@uipath/maestro-builder-sdk 6.36.0 → 6.37.0

package/dist/bpmn/bpmn-sdk.d.ts

@@ -2454,6 +2454,17 @@ declare abstract class ScopeBuilder {
      * is left alone.
      */
     private bindRequiredContext;
+    /**
+     * A binding field's resource key from its `resourceKeyPattern`, with the declared
+     * bindings the key was read through — or `undefined` when the pattern does not
+     * resolve from this context (see `resolveResourceKeyPattern`), in which case the
+     * caller keys the binding by the value, as it always has.
+     *
+     * @throws when the pattern resolves except for a `=bindings.<b>` reference that no
+     * `.binding()` before this node declares with a value: that key would otherwise be
+     * built, so the author is told what to declare rather than given a wrong pair.
+     */
+    private resourceKeyFromPattern;
     /** @internal Shared body of the Orchestrator process-invocation methods. */
     private orchestratorNode;
     /**
@@ -2530,12 +2541,23 @@ declare abstract class ScopeBuilder {
      *
      * @remarks
      * **Not a DMN decision table**, despite the element and the label. The registry spec
-     * is an Orchestrator process invocation — `releaseKey`/`folderId`/`folderPath`/`name`
-     * plus `JobArguments`, `BindingPattern: businessRule` over `Resource: process` —
-     * structurally identical to {@link ScopeBuilder.startProcess}. `process` names a
-     * package whose Orchestrator process type is `BusinessRules`; whatever decision logic
-     * exists lives INSIDE that package, not in the `.bpmn`. So this is the job-start
-     * family's sixth member, not a rules subsystem, and it shares every option with it.
+     * is an Orchestrator process invocation — `name`/`folderPath` plus `JobArguments` —
+     * structurally a {@link ScopeBuilder.startProcess}. `process` names a package whose
+     * Orchestrator process type is `BusinessRules`; whatever decision logic exists lives
+     * INSIDE that package, not in the `.bpmn`. So this is the job-start family's sixth
+     * member, not a rules subsystem.
+     *
+     * Where it departs from the family, the registry says so and this follows it:
+     *
+     *  - the task is `version="v3"` — below v3 the engine cannot run the `.uirule`
+     *    package a BusinessRules project deploys — so a rule is always addressed by
+     *    name, and `releaseKey` / `folderKey` are refused;
+     *  - `name` and `folderPath` are each bound to a `BusinessRule` resource
+     *    (`propertyAttribute` `name` / `folderPath`), both keyed `<folder>.<name>`
+     *    (`<name>` alone when the folder is empty), declared on your behalf as
+     *    `<id>_name` / `<id>_folderPath`; an unbound `_label` carries the rule's name;
+     *  - two output rows: `output` (`=result`, in `outputVar`) and `Error` (`=Error`,
+     *    in `<id>_Error`), both `jsonSchema`.
      *
      * Distinct from the Case SDK's `rule()`, which declares DNF lifecycle conditions
      * (`case-entered`, `required-tasks-completed`, …) deciding when a stage enters or
@@ -2555,7 +2577,7 @@ declare abstract class ScopeBuilder {
      *     process: 'DiscountTier',
      *     folder: 'Finance',
      *     input: { amount: 4200 },
-     *     outputs: { tier: '=response.tier' },
+     *     outputs: { tier: '=result.DiscountTier.tier' },
      *   })
      *   .endEvent('done')
      *   .sequenceFlow('start', 'tier')
@@ -2564,9 +2586,16 @@ declare abstract class ScopeBuilder {
      * ```
      *
      * @param id - The element id, unique in the process and used by `sequenceFlow`.
+     *
+     * **The result is keyed by decision name.** The platform's `output` row is the whole
+     * result (`source="=result"`) and a decision's column reads as
+     * `=result.<Decision>.<column>` — `vars.<id>_businessRuleResponse.<Decision>.<column>`
+     * downstream — never `=result.<column>` (canvas spec `outputNotes`; `uip rules describe
+     * <name>` lists the decisions and columns, and only a decision-keyed rule, one whose
+     * `OutputArguments` carry `x-uipath-decision-keyed`, fits this row).
      * @param opts - Which rule package, folder, and input arguments. `outputVar` defaults
-     * to `<id>_businessRuleResponse` — see the note in the implementation for why this one
-     * type does not take its default from the spec.
+     * to `<id>_businessRuleResponse`. `releaseKey` and `folderKey` are refused: a v3 rule
+     * is addressed by name.
      * @param body - Boundary events attached to this activity, declared on the {@link ActivityBuilder} it receives.
      * @returns This builder, so calls chain.
      */

package/dist/bpmn/bpmn-sdk.js

@@ -3,6 +3,7 @@ import { checkBpmnExpressions, BpmnBuildError } from './bpmn-expr-check.js';
 import { BPMN_SCHEMA_VERSIONS } from './format-profile.js';
 import { schemaVersionRefusal } from '../schema-version.js';
 import { bindingRequiredFields, REGISTRY_GAPS, registryType } from './typed-node.js';
+import { resolveResourceKeyPattern } from './resource-key-pattern.js';
 import { DATA_SERVICE_ACTIVITY_TYPE, DATA_SERVICE_CONNECTOR_KEY, dataServiceWire } from './data-service.js';
 import { ownEntry } from '../core/own-entry.js';
 export { BpmnBuildError } from './bpmn-expr-check.js';
@@ -1213,22 +1214,75 @@ class ScopeBuilder {
             if (typeof value !== 'string' || value.startsWith('='))
                 continue;
             const bindingId = `${id}_${field.name}`;
+            // The key a pattern builds from the context values — a `=bindings.<b>` value as
+            // the DECLARED value of `b`, since a key is never evaluated as an expression.
+            // Resolved only for the fields the pattern names, and refused only when the
+            // pattern would otherwise resolve: a pattern that names nothing the context has
+            // (`${metadata.key}`, the live registry's pattern on a job start, whose context
+            // has no `key`) leaves the key to the value, as before. This snapshot carries no
+            // pattern for the job starts at all; `resource-key-pattern.ts` is tested on both.
+            const keyed = this.resourceKeyFromPattern(id, type, field, context);
             this._bindingRegistry.declare({
                 id: bindingId,
                 name: field.displayName ?? field.name,
                 resource: field.bindingInfo?.resource ?? 'process',
                 propertyAttribute: field.bindingInfo?.propertyAttribute ?? field.name,
-                // A fact the registry omits and the validator enforces — see REGISTRY_GAPS.
                 resourceSubType: ownEntry(REGISTRY_GAPS, type)?.resourceSubType,
                 default: value,
-                resourceKey: value,
+                resourceKey: keyed?.key ?? value,
             });
+            // A declared binding the key was read from shares it when the author left its own
+            // key unset, so the pair names one resource — only when the pattern resolved. One
+            // that already carries a DIFFERENT key (a folder binding two rules share, or an
+            // author's own key) would make this node's pair name two resources: refused, with
+            // the binding to declare instead.
+            if (keyed) {
+                for (const decl of keyed.referenced) {
+                    if (decl.resourceKey === undefined)
+                        decl.resourceKey = keyed.key;
+                    else if (decl.resourceKey !== keyed.key) {
+                        const resource = field.bindingInfo?.resource ?? 'process';
+                        throw new Error(`${type} "${id}": its ${resource} key "${keyed.key}" is read through =bindings.${decl.id}, whose resource key is already ` +
+                            `"${decl.resourceKey}" (another node's pair, or the binding's own), so the pair would name two resources. ` +
+                            `A ${resource} binding names one: declare one per node, e.g. ` +
+                            `\`.binding('${decl.id}_${id}', { resource: '${decl.resource}', propertyAttribute: '${decl.propertyAttribute}', value: '${decl.default}' })\`.`);
+                    }
+                }
+            }
             out[field.name] = `=bindings.${bindingId}`;
         }
         return out;
     }
+    /**
+     * A binding field's resource key from its `resourceKeyPattern`, with the declared
+     * bindings the key was read through — or `undefined` when the pattern does not
+     * resolve from this context (see `resolveResourceKeyPattern`), in which case the
+     * caller keys the binding by the value, as it always has.
+     *
+     * @throws when the pattern resolves except for a `=bindings.<b>` reference that no
+     * `.binding()` before this node declares with a value: that key would otherwise be
+     * built, so the author is told what to declare rather than given a wrong pair.
+     */
+    resourceKeyFromPattern(id, type, field, context) {
+        const pattern = field.bindingInfo?.resourceKeyPattern;
+        const byId = (bindingId) => this._bindingRegistry.bindings.find((b) => b.id === bindingId);
+        const resolved = resolveResourceKeyPattern(pattern, context, byId);
+        if (resolved === undefined)
+            return undefined;
+        if ('blocked' in resolved) {
+            const { field: blockedField, ref } = resolved.blocked;
+            const refId = ref.slice('=bindings.'.length);
+            const resource = field.bindingInfo?.resource ?? 'process';
+            throw new Error(`${type} "${id}": ${blockedField} reads ${ref}, which no .binding() declares with a value before this node, ` +
+                `so the ${resource} key \`${pattern}\` it is paired under cannot be built. Declare ` +
+                `\`.binding('${refId}', { resource: '${resource}', propertyAttribute: '${blockedField}', value: '…' })\` first, or pass the value itself.`);
+        }
+        return { key: resolved.key, referenced: resolved.referenced.map((bid) => byId(bid)).filter((d) => d !== undefined) };
+    }
     /** @internal Shared body of the Orchestrator process-invocation methods. */
-    orchestratorNode(id, type, opts, body) {
+    orchestratorNode(id, type, opts, body, 
+    /** A member's own departures from the family: the business rule's v3 stamp and `_label`. */
+    own = {}) {
         // The `uipath:type` version selects the engine's addressing branch — see
         // OrchestratorOpts.process. By name → v2 (`name` + `folderPath`); by key → v1
         // (`releaseKey` + `folderKey`). A literal release key becomes a `process`/`Key`
@@ -1254,12 +1308,13 @@ class ScopeBuilder {
             id,
             name: opts.name,
             type,
-            typeVersion: byKey ? 'v1' : 'v2',
+            typeVersion: own.typeVersion ?? (byKey ? 'v1' : 'v2'),
             context: this.bindRequiredContext(id, type, {
                 name: opts.process,
                 ...(opts.folder !== undefined ? { folderPath: opts.folder } : {}),
                 ...(releaseKey !== undefined ? { releaseKey } : {}),
                 ...(byKey && opts.folderKey !== undefined ? { folderKey: opts.folderKey } : {}),
+                ...(own.context ?? {}),
             }),
             inputs: opts.input ?? {},
             outputs: opts.outputs,
@@ -1355,12 +1410,23 @@ class ScopeBuilder {
      *
      * @remarks
      * **Not a DMN decision table**, despite the element and the label. The registry spec
-     * is an Orchestrator process invocation — `releaseKey`/`folderId`/`folderPath`/`name`
-     * plus `JobArguments`, `BindingPattern: businessRule` over `Resource: process` —
-     * structurally identical to {@link ScopeBuilder.startProcess}. `process` names a
-     * package whose Orchestrator process type is `BusinessRules`; whatever decision logic
-     * exists lives INSIDE that package, not in the `.bpmn`. So this is the job-start
-     * family's sixth member, not a rules subsystem, and it shares every option with it.
+     * is an Orchestrator process invocation — `name`/`folderPath` plus `JobArguments` —
+     * structurally a {@link ScopeBuilder.startProcess}. `process` names a package whose
+     * Orchestrator process type is `BusinessRules`; whatever decision logic exists lives
+     * INSIDE that package, not in the `.bpmn`. So this is the job-start family's sixth
+     * member, not a rules subsystem.
+     *
+     * Where it departs from the family, the registry says so and this follows it:
+     *
+     *  - the task is `version="v3"` — below v3 the engine cannot run the `.uirule`
+     *    package a BusinessRules project deploys — so a rule is always addressed by
+     *    name, and `releaseKey` / `folderKey` are refused;
+     *  - `name` and `folderPath` are each bound to a `BusinessRule` resource
+     *    (`propertyAttribute` `name` / `folderPath`), both keyed `<folder>.<name>`
+     *    (`<name>` alone when the folder is empty), declared on your behalf as
+     *    `<id>_name` / `<id>_folderPath`; an unbound `_label` carries the rule's name;
+     *  - two output rows: `output` (`=result`, in `outputVar`) and `Error` (`=Error`,
+     *    in `<id>_Error`), both `jsonSchema`.
      *
      * Distinct from the Case SDK's `rule()`, which declares DNF lifecycle conditions
      * (`case-entered`, `required-tasks-completed`, …) deciding when a stage enters or
@@ -1380,7 +1446,7 @@ class ScopeBuilder {
      *     process: 'DiscountTier',
      *     folder: 'Finance',
      *     input: { amount: 4200 },
-     *     outputs: { tier: '=response.tier' },
+     *     outputs: { tier: '=result.DiscountTier.tier' },
      *   })
      *   .endEvent('done')
      *   .sequenceFlow('start', 'tier')
@@ -1389,28 +1455,38 @@ class ScopeBuilder {
      * ```
      *
      * @param id - The element id, unique in the process and used by `sequenceFlow`.
+     *
+     * **The result is keyed by decision name.** The platform's `output` row is the whole
+     * result (`source="=result"`) and a decision's column reads as
+     * `=result.<Decision>.<column>` — `vars.<id>_businessRuleResponse.<Decision>.<column>`
+     * downstream — never `=result.<column>` (canvas spec `outputNotes`; `uip rules describe
+     * <name>` lists the decisions and columns, and only a decision-keyed rule, one whose
+     * `OutputArguments` carry `x-uipath-decision-keyed`, fits this row).
      * @param opts - Which rule package, folder, and input arguments. `outputVar` defaults
-     * to `<id>_businessRuleResponse` — see the note in the implementation for why this one
-     * type does not take its default from the spec.
+     * to `<id>_businessRuleResponse`. `releaseKey` and `folderKey` are refused: a v3 rule
+     * is addressed by name.
      * @param body - Boundary events attached to this activity, declared on the {@link ActivityBuilder} it receives.
      * @returns This builder, so calls chain.
      */
     businessRule(id, opts, body) {
-        // The ONE place this type departs from its family, and deliberately.
-        //
-        // Every other member takes its default output variable from the registry's
-        // `OutputName` (`Process response` → `<id>_processResponse`). This type's
-        // `OutputName` is literally its designer LABEL, `Execute business rule [Preview]`,
-        // so the derived default would be `<id>_executeBusinessRulePreview`: unreadable,
-        // and — worse — it encodes the preview marker in a name authors write expressions
-        // against. When `[Preview]` drops the label becomes `Execute business rule`, the
-        // derived default silently becomes `<id>_executeBusinessRule`, and every
-        // `vars.<id>_executeBusinessRulePreview` reference in every authored process starts
-        // resolving to undefined — a silent wrong-answer change from a cosmetic spec edit.
-        //
-        // Pinning it here makes the default independent of the label. The output ROW still
-        // carries the registry's own `name`, so the artifact is unchanged.
-        return this.orchestratorNode(id, 'Orchestrator.BusinessRules', { ...opts, outputVar: opts.outputVar ?? `${id}_businessRuleResponse` }, body);
+        if (opts.releaseKey !== undefined || opts.folderKey !== undefined) {
+            throw new Error(`businessRule('${id}'): a business rule is addressed by name and folder (version v3 binds the ` +
+                'BusinessRule resource by `name` + `folderPath`); drop `releaseKey` / `folderKey`.');
+        }
+        // The default output variable is pinned rather than derived. Derived, it would come
+        // from the registry's `OutputName`, which was once the designer LABEL, `Execute
+        // business rule [Preview]` — a `[Preview]` marker in a name authors write expressions
+        // against, and one that changed when the marker dropped. Pinning keeps every
+        // `vars.<id>_businessRuleResponse` reference valid across that kind of spec edit.
+        return this.orchestratorNode(id, 'Orchestrator.BusinessRules', 
+        // `folderPath` is a REQUIRED binding of the type: a rule in the running job's own
+        // folder is bound with an empty path, so the pair is keyed by the name alone
+        // (`uip maestro bpmn validate` accepts it); leaving the field out instead drew
+        // BINDING_REQUIRED and EMPTY_REQUIRED_FIELD from `check`.
+        { ...opts, folder: opts.folder ?? '', outputVar: opts.outputVar ?? `${id}_businessRuleResponse` }, body, 
+        // `_label` is the one unbound context field: the rule's name, which the canvas
+        // shows while `name` itself is a binding reference.
+        { typeVersion: 'v3', context: { _label: opts.process } });
     }
     /**
      * Add an item to an Orchestrator **queue** (`Orchestrator.CreateQueueItem`, or

package/dist/bpmn/check.js

@@ -69,6 +69,7 @@ export function check(built, opts = {}) {
     checkFolderBindings(built, diags);
     checkEntryPointId(built, diags);
     checkMethodParentheses(built, diags);
+    checkConnectorRows(built, diags);
     checkConnectors(built, opts, diags);
     checkConnectorEvents(built, opts, diags);
     return diags;
@@ -219,6 +220,69 @@ function checkMethodParentheses(built, diags) {
     };
     walk(built.nodes, built.flows);
 }
+/** The Integration Service activity types, whose payload rows the platform reads only by `target`. */
+const CONNECTOR_ACTIVITY_TYPES = new Set(['Intsvc.ActivityExecution', 'Intsvc.AsyncExecution']);
+/**
+ * The targets the platform's reader knows (`UiPathExtensionsProvider`): anything else —
+ * an empty string included — falls through its switch to `Body`, and the row becomes the
+ * whole request body. `pathParameters` / `queryParameters` are the aggregate forms.
+ */
+const PLATFORM_ROW_TARGETS = new Set(['body', 'bodyField', 'header', 'path', 'query', 'file', 'pathParameters', 'queryParameters']);
+/**
+ * A connector activity's payload rows, as the platform reads them.
+ *
+ * Integration Service reads a connector's payload rows by target only, and its reader
+ * maps a missing, empty or unknown target to `Body` — so such a row does not vanish,
+ * it REPLACES the request body. The 2026-10-16 eval run's agent wrote
+ * `inputRows: [{ name: 'script', type: 'string', value }]` for a JDBC query: it
+ * validated, and faulted live with `Value for required parameter 'script' not found`,
+ * while the v1 arm's `<uipath:input name="body" target="body">{"script":"…"}</uipath:input>`
+ * ran. `inputs: { script }` folds a request field into the body row, so the remedy is
+ * the plain record for a body field, or the row's own target when it is a real slot.
+ * And because an `inputRows` list REPLACES `inputs` at emission (typed-node.ts), a
+ * node that sets both silently drops every `inputs` field — the same live fault.
+ */
+function checkConnectorRows(built, diags) {
+    for (const n of allNodes(built.nodes)) {
+        if (n.kind !== 'typed' || !CONNECTOR_ACTIVITY_TYPES.has(n.type))
+            continue;
+        if (n.inputRows && Object.keys(n.inputs ?? {}).length > 0) {
+            diags.push({
+                level: 'error',
+                code: 'CONNECTOR_INPUTS_SHADOWED',
+                where: n.id,
+                message: `Connector activity "${n.id}" sets both \`inputs\` (${Object.keys(n.inputs).map((k) => `"${k}"`).join(', ')}) and \`inputRows\`; ` +
+                    `an \`inputRows\` list replaces \`inputs\` entirely at emission, so those fields are never sent. Spell them as rows too ` +
+                    `(a body field as \`{ name: 'body', type: 'json', target: 'body', body: { … } }\`), or drop \`inputRows\` and write every field in \`inputs\`.`,
+            });
+        }
+        for (const row of n.inputRows ?? []) {
+            const target = row.target ?? '';
+            if (target === '') {
+                diags.push({
+                    level: 'error',
+                    code: 'CONNECTOR_INPUT_ROW_NO_TARGET',
+                    where: n.id,
+                    message: `Connector activity "${n.id}" input row "${row.name}" has no target. Integration Service reads a connector's ` +
+                        `payload rows by target, and its reader maps a missing or empty one to the request body — so this row validates and ` +
+                        `then becomes the WHOLE body, replacing the body row. Give the row its target — \`target: 'body'\` folds it into ` +
+                        `the request body, \`path\`/\`query\`/\`file\` are the other slots — or move EVERY row to \`inputs: { ${row.name}: … }\` ` +
+                        `and drop \`inputRows\`: an \`inputRows\` list, when present, replaces \`inputs\` entirely.`,
+                });
+            }
+            else if (!PLATFORM_ROW_TARGETS.has(target)) {
+                diags.push({
+                    level: 'error',
+                    code: 'CONNECTOR_INPUT_ROW_TARGET_UNKNOWN',
+                    where: n.id,
+                    message: `Connector activity "${n.id}" input row "${row.name}" has target "${target}", which the platform's reader does not know; ` +
+                        `it falls through to the request body, so this row would replace the body. Use one of ` +
+                        `${[...PLATFORM_ROW_TARGETS].map((t) => `'${t}'`).join(', ')}.`,
+                });
+            }
+        }
+    }
+}
 const GUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 /**
  * `.metadata({ entryPointId })` must be a GUID.

package/dist/bpmn/connector.js

@@ -26,6 +26,9 @@ export function createConnectorTask(ctx, n) {
         // authored for rather than an inferred one.
         ctxInput(m, 'operation', 'string', op.name ?? op.objectName ?? n.action),
         ctxInput(m, 'connectorKey', 'string', rc.connectorKey),
+        // The registry template's own value, and the one the CLI's V1 packaging path keys
+        // on; V2 (`Data.V2`) is tracked in https://github.com/UiPath/builder-sdk/issues/1298, blocked on UiPath/cli#5209.
+        ctxInput(m, 'activityConfigurationVersion', 'string', 'v1'),
     ];
     const connRef = bindingRef(ctx, n.connection, 'Connection', 'ConnectionId', `${rc.connectorKey} connection`);
     if (connRef) {

package/dist/bpmn/declared-vars.js

@@ -1,4 +1,4 @@
-import { typedNodeOutputVar } from './typed-node.js';
+import { typedNodeAdditionalOutputVars, typedNodeOutputVar } from './typed-node.js';
 /**
  * The variables a connector task's output rows land in.
  *
@@ -38,7 +38,7 @@ export function typedNodeDeclaredVars(n) {
     if (n.outputRows)
         return n.outputRows.map((r) => r.var).filter((v) => v !== undefined);
     const v = typedNodeOutputVar(n.id, n.type, n.outputVar, n.spec);
-    return [...(v ? [v] : []), ...Object.keys(n.outputs ?? {})];
+    return [...(v ? [v] : []), ...typedNodeAdditionalOutputVars(n.id, n.type, n.spec), ...Object.keys(n.outputs ?? {})];
 }
 /**
  * Every variable name a node DECLARES by writing to it — the platform counts a
@@ -58,8 +58,15 @@ export function nodeDeclaredVars(n) {
     }
     if (n.kind === 'typed')
         return typedNodeDeclaredVars(n);
-    if (n.kind === 'scriptTask')
+    // Spelled-out rows REPLACE the derived ones, so they are the whole answer — the
+    // same rule as `typedNodeDeclaredVars`. Reading only `outputs` here left a script
+    // task authored with `outputRows` (the form decompile writes) declaring nothing,
+    // so every `vars.<row.var>` downstream was EXPR_UNDECLARED_REF.
+    if (n.kind === 'scriptTask') {
+        if (n.outputRows)
+            return n.outputRows.map((r) => r.var).filter((v) => v !== undefined);
         return Object.keys(n.outputs);
+    }
     if (n.kind === 'task')
         return Object.keys(n.set);
     return [];

package/dist/bpmn/decompile.js

@@ -419,18 +419,32 @@ function outputsOf(payload, _id, type) {
     const rows = payload?.output ?? [];
     const extras = {};
     let outputVar;
-    const specName = type ? registryType(type).output?.name : undefined;
+    const spec = type ? registryType(type) : undefined;
+    const specName = spec?.output?.name;
+    // A row the registry declares beside the main one (a business rule's `Error`) is
+    // re-emitted by the builder, so lifting it as an extra would write it twice on the
+    // way back. Matched by NAME (and source): an export that binds it to a variable
+    // other than the derived `<id>_<name>` is spelled out verbatim instead
+    // (`outputRowsNeedSpellingOut`), which carries that variable through exactly.
+    const declaredBeside = new Map((spec?.additionalOutputs ?? []).map((o) => [o.name, o.source ?? undefined]));
     for (const row of rows) {
         if (specName !== undefined && row.name === specName) {
             // Only worth emitting when it differs from the default the builder derives.
             outputVar = row.var;
             continue;
         }
+        if (declaredBeside.has(row.name) && (declaredBeside.get(row.name) === undefined || declaredBeside.get(row.name) === row.source))
+            continue;
         if (row.source !== undefined)
             extras[row.var ?? row.name] = row.source;
     }
     return { outputVar, extras };
 }
+/** The variable the builder derives for each row the registry declares beside the main one. */
+function derivedExtraVars(id, type) {
+    const spec = type ? registryType(type) : undefined;
+    return new Map((spec?.additionalOutputs ?? []).map((o) => [o.name, `${id}_${o.name}`]));
+}
 /**
  * Whether these rows can be reproduced by the compact `outputVar` + `outputs` pair,
  * or need spelling out.
@@ -445,10 +459,16 @@ function outputsOf(payload, _id, type) {
  * form stays in use wherever it is exact, so the 30 other extension types decompile
  * to exactly the source they did before, and only a row that genuinely needs the
  * long form gets it.
+ *
+ * A row the registry declares beside the main one (`derivedBeside`: a business rule's
+ * `Error`) that an export binds to a variable other than the derived `<id>_<name>`
+ * needs it too: the compact form cannot rename that row, and lifting it as an extra
+ * would have the builder add its own beside it.
  */
-function outputRowsNeedSpellingOut(payload) {
+function outputRowsNeedSpellingOut(payload, derivedBeside = new Map()) {
     const rows = payload?.output ?? [];
-    return rows.some((row) => row.body !== undefined ||
+    return rows.some((row) => (derivedBeside.has(row.name) && row.var !== undefined && row.var !== derivedBeside.get(row.name)) ||
+        row.body !== undefined ||
         row.custom !== undefined ||
         row.description !== undefined ||
         row.target !== undefined ||
@@ -522,7 +542,7 @@ function emitTypedNode(chain, el, payload, type) {
     const verbatimContext = contextRowsNeedSpellingOut(payload, type) ? emitContextRows(payload) : undefined;
     const { outputVar, extras } = outputsOf(payload, id, type);
     const defaultVar = spec.output ? `${id}_${identifierize(spec.output.name)}` : undefined;
-    const verbatimRows = outputRowsNeedSpellingOut(payload) ? emitOutputRows(payload) : undefined;
+    const verbatimRows = outputRowsNeedSpellingOut(payload, derivedExtraVars(id, type)) ? emitOutputRows(payload) : undefined;
     chain.add(`.activity(${tsText(id)}, ${tsText(type)}${optionalArg(opts([
         ['name', el.name !== undefined ? tsText(el.name) : undefined],
         // Only when it differs from the registry's own template, so an
@@ -2012,15 +2032,23 @@ rehome) {
             // a bodied declaration through: ten `error<n>` declarations owned by boundary
             // events in `claims-triage` were skipped as derived and then nobody derived them
             // — they vanished from the recompiled process.
-            if (payload && type && type !== 'BPMN.Variables' && typeDescribesElement(localName(el.$type), type)) {
+            // A script task's default payload type is `BPMN.Variables` — the same type a
+            // variable-assignment task carries, which derives nothing. The script task with
+            // spelled-out rows is admitted by its element, not its type: those rows are the
+            // declaration on the way back in (`implicitNodeVars`' script arm), so they are
+            // skipped here too, or the source redeclares every one of them in `.vars()`.
+            const spelledOutScriptRows = localName(el.$type) === 'scriptTask' && type === 'BPMN.Variables' && outputRowsNeedSpellingOut(payload);
+            if (payload && type && (spelledOutScriptRows || (type !== 'BPMN.Variables' && typeDescribesElement(localName(el.$type), type)))) {
                 for (const row of payload.output ?? []) {
                     if (!row.var)
                         continue;
-                    // A script task's rows are NOT spelled-out `outputRows` on the way back —
-                    // `implicitNodeVars` derives its declarations from `outputs` keys, so they
-                    // carry the id as the name and that arm's own wire type. Every other typed
-                    // node's rows go through `rowDeclaration`, the same call the serializer makes.
-                    candidates.set(row.var, type === 'BPMN.ScriptTask'
+                    // A script task's rows come back as `outputs` when that form reproduces
+                    // them, and `implicitNodeVars` then derives their declarations from the
+                    // keys: id as the name, that arm's own wire type. Rows that need spelling
+                    // out (`emitScriptTask` writes `outputRows` exactly when this holds) are
+                    // declared through `rowDeclaration` on the way back in, like every other
+                    // typed node's, so they are matched the same way here.
+                    candidates.set(row.var, type === 'BPMN.ScriptTask' && !outputRowsNeedSpellingOut(payload)
                         ? { owner: el.id, wire: 'string' }
                         : { owner: el.id, ...rowDeclaration({ name: row.name, type: row.type, schema: row.body }) });
                 }

package/dist/bpmn/intsvc.d.ts

@@ -35,11 +35,11 @@ type ExternalNode = Extract<BpmnNode, {
 /**
  * The extension type a Phase 3d node lowers to, WITHOUT consulting the library.
  *
- * The emitters below take a connector event's type from the library's
- * `runtime.serviceType`, which is the authority. This is the same answer derived
- * from the node alone, so the serializer can declare the node's output variable
- * before it has resolved anything — and the emitter asserts the two agree, so the
- * shortcut cannot silently diverge.
+ * The method the author called decides the placement — `.eventTrigger()` a start
+ * event, `.waitForEvent()` a receive task — so the type is known from the node alone,
+ * and the serializer can declare the node's output variable before it has resolved
+ * anything. The emitter uses this same value; the library only has to say the
+ * operation is a connector event.
  */
 export declare function intsvcServiceType(n: EventNode | ExternalNode): string;
 /**
@@ -55,11 +55,10 @@ export declare function intsvcOutputVar(n: EventNode | ExternalNode): string | u
 /**
  * A connector event node — `Intsvc.EventTrigger` or `Intsvc.WaitForEvent`.
  *
- * The extension type comes from the LIBRARY (`runtime.serviceType`), not from the
- * method the author called. That is deliberate: the descriptor is the authority on
- * which placement it describes, so a `trigger` descriptor reached through
- * `.waitForEvent()` is caught here rather than emitting a start-event type onto a
- * receive task — a mismatch both offline validators accept.
+ * The extension type comes from the method the author called; the library only has
+ * to say the operation is a connector event (`runtime.serviceType` is one of the
+ * event types). A prepared descriptor carries the START form's runtime whichever
+ * method reaches it, so the placement, not the descriptor, decides the type.
  *
  * @param ctx - Serializer context: moddle, library, bindings, binding sink.
  * @param n - The authored node.

package/dist/bpmn/intsvc.js

@@ -1,6 +1,7 @@
 import { createTypedNode, typedNodeOutputVar } from './typed-node.js';
 import { connectorBindingRef } from './connector.js';
 import { eventFilterJmes, eventFilterProblem, jmesString, jmesStringProblem, readEventFilter } from '../core/event-filters.js';
+import { resolveEventWhere } from '../core/lookups.js';
 /**
  * Which extension type an external invocation lowers to.
  *
@@ -19,11 +20,11 @@ const EVENT_SERVICE_TYPE = { trigger: 'Intsvc.EventTrigger', event: 'Intsvc.Wait
 /**
  * The extension type a Phase 3d node lowers to, WITHOUT consulting the library.
  *
- * The emitters below take a connector event's type from the library's
- * `runtime.serviceType`, which is the authority. This is the same answer derived
- * from the node alone, so the serializer can declare the node's output variable
- * before it has resolved anything — and the emitter asserts the two agree, so the
- * shortcut cannot silently diverge.
+ * The method the author called decides the placement — `.eventTrigger()` a start
+ * event, `.waitForEvent()` a receive task — so the type is known from the node alone,
+ * and the serializer can declare the node's output variable before it has resolved
+ * anything. The emitter uses this same value; the library only has to say the
+ * operation is a connector event.
  */
 export function intsvcServiceType(n) {
     return n.kind === 'connectorEvent'
@@ -45,11 +46,10 @@ export function intsvcOutputVar(n) {
 /**
  * A connector event node — `Intsvc.EventTrigger` or `Intsvc.WaitForEvent`.
  *
- * The extension type comes from the LIBRARY (`runtime.serviceType`), not from the
- * method the author called. That is deliberate: the descriptor is the authority on
- * which placement it describes, so a `trigger` descriptor reached through
- * `.waitForEvent()` is caught here rather than emitting a start-event type onto a
- * receive task — a mismatch both offline validators accept.
+ * The extension type comes from the method the author called; the library only has
+ * to say the operation is a connector event (`runtime.serviceType` is one of the
+ * event types). A prepared descriptor carries the START form's runtime whichever
+ * method reaches it, so the placement, not the descriptor, decides the type.
  *
  * @param ctx - Serializer context: moddle, library, bindings, binding sink.
  * @param n - The authored node.
@@ -67,14 +67,20 @@ export function createConnectorEvent(ctx, n) {
         throw new Error(`connector event ${n.key}/${n.eventName} has no runtime.serviceType in the library; ` +
             `it cannot be authored as a BPMN node.`);
     }
-    // The library is the authority, but the serializer has already declared this
-    // node's output variable from the placement alone (`intsvcServiceType`). If the
-    // two ever disagree, that variable is wrong — so say so rather than emit it.
+    // The PLACEMENT decides the extension type — `.eventTrigger()` starts the
+    // process (`Intsvc.EventTrigger`), `.waitForEvent()` pauses it (`Intsvc.WaitForEvent`)
+    // — and the serializer has already declared this node's output variable from it
+    // (`intsvcServiceType`). The library's `runtime.serviceType` only has to agree
+    // that the operation IS a connector event: the platform ships one operation for
+    // both placements, the baked library carries the wait form under `.event.`, and
+    // `prepare` writes the same entry with the START form's runtime block (measured
+    // on `uipath-microsoft-outlook365/email-received`, 2026-10-16) — so reading the
+    // placement off that field refused every prepared `.waitForEvent()` with "use
+    // .eventTrigger() instead", while the unprepared same node compiled.
     const expected = intsvcServiceType(n);
-    if (type !== expected) {
+    if (type !== 'Intsvc.EventTrigger' && type !== 'Intsvc.WaitForEvent') {
         throw new Error(`connector event "${n.id}" was authored as a ${n.subscribe} (${expected}), but the library ` +
-            `describes ${n.key}/${n.eventName} as ${type}. Use ` +
-            `${type === 'Intsvc.EventTrigger' ? '.eventTrigger()' : '.waitForEvent()'} instead.`);
+            `describes ${n.key}/${n.eventName} as ${type}, which is not a connector event.`);
     }
     const conn = connectorBindingRef(ctx, n.connection, 'Connection', 'ConnectionId', `${rc.connectorKey} connection`);
     const folder = connectorBindingRef(ctx, n.folder, 'Connection', 'folderKey', 'FolderKey', conn?.resourceKey);
@@ -108,10 +114,17 @@ export function createConnectorEvent(ctx, n) {
     // The expression is the scope's equality clauses AND-joined with the authored
     // `filters`, each lowered by the designer's own grammar (`core/event-filters.ts`) — the
     // same lowering the Flow serializer does for `onEvent`/`waitForEvent`.
-    inputs.body = eventFilterBody(n.id, n.filter, n.filters);
+    // A `lookup()` token in the scope is replaced by the id `prepare --resolve`
+    // recorded, as Flow's and Case's serializers do; an unrecorded one is refused
+    // with the command that records it. Stringified, a token was `[object Object]`.
+    const scope = resolveEventWhere(n.filter, ctx.library.lookupResolutions, `connector event "${n.id}"`);
+    inputs.body = eventFilterBody(n.id, scope, n.filters);
     if (n.parameters !== undefined)
         inputs.parameters = n.parameters;
-    return createTypedNode(ctx.m, n.id, type, {
+    return createTypedNode(ctx.m, n.id, 
+    // The placement's type, so a prepared `.event.` entry carrying the start form's
+    // runtime cannot turn a wait into a start event (see the check above).
+    expected, {
         name: n.name ?? rc.entry.display?.label ?? n.eventName,
         inputs,
         outputVar: n.outputVar,