@uipath/maestro-builder-sdk 6.14.3 → 6.14.5

package/dist/bindings-v2.js

@@ -42,6 +42,7 @@
  * the connection rows.
  */
 import { existsSync, readFileSync } from 'node:fs';
+import { BindingRefusal, connectionConnectorConflictMessage } from './core/binding-messages.js';
 /** The document version pack emits. */
 const DOCUMENT_VERSION = '2.0';
 /** The per-resource metadata version pack stamps. */
@@ -56,6 +57,93 @@ function str(value) {
 function isConnection(resource) {
     return typeof resource === 'string' && resource.toLowerCase() === 'connection';
 }
+/** The managed-HTTP wrapper's own connector key — never the connection's type when a target is named. */
+const MANAGED_HTTP_CONNECTOR = 'uipath-uipath-http';
+function nodeDetail(node) {
+    return isRecord(node.inputs) && isRecord(node.inputs.detail) ? node.inputs.detail : undefined;
+}
+/** The connection a node runs on: `connectionId`, else `connectionResourceId`. */
+function nodeConnectionKey(detail) {
+    return str(detail.connectionId) ?? str(detail.connectionResourceId);
+}
+/**
+ * The connector a node's CONNECTION belongs to — not the connector the node is.
+ *
+ * The two differ for managed HTTP: its `detail.connector` is always the wrapper,
+ * `uipath-uipath-http`, and the connection it authenticates with is the one
+ * `bodyParameters.targetConnector` names (`uipath-google-drive`,
+ * `uipath-salesforce-slack`, …). Stamping the wrapper made `uip solution
+ * resources refresh` refuse the connection — "Requested type
+ * 'uipath-uipath-http'; the resource is registered as type
+ * 'uipath-google-drive'" (flow-builder-sdk#866). Every other family's
+ * `detail.connector` is its connection's connector.
+ */
+function nodeConnectionConnector(detail) {
+    const connector = str(detail.connector);
+    if (connector === MANAGED_HTTP_CONNECTOR && isRecord(detail.bodyParameters)) {
+        return str(detail.bodyParameters.targetConnector) ?? connector;
+    }
+    return connector;
+}
+/** Every node of the flow and of its inline subflows — they share one `bindings[]`. */
+function allNodes(flow) {
+    const nodes = Array.isArray(flow.nodes) ? flow.nodes.filter(isRecord) : [];
+    if (isRecord(flow.subflows)) {
+        for (const sub of Object.values(flow.subflows)) {
+            if (isRecord(sub) && Array.isArray(sub.nodes))
+                nodes.push(...sub.nodes.filter(isRecord));
+        }
+    }
+    return nodes;
+}
+/**
+ * Which connector each bound connection belongs to, keyed by connection id —
+ * decided by EVERY node on the connection, so the answer does not depend on
+ * which step comes first.
+ *
+ * `bindings.json` cannot answer this: `prepare --connection-id` writes a label,
+ * a resource key and a kind (`ConnectionId` / `FolderKey`), never the connector
+ * (see `core/binding-messages.ts`). The nodes are the only record of it, so
+ * all of them must agree. Two that do not — a Drive step and a Slack step on
+ * one connection, or managed HTTP whose `targetConnector` is not the connection's
+ * connector — are refused with `CONNECTION_CONNECTOR_CONFLICT`: at most one of
+ * them can run, and picking the first silently mislabels the solution resource.
+ *
+ * @throws BindingRefusal when two nodes on one connection name different connectors.
+ */
+export function connectionConnectors(flow) {
+    const out = new Map();
+    if (!isRecord(flow))
+        return out;
+    const bound = new Set();
+    for (const b of Array.isArray(flow.bindings) ? flow.bindings.filter(isRecord) : []) {
+        const key = str(b.resourceKey);
+        if (key && isConnection(b.resource) && str(b.propertyAttribute)?.toLowerCase() === 'connectionid')
+            bound.add(key);
+    }
+    const users = new Map();
+    for (const node of allNodes(flow)) {
+        const detail = nodeDetail(node);
+        const key = detail && nodeConnectionKey(detail);
+        if (!detail || !key || !bound.has(key))
+            continue;
+        const connector = nodeConnectionConnector(detail);
+        if (!connector)
+            continue;
+        const byConnector = users.get(key) ?? new Map();
+        users.set(key, byConnector);
+        const steps = byConnector.get(connector) ?? [];
+        steps.push((isRecord(node.display) ? str(node.display.label) : undefined) ?? str(node.id) ?? '?');
+        byConnector.set(connector, steps);
+    }
+    for (const [key, byConnector] of users) {
+        if (byConnector.size > 1) {
+            throw new BindingRefusal('CONNECTION_CONNECTOR_CONFLICT', connectionConnectorConflictMessage(key, byConnector));
+        }
+        out.set(key, [...byConnector.keys()][0]);
+    }
+    return out;
+}
 /**
  * The `connection` resources a compiled flow declares — one per distinct
  * connection, in node order, attributed to the FIRST node that uses it.
@@ -63,6 +151,16 @@ function isConnection(resource) {
  * Both halves of that are pack's behaviour, not a choice made here: a flow with
  * two Outlook steps on one connection yields a single resource whose
  * `ActivityName` is the earlier step's.
+ *
+ * What the resource IS does not follow node order: its `Connector` comes from
+ * {@link connectionConnectors} (every node on the connection, managed HTTP read
+ * through its `targetConnector`). Pack stamps the same value — measured with
+ * `uip maestro flow pack` on managed HTTP → Slack alone, before a native Slack
+ * step, and after one: `uipath-salesforce-slack` all three times, where this
+ * module used to stamp `uipath-uipath-http` for the first two (#866;
+ * uip 1.202.0-dev, 2026-09-30).
+ *
+ * @throws BindingRefusal when two nodes on one connection name different connectors.
  */
 export function connectionResources(flow) {
     if (!isRecord(flow))
@@ -78,25 +176,31 @@ export function connectionResources(flow) {
             continue;
         if (str(binding.propertyAttribute)?.toLowerCase() !== 'connectionid')
             continue;
-        if (!byKey.has(key))
-            byKey.set(key, binding);
+        byKey.set(key, [...(byKey.get(key) ?? []), binding]);
     }
     if (byKey.size === 0)
         return [];
+    const connectors = connectionConnectors(flow);
     const nodes = Array.isArray(flow.nodes) ? flow.nodes.filter(isRecord) : [];
     const resources = [];
     const seen = new Set();
     for (const node of nodes) {
-        const detail = isRecord(node.inputs) && isRecord(node.inputs.detail) ? node.inputs.detail : undefined;
+        const detail = nodeDetail(node);
         if (!detail)
             continue;
-        const key = str(detail.connectionId) ?? str(detail.connectionResourceId);
+        const key = nodeConnectionKey(detail);
         if (!key || seen.has(key))
             continue;
-        const binding = byKey.get(key);
-        if (!binding)
+        const candidates = byKey.get(key);
+        if (!candidates)
             continue;
         seen.add(key);
+        const connector = connectors.get(key) ?? nodeConnectionConnector(detail) ?? '';
+        // The label is the FIRST ConnectionId binding on the connection, even when
+        // #865's fix emits one per referencing definition — measured against `uip
+        // maestro flow pack` (uip 1.202.0-dev) on both orders of the issue's repro: pack labels
+        // the resource after the earlier step's binding, like `ActivityName`.
+        const binding = candidates[0];
         const displayLabel = str(binding.name) ?? key;
         const label = isRecord(node.display) ? str(node.display.label) : undefined;
         resources.push({
@@ -116,7 +220,7 @@ export function connectionResources(flow) {
                 BindingsVersion: BINDINGS_VERSION,
                 DisplayLabel: displayLabel,
                 UseConnectionService: 'true',
-                Connector: str(detail.connector) ?? '',
+                Connector: connector,
             },
         });
     }

package/dist/check.js

@@ -11,7 +11,7 @@ import { isLookupToken, resolvedValue, unresolvedLookupMessage, } from './core/l
 import { QUEUE_ITEM_RECORD_SCHEMA } from './core/queue-record.js';
 import { EVENT_FILTER_OPERATORS, readEventFilter, eventFilterProblem } from './event-filters.js';
 import { extractRefs } from './core/expr-check.js';
-import { bindingSelfNameMessage, bindingUndeclaredMessage, undeclaredBinding } from './core/binding-messages.js';
+import { bindingSelfNameMessage, bindingUndeclaredMessage, connectionConnectorConflictMessage, undeclaredBinding } from './core/binding-messages.js';
 import { isAnswerField } from './core/hitl-answers.js';
 import { hitlDerivesOutcomeHandles, hitlExitModel, hitlRoutesPerOutcome } from './core/hitl-routing.js';
 import { childStepLists, declaredExits, hasExits, stopsAtEnd } from './core/step-ports.js';
@@ -20,7 +20,51 @@ import { compareSchemaVersions, schemaVersionRefusal } from './schema-version.js
 import { prepareCommand, resolveFlagArg } from './core/cli-spelling.js';
 import { EVENT_BYOA_UNVERIFIED, byoaUnverified } from './core/byoa.js';
 export function check(built, opts = {}) {
-    return checkFlow(built, [], opts);
+    const outer = connectionUsage;
+    connectionUsage = [];
+    try {
+        const diags = checkFlow(built, [], opts);
+        diags.push(...connectionConnectorConflicts(connectionUsage, opts));
+        return diags;
+    }
+    finally {
+        connectionUsage = outer;
+    }
+}
+/**
+ * The connection uses {@link checkBindingLabels} saw during the current
+ * `check()` — the flow and every child flow, which share one `bindings[]`.
+ * Module state rather than a `CheckOpts` field because `check` is synchronous
+ * and this is not an input; `check()` saves and restores it, so a nested call
+ * cannot mix two flows.
+ */
+let connectionUsage;
+/**
+ * CONNECTION_CONNECTOR_CONFLICT — the rule `serialize` enforces on the emitted
+ * document (`connectionConnectors`, bindings-v2.ts), reported here with the same
+ * sentence so `check` does not print `✓ no issues` for a source `compile` then
+ * refuses. Labels are grouped by what they resolve to, so two labels bound to
+ * one connection id are one connection, as they are in the `.flow`.
+ */
+function connectionConnectorConflicts(uses, opts) {
+    const byConnection = new Map();
+    for (const use of uses) {
+        const key = opts.bindings?.resolve(use.label) ?? use.label;
+        const byConnector = byConnection.get(key) ?? new Map();
+        byConnection.set(key, byConnector);
+        byConnector.set(use.connector, [...(byConnector.get(use.connector) ?? []), use.step]);
+    }
+    const out = [];
+    for (const [key, byConnector] of byConnection) {
+        if (byConnector.size < 2)
+            continue;
+        out.push({
+            level: 'error', code: 'CONNECTION_CONNECTOR_CONFLICT',
+            step: [...byConnector.values()][1][0],
+            message: connectionConnectorConflictMessage(key, byConnector),
+        });
+    }
+    return out;
 }
 /**
  * `ancestors` is the chain of child flows currently being checked, innermost
@@ -358,7 +402,10 @@ function checkFlow(built, ancestors, opts = {}) {
                     const filled = (v) => typeof v === 'string' && v.trim() !== '';
                     if (pair?.managed && filled(pair.connection) && filled(pair.folder)) {
                         const httpStep = s.name;
-                        checkBindingLabels(`managed http "${httpStep}"`, pair, opts, (code, message) => diags.push({ level: 'error', code, step: httpStep, message }));
+                        const target = pair.targetConnector;
+                        checkBindingLabels(`managed http "${httpStep}"`, pair, opts, (code, message) => diags.push({ level: 'error', code, step: httpStep, message }), undefined, 
+                        // The connector its CONNECTION belongs to: the target, not the wrapper.
+                        { step: httpStep, connector: typeof target === 'string' && target !== '' ? target : 'uipath-uipath-http' });
                     }
                     const seen = new Set();
                     for (const b of s.spec.inputs.branches ?? []) {
@@ -450,7 +497,7 @@ function checkFlow(built, ancestors, opts = {}) {
                     checkAgent(s.name, s.spec.inputs, diags);
                 }
                 if (s.spec.kind === 'inlineAgent') {
-                    checkInlineAgent(s.name, s.spec.inputs, diags);
+                    checkInlineAgent(s.name, s.spec.inputs, diags, opts);
                 }
                 if (s.spec.kind === 'queueItem')
                     checkQueueItem(s.name, s.spec.inputs, diags);
@@ -537,7 +584,7 @@ function checkFlow(built, ancestors, opts = {}) {
                     });
                     checkEventSubscription(s.spec.subscription, `waitForEvent "${stepName}"`, push('error'), push('warning'), eventParamsFor(s.spec.subscription, opts));
                     checkEventResolution(s.spec.subscription, `waitForEvent "${stepName}"`, 'event', opts, push('error'), push('warning'), eventParamsFor(s.spec.subscription, opts));
-                    checkBindingLabels(`waitForEvent "${stepName}"`, s.spec.subscription, opts, push('error'), eventTarget(s.spec.subscription));
+                    checkBindingLabels(`waitForEvent "${stepName}"`, s.spec.subscription, opts, push('error'), eventTarget(s.spec.subscription), { step: stepName, connector: eventTarget(s.spec.subscription)?.key });
                 }
                 if (s.spec.kind === 'subflow') {
                     // Only a real child goes in the map: a missing one is reported by
@@ -1453,7 +1500,7 @@ function checkConnectorContract(step, spec, opts, diags) {
     if (inputErr) {
         diags.push({ level: 'error', code: 'CONNECTOR_INPUT', step, message: `Connector step "${step}": ${inputErr}` });
     }
-    checkBindingLabels(`Connector step "${step}"`, spec, opts, (code, message) => diags.push({ level: 'error', code, step, message }), { key: spec.key, action: spec.action });
+    checkBindingLabels(`Connector step "${step}"`, spec, opts, (code, message) => diags.push({ level: 'error', code, step, message }), { key: spec.key, action: spec.action }, { step, connector: spec.key });
 }
 /** What `registry prepare` takes for an event subscription: its connector key and curated event name. */
 function eventTarget(sub) {
@@ -1472,7 +1519,13 @@ function eventTarget(sub) {
  * Silent without a bindings.json, and for a label that resolves to anything
  * other than its own name (stub values are compile's CONNECTION_STUB warning).
  */
-function checkBindingLabels(where, labels, opts, report, target) {
+function checkBindingLabels(where, labels, opts, report, target, 
+/** The step, and the connector its connection must belong to, for CONNECTION_CONNECTOR_CONFLICT. */
+use) {
+    const label = labels?.connection;
+    if (use?.connector && typeof label === 'string' && label !== '') {
+        connectionUsage?.push({ step: use.step, label, connector: use.connector });
+    }
     const bindings = opts.bindings;
     if (!bindings || !labels)
         return;
@@ -2285,7 +2338,7 @@ function checkTrigger(spec, diags, opts = {}) {
         const sub = spec.subscription;
         checkEventSubscription(sub, 'trigger', at, push('warning'), eventParamsFor(sub, opts));
         checkEventResolution(sub, 'trigger', 'trigger', opts, at, push('warning'), eventParamsFor(sub, opts));
-        checkBindingLabels('event trigger', sub, opts, at, eventTarget(sub));
+        checkBindingLabels('event trigger', sub, opts, at, eventTarget(sub), { step: 'trigger', connector: eventTarget(sub)?.key });
         return;
     }
     // manual() is the explicit spelling of the default — nothing to validate.
@@ -3457,7 +3510,7 @@ export function jsonTextDirective(text, returnKeys) {
  *    ALSO asks for JSON text makes the model pack its whole answer, serialized, into
  *    one string field. See {@link jsonTextDirective}.
  */
-function checkInlineAgent(step, inputs, diags) {
+function checkInlineAgent(step, inputs, diags, opts = {}) {
     const at = (code, message, suggestion) => {
         diags.push({ level: 'error', code, message, step, ...(suggestion ? { suggestion } : {}) });
     };
@@ -3740,6 +3793,24 @@ function checkInlineAgent(step, inputs, diags) {
                 at('INLINE_AGENT_TOOL_NO_OPERATION', `Inline agent step "${step}" declares a connector tool without ${blank(c.connector) ? 'a `connector`' : 'an `operation`'}. `
                     + `Both name the curated-library entry the tool is resolved from — the same pair \`connector(…)\` takes.`, `{ kind: 'connector', connector: 'uipath-atlassian-jira', operation: 'create-issue' }`);
             }
+            // A connector tool calls Integration Service on a CONNECTION, exactly as a
+            // connector step does — and before #867 there was no way to give it one, so
+            // the tool compiled with none anywhere (no binding, no resource.json row)
+            // and could only fail at run time. Both halves, as `registry prepare` writes them.
+            const labels = t;
+            const missing = ['connection', 'folder'].filter((k) => blank(labels[k]));
+            if (missing.length > 0) {
+                const key = blank(c.connector) ? '<connector-key>' : String(c.connector);
+                const op = blank(c.operation) ? '<operation>' : String(c.operation);
+                at('INLINE_AGENT_TOOL_CONNECTOR_NO_CONNECTION', `Inline agent step "${step}"'s connector tool "${key}/${op}" has no ${missing.map((m) => `\`${m}\``).join(' or ')}. `
+                    + `The tool calls Integration Service on a tenant connection: without one the agent's tool has no `
+                    + `connection binding, its resource.json carries none, and the solution's Resources never list it. `
+                    + `Name the bindings.json labels the same way \`connector()\` takes them — \`${prepareCommand(key, op)}\` `
+                    + `finds the connection and writes both entries.`, `{ kind: 'connector', connector: '${key}', operation: '${op}', connection: '<connection label>', folder: '<folder label>' }`);
+            }
+            else {
+                checkBindingLabels(`Inline agent step "${step}"'s connector tool`, labels, opts, (code, message) => at(code, message), blank(c.connector) ? undefined : { key: String(c.connector), ...(blank(c.operation) ? {} : { action: String(c.operation) }) });
+            }
         }
         else if (kind === 'ixp') {
             const x = t;

package/dist/compile-cli.js

@@ -36,20 +36,24 @@ function opt(argv, name) {
     return i >= 0 ? argv[i + 1] : undefined;
 }
 /**
- * The deployed-resource tool `type` values `compile` writes. NOT every
- * `$resourceType: 'tool'`: `uip agent refresh` generates the `integration` ones
- * from the flow's connector nodes into the same directory, so pruning by
- * `$resourceType` alone would delete the generator's own output.
+ * The tool `type` values `compile` writes. NOT every `$resourceType: 'tool'`:
+ * the designer writes kinds the SDK cannot derive into the same directory, so
+ * pruning by `$resourceType` alone would delete theirs.
+ *
+ * `integration` (connector tools) is compile's since #867: compile writes the
+ * file under the tool node's own `source` id, the same id and content `uip agent
+ * refresh --inline-in-flow` derives from that node, so a file under any other id
+ * belongs to a tool node the flow no longer has.
  */
 const COMPILE_OWNED_TOOL_TYPES = new Set([
-    'process', 'api', 'processOrchestration', 'flow', 'agent', 'function',
+    'process', 'api', 'processOrchestration', 'flow', 'agent', 'function', 'integration',
 ]);
 /**
  * Does `compile` own this resource file — i.e. would this run have written it,
  * so an unwritten one is stale rather than someone else's?
  *
- * Everything it says no to belongs to `uip agent refresh` (connector tools) or to
- * the designer (escalation, mcp, and the kinds the SDK cannot derive).
+ * Everything it says no to belongs to the designer (escalation, mcp, and the
+ * kinds the SDK cannot derive).
  */
 function compileOwnsResource(body) {
     const kind = body?.$resourceType;
@@ -236,7 +240,9 @@ export async function run(argv) {
             // fail on it. Keyed the way refresh keys it — an index by its name.
             const named = body?.indexName ?? body?.name;
             const key = typeof named === 'string' && named !== '' ? named : undefined;
-            if (key !== undefined) {
+            // A connector tool's binding is a `connection` row, and `mergeBindingsV2`
+            // re-derives every connection row from the flow below — nothing to retract.
+            if (key !== undefined && body?.type !== 'integration') {
                 // Keyed the way refresh keys it: an index by its name, a deployed-resource
                 // tool under `process` whatever its own type says.
                 staleBindings.push({ resource: resourceType === 'context' ? 'index' : 'process', key });

package/dist/core/actions.d.ts

@@ -1806,6 +1806,25 @@ export interface ConnectorToolRef {
     object?: string;
     /** Display label; defaults to the library's own (e.g. `'Create Issue'`). */
     name?: string;
+    /**
+     * What the agent is told the tool does — the runtime hands it to the MODEL.
+     * Defaults to the library's own operation description.
+     */
+    description?: string;
+    /**
+     * The connection's binding NAME in `bindings.json` — the same label
+     * `connector()`'s `connection` option takes (e.g. `'genai'`), resolved to
+     * the tenant connection id at compile. Required: a connector tool with no
+     * connection has nothing to call Integration Service with, and `check`
+     * reports `INLINE_AGENT_TOOL_CONNECTOR_NO_CONNECTION`.
+     */
+    connection?: string;
+    /**
+     * The connection's folder binding NAME in `bindings.json` (a `FolderKey`
+     * entry) — the same label `connector()`'s `folder` option takes. Required
+     * with `connection`.
+     */
+    folder?: string;
 }
 /**
  * The tool kinds that wrap a DEPLOYED tenant resource. `kind` picks the

package/dist/core/binding-messages.d.ts

@@ -1,7 +1,11 @@
 /** A tenant resource key — an Integration Service connection id or an Orchestrator folder key — is a GUID. */
 export declare const GUID_RE: RegExp;
 /** The diagnostic codes a label refusal carries, in `check` and on the error `serialize` throws. */
-export type BindingRefusalCode = 'BINDING_SELF_NAME' | 'BINDING_UNDECLARED';
+export type BindingRefusalCode = 'BINDING_SELF_NAME' | 'BINDING_UNDECLARED'
+/** An emitted definition's `<bindings.NAME>` placeholder has no `bindings[]` entry named NAME (#865). */
+ | 'BINDING_PLACEHOLDER_UNRESOLVED'
+/** Two steps on one connection disagree on which connector it belongs to (#866). */
+ | 'CONNECTION_CONNECTOR_CONFLICT';
 /**
  * What `serialize` throws for a label it refuses. It is an ordinary `Error` whose
  * message is the sentence `check` prints; the `code` lets `compile --no-check`
@@ -58,3 +62,14 @@ export interface PrepareTarget {
  * `prepare` command for this step's own connector and operation.
  */
 export declare function bindingUndeclaredMessage(where: string, name: string, attribute: 'connection' | 'folder', declared: readonly string[], target?: PrepareTarget): string;
+/**
+ * Why compile refuses one connection used by steps of different connectors —
+ * shared by `serialize` (which throws it, via `connectionConnectors` in
+ * `bindings-v2.ts`) and `check`, so both print the same sentence.
+ *
+ * `users` maps each connector to the steps that use the connection as that
+ * connector. For managed HTTP the connector is its `targetConnector` — the
+ * connection it authenticates with — not the `uipath-uipath-http` wrapper
+ * (flow-builder-sdk#866).
+ */
+export declare function connectionConnectorConflictMessage(connection: string, users: ReadonlyMap<string, readonly string[]>): string;

package/dist/core/binding-messages.js

@@ -89,3 +89,24 @@ export function bindingUndeclaredMessage(where, name, attribute, declared, targe
         + `declares the label with a placeholder resourceKey instead, which compiles with a CONNECTION_STUB warning — `
         + `never an invented GUID.`;
 }
+/**
+ * Why compile refuses one connection used by steps of different connectors —
+ * shared by `serialize` (which throws it, via `connectionConnectors` in
+ * `bindings-v2.ts`) and `check`, so both print the same sentence.
+ *
+ * `users` maps each connector to the steps that use the connection as that
+ * connector. For managed HTTP the connector is its `targetConnector` — the
+ * connection it authenticates with — not the `uipath-uipath-http` wrapper
+ * (flow-builder-sdk#866).
+ */
+export function connectionConnectorConflictMessage(connection, users) {
+    const who = [...users]
+        .map(([connector, steps]) => `${steps.map((s) => `"${s}"`).join(', ')} as ${connector}`)
+        .join('; ');
+    return `connection "${connection}" is used by steps of different connectors (${who}). An Integration Service `
+        + `connection belongs to exactly one connector, so at most one of these steps can run on it, and the solution `
+        + `resource would be declared as whichever came first. Give each connector its own connection label in `
+        + `bindings.json (\`${prepareCommand('<connector-key>', '<action>')}\` binds one per connector). A managed `
+        + `\`http({ managed: true, … })\` step on another connector's connection must name that connector in `
+        + `\`targetConnector\`.`;
+}

package/dist/serialize.d.ts

@@ -54,6 +54,34 @@ export declare function serializeWithSidecars(built: BuiltFlow, opts?: Serialize
     }>;
 };
 export declare function serialize(built: BuiltFlow, opts?: SerializeOpts): any;
+/**
+ * Every `<bindings.NAME>` placeholder a node's definition carries in its
+ * `model.context` must resolve to a `bindings[]` entry for THAT node.
+ *
+ * "Resolve" is Studio Web's rule, not a looser one: flow-v1
+ * `matchContextBindings` + `getInstanceBindingKey`
+ * (flow-schema/src/packaging/resolve-context.ts) take the entries whose
+ * `resource` EQUALS the definition's `model.bindings.resource`, scope them to the
+ * node's `inputs.detail.connectionResourceId` when that resource is `connection`
+ * (or undeclared), and look the placeholder up there BY NAME. Any miss blocks
+ * publish (MST-15010), and one that slips through reaches Studio as the literal
+ * placeholder: `invalid GUID <bindings.uipath-salesforce-slack connection>`.
+ * `uip maestro flow validate` does not check this.
+ *
+ * That is how #865 shipped — a per-call-site dedupe that let the first step on a
+ * shared connection claim it — and UV-16774 before it (a `Connection` resource
+ * spelling). Checking the finished document catches that class for every family
+ * and every emission order, whichever call site produced it.
+ *
+ * It holds for real definitions: of the 5,102 in the local registry index
+ * (2026-09-30), 4,999 reference a `<bindings.…>` name and every one of them
+ * declares that name in `model.bindings.values`, which is what the emitters
+ * close. Agent resource definitions are the one exemption (see below).
+ *
+ * @throws BindingRefusal `BINDING_PLACEHOLDER_UNRESOLVED`, naming each dangling
+ * placeholder and the step that carries it.
+ */
+export declare function assertBindingPlaceholdersResolve(flow: any): void;
 /**
  * What `compile` would refuse these connector inputs with, or `undefined` when it
  * would accept them — the SAME code path `buildConnectorInputs` runs at emit time,