@uipath/maestro-builder-sdk 6.70.6 → 6.70.8

package/dist/case/task-output-ref.js

@@ -0,0 +1,212 @@
+/**
+ * Reading another task's output in place: the SDD's `vars.$xref('<stage>',
+ * '<task>', '<output>')` marker, and `taskOutput()`, the typed way to write it
+ * (builder-sdk#1241).
+ *
+ * A task's own output is a variable of its own: the Case Designer saves it as
+ * `{ name: 'AgentExpenseRequest', id: 'agentExpenseRequest', var:
+ * 'agentExpenseRequest' }`, with no root `variables` entry, and a later task
+ * reads it as `=vars.agentExpenseRequest`. The id is the plan's, not the
+ * author's: it is unique across the plan, so a second task's `Action` output
+ * is `action2`. An SDD therefore names an output by where it is produced, and
+ * `uip maestro case sdd convert` lowers each marker to `vars.<output id>`
+ * (`sdd-convert/xrefs.ts`). Without the lowering here, an author had to copy
+ * the value into a case variable the SDD does not declare, and `validate
+ * --strict --sdd` refuses each one (`STRICT_SDD_VARIABLE_EXTRA`).
+ *
+ * The rule lives here so `check` (at `build()`) and `serialize` read a marker
+ * the same way. `build()` cannot see the ids, which `serialize` mints, so it
+ * resolves the stage and the task, and the output where the task's rows are
+ * all authored (a reference-mode task). `serialize` resolves every marker
+ * against the rows it wrote and refuses one that names no output.
+ */
+/**
+ * One argument, read by its own delimiter: `'…'`, `"…"`, `` `…` `` or the curly
+ * pair, the four `sdd convert` accepts. A curly pair is two code points, so it
+ * gets its own branch instead of a backreference.
+ */
+const QUOTED = String.raw `(?:'((?:\\.|[^'\\])*)'|"((?:\\.|[^"\\])*)"|` +
+    '`((?:\\\\.|[^`\\\\])*)`' +
+    String.raw `|\u201c([^\u201d]*)\u201d)`;
+/** A `vars.$xref(stage, task, output)` marker. Global: use with `replace`/`matchAll` only. */
+const XREF_CALL = new RegExp(String.raw `vars\.\$xref\(\s*${QUOTED}\s*,\s*${QUOTED}\s*,\s*${QUOTED}\s*\)`, 'g');
+/**
+ * A property read glued to the marker (`vars.$xref(…).unusualClauses`). The
+ * producer may not have run when the reader does, so inside a `=js:`
+ * expression the lowering writes the optional chain
+ * `vars.<id>?.unusualClauses`, as `sdd convert` does. Only there: `?.` is
+ * JavaScript, and nothing shows that the platform's non-js `=vars.<path>`
+ * binding reads it, so any other value keeps the plain `.`.
+ */
+const DOTTED_READ = /^\.[A-Za-z_$]/;
+const unescape = (value) => value.replace(/\\(.)/g, '$1');
+/** Each marker in `text`, in order, with where it sits. */
+export function taskOutputRefs(text) {
+    if (!text.includes('$xref'))
+        return [];
+    return [...text.matchAll(XREF_CALL)].map((m) => {
+        const arg = (from) => unescape(m.slice(from, from + 4).find((v) => v !== undefined) ?? '');
+        return { stage: arg(1), task: arg(5), output: arg(9), whole: m[0], index: m.index ?? 0 };
+    });
+}
+/**
+ * Replace every marker in `text` with what `lower` returns for it. In a `=js:`
+ * expression, a marker followed by a property read gets the optional chain
+ * (`vars.<id>?.field`); any other value keeps the plain read (`vars.<id>.field`).
+ *
+ * @param text - The expression.
+ * @param lower - The variable a marker reads (`agentExpenseRequest`), or `undefined` to keep the marker.
+ */
+export function lowerTaskOutputRefs(text, lower) {
+    if (!text.includes('$xref'))
+        return text;
+    const js = /^\s*=js:/.test(text);
+    let out = '';
+    let at = 0;
+    for (const ref of taskOutputRefs(text)) {
+        const after = text.slice(ref.index + ref.whole.length);
+        const variable = lower(ref);
+        // `undefined` keeps the marker as written (a reference to a stand-in; see `resolveInPlan`).
+        out += variable === undefined ? text.slice(at, ref.index) + ref.whole : `${text.slice(at, ref.index)}vars.${variable}${js && DOTTED_READ.test(after) ? '?' : ''}`;
+        at = ref.index + ref.whole.length;
+    }
+    return out + text.slice(at);
+}
+/**
+ * The one candidate `name` picks out: an exact match first, then a
+ * case-insensitive one (an SDD addresses a stage or an output in any case).
+ * `undefined` when none does; `'ambiguous'` when more than one does.
+ */
+export function pickByName(items, name, names) {
+    for (const same of [(a) => a === name, (a) => a.toLowerCase() === name.toLowerCase()]) {
+        const hits = [...new Set(items.filter((item) => names(item).some((n) => n !== undefined && same(n))))];
+        if (hits.length === 1)
+            return hits[0];
+        if (hits.length > 1)
+            return 'ambiguous';
+    }
+    return undefined;
+}
+/**
+ * The row an output reference names among one task's rows: by the field it
+ * reads (`name`) or by the variable it writes (`var`).
+ */
+export function pickOutputRow(rows, output) {
+    return pickByName(rows, output, (row) => [row.name, row.var]);
+}
+/** The refusal message for a marker that resolves to nothing. */
+export function unresolvedTaskOutputRef(ref, why) {
+    return `taskOutput(${JSON.stringify(ref.stage)}, ${JSON.stringify(ref.task)}, ${JSON.stringify(ref.output)}) ${why}. ` +
+        'A task-output reference names the stage label, the task name and the output (the result field it reads, or the key it has in `.outputs()`).';
+}
+/**
+ * The marker for a reference: `vars.$xref('<stage>','<task>','<output>')`,
+ * each argument single-quoted with its quotes and backslashes escaped. What
+ * `taskOutput()` returns, and what decompile writes back.
+ */
+export function taskOutputMarker(stage, task, output) {
+    const quote = (value) => `'${value.replace(/[\\']/g, '\\$&')}'`;
+    return `vars.$xref(${quote(stage)},${quote(task)},${quote(output)})`;
+}
+/** Every stage task's output rows in a written caseplan, in document order. */
+export function planTaskOutputs(plan) {
+    const found = [];
+    const nodes = plan?.nodes;
+    for (const node of Array.isArray(nodes) ? nodes : []) {
+        const data = node?.data;
+        if (typeof data?.label !== 'string' || !Array.isArray(data.tasks))
+            continue;
+        for (const lane of data.tasks)
+            for (const task of Array.isArray(lane) ? lane : []) {
+                if (typeof task?.displayName !== 'string')
+                    continue;
+                const rows = Array.isArray(task.data?.outputs) ? task.data.outputs : [];
+                found.push({
+                    stage: data.label,
+                    task: task.displayName,
+                    rows: rows.filter((row) => row && typeof row === 'object'),
+                    ...(task.data?.standIn === true ? { standIn: true } : {}),
+                });
+            }
+    }
+    return found;
+}
+/**
+ * What a reference reads in a written plan: the variable of the row it names
+ * (`vars.<id>`, or a custom row's `var`, which has no id), or why it names none.
+ */
+export function resolveInPlan(tasks, ref) {
+    const stage = pickByName([...new Set(tasks.map((t) => t.stage))], ref.stage, (label) => [label]);
+    if (stage === undefined)
+        return { why: `names no stage labelled ${JSON.stringify(ref.stage)}` };
+    if (stage === 'ambiguous')
+        return { why: `names a stage label that more than one stage answers to` };
+    const task = pickByName(tasks.filter((t) => t.stage === stage), ref.task, (t) => [t.task]);
+    if (task === undefined)
+        return { why: `names no task ${JSON.stringify(ref.task)} in stage ${JSON.stringify(stage)}` };
+    if (task === 'ambiguous')
+        return { why: `names a task that more than one task in stage ${JSON.stringify(stage)} answers to` };
+    // The named task was refused and stood in (collect mode). Its refusal is the
+    // finding; its outputs were never written, so there is nothing to judge the
+    // reference against here (`build()` already judged it against the authored ones).
+    if (task.standIn)
+        return { standIn: true };
+    const row = pickOutputRow(task.rows, ref.output);
+    const offered = [...new Set(task.rows.map((r) => r.name).filter((n) => typeof n === 'string'))];
+    if (row === undefined)
+        return { why: `names no output of task ${JSON.stringify(task.task)}, whose outputs are ${offered.length ? offered.map((n) => JSON.stringify(n)).join(', ') : 'none'}` };
+    if (row === 'ambiguous')
+        return { why: `names more than one output of task ${JSON.stringify(task.task)}; name it by the variable it writes instead` };
+    const variable = typeof row.id === 'string' && row.id ? row.id : row.var;
+    if (typeof variable !== 'string' || !variable)
+        return { why: `names an output of task ${JSON.stringify(task.task)} that writes no variable` };
+    return { variable };
+}
+/**
+ * Turn each `vars.<output id>` read in `text` that only a task-output reference
+ * can say back into `vars.$xref(…)`, for decompile. `byId` maps such an id to
+ * the reference that names it.
+ */
+export function raiseTaskOutputReads(text, byId) {
+    if (!byId.size || !text.includes('vars.'))
+        return text;
+    return text.replace(/(?<![\w$.])vars\.([A-Za-z_$][\w$]*)(?![\w$])/g, (whole, id) => {
+        const ref = byId.get(id);
+        return ref ? taskOutputMarker(ref.stage, ref.task, ref.output) : whole;
+    });
+}
+/**
+ * The output ids a decompiled source can only read back by reference: a row
+ * whose id is not the variable it writes (a reassigned extract, a Designer row
+ * such as `{ id: 'oA1b2C3d4', var: 'AgentExpenseRequest' }`). Recompiling mints
+ * that id afresh, and no declaration makes `vars.<id>` readable, so a
+ * `vars.<id>` read in the plan goes back to the source as the reference that
+ * resolves to the same row. A read of an id that is also a variable (an
+ * own-name row, a root variable) is left as written. A row the reference
+ * could not name uniquely is left as written too.
+ */
+export function referableOutputIds(plan, rootNames) {
+    const tasks = planTaskOutputs(plan);
+    const vars = new Set(rootNames);
+    for (const task of tasks)
+        for (const row of task.rows)
+            if (typeof row.var === 'string')
+                vars.add(row.var);
+    const byId = new Map();
+    for (const task of tasks)
+        for (const row of task.rows) {
+            if (typeof row.id !== 'string' || !row.id || row.id === row.var || vars.has(row.id))
+                continue;
+            for (const output of [row.name, row.var]) {
+                if (typeof output !== 'string' || !output)
+                    continue;
+                const ref = { stage: task.stage, task: task.task, output };
+                const resolved = resolveInPlan(tasks, ref);
+                if ('variable' in resolved && resolved.variable === row.id) {
+                    byId.set(row.id, ref);
+                    break;
+                }
+            }
+        }
+    return byId;
+}

package/dist/core/binding-messages.js

@@ -5,7 +5,7 @@
  * from the inner loop as from compile. Before this, `check` printed `0 error(s)`
  * for a source `compile` then refused (teams-decision, 2026-09-01, turn 22 → 23).
  */
-import { prepareCommand } from './cli-spelling.js';
+import { placeholder, prepareCommand } from './cli-spelling.js';
 import { CompileRefusal } from './compile-refusal.js';
 /** A tenant resource key — an Integration Service connection id or an Orchestrator folder key — is a GUID. */
 export const GUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
@@ -96,7 +96,7 @@ export function bindingLabelRefusal(bindings, name, attribute, where, target) {
     return undefined;
 }
 function prepareFor(target) {
-    return prepareCommand(target?.key ?? '<connector-key>', target?.action ?? '<action>');
+    return prepareCommand(target?.key ?? placeholder('<connector-key>'), target?.action ?? placeholder('<action>'));
 }
 /**
  * Why compile refuses `name`, and how to bind it.
@@ -143,7 +143,7 @@ export function connectionConnectorConflictMessage(connection, users) {
     return `connection "${connection}" is used by steps of different connectors (${who}). An Integration Service `
         + `connection belongs to exactly one connector, so at most one of these steps can run on it, and the solution `
         + `resource would be declared as whichever came first. Give each connector its own connection label in `
-        + `bindings.json (\`${prepareCommand('<connector-key>', '<action>')}\` binds one per connector). A managed `
+        + `bindings.json (\`${prepareCommand(placeholder('<connector-key>'), placeholder('<action>'))}\` binds one per connector). A managed `
         + `\`http({ managed: true, … })\` step on another connector's connection must name that connector in `
         + `\`targetConnector\`.`;
 }

package/dist/core/byoa.js

@@ -88,11 +88,11 @@ export function byoaUnverified(where, sub, facts, ledger, bindings) {
     if (byoaRecordFor(ledger, byoaLedgerKey(sub.connector, sub.event), id))
         return undefined;
     const named = label === id ? `connection ${id}` : `connection \`${label}\` (${id})`;
-    const object = sub.object ? ` --object ${sub.object}` : '';
+    const object = sub.object ? ['--object', sub.object] : [];
     return `${where}: \`${sub.connector}\` \`${sub.event}\` requires a BYOA (bring-your-own-app) connection — `
         + `one created with your own OAuth app — and ${named} was never checked against that requirement. `
         + `A standard connection deploys and the trigger never fires. Prepare the event on this connection, `
         + `which refuses a standard connection and records a BYOA one:\n`
-        + `  ${prepareCommand(sub.connector, sub.event)}${object} --connection-id ${id}\n`
+        + `  ${prepareCommand(sub.connector, sub.event, ...object, '--connection-id', id)}\n`
         + `BYOA connections (rows for \`${sub.connector}\`): uip is connections list --byoa --all-folders`;
 }

package/dist/core/cli-spelling.d.ts

@@ -23,12 +23,33 @@ export interface CliSpellingEnv {
  * @returns `uip maestro` when the caller said so, else `npx flow-sdk`.
  */
 export declare function cliSpelling(env?: CliSpellingEnv): string;
+declare const PLACEHOLDER_TEXT: unique symbol;
+/** A `<name>` placeholder the SDK itself writes into a printed command; printed bare. */
+export interface Placeholder {
+    readonly [PLACEHOLDER_TEXT]: string;
+}
+/**
+ * Mark `<name>` as a placeholder for {@link prepareCommand}. Only a marked
+ * placeholder is printed bare: a plain string shaped like `<x>` can come from a
+ * `.flow`, and bare it is a shell redirection.
+ *
+ * @example
+ * ```ts
+ * prepareCommand(key, event, '--connection-id', placeholder('<id>'));
+ * ```
+ */
+export declare function placeholder(name: string): Placeholder;
 /**
  * A `registry prepare` command line, spelled for whoever is driving.
  *
- * @param connectorKey - The connector key, or omitted for the bare command.
- * @param action - The operation, printed as `--action <action>`.
- * @param rest - Further arguments, e.g. `--object`, `<name>`.
+ * The key, action and object often come from a `.flow` file, so every argument
+ * goes through {@link shellArg}; only a {@link placeholder} is kept as is. A value
+ * {@link shellArg} cannot quote prints as its placeholder, and the line ends
+ * with the value once, JSON-escaped: `… --object <object> (where <object> is "a';x")`.
+ *
+ * @param connectorKey - The connector key, or omitted (or empty) for the bare command.
+ * @param action - The operation, printed as `--action <action>`; omitted when empty.
+ * @param rest - Further arguments, e.g. `--object`, `Lead`; an empty one prints as `''`.
  * @returns The full command, no trailing newline.
  *
  * @example
@@ -36,9 +57,25 @@ export declare function cliSpelling(env?: CliSpellingEnv): string;
  * prepareCommand('uipath-salesforce-slack', 'send-message-to-user');
  * // -> "npx flow-sdk registry prepare uipath-salesforce-slack --action send-message-to-user"
  * // -> "uip maestro registry prepare …" when FLOW_SDK_INVOKED_AS="uip maestro"
+ * prepareCommand('uipath-x', 'created', '--object', 'My Object');
+ * // -> "npx flow-sdk registry prepare uipath-x --action created --object 'My Object'"
+ * ```
+ */
+export declare function prepareCommand(connectorKey?: string | Placeholder, action?: string | Placeholder, ...rest: (string | Placeholder)[]): string;
+/**
+ * One argument of a printed command, safe to paste into a POSIX shell or PowerShell.
+ *
+ * @param arg - The argument; `''` is returned for the empty string.
+ * @returns The argument as is, single-quoted, or `undefined` when no quoting is safe in both shells.
+ *
+ * @example
+ * ```ts
+ * shellArg('Lead');          // -> "Lead"
+ * shellArg('Lead;curl x|sh'); // -> "'Lead;curl x|sh'"
+ * shellArg("a';echo X;#");   // -> undefined
  * ```
  */
-export declare function prepareCommand(connectorKey?: string, action?: string, ...rest: string[]): string;
+export declare function shellArg(arg: string): string | undefined;
 /**
  * The argument of one `--resolve <field>:<by>=<value>`, single-quoted when the
  * shell would otherwise mangle it.
@@ -58,3 +95,4 @@ export declare function resolveFlagArg(field: string, by: string, value: string)
  * moved to `uip`. Name it here once.
  */
 export declare const PULL_COMMAND = "uip maestro registry pull";
+export {};

package/dist/core/cli-spelling.js

@@ -44,12 +44,39 @@ export function cliSpelling(env = ambientEnv()) {
     const hint = (env.FLOW_SDK_INVOKED_AS ?? '').trim();
     return SPELLING.test(hint) ? hint : DEFAULT_CLI_SPELLING;
 }
+/** A `<name>` placeholder a caller prints for the reader to fill in, e.g. `<id>`, `<action>`. */
+const PLACEHOLDER = /^<[a-z][a-z0-9-]*>$/;
+const PLACEHOLDER_TEXT = Symbol('placeholder');
+/**
+ * Mark `<name>` as a placeholder for {@link prepareCommand}. Only a marked
+ * placeholder is printed bare: a plain string shaped like `<x>` can come from a
+ * `.flow`, and bare it is a shell redirection.
+ *
+ * @example
+ * ```ts
+ * prepareCommand(key, event, '--connection-id', placeholder('<id>'));
+ * ```
+ */
+export function placeholder(name) {
+    if (!PLACEHOLDER.test(name))
+        throw new Error(`internal SDK error: ${JSON.stringify(name)} is not a <name> placeholder`);
+    return { [PLACEHOLDER_TEXT]: name };
+}
+/** The placeholder printed in place of the value after `flag`: `<object>` after `--object`, else `<arg>`. */
+function placeholderAfter(flag) {
+    return flag !== undefined && /^--[a-z][a-z0-9-]*$/.test(flag) ? `<${flag.slice(2)}>` : '<arg>';
+}
 /**
  * A `registry prepare` command line, spelled for whoever is driving.
  *
- * @param connectorKey - The connector key, or omitted for the bare command.
- * @param action - The operation, printed as `--action <action>`.
- * @param rest - Further arguments, e.g. `--object`, `<name>`.
+ * The key, action and object often come from a `.flow` file, so every argument
+ * goes through {@link shellArg}; only a {@link placeholder} is kept as is. A value
+ * {@link shellArg} cannot quote prints as its placeholder, and the line ends
+ * with the value once, JSON-escaped: `… --object <object> (where <object> is "a';x")`.
+ *
+ * @param connectorKey - The connector key, or omitted (or empty) for the bare command.
+ * @param action - The operation, printed as `--action <action>`; omitted when empty.
+ * @param rest - Further arguments, e.g. `--object`, `Lead`; an empty one prints as `''`.
  * @returns The full command, no trailing newline.
  *
  * @example
@@ -57,22 +84,64 @@ export function cliSpelling(env = ambientEnv()) {
  * prepareCommand('uipath-salesforce-slack', 'send-message-to-user');
  * // -> "npx flow-sdk registry prepare uipath-salesforce-slack --action send-message-to-user"
  * // -> "uip maestro registry prepare …" when FLOW_SDK_INVOKED_AS="uip maestro"
+ * prepareCommand('uipath-x', 'created', '--object', 'My Object');
+ * // -> "npx flow-sdk registry prepare uipath-x --action created --object 'My Object'"
  * ```
  */
 export function prepareCommand(connectorKey, action, ...rest) {
-    return [cliSpelling(), 'registry', 'prepare', connectorKey, ...(action ? ['--action', action] : []), ...rest]
-        .filter(Boolean)
-        .join(' ');
+    const held = [];
+    const arg = (value, stand) => {
+        if (typeof value !== 'string')
+            return value[PLACEHOLDER_TEXT];
+        const quoted = shellArg(value);
+        if (quoted !== undefined)
+            return quoted;
+        held.push(`${stand} is ${JSON.stringify(value)}`);
+        return stand;
+    };
+    const words = [cliSpelling(), 'registry', 'prepare'];
+    if (connectorKey)
+        words.push(arg(connectorKey, '<connector-key>'));
+    if (action)
+        words.push('--action', arg(action, '<action>'));
+    rest.forEach((value, i) => {
+        const prev = rest[i - 1];
+        words.push(arg(value, placeholderAfter(typeof prev === 'string' ? prev : undefined)));
+    });
+    const line = words.join(' ');
+    return held.length ? `${line} (where ${held.join(', ')})` : line;
+}
+/** Characters a POSIX shell or PowerShell reads specially in an unquoted argument (globs, whitespace, quotes incl. “ ” „, `$`, operators). */
+const SHELL_UNSAFE = /[\s'"`$\\[\]*?;&|(){}!#~<>\u201C-\u201E]/;
+/**
+ * Characters no single quoting keeps literal in both a POSIX shell and
+ * PowerShell: POSIX writes `'` as `'\''`, which PowerShell reads as a break-out;
+ * PowerShell also ends `'…'` at U+2018–U+201B; a control character can end the
+ * line. Every other character is literal inside `'…'` in both.
+ */
+const UNQUOTABLE = /['\u2018-\u201B\p{Cc}]/u;
+/** `arg` in POSIX shell single quotes, each embedded `'` written as `'\''`. */
+function singleQuote(arg) {
+    return `'${arg.replaceAll("'", `'\\''`)}'`;
 }
 /**
- * Characters that make a `--resolve` argument unsafe to paste unquoted. `[*]`
- * is a shell glob (every multiselect wire name, `users[*]`), whitespace splits
- * a real name (`Coder Evals`) into two arguments, and quotes, `$`, backslash
- * and the control operators change what the shell hands over. The `<value>`
- * placeholder a template prints is stripped before the test, so a template
- * with nothing else unsafe keeps its bytes.
+ * One argument of a printed command, safe to paste into a POSIX shell or PowerShell.
+ *
+ * @param arg - The argument; `''` is returned for the empty string.
+ * @returns The argument as is, single-quoted, or `undefined` when no quoting is safe in both shells.
+ *
+ * @example
+ * ```ts
+ * shellArg('Lead');          // -> "Lead"
+ * shellArg('Lead;curl x|sh'); // -> "'Lead;curl x|sh'"
+ * shellArg("a';echo X;#");   // -> undefined
+ * ```
  */
-const SHELL_UNSAFE = /[\s'"`$\\[\]*?;&|(){}!#~<>]/;
+export function shellArg(arg) {
+    if (UNQUOTABLE.test(arg))
+        return undefined;
+    return arg === '' || SHELL_UNSAFE.test(arg) ? `'${arg}'` : arg;
+}
 /**
  * The argument of one `--resolve <field>:<by>=<value>`, single-quoted when the
  * shell would otherwise mangle it.
@@ -86,7 +155,7 @@ export function resolveFlagArg(field, by, value) {
     const arg = `${field}:${by}=${value}`;
     if (!SHELL_UNSAFE.test(arg.replaceAll('<value>', '')))
         return arg;
-    return `'${arg.replaceAll("'", `'\\''`)}'`;
+    return singleQuote(arg);
 }
 /**
  * The command a message tells a person or agent to run when the cache is

package/dist/core/event-checks.js

@@ -121,7 +121,7 @@ compileRefusals = true) {
         warn('OBJECT_UNPREPARED', `${where}: object \`${object}\` has no prepared schema for `
             + `\`${sub.connector}\` \`${sub.event}\`, and this connector's objects come from `
             + `the connection, so the library cannot carry one. Materialize it:\n`
-            + `  ${prepareCommand(connectorKey, eventName)} --object ${object}\n`
+            + `  ${prepareCommand(connectorKey, eventName, '--object', object)}\n`
             + `Until then its event parameters and filterable fields are unknown and `
             + `nothing here can check them.`);
     }
@@ -171,8 +171,7 @@ compileRefusals = true) {
                     + `connector discovers CUSTOM FIELDS per connection, so the baked list is a `
                     + `subset by design and this name may be a real field of yours. Prepare the `
                     + `event against your connection to check it for real:\n`
-                    + `  ${prepareCommand(connectorKey, eventName)}`
-                    + `${object ? ` --object ${object}` : ''}\n`
+                    + `  ${prepareCommand(connectorKey, eventName, ...(object ? ['--object', object] : []))}\n`
                     + `Baked fields: ${names.slice(0, 12).join(', ')}${names.length > 12 ? ', …' : ''}.`);
                 return;
             }

package/dist/core/refusals.d.ts

@@ -640,6 +640,7 @@ export declare const REFUSALS: {
     readonly TASK_OUTPUTS_NO_RESPONSE: "lowering";
     readonly TASK_OUTPUTS_PLACEHOLDER_EVENT: "lowering";
     readonly TASK_OUTPUTS_UNSUPPORTED: "lowering";
+    readonly TASK_OUTPUT_REF_UNRESOLVED: "lowering";
     readonly TASK_OUTPUT_SOURCE_AND_ASSIGN: "lowering";
     readonly TASK_REENTRY_IGNORED: "lint";
     readonly TASK_TIMER_OUT_OF_RANGE: "lint";

package/dist/core/refusals.js

@@ -692,6 +692,7 @@ export const REFUSALS = {
     TASK_OUTPUTS_NO_RESPONSE: 'lowering',
     TASK_OUTPUTS_PLACEHOLDER_EVENT: 'lowering',
     TASK_OUTPUTS_UNSUPPORTED: 'lowering',
+    TASK_OUTPUT_REF_UNRESOLVED: 'lowering',
     TASK_OUTPUT_SOURCE_AND_ASSIGN: 'lowering',
     TASK_REENTRY_IGNORED: 'lint',
     TASK_TIMER_OUT_OF_RANGE: 'lint',

package/dist/decompile.js

@@ -45,7 +45,7 @@ import { outputBackingGlobal, outputBackingName } from './flow-output-backing.js
 import { mapJsCode } from './core/js-code-spans.js';
 import { VARS_READ_RE } from './core/vars-read.js';
 import { missingBindingLabels } from './core/binding-messages.js';
-import { prepareCommand } from './core/cli-spelling.js';
+import { placeholder, prepareCommand } from './core/cli-spelling.js';
 import { OUTCOME_HANDLE_NODE_TYPES } from './core/hitl-routing.js';
 import { contributionPort, forwardFanOut } from './core/definition-handles.js';
 import { STICKY_NOTE_TYPE } from './core/definitionless-node-types.js';
@@ -982,7 +982,7 @@ function unboundMarker(node, labels, key, action) {
         + `The source leaves ${missing.length > 1 ? 'them' : 'it'} out${isCanvasDraft(node)
             ? ' and marks the step `{ draft: true }`: compile writes it as a draft, and check refuses it'
             : ', and compile and check refuse it'} (BINDING_MISSING) until it names both labels: `
-        + `run \`${prepareCommand(key, action ?? '<action>')}\`, then pass `
+        + `run \`${prepareCommand(key, action ?? placeholder('<action>'))}\`, then pass `
         + `\`connection\` and \`folder\`.`);
     return ` /* TODO: bind ${commentText(names)}; check refuses this node until it has both labels (BINDING_MISSING) */`;
 }

package/dist/registry/generators/descriptors.js

@@ -18,7 +18,7 @@
  * event's per-object variants are skipped because they share their template's
  * node type and so would emit the same const twice.
  */
-import { prepareCommand } from "../../core/cli-spelling.js";
+import { placeholder, prepareCommand } from "../../core/cli-spelling.js";
 import { commentText, docComment } from "../../core/comment-text.js";
 import { PACKAGE_NAME } from "../../package-name.js";
 import { pyJsonString, pyJsonStringify } from "../codecs/pyjson.js";
@@ -207,7 +207,7 @@ export function emitEvent(entry, inFields, inputTree, outputTree, name, inputTyp
         lines.push(" * Requires a BYOA (bring-your-own-app) connection — on a standard one the");
         lines.push(" * trigger deploys and never fires. Bind it with");
         // Spelled for whoever ran the generator, like every `check` remedy.
-        lines.push(` * \`${commentText(prepareCommand(pyStr(connectorKey), eventId, "--connection-id", "<id>"))}\`,`);
+        lines.push(` * \`${commentText(prepareCommand(pyStr(connectorKey), eventId, "--connection-id", placeholder("<id>")))}\`,`);
         lines.push(" * which refuses a standard connection and records the check `compile` requires;");
         lines.push(" * `uip is connections list --byoa --all-folders` lists the BYOA connections.");
     }

package/dist/registry/generators/markdown/sections/event-facts.js

@@ -5,7 +5,7 @@
  * event page is unchanged. The facts are the sidecar's, which the library build
  * stamps from the event's `triggers objects` row (#848).
  */
-import { prepareCommand } from "../../../../core/cli-spelling.js";
+import { placeholder, prepareCommand } from "../../../../core/cli-spelling.js";
 import { isEventNodeType } from "../../../model/library.js";
 import { dictOf, getStr } from "../pyvalue.js";
 export function eventFactsLines(j, v1def) {
@@ -29,7 +29,7 @@ export function eventFactsLines(j, v1def) {
             "connection that was never checked (`EVENT_BYOA_UNVERIFIED`).");
         out.push("");
         out.push("```bash");
-        out.push(prepareCommand(key, event, "--connection-id", "<id>"));
+        out.push(prepareCommand(key, event, "--connection-id", placeholder("<id>")));
         out.push("uip is connections list --byoa --all-folders   # the BYOA connections");
         out.push("```");
         out.push("");

package/dist/serialize.js

@@ -57,7 +57,7 @@ import { planFlowGlobals, planSharedInputs, sharedInputRoots } from './flow-vari
 import { outputBackingGlobal, planOutputBacking } from './flow-output-backing.js';
 import { mapJsCode } from './core/js-code-spans.js';
 import { contributionPort } from './core/definition-handles.js';
-import { prepareCommand } from './core/cli-spelling.js';
+import { placeholder, prepareCommand } from './core/cli-spelling.js';
 import { processResourceBindings } from './core/process-resource.js';
 import { types } from './core/expr.js';
 import { SUBFLOW_START_LABEL } from './core/subflow-start.js';
@@ -612,7 +612,7 @@ function resolveBinding(opts, name, attribute, where, target) {
         const fault = STUB_GUID_RE.test(value)
             ? `"401 Invalid Organization or User secret, or invalid Element token provided" — no such connection exists`
             : `"'Connection' has an invalid GUID value: '${value}'"`;
-        const remedy = `Bind the real one: \`${prepareCommand('<connector-key>', '<action>')}\` finds the connection `
+        const remedy = `Bind the real one: \`${prepareCommand(placeholder('<connector-key>'), placeholder('<action>'))}\` finds the connection `
             + `and writes both entries into bindings.json (several candidates: pass \`--connection-id <id>\` from the list it `
             + `prints); by hand, read Id and FolderKey from \`uip is connections list --all-folders --output json\`.`;
         const message = resolved === undefined

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uipath/maestro-builder-sdk",
-  "version": "6.70.6",
+  "version": "6.70.8",
   "description": "Build UiPath Flow, Case, and BPMN artifacts by writing TypeScript.",
   "license": "MIT",
   "homepage": "https://docs.uipath.com/maestro",
@@ -100,5 +100,5 @@
     "@types/node": "^22.7.0",
     "esbuild": "^0.28.1"
   },
-  "gitref": "acb0888df4770ee4db5ebb89ef2116cf400ee1b9"
+  "gitref": "17641bf2850dc69f377b91277d0e6dfc756b1280"
 }