@uipath/maestro-builder-sdk 6.18.6 → 6.18.8

package/dist/case/check.d.ts

@@ -10,6 +10,7 @@
 import type { BuiltCase } from './case-sdk.js';
 import { type ConnectorCheckOpts } from '../core/connector-checks.js';
 import type { EventSubscription } from '../core/actions.js';
+import { type EventCheckOpts } from '../core/event-checks.js';
 export interface Diagnostic {
     level: 'error' | 'warning';
     code: string;
@@ -26,13 +27,13 @@ export interface Diagnostic {
  * the event, and validates a connector task's inputs and resolves its lookups
  * through the shared `buildConnectorInputs` (`connectorInputs`, `lookups`,
  * `resolutions`), and refuses a connection/folder label bindings.json cannot
- * turn into a resource key (`bindings`, `bindingLabelRefusal`). It does not
- * check BYOA, so that hook stays off until Case compile enforces it.
+ * turn into a resource key (`bindings`, `bindingLabelRefusal`), and refuses an
+ * event on an unverified BYOA connection (`eventFacts`, `byoa`).
  *
  * Every hook fails open: without a library, `check` stays a pure function of the
  * built model.
  */
-export type CaseCheckOpts = Pick<ConnectorCheckOpts, 'connectorResolveError' | 'connectorInputs' | 'lookups' | 'resolutions' | 'schemaReadiness' | 'bindings'> & {
+export type CaseCheckOpts = Pick<ConnectorCheckOpts, 'connectorResolveError' | 'connectorInputs' | 'lookups' | 'resolutions' | 'schemaReadiness' | 'bindings'> & Pick<EventCheckOpts, 'eventFacts' | 'byoa'> & {
     /**
      * What Case `compile` would refuse an event subscription with, or `undefined`
      * when it resolves: `EVENT_UNKNOWN` (the event is not in the library, or

package/dist/case/check.js

@@ -298,10 +298,17 @@ function checkLibraryConnectors(built, opts, diags) {
         const refused = opts.subscriptionError?.(kind, sub);
         if (refused !== undefined)
             diags.push({ level: 'error', code: refused.code, message: `${where}: ${refused.message}`, where: at });
-        // A `where` lookup nobody recorded: Flow's LOOKUP_UNRESOLVED warning, from the
-        // shared event rules. Only `resolutions` is passed, so nothing else in them fires.
         checkBindingLabels(where, sub, opts, (code, message) => diags.push({ level: 'error', code, message, where: at }), { key: sub.connector, action: sub.event });
-        checkEventResolution(sub, where, kind, { resolutions: opts.resolutions ?? {} }, (code, message) => diags.push({ level: 'error', code, message, where: at }), (code, message) => diags.push({ level: 'warning', code, message, where: at }));
+        // From the shared event rules, the two Case compile enforces: a `where` lookup
+        // nobody recorded (LOOKUP_UNRESOLVED, a warning) and an unverified BYOA
+        // connection (EVENT_BYOA_UNVERIFIED). Only their hooks are passed, so nothing
+        // else in them fires.
+        checkEventResolution(sub, where, kind, {
+            resolutions: opts.resolutions ?? {},
+            ...(opts.eventFacts ? { eventFacts: opts.eventFacts } : {}),
+            ...(opts.byoa ? { byoa: opts.byoa } : {}),
+            ...(opts.bindings ? { bindings: opts.bindings } : {}),
+        }, (code, message) => diags.push({ level: 'error', code, message, where: at }), (code, message) => diags.push({ level: 'warning', code, message, where: at }));
     };
     const rules = (conditions, where) => {
         for (const c of conditions)

package/dist/case/cli-library.d.ts

@@ -9,9 +9,8 @@ import type { CaseCheckOpts } from './check.js';
  * compile's own call), a connector task's field contract and lookups (the
  * `=`-expression validator Case compile runs), and the schema-readiness warnings.
  * With `bindings`, the binding-label rules (BINDING_SELF_NAME, BINDING_UNDECLARED),
- * which Case `serialize` enforces through the same `bindingLabelRefusal`. The
- * BYOA hooks of the shared bag are left out, because Case `serialize` does not
- * enforce them.
+ * which Case `serialize` enforces through the same `bindingLabelRefusal`, and the
+ * BYOA facts and ledger, for the refusal `resolveCaseSubscription` makes.
  *
  * @param library - The library `openCliLibrary` returned, or `undefined`.
  * @param bindings - The project's bindings.json, as compile reads it.

package/dist/case/cli-library.js

@@ -18,9 +18,8 @@ import { EVENT_GENERIC_NO_OBJECT, GenericEventNoObjectError, resolveCaseSubscrip
  * compile's own call), a connector task's field contract and lookups (the
  * `=`-expression validator Case compile runs), and the schema-readiness warnings.
  * With `bindings`, the binding-label rules (BINDING_SELF_NAME, BINDING_UNDECLARED),
- * which Case `serialize` enforces through the same `bindingLabelRefusal`. The
- * BYOA hooks of the shared bag are left out, because Case `serialize` does not
- * enforce them.
+ * which Case `serialize` enforces through the same `bindingLabelRefusal`, and the
+ * BYOA facts and ledger, for the refusal `resolveCaseSubscription` makes.
  *
  * @param library - The library `openCliLibrary` returned, or `undefined`.
  * @param bindings - The project's bindings.json, as compile reads it.
@@ -36,6 +35,8 @@ export function caseCheckOpts(library, bindings) {
         connectorInputs: shared.connectorInputs,
         lookups: shared.lookups,
         resolutions: shared.resolutions,
+        eventFacts: shared.eventFacts,
+        byoa: shared.byoa,
         schemaReadiness: shared.schemaReadiness,
         externalDescriptorError: (kind, d) => {
             let rc;

package/dist/case/serialize.js

@@ -890,7 +890,7 @@ function resolvedSubscriptionBag(kind, spec, resolver, elementId, where) {
     if (!resolver.library)
         throw new Error(`${kind === 'trigger' ? 'event trigger' : 'wait-for-connector'} needs the connector library — `
             + `pass { library } to serialize or use uip maestro case compile --library.`);
-    const rc = resolveCaseSubscription(resolver.library, kind, spec);
+    const rc = resolveCaseSubscription(resolver.library, kind, spec, { where, bindings: resolver.bindings });
     const op = rc.entry.operation ?? {};
     const context = [io('connectorKey', 'string', { value: rc.connectorKey })];
     const target = { key: spec.connector, action: spec.event };

package/dist/case/subscription.d.ts

@@ -10,6 +10,7 @@
  */
 import type { EventSubscription } from '../core/actions.js';
 import type { Library, ResolvedConnector } from '../core/library.js';
+import type { BindingsView } from '../core/binding-messages.js';
 /** Check's code for {@link GenericEventNoObjectError}; Flow and BPMN `check` use the same one. */
 export declare const EVENT_GENERIC_NO_OBJECT = "EVENT_GENERIC_NO_OBJECT";
 /** A GENERIC event subscription that names no object. */
@@ -24,7 +25,13 @@ export declare class GenericEventNoObjectError extends Error {
  * @param library - The connector library.
  * @param kind - `trigger` for an event trigger, `event` for a wait-for-connector task or rule.
  * @param sub - The authored subscription.
+ * @param byoa - Where the subscription is and the bindings, to refuse an
+ *   unverified BYOA connection; compile passes it, `check` does not (it reports
+ *   that rule from the shared event rules).
  * @returns The resolved event.
- * @throws What `resolveEvent` throws, or {@link GenericEventNoObjectError}.
+ * @throws What `resolveEvent` throws, {@link GenericEventNoObjectError}, or a `ByoaRefusal`.
  */
-export declare function resolveCaseSubscription(library: Library, kind: 'trigger' | 'event', sub: EventSubscription): ResolvedConnector;
+export declare function resolveCaseSubscription(library: Library, kind: 'trigger' | 'event', sub: EventSubscription, byoa?: {
+    where: string;
+    bindings?: BindingsView;
+}): ResolvedConnector;

package/dist/case/subscription.js

@@ -1,4 +1,5 @@
 import { genericEventObjectRefusal } from '../core/event-checks.js';
+import { ByoaRefusal, byoaUnverified } from '../core/byoa.js';
 /** Check's code for {@link GenericEventNoObjectError}; Flow and BPMN `check` use the same one. */
 export const EVENT_GENERIC_NO_OBJECT = 'EVENT_GENERIC_NO_OBJECT';
 /** A GENERIC event subscription that names no object. */
@@ -17,13 +18,25 @@ function caseObjectOption(object) {
  * @param library - The connector library.
  * @param kind - `trigger` for an event trigger, `event` for a wait-for-connector task or rule.
  * @param sub - The authored subscription.
+ * @param byoa - Where the subscription is and the bindings, to refuse an
+ *   unverified BYOA connection; compile passes it, `check` does not (it reports
+ *   that rule from the shared event rules).
  * @returns The resolved event.
- * @throws What `resolveEvent` throws, or {@link GenericEventNoObjectError}.
+ * @throws What `resolveEvent` throws, {@link GenericEventNoObjectError}, or a `ByoaRefusal`.
  */
-export function resolveCaseSubscription(library, kind, sub) {
+export function resolveCaseSubscription(library, kind, sub, byoa) {
     const rc = library.resolveEvent(kind, sub.connector, sub.event, sub.version, sub.object);
     const noObject = genericEventObjectRefusal(rc, sub, caseObjectOption);
     if (noObject)
         throw new GenericEventNoObjectError(noObject);
+    // A BYOA-only event on a connection `prepare` never checked deploys and never
+    // fires (#848). Flow's `refuseUnverifiedByoa` rule and text (`byoaUnverified`);
+    // Case `check` reports it from the shared event rules (`eventFacts` / `byoa`).
+    if (byoa && typeof library.eventFacts === 'function') {
+        const object = typeof sub.object === 'string' && sub.object !== '' ? sub.object : undefined;
+        const message = byoaUnverified(byoa.where, { connector: sub.connector, event: sub.event, ...(object ? { object } : {}), connection: sub.connection }, library.eventFacts(sub.connector, sub.event, object), library.byoaVerifications, byoa.bindings);
+        if (message)
+            throw new ByoaRefusal(message);
+    }
     return rc;
 }

package/dist/registry/uip/client.js

@@ -4,6 +4,7 @@ import { createRequire } from "node:module";
 import { join } from "node:path";
 import { writeJsonFile } from "../../core/json-file.js";
 import { HostUipClient } from "./host.js";
+import { launchFor } from "./launch.js";
 /**
  * Room for the largest `registry search` a tenant has answered, with margin.
  * `execFile`'s 1 MiB default cut that stream off, so the port raised it; a
@@ -35,6 +36,9 @@ export class SpawnUipClient {
         const [executable, ...args] = argv;
         const timeoutMs = options.timeoutMs ?? this.defaults.timeoutMs;
         return new Promise((resolve, reject) => {
+            // `uip` stays the logical name in argv (recordings are keyed by it);
+            // only here is it turned into what Windows can start (launch.ts, #940).
+            const launch = launchFor(executable, args);
             // stdin is `ignore`, not the default pipe. A pipe this process never
             // writes to stays open, so a `uip` that decides to prompt — an expired
             // login, a consent question — would block on it for as long as the
@@ -42,7 +46,7 @@ export class SpawnUipClient {
             // reads EOF at once and the CLI fails like any other call, which is
             // what Python's `subprocess.run` gave it: the parent's stdin, already at
             // EOF on an agent.
-            const child = childProcess().spawn(executable, args, {
+            const child = childProcess().spawn(launch.file, launch.args, {
                 cwd: options.cwd ?? this.defaults.cwd,
                 stdio: ["ignore", "pipe", "pipe"],
             });
@@ -265,7 +269,8 @@ export function runUipSync(argv, options = {}) {
     if (replay)
         return { ...readRecording(replay, argv).result };
     const [executable, ...args] = argv;
-    const r = childProcess().spawnSync(executable, args, {
+    const launch = launchFor(executable, args);
+    const r = childProcess().spawnSync(launch.file, launch.args, {
         cwd: options.cwd,
         stdio: ["ignore", "pipe", "pipe"],
         encoding: "utf8",

package/dist/registry/uip/host.js

@@ -1,4 +1,5 @@
 import { createRequire } from "node:module";
+import { launchFor } from "./launch.js";
 /** The MCP tool this client calls; a server without it is treated as absent. */
 export const HOST_TOOL = "run_argv";
 /** How long the host may take to start and list its tools before the client gives up on it. */
@@ -241,7 +242,8 @@ export class HostUipClient {
             // entries reach `client.ts`, so a static import would load a process API on
             // every builder import (FB009).
             const { spawn } = createRequire(import.meta.url)("node:child_process");
-            child = spawn(command[0], command.slice(1), { stdio: ["pipe", "pipe", "pipe"] });
+            const launch = launchFor(command[0], command.slice(1));
+            child = spawn(launch.file, launch.args, { stdio: ["pipe", "pipe", "pipe"] });
         }
         catch (error) {
             this.giveUp(`could not start ${command.join(" ")}: ${error instanceof Error ? error.message : String(error)}`);

package/dist/registry/uip/launch.d.ts

@@ -0,0 +1,24 @@
+export interface Launch {
+    file: string;
+    args: string[];
+}
+/** The parts of the host the lookup reads; injected so the Windows branch is testable anywhere. */
+export interface LaunchHost {
+    platform: NodeJS.Platform;
+    /** `PATH`, `;`-separated on Windows. */
+    path: string | undefined;
+    /** `PATHEXT`; cmd.exe's default when unset. */
+    pathExt: string | undefined;
+    /** The Node that runs a shim's script — this process's own. */
+    execPath: string;
+    isFile(path: string): boolean;
+    readFile(path: string): string;
+}
+/**
+ * The file and arguments to spawn for `executable args`, without a shell.
+ *
+ * @throws when, on Windows, the name resolves to a batch shim this cannot read
+ * a script out of — naming the shim, so the remedy is not "put uip on PATH"
+ * for a `uip` that is on PATH.
+ */
+export declare function launchFor(executable: string, args: readonly string[], host?: LaunchHost): Launch;

package/dist/registry/uip/launch.js

@@ -0,0 +1,105 @@
+/**
+ * What to actually spawn for a logical `uip` command line.
+ *
+ * Every argv in the registry starts with the bare name `uip` (`commands.ts`),
+ * and that name is what recordings are keyed by, so it stays bare everywhere
+ * above the spawn. On POSIX the bare name is also what `spawn` wants. On
+ * Windows it is not (flow-builder-sdk#940): npm installs the CLI as a `uip.cmd`
+ * shim (plus a POSIX `uip` script Windows cannot run), and Node starts neither
+ * without a shell — `uip` is `ENOENT`, and `uip.cmd` is `EINVAL` since the
+ * CVE-2024-27980 fix refused `.cmd`/`.bat` without `shell`.
+ *
+ * `shell: true` would start it, but every argument (`-f name=value`, a JSON
+ * value, a `|` in a JMESPath filter) would then go through cmd.exe quoting, and
+ * a timeout's `kill` would end cmd.exe and leave the CLI running. So on Windows
+ * a bare name is looked up on `PATH` the way cmd.exe would (`PATHEXT` order),
+ * and:
+ *   - an `.exe`/`.com` is spawned by its full path;
+ *   - a `.cmd`/`.bat` npm shim is read for the script it runs
+ *     (`"%dp0%\node_modules\@uipath\cli\dist\index.js" %*`), and that script is
+ *     run with this process's own Node, which is what the shim would do;
+ *   - a shim that names no script is an error that says so, not a guess.
+ * A name that is not bare (a path, or one with an extension) is spawned as
+ * given, and so is anything on another platform.
+ *
+ * Example, on Windows with npm's global bin on PATH:
+ *   launchFor("uip", ["--version"])
+ *   // -> { file: "C:\\Program Files\\nodejs\\node.exe",
+ *   //      args: ["C:\\Users\\me\\AppData\\Roaming\\npm\\node_modules\\@uipath\\cli\\dist\\index.js", "--version"] }
+ */
+import { readFileSync, statSync } from "node:fs";
+import { win32 } from "node:path";
+const DEFAULT_PATHEXT = ".COM;.EXE;.BAT;.CMD";
+/**
+ * The script an npm (`cmd-shim`) or pnpm shim hands its arguments to: the last
+ * quoted `%dp0%\…` / `%~dp0\…` path followed by `%*`. Only a JavaScript target
+ * counts; a shim around something else is not one this module can run directly.
+ */
+const SHIM_TARGET = /"%~?dp0%?\\([^"]+\.[cm]?js)"\s+%\*/g;
+function ambientHost() {
+    return {
+        platform: process.platform,
+        path: process.env.PATH,
+        pathExt: process.env.PATHEXT,
+        execPath: process.execPath,
+        isFile: (path) => {
+            try {
+                return statSync(path).isFile();
+            }
+            catch {
+                return false;
+            }
+        },
+        readFile: (path) => readFileSync(path, "utf8"),
+    };
+}
+/** True for a name `PATH` lookup applies to: no directory part and no extension. */
+function isBareName(executable) {
+    return executable !== "" && !/[\\/]/.test(executable) && win32.extname(executable) === "";
+}
+/** The first `<dir>\<executable><ext>` on PATH, in cmd.exe's order, or undefined. */
+function findOnPath(executable, host) {
+    const extensions = (host.pathExt || DEFAULT_PATHEXT).split(";").filter(Boolean);
+    for (const dir of (host.path ?? "").split(";")) {
+        const trimmed = dir.trim().replace(/^"(.*)"$/, "$1");
+        if (trimmed === "")
+            continue;
+        for (const ext of extensions) {
+            const candidate = win32.join(trimmed, executable + ext.toLowerCase());
+            if (host.isFile(candidate))
+                return candidate;
+        }
+    }
+    return undefined;
+}
+/** The script a `.cmd`/`.bat` shim runs, as an absolute path, or undefined. */
+function shimTarget(shim, host) {
+    const matches = [...host.readFile(shim).matchAll(SHIM_TARGET)];
+    const last = matches.at(-1);
+    return last ? win32.join(win32.dirname(shim), last[1]) : undefined;
+}
+/**
+ * The file and arguments to spawn for `executable args`, without a shell.
+ *
+ * @throws when, on Windows, the name resolves to a batch shim this cannot read
+ * a script out of — naming the shim, so the remedy is not "put uip on PATH"
+ * for a `uip` that is on PATH.
+ */
+export function launchFor(executable, args, host = ambientHost()) {
+    if (host.platform !== "win32" || !isBareName(executable))
+        return { file: executable, args: [...args] };
+    const found = findOnPath(executable, host);
+    // Not on PATH: spawn the bare name and let the ENOENT say so.
+    if (!found)
+        return { file: executable, args: [...args] };
+    const ext = win32.extname(found).toLowerCase();
+    if (ext !== ".cmd" && ext !== ".bat")
+        return { file: found, args: [...args] };
+    const script = shimTarget(found, host);
+    if (!script || !host.isFile(script)) {
+        throw new Error(`Could not start ${executable}: ${found} is a batch file, which Node cannot run without a shell, ` +
+            (script ? `and the script it names (${script}) does not exist.` : "and it names no JavaScript entry point to run instead.") +
+            " Reinstall the UiPath CLI with npm (`npm install -g @uipath/cli`).");
+    }
+    return { file: host.execPath, args: [script, ...args] };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uipath/maestro-builder-sdk",
-  "version": "6.18.6",
+  "version": "6.18.8",
   "description": "Build UiPath Flow, Case, and BPMN artifacts by writing TypeScript.",
   "license": "MIT",
   "homepage": "https://docs.uipath.com/maestro",
@@ -92,5 +92,5 @@
     "@types/node": "^22.7.0",
     "esbuild": "^0.28.1"
   },
-  "gitref": "27768f00ecc6986a54deba3c8f327d01ace642f8"
+  "gitref": "ce161efe130f6a6cdee895d8a7fab2faddcec0fd"
 }