@uipath/maestro-builder-sdk 6.27.0 → 6.28.0

package/dist/cli/commands/bpmn.js

@@ -1,4 +1,4 @@
-import { addValue, inferCheckMode, invoke, loadTool, namedOrLegacySecond, retiredCompiledOption, refuse } from '../common.js';
+import { addValue, inferCheckMode, invoke, namedOrLegacySecond, retiredCompiledOption, refuse } from '../common.js';
 export function registerBpmnCommands(program) {
     const family = program.command('bpmn').description('Build, inspect, and merge BPMN artifacts.');
     family.command('compile')
@@ -18,7 +18,7 @@ export function registerBpmnCommands(program) {
         addValue(argv, '--library', options.library);
         addValue(argv, '--bindings', options.bindings);
         addValue(argv, '--connectors-local', options.connectorsLocal);
-        await invoke('bpmn compile', () => loadTool(import.meta.url, '../../bpmn/compile-cli.js'), argv);
+        await invoke('bpmn compile', () => import('../../bpmn/compile-cli.js'), argv);
     });
     family.command('check')
         .description('Check authored TypeScript. Check a .bpmn with `uip maestro bpmn validate`.')
@@ -51,7 +51,7 @@ export function registerBpmnCommands(program) {
         addValue(argv, '--library', options.library);
         addValue(argv, '--connectors-local', options.connectorsLocal);
         addValue(argv, '--bindings', options.bindings);
-        await invoke('bpmn check', () => loadTool(import.meta.url, '../../bpmn/check-cli.js'), argv);
+        await invoke('bpmn check', () => import('../../bpmn/check-cli.js'), argv);
     });
     family.command('tidy')
         .description('Add diagram layout to a compiled .bpmn artifact.')
@@ -60,7 +60,7 @@ export function registerBpmnCommands(program) {
         .action(async (input, options) => {
         const argv = [input];
         addValue(argv, '-o', options.output);
-        await invoke('bpmn tidy', () => loadTool(import.meta.url, '../../bpmn/tidy-cli.js'), argv);
+        await invoke('bpmn tidy', () => import('../../bpmn/tidy-cli.js'), argv);
     });
     family
         .command('decompile')
@@ -74,7 +74,7 @@ export function registerBpmnCommands(program) {
         addValue(argv, '-o', options.output);
         addValue(argv, '--import', options.import);
         addValue(argv, '--style', options.style);
-        await invoke('bpmn decompile', () => loadTool(import.meta.url, '../../bpmn/decompile-cli.js'), argv);
+        await invoke('bpmn decompile', () => import('../../bpmn/decompile-cli.js'), argv);
     });
     family
         .command('merge')
@@ -95,6 +95,6 @@ export function registerBpmnCommands(program) {
         const argv = [original, edited];
         addValue(argv, '-o', options.output);
         addValue(argv, '--baseline', options.baseline);
-        await invoke('bpmn merge', () => loadTool(import.meta.url, '../../bpmn/merge-cli.js'), argv);
+        await invoke('bpmn merge', () => import('../../bpmn/merge-cli.js'), argv);
     });
 }

package/dist/cli/commands/case.js

@@ -1,4 +1,4 @@
-import { addValue, inferCheckMode, invoke, loadTool, namedOrLegacySecond, retiredCompiledOption, refuse } from '../common.js';
+import { addValue, inferCheckMode, invoke, namedOrLegacySecond, retiredCompiledOption, refuse } from '../common.js';
 export function registerCaseCommands(program) {
     const family = program.command('case').description('Build, check, and merge Case artifacts.');
     family.command('compile')
@@ -14,7 +14,7 @@ export function registerCaseCommands(program) {
         addValue(argv, '--library', options.library);
         addValue(argv, '--bindings', options.bindings);
         addValue(argv, '--connectors-local', options.connectorsLocal);
-        await invoke('case compile', () => loadTool(import.meta.url, '../../case/compile-cli.js'), argv);
+        await invoke('case compile', () => import('../../case/compile-cli.js'), argv);
     });
     family.command('check')
         .description('Check authored TypeScript. Check a caseplan.json with `uip maestro case validate`.')
@@ -45,7 +45,7 @@ export function registerCaseCommands(program) {
         addValue(argv, '--library', options.library);
         addValue(argv, '--connectors-local', options.connectorsLocal);
         addValue(argv, '--bindings', options.bindings);
-        await invoke('case check', () => loadTool(import.meta.url, '../../case/check-cli.js'), argv);
+        await invoke('case check', () => import('../../case/check-cli.js'), argv);
     });
     family.command('decompile')
         .description('Convert a caseplan.json to authored TypeScript.')
@@ -64,7 +64,7 @@ export function registerCaseCommands(program) {
             argv.push('--best-effort');
         if (options.pipeline === false)
             argv.push('--no-pipeline');
-        await invoke('case decompile', () => loadTool(import.meta.url, '../../case/decompile-cli.js'), argv);
+        await invoke('case decompile', () => import('../../case/decompile-cli.js'), argv);
     });
     family.command('merge')
         .description('Merge an edited case plan with its original caseplan.json.')
@@ -82,6 +82,6 @@ export function registerCaseCommands(program) {
         const [edited, original] = pair;
         const argv = [original, edited];
         addValue(argv, '-o', options.output);
-        await invoke('case merge', () => loadTool(import.meta.url, '../../case/merge-cli.js'), argv);
+        await invoke('case merge', () => import('../../case/merge-cli.js'), argv);
     });
 }

package/dist/cli/commands/flow.js

@@ -1,5 +1,5 @@
 import { Option } from 'commander';
-import { addValue, emitOnlyEnabled, inferCheckMode, invoke, loadTool, namedOrLegacySecond, retiredCompiledOption, refuse } from '../common.js';
+import { addValue, emitOnlyEnabled, inferCheckMode, invoke, namedOrLegacySecond, retiredCompiledOption, refuse } from '../common.js';
 /** The retired compiled check's flags: `[commander flags, option key, description]`. One table, so hiding and warning cannot drift. */
 const RETIRED_COMPILED_CHECK_FLAGS = [
     ['--uip', 'uip', 'retired: resolve missing schemas with the UiPath CLI'],
@@ -32,7 +32,7 @@ export function registerFlowCommands(program) {
         addValue(argv, '--connectors-local', options.connectorsLocal);
         if (options.check === false || emitOnlyEnabled())
             argv.push('--no-check');
-        await invoke('flow compile', () => loadTool(import.meta.url, '../../compile-cli.js'), argv);
+        await invoke('flow compile', () => import('../../compile-cli.js'), argv);
     });
     const check = flow.command('check')
         .description('Check authored TypeScript. Check a compiled .flow with `uip maestro flow validate`.')
@@ -69,7 +69,7 @@ export function registerFlowCommands(program) {
             const argv = [input];
             addValue(argv, '--library', options.library);
             addValue(argv, '--connectors-local', options.connectorsLocal);
-            await invoke('flow check', () => loadTool(import.meta.url, '../../check-cli.js'), argv);
+            await invoke('flow check', () => import('../../check-cli.js'), argv);
             return;
         }
         // The COMPILED-artifact analyser is gone: it was a standalone tool bundled into this
@@ -100,15 +100,18 @@ export function registerFlowCommands(program) {
             argv.push('--strict');
         if (options.pipeline === false)
             argv.push('--no-pipeline');
-        await invoke('flow decompile', () => loadTool(import.meta.url, '../../decompile-cli.js'), argv);
+        await invoke('flow decompile', () => import('../../decompile-cli.js'), argv);
     });
     flow.command('merge')
         .description('Merge an edited flow with its original artifact.')
-        .argument('<edited>', 'edited .flow path')
+        .argument('<edited>', 'edited .flow path, or the edited .flow.ts source (merge compiles it, tolerating untouched draft nodes)')
         .option('--original <file>', '(required) original .flow path, the artifact to merge into')
         .option('-o, --output <file>', 'merged output path')
         .option('--baseline <file>', 'compiled pristine decompile')
-        .option('--strict', 'refuse when the no-edit round trip (--baseline) differs from the original')
+        .option('--baseline-from <file>', 'build the baseline from this original .flow (decompile + compile, tolerating draft nodes) instead of --baseline')
+        .option('--library <dir>', 'connector library, for compiling with --baseline-from or a .flow.ts edited source')
+        .option('--bindings <file>', 'bindings.json, for the same compiles')
+        .option('--strict', 'refuse when the no-edit round trip (the baseline) differs from the original')
         .allowExcessArguments()
         .action(async (_edited, options, command) => {
         const pair = namedOrLegacySecond(command, {
@@ -121,8 +124,11 @@ export function registerFlowCommands(program) {
         const argv = [original, edited];
         addValue(argv, '-o', options.output);
         addValue(argv, '--baseline', options.baseline);
+        addValue(argv, '--baseline-from', options.baselineFrom);
+        addValue(argv, '--library', options.library);
+        addValue(argv, '--bindings', options.bindings);
         if (options.strict)
             argv.push('--strict');
-        await invoke('flow merge', () => loadTool(import.meta.url, '../../merge-cli.js'), argv);
+        await invoke('flow merge', () => import('../../merge-cli.js'), argv);
     });
 }

package/dist/cli/commands/registry.js

@@ -1,4 +1,4 @@
-import { addValue, invoke, loadTool, namedOrLegacySecond } from '../common.js';
+import { addValue, invoke, namedOrLegacySecond } from '../common.js';
 /** Commander hands a repeatable option one value at a time. */
 function collect(value, previous) {
     return [...previous, value];
@@ -49,7 +49,7 @@ export function registerRegistryCommands(program) {
         addValue(argv, '--root', options.root);
         addValue(argv, '--extractor', options.extractor);
         addValue(argv, '--generator', options.generator);
-        await invoke('registry pull', () => loadTool(import.meta.url, '../../registry/pull-cli.js'), argv);
+        await invoke('registry pull', () => import('../../registry/pull-cli.js'), argv);
     });
     family.command('materialize')
         .description('Generate library-md and connectors/ from an extracted library-json.')
@@ -80,7 +80,7 @@ export function registerRegistryCommands(program) {
             argv.push('--check-orphans');
         addValue(argv, '--python', options.python);
         addValue(argv, '--generator', options.generator);
-        await invoke('registry materialize', () => loadTool(import.meta.url, '../../registry/materialize-cli.js'), argv);
+        await invoke('registry materialize', () => import('../../registry/materialize-cli.js'), argv);
     });
     // The pipeline's generator, `generate_library_json.py`, flag for flag: the
     // Azure YAML that calls it should only have to swap the executable.
@@ -119,7 +119,7 @@ export function registerRegistryCommands(program) {
         addValue(argv, '--connectors', options.connectors);
         addValue(argv, '--catalog-scope', options.catalogScope);
         addValue(argv, '--concurrency', options.concurrency);
-        await invoke('registry build-library', () => loadTool(import.meta.url, '../../registry/library-build/cli.js'), argv);
+        await invoke('registry build-library', () => import('../../registry/library-build/cli.js'), argv);
     });
     family.command('prepare')
         .description("Resolve one operation's schema against a live connection into ./.flow-sdk/connectors-local.")
@@ -200,7 +200,7 @@ export function registerRegistryCommands(program) {
             argv.push('--no-source-rewrite');
         addValue(argv, '--python', options.python);
         addValue(argv, '--generator', options.generator);
-        await invoke('registry prepare', () => loadTool(import.meta.url, '../../registry/prepare-cli.js'), argv);
+        await invoke('registry prepare', () => import('../../registry/prepare-cli.js'), argv);
     });
     family.command('path')
         .description('Print where the cached connector library is.')
@@ -216,7 +216,7 @@ export function registerRegistryCommands(program) {
             if (options[key])
                 argv.push(`--${flag}`);
         }
-        await invoke('registry path', () => loadTool(import.meta.url, '../../registry/path-cli.js'), argv);
+        await invoke('registry path', () => import('../../registry/path-cli.js'), argv);
     });
     family.command('search')
         .description('Find connector operations in an extracted library.')
@@ -231,6 +231,6 @@ export function registerRegistryCommands(program) {
         addValue(argv, '--library-md', options.libraryMd);
         addValue(argv, '--connector', options.connector);
         addValue(argv, '--limit', options.limit);
-        await invoke('registry search', () => loadTool(import.meta.url, '../../registry/search-cli.js'), argv);
+        await invoke('registry search', () => import('../../registry/search-cli.js'), argv);
     });
 }

package/dist/cli/common.d.ts

@@ -1,8 +1,5 @@
 import { type Command, Option } from 'commander';
 export type ToolRun = (argv: string[]) => Promise<number> | number;
-export declare function loadTool(baseUrl: string, relativePath: string): Promise<{
-    run: ToolRun;
-}>;
 export declare function invoke(label: string, load: () => Promise<{
     run: ToolRun;
 }>, argv: string[]): Promise<void>;

package/dist/cli/common.js

@@ -1,14 +1,12 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { Option } from 'commander';
-export function loadTool(baseUrl, relativePath) {
-    return import(new URL(relativePath, baseUrl).href);
-}
 export async function invoke(label, load, argv) {
     // In `--json` mode stdout carries exactly one JSON object, printed by
     // `emitJsonResult` once the verb is done. The tool's own human lines go to
     // stderr meanwhile, so they are still seen but never mixed into it.
     const restore = jsonResultRequested() ? routeStdoutToStderr() : () => { };
+    globalThis[HOSTED_BY_CLI] = true;
     try {
         const code = await (await load()).run(argv);
         if (code !== 0)
@@ -24,6 +22,8 @@ export async function invoke(label, load, argv) {
         restore();
     }
 }
+/** Tells `runWhenInvokedDirectly` (`src/cli-run.ts`) the tool is run by this CLI. */
+const HOSTED_BY_CLI = Symbol.for('uipath.maestro-builder-sdk.cli-hosted');
 /**
  * The slot `src/cli-result.ts` writes (`reportResult`). Read here through the
  * same `Symbol.for` key, since `dist/cli/` and `dist/` are separate builds.

package/dist/cli-run.js

@@ -14,7 +14,17 @@ function realOrAbsolute(path) {
         return resolve(path);
     }
 }
+/**
+ * Set by the `flow-sdk` CLI before it imports a tool (`cli/common.ts`, read
+ * through the same `Symbol.for` key since `dist/cli/` is a separate build). A
+ * bundle gives every module the bundle's own `import.meta.url`, which matches
+ * `process.argv[1]` for whichever tool the CLI loads; without this the tool
+ * would run a second time, on the CLI's argv.
+ */
+const HOSTED_BY_CLI = Symbol.for('uipath.maestro-builder-sdk.cli-hosted');
 export function runWhenInvokedDirectly(moduleUrl, label, run) {
+    if (globalThis[HOSTED_BY_CLI])
+        return;
     const entry = process.argv[1];
     if (!entry)
         return;

package/dist/core/connector-inputs.d.ts

@@ -37,6 +37,12 @@ export interface ConnectorInputOpts {
     lookups?: Readonly<Record<string, LookupSpec>>;
     /** `ignore` skips an unresolved lookup instead of refusing it — what `check` wants. */
     unresolvedLookups?: 'error' | 'ignore';
+    /**
+     * Receives a missing REQUIRED input instead of refusing it — the draft
+     * tolerance of a merge-owned compile (#1134). Every other input error still
+     * refuses.
+     */
+    onMissingRequired?: (message: string) => void;
 }
 /** Flow's dialect, re-exported so `serialize.ts` need not reach past this module. */
 export { FLOW_EXPR_DIALECT } from './connector-checks.js';

package/dist/core/connector-inputs.js

@@ -116,8 +116,13 @@ export function buildConnectorInputs(rc, inputs, opts) {
             // not know what to put in it than because they forgot it exists: name the
             // id it sends and the helper that finds one, so "(string)" is not read as
             // "any string" — an e-mail into `fields.reporter.id` is exactly that misreading.
-            if (f.required)
-                errs.push(`missing required input "${f.name}" (${f.type ?? 'value'})${missingLookupHint(f.name, lookups[f.name], rc, dialect.descriptors)}`);
+            if (f.required) {
+                const message = `missing required input "${f.name}" (${f.type ?? 'value'})${missingLookupHint(f.name, lookups[f.name], rc, dialect.descriptors)}`;
+                if (opts.onMissingRequired)
+                    opts.onMissingRequired(message);
+                else
+                    errs.push(message);
+            }
             continue;
         }
         // An unresolved lookup is swapped for its recorded id, or reported. It is

package/dist/core/sha.d.ts

@@ -0,0 +1,16 @@
+/**
+ * SHA-1 and SHA-256 of a string's UTF-8 bytes, in plain JavaScript.
+ *
+ * The ids built from them (`schemaId` in `serialize.ts`, `sha256Uuid` in
+ * `stable-id.ts`) are computed synchronously while a flow serializes, and must be
+ * byte-for-byte what `node:crypto` gives, since they are already in shipped
+ * artifacts. Owning the digest here keeps the authoring path free of `node:`
+ * imports, so a host without Node (a browser sandbox) runs it unshimmed; the
+ * browser's own `crypto.subtle.digest` is async-only. `tests/sha.test.ts` checks
+ * both against `node:crypto`. They derive ids, nothing secret: not for passwords,
+ * signatures or integrity checks.
+ */
+export declare function sha1(text: string): Uint8Array;
+export declare function sha256(text: string): Uint8Array;
+/** Lowercase hex of `bytes`, as `digest('hex')` writes it. */
+export declare function bytesToHex(bytes: Uint8Array): string;

package/dist/core/sha.js

@@ -0,0 +1,118 @@
+/**
+ * SHA-1 and SHA-256 of a string's UTF-8 bytes, in plain JavaScript.
+ *
+ * The ids built from them (`schemaId` in `serialize.ts`, `sha256Uuid` in
+ * `stable-id.ts`) are computed synchronously while a flow serializes, and must be
+ * byte-for-byte what `node:crypto` gives, since they are already in shipped
+ * artifacts. Owning the digest here keeps the authoring path free of `node:`
+ * imports, so a host without Node (a browser sandbox) runs it unshimmed; the
+ * browser's own `crypto.subtle.digest` is async-only. `tests/sha.test.ts` checks
+ * both against `node:crypto`. They derive ids, nothing secret: not for passwords,
+ * signatures or integrity checks.
+ */
+function utf8(text) {
+    return new TextEncoder().encode(text);
+}
+/** The message padded to a multiple of 64 bytes, with its bit length in the last 8, big-endian. */
+function padded(message) {
+    const length = Math.ceil((message.length + 9) / 64) * 64;
+    const bytes = new Uint8Array(length);
+    bytes.set(message);
+    bytes[message.length] = 0x80;
+    const view = new DataView(bytes.buffer);
+    const bits = message.length * 8;
+    view.setUint32(length - 8, Math.floor(bits / 0x100000000));
+    view.setUint32(length - 4, bits >>> 0);
+    return view;
+}
+function digest(words) {
+    const out = new Uint8Array(words.length * 4);
+    const view = new DataView(out.buffer);
+    words.forEach((word, i) => view.setUint32(i * 4, word));
+    return out;
+}
+const rotl = (x, n) => (x << n) | (x >>> (32 - n));
+const rotr = (x, n) => (x >>> n) | (x << (32 - n));
+export function sha1(text) {
+    const view = padded(utf8(text));
+    const h = [0x67452301, 0xefcdab89, 0x98badcfe, 0x10325476, 0xc3d2e1f0];
+    const w = new Array(80);
+    for (let block = 0; block < view.byteLength; block += 64) {
+        for (let i = 0; i < 16; i++)
+            w[i] = view.getUint32(block + i * 4);
+        for (let i = 16; i < 80; i++)
+            w[i] = rotl(w[i - 3] ^ w[i - 8] ^ w[i - 14] ^ w[i - 16], 1);
+        let [a, b, c, d, e] = h;
+        for (let i = 0; i < 80; i++) {
+            const [f, k] = i < 20 ? [(b & c) | (~b & d), 0x5a827999]
+                : i < 40 ? [b ^ c ^ d, 0x6ed9eba1]
+                    : i < 60 ? [(b & c) | (b & d) | (c & d), 0x8f1bbcdc]
+                        : [b ^ c ^ d, 0xca62c1d6];
+            const t = (rotl(a, 5) + f + e + k + w[i]) | 0;
+            e = d;
+            d = c;
+            c = rotl(b, 30);
+            b = a;
+            a = t;
+        }
+        h[0] = (h[0] + a) | 0;
+        h[1] = (h[1] + b) | 0;
+        h[2] = (h[2] + c) | 0;
+        h[3] = (h[3] + d) | 0;
+        h[4] = (h[4] + e) | 0;
+    }
+    return digest(h);
+}
+const K256 = [
+    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+    0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+    0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+    0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+    0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+    0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+];
+export function sha256(text) {
+    const view = padded(utf8(text));
+    const h = [0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19];
+    const w = new Array(64);
+    for (let block = 0; block < view.byteLength; block += 64) {
+        for (let i = 0; i < 16; i++)
+            w[i] = view.getUint32(block + i * 4);
+        for (let i = 16; i < 64; i++) {
+            const s0 = rotr(w[i - 15], 7) ^ rotr(w[i - 15], 18) ^ (w[i - 15] >>> 3);
+            const s1 = rotr(w[i - 2], 17) ^ rotr(w[i - 2], 19) ^ (w[i - 2] >>> 10);
+            w[i] = (w[i - 16] + s0 + w[i - 7] + s1) | 0;
+        }
+        let [a, b, c, d, e, f, g, hh] = h;
+        for (let i = 0; i < 64; i++) {
+            const t1 = (hh + (rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25)) + ((e & f) ^ (~e & g)) + K256[i] + w[i]) | 0;
+            const t2 = ((rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) + ((a & b) ^ (a & c) ^ (b & c))) | 0;
+            hh = g;
+            g = f;
+            f = e;
+            e = (d + t1) | 0;
+            d = c;
+            c = b;
+            b = a;
+            a = (t1 + t2) | 0;
+        }
+        h[0] = (h[0] + a) | 0;
+        h[1] = (h[1] + b) | 0;
+        h[2] = (h[2] + c) | 0;
+        h[3] = (h[3] + d) | 0;
+        h[4] = (h[4] + e) | 0;
+        h[5] = (h[5] + f) | 0;
+        h[6] = (h[6] + g) | 0;
+        h[7] = (h[7] + hh) | 0;
+    }
+    return digest(h);
+}
+/** Lowercase hex of `bytes`, as `digest('hex')` writes it. */
+export function bytesToHex(bytes) {
+    let out = '';
+    for (const byte of bytes)
+        out += byte.toString(16).padStart(2, '0');
+    return out;
+}

package/dist/core/stable-id.js

@@ -36,7 +36,7 @@
  * site uses; `tests/cli.test.ts` pins the Case entry point's `uniqueId`. Change one
  * only deliberately, updating that table and any byte-lock fixture it moves.
  */
-import { createHash } from 'node:crypto';
+import { bytesToHex, sha1, sha256 } from './sha.js';
 /** A uuid-shaped id derived from `seed`. Every segment is unsigned, including the `>>> 0` fix explained above. */
 export function stableId(seed) {
     let h1 = 0x811c9dc5;
@@ -88,7 +88,7 @@ export function fnv1aX4Uuid(seed) {
  * Consumer: a Case entry point's `uniqueId` in `entry-points.json` (`case/compile-cli.ts`).
  */
 export function sha256Uuid(seed) {
-    const h = createHash('sha256').update(seed).digest('hex');
+    const h = bytesToHex(sha256(seed));
     return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20, 32)}`;
 }
 /**
@@ -100,10 +100,9 @@ export function sha256Uuid(seed) {
  * (SHA-1 based, version + variant bits set) because that is what the field holds.
  */
 export function schemaId(flowId, nodeId) {
-    const h = createHash('sha1').update(`uipath.human-in-the-loop:${flowId}:${nodeId}`).digest();
-    const b = Buffer.from(h.subarray(0, 16));
+    const b = sha1(`uipath.human-in-the-loop:${flowId}:${nodeId}`).slice(0, 16);
     b[6] = (b[6] & 0x0f) | 0x50;
     b[8] = (b[8] & 0x3f) | 0x80;
-    const hex = b.toString('hex');
-    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+    const h = bytesToHex(b);
+    return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20)}`;
 }

package/dist/flow-definitions.js

@@ -6,15 +6,13 @@
  * Kept apart from `serialize.ts` so the registry can depend on the bundle without
  * importing the serializer that depends on the registry.
  */
-import { readFileSync } from 'node:fs';
-import { dirname, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
+import coreDefinitions from './core-definitions.json' with { type: 'json' };
 /**
  * The bundled definitions, keyed `<nodeType>@<version>`. Deep-frozen: every reader
  * shares this one copy, so a write meant for one node must clone first, and one
  * that does not throws at its own site instead of leaking into another reader.
  */
-export const BUNDLED_DEFINITIONS = deepFreeze(JSON.parse(readFileSync(join(dirname(fileURLToPath(import.meta.url)), 'core-definitions.json'), 'utf8')));
+export const BUNDLED_DEFINITIONS = deepFreeze(coreDefinitions);
 function deepFreeze(value) {
     if (value !== null && typeof value === 'object' && !Object.isFrozen(value)) {
         Object.freeze(value);

package/dist/merge-cli.d.ts

@@ -1,3 +1,3 @@
 #!/usr/bin/env node
 import { type CliExitCode } from './cli-run.js';
-export declare function run(argv: string[]): CliExitCode;
+export declare function run(argv: string[]): Promise<CliExitCode>;

package/dist/merge-cli.js

@@ -3,7 +3,13 @@
  * merge-cli — merge an edited flow back into the original `.flow` (bin `flow-merge`)
  *
  * Usage:
- *   flow-merge <original.flow> <edited.flow> [-o merged.flow] [--baseline <baseline.flow>] [--strict]
+ *   flow-merge <original.flow> <edited.flow | Edited.flow.ts> [-o merged.flow]
+ *              [--baseline <baseline.flow> | --baseline-from <original.flow>] [--strict]
+ *
+ * `--baseline-from <original.flow>` makes merge build the baseline itself
+ * (decompile + compile, nothing written), and an edited `.flow.ts` makes merge
+ * compile it: both compiles tolerate DRAFT nodes, and merge refuses a draft
+ * only where it would take the node from the edited flow. See merge-compile.ts.
  *
  * `edited.flow` is compile(decompile(original) after your edits). `--baseline`
  * is compile(decompile(original)) BEFORE any edit — supplying it enables the
@@ -19,27 +25,88 @@ import { readFileSync } from 'node:fs';
 import { basename, resolve } from 'node:path';
 import { MergeRefusedError, mergeFlow } from './merge.js';
 import { flagValue, runWhenInvokedDirectly } from './cli-run.js';
-export function run(argv) {
+import { ensureTypeScriptRuntime } from './node-runtime.js';
+import { flowCheckOpts, openCliLibrary } from './cli-library.js';
+import { Bindings } from './bindings.js';
+import { defaultBindingsFile } from './workdir.js';
+import { baselineFromOriginal, checkEdited, classifyDrafts, compileSourceDraftTolerant } from './merge-compile.js';
+const USAGE = 'usage: flow-merge <original.flow> <edited.flow | Edited.flow.ts> [-o merged.flow] '
+    + '[--baseline <baseline.flow> | --baseline-from <original.flow>] [--library <dir>] [--bindings <file>] [--strict]';
+export async function run(argv) {
     if (argv.length === 0 || argv[0] === '-h' || argv[0] === '--help') {
-        console.error('usage: flow-merge <original.flow> <edited.flow> [-o merged.flow] [--baseline <baseline.flow>] [--strict]');
+        console.error(USAGE);
         return 2;
     }
-    const flags = new Set(['-o', '--baseline']);
+    const flags = new Set(['-o', '--baseline', '--baseline-from', '--library', '--bindings', '--connectors-local']);
     const positionals = argv.filter((a, i) => !flags.has(a) && !flags.has(argv[i - 1]) && !a.startsWith('-'));
     const [originalPath, editedPath] = positionals;
     if (!originalPath || !editedPath) {
         console.error('flow-merge: need <original.flow> and <edited.flow>');
         return 2;
     }
-    const original = JSON.parse(readFileSync(originalPath, 'utf8'));
-    const edited = JSON.parse(readFileSync(editedPath, 'utf8'));
     const baselinePath = flagValue(argv, '--baseline');
-    const baseline = baselinePath ? JSON.parse(readFileSync(baselinePath, 'utf8')) : undefined;
+    const baselineFrom = flagValue(argv, '--baseline-from');
+    if (baselinePath && baselineFrom) {
+        console.error('flow-merge: pass --baseline or --baseline-from, not both');
+        return 2;
+    }
+    const editedIsSource = /\.ts$/.test(editedPath);
+    // Merge compiles a side itself only for --baseline-from or a .flow.ts edited
+    // source; both load TypeScript, so both need the type-stripping runtime.
+    if (baselineFrom || editedIsSource)
+        ensureTypeScriptRuntime();
+    const library = baselineFrom || editedIsSource ? openCliLibrary(argv) : undefined;
+    const bindings = baselineFrom || editedIsSource ? new Bindings(flagValue(argv, '--bindings') ?? defaultBindingsFile()) : undefined;
+    const compileOpts = { library, bindings };
+    const original = JSON.parse(readFileSync(originalPath, 'utf8'));
+    let drafts = [];
+    let diagnostics = [];
+    let edited;
+    if (editedIsSource) {
+        // The edited source gets what `compile` gives it: check() with the same
+        // options, and the serializer's warnings (CONNECTION_STUB, ...) printed.
+        const compiled = await compileSourceDraftTolerant(resolve(editedPath), {
+            ...compileOpts,
+            warn: (w) => console.error(`  ⚠ [${w.code}] ${w.message}`),
+        });
+        edited = compiled.flow;
+        drafts = compiled.drafts;
+        diagnostics = checkEdited(compiled.built, edited, flowCheckOpts(library, bindings));
+    }
+    else {
+        edited = JSON.parse(readFileSync(editedPath, 'utf8'));
+    }
+    const baseline = baselineFrom
+        ? (await baselineFromOriginal(baselineFrom, compileOpts, (m) => console.error(`flow-merge: decompile warning: ${m}`))).flow
+        : baselinePath ? JSON.parse(readFileSync(baselinePath, 'utf8')) : undefined;
     const strict = argv.includes('--strict');
     if (strict && !baseline) {
-        console.error('flow-merge: --strict compares the no-edit round trip with the original; pass --baseline <baseline.flow>');
+        console.error('flow-merge: --strict compares the no-edit round trip with the original; pass --baseline <baseline.flow> or --baseline-from <original.flow>');
         return 2;
     }
+    // A draft node (no connection, an empty required input, no object) is
+    // acceptable only where merge restores the ORIGINAL node; one the author
+    // changed or added gets the strict compile's refusal (#1134).
+    // check()'s errors follow the same rule; its warnings are printed as compile prints them.
+    const { kept, refused } = classifyDrafts(original, edited, baseline, drafts);
+    const checked = classifyDrafts(original, edited, baseline, diagnostics.filter((d) => d.level === 'error'));
+    for (const d of diagnostics)
+        if (d.level === 'warning')
+            console.error(`  ⚠ [${d.code}] ${d.message}`);
+    for (const d of [...kept, ...checked.kept]) {
+        console.error(`  ⚠ [DRAFT_NODE_KEPT] "${d.nodeId}" is unfinished in the original (${d.code}); it is untouched, so the original node is kept as is.`);
+    }
+    const errors = [...refused, ...checked.refused];
+    if (errors.length) {
+        for (const d of errors) {
+            const where = d.nodeId === '' ? 'the edited flow'
+                : d.reason === 'subflow' ? `"${d.nodeId}" is inside a subflow, which merge takes whole; finish it`
+                    : `"${d.nodeId}" is changed or new in the edited flow`;
+            console.error(`  ✗ [${d.code}] ${where}: ${d.message}`);
+        }
+        console.error(`flow-merge: ${errors.length} error(s) in nodes merge takes from the edited flow; finish them or revert the edit. Nothing written.`);
+        return 1;
+    }
     let merged;
     try {
         merged = mergeFlow(original, edited, {

package/dist/merge-compile.d.ts

@@ -0,0 +1,55 @@
+import { type DraftFinding, type SerializeOpts } from './serialize.js';
+import { type CheckOpts, type Diagnostic } from './check.js';
+import type { BuiltFlow } from './flow-sdk.js';
+/** A compile's flow and the draft refusals it reported instead of throwing. */
+export interface DraftTolerantCompile {
+    flow: any;
+    drafts: DraftFinding[];
+}
+/** Compile `built` with draft tolerance. Every other refusal still throws. */
+export declare function compileDraftTolerant(built: BuiltFlow, opts?: Omit<SerializeOpts, 'draft'>): DraftTolerantCompile;
+/**
+ * Load a `.flow.ts` source and compile it with draft tolerance.
+ * The caller has already called `ensureTypeScriptRuntime()`.
+ */
+export declare function compileSourceDraftTolerant(file: string, opts?: Omit<SerializeOpts, 'draft'>): Promise<DraftTolerantCompile & {
+    built: BuiltFlow;
+}>;
+/**
+ * The baseline of `originalPath`: decompile it (reading agent sidecars beside
+ * it, as `flow decompile` does), then compile the source with draft tolerance.
+ * The source goes to a temporary directory that is removed afterwards.
+ */
+export declare function baselineFromOriginal(originalPath: string, opts?: Omit<SerializeOpts, 'draft'>, warn?: (message: string) => void): Promise<DraftTolerantCompile>;
+/** Why merge takes a node from the edited flow, so a finding on it is an error. */
+export type TakenReason = 'edited' | 'subflow';
+/** A finding on a node merge takes from the edited flow, with the reason it takes it. */
+export type Refused<T> = T & {
+    reason: TakenReason;
+};
+/**
+ * Sort each finding by what merge does with its node: `refused` when the node
+ * comes from the edited flow (reason `edited`: the author changed or added it;
+ * reason `subflow`: it sits in a subflow, which merge takes from `edited`
+ * whole), `kept` when merge restores the original node.
+ *
+ * For instance a Slack node with no connection that the author did not touch
+ * is `kept`; the same node with a new message text is `refused` as `edited`.
+ */
+export declare function classifyDrafts<T extends {
+    nodeId: string;
+}>(original: any, edited: any, baseline: any, findings: readonly T[]): {
+    kept: T[];
+    refused: Refused<T>[];
+};
+/** A `check()` diagnostic, placed on the root node its step emitted (`''` when it names no root step). */
+export type PlacedDiagnostic = Diagnostic & {
+    nodeId: string;
+};
+/**
+ * Run `check()` on the edited source, as `compile` does, and place each
+ * diagnostic on the node its step emitted in `editedFlow`, so
+ * {@link classifyDrafts} can sort it. A diagnostic with no step, or a step
+ * with no root node, gets nodeId `''`, which is always refused.
+ */
+export declare function checkEdited(built: BuiltFlow, editedFlow: any, opts: CheckOpts): PlacedDiagnostic[];

package/dist/merge-compile.js

@@ -0,0 +1,104 @@
+/**
+ * merge-compile — the compiles `flow merge --baseline-from` runs itself (#1134).
+ *
+ * Both compiles tolerate draft nodes (`SerializeOpts.draft`). A draft on a node
+ * merge keeps from the original is a warning; a draft or `check()` error on a
+ * node merge takes from the edited flow is an error. Nothing draft-tolerant is
+ * written to disk.
+ */
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { decompile } from './decompile.js';
+import { loadBuiltFlow } from './load.js';
+import { serialize } from './serialize.js';
+import { check } from './check.js';
+import { nodesTakenFromEdited } from './merge.js';
+import { PACKAGE_NAME } from './package-name.js';
+/** Compile `built` with draft tolerance. Every other refusal still throws. */
+export function compileDraftTolerant(built, opts = {}) {
+    const drafts = [];
+    const flow = serialize(built, { ...opts, draft: (f) => drafts.push(f) });
+    return { flow, drafts };
+}
+/**
+ * Load a `.flow.ts` source and compile it with draft tolerance.
+ * The caller has already called `ensureTypeScriptRuntime()`.
+ */
+export async function compileSourceDraftTolerant(file, opts = {}) {
+    const built = await loadBuiltFlow(file);
+    return { ...compileDraftTolerant(built, opts), built };
+}
+/**
+ * The baseline of `originalPath`: decompile it (reading agent sidecars beside
+ * it, as `flow decompile` does), then compile the source with draft tolerance.
+ * The source goes to a temporary directory that is removed afterwards.
+ */
+export async function baselineFromOriginal(originalPath, opts = {}, warn) {
+    const original = JSON.parse(readFileSync(originalPath, 'utf8'));
+    const source = decompile(original, {
+        importSpecifier: PACKAGE_NAME,
+        warn,
+        readSidecar: (relativePath) => {
+            try {
+                return readFileSync(join(dirname(resolve(originalPath)), relativePath), 'utf8');
+            }
+            catch {
+                return undefined;
+            }
+        },
+    });
+    const dir = mkdtempSync(join(tmpdir(), 'flow-merge-baseline-'));
+    try {
+        writeFileSync(join(dir, 'package.json'), '{"type":"module"}\n');
+        const file = join(dir, 'Baseline.flow.ts');
+        writeFileSync(file, source);
+        return await compileSourceDraftTolerant(file, opts);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+}
+/**
+ * Sort each finding by what merge does with its node: `refused` when the node
+ * comes from the edited flow (reason `edited`: the author changed or added it;
+ * reason `subflow`: it sits in a subflow, which merge takes from `edited`
+ * whole), `kept` when merge restores the original node.
+ *
+ * For instance a Slack node with no connection that the author did not touch
+ * is `kept`; the same node with a new message text is `refused` as `edited`.
+ */
+export function classifyDrafts(original, edited, baseline, findings) {
+    const fromEdited = new Set(nodesTakenFromEdited(original, edited, baseline));
+    const rootIds = new Set((edited?.nodes ?? []).map((n) => n.id));
+    const kept = [];
+    const refused = [];
+    for (const f of findings) {
+        if (!rootIds.has(f.nodeId))
+            refused.push({ ...f, reason: 'subflow' });
+        else if (fromEdited.has(f.nodeId))
+            refused.push({ ...f, reason: 'edited' });
+        else
+            kept.push(f);
+    }
+    return { kept, refused };
+}
+/**
+ * Run `check()` on the edited source, as `compile` does, and place each
+ * diagnostic on the node its step emitted in `editedFlow`, so
+ * {@link classifyDrafts} can sort it. A diagnostic with no step, or a step
+ * with no root node, gets nodeId `''`, which is always refused.
+ */
+export function checkEdited(built, editedFlow, opts) {
+    const byStep = new Map();
+    for (const n of editedFlow?.nodes ?? []) {
+        const label = n?.display?.label;
+        if (typeof label === 'string' && !byStep.has(label))
+            byStep.set(label, n.id);
+    }
+    const ids = new Set((editedFlow?.nodes ?? []).map((n) => n.id));
+    return check(built, opts).map((d) => ({
+        ...d,
+        nodeId: d.step === undefined ? '' : byStep.get(d.step) ?? (ids.has(d.step) ? d.step : ''),
+    }));
+}

package/dist/merge.d.ts

@@ -152,4 +152,13 @@ export interface MergeOptions {
      */
     strict?: boolean;
 }
+/**
+ * The ids of the root nodes {@link mergeFlow} takes from `edited` rather than
+ * restoring from `original`: every node that is new, or that differs from its
+ * `baseline` counterpart. With no baseline, that is every node.
+ *
+ * For instance, with a baseline equal to `edited` and every node present in
+ * `original`, the answer is `[]` — a no-edit merge keeps them all.
+ */
+export declare function nodesTakenFromEdited(original: AnyFlow, edited: AnyFlow, baseline?: AnyFlow): string[];
 export declare function mergeFlow(original: AnyFlow, edited: AnyFlow, options?: MergeOptions): AnyFlow;

package/dist/merge.js

@@ -97,6 +97,27 @@ function nodeUnchanged(a, b) {
         return false;
     return JSON.stringify(a.inputs ?? {}) === JSON.stringify(b.inputs ?? {});
 }
+/**
+ * The ids of the root nodes {@link mergeFlow} takes from `edited` rather than
+ * restoring from `original`: every node that is new, or that differs from its
+ * `baseline` counterpart. With no baseline, that is every node.
+ *
+ * For instance, with a baseline equal to `edited` and every node present in
+ * `original`, the answer is `[]` — a no-edit merge keeps them all.
+ */
+export function nodesTakenFromEdited(original, edited, baseline) {
+    const origNodes = byId(original.nodes);
+    const baseNodes = byId(baseline?.nodes);
+    return (edited.nodes ?? []).filter((e) => !isKept(e, origNodes, baseNodes, baseline)).map((e) => e.id);
+}
+/**
+ * Whether merge restores `e`'s ORIGINAL node instead of taking `e`: there is a
+ * baseline, the original has the node, and `e` equals its baseline counterpart.
+ * {@link mergeFlow}'s node loop and {@link nodesTakenFromEdited} both ask this.
+ */
+function isKept(e, origNodes, baseNodes, baseline) {
+    return !!baseline && origNodes.has(e.id) && nodeUnchanged(e, baseNodes.get(e.id));
+}
 /**
  * Give an edited node the original's position, by id.
  *
@@ -132,7 +153,7 @@ export function mergeFlow(original, edited, options = {}) {
     const finalNodes = [];
     for (const e of edited.nodes ?? []) {
         const orig = origNodes.get(e.id);
-        if (options.baseline && orig && nodeUnchanged(e, baseNodes.get(e.id))) {
+        if (isKept(e, origNodes, baseNodes, options.baseline) && orig) {
             // Untouched by the user (equal to the faithful baseline) → keep the
             // original node exactly, placeholder-safe.
             finalNodes.push(jsonClone(orig));

package/dist/sdk-resolve.d.ts

@@ -4,8 +4,10 @@
  * `sdk-resolve-hook.ts` for why. Idempotent; call it before importing authored
  * source.
  *
- * Does nothing when the compiled hook is absent, which is the case only when
- * the SDK runs from its TypeScript source under the test runner. The runner
- * resolves imports itself, so no hook is needed there.
+ * Does nothing when the SDK runs from its TypeScript source under the test
+ * runner, which resolves imports itself. Anywhere else a missing hook means the
+ * SDK was bundled: authored source would then load a second copy of the
+ * package, its expressions would fail this copy's `instanceof` checks, and the
+ * `.flow` would come out wrong with no error. That throws instead.
  */
 export declare function useThisSdkForAuthoredSource(): void;

package/dist/sdk-resolve.js

@@ -2,6 +2,7 @@
 import { existsSync } from 'node:fs';
 import { register } from 'node:module';
 import { fileURLToPath } from 'node:url';
+import { PACKAGE_NAME } from './package-name.js';
 let registered = false;
 /**
  * Make `import … from '@uipath/maestro-builder-sdk'` in authored source resolve
@@ -9,16 +10,24 @@ let registered = false;
  * `sdk-resolve-hook.ts` for why. Idempotent; call it before importing authored
  * source.
  *
- * Does nothing when the compiled hook is absent, which is the case only when
- * the SDK runs from its TypeScript source under the test runner. The runner
- * resolves imports itself, so no hook is needed there.
+ * Does nothing when the SDK runs from its TypeScript source under the test
+ * runner, which resolves imports itself. Anywhere else a missing hook means the
+ * SDK was bundled: authored source would then load a second copy of the
+ * package, its expressions would fail this copy's `instanceof` checks, and the
+ * `.flow` would come out wrong with no error. That throws instead.
  */
 export function useThisSdkForAuthoredSource() {
     if (registered)
         return;
-    registered = true;
     const hook = new URL('./sdk-resolve-hook.js', import.meta.url);
-    if (!existsSync(fileURLToPath(hook)))
-        return;
+    if (!existsSync(fileURLToPath(hook))) {
+        if (import.meta.url.endsWith('.ts')) {
+            registered = true;
+            return;
+        }
+        throw new Error(`cannot point authored source at this copy of ${PACKAGE_NAME}: ${fileURLToPath(hook)} is missing, as in a bundle, `
+            + 'so its imports would load a second copy and serialize wrong. Run the installed package, or load authored source yourself.');
+    }
     register(hook);
+    registered = true;
 }

package/dist/serialize.d.ts

@@ -1,6 +1,7 @@
 import type { DefinitionReference } from './core/node-classes.js';
 import type { BuiltFlow } from './flow-sdk.js';
 import type { Library } from './library.js';
+import { type BindingRefusalCode } from './core/binding-messages.js';
 import type { Bindings } from './bindings.js';
 import { connectorInputErrors as coreConnectorInputErrors } from './core/connector-inputs.js';
 /**
@@ -47,6 +48,18 @@ export interface SerializeWarning {
     code: string;
     message: string;
 }
+/** A required connector input left empty — the one draft code with no error class of its own. */
+export declare const CONNECTOR_INPUT_MISSING = "CONNECTOR_INPUT_MISSING";
+/** The refusals a draft-tolerant compile reports instead of throwing. */
+export type DraftCode = BindingRefusalCode | typeof CONNECTOR_INPUT_MISSING | 'CONNECTOR_OBJECT_REQUIRED';
+/** A refusal a draft-tolerant compile reported instead of throwing (see {@link SerializeOpts.draft}). */
+export interface DraftFinding {
+    /** The emitted node's id. */
+    nodeId: string;
+    code: DraftCode;
+    /** The sentence the strict compile refuses with. */
+    message: string;
+}
 export interface SerializeOpts {
     library?: Library;
     bindings?: Bindings;
@@ -56,6 +69,19 @@ export interface SerializeOpts {
      * hears nothing, which keeps `serialize()` silent in tests and libraries.
      */
     warn?: (warning: SerializeWarning) => void;
+    /**
+     * Draft tolerance, for a compile whose output only `merge` reads (#1134).
+     *
+     * A canvas flow often holds DRAFT nodes — a connector with no connection, an
+     * empty required input, a generic operation with no object — which the
+     * canvas saves and compile refuses. In a brownfield merge an untouched node
+     * is restored from the original anyway, so refusing it only blocks the edit.
+     * When this callback is given, those three refusals are reported here, with
+     * the node's id, and the node is emitted with what it has; `merge` then
+     * refuses any such node it would take from the edited flow. Absent (every
+     * ordinary compile), behaviour is unchanged.
+     */
+    draft?: (finding: DraftFinding) => void;
     /**
      * Filled in by `serialize` with the extra files the flow needs beside the
      * `.flow`, relative to it: one `<source>/agent.json` per inline agent, plus a

package/dist/serialize.js

@@ -6,9 +6,7 @@
  * resolved from the connector library (entry + v1def sidecar), matching what
  * the platform emits, so the result passes `uip maestro flow validate`.
  */
-import { readFileSync } from 'node:fs';
-import { fileURLToPath } from 'node:url';
-import { dirname, join } from 'node:path';
+import ixpDefinition from './ixp-definition.json' with { type: 'json' };
 import { BUNDLED_DEFINITIONS, bundledVersions } from './flow-definitions.js';
 import { Expr, toExpr, SCHEDULE_PRESETS, parseIxpProjectType, flatNameOf, flatNameSegmentsOf } from './flow-sdk.js';
 import { FlowAction, FlowTrigger } from './core/node-classes.js';
@@ -22,6 +20,7 @@ import { stepExits } from './flow-step-exits.js';
 import { resolveVersionCarried } from './core/nodes/versioned.js';
 import { indexCarriedDefinitions } from './core/carried-definitions.js';
 import { FORM_FIELD_JSON_TYPE } from './core/form-field-type.js';
+import { ConnectorResolveError } from './core/library.js';
 import { connectionConnectors } from './bindings-v2.js';
 import { BindingRefusal, GUID_RE, bindingLabelRefusal, bindingMissingMessage, missingBindingLabels } from './core/binding-messages.js';
 import { ByoaRefusal, byoaUnverified } from './core/byoa.js';
@@ -65,7 +64,6 @@ import { types } from './core/expr.js';
 import { SUBFLOW_START_LABEL } from './core/subflow-start.js';
 import { ownEntry } from './core/own-entry.js';
 import { jsonClone } from './core/json-file.js';
-const HERE = dirname(fileURLToPath(import.meta.url));
 // core-definitions.json is an object keyed by "<nodeType>@<version>".
 const DEFS = BUNDLED_DEFINITIONS;
 // FIRST occurrence wins: with multiple bundled versions of one family (HITL
@@ -2592,7 +2590,7 @@ function promptTokens(content) {
  * ["fileRef"]` (the pre-pull answer) instead of the three the platform's
  * `ixp-node` validator actually enforces.
  */
-const IXP_DEF = JSON.parse(readFileSync(join(HERE, 'ixp-definition.json'), 'utf8'));
+const IXP_DEF = ixpDefinition;
 /**
  * Build the definition for one published IxP project.
  *
@@ -3002,6 +3000,8 @@ function scheduleInputs(inputs, nodeId) {
 function outcomeId(name, index) {
     return outcomeSlug(name, index);
 }
+/** A required connector input left empty — the one draft code with no error class of its own. */
+export const CONNECTOR_INPUT_MISSING = 'CONNECTOR_INPUT_MISSING';
 /**
  * `serialize`, plus the extra files the flow needs on disk beside it.
  *
@@ -4961,20 +4961,67 @@ export function serialize(built, opts = {}) {
         if (spec.kind === 'connector') {
             if (!opts.library)
                 throw new Error(`connector "${step.name}" needs a library (pass --library / set $FLOW_SDK_LIBRARY_JSON).`);
-            const rc = opts.library.resolve(spec.key, spec.action, spec.version, spec.object);
+            let rc;
+            try {
+                rc = opts.library.resolve(spec.key, spec.action, spec.version, spec.object);
+            }
+            catch (error) {
+                if (!opts.draft || !(error instanceof ConnectorResolveError) || error.code !== 'CONNECTOR_OBJECT_REQUIRED')
+                    throw error;
+                // A generic operation saved before its object was picked has no
+                // definition to emit against. Draft tolerance emits a stable stand-in
+                // under the node's id; merge restores the original when it is untouched
+                // and refuses it otherwise.
+                const id = stepUid(scope, step.name);
+                opts.draft({ nodeId: id, code: error.code, message: error.message });
+                // It leaves on the port every connector action leaves on, so the
+                // no-edit round trip rewires nothing. Its inputs carry what the author
+                // wrote, so an edit to the node (an input, a connection) shows up as a
+                // change and merge refuses it instead of restoring the original.
+                const type = `uipath.connector.${spec.key}.${spec.action}`;
+                scope.nodes.push({
+                    id, type, typeVersion: spec.version ?? '1.0.0',
+                    ...(parentId ? { parentId } : {}), display: { label: step.name },
+                    inputs: {
+                        draft: true,
+                        spec: renderDeep(spec.inputs ?? {}, scope.rename),
+                        ...(spec.connection !== undefined ? { connection: spec.connection } : {}),
+                        ...(spec.folder !== undefined ? { folder: spec.folder } : {}),
+                    },
+                });
+                for (const t of tails)
+                    addEdge(scope, t, id);
+                return [{ node: id, port: successPort(type) }];
+            }
             const id = stepUid(scope, step.name);
             const node = makeNode(rc.nodeType, id, step.name, { parentId, requestedVersion: step.options?.version, def: rc.v1def });
             declareListOutputType(node, rc);
-            requireBindingPair(`connector "${step.name}"`, spec, { key: spec.key, action: spec.action });
+            // A draft that names no connection gets no binding rows either: there
+            // is nothing to bind, and rows with an empty resourceKey would leak into
+            // the merged file through merge's bindings union.
+            let unbound = false;
+            try {
+                requireBindingPair(`connector "${step.name}"`, spec, { key: spec.key, action: spec.action });
+            }
+            catch (error) {
+                if (!opts.draft || !(error instanceof BindingRefusal))
+                    throw error;
+                opts.draft({ nodeId: id, code: error.code, message: error.message });
+                unbound = true;
+            }
             const conn = resolveBinding(opts, spec.connection, 'connection', `connector "${step.name}"`, { key: spec.key, action: spec.action });
             const folder = resolveBinding(opts, spec.folder, 'folder', `connector "${step.name}"`, { key: spec.key, action: spec.action });
             // The platform reaches the connection through the flow's `bindings[]`,
             // never through `inputs.detail` — without this pair the run faults with
             // `[102010]` (board G-19; see connectionResourceBindings).
             const { entries: connBindings } = connectionResourceBindings({ def: rc.v1def, connectorKey: rc.connectorKey, connectionId: conn, folderKey: folder }, resourceBindings);
-            for (const b of connBindings)
-                resourceBindings.set(b.id, b);
+            if (!unbound)
+                for (const b of connBindings)
+                    resourceBindings.set(b.id, b);
             const connectorInputs = buildConnectorInputs(rc, spec.inputs, {
+                ...(opts.draft
+                    ? { onMissingRequired: (m) => opts.draft({ nodeId: id, code: CONNECTOR_INPUT_MISSING, message: `connector ${rc.nodeType}: ${m}` }) }
+                    : {}),
                 dialect: FLOW_EXPR_DIALECT,
                 render: (value) => renderDeep(value, scope.rename),
                 resolutions: opts.library.lookupResolutions ?? {},

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uipath/maestro-builder-sdk",
-  "version": "6.27.0",
+  "version": "6.28.0",
   "description": "Build UiPath Flow, Case, and BPMN artifacts by writing TypeScript.",
   "license": "MIT",
   "homepage": "https://docs.uipath.com/maestro",
@@ -92,5 +92,5 @@
     "@types/node": "^22.7.0",
     "esbuild": "^0.28.1"
   },
-  "gitref": "69352e3f5c7c379e0e70b3c7b6fb2fba91255f84"
+  "gitref": "2129535cf7f13d90345db00a5d72d096c69fce04"
 }