@uipath/flow-tool 0.9.1 → 1.0.4

package/dist/services/flow-validate-service.d.ts

@@ -1,3 +1,4 @@
+import type { NodeManifest } from "@uipath/flow-core";
 import { type FlowNodeValidator, type ValidationIssue } from "./node-validators/index.js";
 import type { WorkflowGovernanceEnforcements, WorkflowValidationRule } from "./node-validators/workflow-rule-types.js";
 interface FlowValidateResult {
@@ -5,6 +6,7 @@ interface FlowValidateResult {
     filePath: string;
     issues: ValidationIssue[];
 }
+type ManifestForCurrentValidation = Pick<NodeManifest, "nodeType" | "version" | "handleConfiguration" | "supportsErrorHandling">;
 /**
  * Optional hooks callers can use to extend validation without editing this
  * service. See `packages/flow-tool/src/services/node-validators/types.ts`
@@ -37,6 +39,18 @@ export interface FlowValidateOptions {
      * in this allow-list.
      */
     availableModelNames?: string[];
+    /**
+     * Compare edge handles against the current bundled OOTB manifests in
+     * addition to the definitions embedded in the .flow file. This catches
+     * flows generated with stale OOTB definitions that are internally
+     * consistent but render incorrectly in Studio Web.
+     */
+    validateCurrentManifests?: boolean;
+    /**
+     * Test/host override for the current manifest set. Supplying this also
+     * enables current-manifest validation.
+     */
+    currentManifests?: ManifestForCurrentValidation[];
 }
 export declare class FlowValidateService {
     private readonly fs;
@@ -44,15 +58,57 @@ export declare class FlowValidateService {
     private readonly nodeValidators;
     private readonly governanceEnforcements?;
     private readonly availableModelNames?;
+    private readonly validateCurrentManifests;
+    private readonly currentManifestOverrides?;
+    private currentManifestCache?;
     constructor(options?: FlowValidateOptions);
     execute(flowFilePath: string): Promise<number>;
+    private loadCurrentManifestMap;
+    private loadCurrentManifestMapUncached;
     validateFile(flowFilePath: string): Promise<FlowValidateResult>;
+    /**
+     * For agent nodes that reference an external agent definition via a
+     * `projectId` UUID, read the sibling `<uuid>/agent.json` file and
+     * populate `systemPrompt` / `userPrompt` (and governance-relevant
+     * settings) from the agent's `messages` array so that schema
+     * validation sees them.
+     *
+     * The UUID may be at `inputs.source` (canonical post-flow-core-0.2.50)
+     * or `model.source` (legacy). The autonomous-agent manifest's
+     * `model.source: true` declaration is a historical artifact from
+     * before the migration; current canvas writes go to `inputs.source`.
+     * `node.model.source` is read for backwards compatibility with older
+     * `.flow` files. MST-9263.
+     *
+     * Returns a map of `nodeId → AgentHydrationDiagnosis` so callers can
+     * decorate downstream `REQUIRED_FIELD` validator errors with a
+     * specific reason hydration could not fill the prompt fields.
+     */
+    private resolveAgentPrompts;
+    /**
+     * Decorate `[REQUIRED_FIELD] systemPrompt|userPrompt` validator errors
+     * on inline-agent nodes with a diagnostic hint pinpointing why the
+     * resolver couldn't fill the field — so users see "agent.json not
+     * found at <path>" instead of just "systemPrompt is required". The
+     * raw AJV error stays in the message; the hint is appended on a
+     * second line. MST-9263.
+     */
+    private enrichInlineAgentPromptIssues;
     private validateGraph;
     private validateEdgeReferences;
     private validateNodeTypeDefinitions;
     private validateUniqueIds;
     /** Uniqueness check for `variables.globals` IDs; called once per scope (root + each subflow). */
     private validateGlobalVariableUniqueness;
+    /**
+     * Catch stale embedded OOTB definitions. Studio Web renders against the
+     * current node manifest, while .flow files carry a serialized copy of the
+     * manifest that may have been produced by an older CLI. A flow can
+     * therefore be internally consistent, pass embedded-definition validation,
+     * and still render with missing edges because the edge handle no longer
+     * exists in the current manifest.
+     */
+    private validateEdgeHandlesAgainstCurrentManifests;
     /**
      * Check that every edge references handles declared in the source/target
      * node manifests, and that no handle exceeds its maxConnections constraint.

package/dist/services/node-validators/expression-prefix-validator.d.ts

@@ -0,0 +1,45 @@
+import type { FlowNodeValidator } from "./types.js";
+/**
+ * Lints two related authoring failure modes around `=js:` expression-mode:
+ *
+ * 1. **Connector / HTTP parameters missing the `=js:` prefix (MST-9107).**
+ *    The flow-workbench BPMN serializer rewrites `$vars` → `vars` regardless
+ *    of whether the value carries the `=js:` prefix, so a string like
+ *    `"$vars.X.output.Id"` ships to the runtime as the literal string
+ *    `"vars.X.output.Id"` instead of being evaluated as an expression. The
+ *    failure is silent: `flow validate` (without this rule) and `flow format`
+ *    both pass; the activity input ends up bound to the literal string at
+ *    runtime.
+ *
+ *    Also catches the agent-invented `nodes.<id>.output.Y` syntax — there
+ *    is no such reference dialect; the agent should write
+ *    `=js:$vars.<id>.output.<f>`.
+ *
+ * 2. **Script-node `inputs.source` written as an expression-mode string
+ *    (MST-9265 / MST-9260).** A Script node's `source` field is the
+ *    JavaScript function body, not an expression-mode value. Authoring
+ *    `inputs.source = "=js:vars.start.output.text"` makes the runtime
+ *    treat the literal string as the JS source — i.e., the script reverses
+ *    its own source code instead of the input. Flag values that begin with
+ *    `=js:` so the agent gets an actionable error before `flow debug`.
+ *
+ * Scope:
+ * - Connector activity nodes (`uipath.connector.*`, excluding triggers) —
+ *   missing-prefix scan against `inputs.detail.{body,query,path}Parameters`.
+ * - Managed HTTP nodes (`core.action.http.v2`) — same scan.
+ * - Custom HTTP nodes (`core.action.http`) — same scan.
+ * - Script nodes (`core.action.script`) — `inputs.source` literal-vs-
+ *   expression check (MST-9260).
+ *
+ * Out of scope:
+ * - Decision / Switch / HTTP branch condition expressions — those are always
+ *   parsed as JS, so `=js:` is forbidden, not required. Covered by the
+ *   `condition-expression` rule in `@uipath/flow-schema`.
+ * - Variable updates — `bpmn-moddle.ensureJsPrefix` already auto-prefixes and
+ *   warns; covered by `variable-update-service`.
+ * - End node output `source` and subflow input `source` — those ARE
+ *   expression-mode fields where `=js:` is valid. A future check can lint
+ *   their *contents* (resolvability) but the leading-`=js:` rule does not
+ *   apply.
+ */
+export declare const expressionPrefixValidator: FlowNodeValidator;

package/dist/services/node-validators/index.d.ts

@@ -1,5 +1,7 @@
 import type { FlowNodeValidator } from "./types.js";
 export { connectorNodeValidator } from "./connector-validator.js";
+export { expressionPrefixValidator } from "./expression-prefix-validator.js";
+export { modelSourceValidator } from "./model-source-validator.js";
 export type { FlowNodeValidator, FlowValidatorContext, FlowValidatorNode, ValidationIssue, ValidationIssueSeverity, } from "./types.js";
 /**
  * Validators applied by default in `FlowValidateService`. Downstream tools

package/dist/services/node-validators/model-source-validator.d.ts

@@ -0,0 +1,25 @@
+import type { FlowNodeValidator } from "./types.js";
+/**
+ * Enforces the source-UUID contract for nodes whose plugin manifest declares
+ * `model: { source: true, ... }` at the top level.
+ *
+ * flow-core 0.2.50 moved the per-instance source UUID from `node.model.source`
+ * to `node.inputs.source`. Older `.flow` files may still carry the legacy
+ * `model.source` shape, so validation accepts both locations while reporting
+ * missing values against the canonical `inputs.source` path.
+ *
+ * Scope:
+ * - Any node whose plugin manifest declares `model.source === true`.
+ * - Currently observed plugins: `uipath.agent.autonomous`,
+ *   `uipath.agent.conversational`. Plugin-list discovered dynamically
+ *   from the registry — adding new agent-style plugins in the future
+ *   doesn't require updating this validator.
+ *
+ * Out of scope:
+ * - Plugins that don't declare `model.source: true` (most node types).
+ * - Validating the UUID format of the source value — handled by the
+ *   schema-validation rule in `@uipath/flow-schema`.
+ * - The `model.type`, `model.serviceType`, `model.version` fields —
+ *   those are written by the canvas, not by the agent.
+ */
+export declare const modelSourceValidator: FlowNodeValidator;

package/dist/services/node-validators/types.d.ts

@@ -1,5 +1,5 @@
 /**
- * Contribution surface for node-type-scoped validators in `uip flow validate`.
+ * Contribution surface for node-type-scoped validators in `uip maestro flow validate`.
  *
  * A `FlowNodeValidator` runs once per node during the validate pass and emits
  * zero or more `ValidationIssue`s. This is the second pluggability layer of