@uipath/maestro-builder-sdk 6.18.5 → 6.18.7

package/dist/case/check-cli.js

@@ -3,7 +3,7 @@
  * check-cli — fast static validation of <Name>.case.ts (no output file).
  *
  * Usage: node --experimental-strip-types check-cli.js <case.ts | BaseName> \
- *     [--library <library-json dir>] [--connectors-local <overlay dir>]
+ *     [--library <library-json dir>] [--connectors-local <overlay dir>] [--bindings <bindings.json>]
  * Exits 0 when clean (warnings allowed), 1 on any error.
  *
  * The library is opened exactly as `compile-cli` opens it (`openCliLibrary`), so
@@ -14,11 +14,13 @@ import { resolveCaseFile, loadBuiltCase } from './load.js';
 import { check } from './check.js';
 import { caseCheckOpts } from './cli-library.js';
 import { openCliLibrary } from '../core/cli-library.js';
-import { runWhenInvokedDirectly } from '../cli-run.js';
+import { Bindings } from '../core/bindings.js';
+import { defaultBindingsFile } from '../workdir.js';
+import { flagValue, runWhenInvokedDirectly } from '../cli-run.js';
 import { ensureTypeScriptRuntime } from '../node-runtime.js';
 /** Flags that take a value: their argument is never the source positional. */
-const VALUE_FLAGS = new Set(['--library', '--connectors-local']);
-const USAGE = 'usage: check <case.ts | BaseName> [--library <dir>] [--connectors-local <dir>]';
+const VALUE_FLAGS = new Set(['--library', '--connectors-local', '--bindings']);
+const USAGE = 'usage: check <case.ts | BaseName> [--library <dir>] [--connectors-local <dir>] [--bindings <file>]';
 export async function run(argv) {
     if (argv.length === 0 || argv[0] === '-h' || argv[0] === '--help') {
         console.error(USAGE);
@@ -32,7 +34,9 @@ export async function run(argv) {
     const file = resolveCaseFile(input);
     ensureTypeScriptRuntime();
     const built = await loadBuiltCase(file);
-    const diags = check(built, caseCheckOpts(openCliLibrary(argv)));
+    // bindings.json as `case compile` reads it, for the binding-label rules (#1034).
+    const bindings = new Bindings(flagValue(argv, '--bindings') ?? defaultBindingsFile());
+    const diags = check(built, caseCheckOpts(openCliLibrary(argv), bindings));
     reportDiagnostics(diags);
     for (const d of diags)
         console.error(`  ${d.level === 'error' ? '✗' : '⚠'} [${d.code}] ${d.message}`);

package/dist/case/check.d.ts

@@ -10,6 +10,7 @@
 import type { BuiltCase } from './case-sdk.js';
 import { type ConnectorCheckOpts } from '../core/connector-checks.js';
 import type { EventSubscription } from '../core/actions.js';
+import { type EventCheckOpts } from '../core/event-checks.js';
 export interface Diagnostic {
     level: 'error' | 'warning';
     code: string;
@@ -25,13 +26,14 @@ export interface Diagnostic {
  * `compile` actually makes. Case `serialize` resolves the connector operation and
  * the event, and validates a connector task's inputs and resolves its lookups
  * through the shared `buildConnectorInputs` (`connectorInputs`, `lookups`,
- * `resolutions`). It does not check binding labels or BYOA, so those hooks stay
- * off until Case compile enforces them.
+ * `resolutions`), and refuses a connection/folder label bindings.json cannot
+ * turn into a resource key (`bindings`, `bindingLabelRefusal`), and refuses an
+ * event on an unverified BYOA connection (`eventFacts`, `byoa`).
  *
  * Every hook fails open: without a library, `check` stays a pure function of the
  * built model.
  */
-export type CaseCheckOpts = Pick<ConnectorCheckOpts, 'connectorResolveError' | 'connectorInputs' | 'lookups' | 'resolutions' | 'schemaReadiness'> & {
+export type CaseCheckOpts = Pick<ConnectorCheckOpts, 'connectorResolveError' | 'connectorInputs' | 'lookups' | 'resolutions' | 'schemaReadiness' | 'bindings'> & Pick<EventCheckOpts, 'eventFacts' | 'byoa'> & {
     /**
      * What Case `compile` would refuse an event subscription with, or `undefined`
      * when it resolves: `EVENT_UNKNOWN` (the event is not in the library, or

package/dist/case/check.js

@@ -2,7 +2,7 @@ import { types } from '../core/expr.js';
 import { authoredCaseVersion, CASE_FORMAT_PROFILE, CASE_SCHEMA_VERSIONS } from './format-profile.js';
 import { schemaVersionRefusal } from '../schema-version.js';
 import { caseJsonPreservation, caseJsonPreservationErrors } from './preserve.js';
-import { EQUALS_EXPR_DIALECT, checkConnectorContract, checkConnectorLookups, checkConnectorSchema, } from '../core/connector-checks.js';
+import { EQUALS_EXPR_DIALECT, checkBindingLabels, checkConnectorContract, checkConnectorLookups, checkConnectorSchema, } from '../core/connector-checks.js';
 import { checkEventResolution } from '../core/event-checks.js';
 import { EXTERNAL_TASK_DESCRIPTOR_CONTRACT } from './external.js';
 const TYPE_NAMES = new Set(Object.values(types));
@@ -114,6 +114,11 @@ export function check(built, opts = {}) {
                     message: `Stage "${stage.label}" selectNextStage.objectName must name a Data Fabric entity.`,
                     where: stage.label,
                 });
+            // Its connector's labels resolve through the same `bindingRef` as a
+            // connector task's, so they get the same binding-label rules.
+            const connector = exit.selectNextStage.connector;
+            if (connector)
+                checkBindingLabels('select-next-stage connector', connector, opts, (code, message) => diags.push({ level: 'error', code, message, where: stage.label }), { key: connector.connectorKey });
         }
         for (const lane of stage.lanes)
             for (const t of lane) {
@@ -293,9 +298,17 @@ function checkLibraryConnectors(built, opts, diags) {
         const refused = opts.subscriptionError?.(kind, sub);
         if (refused !== undefined)
             diags.push({ level: 'error', code: refused.code, message: `${where}: ${refused.message}`, where: at });
-        // A `where` lookup nobody recorded: Flow's LOOKUP_UNRESOLVED warning, from the
-        // shared event rules. Only `resolutions` is passed, so nothing else in them fires.
-        checkEventResolution(sub, where, kind, { resolutions: opts.resolutions ?? {} }, (code, message) => diags.push({ level: 'error', code, message, where: at }), (code, message) => diags.push({ level: 'warning', code, message, where: at }));
+        checkBindingLabels(where, sub, opts, (code, message) => diags.push({ level: 'error', code, message, where: at }), { key: sub.connector, action: sub.event });
+        // From the shared event rules, the two Case compile enforces: a `where` lookup
+        // nobody recorded (LOOKUP_UNRESOLVED, a warning) and an unverified BYOA
+        // connection (EVENT_BYOA_UNVERIFIED). Only their hooks are passed, so nothing
+        // else in them fires.
+        checkEventResolution(sub, where, kind, {
+            resolutions: opts.resolutions ?? {},
+            ...(opts.eventFacts ? { eventFacts: opts.eventFacts } : {}),
+            ...(opts.byoa ? { byoa: opts.byoa } : {}),
+            ...(opts.bindings ? { bindings: opts.bindings } : {}),
+        }, (code, message) => diags.push({ level: 'error', code, message, where: at }), (code, message) => diags.push({ level: 'warning', code, message, where: at }));
     };
     const rules = (conditions, where) => {
         for (const c of conditions)

package/dist/case/cli-library.d.ts

@@ -1,4 +1,5 @@
 import type { Library } from '../core/library.js';
+import type { BindingsView } from '../core/binding-messages.js';
 import type { CaseCheckOpts } from './check.js';
 /**
  * Case's check options from a library the CLI already opened, or `{}` without one.
@@ -7,10 +8,12 @@ import type { CaseCheckOpts } from './check.js';
  * the operation and event resolution (the event through `resolveCaseSubscription`,
  * compile's own call), a connector task's field contract and lookups (the
  * `=`-expression validator Case compile runs), and the schema-readiness warnings.
- * The binding-label and BYOA hooks of the shared bag are left out, because Case
- * `serialize` does not enforce them.
+ * With `bindings`, the binding-label rules (BINDING_SELF_NAME, BINDING_UNDECLARED),
+ * which Case `serialize` enforces through the same `bindingLabelRefusal`, and the
+ * BYOA facts and ledger, for the refusal `resolveCaseSubscription` makes.
  *
  * @param library - The library `openCliLibrary` returned, or `undefined`.
+ * @param bindings - The project's bindings.json, as compile reads it.
  * @returns The options for Case `check`.
  */
-export declare function caseCheckOpts(library: Library | undefined): CaseCheckOpts;
+export declare function caseCheckOpts(library: Library | undefined, bindings?: BindingsView): CaseCheckOpts;

package/dist/case/cli-library.js

@@ -17,21 +17,26 @@ import { EVENT_GENERIC_NO_OBJECT, GenericEventNoObjectError, resolveCaseSubscrip
  * the operation and event resolution (the event through `resolveCaseSubscription`,
  * compile's own call), a connector task's field contract and lookups (the
  * `=`-expression validator Case compile runs), and the schema-readiness warnings.
- * The binding-label and BYOA hooks of the shared bag are left out, because Case
- * `serialize` does not enforce them.
+ * With `bindings`, the binding-label rules (BINDING_SELF_NAME, BINDING_UNDECLARED),
+ * which Case `serialize` enforces through the same `bindingLabelRefusal`, and the
+ * BYOA facts and ledger, for the refusal `resolveCaseSubscription` makes.
  *
  * @param library - The library `openCliLibrary` returned, or `undefined`.
+ * @param bindings - The project's bindings.json, as compile reads it.
  * @returns The options for Case `check`.
  */
-export function caseCheckOpts(library) {
+export function caseCheckOpts(library, bindings) {
     if (!library)
-        return {};
-    const shared = connectorCheckOpts(library);
+        return bindings ? { bindings } : {};
+    const shared = connectorCheckOpts(library, bindings);
     return {
+        ...(bindings ? { bindings } : {}),
         connectorResolveError: shared.connectorResolveError,
         connectorInputs: shared.connectorInputs,
         lookups: shared.lookups,
         resolutions: shared.resolutions,
+        eventFacts: shared.eventFacts,
+        byoa: shared.byoa,
         schemaReadiness: shared.schemaReadiness,
         externalDescriptorError: (kind, d) => {
             let rc;

package/dist/case/compile-cli.js

@@ -49,7 +49,9 @@ export async function run(argv) {
     // which is what the three copies of these lines used to each decide for itself.
     // Opened BEFORE the check pass, which reads the same library (#1014).
     const library = openCliLibrary(argv);
-    const diags = check(built, caseCheckOpts(library));
+    const bindFile = flagValue(argv, '--bindings') ?? defaultBindingsFile();
+    const bindings = new Bindings(bindFile);
+    const diags = check(built, caseCheckOpts(library, bindings));
     for (const d of diags)
         console.error(`  ${d.level === 'error' ? '✗' : '⚠'} [${d.code}] ${d.message}`);
     // Reported before serialize, so every exit path carries what stderr printed.
@@ -59,8 +61,6 @@ export async function run(argv) {
         console.error(`compile: ${errors.length} error(s); not emitting.`);
         return 1;
     }
-    const bindFile = flagValue(argv, '--bindings') ?? defaultBindingsFile();
-    const bindings = new Bindings(bindFile);
     let caseplan;
     try {
         caseplan = serialize(built, { library, bindings });

package/dist/case/serialize.js

@@ -11,6 +11,7 @@
 import { IdGen } from './ids.js';
 import { buildConnectorInputs, nestConnectorBody, transportHttpMethod } from '../core/connector-inputs.js';
 import { EQUALS_EXPR_DIALECT } from '../core/connector-checks.js';
+import { bindingLabelRefusal } from '../core/binding-messages.js';
 import { resolveEventWhere } from '../core/lookups.js';
 import { resolveCaseSubscription } from './subscription.js';
 import { externalDescriptorRefusal } from './external.js';
@@ -177,12 +178,13 @@ export function serialize(built, opts = {}) {
         const context = [];
         if (connector) {
             context.push(io('connectorKey', 'string', { value: connector.connectorKey }));
-            const connection = bindingRef(resolver, connector.connection, 'Connection', 'ConnectionId', `${connector.connectorKey} connection`);
+            const site = { where: 'select-next-stage connector', target: { key: connector.connectorKey } };
+            const connection = bindingRef(resolver, connector.connection, 'Connection', 'ConnectionId', `${connector.connectorKey} connection`, { ...site, attribute: 'connection' });
             if (connection) {
                 context.push(io('connection', 'string', { value: `=bindings.${connection.id}` }));
                 context.push(io('resourceKey', 'string', { value: connection.resourceKey }));
             }
-            const folder = bindingRef(resolver, connector.folder, 'Connection', 'folderKey', 'FolderKey');
+            const folder = bindingRef(resolver, connector.folder, 'Connection', 'folderKey', 'FolderKey', { ...site, attribute: 'folder' });
             if (folder)
                 context.push(io('folderKey', 'string', { value: `=bindings.${folder.id}` }));
         }
@@ -697,7 +699,7 @@ function emitTriggers(triggers, ids, resolver) {
             // placeholder. A subscription resolves through the same library/binding
             // machinery as connector tasks and wait-for-connector bags.
             const bag = t.eventSubscription
-                ? resolvedSubscriptionBag('trigger', t.eventSubscription, resolver, triggerId)
+                ? resolvedSubscriptionBag('trigger', t.eventSubscription, resolver, triggerId, `Event trigger "${label}"`)
                 : { serviceType: CASE_FORMAT_PROFILE.eventServiceType };
             if (t.eventOutputs?.length) {
                 const outputs = t.eventOutputs.map((o) => {
@@ -836,10 +838,10 @@ function taskData(task, resolver, taskId, stageId, ids) {
             return data;
         }
         case 'connector':
-            return connectorTaskData(task.connector, resolver, taskId);
+            return connectorTaskData(task.connector, resolver, taskId, `Connector task "${task.name}"`);
         case 'external-agent':
         case 'external-workflow':
-            return externalTaskData(task.kind, task.external, resolver);
+            return externalTaskData(task.kind, task.external, resolver, `${task.kind === 'external-agent' ? 'External Agent' : 'External Workflow'} task "${task.name}"`);
         case 'wait-for-timer': {
             if (task.timer?.duration)
                 return { timerType: 'timeDuration', timeDuration: task.timer.duration };
@@ -852,7 +854,7 @@ function taskData(task, resolver, taskId, stageId, ids) {
         case 'wait-for-connector':
             // Floor placeholder (no connector named) = `serviceType` only; naming the
             // connector/operation emits the `context` subscription.
-            return waitConnectorBag(task.waitConnector, { alwaysContext: false }, resolver, `${stageId}-${taskId}`);
+            return waitConnectorBag(task.waitConnector, { alwaysContext: false }, resolver, `${stageId}-${taskId}`, `Wait-for-connector task "${task.name}"`);
     }
 }
 /**
@@ -863,9 +865,9 @@ function taskData(task, resolver, taskId, stageId, ids) {
  * and empty `inputs`/`outputs`/`bindings`. A *rule* always carries the context —
  * `validate` rejects a bare `uipath` ("connector activity missing").
  */
-function waitConnectorBag(spec, opts, resolver, elementId) {
+function waitConnectorBag(spec, opts, resolver, elementId, where) {
     if (isResolvedSubscription(spec))
-        return resolvedSubscriptionBag('event', spec, resolver, elementId);
+        return resolvedSubscriptionBag('event', spec, resolver, elementId, where);
     const bag = { serviceType: CASE_FORMAT_PROFILE.waitConnectorServiceType };
     const named = spec?.connectorKey !== undefined || spec?.operation !== undefined;
     if (opts.alwaysContext || named) {
@@ -884,19 +886,20 @@ function isResolvedSubscription(spec) {
 }
 /** Resolve a Case event/wait subscription into the designer/runtime bag pinned
  * by the archived v1 artifacts. Placeholder bags never enter this path. */
-function resolvedSubscriptionBag(kind, spec, resolver, elementId) {
+function resolvedSubscriptionBag(kind, spec, resolver, elementId, where) {
     if (!resolver.library)
         throw new Error(`${kind === 'trigger' ? 'event trigger' : 'wait-for-connector'} needs the connector library — `
             + `pass { library } to serialize or use uip maestro case compile --library.`);
-    const rc = resolveCaseSubscription(resolver.library, kind, spec);
+    const rc = resolveCaseSubscription(resolver.library, kind, spec, { where, bindings: resolver.bindings });
     const op = rc.entry.operation ?? {};
     const context = [io('connectorKey', 'string', { value: rc.connectorKey })];
-    const connection = bindingRef(resolver, spec.connection, 'Connection', 'ConnectionId', `${rc.connectorKey} connection`);
+    const target = { key: spec.connector, action: spec.event };
+    const connection = bindingRef(resolver, spec.connection, 'Connection', 'ConnectionId', `${rc.connectorKey} connection`, { attribute: 'connection', where, target });
     if (connection) {
         context.push(io('connection', 'string', { value: `=bindings.${connection.id}` }));
         context.push(io('resourceKey', 'string', { value: connection.resourceKey }));
     }
-    const folder = bindingRef(resolver, spec.folder, 'Connection', 'folderKey', 'FolderKey');
+    const folder = bindingRef(resolver, spec.folder, 'Connection', 'folderKey', 'FolderKey', { attribute: 'folder', where, target });
     if (folder)
         context.push(io('folderKey', 'string', { value: `=bindings.${folder.id}` }));
     context.push(io('method', 'string', {}), io('path', 'string', {}), io('objectName', 'string', { value: op.objectName ?? spec.event }), io('operation', 'string', { value: op.eventOperation ?? spec.event }), io('metadata', 'json', { body: subscriptionMetadata(rc, op, spec.filters ?? [], elementId) }));
@@ -1077,7 +1080,7 @@ function emitTaskOutput(o, elementId, ids, seed, resolver) {
  * the op's output schema. Connection/folder resolve through `bindings` and are
  * referenced as `=bindings.<id>`, with the binding entry collected at case root.
  */
-function connectorTaskData(spec, resolver, elementId) {
+function connectorTaskData(spec, resolver, elementId, where) {
     if (!resolver.library)
         throw new Error(`connector task needs the connector library — pass { library } to serialize or use uip maestro case compile --library.`);
     const rc = resolver.library.resolve(spec.key, spec.action, spec.version, spec.object);
@@ -1086,12 +1089,13 @@ function connectorTaskData(spec, resolver, elementId) {
         io('connectorKey', 'string', { value: rc.connectorKey }),
     ];
     // connection + folder → root bindings, referenced by id.
-    const connRef = bindingRef(resolver, spec.connection, 'Connection', 'ConnectionId', `${rc.connectorKey} connection`);
+    const target = { key: spec.key, action: spec.action };
+    const connRef = bindingRef(resolver, spec.connection, 'Connection', 'ConnectionId', `${rc.connectorKey} connection`, { attribute: 'connection', where, target });
     if (connRef) {
         context.push(io('connection', 'string', { value: `=bindings.${connRef.id}` }));
         context.push(io('resourceKey', 'string', { value: connRef.resourceKey }));
     }
-    const folderRef = bindingRef(resolver, spec.folder, 'Connection', 'folderKey', 'FolderKey');
+    const folderRef = bindingRef(resolver, spec.folder, 'Connection', 'folderKey', 'FolderKey', { attribute: 'folder', where, target });
     if (folderRef)
         context.push(io('folderKey', 'string', { value: `=bindings.${folderRef.id}` }));
     context.push(io('objectName', 'string', { value: op.objectName ?? spec.action }), io('method', 'string', { value: transportHttpMethod(rc.httpMethod) }), io('path', 'string', { value: rc.endpoint }), io('metadata', 'json', { body: connectorMetadata(rc, op) }));
@@ -1128,7 +1132,7 @@ function connectorTaskData(spec, resolver, elementId) {
     const outputs = connectorOutputs(rc, elementId, resolver);
     return { serviceType: CASE_FORMAT_PROFILE.connectorActivityServiceType, context, inputs, outputs, bindings: [] };
 }
-function externalTaskData(kind, spec, resolver) {
+function externalTaskData(kind, spec, resolver, where) {
     if (!resolver.library)
         throw new Error(`${kind} task needs the connector library — pass { library } to serialize or use uip maestro case compile --library.`);
     const rc = resolver.library.resolve(spec.connector.key, spec.connector.action, spec.connector.version, spec.connector.object);
@@ -1137,8 +1141,9 @@ function externalTaskData(kind, spec, resolver) {
         throw new Error(refused);
     if (spec.mode !== 'sync' && spec.mode !== 'async')
         throw new Error(`${kind} task mode must be "sync" or "async".`);
-    const connection = bindingRef(resolver, spec.connector.connection, 'Connection', 'ConnectionId', `${rc.connectorKey} connection`);
-    const folder = bindingRef(resolver, spec.connector.folder, 'Connection', 'folderKey', 'FolderKey');
+    const target = { key: spec.connector.key, action: spec.connector.action };
+    const connection = bindingRef(resolver, spec.connector.connection, 'Connection', 'ConnectionId', `${rc.connectorKey} connection`, { attribute: 'connection', where, target });
+    const folder = bindingRef(resolver, spec.connector.folder, 'Connection', 'folderKey', 'FolderKey', { attribute: 'folder', where, target });
     if (!connection || !folder)
         throw new Error(`${kind} task requires non-empty connection and folder binding names.`);
     const serviceType = kind === 'external-agent'
@@ -1199,9 +1204,17 @@ function ioSlot(name, bodyObj, elementId) {
 }
 /** Resolve a symbolic connection/folder to a root binding entry (collected once),
  * returning its id + resourceKey for the `=bindings.<id>` reference. */
-function bindingRef(resolver, name, resource, propertyAttribute, displayName) {
+function bindingRef(resolver, name, resource, propertyAttribute, displayName, site) {
     if (!name)
         return undefined;
+    // A label compile cannot turn into a resource key: one bindings.json answers
+    // with the label itself, or a populated one does not declare it. Falling back
+    // to the label emitted it as the binding's resourceKey, and the run faulted
+    // with "'Connection' has an invalid GUID value" (#1034). Same refusal, same
+    // text, as Flow compile and every family's check (`bindingLabelRefusal`).
+    const refused = bindingLabelRefusal(resolver.bindings, name, site.attribute, site.where, site.target);
+    if (refused)
+        throw refused;
     const entry = resolver.bindings?.entry(name);
     const id = entry?.id ?? name;
     const resourceKey = entry?.resourceKey ?? entry?.default ?? name;
@@ -1324,10 +1337,11 @@ function toCamel(s) {
     return s.replace(/_([a-z0-9])/gi, (_m, c) => String(c).toUpperCase());
 }
 // ─── Conditions & rules ───────────────────────────────────────────────────────
-function emitRules(rules, seed, ownerId, ids, resolver) {
-    return rules.map((group, gi) => group.map((r, ri) => emitRule(r, `${seed}:${gi}:${ri}`, ownerId, ids, resolver)));
+/** `site` names the condition as Case `check` does (`stage "S" entry`), for refusals. */
+function emitRules(rules, seed, ownerId, ids, resolver, site) {
+    return rules.map((group, gi) => group.map((r, ri) => emitRule(r, `${seed}:${gi}:${ri}`, ownerId, ids, resolver, site)));
 }
-function emitRule(r, seed, ownerId, ids, resolver) {
+function emitRule(r, seed, ownerId, ids, resolver, site) {
     const ruleId = ids.ruleId(seed);
     const out = { rule: r.rule, id: ruleId };
     if (r.rule === 'selected-stage-completed' || r.rule === 'selected-stage-exited') {
@@ -1347,7 +1361,7 @@ function emitRule(r, seed, ownerId, ids, resolver) {
     }
     if (r.rule === 'wait-for-connector') {
         // A rule always carries the subscription under `uipath` (placeholder-safe).
-        out[CASE_FORMAT_PROFILE.waitConnectorRuleBagField] = waitConnectorBag(r.connector, { alwaysContext: true }, resolver, `${ownerId}-${ruleId}`);
+        out[CASE_FORMAT_PROFILE.waitConnectorRuleBagField] = waitConnectorBag(r.connector, { alwaysContext: true }, resolver, `${ownerId}-${ruleId}`, `wait-for-connector rule in ${site}`);
     }
     if (r.rule === 'sla-status-change') {
         // Resolve the SLA (and, for at-risk, the escalation) by displayName → the
@@ -1371,7 +1385,7 @@ function emitEntry(c, seed, ownerId, label, ids, resolver) {
     const out = {
         id: ids.conditionId(seed),
         displayName: resolver.conditionName(c.displayName, `${label} entry`),
-        rules: emitRules(c.rules, seed, ownerId, ids, resolver),
+        rules: emitRules(c.rules, seed, ownerId, ids, resolver, `stage "${label}" entry`),
     };
     if (c.isInterrupting !== undefined)
         out.isInterrupting = c.isInterrupting;
@@ -1381,7 +1395,7 @@ function emitExit(c, seed, ownerId, label, ids, resolver) {
     const out = {
         id: ids.conditionId(seed),
         displayName: resolver.conditionName(c.displayName, `${label} ${c.marksStageComplete ? 'complete' : 'exit'}`),
-        rules: emitRules(c.rules, seed, ownerId, ids, resolver),
+        rules: emitRules(c.rules, seed, ownerId, ids, resolver, `stage "${label}" exit`),
     };
     if (c.marksStageComplete !== undefined)
         out.marksStageComplete = c.marksStageComplete;
@@ -1399,7 +1413,7 @@ function emitTaskEntry(c, seed, ownerId, label, ids, resolver) {
     return {
         id: ids.conditionId(seed),
         displayName: resolver.conditionName(c.displayName, `${label} entry`),
-        rules: emitRules(c.rules, seed, ownerId, ids, resolver),
+        rules: emitRules(c.rules, seed, ownerId, ids, resolver, `task "${label}" entry`),
     };
 }
 function emitCaseExit(c, i, ids, resolver) {
@@ -1407,7 +1421,7 @@ function emitCaseExit(c, i, ids, resolver) {
     const out = {
         id: ids.conditionId(seed),
         displayName: resolver.conditionName(c.displayName, 'Case complete'),
-        rules: emitRules(c.rules, seed, 'root', ids, resolver),
+        rules: emitRules(c.rules, seed, 'root', ids, resolver, 'case exit'),
     };
     if (c.marksCaseComplete !== undefined)
         out.marksCaseComplete = c.marksCaseComplete;

package/dist/case/subscription.d.ts

@@ -10,6 +10,7 @@
  */
 import type { EventSubscription } from '../core/actions.js';
 import type { Library, ResolvedConnector } from '../core/library.js';
+import type { BindingsView } from '../core/binding-messages.js';
 /** Check's code for {@link GenericEventNoObjectError}; Flow and BPMN `check` use the same one. */
 export declare const EVENT_GENERIC_NO_OBJECT = "EVENT_GENERIC_NO_OBJECT";
 /** A GENERIC event subscription that names no object. */
@@ -24,7 +25,13 @@ export declare class GenericEventNoObjectError extends Error {
  * @param library - The connector library.
  * @param kind - `trigger` for an event trigger, `event` for a wait-for-connector task or rule.
  * @param sub - The authored subscription.
+ * @param byoa - Where the subscription is and the bindings, to refuse an
+ *   unverified BYOA connection; compile passes it, `check` does not (it reports
+ *   that rule from the shared event rules).
  * @returns The resolved event.
- * @throws What `resolveEvent` throws, or {@link GenericEventNoObjectError}.
+ * @throws What `resolveEvent` throws, {@link GenericEventNoObjectError}, or a `ByoaRefusal`.
  */
-export declare function resolveCaseSubscription(library: Library, kind: 'trigger' | 'event', sub: EventSubscription): ResolvedConnector;
+export declare function resolveCaseSubscription(library: Library, kind: 'trigger' | 'event', sub: EventSubscription, byoa?: {
+    where: string;
+    bindings?: BindingsView;
+}): ResolvedConnector;

package/dist/case/subscription.js

@@ -1,4 +1,5 @@
 import { genericEventObjectRefusal } from '../core/event-checks.js';
+import { ByoaRefusal, byoaUnverified } from '../core/byoa.js';
 /** Check's code for {@link GenericEventNoObjectError}; Flow and BPMN `check` use the same one. */
 export const EVENT_GENERIC_NO_OBJECT = 'EVENT_GENERIC_NO_OBJECT';
 /** A GENERIC event subscription that names no object. */
@@ -17,13 +18,25 @@ function caseObjectOption(object) {
  * @param library - The connector library.
  * @param kind - `trigger` for an event trigger, `event` for a wait-for-connector task or rule.
  * @param sub - The authored subscription.
+ * @param byoa - Where the subscription is and the bindings, to refuse an
+ *   unverified BYOA connection; compile passes it, `check` does not (it reports
+ *   that rule from the shared event rules).
  * @returns The resolved event.
- * @throws What `resolveEvent` throws, or {@link GenericEventNoObjectError}.
+ * @throws What `resolveEvent` throws, {@link GenericEventNoObjectError}, or a `ByoaRefusal`.
  */
-export function resolveCaseSubscription(library, kind, sub) {
+export function resolveCaseSubscription(library, kind, sub, byoa) {
     const rc = library.resolveEvent(kind, sub.connector, sub.event, sub.version, sub.object);
     const noObject = genericEventObjectRefusal(rc, sub, caseObjectOption);
     if (noObject)
         throw new GenericEventNoObjectError(noObject);
+    // A BYOA-only event on a connection `prepare` never checked deploys and never
+    // fires (#848). Flow's `refuseUnverifiedByoa` rule and text (`byoaUnverified`);
+    // Case `check` reports it from the shared event rules (`eventFacts` / `byoa`).
+    if (byoa && typeof library.eventFacts === 'function') {
+        const object = typeof sub.object === 'string' && sub.object !== '' ? sub.object : undefined;
+        const message = byoaUnverified(byoa.where, { connector: sub.connector, event: sub.event, ...(object ? { object } : {}), connection: sub.connection }, library.eventFacts(sub.connector, sub.event, object), library.byoaVerifications, byoa.bindings);
+        if (message)
+            throw new ByoaRefusal(message);
+    }
     return rc;
 }

package/dist/cli/commands/case.js

@@ -26,6 +26,7 @@ export function registerCaseCommands(program) {
         // check-cli sees argv.
         .option('--library <dir>', 'connector library directory')
         .option('--connectors-local <dir>', 'connection-resolved connector overlay')
+        .option('--bindings <file>', 'bindings.json, for the connection/folder label rules')
         .addOption(retiredCompiledOption())
         .action(async (input, options) => {
         let mode;
@@ -43,6 +44,7 @@ export function registerCaseCommands(program) {
         const argv = [input];
         addValue(argv, '--library', options.library);
         addValue(argv, '--connectors-local', options.connectorsLocal);
+        addValue(argv, '--bindings', options.bindings);
         await invoke('case check', () => loadTool(import.meta.url, '../../case/check-cli.js'), argv);
     });
     family.command('decompile')

package/dist/core/binding-messages.d.ts

@@ -43,6 +43,27 @@ export declare function bindingSelfNameMessage(where: string, name: string, attr
  * with nothing real to bind is meant to take.
  */
 export declare function undeclaredBinding(bindings: BindingsView | undefined, name: string): string[] | undefined;
+/**
+ * The refusal for one connection/folder label `compile` cannot turn into a
+ * resource key, or `undefined` when the label is acceptable.
+ *
+ * - `BINDING_SELF_NAME`: bindings.json declares the label and answers with the
+ *   label itself.
+ * - `BINDING_UNDECLARED`: a POPULATED bindings.json does not declare it, and it
+ *   is not a GUID ({@link undeclaredBinding}).
+ *
+ * Silent without a bindings.json, or with an empty one: offline authoring. One
+ * function for every family's `serialize` (which throws the result) and the
+ * shared `check` rule (which reports it), so all print the same sentence.
+ *
+ * @param bindings - The project's bindings.json, if any.
+ * @param name - The authored label.
+ * @param attribute - Which half of the pair it is.
+ * @param where - The site, prefixed to the message.
+ * @param target - The connector and operation, for the `prepare` remedy.
+ * @returns The refusal, or `undefined`.
+ */
+export declare function bindingLabelRefusal(bindings: BindingsView | undefined, name: string, attribute: 'connection' | 'folder', where: string, target?: PrepareTarget): BindingRefusal | undefined;
 /**
  * The connector and operation a label belongs to, when the call site knows them:
  * a connector step's `key` + `action`, an event's `connector` + `event`. With it

package/dist/core/binding-messages.js

@@ -58,6 +58,39 @@ export function undeclaredBinding(bindings, name) {
         return undefined;
     return declared;
 }
+/**
+ * The refusal for one connection/folder label `compile` cannot turn into a
+ * resource key, or `undefined` when the label is acceptable.
+ *
+ * - `BINDING_SELF_NAME`: bindings.json declares the label and answers with the
+ *   label itself.
+ * - `BINDING_UNDECLARED`: a POPULATED bindings.json does not declare it, and it
+ *   is not a GUID ({@link undeclaredBinding}).
+ *
+ * Silent without a bindings.json, or with an empty one: offline authoring. One
+ * function for every family's `serialize` (which throws the result) and the
+ * shared `check` rule (which reports it), so all print the same sentence.
+ *
+ * @param bindings - The project's bindings.json, if any.
+ * @param name - The authored label.
+ * @param attribute - Which half of the pair it is.
+ * @param where - The site, prefixed to the message.
+ * @param target - The connector and operation, for the `prepare` remedy.
+ * @returns The refusal, or `undefined`.
+ */
+export function bindingLabelRefusal(bindings, name, attribute, where, target) {
+    if (!bindings)
+        return undefined;
+    const resolved = bindings.resolve(name);
+    if (resolved === name)
+        return new BindingRefusal('BINDING_SELF_NAME', bindingSelfNameMessage(where, name, attribute, target));
+    if (resolved === undefined) {
+        const declared = undeclaredBinding(bindings, name);
+        if (declared)
+            return new BindingRefusal('BINDING_UNDECLARED', bindingUndeclaredMessage(where, name, attribute, declared, target));
+    }
+    return undefined;
+}
 function prepareFor(target) {
     return prepareCommand(target?.key ?? '<connector-key>', target?.action ?? '<action>');
 }

package/dist/core/connector-checks.js

@@ -26,7 +26,7 @@ import { isLookupToken, resolvedValue, } from './lookups.js';
 import { Expr } from './expr.js';
 import { extractRefs } from './expr-check.js';
 import { prepareCommand, resolveFlagArg } from './cli-spelling.js';
-import { bindingMissingMessage, bindingSelfNameMessage, bindingUndeclaredMessage, connectionConnectorConflictMessage, missingBindingLabels, undeclaredBinding, } from './binding-messages.js';
+import { bindingLabelRefusal, bindingMissingMessage, connectionConnectorConflictMessage, missingBindingLabels, } from './binding-messages.js';
 /**
  * Flow: an input is an {@link Expr} object. A non-literal one is runtime; a
  * literal one (`lit(…)`) carries the constant it was built from.
@@ -370,16 +370,9 @@ use) {
         const name = labels[attribute];
         if (typeof name !== 'string')
             continue;
-        const resolved = bindings.resolve(name);
-        if (resolved === name) {
-            report('BINDING_SELF_NAME', bindingSelfNameMessage(where, name, attribute, target));
-        }
-        else if (resolved === undefined) {
-            const declared = undeclaredBinding(bindings, name);
-            if (declared) {
-                report('BINDING_UNDECLARED', bindingUndeclaredMessage(where, name, attribute, declared, target));
-            }
-        }
+        const refused = bindingLabelRefusal(bindings, name, attribute, where, target);
+        if (refused)
+            report(refused.code, refused.message);
     }
 }
 /**

package/dist/serialize.js

@@ -18,7 +18,7 @@ import { planContributionBindings } from './core/contribution-bindings.js';
 import { definitionHasErrorPort, errorPortRefusal } from './core/error-port.js';
 import { isAnswerField } from './core/hitl-answers.js';
 import { connectionConnectors } from './bindings-v2.js';
-import { BindingRefusal, GUID_RE, bindingMissingMessage, bindingSelfNameMessage, bindingUndeclaredMessage, missingBindingLabels, undeclaredBinding } from './core/binding-messages.js';
+import { BindingRefusal, GUID_RE, bindingLabelRefusal, bindingMissingMessage, missingBindingLabels } from './core/binding-messages.js';
 import { ByoaRefusal, byoaUnverified } from './core/byoa.js';
 import { genericEventObjectRefusal } from './core/event-checks.js';
 import { OUTCOME_HANDLE_NODE_TYPES, assertHitlExitInvariant, hitlExitModel, hitlExitViolation, outcomeSlug } from './core/hitl-routing.js';
@@ -3886,16 +3886,10 @@ function requireBindingPair(where, labels, target) {
 function resolveBinding(opts, name, attribute, where, target) {
     if (name === undefined)
         return undefined;
+    const refused = bindingLabelRefusal(opts.bindings, name, attribute, where, target);
+    if (refused)
+        throw refused;
     const resolved = opts.bindings?.resolve(name);
-    if (resolved === name) {
-        throw new BindingRefusal('BINDING_SELF_NAME', bindingSelfNameMessage(where, name, attribute, target));
-    }
-    if (resolved === undefined) {
-        const declared = undeclaredBinding(opts.bindings, name);
-        if (declared) {
-            throw new BindingRefusal('BINDING_UNDECLARED', bindingUndeclaredMessage(where, name, attribute, declared, target));
-        }
-    }
     const value = resolved ?? name;
     const reason = connectionStubReason(value);
     if (reason !== undefined && opts.warn) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uipath/maestro-builder-sdk",
-  "version": "6.18.5",
+  "version": "6.18.7",
   "description": "Build UiPath Flow, Case, and BPMN artifacts by writing TypeScript.",
   "license": "MIT",
   "homepage": "https://docs.uipath.com/maestro",
@@ -92,5 +92,5 @@
     "@types/node": "^22.7.0",
     "esbuild": "^0.28.1"
   },
-  "gitref": "714298df601bba1d5d278525ba354d670cec21aa"
+  "gitref": "7dffe3f9de6568ee2673c38faa5046eb7c86eb54"
 }