@uipath/maestro-builder-sdk 6.14.4 → 6.15.0

package/dist/check.js

@@ -7,64 +7,22 @@
  */
 import { Expr, SCHEDULE_PRESETS, DELAY_PRESETS, VARIANT_OPERATION, parseIxpProjectType, flatNameOf, flatNameSegmentsOf, FLAT_SEP } from './flow-sdk.js';
 import { FlowNode } from './core/node-classes.js';
-import { isLookupToken, resolvedValue, unresolvedLookupMessage, } from './core/lookups.js';
 import { QUEUE_ITEM_RECORD_SCHEMA } from './core/queue-record.js';
-import { EVENT_FILTER_OPERATORS, readEventFilter, eventFilterProblem } from './event-filters.js';
-import { extractRefs } from './core/expr-check.js';
-import { bindingSelfNameMessage, bindingUndeclaredMessage, connectionConnectorConflictMessage, undeclaredBinding } from './core/binding-messages.js';
+import { checkEventResolution, checkEventSubscription, eventParamsFor, } from './core/event-checks.js';
+import { FLOW_EXPR_DIALECT, checkBindingLabels, checkConnectorContract as coreCheckConnectorContract, checkConnectorLookups as coreCheckConnectorLookups, checkConnectorSchema as coreCheckConnectorSchema, collectConnectionUses, connectionConnectorConflicts, } from './core/connector-checks.js';
+import { prepareCommand } from './core/cli-spelling.js';
 import { isAnswerField } from './core/hitl-answers.js';
 import { hitlDerivesOutcomeHandles, hitlExitModel, hitlRoutesPerOutcome } from './core/hitl-routing.js';
 import { childStepLists, declaredExits, hasExits, stopsAtEnd } from './core/step-ports.js';
 import { FLOW_SCHEMA_VERSIONS } from './format-profile.js';
 import { compareSchemaVersions, schemaVersionRefusal } from './schema-version.js';
-import { prepareCommand, resolveFlagArg } from './core/cli-spelling.js';
-import { EVENT_BYOA_UNVERIFIED, byoaUnverified } from './core/byoa.js';
 export function check(built, opts = {}) {
-    const outer = connectionUsage;
-    connectionUsage = [];
-    try {
-        const diags = checkFlow(built, [], opts);
-        diags.push(...connectionConnectorConflicts(connectionUsage, opts));
-        return diags;
+    let diags = [];
+    const uses = collectConnectionUses(() => { diags = checkFlow(built, [], opts); });
+    for (const { id, message } of connectionConnectorConflicts(uses, opts)) {
+        diags.push({ level: 'error', code: 'CONNECTION_CONNECTOR_CONFLICT', step: id, message });
     }
-    finally {
-        connectionUsage = outer;
-    }
-}
-/**
- * The connection uses {@link checkBindingLabels} saw during the current
- * `check()` — the flow and every child flow, which share one `bindings[]`.
- * Module state rather than a `CheckOpts` field because `check` is synchronous
- * and this is not an input; `check()` saves and restores it, so a nested call
- * cannot mix two flows.
- */
-let connectionUsage;
-/**
- * CONNECTION_CONNECTOR_CONFLICT — the rule `serialize` enforces on the emitted
- * document (`connectionConnectors`, bindings-v2.ts), reported here with the same
- * sentence so `check` does not print `✓ no issues` for a source `compile` then
- * refuses. Labels are grouped by what they resolve to, so two labels bound to
- * one connection id are one connection, as they are in the `.flow`.
- */
-function connectionConnectorConflicts(uses, opts) {
-    const byConnection = new Map();
-    for (const use of uses) {
-        const key = opts.bindings?.resolve(use.label) ?? use.label;
-        const byConnector = byConnection.get(key) ?? new Map();
-        byConnection.set(key, byConnector);
-        byConnector.set(use.connector, [...(byConnector.get(use.connector) ?? []), use.step]);
-    }
-    const out = [];
-    for (const [key, byConnector] of byConnection) {
-        if (byConnector.size < 2)
-            continue;
-        out.push({
-            level: 'error', code: 'CONNECTION_CONNECTOR_CONFLICT',
-            step: [...byConnector.values()][1][0],
-            message: connectionConnectorConflictMessage(key, byConnector),
-        });
-    }
-    return out;
+    return diags;
 }
 /**
  * `ancestors` is the chain of child flows currently being checked, innermost
@@ -405,7 +363,7 @@ function checkFlow(built, ancestors, opts = {}) {
                         const target = pair.targetConnector;
                         checkBindingLabels(`managed http "${httpStep}"`, pair, opts, (code, message) => diags.push({ level: 'error', code, step: httpStep, message }), undefined, 
                         // The connector its CONNECTION belongs to: the target, not the wrapper.
-                        { step: httpStep, connector: typeof target === 'string' && target !== '' ? target : 'uipath-uipath-http' });
+                        { id: httpStep, connector: typeof target === 'string' && target !== '' ? target : 'uipath-uipath-http' });
                     }
                     const seen = new Set();
                     for (const b of s.spec.inputs.branches ?? []) {
@@ -497,7 +455,7 @@ function checkFlow(built, ancestors, opts = {}) {
                     checkAgent(s.name, s.spec.inputs, diags);
                 }
                 if (s.spec.kind === 'inlineAgent') {
-                    checkInlineAgent(s.name, s.spec.inputs, diags);
+                    checkInlineAgent(s.name, s.spec.inputs, diags, opts);
                 }
                 if (s.spec.kind === 'queueItem')
                     checkQueueItem(s.name, s.spec.inputs, diags);
@@ -584,7 +542,7 @@ function checkFlow(built, ancestors, opts = {}) {
                     });
                     checkEventSubscription(s.spec.subscription, `waitForEvent "${stepName}"`, push('error'), push('warning'), eventParamsFor(s.spec.subscription, opts));
                     checkEventResolution(s.spec.subscription, `waitForEvent "${stepName}"`, 'event', opts, push('error'), push('warning'), eventParamsFor(s.spec.subscription, opts));
-                    checkBindingLabels(`waitForEvent "${stepName}"`, s.spec.subscription, opts, push('error'), eventTarget(s.spec.subscription), { step: stepName, connector: eventTarget(s.spec.subscription)?.key });
+                    checkBindingLabels(`waitForEvent "${stepName}"`, s.spec.subscription, opts, push('error'), eventTarget(s.spec.subscription), { id: stepName, connector: eventTarget(s.spec.subscription)?.key });
                 }
                 if (s.spec.kind === 'subflow') {
                     // Only a real child goes in the map: a missing one is reported by
@@ -1274,234 +1232,6 @@ function checkFlow(built, ancestors, opts = {}) {
     }
     return diags;
 }
-/** Reject a wrapper hop when the runtime shape of a list has been measured. */
-/**
- * The lookup rules: a pasted id, and an unresolved token.
- *
- * These are the strongest discoverability route in the design, because they
- * need no prior knowledge and arrive in the loop the author is already in. An
- * author who pastes `WT9RC72KU` into a lookup field is not being careless, they
- * are being uninformed — nothing anywhere told them the field was resolvable —
- * and the fix is to tell them at the point of the mistake.
- *
- * Both are WARNINGS, not errors. A literal id is legal and sometimes correct
- * (a value that genuinely does not move), and the unresolved case is already a
- * hard failure at compile, where the same message is repeated. Making it an
- * error here would stop a `check` that is otherwise clean from telling the
- * author about everything ELSE that is wrong, which is the whole point of
- * running the cheap pass first.
- */
-function checkConnectorLookups(step, spec, opts, diags) {
-    const specs = opts.lookups?.(spec.key, spec.action, spec.version, spec.object);
-    const resolutions = opts.resolutions ?? {};
-    // One LOOKUP_LITERAL_ID per field: a multiselect of three pasted ids is one
-    // mistake with one remedy, not three.
-    const literalWarned = new Set();
-    const visit = (value, path) => {
-        if (isLookupToken(value)) {
-            // A match key the field does not declare is certainly wrong, and the
-            // spec that says so is already in hand. `fields.reporter.id` is searchable
-            // by `displayName | accountId`; `.by('name', …)` used to pass here as an
-            // ordinary unresolved lookup, and the prepare command this warning prints
-            // would then be REFUSED by the resolver — the mistake surviving both the
-            // check and its own suggested fix. `spec.by` is the field's own
-            // declaration, so it is complete by construction and may hard-error.
-            const named = path.join('.');
-            const declared = specs?.[named];
-            const by = value.__lookup.by;
-            if (declared && typeof by === 'string' && !declared.by.includes(by)) {
-                const { target, call } = lookupPhrases(named, declared, spec);
-                diags.push({
-                    level: 'error',
-                    code: 'LOOKUP_UNKNOWN_MATCH_KEY',
-                    message: `Connector step "${step}": \`${named}\` has no match key \`${by}\`. It resolves `
-                        + `against \`${target}\`, which is searchable by `
-                        + `${declared.by.map((b) => `\`${b}\``).join(' or ')}. Resolving on `
-                        + `\`${by}\` is refused, so recording it would fail too:\n`
-                        + `  ${call}`,
-                    step,
-                });
-                return;
-            }
-            if (resolvedValue(value, resolutions) === undefined) {
-                diags.push({
-                    level: 'warning',
-                    code: 'LOOKUP_UNRESOLVED',
-                    message: `Connector step "${step}": ` + unresolvedLookupMessage(value)
-                        + `\nCompile will fail until this is recorded. Running it now, before `
-                        + `compiling, is the cheap order: this pass has already found everything `
-                        + `else that is wrong.`,
-                    step,
-                });
-            }
-            return;
-        }
-        if (Array.isArray(value)) {
-            // An element is named by the WIRE name the lookup table is keyed on —
-            // `users[*]`, `contacts[*].id` — not by its index. `users.0` matched no
-            // spec, so a pasted id, a token with a bad match key, or a runtime value
-            // inside a multiselect passed every rule below unseen. A name that already
-            // is the array's (a flat `'users[*]'` key, or a field typed as an array)
-            // stays as it is.
-            const last = path[path.length - 1] ?? '';
-            const element = last.endsWith('[*]') || specs?.[path.join('.')]
-                ? path
-                : [...path.slice(0, -1), `${last}[*]`];
-            value.forEach((v) => visit(v, element));
-            return;
-        }
-        if (value && typeof value === 'object' && !(value instanceof Expr)) {
-            for (const [k, v] of Object.entries(value)) {
-                visit(v, [...path, k]);
-            }
-            return;
-        }
-        if (!specs)
-            return;
-        const field = path.join('.');
-        const lookup = specs[field];
-        if (!lookup)
-            return;
-        if (value instanceof Expr && !value.literal) {
-            const d = runtimeLookupDiagnostic(step, spec, field, lookup, value);
-            if (d)
-                diags.push(d);
-            return;
-        }
-        // A pasted id, whether bare or wrapped in `lit()`.
-        const literal = value instanceof Expr ? value.value : value;
-        if (typeof literal !== 'string')
-            return;
-        if (literalWarned.has(field))
-            return;
-        literalWarned.add(field);
-        const { target, call } = lookupPhrases(field, lookup, spec);
-        diags.push({
-            level: 'warning',
-            code: 'LOOKUP_LITERAL_ID',
-            message: `Connector step "${step}": \`${field}\` is a lookup field — its value is an id from `
-                + `\`${target}\`, searchable by ${lookup.by.map((b) => `\`${b}\``).join(', ')}. `
-                + `A literal id is meaningless in review and does not survive a move to another `
-                + `connection: it resolves to nothing there, or to something else, and neither `
-                + `compile nor deploy can tell. Write what you mean and resolve it late:\n`
-                + `  ${call}\n`
-                + `then record the value once with \`${prepareCommand(spec.key, spec.action)} `
-                + `--resolve ${resolveFlagArg(field, lookup.by[0] ?? 'id', '<value>')}\`.`,
-            step,
-        });
-    };
-    for (const [name, value] of Object.entries(spec.inputs ?? {}))
-        visit(value, [name]);
-}
-/**
- * The schema rules: an unprepared object, and unprepared custom fields.
- *
- * Same reasoning as the lookup rules above — the author needs no prior
- * knowledge, and the diagnostic arrives in the loop they are already in, with
- * the one command that discharges it. Both are WARNINGS: compile accepts a
- * connection-scoped object (stamped `objectNameUnverified`) and passes the
- * inputs through, so `check` is the one place the gap is visible BEFORE a
- * flow dispatches against a schema nothing validated.
- *
- * The custom-fields rule is deliberately narrower than "unprepared op": a step
- * that uses only baked fields owes nothing, and warning on it anyway teaches
- * the author that the warning is noise. It fires only for inputs OUTSIDE the
- * tenant-agnostic snapshot — the moment hand-guessing actually starts.
- */
-function checkConnectorSchema(step, spec, opts, diags) {
-    const readiness = opts.schemaReadiness?.(spec.key, spec.action, spec.version, spec.object);
-    if (!readiness || readiness.prepared)
-        return;
-    const prepare = prepareCommand(spec.key, spec.action);
-    if (readiness.kind === 'object') {
-        diags.push({
-            level: 'warning',
-            code: 'OBJECT_UNPREPARED',
-            message: `Connector step "${step}": object "${spec.object}" has no locally materialized schema — `
-                + `this operation resolves its object against the connection, so its fields cannot be `
-                + `validated here and compile will emit it unverified. Prepare it once:\n`
-                + `  ${prepare} --object ${spec.object}\n`
-                + `The name is matched against the connected catalog (exact, then case-insensitive on `
-                + `name and display name); several matches fail with the candidates to choose from, and `
-                + `the prepared descriptor is the import to switch to.`,
-            step,
-            ...(readiness.canonical ? { suggestion: readiness.canonical } : {}),
-        });
-        return;
-    }
-    if (readiness.kind === 'customFields') {
-        // Match by full dotted path, the same descent `checkConnectorLookups`
-        // uses 100 lines up — a top-level comparison would let `contact:
-        // { cf_custom: … }` slide because `contact` is a baked head, and a nested
-        // hand-guessed custom field is precisely the moment this warning is for.
-        // Wire-array markers are stripped from the baked names (`users[*]` is
-        // authored as `users`).
-        const baked = (readiness.bakedFields ?? []).map((name) => name.replace(/\[\*\]/g, ''));
-        const unknown = [];
-        const visit = (value, path) => {
-            const dotted = path.join('.');
-            // A baked field, or deeper than one — the name is in the vocabulary;
-            // whether the VALUE fits is compile's business, not this warning's.
-            if (baked.some((b) => b === dotted || dotted.startsWith(b + '.')))
-                return;
-            // The head of baked fields (`contact` when `contact.email` is baked):
-            // descend to find the precise gap underneath it. Array elements keep
-            // their parent's path — the baked names index arrays as `items[*].sku`,
-            // normalized above to `items.sku` — so a guessed field inside a list
-            // element (`lineItems: [{ cf_custom }]`) warns exactly like one under
-            // an object head.
-            if (baked.some((b) => b.startsWith(dotted + '.'))) {
-                if (Array.isArray(value)) {
-                    for (const element of value)
-                        visit(element, path);
-                }
-                else if (value && typeof value === 'object'
-                    && !(value instanceof Expr) && !isLookupToken(value)) {
-                    for (const [k, v] of Object.entries(value)) {
-                        visit(v, [...path, k]);
-                    }
-                }
-                return;
-            }
-            // Neither a baked name nor on the way to one — this IS the gap,
-            // reported once at its head.
-            unknown.push(dotted);
-        };
-        for (const [name, value] of Object.entries(spec.inputs ?? {}))
-            visit(value, [name]);
-        // Array elements share their parent's path, so one guessed field across
-        // many list rows is one gap, not one per row.
-        const distinct = [...new Set(unknown)];
-        if (distinct.length === 0)
-            return;
-        diags.push({
-            level: 'warning',
-            code: 'CUSTOM_FIELDS_UNPREPARED',
-            message: `Connector step "${step}": ${distinct.map((n) => `\`${n}\``).join(', ')} `
-                + `${distinct.length === 1 ? 'is' : 'are'} not in the tenant-agnostic snapshot, and this `
-                + `operation resolves its real field set — custom fields included — from a live `
-                + `connection. Do not hand-guess the names; materialize the schema once:\n`
-                + `  ${prepare}\n`
-                + `then author against the prepared descriptor (its field names and doc comments are `
-                + `the vocabulary) and re-run check.`,
-            step,
-        });
-    }
-}
-/**
- * The field contract and the binding names `compile` enforces, reported here first.
- *
- * Both rules run only with the facts in hand (a library for the fields, a
- * bindings.json for the names); without them `check` stays a pure function of the
- * built flow and says nothing, as before.
- */
-function checkConnectorContract(step, spec, opts, diags) {
-    const inputErr = opts.connectorInputs?.({ key: spec.key, action: spec.action, version: spec.version, object: spec.object }, spec.inputs ?? {});
-    if (inputErr) {
-        diags.push({ level: 'error', code: 'CONNECTOR_INPUT', step, message: `Connector step "${step}": ${inputErr}` });
-    }
-    checkBindingLabels(`Connector step "${step}"`, spec, opts, (code, message) => diags.push({ level: 'error', code, step, message }), { key: spec.key, action: spec.action }, { step, connector: spec.key });
-}
 /** What `registry prepare` takes for an event subscription: its connector key and curated event name. */
 function eventTarget(sub) {
     const { connector, event } = (sub ?? {});
@@ -1510,139 +1240,32 @@ function eventTarget(sub) {
         : undefined;
 }
 /**
- * The binding-label rules `serialize`'s `resolveBinding` enforces, for one
- * `{ connection, folder }` pair — reported at every site that resolves one
- * (connector step, event trigger and `.entryPoint` onEvent, waitForEvent, managed
- * HTTP), with the sentence compile throws. Without this at the event and HTTP
- * sites `check` printed `✓ no issues` for a source `compile` then refused.
- *
- * Silent without a bindings.json, and for a label that resolves to anything
- * other than its own name (stub values are compile's CONNECTION_STUB warning).
+ * The connector rules live in `core/connector-checks.ts`, shared with BPMN —
+ * they were always a function of the connector corpus and the step's own
+ * `{ key, action, version, object, inputs, connection, folder }`, never of
+ * anything flow-shaped. These three adapters add what IS flow-shaped: the
+ * `Connector step "…"` vocabulary, the `step` field on the diagnostic, and the
+ * `$vars`/`Expr` dialect its inputs are written in.
  */
-function checkBindingLabels(where, labels, opts, report, target, 
-/** The step, and the connector its connection must belong to, for CONNECTION_CONNECTOR_CONFLICT. */
-use) {
-    const label = labels?.connection;
-    if (use?.connector && typeof label === 'string' && label !== '') {
-        connectionUsage?.push({ step: use.step, label, connector: use.connector });
-    }
-    const bindings = opts.bindings;
-    if (!bindings || !labels)
-        return;
-    for (const attribute of ['connection', 'folder']) {
-        const name = labels[attribute];
-        if (typeof name !== 'string')
-            continue;
-        const resolved = bindings.resolve(name);
-        if (resolved === name) {
-            report('BINDING_SELF_NAME', bindingSelfNameMessage(where, name, attribute, target));
-        }
-        else if (resolved === undefined) {
-            const declared = undeclaredBinding(bindings, name);
-            if (declared) {
-                report('BINDING_UNDECLARED', bindingUndeclaredMessage(where, name, attribute, declared, target));
-            }
-        }
-    }
+function connectorSite(step, diags) {
+    return {
+        where: `Connector step "${step}"`,
+        report: (d) => diags.push({ ...d, step }),
+    };
 }
-/**
- * The two phrases every lookup diagnostic needs: what the field sends, and how
- * to resolve it.
- *
- * The `call` names BOTH authoring forms, and names which one the alias belongs
- * to. Printing `lookup(<Descriptor>, 'entityName').byDisplayName('<value>')`
- * alone — the old text — was a remedy with an unstated precondition: aliases
- * are generated onto the descriptor, and `<Descriptor>` is a placeholder the
- * reader has to fill from somewhere. An author holding the connector key and
- * action instead (the form the library's Generic CRUD half is authored in, and
- * the majority of its lookup fields) substitutes those for the placeholder,
- * keeps the alias, and gets `lookup(...).byDisplayName is not a function`. Six
- * flow-eval tasks did precisely that, each losing a check-edit-check round to
- * a message that had told them to.
- */
-function lookupPhrases(field, lookup, spec) {
-    const target = `${lookup.objectName ?? lookup.path}.${lookup.value}`;
-    const by = lookup.by[0] ?? 'id';
-    const alias = Object.keys(lookup.aliases)[0];
-    // The key/action form first: it needs no import, so it is the one line that
-    // is paste-ready from the message alone.
-    const generic = `lookup('${spec.key}', '${spec.action}', '${field}').by('${by}', '<value>')`;
-    const call = alias
-        ? `${generic}\n  or \`lookup(D, '${field}').${alias}('<value>')\`, where D is the `
-            + `descriptor \`${prepareCommand(spec.key, spec.action)}\` generates — the aliases exist only there`
-        : generic;
-    return { target, call };
+function checkConnectorLookups(step, spec, opts, diags) {
+    const { where, report } = connectorSite(step, diags);
+    coreCheckConnectorLookups(where, spec, opts, FLOW_EXPR_DIALECT, report);
 }
-/**
- * `senderEmail`, `emailAddress`, `e_mail`, `userPrincipalName` — an address. Applied
- * to the LEAF an expression reads, and to the lookup's own `value` / `by` names,
- * because whether an address is wrong depends on what the field sends: SendGrid's
- * `from` sends `from_email`, PagerDuty's `From` sends `email` — there an e-mail IS
- * the id. `emailId` is left to the id rule.
- */
-const EMAIL_LEAF = /e[-_]?mail|principal/i;
-/**
- * `id`, `accountId`, `channelKey`, `record_id`, `CHANNEL_KEY` — the author is
- * already naming an id. Case-sensitive on purpose: `valid`, `paid` and `monkey`
- * end in the same letters and are not ids.
- */
-const ID_LEAF = /(?:^|[a-z0-9])(?:Id|ID|Key|KEY)$|(?:^|_)(?:id|key|ID|KEY|Id|Key)$/;
-/**
- * The lookup rule for a RUNTIME value.
- *
- * `check` cannot evaluate `$vars.start.output.senderEmail`, but it does know what
- * the field it lands in must carry — `reporter.accountId` — because the descriptor
- * says so. That is the fact the author of the 09-01 escalation flow never saw: the
- * generated type read `id: ConnectorLookupValue<string>`, the field was required,
- * the only person-shaped input in scope was an e-mail, and nothing between the
- * source and the tenant said an address is not an account id. Jira did, at run
- * time, as `[102003] Integration Services bad request`.
- *
- * Three tiers, decided by the LEAF the expression reads, because that name is
- * the only signal available before the flow runs:
- *   - id-shaped (`…Id`, `…Key`, or the lookup's own `value`): silence. The author
- *     has said it is an id; a mistaken id is `LOOKUP_LITERAL_ID`'s move-between-
- *     connections problem, not this one.
- *   - e-mail-shaped, into a lookup that neither SENDS an e-mail (`value`) nor
- *     SEARCHES by one (`by`): an ERROR. Jira's reporter (`accountId`, by
- *     displayName/accountId) is the measured case — the provider rejects the
- *     address, and stopping here is cheaper than a faulted run. Into a lookup
- *     whose `value` is itself an e-mail (SendGrid `from` → `from_email`, PagerDuty
- *     `From` → `email`, 19 fields in the library): silence — the address is the
- *     id. Into one that only searches by e-mail (ActiveCampaign `contact` → `id`,
- *     by `email`, 139 fields): a WARNING — the provider indexes people by address,
- *     so some accept it in the id slot and some do not; the reader decides.
- *   - anything else (a name, a whole output object, a concatenation): a WARNING
- *     that states the identity, so the reader can decide.
- */
-function runtimeLookupDiagnostic(step, spec, field, lookup, value) {
-    const refs = extractRefs(value.js);
-    const single = refs.length === 1 && value.js.trim() === refs[0].raw ? refs[0] : undefined;
-    const leaf = single ? (single.path.length ? single.path[single.path.length - 1] : single.root) : undefined;
-    // The lookup's value may be dotted (`properties.email`): compare against its last segment too.
-    const valueLeaf = lookup.value.split('.').pop() ?? lookup.value;
-    const valueIsEmail = EMAIL_LEAF.test(lookup.value);
-    if (leaf && (ID_LEAF.test(leaf)
-        || leaf.toLowerCase() === lookup.value.toLowerCase()
-        || leaf.toLowerCase() === valueLeaf.toLowerCase()
-        || (valueIsEmail && EMAIL_LEAF.test(leaf))))
-        return undefined;
-    const { target, call } = lookupPhrases(field, lookup, spec);
-    const searchesByEmail = lookup.by.some((b) => EMAIL_LEAF.test(b));
-    const isEmail = !!leaf && EMAIL_LEAF.test(leaf) && !valueIsEmail && !searchesByEmail;
-    const message = `Connector step "${step}": \`${field}\` is a lookup field bound to the runtime expression `
-        + `\`${value.js}\`. At run time it must carry a \`${target}\` — the id the connector stores — `
-        + `not a name or an address: the connector rejects anything else when the flow runs, and `
-        + `neither compile nor validate can tell. Resolve the value you know instead:\n`
-        + `  ${call}\n`
-        + `then record it once with \`${prepareCommand(spec.key, spec.action)} `
-        + `--resolve ${resolveFlagArg(field, lookup.by[0] ?? 'id', '<value>')}\`; or read the id from a step whose `
-        + `output returned one (\`${lookup.value}\`).`
-        + (isEmail
-            ? `\n\`${single.raw}\` reads \`${leaf}\`, an e-mail address, not a \`${target}\`.`
-            : '');
-    return { level: isEmail ? 'error' : 'warning', code: 'LOOKUP_RUNTIME_VALUE', message, step };
+function checkConnectorSchema(step, spec, opts, diags) {
+    const { where, report } = connectorSite(step, diags);
+    coreCheckConnectorSchema(where, spec, opts, FLOW_EXPR_DIALECT, report);
+}
+function checkConnectorContract(step, spec, opts, diags) {
+    const { where, report } = connectorSite(step, diags);
+    coreCheckConnectorContract(where, spec, opts, report, step);
 }
+/** Reject a wrapper hop when the runtime shape of a list has been measured. */
 function checkLoopListEnvelope(loop, connectors, opts, diags) {
     const read = /^\$vars\.([^.]+)\.output\.([A-Za-z_$][\w$]*)$/.exec(loop.collection.js);
     if (!read || !opts.listEnvelope)
@@ -1980,305 +1603,6 @@ const INTERVAL_WORDS = [
  * Without a library (`uip maestro flow check` run with no `--library`) the fields
  * are unknown, so the warning keeps the generic wording.
  */
-/**
- * Ask the library what event parameters a subscription's operation declares.
- * Returns `undefined` when the subscription is too broken to look up (its own
- * diagnostics say so) or when no resolver was supplied — both mean "unknown", and
- * unknown fails open.
- */
-function eventParamsFor(subscription, opts) {
-    if (!opts.eventParams)
-        return undefined;
-    const sub = subscription;
-    if (typeof sub?.connector !== 'string' || typeof sub?.event !== 'string')
-        return undefined;
-    if (sub.connector === '' || sub.event === '')
-        return undefined;
-    // A GENERIC event's schema is per OBJECT once the library carries baked
-    // per-object variants, so the object is part of the subscription's identity
-    // here. Without it the lookup asks for a node type that resolves to no
-    // single variant and answers "unknown", which reads as EVENT_UNPREPARED on
-    // an event the library actually knows.
-    const object = typeof sub.object === 'string' && sub.object !== ''
-        ? sub.object : undefined;
-    return opts.eventParams(sub.connector, sub.event, object);
-}
-/**
- * The event-side resolution rules — the trigger twin of `checkConnectorLookups`,
- * plus three rules with no activity counterpart:
- *
- * - `EVENT_UNKNOWN` — an ERROR: a library is loaded and it cannot resolve the
- *   subscription, so `compile` will refuse it. The message is the resolver's
- *   own (`eventResolveError`), the same text compile throws. Checked first; when
- *   it fires, EVENT_UNPREPARED and the filter rules below are skipped for this
- *   subscription, since there is no entry for them to read.
- * - `EVENT_UNPREPARED` — the event RESOLVES but the library knows nothing
- *   about its parameters (or no `eventResolveError` resolver was supplied):
- *   the fallback case for a connector the shipped library was not generated
- *   against. A warning, because compile still succeeds. Prints the one
- *   command that makes the event checkable.
- * - `EVENT_BYOA_UNVERIFIED` — an ERROR: the event only fires on a BYOA
- *   (bring-your-own-app) connection, and the bound connection id has no record
- *   of `prepare` having checked it (`core/byoa.ts` has the rule and when it
- *   stays silent). A standard connection deploys and the trigger never fires;
- *   the usual way in is binding the connection by preparing one of the
- *   connector's ACTIONS, which checks nothing about BYOA. `compile` throws the
- *   same text.
- * - `EVENT_FILTER_UNKNOWN_FIELD` — a filter leaf naming a field outside the
- *   prepared vocabulary is an ERROR, not a warning, because the platform's own
- *   configure DROPS an unmatched leaf and reports Success: the deployed
- *   trigger then fires on events the filter should exclude, silently. Matching
- *   is case-sensitive, so the near-miss hint checks case first. When the
- *   vocabulary is unknown or known-empty this stays quiet — fail open.
- *
- * Unresolved `where` lookups follow the activity rule exactly: a WARNING here
- * (compile repeats it as the hard failure), with the recorded answer looked up
- * under the event-form node type — the form `prepare` stores.
- */
-function checkEventResolution(subscription, where, kind, opts, error, warn, eventParams) {
-    const sub = subscription;
-    if (!sub || typeof sub.connector !== 'string' || typeof sub.event !== 'string'
-        || sub.connector === '' || sub.event === '')
-        return;
-    // Captured because the guard above narrows `sub.connector` / `sub.event` only
-    // in THIS scope: a property narrowing does not survive into the `filters`
-    // callback below, where they are `unknown` again. The old messages hid that
-    // by interpolating them into template literals, which accept anything.
-    const connectorKey = sub.connector;
-    const eventName = sub.event;
-    // Exactly what `serialize` passes to `resolveEvent` — `sub.version` and
-    // `sub.object` as the author wrote them — so the verdict is compile's.
-    const unresolved = opts.eventResolveError?.(kind, {
-        connector: connectorKey,
-        event: eventName,
-        ...(typeof sub.version === 'string' ? { version: sub.version } : {}),
-        ...(typeof sub.object === 'string' ? { object: sub.object } : {}),
-    });
-    if (unresolved !== undefined) {
-        error('EVENT_UNKNOWN', `${where}: ${unresolved}`);
-        return;
-    }
-    const object = typeof sub.object === 'string' && sub.object !== '' ? sub.object : undefined;
-    const byoa = opts.eventFacts && byoaUnverified(where, { connector: connectorKey, event: eventName, ...(object ? { object } : {}), connection: sub.connection }, opts.eventFacts(connectorKey, eventName, object), opts.byoa, opts.bindings);
-    if (byoa)
-        error(EVENT_BYOA_UNVERIFIED, byoa);
-    if (eventParams?.objectUnprepared && object) {
-        // The generic template answers for every object, so resolution SUCCEEDS
-        // and nothing downstream notices that the object named here has no
-        // schema: no unprepared warning, and a filter vocabulary that fails open.
-        // That is the silent case this whole surface exists to remove, one level
-        // up from the activity it was first found on.
-        warn('OBJECT_UNPREPARED', `${where}: object \`${object}\` has no prepared schema for `
-            + `\`${sub.connector}\` \`${sub.event}\`, and this connector's objects come from `
-            + `the connection, so the library cannot carry one. Materialize it:\n`
-            + `  ${prepareCommand(connectorKey, eventName)} --object ${object}\n`
-            + `Until then its event parameters and filterable fields are unknown and `
-            + `nothing here can check them.`);
-    }
-    if (opts.eventParams && eventParams === undefined) {
-        warn('EVENT_UNPREPARED', `${where}: the library knows nothing about connector event \`${sub.connector}\` \`${sub.event}\` — `
-            + `its parameters and filterable fields cannot be verified offline. Prepare it against a live connection:\n`
-            + `  ${prepareCommand(connectorKey, eventName)}\n`
-            + `and re-run check: the prepared overlay makes this event checkable.`);
-    }
-    const resolutions = opts.resolutions ?? {};
-    const scope = sub.where && typeof sub.where === 'object'
-        ? Object.entries(sub.where) : [];
-    for (const [key, value] of scope) {
-        if (!isLookupToken(value))
-            continue;
-        if (resolvedValue(value, resolutions) !== undefined)
-            continue;
-        warn('LOOKUP_UNRESOLVED', `${where}: \`where.${key}\` ` + unresolvedLookupMessage(value)
-            + `\nCompile will fail until this is recorded.`);
-    }
-    const names = opts.eventFilterFields?.(sub.connector, sub.event, object);
-    if (names && names.length > 0 && Array.isArray(sub.filters)) {
-        const known = new Set(names);
-        sub.filters.forEach((leaf, i) => {
-            const { read } = readEventFilter(leaf);
-            if (!read || known.has(read.field))
-                return;
-            const caseSlip = names.find((n) => n.toLowerCase() === read.field.toLowerCase());
-            // A case slip is a mistake whatever the vocabulary's completeness — the
-            // platform matches case-sensitively, so `Subject` is dropped even where
-            // `subject` exists. An unrecognized name is only certainly wrong when
-            // the vocabulary is COMPLETE; where required selectors decide the field
-            // set and nothing can supply them, refusing a legal field would be the
-            // worse error, so it warns.
-            const selectors = eventParams?.selectors ?? [];
-            // A hybrid connector's custom filter fields are left for `prepare` BY
-            // DESIGN, so the baked list is a strict subset of the tenant's and a
-            // name outside it may be perfectly real. Erroring there tells the author
-            // the platform will drop a field it will actually honour, and the only
-            // way out is deleting a correct filter — "not in my snapshot" mistaken
-            // for "wrong", which is the trap CUSTOM_FIELDS_UNPREPARED was narrowed
-            // around for activities. Same shape here, and the same remedy: name the
-            // prepare that closes the gap.
-            if (eventParams?.customFieldsUnprepared && !caseSlip) {
-                warn('CUSTOM_FIELDS_UNPREPARED', `${where}: filters[${i}] names \`${read.field}\`, which is not in the `
-                    + `tenant-agnostic vocabulary for \`${sub.connector}\` \`${sub.event}\`. This `
-                    + `connector discovers CUSTOM FIELDS per connection, so the baked list is a `
-                    + `subset by design and this name may be a real field of yours. Prepare the `
-                    + `event against your connection to check it for real:\n`
-                    + `  ${prepareCommand(connectorKey, eventName)}`
-                    + `${object ? ` --object ${object}` : ''}\n`
-                    + `Baked fields: ${names.slice(0, 12).join(', ')}${names.length > 12 ? ', …' : ''}.`);
-                return;
-            }
-            // Same shape as the branch above, for the gap preparing cannot close.
-            // `customFieldsUnprepared` says "run prepare and this resolves";
-            // `filtersPartial` says "no call reaches these fields at all", so the
-            // remedy is the designer, not another command.
-            //
-            // Yields to the selector branch below, which reaches the same WARNING by
-            // a more specific route: where `project` / `issuetype` select the schema
-            // it can name them, and "these two values decide the field set" is more
-            // use to an author than "this connector reads its schema from the
-            // connection". Both are true of Jira; the named one is the better message.
-            if (eventParams?.filtersPartial && !caseSlip && selectors.length === 0) {
-                warn('EVENT_FILTER_UNKNOWN_FIELD', `${where}: filters[${i}] names \`${read.field}\`, which is not in the known `
-                    + `filter vocabulary for \`${sub.connector}\` \`${sub.event}\`. This connector `
-                    + `discovers custom fields per connection, and the trigger metadata call takes no `
-                    + `parent values (\`uip is triggers describe\` has no \`-f\`), so the list below is a `
-                    + `subset NO prepare can complete — this name may be a real field of yours. `
-                    + `Verify it against the trigger in the designer before deploying.\n`
-                    + `Known fields: ${names.slice(0, 12).join(', ')}${names.length > 12 ? ', …' : ''}.`);
-                return;
-            }
-            const baseline = selectors.length > 0 && !caseSlip;
-            (baseline ? warn : error)('EVENT_FILTER_UNKNOWN_FIELD', `${where}: filters[${i}] names \`${read.field}\`, which is not a filterable field of `
-                + `\`${sub.connector}\` \`${sub.event}\`. The platform DROPS an unmatched leaf and the deployed `
-                + `trigger fires on events this filter should exclude. `
-                + (caseSlip
-                    ? `Did you mean \`${caseSlip}\`? Matching is case-sensitive.`
-                    : `Filterable fields: ${names.slice(0, 12).join(', ')}${names.length > 12 ? ', …' : ''}.`)
-                + (baseline
-                    ? ` This is a WARNING rather than an error because \`${selectors.join('`, `')}\` `
-                        + `select this event's schema and no discovery call accepts their values, so the `
-                        + `list above is a baseline the real vocabulary extends. Verify the name against `
-                        + `the trigger in the designer before deploying.`
-                    : ''));
-        });
-    }
-}
-function checkEventSubscription(subscription, where, at, warn, eventParams) {
-    const sub = subscription;
-    if (!sub || typeof sub !== 'object') {
-        at('EVENT_NO_SUBSCRIPTION', `${where} has no event subscription. Pass one: `
-            + `{ connector: 'uipath-microsoft-outlook365', event: 'email-received', where: { parentFolderId: '<id>' } }.`);
-        return;
-    }
-    if (typeof sub.connector !== 'string' || sub.connector === '') {
-        at('EVENT_NO_CONNECTOR', `${where} has no \`connector\` key (e.g. 'uipath-microsoft-outlook365').`);
-    }
-    if (typeof sub.event !== 'string' || sub.event === '') {
-        at('EVENT_NO_EVENT', `${where} has no \`event\` name (e.g. 'email-received').`);
-    }
-    const scope = sub.where;
-    const scopeEntries = scope && typeof scope === 'object'
-        ? Object.entries(scope)
-            .filter(([, v]) => v !== undefined && v !== null && String(v) !== '')
-        : [];
-    const scopeKeys = scopeEntries.map(([k]) => k);
-    // The object an author put in `where` by mistake — `objectName` is what the
-    // platform's own `node configure --detail` calls it, so it is the natural slip.
-    const scopeObject = scopeEntries.find(([k]) => /^(objectName|entityName|object)$/i.test(k))?.[1];
-    const object = typeof sub.object === 'string' && sub.object !== '' ? sub.object : undefined;
-    const say = warn ?? at;
-    // The OBJECT half of the contract. A GENERIC event (`record-created` on Data
-    // Fabric, Salesforce, ServiceNow, Jira, …) fires for ONE object of the connection
-    // and its library entry names none — so `object` is REQUIRED, and its absence is
-    // an error: the node would carry `objectName: ""`, validate, and be refused by
-    // the platform's dispatcher (or watch nothing). A CURATED event has its object
-    // built in, so an `object` there names a choice that does not exist.
-    if (eventParams?.generic) {
-        if (object === undefined) {
-            at('EVENT_GENERIC_NO_OBJECT', `${where} subscribes to a GENERIC event: \`${String(sub.connector)}\` \`${String(sub.event)}\` fires for ONE `
-                + `object of the connection (an entity, a table, a custom object) and the library carries no default. `
-                + `Name it with \`object\`.`
-                + (scopeObject !== undefined
-                    ? ` \`where: { ${scopeKeys.join(', ')} }\` is not it — \`where\` holds event PARAMETERS, and this `
-                        + `operation takes none; the value you put there is the object.`
-                    : ` \`uip is triggers objects ${String(sub.connector)} <EVENT> --connection-id <id>\` lists the objects `
-                        + `the bound connection exposes.`), `object: '${scopeObject !== undefined ? String(scopeObject) : '<Object>'}'`);
-        }
-    }
-    else if (object !== undefined && eventParams?.known) {
-        at('EVENT_OBJECT_NOT_GENERIC', `${where} passes \`object: '${object}'\`, but \`${String(sub.connector)}\` \`${String(sub.event)}\` is a `
-            + `CURATED event whose object is built in`
-            + (eventParams.object ? ` (\`${eventParams.object}\`)` : '')
-            + `. \`object\` names the object of a GENERIC event only (\`record-created\` and its kin); drop it here.`, undefined);
-    }
-    // The operation declares no event parameters: an empty `where` is the ONLY
-    // correct authoring, and a non-empty one names fields the operation has not got.
-    if (eventParams?.known && eventParams.names.length === 0) {
-        if (scopeKeys.length > 0) {
-            say('EVENT_SCOPE_NOT_TAKEN', `${where} passes \`where: { ${scopeKeys.join(', ')} }\`, but this connector operation takes NO event `
-                + `parameters — its library entry declares \`inputSchema.fields: []\`, and \`uip is triggers describe\` `
-                + `reports \`EventParameters: []\`. The subscription is scoped by the CONNECTION alone, so these keys `
-                + `are carried into \`detail.eventParameters\` and matched against nothing. `
-                + (eventParams.generic && scopeObject !== undefined
-                    ? `The object this GENERIC event watches goes in \`object\`, not \`where\`.`
-                    : `Filter on the PAYLOAD instead if you meant to narrow it.`), eventParams.generic && scopeObject !== undefined
-                ? `object: '${String(scopeObject)}'`
-                : `where: {}`);
-        }
-    }
-    else if (scopeKeys.length === 0 && !eventParams?.generic) {
-        // Whether omitting the scope is a mistake is not knowable here — the platform
-        // accepts an unscoped subscription (it listens to everything the connection can
-        // see) and 12 deployed Outlook flows that do exactly that scored 1.0. Name the
-        // fields the operation actually has and let the author decide.
-        const fields = eventParams?.known && eventParams.names.length > 0
-            ? `Its event parameters are: ${eventParams.names.map((n) => `\`${n}\``).join(', ')}`
-            : "\`where\` carries the connector's event parameters — for Outlook email-received that is the mail folder";
-        say('EVENT_NO_SCOPE', `${where} has no \`where\`, so its subscription is UNSCOPED: it listens to everything the bound `
-            + `connection can see, not the one thing you named. That deploys and runs — it is broader than you `
-            + `probably meant, which is why this is a warning and not an error. ${fields}. `
-            + `The names and their ids come from the bound connection: `
-            + `\`uip is triggers describe <connector> <EVENT> <object> --connection-id <id>\` lists them, and `
-            + `\`uip is resources run list <connector> MailFolder --connection-id <id>\` resolves a folder id. `
-            + `If the operation takes no event parameters at all — HTTP Webhook is one — an empty \`where\` `
-            + `is correct, and with a library on hand this warning does not fire.`, eventParams?.known && eventParams.names.length > 0
-            ? `where: { ${eventParams.names[0]}: '<id>' }`
-            : `where: { parentFolderId: '<mail folder id>' }`);
-    }
-    const filters = sub.filters;
-    if (filters !== undefined) {
-        if (!Array.isArray(filters)) {
-            at('EVENT_FILTERS_NOT_ARRAY', `${where}'s \`filters\` must be an ARRAY of { field, <operator>: value } — filters are positional and `
-                + `carry author-supplied field names, so an object map cannot express them.`, `filters: [{ field: 'subject', contains: 'Report' }]`);
-        }
-        else {
-            const operators = Object.keys(EVENT_FILTER_OPERATORS).join(', ');
-            filters.forEach((f, i) => {
-                const leaf = f;
-                if (!leaf || typeof leaf.field !== 'string' || leaf.field === '') {
-                    at('EVENT_FILTER_NO_FIELD', `${where}'s filters[${i}] has no \`field\` — name a field on the event payload, e.g. 'subject'.`);
-                }
-                const { keys, read } = readEventFilter(leaf);
-                if (keys.length === 0) {
-                    at('EVENT_FILTER_NO_VALUE', `${where}'s filters[${i}] has no operator. Write exactly one of ${operators} with its value — `
-                        + `\`contains\` is a case-sensitive substring test, the same one Integration Service applies `
-                        + `server-side; \`lessThan\`/\`greaterThan\` order a number or an ISO date.`, `{ field: '${typeof leaf?.field === 'string' ? leaf.field : 'subject'}', contains: '<text>' }`);
-                }
-                else if (keys.length > 1) {
-                    at('EVENT_FILTER_MANY_OPERATORS', `${where}'s filters[${i}] carries ${keys.length} operators (${keys.join(', ')}); a condition has exactly `
-                        + `one. Write two conditions instead — they are ANDed.`);
-                }
-                else if (!read) {
-                    at('EVENT_FILTER_NO_VALUE', `${where}'s filters[${i}] gives \`${keys[0]}\` a value that is not a string, number or boolean.`);
-                }
-                else {
-                    const problem = eventFilterProblem(read);
-                    if (problem)
-                        at('EVENT_FILTER_BAD_VALUE', `${where}'s filters[${i}] on \`${read.field}\`: ${problem}`);
-                }
-            });
-        }
-    }
-}
 /**
  * `{ updates }` writes a declared flow variable when the node completes. The
  * assignable targets are `.var()` variables and flow outputs — assigning to an
@@ -2338,7 +1662,7 @@ function checkTrigger(spec, diags, opts = {}) {
         const sub = spec.subscription;
         checkEventSubscription(sub, 'trigger', at, push('warning'), eventParamsFor(sub, opts));
         checkEventResolution(sub, 'trigger', 'trigger', opts, at, push('warning'), eventParamsFor(sub, opts));
-        checkBindingLabels('event trigger', sub, opts, at, eventTarget(sub), { step: 'trigger', connector: eventTarget(sub)?.key });
+        checkBindingLabels('event trigger', sub, opts, at, eventTarget(sub), { id: 'trigger', connector: eventTarget(sub)?.key });
         return;
     }
     // manual() is the explicit spelling of the default — nothing to validate.
@@ -3510,7 +2834,7 @@ export function jsonTextDirective(text, returnKeys) {
  *    ALSO asks for JSON text makes the model pack its whole answer, serialized, into
  *    one string field. See {@link jsonTextDirective}.
  */
-function checkInlineAgent(step, inputs, diags) {
+function checkInlineAgent(step, inputs, diags, opts = {}) {
     const at = (code, message, suggestion) => {
         diags.push({ level: 'error', code, message, step, ...(suggestion ? { suggestion } : {}) });
     };
@@ -3793,6 +3117,24 @@ function checkInlineAgent(step, inputs, diags) {
                 at('INLINE_AGENT_TOOL_NO_OPERATION', `Inline agent step "${step}" declares a connector tool without ${blank(c.connector) ? 'a `connector`' : 'an `operation`'}. `
                     + `Both name the curated-library entry the tool is resolved from — the same pair \`connector(…)\` takes.`, `{ kind: 'connector', connector: 'uipath-atlassian-jira', operation: 'create-issue' }`);
             }
+            // A connector tool calls Integration Service on a CONNECTION, exactly as a
+            // connector step does — and before #867 there was no way to give it one, so
+            // the tool compiled with none anywhere (no binding, no resource.json row)
+            // and could only fail at run time. Both halves, as `registry prepare` writes them.
+            const labels = t;
+            const missing = ['connection', 'folder'].filter((k) => blank(labels[k]));
+            if (missing.length > 0) {
+                const key = blank(c.connector) ? '<connector-key>' : String(c.connector);
+                const op = blank(c.operation) ? '<operation>' : String(c.operation);
+                at('INLINE_AGENT_TOOL_CONNECTOR_NO_CONNECTION', `Inline agent step "${step}"'s connector tool "${key}/${op}" has no ${missing.map((m) => `\`${m}\``).join(' or ')}. `
+                    + `The tool calls Integration Service on a tenant connection: without one the agent's tool has no `
+                    + `connection binding, its resource.json carries none, and the solution's Resources never list it. `
+                    + `Name the bindings.json labels the same way \`connector()\` takes them — \`${prepareCommand(key, op)}\` `
+                    + `finds the connection and writes both entries.`, `{ kind: 'connector', connector: '${key}', operation: '${op}', connection: '<connection label>', folder: '<folder label>' }`);
+            }
+            else {
+                checkBindingLabels(`Inline agent step "${step}"'s connector tool`, labels, opts, (code, message) => at(code, message), blank(c.connector) ? undefined : { key: String(c.connector), ...(blank(c.operation) ? {} : { action: String(c.operation) }) });
+            }
         }
         else if (kind === 'ixp') {
             const x = t;