@uipath/maestro-builder-sdk 6.14.4 → 6.15.0

package/dist/cli/commands/bpmn.js

@@ -7,11 +7,17 @@ export function registerBpmnCommands(program) {
         .option('-o, --output <file>', 'output .bpmn path')
         .option('--library <dir>', 'connector library directory')
         .option('--bindings <file>', 'bindings.json path')
+        // The overlay `registry prepare` writes, as Flow's compile takes it. This
+        // CLI parses with Commander and `exitOverride()`s, so an option it does not
+        // declare is an `unknown option` BEFORE compile-cli sees argv — reading the
+        // flag in compile-cli is necessary and not sufficient.
+        .option('--connectors-local <dir>', 'connection-resolved connector overlay')
         .action(async (source, options) => {
         const argv = [source];
         addValue(argv, '-o', options.output);
         addValue(argv, '--library', options.library);
         addValue(argv, '--bindings', options.bindings);
+        addValue(argv, '--connectors-local', options.connectorsLocal);
         await invoke('bpmn compile', () => loadTool(import.meta.url, '../../bpmn/compile-cli.js'), argv);
     });
     family.command('check')
@@ -19,6 +25,12 @@ export function registerBpmnCommands(program) {
         .argument('<input>', 'a .bpmn.ts path or bare name')
         .option('--source', 'check authored TypeScript')
         .option('--graph', 'also print the resolved wiring: every element with the flows leaving it, implied edges marked ~>')
+        // The library and its overlay, as Flow's check takes them: `check` reads
+        // the connector corpus now, and an option this parser does not declare is
+        // `unknown option` before check-cli sees argv.
+        .option('--library <dir>', 'connector library directory')
+        .option('--connectors-local <dir>', 'connection-resolved connector overlay')
+        .option('--bindings <file>', 'bindings.json path')
         .addOption(retiredCompiledOption())
         .action(async (input, options) => {
         let mode;
@@ -36,6 +48,9 @@ export function registerBpmnCommands(program) {
         const argv = [input];
         if (options.graph)
             argv.push('--graph');
+        addValue(argv, '--library', options.library);
+        addValue(argv, '--connectors-local', options.connectorsLocal);
+        addValue(argv, '--bindings', options.bindings);
         await invoke('bpmn check', () => loadTool(import.meta.url, '../../bpmn/check-cli.js'), argv);
     });
     family.command('tidy')

package/dist/cli-library.d.ts

@@ -1,28 +1,9 @@
-import type { CheckOpts } from './check.js';
-import { Library } from './library.js';
 /**
- * The library for this invocation, or `undefined` when there is none.
+ * cli-library — compatibility re-export.
  *
- * `--library <dir>`, else `$FLOW_SDK_LIBRARY_JSON`, else the cache `registry
- * pull` filled (`resolveLibraryDir`). The overlay is `--connectors-local <dir>`,
- * else `.flow-sdk/connectors-local` (or a legacy `./connectors-local`) when it has an `index.json` — the directory
- * `registry prepare` writes by default.
+ * How a CLI opens the connector library and its `connectors-local/` overlay, and
+ * the event verdicts `check` shares with `compile`, all moved to
+ * `core/cli-library.ts` when BPMN's `compile` and `check` needed the same things.
+ * This shim preserves the historical `./cli-library.js` import path.
  */
-export declare function openCliLibrary(argv: readonly string[]): Library | undefined;
-/**
- * `check`'s EVENT_UNKNOWN verdict: the message `library.resolveEvent` throws
- * for a subscription, or `undefined` when it resolves.
- *
- * This is the call `serialize` makes for `onEvent` (kind `trigger`, for the
- * flow's trigger and each entry point) and for `waitForEvent` (kind `event`),
- * with the subscription's own `version` and `object`, so check reports an error
- * exactly when compile would throw, with the same text.
- */
-export declare function eventResolveErrorFor(library: Library): NonNullable<CheckOpts['eventResolveError']>;
-/**
- * `check`'s EVENT_BYOA_UNVERIFIED inputs: the event facts and the recorded BYOA
- * checks, from the same `library.eventFacts` / `library.byoaVerifications` that
- * `serialize` reads for the same refusal. Both CLIs spread this into their
- * check options, so the inner loop and the emit rung refuse the same flows.
- */
-export declare function byoaCheckOpts(library: Library): Pick<CheckOpts, 'eventFacts' | 'byoa'>;
+export { openCliLibrary, flagValue, connectorCheckOpts, eventResolveErrorFor, byoaCheckOpts } from './core/cli-library.js';

package/dist/cli-library.js

@@ -1,76 +1,9 @@
 /**
- * cli-library — the connector library a flow CLI opens, and the event verdict
- * `check` shares with `compile`.
+ * cli-library — compatibility re-export.
  *
- * `check-cli` and `compile-cli` used to open the library each in their own way:
- * compile honoured `--connectors-local <dir>`, check ignored the flag and only
- * auto-detected `./connectors-local`. As long as check only WARNED from the
- * library that was harmless. Now check reports EVENT_UNKNOWN as an ERROR when
- * the library cannot resolve an event, so a different library would make check
- * refuse a source compile accepts. Both CLIs open it here instead.
+ * How a CLI opens the connector library and its `connectors-local/` overlay, and
+ * the event verdicts `check` shares with `compile`, all moved to
+ * `core/cli-library.ts` when BPMN's `compile` and `check` needed the same things.
+ * This shim preserves the historical `./cli-library.js` import path.
  */
-import { existsSync } from 'node:fs';
-import { join } from 'node:path';
-import { Library } from './library.js';
-import { resolveLibraryDir } from './registry/cache.js';
-import { defaultOverlayDir } from './workdir.js';
-/** The value after `name` in `argv`, or `undefined`. */
-function flagValue(argv, name) {
-    const i = argv.indexOf(name);
-    return i >= 0 ? argv[i + 1] : undefined;
-}
-/**
- * The library for this invocation, or `undefined` when there is none.
- *
- * `--library <dir>`, else `$FLOW_SDK_LIBRARY_JSON`, else the cache `registry
- * pull` filled (`resolveLibraryDir`). The overlay is `--connectors-local <dir>`,
- * else `.flow-sdk/connectors-local` (or a legacy `./connectors-local`) when it has an `index.json` — the directory
- * `registry prepare` writes by default.
- */
-export function openCliLibrary(argv) {
-    const libDir = resolveLibraryDir(flagValue(argv, '--library'));
-    if (!libDir || !existsSync(join(libDir, 'index.json')))
-        return undefined;
-    const overlayDir = flagValue(argv, '--connectors-local')
-        ?? defaultOverlayDir();
-    return new Library(libDir, { overlayDir });
-}
-/**
- * `check`'s EVENT_UNKNOWN verdict: the message `library.resolveEvent` throws
- * for a subscription, or `undefined` when it resolves.
- *
- * This is the call `serialize` makes for `onEvent` (kind `trigger`, for the
- * flow's trigger and each entry point) and for `waitForEvent` (kind `event`),
- * with the subscription's own `version` and `object`, so check reports an error
- * exactly when compile would throw, with the same text.
- */
-export function eventResolveErrorFor(library) {
-    return (kind, sub) => {
-        try {
-            library.resolveEvent(kind, sub.connector, sub.event, sub.version, sub.object);
-            return undefined;
-        }
-        catch (error) {
-            return error instanceof Error ? error.message : String(error);
-        }
-    };
-}
-/**
- * `check`'s EVENT_BYOA_UNVERIFIED inputs: the event facts and the recorded BYOA
- * checks, from the same `library.eventFacts` / `library.byoaVerifications` that
- * `serialize` reads for the same refusal. Both CLIs spread this into their
- * check options, so the inner loop and the emit rung refuse the same flows.
- */
-export function byoaCheckOpts(library) {
-    return {
-        eventFacts: (connector, event, object) => {
-            try {
-                return library.eventFacts(connector, event, object);
-            }
-            catch {
-                return undefined; // unknown fails open, same as every library callback
-            }
-        },
-        byoa: library.byoaVerifications,
-    };
-}
+export { openCliLibrary, flagValue, connectorCheckOpts, eventResolveErrorFor, byoaCheckOpts } from './core/cli-library.js';

package/dist/compile-cli.js

@@ -36,20 +36,24 @@ function opt(argv, name) {
     return i >= 0 ? argv[i + 1] : undefined;
 }
 /**
- * The deployed-resource tool `type` values `compile` writes. NOT every
- * `$resourceType: 'tool'`: `uip agent refresh` generates the `integration` ones
- * from the flow's connector nodes into the same directory, so pruning by
- * `$resourceType` alone would delete the generator's own output.
+ * The tool `type` values `compile` writes. NOT every `$resourceType: 'tool'`:
+ * the designer writes kinds the SDK cannot derive into the same directory, so
+ * pruning by `$resourceType` alone would delete theirs.
+ *
+ * `integration` (connector tools) is compile's since #867: compile writes the
+ * file under the tool node's own `source` id, the same id and content `uip agent
+ * refresh --inline-in-flow` derives from that node, so a file under any other id
+ * belongs to a tool node the flow no longer has.
  */
 const COMPILE_OWNED_TOOL_TYPES = new Set([
-    'process', 'api', 'processOrchestration', 'flow', 'agent', 'function',
+    'process', 'api', 'processOrchestration', 'flow', 'agent', 'function', 'integration',
 ]);
 /**
  * Does `compile` own this resource file — i.e. would this run have written it,
  * so an unwritten one is stale rather than someone else's?
  *
- * Everything it says no to belongs to `uip agent refresh` (connector tools) or to
- * the designer (escalation, mcp, and the kinds the SDK cannot derive).
+ * Everything it says no to belongs to the designer (escalation, mcp, and the
+ * kinds the SDK cannot derive).
  */
 function compileOwnsResource(body) {
     const kind = body?.$resourceType;
@@ -236,7 +240,9 @@ export async function run(argv) {
             // fail on it. Keyed the way refresh keys it — an index by its name.
             const named = body?.indexName ?? body?.name;
             const key = typeof named === 'string' && named !== '' ? named : undefined;
-            if (key !== undefined) {
+            // A connector tool's binding is a `connection` row, and `mergeBindingsV2`
+            // re-derives every connection row from the flow below — nothing to retract.
+            if (key !== undefined && body?.type !== 'integration') {
                 // Keyed the way refresh keys it: an index by its name, a deployed-resource
                 // tool under `process` whatever its own type says.
                 staleBindings.push({ resource: resourceType === 'context' ? 'index' : 'process', key });

package/dist/core/actions.d.ts

@@ -1806,6 +1806,25 @@ export interface ConnectorToolRef {
     object?: string;
     /** Display label; defaults to the library's own (e.g. `'Create Issue'`). */
     name?: string;
+    /**
+     * What the agent is told the tool does — the runtime hands it to the MODEL.
+     * Defaults to the library's own operation description.
+     */
+    description?: string;
+    /**
+     * The connection's binding NAME in `bindings.json` — the same label
+     * `connector()`'s `connection` option takes (e.g. `'genai'`), resolved to
+     * the tenant connection id at compile. Required: a connector tool with no
+     * connection has nothing to call Integration Service with, and `check`
+     * reports `INLINE_AGENT_TOOL_CONNECTOR_NO_CONNECTION`.
+     */
+    connection?: string;
+    /**
+     * The connection's folder binding NAME in `bindings.json` (a `FolderKey`
+     * entry) — the same label `connector()`'s `folder` option takes. Required
+     * with `connection`.
+     */
+    folder?: string;
 }
 /**
  * The tool kinds that wrap a DEPLOYED tenant resource. `kind` picks the

package/dist/core/cli-library.d.ts

@@ -0,0 +1,47 @@
+import { Library } from './library.js';
+import type { BindingsView } from './binding-messages.js';
+import { type ConnectorCheckOpts } from './connector-checks.js';
+import type { EventCheckOpts } from './event-checks.js';
+/** The value after `name` in `argv`, or `undefined`. */
+export declare function flagValue(argv: readonly string[], name: string): string | undefined;
+/**
+ * The library for this invocation, or `undefined` when there is none.
+ *
+ * `--library <dir>`, else `$FLOW_SDK_LIBRARY_JSON`, else the cache `registry
+ * pull` filled (`resolveLibraryDir`). The overlay is `--connectors-local <dir>`,
+ * else `.flow-sdk/connectors-local` (or a legacy `./connectors-local`) when it
+ * has an `index.json` — the directory `registry prepare` writes by default.
+ */
+export declare function openCliLibrary(argv: readonly string[]): Library | undefined;
+/**
+ * The connector half of a family's check options, from a library the CLI already
+ * opened.
+ *
+ * Every callback fails OPEN: an entry the library cannot resolve, or no library
+ * at all, means "unknown", and an unknown fact fires no rule. That is what lets
+ * `check` stay the fast inner-loop rung — a process with no connectors needs no
+ * library, and one whose connector is absent from the library is `compile`'s
+ * business to name, not this pass's to guess at.
+ *
+ * The `resolutions` are the overlay's: without them every lookup already
+ * recorded by `registry prepare --resolve` would be reported as still owed,
+ * telling the author to re-run a prepare they already ran.
+ */
+export declare function connectorCheckOpts(library: Library | undefined, bindings?: BindingsView): ConnectorCheckOpts & EventCheckOpts;
+/**
+ * `check`'s EVENT_UNKNOWN verdict: the message `library.resolveEvent` throws
+ * for a subscription, or `undefined` when it resolves.
+ *
+ * This is the call `serialize` makes for a START subscription (kind `trigger`)
+ * and for a mid-flow wait (kind `event`), with the subscription's own `version`
+ * and `object`, so check reports an error exactly when compile would throw, with
+ * the same text.
+ */
+export declare function eventResolveErrorFor(library: Library): NonNullable<EventCheckOpts['eventResolveError']>;
+/**
+ * `check`'s EVENT_BYOA_UNVERIFIED inputs: the event facts and the recorded BYOA
+ * checks, from the same `library.eventFacts` / `library.byoaVerifications` that
+ * `serialize` reads for the same refusal, so the inner loop and the emit rung
+ * refuse the same subscriptions.
+ */
+export declare function byoaCheckOpts(library: Library): Pick<EventCheckOpts, 'eventFacts' | 'byoa'>;

package/dist/core/cli-library.js

@@ -0,0 +1,150 @@
+/**
+ * core/cli-library — how every family's CLI opens the connector library.
+ *
+ * One function, because the families kept opening it differently and the
+ * differences were invisible until they bit. Flow's `check-cli` and `compile-cli`
+ * used to disagree about `--connectors-local` (compile honoured the flag, check
+ * only auto-detected the directory), which made `check` refuse a source `compile`
+ * accepted. BPMN had the opposite shape of the same bug: `bpmn/compile-cli`
+ * constructed `new Library(libDir)` with no overlay at all, so `uip maestro
+ * registry prepare` wrote `connectors-local/` and BPMN never read a byte of it —
+ * a prepare that looked like it worked and changed nothing.
+ *
+ * Nothing here is family-specific. The two Flow-typed helpers that used to sit
+ * beside it (`eventResolveErrorFor`, `byoaCheckOpts`) stay in `../cli-library.ts`
+ * until the BPMN check rung needs them too.
+ */
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { Library } from './library.js';
+import { resolveLibraryDir } from '../registry/cache.js';
+import { defaultOverlayDir } from '../workdir.js';
+import { EQUALS_EXPR_DIALECT } from './connector-checks.js';
+import { connectorInputErrors } from './connector-inputs.js';
+/** The value after `name` in `argv`, or `undefined`. */
+export function flagValue(argv, name) {
+    const i = argv.indexOf(name);
+    return i >= 0 ? argv[i + 1] : undefined;
+}
+/**
+ * The library for this invocation, or `undefined` when there is none.
+ *
+ * `--library <dir>`, else `$FLOW_SDK_LIBRARY_JSON`, else the cache `registry
+ * pull` filled (`resolveLibraryDir`). The overlay is `--connectors-local <dir>`,
+ * else `.flow-sdk/connectors-local` (or a legacy `./connectors-local`) when it
+ * has an `index.json` — the directory `registry prepare` writes by default.
+ */
+export function openCliLibrary(argv) {
+    const libDir = resolveLibraryDir(flagValue(argv, '--library'));
+    if (!libDir || !existsSync(join(libDir, 'index.json')))
+        return undefined;
+    const overlayDir = flagValue(argv, '--connectors-local') ?? defaultOverlayDir();
+    return new Library(libDir, { overlayDir });
+}
+/**
+ * The connector half of a family's check options, from a library the CLI already
+ * opened.
+ *
+ * Every callback fails OPEN: an entry the library cannot resolve, or no library
+ * at all, means "unknown", and an unknown fact fires no rule. That is what lets
+ * `check` stay the fast inner-loop rung — a process with no connectors needs no
+ * library, and one whose connector is absent from the library is `compile`'s
+ * business to name, not this pass's to guess at.
+ *
+ * The `resolutions` are the overlay's: without them every lookup already
+ * recorded by `registry prepare --resolve` would be reported as still owed,
+ * telling the author to re-run a prepare they already ran.
+ */
+export function connectorCheckOpts(library, bindings) {
+    if (!library)
+        return bindings ? { bindings } : {};
+    return {
+        eventResolveError: eventResolveErrorFor(library),
+        ...byoaCheckOpts(library),
+        eventParams: (connector, event, object) => {
+            try {
+                return library.eventParameterFields(connector, event, object);
+            }
+            catch {
+                // An unresolvable operation is EVENT_UNKNOWN's business, reported from
+                // `eventResolveError` above; here it just means "unknown".
+                return undefined;
+            }
+        },
+        eventFilterFields: (connector, event, object) => {
+            try {
+                return library.eventFilterFields(connector, event, object);
+            }
+            catch {
+                return undefined;
+            }
+        },
+        lookups: (connector, action, version, object) => library.lookupSpecs(connector, action, version, object),
+        resolutions: library.lookupResolutions,
+        schemaReadiness: (connector, action, version, object) => {
+            try {
+                return library.schemaReadiness(connector, action, version, object);
+            }
+            catch {
+                return undefined;
+            }
+        },
+        // The field contract compile enforces, from the same validator, so the inner
+        // loop and the emit rung cannot disagree about a missing required field, an
+        // unknown key or a mistyped value. An operation the library cannot resolve is
+        // compile's business to name — here it just means "unknown".
+        //
+        // The `=`-expression dialect, because this bag serves the families that spell
+        // an expression that way. Flow binds its own `connectorInputErrors` in
+        // `serialize.ts`, which carries `renderDeep` with it, and overrides this.
+        connectorInputs: (spec, inputs) => {
+            try {
+                const rc = library.resolve(spec.key, spec.action, spec.version, spec.object);
+                return connectorInputErrors(rc, inputs, library.lookupResolutions ?? {}, library.lookupSpecs(spec.key, spec.action, spec.version, spec.object) ?? {}, { dialect: EQUALS_EXPR_DIALECT });
+            }
+            catch {
+                return undefined;
+            }
+        },
+        ...(bindings ? { bindings } : {}),
+    };
+}
+/**
+ * `check`'s EVENT_UNKNOWN verdict: the message `library.resolveEvent` throws
+ * for a subscription, or `undefined` when it resolves.
+ *
+ * This is the call `serialize` makes for a START subscription (kind `trigger`)
+ * and for a mid-flow wait (kind `event`), with the subscription's own `version`
+ * and `object`, so check reports an error exactly when compile would throw, with
+ * the same text.
+ */
+export function eventResolveErrorFor(library) {
+    return (kind, sub) => {
+        try {
+            library.resolveEvent(kind, sub.connector, sub.event, sub.version, sub.object);
+            return undefined;
+        }
+        catch (error) {
+            return error instanceof Error ? error.message : String(error);
+        }
+    };
+}
+/**
+ * `check`'s EVENT_BYOA_UNVERIFIED inputs: the event facts and the recorded BYOA
+ * checks, from the same `library.eventFacts` / `library.byoaVerifications` that
+ * `serialize` reads for the same refusal, so the inner loop and the emit rung
+ * refuse the same subscriptions.
+ */
+export function byoaCheckOpts(library) {
+    return {
+        eventFacts: (connector, event, object) => {
+            try {
+                return library.eventFacts(connector, event, object);
+            }
+            catch {
+                return undefined; // unknown fails open, same as every library callback
+            }
+        },
+        byoa: library.byoaVerifications,
+    };
+}

package/dist/core/connector-checks.d.ts

@@ -0,0 +1,226 @@
+/**
+ * core/connector-checks — the check rules whose facts live in the connector
+ * library, shared by every family that authors a connector activity.
+ *
+ * These were Flow's, and they are the reason Flow's `check` can say "run THIS
+ * prepare" in the loop the author is already in. BPMN had none of them: its
+ * `check` took no options at all, so a BPMN connector node reached `compile`
+ * with an unresolved lookup, an unprepared object or a self-naming binding and
+ * learned about it from `uip maestro bpmn validate`, a tenant, or a faulted run.
+ * (`flow-v2-run-8`: `skill-bpmn-e2e-customer-escalation-triage` packed
+ * `bindings_v2.json` carrying the literal strings `jiraConnection` and
+ * `slackConnection` where connection ids belong.)
+ *
+ * Nothing here knows what a step or a task is. A caller supplies:
+ *
+ *  - `where` — how the message opens (`Connector step "post"`,
+ *    `Connector task "post"`), so each family keeps its own vocabulary;
+ *  - `report` — where the diagnostic goes, so each family adds its own locator
+ *    field (Flow's `step`, BPMN's `where`);
+ *  - `dialect` — how an authored value reads, because Flow writes expressions as
+ *    `Expr` objects over `$vars` and BPMN writes them as `=`-prefixed strings
+ *    over `vars`. Without this a BPMN `'=vars.channelId'` would read as a pasted
+ *    literal id and warn about itself.
+ */
+import { type LookupResolutions, type LookupSpec } from './lookups.js';
+import type { SchemaReadiness } from './library.js';
+import { type BindingsView, type PrepareTarget } from './binding-messages.js';
+/** One connector activity, as every family already models it. */
+export interface ConnectorSpec {
+    /** Connector library key, e.g. `uipath-atlassian-jira`. */
+    key: string;
+    /** The operation, e.g. `create-issue`. */
+    action: string;
+    /** Pinned operation version, when the author pinned one. */
+    version?: string;
+    /** Which OBJECT a generic operation addresses. */
+    object?: string;
+    /** The author's activity inputs, by the connector's own field names. */
+    inputs?: Record<string, unknown>;
+    /** Symbolic binding names, resolved through `bindings.json`. */
+    connection?: unknown;
+    folder?: unknown;
+}
+/** A diagnostic with no locator — the caller attaches its family's. */
+export interface ConnectorDiagnostic {
+    level: 'error' | 'warning';
+    code: string;
+    message: string;
+    suggestion?: string;
+}
+/** Where a diagnostic goes. */
+export type ReportConnector = (diagnostic: ConnectorDiagnostic) => void;
+/**
+ * How one authored input value reads.
+ *
+ * `container` means "descend into it" — an array or a plain object. A lookup
+ * token is recognized before `classify` is consulted, so a dialect never sees one.
+ */
+export type ValueReading = {
+    kind: 'runtime';
+    js: string;
+} | {
+    kind: 'literal';
+    value: unknown;
+} | {
+    kind: 'container';
+};
+/** How a family spells expressions. */
+export interface ExprDialect {
+    /** The reference namespace `extractRefs` reads: `$vars` for Flow, `vars` for BPMN. */
+    namespace: string;
+    classify(value: unknown): ValueReading;
+    /**
+     * Is this value one the family cannot evaluate here — a Flow `Expr`, a BPMN
+     * `=`-expression?
+     *
+     * Separate from `classify` because the two questions differ for a Flow
+     * `lit(…)`: it classifies as a LITERAL (the lookup rules read its constant)
+     * but is still opaque to the input validator, which must not type-check the
+     * `Expr` wrapper against the field's declared type.
+     */
+    isOpaque(value: unknown): boolean;
+    /**
+     * Does this family import GENERATED CONNECTOR DESCRIPTORS?
+     *
+     * Flow's `connector(SendMessageToUser, …)` does, and the `.byName()` aliases
+     * exist only on one. BPMN's `.connector()` takes the key and action as
+     * strings, so a remedy naming a descriptor there sends the reader after a
+     * module nothing generates. It is a family fact rather than an expression
+     * one, but the dialect is the family token every one of these rules already
+     * has in hand.
+     */
+    descriptors: boolean;
+}
+/**
+ * Flow: an input is an {@link Expr} object. A non-literal one is runtime; a
+ * literal one (`lit(…)`) carries the constant it was built from.
+ */
+export declare const FLOW_EXPR_DIALECT: ExprDialect;
+/**
+ * BPMN and Case: an expression is a string that starts with `=`.
+ *
+ * `=js:…` is the same thing with an evaluator prefix; both reduce to the source
+ * `extractRefs` reads. A string that does NOT start with `=` is a constant, which
+ * is exactly what `LOOKUP_LITERAL_ID` is about.
+ */
+export declare const EQUALS_EXPR_DIALECT: ExprDialect;
+/** The library-backed facts these rules need, or `undefined` for "no library". */
+export interface ConnectorCheckOpts {
+    /** One connector operation's generated lookup table, keyed by field. */
+    lookups?: (connector: string, action: string, version?: string, object?: string) => Readonly<Record<string, LookupSpec>> | undefined;
+    /** Everything `registry prepare --resolve` has recorded in the local overlay. */
+    resolutions?: LookupResolutions;
+    /** Whether a connector step's schema is materialized locally. */
+    schemaReadiness?: (connector: string, action: string, version?: string, object?: string) => SchemaReadiness | undefined;
+    /** What `compile` would refuse these inputs with, or `undefined` when it would accept them. */
+    connectorInputs?: (spec: {
+        key: string;
+        action: string;
+        version?: string;
+        object?: string;
+    }, inputs: Record<string, unknown>) => string | undefined;
+    /** The project's `bindings.json`, for the label rules. */
+    bindings?: BindingsView;
+}
+/**
+ * The lookup rules: a pasted id, and an unresolved token.
+ *
+ * These are the strongest discoverability route in the design, because they
+ * need no prior knowledge and arrive in the loop the author is already in. An
+ * author who pastes `WT9RC72KU` into a lookup field is not being careless, they
+ * are being uninformed — nothing anywhere told them the field was resolvable —
+ * and the fix is to tell them at the point of the mistake.
+ *
+ * Both are WARNINGS, not errors. A literal id is legal and sometimes correct
+ * (a value that genuinely does not move), and the unresolved case is already a
+ * hard failure at compile, where the same message is repeated. Making it an
+ * error here would stop a `check` that is otherwise clean from telling the
+ * author about everything ELSE that is wrong, which is the whole point of
+ * running the cheap pass first.
+ */
+export declare function checkConnectorLookups(where: string, spec: ConnectorSpec, opts: ConnectorCheckOpts, dialect: ExprDialect, report: ReportConnector): void;
+/**
+ * The schema rules: an unprepared object, and unprepared custom fields.
+ *
+ * Same reasoning as the lookup rules above — the author needs no prior
+ * knowledge, and the diagnostic arrives in the loop they are already in, with
+ * the one command that discharges it. Both are WARNINGS: compile accepts a
+ * connection-scoped object (stamped `objectNameUnverified`) and passes the
+ * inputs through, so `check` is the one place the gap is visible BEFORE a
+ * process dispatches against a schema nothing validated.
+ *
+ * The custom-fields rule is deliberately narrower than "unprepared op": a step
+ * that uses only baked fields owes nothing, and warning on it anyway teaches
+ * the author that the warning is noise. It fires only for inputs OUTSIDE the
+ * tenant-agnostic snapshot — the moment hand-guessing actually starts.
+ */
+export declare function checkConnectorSchema(where: string, spec: ConnectorSpec, opts: ConnectorCheckOpts, dialect: ExprDialect, report: ReportConnector): void;
+/**
+ * The field contract and the binding names `compile` enforces, reported here first.
+ *
+ * Both rules run only with the facts in hand (a library for the fields, a
+ * bindings.json for the names); without them `check` stays a pure function of the
+ * built model and says nothing, as before.
+ */
+export declare function checkConnectorContract(where: string, spec: ConnectorSpec, opts: ConnectorCheckOpts, report: ReportConnector, 
+/** The activity's own id, for {@link connectionConnectorConflicts}; omit to record nothing. */
+id?: string): void;
+/**
+ * The binding-label rules `serialize`'s `resolveBinding` enforces, for one
+ * `{ connection, folder }` pair — reported at every site that resolves one
+ * (connector step, event trigger and `.entryPoint` onEvent, waitForEvent, managed
+ * HTTP), with the sentence compile throws. Without this at the event and HTTP
+ * sites `check` printed `✓ no issues` for a source `compile` then refused.
+ *
+ * Silent without a bindings.json, and for a label that resolves to anything
+ * other than its own name (stub values are compile's CONNECTION_STUB warning).
+ */
+export declare function checkBindingLabels(where: string, labels: {
+    connection?: unknown;
+    folder?: unknown;
+} | undefined, opts: ConnectorCheckOpts, report: (code: 'BINDING_SELF_NAME' | 'BINDING_UNDECLARED', message: string) => void, target?: PrepareTarget, 
+/** The activity, and the connector its connection must belong to, for {@link connectionConnectorConflicts}. */
+use?: {
+    id: string;
+    connector: string | undefined;
+}): void;
+/**
+ * The two phrases every lookup diagnostic needs: what the field sends, and how
+ * to resolve it.
+ *
+ * The `call` names BOTH authoring forms, and names which one the alias belongs
+ * to. Printing `lookup(<Descriptor>, 'entityName').byDisplayName('<value>')`
+ * alone — the old text — was a remedy with an unstated precondition: aliases
+ * are generated onto the descriptor, and `<Descriptor>` is a placeholder the
+ * reader has to fill from somewhere. An author holding the connector key and
+ * action instead (the form the library's Generic CRUD half is authored in, and
+ * the majority of its lookup fields) substitutes those for the placeholder,
+ * keeps the alias, and gets `lookup(...).byDisplayName is not a function`. Six
+ * flow-eval tasks did precisely that, each losing a check-edit-check round to
+ * a message that had told them to.
+ */
+export declare function lookupPhrases(field: string, lookup: LookupSpec, spec: ConnectorSpec, descriptors?: boolean): {
+    target: string;
+    call: string;
+};
+/** One activity's use of a connection label, as the connector the connection must belong to. */
+export interface ConnectionUse {
+    /** The activity's own id — Flow's step name, BPMN's element id. */
+    id: string;
+    label: string;
+    connector: string;
+}
+/** Run `check`, and hand back the connection uses its binding-label rules saw. */
+export declare function collectConnectionUses(check: () => void): ConnectionUse[];
+/**
+ * CONNECTION_CONNECTOR_CONFLICT — the rule `serialize` enforces on the emitted
+ * document (`connectionConnectors`, bindings-v2.ts), reported here with the same
+ * sentence so `check` does not print `✓ no issues` for a source `compile` then
+ * refuses. Labels are grouped by what they resolve to, so two labels bound to
+ * one connection id are one connection, as they are in the artifact.
+ */
+export declare function connectionConnectorConflicts(uses: readonly ConnectionUse[], opts: ConnectorCheckOpts): {
+    id: string;
+    message: string;
+}[];