@uipath/maestro-builder-sdk 6.27.0 → 6.27.1

package/dist/cli/commands/bpmn.js

@@ -1,4 +1,4 @@
-import { addValue, inferCheckMode, invoke, loadTool, namedOrLegacySecond, retiredCompiledOption, refuse } from '../common.js';
+import { addValue, inferCheckMode, invoke, namedOrLegacySecond, retiredCompiledOption, refuse } from '../common.js';
 export function registerBpmnCommands(program) {
     const family = program.command('bpmn').description('Build, inspect, and merge BPMN artifacts.');
     family.command('compile')
@@ -18,7 +18,7 @@ export function registerBpmnCommands(program) {
         addValue(argv, '--library', options.library);
         addValue(argv, '--bindings', options.bindings);
         addValue(argv, '--connectors-local', options.connectorsLocal);
-        await invoke('bpmn compile', () => loadTool(import.meta.url, '../../bpmn/compile-cli.js'), argv);
+        await invoke('bpmn compile', () => import('../../bpmn/compile-cli.js'), argv);
     });
     family.command('check')
         .description('Check authored TypeScript. Check a .bpmn with `uip maestro bpmn validate`.')
@@ -51,7 +51,7 @@ export function registerBpmnCommands(program) {
         addValue(argv, '--library', options.library);
         addValue(argv, '--connectors-local', options.connectorsLocal);
         addValue(argv, '--bindings', options.bindings);
-        await invoke('bpmn check', () => loadTool(import.meta.url, '../../bpmn/check-cli.js'), argv);
+        await invoke('bpmn check', () => import('../../bpmn/check-cli.js'), argv);
     });
     family.command('tidy')
         .description('Add diagram layout to a compiled .bpmn artifact.')
@@ -60,7 +60,7 @@ export function registerBpmnCommands(program) {
         .action(async (input, options) => {
         const argv = [input];
         addValue(argv, '-o', options.output);
-        await invoke('bpmn tidy', () => loadTool(import.meta.url, '../../bpmn/tidy-cli.js'), argv);
+        await invoke('bpmn tidy', () => import('../../bpmn/tidy-cli.js'), argv);
     });
     family
         .command('decompile')
@@ -74,7 +74,7 @@ export function registerBpmnCommands(program) {
         addValue(argv, '-o', options.output);
         addValue(argv, '--import', options.import);
         addValue(argv, '--style', options.style);
-        await invoke('bpmn decompile', () => loadTool(import.meta.url, '../../bpmn/decompile-cli.js'), argv);
+        await invoke('bpmn decompile', () => import('../../bpmn/decompile-cli.js'), argv);
     });
     family
         .command('merge')
@@ -95,6 +95,6 @@ export function registerBpmnCommands(program) {
         const argv = [original, edited];
         addValue(argv, '-o', options.output);
         addValue(argv, '--baseline', options.baseline);
-        await invoke('bpmn merge', () => loadTool(import.meta.url, '../../bpmn/merge-cli.js'), argv);
+        await invoke('bpmn merge', () => import('../../bpmn/merge-cli.js'), argv);
     });
 }

package/dist/cli/commands/case.js

@@ -1,4 +1,4 @@
-import { addValue, inferCheckMode, invoke, loadTool, namedOrLegacySecond, retiredCompiledOption, refuse } from '../common.js';
+import { addValue, inferCheckMode, invoke, namedOrLegacySecond, retiredCompiledOption, refuse } from '../common.js';
 export function registerCaseCommands(program) {
     const family = program.command('case').description('Build, check, and merge Case artifacts.');
     family.command('compile')
@@ -14,7 +14,7 @@ export function registerCaseCommands(program) {
         addValue(argv, '--library', options.library);
         addValue(argv, '--bindings', options.bindings);
         addValue(argv, '--connectors-local', options.connectorsLocal);
-        await invoke('case compile', () => loadTool(import.meta.url, '../../case/compile-cli.js'), argv);
+        await invoke('case compile', () => import('../../case/compile-cli.js'), argv);
     });
     family.command('check')
         .description('Check authored TypeScript. Check a caseplan.json with `uip maestro case validate`.')
@@ -45,7 +45,7 @@ export function registerCaseCommands(program) {
         addValue(argv, '--library', options.library);
         addValue(argv, '--connectors-local', options.connectorsLocal);
         addValue(argv, '--bindings', options.bindings);
-        await invoke('case check', () => loadTool(import.meta.url, '../../case/check-cli.js'), argv);
+        await invoke('case check', () => import('../../case/check-cli.js'), argv);
     });
     family.command('decompile')
         .description('Convert a caseplan.json to authored TypeScript.')
@@ -64,7 +64,7 @@ export function registerCaseCommands(program) {
             argv.push('--best-effort');
         if (options.pipeline === false)
             argv.push('--no-pipeline');
-        await invoke('case decompile', () => loadTool(import.meta.url, '../../case/decompile-cli.js'), argv);
+        await invoke('case decompile', () => import('../../case/decompile-cli.js'), argv);
     });
     family.command('merge')
         .description('Merge an edited case plan with its original caseplan.json.')
@@ -82,6 +82,6 @@ export function registerCaseCommands(program) {
         const [edited, original] = pair;
         const argv = [original, edited];
         addValue(argv, '-o', options.output);
-        await invoke('case merge', () => loadTool(import.meta.url, '../../case/merge-cli.js'), argv);
+        await invoke('case merge', () => import('../../case/merge-cli.js'), argv);
     });
 }

package/dist/cli/commands/flow.js

@@ -1,5 +1,5 @@
 import { Option } from 'commander';
-import { addValue, emitOnlyEnabled, inferCheckMode, invoke, loadTool, namedOrLegacySecond, retiredCompiledOption, refuse } from '../common.js';
+import { addValue, emitOnlyEnabled, inferCheckMode, invoke, namedOrLegacySecond, retiredCompiledOption, refuse } from '../common.js';
 /** The retired compiled check's flags: `[commander flags, option key, description]`. One table, so hiding and warning cannot drift. */
 const RETIRED_COMPILED_CHECK_FLAGS = [
     ['--uip', 'uip', 'retired: resolve missing schemas with the UiPath CLI'],
@@ -32,7 +32,7 @@ export function registerFlowCommands(program) {
         addValue(argv, '--connectors-local', options.connectorsLocal);
         if (options.check === false || emitOnlyEnabled())
             argv.push('--no-check');
-        await invoke('flow compile', () => loadTool(import.meta.url, '../../compile-cli.js'), argv);
+        await invoke('flow compile', () => import('../../compile-cli.js'), argv);
     });
     const check = flow.command('check')
         .description('Check authored TypeScript. Check a compiled .flow with `uip maestro flow validate`.')
@@ -69,7 +69,7 @@ export function registerFlowCommands(program) {
             const argv = [input];
             addValue(argv, '--library', options.library);
             addValue(argv, '--connectors-local', options.connectorsLocal);
-            await invoke('flow check', () => loadTool(import.meta.url, '../../check-cli.js'), argv);
+            await invoke('flow check', () => import('../../check-cli.js'), argv);
             return;
         }
         // The COMPILED-artifact analyser is gone: it was a standalone tool bundled into this
@@ -100,7 +100,7 @@ export function registerFlowCommands(program) {
             argv.push('--strict');
         if (options.pipeline === false)
             argv.push('--no-pipeline');
-        await invoke('flow decompile', () => loadTool(import.meta.url, '../../decompile-cli.js'), argv);
+        await invoke('flow decompile', () => import('../../decompile-cli.js'), argv);
     });
     flow.command('merge')
         .description('Merge an edited flow with its original artifact.')
@@ -123,6 +123,6 @@ export function registerFlowCommands(program) {
         addValue(argv, '--baseline', options.baseline);
         if (options.strict)
             argv.push('--strict');
-        await invoke('flow merge', () => loadTool(import.meta.url, '../../merge-cli.js'), argv);
+        await invoke('flow merge', () => import('../../merge-cli.js'), argv);
     });
 }

package/dist/cli/commands/registry.js

@@ -1,4 +1,4 @@
-import { addValue, invoke, loadTool, namedOrLegacySecond } from '../common.js';
+import { addValue, invoke, namedOrLegacySecond } from '../common.js';
 /** Commander hands a repeatable option one value at a time. */
 function collect(value, previous) {
     return [...previous, value];
@@ -49,7 +49,7 @@ export function registerRegistryCommands(program) {
         addValue(argv, '--root', options.root);
         addValue(argv, '--extractor', options.extractor);
         addValue(argv, '--generator', options.generator);
-        await invoke('registry pull', () => loadTool(import.meta.url, '../../registry/pull-cli.js'), argv);
+        await invoke('registry pull', () => import('../../registry/pull-cli.js'), argv);
     });
     family.command('materialize')
         .description('Generate library-md and connectors/ from an extracted library-json.')
@@ -80,7 +80,7 @@ export function registerRegistryCommands(program) {
             argv.push('--check-orphans');
         addValue(argv, '--python', options.python);
         addValue(argv, '--generator', options.generator);
-        await invoke('registry materialize', () => loadTool(import.meta.url, '../../registry/materialize-cli.js'), argv);
+        await invoke('registry materialize', () => import('../../registry/materialize-cli.js'), argv);
     });
     // The pipeline's generator, `generate_library_json.py`, flag for flag: the
     // Azure YAML that calls it should only have to swap the executable.
@@ -119,7 +119,7 @@ export function registerRegistryCommands(program) {
         addValue(argv, '--connectors', options.connectors);
         addValue(argv, '--catalog-scope', options.catalogScope);
         addValue(argv, '--concurrency', options.concurrency);
-        await invoke('registry build-library', () => loadTool(import.meta.url, '../../registry/library-build/cli.js'), argv);
+        await invoke('registry build-library', () => import('../../registry/library-build/cli.js'), argv);
     });
     family.command('prepare')
         .description("Resolve one operation's schema against a live connection into ./.flow-sdk/connectors-local.")
@@ -200,7 +200,7 @@ export function registerRegistryCommands(program) {
             argv.push('--no-source-rewrite');
         addValue(argv, '--python', options.python);
         addValue(argv, '--generator', options.generator);
-        await invoke('registry prepare', () => loadTool(import.meta.url, '../../registry/prepare-cli.js'), argv);
+        await invoke('registry prepare', () => import('../../registry/prepare-cli.js'), argv);
     });
     family.command('path')
         .description('Print where the cached connector library is.')
@@ -216,7 +216,7 @@ export function registerRegistryCommands(program) {
             if (options[key])
                 argv.push(`--${flag}`);
         }
-        await invoke('registry path', () => loadTool(import.meta.url, '../../registry/path-cli.js'), argv);
+        await invoke('registry path', () => import('../../registry/path-cli.js'), argv);
     });
     family.command('search')
         .description('Find connector operations in an extracted library.')
@@ -231,6 +231,6 @@ export function registerRegistryCommands(program) {
         addValue(argv, '--library-md', options.libraryMd);
         addValue(argv, '--connector', options.connector);
         addValue(argv, '--limit', options.limit);
-        await invoke('registry search', () => loadTool(import.meta.url, '../../registry/search-cli.js'), argv);
+        await invoke('registry search', () => import('../../registry/search-cli.js'), argv);
     });
 }

package/dist/cli/common.d.ts

@@ -1,8 +1,5 @@
 import { type Command, Option } from 'commander';
 export type ToolRun = (argv: string[]) => Promise<number> | number;
-export declare function loadTool(baseUrl: string, relativePath: string): Promise<{
-    run: ToolRun;
-}>;
 export declare function invoke(label: string, load: () => Promise<{
     run: ToolRun;
 }>, argv: string[]): Promise<void>;

package/dist/cli/common.js

@@ -1,14 +1,12 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { Option } from 'commander';
-export function loadTool(baseUrl, relativePath) {
-    return import(new URL(relativePath, baseUrl).href);
-}
 export async function invoke(label, load, argv) {
     // In `--json` mode stdout carries exactly one JSON object, printed by
     // `emitJsonResult` once the verb is done. The tool's own human lines go to
     // stderr meanwhile, so they are still seen but never mixed into it.
     const restore = jsonResultRequested() ? routeStdoutToStderr() : () => { };
+    globalThis[HOSTED_BY_CLI] = true;
     try {
         const code = await (await load()).run(argv);
         if (code !== 0)
@@ -24,6 +22,8 @@ export async function invoke(label, load, argv) {
         restore();
     }
 }
+/** Tells `runWhenInvokedDirectly` (`src/cli-run.ts`) the tool is run by this CLI. */
+const HOSTED_BY_CLI = Symbol.for('uipath.maestro-builder-sdk.cli-hosted');
 /**
  * The slot `src/cli-result.ts` writes (`reportResult`). Read here through the
  * same `Symbol.for` key, since `dist/cli/` and `dist/` are separate builds.

package/dist/cli-run.js

@@ -14,7 +14,17 @@ function realOrAbsolute(path) {
         return resolve(path);
     }
 }
+/**
+ * Set by the `flow-sdk` CLI before it imports a tool (`cli/common.ts`, read
+ * through the same `Symbol.for` key since `dist/cli/` is a separate build). A
+ * bundle gives every module the bundle's own `import.meta.url`, which matches
+ * `process.argv[1]` for whichever tool the CLI loads; without this the tool
+ * would run a second time, on the CLI's argv.
+ */
+const HOSTED_BY_CLI = Symbol.for('uipath.maestro-builder-sdk.cli-hosted');
 export function runWhenInvokedDirectly(moduleUrl, label, run) {
+    if (globalThis[HOSTED_BY_CLI])
+        return;
     const entry = process.argv[1];
     if (!entry)
         return;

package/dist/core/sha.d.ts

@@ -0,0 +1,16 @@
+/**
+ * SHA-1 and SHA-256 of a string's UTF-8 bytes, in plain JavaScript.
+ *
+ * The ids built from them (`schemaId` in `serialize.ts`, `sha256Uuid` in
+ * `stable-id.ts`) are computed synchronously while a flow serializes, and must be
+ * byte-for-byte what `node:crypto` gives, since they are already in shipped
+ * artifacts. Owning the digest here keeps the authoring path free of `node:`
+ * imports, so a host without Node (a browser sandbox) runs it unshimmed; the
+ * browser's own `crypto.subtle.digest` is async-only. `tests/sha.test.ts` checks
+ * both against `node:crypto`. They derive ids, nothing secret: not for passwords,
+ * signatures or integrity checks.
+ */
+export declare function sha1(text: string): Uint8Array;
+export declare function sha256(text: string): Uint8Array;
+/** Lowercase hex of `bytes`, as `digest('hex')` writes it. */
+export declare function bytesToHex(bytes: Uint8Array): string;

package/dist/core/sha.js

@@ -0,0 +1,118 @@
+/**
+ * SHA-1 and SHA-256 of a string's UTF-8 bytes, in plain JavaScript.
+ *
+ * The ids built from them (`schemaId` in `serialize.ts`, `sha256Uuid` in
+ * `stable-id.ts`) are computed synchronously while a flow serializes, and must be
+ * byte-for-byte what `node:crypto` gives, since they are already in shipped
+ * artifacts. Owning the digest here keeps the authoring path free of `node:`
+ * imports, so a host without Node (a browser sandbox) runs it unshimmed; the
+ * browser's own `crypto.subtle.digest` is async-only. `tests/sha.test.ts` checks
+ * both against `node:crypto`. They derive ids, nothing secret: not for passwords,
+ * signatures or integrity checks.
+ */
+function utf8(text) {
+    return new TextEncoder().encode(text);
+}
+/** The message padded to a multiple of 64 bytes, with its bit length in the last 8, big-endian. */
+function padded(message) {
+    const length = Math.ceil((message.length + 9) / 64) * 64;
+    const bytes = new Uint8Array(length);
+    bytes.set(message);
+    bytes[message.length] = 0x80;
+    const view = new DataView(bytes.buffer);
+    const bits = message.length * 8;
+    view.setUint32(length - 8, Math.floor(bits / 0x100000000));
+    view.setUint32(length - 4, bits >>> 0);
+    return view;
+}
+function digest(words) {
+    const out = new Uint8Array(words.length * 4);
+    const view = new DataView(out.buffer);
+    words.forEach((word, i) => view.setUint32(i * 4, word));
+    return out;
+}
+const rotl = (x, n) => (x << n) | (x >>> (32 - n));
+const rotr = (x, n) => (x >>> n) | (x << (32 - n));
+export function sha1(text) {
+    const view = padded(utf8(text));
+    const h = [0x67452301, 0xefcdab89, 0x98badcfe, 0x10325476, 0xc3d2e1f0];
+    const w = new Array(80);
+    for (let block = 0; block < view.byteLength; block += 64) {
+        for (let i = 0; i < 16; i++)
+            w[i] = view.getUint32(block + i * 4);
+        for (let i = 16; i < 80; i++)
+            w[i] = rotl(w[i - 3] ^ w[i - 8] ^ w[i - 14] ^ w[i - 16], 1);
+        let [a, b, c, d, e] = h;
+        for (let i = 0; i < 80; i++) {
+            const [f, k] = i < 20 ? [(b & c) | (~b & d), 0x5a827999]
+                : i < 40 ? [b ^ c ^ d, 0x6ed9eba1]
+                    : i < 60 ? [(b & c) | (b & d) | (c & d), 0x8f1bbcdc]
+                        : [b ^ c ^ d, 0xca62c1d6];
+            const t = (rotl(a, 5) + f + e + k + w[i]) | 0;
+            e = d;
+            d = c;
+            c = rotl(b, 30);
+            b = a;
+            a = t;
+        }
+        h[0] = (h[0] + a) | 0;
+        h[1] = (h[1] + b) | 0;
+        h[2] = (h[2] + c) | 0;
+        h[3] = (h[3] + d) | 0;
+        h[4] = (h[4] + e) | 0;
+    }
+    return digest(h);
+}
+const K256 = [
+    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+    0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+    0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+    0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+    0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+    0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+];
+export function sha256(text) {
+    const view = padded(utf8(text));
+    const h = [0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19];
+    const w = new Array(64);
+    for (let block = 0; block < view.byteLength; block += 64) {
+        for (let i = 0; i < 16; i++)
+            w[i] = view.getUint32(block + i * 4);
+        for (let i = 16; i < 64; i++) {
+            const s0 = rotr(w[i - 15], 7) ^ rotr(w[i - 15], 18) ^ (w[i - 15] >>> 3);
+            const s1 = rotr(w[i - 2], 17) ^ rotr(w[i - 2], 19) ^ (w[i - 2] >>> 10);
+            w[i] = (w[i - 16] + s0 + w[i - 7] + s1) | 0;
+        }
+        let [a, b, c, d, e, f, g, hh] = h;
+        for (let i = 0; i < 64; i++) {
+            const t1 = (hh + (rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25)) + ((e & f) ^ (~e & g)) + K256[i] + w[i]) | 0;
+            const t2 = ((rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) + ((a & b) ^ (a & c) ^ (b & c))) | 0;
+            hh = g;
+            g = f;
+            f = e;
+            e = (d + t1) | 0;
+            d = c;
+            c = b;
+            b = a;
+            a = (t1 + t2) | 0;
+        }
+        h[0] = (h[0] + a) | 0;
+        h[1] = (h[1] + b) | 0;
+        h[2] = (h[2] + c) | 0;
+        h[3] = (h[3] + d) | 0;
+        h[4] = (h[4] + e) | 0;
+        h[5] = (h[5] + f) | 0;
+        h[6] = (h[6] + g) | 0;
+        h[7] = (h[7] + hh) | 0;
+    }
+    return digest(h);
+}
+/** Lowercase hex of `bytes`, as `digest('hex')` writes it. */
+export function bytesToHex(bytes) {
+    let out = '';
+    for (const byte of bytes)
+        out += byte.toString(16).padStart(2, '0');
+    return out;
+}

package/dist/core/stable-id.js

@@ -36,7 +36,7 @@
  * site uses; `tests/cli.test.ts` pins the Case entry point's `uniqueId`. Change one
  * only deliberately, updating that table and any byte-lock fixture it moves.
  */
-import { createHash } from 'node:crypto';
+import { bytesToHex, sha1, sha256 } from './sha.js';
 /** A uuid-shaped id derived from `seed`. Every segment is unsigned, including the `>>> 0` fix explained above. */
 export function stableId(seed) {
     let h1 = 0x811c9dc5;
@@ -88,7 +88,7 @@ export function fnv1aX4Uuid(seed) {
  * Consumer: a Case entry point's `uniqueId` in `entry-points.json` (`case/compile-cli.ts`).
  */
 export function sha256Uuid(seed) {
-    const h = createHash('sha256').update(seed).digest('hex');
+    const h = bytesToHex(sha256(seed));
     return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20, 32)}`;
 }
 /**
@@ -100,10 +100,9 @@ export function sha256Uuid(seed) {
  * (SHA-1 based, version + variant bits set) because that is what the field holds.
  */
 export function schemaId(flowId, nodeId) {
-    const h = createHash('sha1').update(`uipath.human-in-the-loop:${flowId}:${nodeId}`).digest();
-    const b = Buffer.from(h.subarray(0, 16));
+    const b = sha1(`uipath.human-in-the-loop:${flowId}:${nodeId}`).slice(0, 16);
     b[6] = (b[6] & 0x0f) | 0x50;
     b[8] = (b[8] & 0x3f) | 0x80;
-    const hex = b.toString('hex');
-    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+    const h = bytesToHex(b);
+    return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20)}`;
 }

package/dist/flow-definitions.js

@@ -6,15 +6,13 @@
  * Kept apart from `serialize.ts` so the registry can depend on the bundle without
  * importing the serializer that depends on the registry.
  */
-import { readFileSync } from 'node:fs';
-import { dirname, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
+import coreDefinitions from './core-definitions.json' with { type: 'json' };
 /**
  * The bundled definitions, keyed `<nodeType>@<version>`. Deep-frozen: every reader
  * shares this one copy, so a write meant for one node must clone first, and one
  * that does not throws at its own site instead of leaking into another reader.
  */
-export const BUNDLED_DEFINITIONS = deepFreeze(JSON.parse(readFileSync(join(dirname(fileURLToPath(import.meta.url)), 'core-definitions.json'), 'utf8')));
+export const BUNDLED_DEFINITIONS = deepFreeze(coreDefinitions);
 function deepFreeze(value) {
     if (value !== null && typeof value === 'object' && !Object.isFrozen(value)) {
         Object.freeze(value);

package/dist/sdk-resolve.d.ts

@@ -4,8 +4,10 @@
  * `sdk-resolve-hook.ts` for why. Idempotent; call it before importing authored
  * source.
  *
- * Does nothing when the compiled hook is absent, which is the case only when
- * the SDK runs from its TypeScript source under the test runner. The runner
- * resolves imports itself, so no hook is needed there.
+ * Does nothing when the SDK runs from its TypeScript source under the test
+ * runner, which resolves imports itself. Anywhere else a missing hook means the
+ * SDK was bundled: authored source would then load a second copy of the
+ * package, its expressions would fail this copy's `instanceof` checks, and the
+ * `.flow` would come out wrong with no error. That throws instead.
  */
 export declare function useThisSdkForAuthoredSource(): void;

package/dist/sdk-resolve.js

@@ -2,6 +2,7 @@
 import { existsSync } from 'node:fs';
 import { register } from 'node:module';
 import { fileURLToPath } from 'node:url';
+import { PACKAGE_NAME } from './package-name.js';
 let registered = false;
 /**
  * Make `import … from '@uipath/maestro-builder-sdk'` in authored source resolve
@@ -9,16 +10,24 @@ let registered = false;
  * `sdk-resolve-hook.ts` for why. Idempotent; call it before importing authored
  * source.
  *
- * Does nothing when the compiled hook is absent, which is the case only when
- * the SDK runs from its TypeScript source under the test runner. The runner
- * resolves imports itself, so no hook is needed there.
+ * Does nothing when the SDK runs from its TypeScript source under the test
+ * runner, which resolves imports itself. Anywhere else a missing hook means the
+ * SDK was bundled: authored source would then load a second copy of the
+ * package, its expressions would fail this copy's `instanceof` checks, and the
+ * `.flow` would come out wrong with no error. That throws instead.
  */
 export function useThisSdkForAuthoredSource() {
     if (registered)
         return;
-    registered = true;
     const hook = new URL('./sdk-resolve-hook.js', import.meta.url);
-    if (!existsSync(fileURLToPath(hook)))
-        return;
+    if (!existsSync(fileURLToPath(hook))) {
+        if (import.meta.url.endsWith('.ts')) {
+            registered = true;
+            return;
+        }
+        throw new Error(`cannot point authored source at this copy of ${PACKAGE_NAME}: ${fileURLToPath(hook)} is missing, as in a bundle, `
+            + 'so its imports would load a second copy and serialize wrong. Run the installed package, or load authored source yourself.');
+    }
     register(hook);
+    registered = true;
 }

package/dist/serialize.js

@@ -6,9 +6,7 @@
  * resolved from the connector library (entry + v1def sidecar), matching what
  * the platform emits, so the result passes `uip maestro flow validate`.
  */
-import { readFileSync } from 'node:fs';
-import { fileURLToPath } from 'node:url';
-import { dirname, join } from 'node:path';
+import ixpDefinition from './ixp-definition.json' with { type: 'json' };
 import { BUNDLED_DEFINITIONS, bundledVersions } from './flow-definitions.js';
 import { Expr, toExpr, SCHEDULE_PRESETS, parseIxpProjectType, flatNameOf, flatNameSegmentsOf } from './flow-sdk.js';
 import { FlowAction, FlowTrigger } from './core/node-classes.js';
@@ -65,7 +63,6 @@ import { types } from './core/expr.js';
 import { SUBFLOW_START_LABEL } from './core/subflow-start.js';
 import { ownEntry } from './core/own-entry.js';
 import { jsonClone } from './core/json-file.js';
-const HERE = dirname(fileURLToPath(import.meta.url));
 // core-definitions.json is an object keyed by "<nodeType>@<version>".
 const DEFS = BUNDLED_DEFINITIONS;
 // FIRST occurrence wins: with multiple bundled versions of one family (HITL
@@ -2592,7 +2589,7 @@ function promptTokens(content) {
  * ["fileRef"]` (the pre-pull answer) instead of the three the platform's
  * `ixp-node` validator actually enforces.
  */
-const IXP_DEF = JSON.parse(readFileSync(join(HERE, 'ixp-definition.json'), 'utf8'));
+const IXP_DEF = ixpDefinition;
 /**
  * Build the definition for one published IxP project.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uipath/maestro-builder-sdk",
-  "version": "6.27.0",
+  "version": "6.27.1",
   "description": "Build UiPath Flow, Case, and BPMN artifacts by writing TypeScript.",
   "license": "MIT",
   "homepage": "https://docs.uipath.com/maestro",
@@ -92,5 +92,5 @@
     "@types/node": "^22.7.0",
     "esbuild": "^0.28.1"
   },
-  "gitref": "69352e3f5c7c379e0e70b3c7b6fb2fba91255f84"
+  "gitref": "c635f8993b10e795715c85109080ec8e2e2f28d2"
 }