHandling, currentManifests, (workflow.variables?.globals ?? []).map((g) => g.id).filter((id) => typeof id === "string")));
+      issues.push(...this.validateGlobalVariableUniqueness(subGraph, prefix));
+      issues.push(...this.validateGlobalTriggerBindings(subGraph, prefix));
+      issues.push(...this.validateTriggerScopedBareVarReads(subGraph, prefix));
+      issues.push(...this.validateUnboundInputGlobals(subGraph, prefix));
+      issues.push(...this.validateAgentInputBindings(subGraph, hydrationDiagnoses, prefix));
+      issues.push(...this.validateAgentPromptInputRefs(subGraph, hydrationDiagnoses, prefix));
+      issues.push(...this.validateAgentInputScopeRefs(subGraph, hydrationDiagnoses, prefix));
+      issues.push(...this.rejectSubflowVoiceAgents(subGraph, prefix));
+      issues.push(...await validateExpressions({
+        ...subGraph,
+        subflows
+      }, prefix, this.strictExpressions));
+    }
+    this.enrichInlineAgentPromptIssues(issues, hydrationDiagnoses, flowDir);
+    return {
+      success: issues.filter((i) => i.severity === "error").length === 0,
+      filePath: absolutePath,
+      issues
+    };
+  }
+  async validateForwardMigration(content, absolutePath) {
+    let raw;
+    try {
+      raw = JSON.parse(content);
+    } catch {
+      return [];
+    }
+    if (!raw || typeof raw !== "object")
+      return [];
+    let resolved;
+    try {
+      ({ resolved } = await resolveWorkflowRefs(raw, createFlowRefResolver(this.fs), absolutePath));
+    } catch {
+      return [];
+    }
+    const check = checkForwardMigration(resolved);
+    if (check.ok)
+      return [];
+    return [
+      {
+        path: "version",
+        message: `[MIGRATION] ${check.message}`,
+        severity: "error"
+      }
+    ];
+  }
+  async resolveAgentPrompts(nodes, flowDir) {
+    const diagnoses = new Map;
+    for (const node of nodes) {
+      if (!AGENT_NODE_TYPES.includes(node.type))
+        continue;
+      const source = readAgentSourceId(node);
+      if (!source) {
+        diagnoses.set(node.id, {
+          sourceLocation: "missing",
+          agentDirExists: false,
+          agentJsonExists: false,
+          messagesPresent: false,
+          systemPromptPopulated: false,
+          userPromptPopulated: false
+        });
+        continue;
+      }
+      const sourceLocation = "inputs.source";
+      if (/[/\\.]/.test(source)) {
+        diagnoses.set(node.id, {
+          sourceLocation,
+          sourceId: source,
+          agentDirExists: false,
+          agentJsonExists: false,
+          messagesPresent: false,
+          systemPromptPopulated: false,
+          userPromptPopulated: false
+        });
+        continue;
+      }
+      if (!node.inputs)
+        node.inputs = {};
+      const inputs = node.inputs;
+      const diag = {
+        sourceLocation,
+        sourceId: source,
+        agentDirExists: false,
+        agentJsonExists: false,
+        messagesPresent: false,
+        systemPromptPopulated: false,
+        userPromptPopulated: false
+      };
+      diagnoses.set(node.id, diag);
+      const agentDir = this.fs.path.join(flowDir, source);
+      diag.agentDirExists = await this.fs.exists(agentDir);
+      const agentJsonPath = this.fs.path.join(agentDir, "agent.json");
+      diag.agentJsonPath = agentJsonPath;
+      diag.agentJsonExists = await this.fs.exists(agentJsonPath);
+      if (!diag.agentJsonExists)
+        continue;
+      const [readErr, raw] = await catchError(this.fs.readFile(agentJsonPath, "utf-8"));
+      if (readErr || !raw) {
+        diag.agentJsonUnparseable = true;
+        continue;
+      }
+      const [parseErr, agent] = await catchError(Promise.resolve(raw).then((s) => JSON.parse(s)));
+      if (parseErr || !agent) {
+        diag.agentJsonUnparseable = true;
+        continue;
+      }
+      const settings = agent.settings;
+      if (isVoiceAgentNodeType(node.type)) {
+        const voiceSettings = isRecord(settings) ? settings.voice : undefined;
+        diag.voiceSettingsPresent = isRecord(voiceSettings);
+        if (diag.voiceSettingsPresent && inputs.voice === undefined) {
+          inputs.voice = voiceSettings;
+        }
+        diag.isConversationalAgent = isRecord(agent.metadata) && agent.metadata.isConversational === true;
+      }
+      const messages = agent.messages;
+      if (!Array.isArray(messages))
+        continue;
+      diag.messagesPresent = true;
+      const systemVars = new Set;
+      const userVars = new Set;
+      for (const msg of messages) {
+        if (!msg || typeof msg !== "object")
+          continue;
+        const m = msg;
+        if (typeof m.content === "string") {
+          const target = m.role === "system" ? systemVars : userVars;
+          for (const v of extractPromptVariables(m.content)) {
+            target.add(v);
+          }
+        }
+        if (m.role === "system" && typeof m.content === "string") {
+          inputs.systemPrompt ??= m.content;
+          if (m.content.length > 0)
+            diag.systemPromptPopulated = true;
+        }
+        if (m.role === "user" && typeof m.content === "string") {
+          inputs.userPrompt ??= m.content;
+          if (m.content.length > 0)
+            diag.userPromptPopulated = true;
+        }
+      }
+      const byField = {};
+      if (systemVars.size > 0)
+        byField.systemPrompt = [...systemVars];
+      if (userVars.size > 0)
+        byField.userPrompt = [...userVars];
+      if (Object.keys(byField).length > 0) {
+        diag.promptVariablesByField = byField;
+      }
+      if (settings && typeof settings === "object") {
+        const s = settings;
+        if (typeof s.temperature === "number" && inputs.temperature === undefined) {
+          inputs.temperature = s.temperature;
+        }
+        if (typeof s.maxTokens === "number" && inputs.maxTokenPerResponse === undefined) {
+          inputs.maxTokenPerResponse = s.maxTokens;
+        }
+        if (typeof s.model === "string" && inputs.model === undefined) {
+          inputs.model = s.model;
+        }
+      }
+      const inputSchema = agent.inputSchema;
+      if (inputSchema && typeof inputSchema === "object") {
+        const props = inputSchema.properties;
+        if (props && typeof props === "object") {
+          diag.declaredInputKeys = Object.keys(props);
+          const leaves = collectAgentInputLeaves(inputSchema);
+          diag.declaredInputLeaves = leaves;
+          diag.declaredInputPaths = new Set([
+            ...leaves.map((leaf) => leaf.path),
+            ...diag.declaredInputKeys.map(canonicalAgentInputPath)
+          ]);
+        }
+      }
+    }
+    return diagnoses;
+  }
+  validateAgentInputBindings(graph, diagnoses, pathPrefix) {
+    const issues = [];
+    for (const node of graph.nodes) {
+      if (!AGENT_NODE_TYPES.includes(node.type))
+        continue;
+      const diag = diagnoses.get(node.id);
+      const declared = diag?.declaredInputKeys ?? [];
+      if (declared.length > 0)
+        continue;
+      if (!diag?.messagesPresent)
+        continue;
+      const provided = collectAgentInputVarIds(node.inputs?.agentInputVariables);
+      if (provided.size > 0) {
+        issues.push(this.buildIgnoredAgentInputsWarning(node, provided, pathPrefix));
+      }
+    }
+    return issues;
+  }
+  buildIgnoredAgentInputsWarning(node, provided, pathPrefix) {
+    const label = node.display?.label ?? node.id;
+    const many = provided.size > 1;
+    const quoted = [...provided].map((p) => `"${p}"`).join(", ");
+    return {
+      path: `${pathPrefix}nodes[${node.id}].inputs.agentInputVariables`,
+      message: `Agent "${label}" declares no inputs in its agent.json \`inputSchema\`, but the flow node binds ${provided.size} input${many ? "s" : ""} (${quoted}) under \`inputs.agentInputVariables\`. Because the agent.json \`inputSchema\` declares no inputs, at runtime ${many ? "these bindings are" : "this binding is"} silently dropped — the agent runs without the flow's inputs. Add the expected input${many ? "s" : ""} under \`inputSchema.properties\` in agent.json (then \`uip agent refresh --inline-in-flow\`), or remove the unused binding${many ? "s" : ""}.`,
+      severity: "warning"
+    };
+  }
+  validateAgentPromptInputRefs(graph, diagnoses, pathPrefix) {
+    const issues = [];
+    for (const node of graph.nodes) {
+      if (!AGENT_NODE_TYPES.includes(node.type))
+        continue;
+      const diag = diagnoses.get(node.id);
+      if (!diag?.messagesPresent)
+        continue;
+      const byField = diag.promptVariablesByField;
+      if (!byField)
+        continue;
+      const declared = new Set(diag.declaredInputKeys ?? []);
+      const declaredPaths = diag.declaredInputPaths ?? new Set;
+      const label = node.display?.label ?? node.id;
+      for (const [field, vars] of Object.entries(byField)) {
+        issues.push(...this.buildPromptInputRefIssues(node, field, vars ?? [], declared, declaredPaths, label, pathPrefix));
+      }
+    }
+    return issues;
+  }
+  rejectSubflowVoiceAgents(graph, pathPrefix) {
+    const issues = [];
+    for (const node of graph.nodes) {
+      if (!isVoiceAgentNodeType(node.type))
+        continue;
+      const label = node.display?.label ?? node.id;
+      issues.push({
+        path: `${pathPrefix}nodes[${node.id}]`,
+        message: `Voice agent "${label}": voice agent nodes are not supported inside subflows — move it to the top-level flow.`,
+        severity: "error"
+      });
+    }
+    return issues;
+  }
+  validateVoiceAgentSettings(graph, diagnoses, pathPrefix) {
+    const issues = [];
+    for (const node of graph.nodes) {
+      if (!isVoiceAgentNodeType(node.type))
+        continue;
+      const diag = diagnoses.get(node.id);
+      if (!diag || diag.sourceLocation === "missing")
+        continue;
+      const label = node.display?.label ?? node.id;
+      const agentJsonPath = diag.agentJsonPath ?? `${diag.sourceId}/agent.json`;
+      if (!diag.agentJsonExists) {
+        issues.push({
+          path: `${pathPrefix}nodes[${node.id}].inputs.source`,
+          message: `Voice agent "${label}": agent.json not found at \`${agentJsonPath}\`. A voice agent node needs its backing agent directory inside the flow project — create it with \`uip agent init "<flowDir>" --inline-in-flow --conversational\` (then add \`settings.voice\` to its agent.json) or fix \`inputs.source\`.`,
+          severity: "error"
+        });
+        continue;
+      }
+      if (diag.agentJsonUnparseable) {
+        issues.push({
+          path: `${pathPrefix}nodes[${node.id}].inputs.source`,
+          message: `Voice agent "${label}": \`${agentJsonPath}\` exists but is empty or not valid JSON. Fix the file — check for merge-conflict markers or a truncated write.`,
+          severity: "error"
+        });
+        continue;
+      }
+      if (diag.voiceSettingsPresent === false) {
+        issues.push({
+          path: `${pathPrefix}nodes[${node.id}].inputs.source`,
+          message: `Voice agent "${label}": \`${agentJsonPath}\` has no \`settings.voice\`. Add the voice settings object (model, maxTokens, temperature, persona).`,
+          severity: "error"
+        });
+      }
+      if (diag.isConversationalAgent === false) {
+        issues.push({
+          path: `${pathPrefix}nodes[${node.id}].inputs.source`,
+          message: `Voice agent "${label}": \`${agentJsonPath}\` is not a conversational agent. Voice agents run on the conversational engine — set \`metadata.isConversational: true\` and \`settings.engine: "conversational-v1"\`.`,
+          severity: "error"
+        });
+      }
+    }
+    return issues;
+  }
+  buildPromptInputRefIssues(node, field, vars, declared, declaredPaths, label, pathPrefix) {
+    const issues = [];
+    const malformed = [];
+    const undeclared = [];
+    for (const raw of vars) {
+      const key = this.canonicalInputKey(raw);
+      if (key === undefined) {
+        malformed.push(raw);
+      } else if (!declared.has(key) && !declaredPaths.has(canonicalAgentInputPath(key))) {
+        undeclared.push(key);
+      }
+    }
+    const path = `${pathPrefix}nodes[${node.id}].inputs.${field}`;
+    if (malformed.length > 0) {
+      const many = malformed.length > 1;
+      const quoted = malformed.map((r) => `{{${r}}}`).join(", ");
+      issues.push({
+        path,
+        message: `Agent "${label}"'s prompt has placeholder${many ? "s" : ""} ${quoted} that ${many ? "do" : "does"} not use the \`input.\` namespace. The runtime binds a placeholder only in the canonical \`{{input.<key>}}\` form, so ${many ? "these stay" : "this stays"} literal text at runtime even when the value is delivered. Rewrite ${many ? "them" : "it"} as \`{{input.<key>}}\` (and declare \`<key>\` under \`inputSchema.properties\`).`,
+        severity: "error"
+      });
+    }
+    if (undeclared.length > 0) {
+      const many = undeclared.length > 1;
+      const placeholders = undeclared.map((u) => `{{input.${u}}}`).join(", ");
+      const quoted = undeclared.map((u) => `"${u}"`).join(", ");
+      const schemaState = declared.size === 0 ? "the agent.json declares no `inputSchema.properties`" : `${many ? "they are" : "it is"} absent from the agent.json \`inputSchema.properties\` (which declares ${[...declared].map((d) => `"${d}"`).join(", ")})`;
+      issues.push({
+        path,
+        message: `Agent "${label}"'s prompt reads ${placeholders}, but ${schemaState}. The runtime only substitutes placeholders declared in \`inputSchema.properties\`, so at runtime ${many ? "these placeholders stay" : "this placeholder stays"} as ${many ? "literal tokens" : "a literal token"} — the agent receives the raw \`{{input.<key>}}\` text instead of the delivered value. Declare ${many ? "these inputs" : "this input"} (${quoted}) under \`inputSchema.properties\` in agent.json (e.g. \`uip agent refresh --inline-in-flow\`), or remove the placeholder${many ? "s" : ""} from the prompt.`,
+        severity: "error"
+      });
+    }
+    return issues;
+  }
+  validateAgentInputScopeRefs(graph, diagnoses, pathPrefix) {
+    const agentNodes = graph.nodes.filter((n) => AGENT_NODE_TYPES.includes(n.type));
+    if (agentNodes.length === 0)
+      return [];
+    const nodesById = new Map(graph.nodes.map((n) => [n.id, n]));
+    const nodeIds = new Set(nodesById.keys());
+    const globalIds = new Set((graph.variables?.globals ?? []).map((g) => g.id));
+    const incoming = new Map;
+    for (const edge of graph.edges) {
+      const sources = incoming.get(edge.targetNodeId);
+      if (sources)
+        sources.push(edge.sourceNodeId);
+      else
+        incoming.set(edge.targetNodeId, [edge.sourceNodeId]);
+    }
+    const issues = [];
+    for (const node of agentNodes) {
+      const { byNode: refs, byField } = this.collectAgentVarRefs(node, diagnoses.get(node.id), globalIds);
+      if (refs.size === 0)
+        continue;
+      const wired = incoming.has(node.id);
+      const upstream = wired ? this.collectUpstreamNodeIds(incoming, node.id) : new Set;
+      const missing = [];
+      const notUpstream = [];
+      for (const [refId, origin] of refs) {
+        if (!nodeIds.has(refId))
+          missing.push(origin);
+        else if (wired && !upstream.has(refId))
+          notUpstream.push(origin);
+      }
+      const label = node.display?.label ?? node.id;
+      const path = `${pathPrefix}nodes[${node.id}].inputs.agentInputVariables`;
+      const scope = pathPrefix ? "subflow" : "flow";
+      if (missing.length > 0) {
+        issues.push({
+          path,
+          message: `Agent "${label}" reads ${missing.join(", ")}, but no such node exists in this ${scope}. Studio Web rejects the flow on open with "that variable is not available in this scope", and at runtime the input resolves to nothing. Point the reference at an existing node id (then re-run \`uip agent refresh --inline-in-flow\` so agent.json and the node agree), or drop the input.`,
+          severity: "error"
+        });
+      }
+      if (notUpstream.length > 0) {
+        issues.push({
+          path,
+          message: `Agent "${label}" reads ${notUpstream.join(", ")}, but no edge path leads from that node to "${node.id}", so it has not run when the agent does and its output is not written yet ([400300] Error evaluating expression in activity inputs). Studio Web reports the same variable as not available in this scope. Wire the node upstream of the agent, or bind an input the agent can see.`,
+          severity: "error"
+        });
+      }
+      const invalidFields = [];
+      for (const ref of byField) {
+        if (!nodeIds.has(ref.nodeId))
+          continue;
+        const producer = nodesById.get(ref.nodeId);
+        if (!producer)
+          continue;
+        const outputFields = getProducerOutputFields(producer);
+        if (!outputFields)
+          continue;
+        if (outputFields.has(ref.field))
+          continue;
+        const available = [...outputFields].join(", ");
+        invalidFields.push(`${ref.origin} — node "${ref.nodeId}" has no output named "${ref.field}"` + (available ? ` (available: ${available})` : ""));
+      }
+      if (invalidFields.length > 0) {
+        issues.push({
+          path,
+          message: `Agent "${label}" reads ${invalidFields.join("; ")}. Fix the binding to use an output the producer node declares, or add the missing output to the producer.`,
+          severity: "error"
+        });
+      }
+    }
+    return issues;
+  }
+  collectAgentVarRefs(node, diag, globalIds) {
+    const byNode = new Map;
+    const fieldSeen = new Set;
+    const byField = [];
+    const add = (nodeId, field, origin) => {
+      if (globalIds.has(nodeId))
+        return;
+      if (!byNode.has(nodeId))
+        byNode.set(nodeId, origin);
+      if (field) {
+        const fk = `${nodeId}\x00${field}`;
+        if (!fieldSeen.has(fk)) {
+          fieldSeen.add(fk);
+          byField.push({ nodeId, field, origin });
+        }
+      }
+    };
+    for (const leaf of diag?.declaredInputLeaves ?? []) {
+      const ref = decodeSchemaKeyNodeRef(leaf.flatKey);
+      if (ref) {
+        add(ref.nodeId, ref.field, `\`$vars.${leaf.path}\` (agent.json input "${leaf.flatKey}")`);
+      }
+    }
+    const bound = node.inputs?.agentInputVariables;
+    if (Array.isArray(bound)) {
+      for (const entry of bound) {
+        if (!entry || typeof entry !== "object")
+          continue;
+        const binding = entry.binding;
+        if (typeof binding !== "string")
+          continue;
+        const match = VARS_NODE_OUTPUT_RE.exec(binding);
+        if (!match)
+          continue;
+        add(match[1], match[2], `\`${binding.replace(/^=/, "")}\` (agentInputVariables binding)`);
+      }
+    }
+    return { byNode, byField };
+  }
+  collectUpstreamNodeIds(incoming, targetId) {
+    const upstream = new Set;
+    const queue = [targetId];
+    while (queue.length > 0) {
+      const current = queue.pop();
+      for (const source of incoming.get(current) ?? []) {
+        if (upstream.has(source))
+          continue;
+        upstream.add(source);
+        queue.push(source);
+      }
+    }
+    return upstream;
+  }
+  canonicalInputKey(rawVar) {
+    if (!rawVar.startsWith("input."))
+      return;
+    const key = rawVar.slice("input.".length);
+    if (key.length === 0 || key !== key.trim())
+      return;
+    return key;
+  }
+  enrichInlineAgentPromptIssues(issues, diagnoses, flowDir) {
+    if (diagnoses.size === 0)
+      return;
+    const promptFieldRe = /\bnodes\[([^\]]+)\]\.inputs\.(systemPrompt|userPrompt)/;
+    for (const issue of issues) {
+      if (!issue.message.includes("REQUIRED_FIELD"))
+        continue;
+      const m = promptFieldRe.exec(issue.path);
+      if (!m)
+        continue;
+      const nodeId = m[1];
+      const diag = diagnoses.get(nodeId);
+      if (!diag)
+        continue;
+      const hint = formatHydrationHint(diag, flowDir);
+      issue.message = `${issue.message}
+    Hint: ${hint}`;
+    }
+  }
+  validateGraph(graph, pathPrefix, rawDefErrorHandling = new Map, currentManifests = new Map, parentVariableIds = []) {
+    const issues = [];
+    issues.push(...this.validateEdgeReferences(graph));
+    issues.push(...this.validateNodeTypeDefinitions(graph));
+    issues.push(...this.validateUniqueIds(graph), ...this.validateExclusiveBranchJoins(graph), ...validateVarsReferences(graph, {
+      extraKnownRoots: parentVariableIds
+    }));
+    issues.push(...this.validateEdgeHandles(graph, rawDefErrorHandling));
+    issues.push(...this.validateEdgeHandlesAgainstCurrentManifests(graph, currentManifests));
+    const ctx = buildValidationContext(graph);
+    if (this.governanceEnforcements) {
+      ctx.governanceEnforcements = this.governanceEnforcements;
+    }
+    if (this.availableModelNames) {
+      ctx.availableModelNames = this.availableModelNames;
+    }
+    const dropped = new Set(["expression-ref"]);
+    if (pathPrefix)
+      dropped.add("trigger-required");
+    const rules = cliRules.filter((r) => !dropped.has(r.id));
+    const ruleErrors = runRules([
+      ...rules,
+      conditionExpressionRule,
+      ...this.extraRules
+    ], ctx);
+    issues.push(...ruleErrors.map(validationErrorToIssue));
+    issues.push(...this.runNodeValidators(graph));
+    return pathPrefix ? issues.map((i) => ({ ...i, path: `${pathPrefix}${i.path}` })) : issues;
+  }
+  validateExclusiveBranchJoins(flow) {
+    const graph = indexJoinGraph(flow);
+    const issues = [];
+    for (const node of flow.nodes) {
+      const finding = findUnsatisfiableJoin(node, graph);
+      if (finding) {
+        issues.push(describeUnsatisfiableJoin(node, finding, graph));
+      }
+    }
+    return issues;
+  }
+  validateEdgeReferences(flow) {
+    const issues = [];
+    const nodeIds = new Set(flow.nodes.map((n) => n.id));
+    for (const edge of flow.edges) {
+      if (!nodeIds.has(edge.sourceNodeId)) {
+        issues.push({
+          path: `edges[${edge.id}].sourceNodeId`,
+          message: `Edge references non-existent source node: "${edge.sourceNodeId}"`,
+          severity: "error"
+        });
+      }
+      if (!nodeIds.has(edge.targetNodeId)) {
+        issues.push({
+          path: `edges[${edge.id}].targetNodeId`,
+          message: `Edge references non-existent target node: "${edge.targetNodeId}"`,
+          severity: "error"
+        });
+      }
+    }
+    return issues;
+  }
+  validateNodeTypeDefinitions(flow) {
+    const issues = [];
+    const definedTypes = new Set(flow.definitions.map((d) => `${d.nodeType}:${d.version}`));
+    const definedVersionsByType = new Map;
+    for (const d of flow.definitions) {
+      const versions = definedVersionsByType.get(d.nodeType) ?? [];
+      versions.push(d.version);
+      definedVersionsByType.set(d.nodeType, versions);
+    }
+    for (const node of flow.nodes) {
+      if (UI_ONLY_NODE_TYPES.has(node.type)) {
+        continue;
+      }
+      const key = `${node.type}:${node.typeVersion}`;
+      if (!definedTypes.has(key)) {
+        const sameTypeVersions = definedVersionsByType.get(node.type);
+        const hint = sameTypeVersions?.length ? `
+    Hint: \`definitions[]\` has \`${node.type}\` at version(s) ${sameTypeVersions.map((v) => `"${v}"`).join(", ")} but the node uses \`typeVersion: "${node.typeVersion}"\`. Align one side — \`typeVersion\` must match the definition's \`version\` exactly (e.g., \`"1.0"\` ≠ \`"1.0.0"\`).` : `
+    Hint: run \`uip maestro flow registry get ${node.type} --output json\` and append the returned node object to \`definitions[]\` (depending on plugin version, the object is at \`Data.Node\` or the top level). Set \`typeVersion\` to the returned \`version\` exactly — registry may emit \`"1.0"\` while older flows used \`"1.0.0"\`. To scaffold a new node with its definition auto-injected, run \`uip maestro flow node add <file> ${node.type}\` instead.`;
+        issues.push({
+          path: `nodes[${node.id}].type`,
+          message: `Node type "${key}" has no matching definition.${hint}`,
+          severity: "error"
+        });
+      }
+    }
+    return issues;
+  }
+  validateUniqueIds(flow) {
+    const issues = [];
+    const nodeIds = new Map;
+    for (const node of flow.nodes) {
+      nodeIds.set(node.id, (nodeIds.get(node.id) ?? 0) + 1);
+    }
+    for (const [id, count] of nodeIds) {
+      if (count > 1) {
+        issues.push({
+          path: `nodes`,
+          message: `Duplicate node ID: "${id}" (appears ${count} times)`,
+          severity: "error"
+        });
+      }
+    }
+    const edgeIds = new Map;
+    for (const edge of flow.edges) {
+      edgeIds.set(edge.id, (edgeIds.get(edge.id) ?? 0) + 1);
+    }
+    for (const [id, count] of edgeIds) {
+      if (count > 1) {
+        issues.push({
+          path: `edges`,
+          message: `Duplicate edge ID: "${id}" (appears ${count} times)`,
+          severity: "error"
+        });
+      }
+    }
+    return issues;
+  }
+  validateGlobalVariableUniqueness(flow, pathPrefix) {
+    const issues = [];
+    const globals = flow.variables?.globals ?? [];
+    const varCounts = new Map;
+    for (const v of globals) {
+      if (!v.id)
+        continue;
+      varCounts.set(v.id, (varCounts.get(v.id) ?? 0) + 1);
+    }
+    for (const [id, count] of varCounts) {
+      if (count > 1) {
+        issues.push({
+          path: `${pathPrefix}variables.globals`,
+          message: `Duplicate variable ID: "${id}" (appears ${count} times)`,
+          severity: "error"
+        });
+      }
+    }
+    return issues;
+  }
+  validateGlobalTriggerBindings(flow, pathPrefix) {
+    const issues = [];
+    const nodes = flow.nodes ?? [];
+    const globals = flow.variables?.globals ?? [];
+    const inGlobals = new Map;
+    for (const g of globals) {
+      if (g.id && g.direction === "in") {
+        inGlobals.set(g.id, g.triggerNodeId);
+      }
+    }
+    if (inGlobals.size === 0)
+      return issues;
+    const triggerNodeIds = new Set(nodes.filter((n) => typeof n.type === "string" && n.type.startsWith("core.trigger.")).map((n) => n.id));
+    if (triggerNodeIds.size === 0)
+      return issues;
+    const expressions = collectNodeExpressionStrings(nodes);
+    const refRe = /\$vars\.([A-Za-z0-9_$]+)\.output\.([A-Za-z0-9_$]+)/g;
+    const reported = new Set;
+    for (const expr of expressions) {
+      for (const match of expr.matchAll(refRe)) {
+        const refNode = match[1];
+        const refField = match[2];
+        if (!triggerNodeIds.has(refNode))
+          continue;
+        if (!inGlobals.has(refField))
+          continue;
+        const boundTo = inGlobals.get(refField);
+        if (boundTo === refNode)
+          continue;
+        const key = `${refField}->${refNode}`;
+        if (reported.has(key))
+          continue;
+        reported.add(key);
+        const detail = boundTo ? `its "triggerNodeId" is "${boundTo}", not "${refNode}"` : `it has no "triggerNodeId"`;
+        issues.push({
+          path: `${pathPrefix}variables.globals[${refField}].triggerNodeId`,
+          message: `Input variable "${refField}" is read via \`$vars.${refNode}.output.${refField}\`, but ${detail}. At runtime the trigger "${refNode}" output will not contain "${refField}", so the value resolves to null (a downstream node may fault, e.g. "Cannot read property '…' of null"). Set "triggerNodeId": "${refNode}" on the "${refField}" global.`,
+          severity: "warning"
+        });
+      }
+    }
+    return issues;
+  }
+  validateTriggerScopedBareVarReads(flow, pathPrefix) {
+    const issues = [];
+    const nodes = flow.nodes ?? [];
+    const globals = flow.variables?.globals ?? [];
+    const triggerNodeIds = new Set(nodes.filter((n) => isStartEventNode({
+      id: n.id,
+      type: n.type,
+      typeVersion: n.typeVersion ?? "1.0"
+    })).map((n) => n.id));
+    if (triggerNodeIds.size === 0)
+      return issues;
+    const boundInGlobals = new Map;
+    for (const g of globals) {
+      if (g.id && g.direction === "in" && g.triggerNodeId && triggerNodeIds.has(g.triggerNodeId)) {
+        boundInGlobals.set(g.id, g.triggerNodeId);
+      }
+    }
+    if (boundInGlobals.size === 0)
+      return issues;
+    const nodeIds = new Set(nodes.map((n) => n.id));
+    const updatesByNode = flow.variables?.variableUpdates ?? {};
+    const reported = new Set;
+    for (const { ref } of collectVarsRefs(nodes, updatesByNode)) {
+      if (ref.inProse)
+        continue;
+      const root = ref.segments[0];
+      if (nodeIds.has(root))
+        continue;
+      const trigger = boundInGlobals.get(root);
+      if (!trigger)
+        continue;
+      if (reported.has(root))
+        continue;
+      reported.add(root);
+      issues.push({
+        path: `${pathPrefix}variables.globals[${root}]`,
+        message: `Input variable "${root}" is trigger-scoped (its "triggerNodeId" is "${trigger}"), but it is read as \`${ref.text}\`. At runtime that value is surfaced only under the trigger output, so the read resolves to null (it may look fine with a manual trigger, which also emits a process-level input, then fault or use a wrong value under a connector or scheduled trigger). Read it as \`$vars.${trigger}.output.${root}\`.`,
+        severity: "error"
+      });
+    }
+    return issues;
+  }
+  validateUnboundInputGlobals(flow, pathPrefix) {
+    const issues = [];
+    const nodes = flow.nodes ?? [];
+    const inGlobals = (flow.variables?.globals ?? []).filter((g) => g.id && g.direction === "in");
+    if (inGlobals.length === 0)
+      return issues;
+    const triggerNodes = nodes.filter((n) => isStartEventNode({
+      id: n.id,
+      type: n.type,
+      typeVersion: n.typeVersion ?? "1.0"
+    }));
+    if (triggerNodes.length === 0)
+      return issues;
+    const definitions = flow.definitions ?? [];
+    const manifestInputIds = (node) => {
+      const def = definitions.find((d) => d.nodeType === node.type && d.version === node.typeVersion) ?? definitions.find((d) => d.nodeType === node.type);
+      const props = def?.outputDefinition?.output?.schema?.properties;
+      return props && typeof props === "object" ? Object.keys(props) : [];
+    };
+    const manifestInputs = new Set;
+    const globalsDrivenTriggers = [];
+    for (const t of triggerNodes) {
+      const ids = manifestInputIds(t);
+      if (ids.length > 0) {
+        for (const id of ids)
+          manifestInputs.add(id);
+      } else {
+        globalsDrivenTriggers.push(t.id);
+      }
+    }
+    if (globalsDrivenTriggers.length === 0)
+      return issues;
+    const triggerIds = new Set(triggerNodes.map((n) => n.id));
+    const readViaTrigger = new Set;
+    const refRe = /\$vars\.([A-Za-z0-9_$]+)\.output\.([A-Za-z0-9_$]+)/g;
+    for (const expr of collectNodeExpressionStrings(nodes)) {
+      for (const match of expr.matchAll(refRe)) {
+        if (triggerIds.has(match[1]))
+          readViaTrigger.add(match[2]);
+      }
+    }
+    const soleTrigger = globalsDrivenTriggers.length === 1 ? globalsDrivenTriggers[0] : undefined;
+    for (const g of inGlobals) {
+      if (g.triggerNodeId && triggerIds.has(g.triggerNodeId))
+        continue;
+      if (readViaTrigger.has(g.id))
+        continue;
+      if (manifestInputs.has(g.id))
+        continue;
+      const detail = g.triggerNodeId ? `its "triggerNodeId" is "${g.triggerNodeId}", which is not a trigger node in this flow` : `it has no "triggerNodeId"`;
+      const fix = soleTrigger ? `Set "triggerNodeId": "${soleTrigger}" on the "${g.id}" global.` : `Set "triggerNodeId" on the "${g.id}" global to the trigger that supplies it (${globalsDrivenTriggers.join(", ")}).`;
+      issues.push({
+        path: `${pathPrefix}variables.globals[${g.id}].triggerNodeId`,
+        message: `Input variable "${g.id}" is omitted from the packed entry point's \`input.properties\` because ${detail}. A deployed process or trigger then has no way to pass "${g.id}" — while \`flow validate\`, \`flow format\`, and \`flow debug --inputs\` all stay green. ${fix}`,
+        severity: "warning"
+      });
+    }
+    return issues;
+  }
+  validateResourceBindings(workflow) {
+    const issues = [];
+    const bindings = workflow.bindings ?? [];
+    const declaredKeys = new Set(bindings.map((b) => b.resourceKey));
+    const definitions = workflow.definitions;
+    const subflows = workflow.subflows ?? {};
+    const allNodes = [
+      ...workflow.nodes.map((n) => ({
+        id: n.id,
+        type: n.type,
+        typeVersion: n.typeVersion,
+        inputs: n.inputs,
+        scope: ""
+      })),
+      ...Object.entries(subflows).flatMap(([subflowId, sub]) => (sub.nodes ?? []).map((n) => ({
+        id: n.id,
+        type: n.type,
+        typeVersion: n.typeVersion,
+        inputs: n.inputs,
+        scope: `subflows[${subflowId}].`
+      })))
+    ];
+    for (const node of allNodes) {
+      if (!isProcessNode({ nodeType: node.type }))
+        continue;
+      const needed = collectNodeBindingResourceKeys(node, bindings, definitions);
+      for (const key of needed) {
+        if (declaredKeys.has(key))
+          continue;
+        issues.push({
+          path: `${node.scope}nodes[${node.id}].bindings`,
+          message: `Resource node "${node.id}" (type ${node.type}) references binding key "${key}" that is not declared in workflow.bindings. Add the binding entry; otherwise the runtime fails as "Failure in the Orchestrator Job".`,
+          severity: "error"
+        });
+      }
+    }
+    return issues;
+  }
+  validateConnectionIdReuse(workflow) {
+    const issues = [];
+    const subflows = workflow.subflows ?? {};
+    const buckets = new Map;
+    function recordNode(node, scope) {
+      const detail = node.inputs?.detail;
+      const connId = detail?.connectionResourceId;
+      if (typeof connId !== "string" || connId.length === 0)
+        return;
+      let list = buckets.get(connId);
+      if (!list) {
+        list = [];
+        buckets.set(connId, list);
+      }
+      list.push({ nodeId: node.id, scope });
+    }
+    for (const node of workflow.nodes) {
+      recordNode(node, "");
+    }
+    for (const [subflowId, sub] of Object.entries(subflows)) {
+      for (const node of sub.nodes ?? []) {
+        recordNode(node, `subflows[${subflowId}].`);
+      }
+    }
+    for (const [connId, occurrences] of buckets) {
+      if (occurrences.length < 2)
+        continue;
+      const nodeList = occurrences.map((o) => `${o.scope}nodes[${o.nodeId}]`).join(", ");
+      const first = occurrences[0];
+      issues.push({
+        path: `${first.scope}nodes[${first.nodeId}].inputs.detail.connectionResourceId`,
+        severity: "warning",
+        message: `Connection "${connId}" is referenced by ${occurrences.length} nodes (${nodeList}). Shared connections cause cross-node state leakage at runtime. If this is intentional (e.g. two connectors on the same SaaS account), ignore this warning; otherwise create a separate connection per node.`
+      });
+    }
+    return issues;
+  }
+  validateDuplicateProcessTargets(workflow) {
+    const issues = [];
+    const subflows = workflow.subflows ?? {};
+    const definitions = workflow.definitions;
+    const buckets = new Map;
+    const recordNode = (node, scope) => {
+      const target = resolveProcessTarget(node, definitions);
+      if (!target)
+        return;
+      const bucketKey = `${target.subType}\x00${target.key}`;
+      let list = buckets.get(bucketKey);
+      if (!list) {
+        list = [];
+        buckets.set(bucketKey, list);
+      }
+      list.push({
+        nodeId: node.id,
+        label: node.display?.label ?? "",
+        scope,
+        targetKey: target.key
+      });
+    };
+    for (const node of workflow.nodes) {
+      recordNode(node, "");
+    }
+    for (const [subflowId, sub] of Object.entries(subflows)) {
+      for (const node of sub.nodes ?? []) {
+        recordNode(node, `subflows[${subflowId}].`);
+      }
+    }
+    for (const occurrences of buckets.values()) {
+      if (occurrences.length < 2)
+        continue;
+      const distinctLabels = new Set(occurrences.map((o) => o.label));
+      if (distinctLabels.size < 2)
+        continue;
+      const nodeList = occurrences.map((o) => `${o.scope}nodes[${o.nodeId}] ("${o.label}")`).join(", ");
+      const first = occurrences[0];
+      issues.push({
+        path: `${first.scope}nodes[${first.nodeId}]`,
+        severity: "warning",
+        message: `Process target "${first.targetKey}" is invoked by ${occurrences.length} differently-named nodes (${nodeList}). Two differently-named nodes resolving to the same process/function usually means a node was duplicated without re-pointing its target — verify each node calls the intended process. If this reuse is intentional, ignore this warning.`
+      });
+    }
+    return issues;
+  }
+  async validateConnectorBindingShapes(workflow) {
+    const catalog = await this.loadConnectorCatalogCached();
+    return validateConnectorBindings(workflow, catalog, {
+      strict: this.strictBindings
+    });
+  }
+  async loadConnectorCatalogCached() {
+    if (this.connectorCatalogOverride) {
+      return this.connectorCatalogOverride;
+    }
+    this.connectorCatalogCache ??= loadConnectorCatalog();
+    return this.connectorCatalogCache;
+  }
+  async validateSolutionRegistrationAndLayout(absolutePath) {
+    const issues = [];
+    const flowDir = this.fs.path.dirname(absolutePath);
+    const discovery = await findNearestParentUipxFile(this.fs, absolutePath);
+    if (discovery.status !== "found") {
+      return issues;
+    }
+    const [readErr, manifest] = await readSolutionManifest(this.fs, discovery.solutionFile);
+    if (readErr || !manifest) {
+      return issues;
+    }
+    const solutionDir = this.fs.path.dirname(discovery.solutionFile);
+    const flowDirReal = await this.canonicalizePath(flowDir);
+    let isRegistered = false;
+    for (const p of manifest.projects) {
+      const projectDir = this.fs.path.resolve(solutionDir, this.fs.path.dirname(p.ProjectRelativePath));
+      const projectDirReal = await this.canonicalizePath(projectDir);
+      if (projectDirReal === flowDirReal) {
+        isRegistered = true;
+        break;
+      }
+    }
+    if (!isRegistered) {
+      issues.push({
+        path: "(workflow)",
+        severity: "warning",
+        message: `.flow file at ${absolutePath} is not registered as a project of solution ${discovery.solutionFile}. Run \`uip solution projects add "${flowDir}"\` so Studio Web and \`flow debug\` can discover it.`
+      });
+    }
+    const flowBase = this.fs.path.basename(absolutePath, ".flow");
+    const dirBase = this.fs.path.basename(flowDir);
+    if (flowBase !== dirBase) {
+      issues.push({
+        path: "(workflow)",
+        severity: "warning",
+        message: `.flow file at ${absolutePath} does not match canonical layout. Expected the .flow basename ("${flowBase}") to match its parent directory name ("${dirBase}"). The canonical layout is <solution>/<projectName>/<projectName>.flow.`
+      });
+    }
+    return issues;
+  }
+  async canonicalizePath(p) {
+    const [err, real] = await catchError(this.fs.realpath(p));
+    return err || !real ? p : real;
+  }
+  validateEdgeHandlesAgainstCurrentManifests(flow, currentManifests) {
+    const issues = [];
+    if (currentManifests.size === 0)
+      return issues;
+    const nodeById = new Map(flow.nodes.map((n) => [n.id, n]));
+    const handlesByNode = new Map;
+    for (const node of flow.nodes) {
+      const currentManifest = currentManifests.get(node.type.toLowerCase());
+      if (!currentManifest)
+        continue;
+      if (!manifestVersionMatchesNode(node.typeVersion, currentManifest.version)) {
+        continue;
+      }
+      const entry = {
+        source: new Map,
+        target: new Map,
+        sourceTemplates: [],
+        targetTemplates: [],
+        sourceDeclared: false
+      };
+      const handleConfiguration = currentManifest.handleConfiguration ?? [];
+      for (const group of handleConfiguration) {
+        for (const handle of group.handles ?? []) {
+          if (handle.type !== "source" && handle.type !== "target") {
+            continue;
+          }
+          const concreteTarget = handle.type === "source" ? entry.source : entry.target;
+          const templateTarget = handle.type === "source" ? entry.sourceTemplates : entry.targetTemplates;
+          for (const id of expandHandleIds(handle, node)) {
+            if (isTemplatedHandleId(id)) {
+              templateTarget.push({
+                templateId: id,
+                position: group.position
+              });
+            } else {
+              concreteTarget.set(id, {
+                position: group.position
+              });
+            }
+          }
+        }
+      }
+      if (currentManifest.supportsErrorHandling === true && !entry.source.has("error")) {
+        entry.source.set("error", {});
+      }
+      const sourceSetDeclared = [...entry.source.values()].some((info) => info.position !== undefined) || entry.sourceTemplates.length > 0;
+      entry.sourceDeclared = sourceSetDeclared;
+      const customization = deriveHandleCustomizationSourceOverride(node);
+      if (customization && sourceSetDeclared) {
+        const overriddenPositions = new Set(customization.positions);
+        for (const [handleId, info] of [...entry.source]) {
+          if (info.position !== undefined && overriddenPositions.has(info.position)) {
+            entry.source.delete(handleId);
+          }
+        }
+        entry.sourceTemplates = entry.sourceTemplates.filter((template) => template.position === undefined || !overriddenPositions.has(template.position));
+        for (const handleId of customization.sourceHandleIds) {
+          entry.source.set(handleId, {});
+        }
+      }
+      handlesByNode.set(node.id, entry);
+    }
+    const resolveHandle = (nodeHandles, side, port) => {
+      if (!nodeHandles)
+        return true;
+      const concrete = nodeHandles[side];
+      if (concrete.has(port))
+        return true;
+      const templates = side === "source" ? nodeHandles.sourceTemplates : nodeHandles.targetTemplates;
+      return templates.some((t) => portMatchesTemplate(port, t.templateId));
+    };
+    const hasAnyHandles = (nodeHandles, side) => {
+      if (!nodeHandles)
+        return false;
+      if (side === "source")
+        return nodeHandles.sourceDeclared;
+      return nodeHandles.target.size + nodeHandles.targetTemplates.length > 0;
+    };
+    const availablePorts = (nodeHandles, side) => nodeHandles ? formatHandleList(nodeHandles[side], side === "source" ? nodeHandles.sourceTemplates : nodeHandles.targetTemplates) : "(none)";
+    for (const edge of flow.edges) {
+      const sourceNode = nodeById.get(edge.sourceNodeId);
+      const sourceHandles = handlesByNode.get(edge.sourceNodeId);
+      if (sourceNode && hasAnyHandles(sourceHandles, "source") && !resolveHandle(sourceHandles, "source", edge.sourcePort)) {
+        issues.push({
+          path: `edges[${edge.id}].sourcePort`,
+          message: `Edge references source handle "${edge.sourcePort}" on node "${edge.sourceNodeId}", but the current manifest for "${sourceNode.type}" does not declare that handle. The .flow definition appears stale; refresh the node definition from the registry and rewire to one of: ${availablePorts(sourceHandles, "source")}`,
+          severity: "error"
+        });
+      }
+      const targetNode = nodeById.get(edge.targetNodeId);
+      const targetHandles = handlesByNode.get(edge.targetNodeId);
+      if (targetNode && hasAnyHandles(targetHandles, "target") && !resolveHandle(targetHandles, "target", edge.targetPort)) {
+        issues.push({
+          path: `edges[${edge.id}].targetPort`,
+          message: `Edge references target handle "${edge.targetPort}" on node "${edge.targetNodeId}", but the current manifest for "${targetNode.type}" does not declare that handle. The .flow definition appears stale; refresh the node definition from the registry and rewire to one of: ${availablePorts(targetHandles, "target")}`,
+          severity: "error"
+        });
+      }
+    }
+    return issues;
+  }
+  validateEdgeHandles(flow, rawDefErrorHandling = new Map) {
+    const issues = [];
+    const defByKey = new Map;
+    for (const def of flow.definitions) {
+      const key = `${def.nodeType}:${def.version}`;
+      defByKey.set(key, {
+        handleConfiguration: def.handleConfiguration ?? [],
+        supportsErrorHandling: rawDefErrorHandling.get(key) === true
+      });
+    }
+    const nodeById = new Map(flow.nodes.map((node) => [node.id, node]));
+    const handlesByNode = new Map;
+    const handleCustomizedNodes = new Map;
+    for (const node of flow.nodes) {
+      const version = node.typeVersion ?? "1.0.0";
+      const defEntry = defByKey.get(`${node.type}:${version}`);
+      if (!defEntry)
+        continue;
+      const entry = {
+        source: new Map,
+        target: new Map,
+        sourceTemplates: [],
+        targetTemplates: [],
+        sourceDeclared: false
+      };
+      for (const group of defEntry.handleConfiguration) {
+        for (const handle of group.handles ?? []) {
+          const info = {
+            maxConnections: handle.constraints?.maxConnections,
+            visible: handle.visible,
+            position: group.position
+          };
+          const expandedIds = expandHandleIds(handle, node);
+          if (handle.type !== "source" && handle.type !== "target") {
+            continue;
+          }
+          const concreteTarget = handle.type === "source" ? entry.source : entry.target;
+          const templateTarget = handle.type === "source" ? entry.sourceTemplates : entry.targetTemplates;
+          for (const id of expandedIds) {
+            if (isTemplatedHandleId(id)) {
+              templateTarget.push({ templateId: id, info });
+            } else {
+              concreteTarget.set(id, info);
+            }
+          }
+        }
+      }
+      if (defEntry.supportsErrorHandling && !entry.source.has("error")) {
+        entry.source.set("error", {
+          visible: buildErrorHandle().visible
+        });
+      }
+      const sourceSetDeclared = [...entry.source.values()].some((info) => info.position !== undefined) || entry.sourceTemplates.length > 0;
+      entry.sourceDeclared = sourceSetDeclared;
+      const customization = deriveHandleCustomizationSourceOverride(node);
+      if (sourceSetDeclared && !customization) {
+        for (const outcomeHandleId of deriveOutcomeHandleIds(node)) {
+          if (!entry.source.has(outcomeHandleId)) {
+            entry.source.set(outcomeHandleId, {});
+          }
+        }
+      }
+      if (customization && sourceSetDeclared) {
+        const overriddenPositions = new Set(customization.positions);
+        for (const [handleId, info] of [...entry.source]) {
+          if (info.position !== undefined && overriddenPositions.has(info.position)) {
+            entry.source.delete(handleId);
+          }
+        }
+        entry.sourceTemplates = entry.sourceTemplates.filter((template) => template.info.position === undefined || !overriddenPositions.has(template.info.position));
+        for (const handleId of customization.sourceHandleIds) {
+          entry.source.set(handleId, {});
+        }
+        if (!customization.sourceHandleIds.includes("completed")) {
+          handleCustomizedNodes.set(node.id, customization.sourceHandleIds);
+        }
+      }
+      handlesByNode.set(node.id, entry);
+    }
+    const sourceCounts = new Map;
+    const targetCounts = new Map;
+    const bump = (counts, nodeId, handleId) => {
+      let inner = counts.get(nodeId);
+      if (!inner) {
+        inner = new Map;
+        counts.set(nodeId, inner);
+      }
+      inner.set(handleId, (inner.get(handleId) ?? 0) + 1);
+    };
+    const resolveHandle = (nodeHandles, side, port) => {
+      if (!nodeHandles)
+        return { matched: false };
+      const concrete = nodeHandles[side];
+      if (concrete.has(port)) {
+        return { matched: true, info: concrete.get(port) };
+      }
+      const templates = side === "source" ? nodeHandles.sourceTemplates : nodeHandles.targetTemplates;
+      const matchedTemplate = templates.find((t) => portMatchesTemplate(port, t.templateId));
+      if (matchedTemplate) {
+        return { matched: true, info: matchedTemplate.info };
+      }
+      return { matched: false };
+    };
+    const hasAnyHandles = (nodeHandles, side) => {
+      if (!nodeHandles)
+        return false;
+      if (side === "source")
+        return nodeHandles.sourceDeclared;
+      return nodeHandles.target.size + nodeHandles.targetTemplates.length > 0;
+    };
+    for (const edge of flow.edges) {
+      const sourceHandles = handlesByNode.get(edge.sourceNodeId);
+      if (hasAnyHandles(sourceHandles, "source")) {
+        const resolved = resolveHandle(sourceHandles, "source", edge.sourcePort);
+        if (!resolved.matched) {
+          const customizedHandles = handleCustomizedNodes.get(edge.sourceNodeId);
+          const message = edge.sourcePort === "completed" && customizedHandles ? `Edge from node "${edge.sourceNodeId}" uses the bare "completed" source handle, but this node's handles are customized to ${customizedHandles.join(", ")}, which does not include "completed".${customizedHandles.length > 1 ? ' A "completed" edge collapses every outcome onto one unconditional path and renders no edge on the canvas.' : ""} Rewire the edge to one of those handles.` : `Edge references undeclared source handle "${edge.sourcePort}" on node "${edge.sourceNodeId}"`;
+          issues.push({
+            path: `edges[${edge.id}].sourcePort`,
+            message,
+            severity: "error"
+          });
+        } else {
+          bump(sourceCounts, edge.sourceNodeId, edge.sourcePort);
+          const sourceNode = nodeById.get(edge.sourceNodeId);
+          const visible = resolved.info?.visible;
+          if (!isHandleVisible({ visible }, sourceNode ?? {})) {
+            const visibleInputKey = parseVisibleInputKey(visible);
+            const detail = visibleInputKey !== null ? `inputs.${visibleInputKey} is not true. The "${edge.sourcePort}" handle is only available when inputs.${visibleInputKey} is true. Run "uip maestro flow format" or set inputs.${visibleInputKey} to true on the source node.` : `the "${edge.sourcePort}" handle is hidden (visible: false) on this node, so the edge can never render.`;
+            issues.push({
+              path: visibleInputKey !== null ? `nodes[${edge.sourceNodeId}].inputs.${visibleInputKey}` : `edges[${edge.id}].sourcePort`,
+              message: `Node "${edge.sourceNodeId}" has an outgoing sourcePort: "${edge.sourcePort}" edge, but ${detail}`,
+              severity: "error"
+            });
+          } else if (visible === undefined && edge.sourcePort === ERROR_SOURCE_PORT && sourceNode?.inputs?.errorHandlingEnabled !== true) {
+            issues.push({
+              path: `nodes[${edge.sourceNodeId}].inputs.errorHandlingEnabled`,
+              message: `Node "${edge.sourceNodeId}" has an outgoing sourcePort: "error" edge, but inputs.errorHandlingEnabled is not true. Run "uip maestro flow format" or set inputs.errorHandlingEnabled to true on the source node.`,
+              severity: "error"
+            });
+          }
+        }
+      }
+      const targetHandles = handlesByNode.get(edge.targetNodeId);
+      if (hasAnyHandles(targetHandles, "target")) {
+        const resolved = resolveHandle(targetHandles, "target", edge.targetPort);
+        if (!resolved.matched) {
+          issues.push({
+            path: `edges[${edge.id}].targetPort`,
+            message: `Edge references undeclared target handle "${edge.targetPort}" on node "${edge.targetNodeId}"`,
+            severity: "error"
+          });
+        } else {
+          bump(targetCounts, edge.targetNodeId, edge.targetPort);
+        }
+      }
+    }
+    const checkMax = (counts, side) => {
+      for (const [nodeId, perHandle] of counts) {
+        for (const [handleId, count] of perHandle) {
+          const nodeHandles = handlesByNode.get(nodeId);
+          let info = nodeHandles?.[side].get(handleId);
+          if (!info && nodeHandles) {
+            const templates = side === "source" ? nodeHandles.sourceTemplates : nodeHandles.targetTemplates;
+            info = templates.find((t) => portMatchesTemplate(handleId, t.templateId))?.info;
+          }
+          const max = info?.maxConnections;
+          if (max !== undefined && count > max) {
+            issues.push({
+              path: `nodes[${nodeId}].handles[${handleId}]`,
+              message: `[MAX_CONNECTIONS_EXCEEDED] Handle "${handleId}" on node "${nodeId}" has ${count} ${side} connection(s), max is ${max}`,
+              severity: "error"
+            });
+          }
+        }
+      }
+    };
+    checkMax(sourceCounts, "source");
+    checkMax(targetCounts, "target");
+    return issues;
+  }
+  runNodeValidators(flow) {
+    const issues = [];
+    const context = {
+      definitions: flow.definitions,
+      nodeIds: new Set(flow.nodes.map((n) => n.id)),
+      strictBindings: this.strictBindings
+    };
+    for (const node of flow.nodes) {
+      for (const validator of this.nodeValidators) {
+        if (!validator.appliesTo(node))
+          continue;
+        issues.push(...validator.validate(node, context));
+      }
+    }
+    return issues;
+  }
+}
+function indexJoinGraph(flow) {
+  const modelTypeByNodeType = new Map;
+  for (const def of flow.definitions) {
+    if (typeof def.model?.type === "string") {
+      modelTypeByNodeType.set(def.nodeType, def.model.type);
+    }
+  }
+  const incomingByTarget = new Map;
+  for (const edge of flow.edges) {
+    const list = incomingByTarget.get(edge.targetNodeId) ?? [];
+    list.push(edge);
+    incomingByTarget.set(edge.targetNodeId, list);
+  }
+  return {
+    nodesById: new Map(flow.nodes.map((n) => [n.id, n])),
+    incomingByTarget,
+    modelTypeOf: (node) => typeof node.model?.type === "string" ? node.model.type : modelTypeByNodeType.get(node.type)
+  };
+}
+function isParallelJoin(node, graph) {
+  return node.type === "core.logic.merge" || graph.modelTypeOf(node) === "bpmn:ParallelGateway";
+}
+function isExclusiveSplit(node, graph) {
+  return node.type === "core.logic.decision" || node.type === "core.logic.switch" || graph.modelTypeOf(node) === "bpmn:ExclusiveGateway";
+}
+function walkToExclusiveSplit(edge, graph) {
+  let current = edge;
+  const seen = new Set;
+  while (current !== undefined && !seen.has(current.sourceNodeId)) {
+    const source = graph.nodesById.get(current.sourceNodeId);
+    if (!source)
+      return;
+    seen.add(source.id);
+    if (isExclusiveSplit(source, graph)) {
+      return { splitId: source.id, port: current.sourcePort };
+    }
+    const upstream = graph.incomingByTarget.get(source.id) ?? [];
+    current = upstream.length === 1 ? upstream[0] : undefined;
+  }
+  return;
+}
+function findUnsatisfiableJoin(node, graph) {
+  if (!isParallelJoin(node, graph))
+    return;
+  const incoming = graph.incomingByTarget.get(node.id) ?? [];
+  if (incoming.length < 2)
+    return;
+  const origins = incoming.map((edge) => walkToExclusiveSplit(edge, graph));
+  if (origins.includes(undefined))
+    return;
+  const resolved = origins;
+  const splitIds = new Set(resolved.map((o) => o.splitId));
+  if (splitIds.size !== 1)
+    return;
+  const ports = [...new Set(resolved.map((o) => o.port))].sort((a, b) => a.localeCompare(b));
+  if (ports.length < 2)
+    return;
+  return { splitId: resolved[0].splitId, ports };
+}
+function describeUnsatisfiableJoin(node, finding, graph) {
+  const split = graph.nodesById.get(finding.splitId);
+  const splitLabel = split?.display?.label ?? finding.splitId;
+  const joinLabel = node.display?.label ?? node.id;
+  const splitKind = split?.type === "core.logic.switch" ? "Switch" : "Decision";
+  const portList = finding.ports.map((p) => `"${p}"`).join(", ");
+  return {
+    path: `nodes[${node.id}]`,
+    message: `Merge "${joinLabel}" can never complete: every one of its incoming paths comes from a ` + `different branch of the same ${splitKind} "${splitLabel}" (ports ${portList}). ` + `A Merge is a parallel join that waits for ALL incoming paths, but a ${splitKind} takes exactly one branch, ` + `so the run would stop at "${joinLabel}" and never reach an End node. ` + `Connect each branch directly to the node that should run next (a node accepts several incoming edges), ` + `and use Merge only to rejoin branches that run in parallel.`,
+    severity: "error"
+  };
+}
+export {
+  FlowValidateService
+};
+
+//# debugId=31F34A853235544A64756E2164756E21