@uipath/maestro-builder-sdk 6.9.0 → 6.9.1

package/dist/check.d.ts

@@ -1,6 +1,7 @@
 import { type LookupResolutions, type LookupSpec } from './core/lookups.js';
 import type { SchemaReadiness } from './core/library.js';
 import type { BuiltFlow } from './flow-sdk.js';
+import { type BindingsView } from './core/binding-messages.js';
 export interface Diagnostic {
     level: 'error' | 'warning';
     code: string;
@@ -140,12 +141,13 @@ export interface CheckOpts {
         object?: string;
     }, inputs: Record<string, unknown>) => string | undefined;
     /**
-     * The project's `bindings.json`, when there is one — enough of it to detect an
-     * entry that answers with its own name, which `compile` refuses (BINDING_SELF_NAME).
+     * The project's `bindings.json`, when there is one — enough of it to detect the
+     * two labels `compile` refuses: an entry that answers with its own name
+     * (BINDING_SELF_NAME), and a label a populated file does not declare
+     * (BINDING_UNDECLARED). `declared` and `entry` are optional so a caller holding
+     * only `resolve` still gets the first rule; the `Bindings` class has all three.
      */
-    bindings?: {
-        resolve(name?: string): string | undefined;
-    };
+    bindings?: BindingsView;
 }
 export declare function check(built: BuiltFlow, opts?: CheckOpts): Diagnostic[];
 /**

package/dist/check.js

@@ -10,7 +10,7 @@ import { FlowNode } from './core/node-classes.js';
 import { isLookupToken, resolvedValue, unresolvedLookupMessage, } from './core/lookups.js';
 import { EVENT_FILTER_OPERATORS, readEventFilter, eventFilterProblem } from './event-filters.js';
 import { extractRefs } from './core/expr-check.js';
-import { bindingSelfNameMessage } from './core/binding-messages.js';
+import { bindingSelfNameMessage, bindingUndeclaredMessage, undeclaredBinding } from './core/binding-messages.js';
 import { hitlDerivesOutcomeHandles, hitlExitModel, hitlRoutesPerOutcome } from './core/hitl-routing.js';
 import { declaredExits, hasExits, stopsAtEnd } from './core/step-ports.js';
 import { FLOW_SCHEMA_VERSIONS } from './format-profile.js';
@@ -357,6 +357,14 @@ function checkFlow(built, ancestors, opts = {}) {
                     checkTransform(s.name, s.spec.inputs, diags, typeOf, triggerId);
                 if (s.spec.kind === 'http') {
                     checkHttp(s.name, s.spec.inputs, diags);
+                    // Only a complete pair: an empty half is HTTP_MANAGED_BINDING_INCOMPLETE, which
+                    // serialize refuses before it resolves either name.
+                    const pair = s.spec.inputs;
+                    const filled = (v) => typeof v === 'string' && v.trim() !== '';
+                    if (pair?.managed && filled(pair.connection) && filled(pair.folder)) {
+                        const httpStep = s.name;
+                        checkBindingLabels(`managed http "${httpStep}"`, pair, opts, (code, message) => diags.push({ level: 'error', code, step: httpStep, message }));
+                    }
                     const seen = new Set();
                     for (const b of s.spec.inputs.branches ?? []) {
                         addExpr(b.condition.js, s.name);
@@ -530,6 +538,7 @@ function checkFlow(built, ancestors, opts = {}) {
                     });
                     checkEventSubscription(s.spec.subscription, `waitForEvent "${stepName}"`, push('error'), push('warning'), eventParamsFor(s.spec.subscription, opts));
                     checkEventResolution(s.spec.subscription, `waitForEvent "${stepName}"`, 'event', opts, push('error'), push('warning'), eventParamsFor(s.spec.subscription, opts));
+                    checkBindingLabels(`waitForEvent "${stepName}"`, s.spec.subscription, opts, push('error'), eventTarget(s.spec.subscription));
                 }
                 if (s.spec.kind === 'subflow') {
                     // Only a real child goes in the map: a missing one is reported by
@@ -1470,14 +1479,41 @@ function checkConnectorContract(step, spec, opts, diags) {
     if (inputErr) {
         diags.push({ level: 'error', code: 'CONNECTOR_INPUT', step, message: `Connector step "${step}": ${inputErr}` });
     }
-    if (opts.bindings) {
-        for (const attribute of ['connection', 'folder']) {
-            const name = spec[attribute];
-            if (name !== undefined && opts.bindings.resolve(name) === name) {
-                diags.push({
-                    level: 'error', code: 'BINDING_SELF_NAME', step,
-                    message: bindingSelfNameMessage(`Connector step "${step}"`, name, attribute),
-                });
+    checkBindingLabels(`Connector step "${step}"`, spec, opts, (code, message) => diags.push({ level: 'error', code, step, message }), { key: spec.key, action: spec.action });
+}
+/** What `registry prepare` takes for an event subscription: its connector key and curated event name. */
+function eventTarget(sub) {
+    const { connector, event } = (sub ?? {});
+    return typeof connector === 'string' && connector !== ''
+        ? { key: connector, ...(typeof event === 'string' && event !== '' ? { action: event } : {}) }
+        : undefined;
+}
+/**
+ * The binding-label rules `serialize`'s `resolveBinding` enforces, for one
+ * `{ connection, folder }` pair — reported at every site that resolves one
+ * (connector step, event trigger and `.entryPoint` onEvent, waitForEvent, managed
+ * HTTP), with the sentence compile throws. Without this at the event and HTTP
+ * sites `check` printed `✓ no issues` for a source `compile` then refused.
+ *
+ * Silent without a bindings.json, and for a label that resolves to anything
+ * other than its own name (stub values are compile's CONNECTION_STUB warning).
+ */
+function checkBindingLabels(where, labels, opts, report, target) {
+    const bindings = opts.bindings;
+    if (!bindings || !labels)
+        return;
+    for (const attribute of ['connection', 'folder']) {
+        const name = labels[attribute];
+        if (typeof name !== 'string')
+            continue;
+        const resolved = bindings.resolve(name);
+        if (resolved === name) {
+            report('BINDING_SELF_NAME', bindingSelfNameMessage(where, name, attribute, target));
+        }
+        else if (resolved === undefined) {
+            const declared = undeclaredBinding(bindings, name);
+            if (declared) {
+                report('BINDING_UNDECLARED', bindingUndeclaredMessage(where, name, attribute, declared, target));
             }
         }
     }
@@ -2278,6 +2314,7 @@ function checkTrigger(spec, diags, opts = {}) {
         const sub = spec.subscription;
         checkEventSubscription(sub, 'trigger', at, push('warning'), eventParamsFor(sub, opts));
         checkEventResolution(sub, 'trigger', 'trigger', opts, at, push('warning'), eventParamsFor(sub, opts));
+        checkBindingLabels('event trigger', sub, opts, at, eventTarget(sub));
         return;
     }
     // manual() is the explicit spelling of the default — nothing to validate.

package/dist/compile-cli.js

@@ -27,6 +27,7 @@ import { Bindings } from './bindings.js';
 import { runWhenInvokedDirectly } from './cli-run.js';
 import { connectionResources, mergeBindingsV2, readBindingsV2 } from './bindings-v2.js';
 import { ensureTypeScriptRuntime } from './node-runtime.js';
+import { BindingRefusal } from './core/binding-messages.js';
 function opt(argv, name) {
     const i = argv.indexOf(name);
     return i >= 0 ? argv[i + 1] : undefined;
@@ -106,11 +107,27 @@ export async function run(argv) {
     }
     // The serializer's own observations — a connection or folder value that can
     // never be a tenant resource key — printed in the same `⚠ [CODE]` shape as
-    // check()'s, and never fatal: the .flow is still written, exit stays 0.
+    // check()'s. Warnings are never fatal: the .flow is still written, exit stays 0.
+    // A binding LABEL the serializer refuses (its own name as the resourceKey, or a
+    // label a populated bindings.json does not declare) is an error, not a
+    // warning: the check pass above reports it first, and this is the same refusal
+    // in the same `✗ [CODE]` shape when that pass was skipped (`--no-check`, or an
+    // emit-only project). Nothing is written.
     const warnings = [];
-    const { flow: flowJson, sidecars } = serializeWithSidecars(built, {
-        library, bindings, warn: (w) => warnings.push(w),
-    });
+    let emitted;
+    try {
+        emitted = serializeWithSidecars(built, { library, bindings, warn: (w) => warnings.push(w) });
+    }
+    catch (error) {
+        if (!(error instanceof BindingRefusal))
+            throw error;
+        for (const w of warnings)
+            console.error(`  ⚠ [${w.code}] ${w.message}`);
+        console.error(`  ✗ [${error.code}] ${error.message}`);
+        console.error('compile: 1 error(s); not emitting.');
+        return 1;
+    }
+    const { flow: flowJson, sidecars } = emitted;
     for (const w of warnings)
         console.error(`  ⚠ [${w.code}] ${w.message}`);
     const out = opt(argv, '-o') ?? `${built.name || basename(file).replace(/\.flow\.ts$|\.ts$/, '')}.flow`;

package/dist/core/binding-messages.d.ts

@@ -1 +1,60 @@
-export declare function bindingSelfNameMessage(where: string, name: string, attribute: 'connection' | 'folder'): string;
+/** A tenant resource key — an Integration Service connection id or an Orchestrator folder key — is a GUID. */
+export declare const GUID_RE: RegExp;
+/** The diagnostic codes a label refusal carries, in `check` and on the error `serialize` throws. */
+export type BindingRefusalCode = 'BINDING_SELF_NAME' | 'BINDING_UNDECLARED';
+/**
+ * What `serialize` throws for a label it refuses. It is an ordinary `Error` whose
+ * message is the sentence `check` prints; the `code` lets `compile --no-check`
+ * print it in the same `✗ [CODE]` shape as the check pass instead of a bare line.
+ */
+export declare class BindingRefusal extends Error {
+    readonly code: BindingRefusalCode;
+    constructor(code: BindingRefusalCode, message: string);
+}
+/** The part of a bindings.json the label rules read — `core/bindings.ts` `Bindings` has all three. */
+export interface BindingsView {
+    resolve(name?: string): string | undefined;
+    declared?(): string[];
+    entry?(name?: string): unknown;
+}
+export declare function bindingSelfNameMessage(where: string, name: string, attribute: 'connection' | 'folder', target?: PrepareTarget): string;
+/**
+ * The names a populated bindings.json declares when it does NOT declare `name`,
+ * else `undefined`.
+ *
+ * `undefined` — nothing to refuse — when no bindings.json is loaded, when it
+ * declares no entries (offline authoring: the symbolic name is the only honest
+ * placeholder there), when `name` is itself a GUID (an author may write the
+ * resource key directly), or when any entry answers to `name`. "Answers" is the
+ * union of `entry()`, `resolve()` and `declared()`, so an entry that is declared
+ * but carries no `resourceKey` is NOT refused here — it stays the
+ * `CONNECTION_STUB` warning, which is the route a simulated or validate-only task
+ * with nothing real to bind is meant to take.
+ */
+export declare function undeclaredBinding(bindings: BindingsView | undefined, name: string): string[] | undefined;
+/**
+ * The connector and operation a label belongs to, when the call site knows them:
+ * a connector step's `key` + `action`, an event's `connector` + `event`. With it
+ * the remedy is a command the author can paste; without it (managed HTTP) the
+ * command keeps its `<connector-key> <action>` placeholders.
+ */
+export interface PrepareTarget {
+    key: string;
+    action?: string;
+}
+/**
+ * Why compile refuses `name`, and how to bind it.
+ *
+ * It names NO declared label as the one to use. bindings.json rows carry a label,
+ * a resource key and a kind (`ConnectionId` / `FolderKey`), never the connector
+ * they were bound for, so compile cannot tell which declared label — if any — is
+ * this connector's. Suggesting one sent a Data Service step to `connection:
+ * 'slack'` (the only `ConnectionId` row), and following that compiled the Slack
+ * connection id into the Data Service node with no warning at all: a real GUID of
+ * the wrong connector, which nothing downstream detects. The partial-prepare shape
+ * (ipe-drive-to-slack 09-23: `slack` bound, `drive` not yet) is exactly where
+ * that advice was on offer. So the message lists what is declared, says that a
+ * row is only reusable if it was bound for THIS connector, and gives the
+ * `prepare` command for this step's own connector and operation.
+ */
+export declare function bindingUndeclaredMessage(where: string, name: string, attribute: 'connection' | 'folder', declared: readonly string[], target?: PrepareTarget): string;

package/dist/core/binding-messages.js

@@ -1,16 +1,91 @@
 /**
- * The refusal for a bindings.json entry that answers with its own name — shared by
- * `serialize` (which throws it) and `check` (BINDING_SELF_NAME), so the author reads
- * the same sentence from the inner loop as from compile. Before this, `check`
- * printed `0 error(s)` for a source `compile` then refused (teams-decision,
- * 2026-09-01, turn 22 → 23).
+ * The refusals for a connection/folder label `compile` cannot turn into a tenant
+ * resource key — shared by `serialize` (which throws them) and `check`
+ * (BINDING_SELF_NAME, BINDING_UNDECLARED), so the author reads the same sentence
+ * from the inner loop as from compile. Before this, `check` printed `0 error(s)`
+ * for a source `compile` then refused (teams-decision, 2026-09-01, turn 22 → 23).
  */
 import { prepareCommand } from './cli-spelling.js';
-export function bindingSelfNameMessage(where, name, attribute) {
+/** A tenant resource key — an Integration Service connection id or an Orchestrator folder key — is a GUID. */
+export const GUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/**
+ * What `serialize` throws for a label it refuses. It is an ordinary `Error` whose
+ * message is the sentence `check` prints; the `code` lets `compile --no-check`
+ * print it in the same `✗ [CODE]` shape as the check pass instead of a bare line.
+ */
+export class BindingRefusal extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'BindingRefusal';
+        this.code = code;
+    }
+}
+export function bindingSelfNameMessage(where, name, attribute, target) {
     return `${where}: binding "${name}" resolves to its own name, so the ${attribute} would compile to the `
         + `literal string "${name}" and the run would fault with "'Connection' has an invalid GUID value: `
-        + `'${name}'". Set its "resourceKey" to the real id: \`${prepareCommand('<connector-key>', '<action>')}\` `
+        + `'${name}'". Set its "resourceKey" to the real id: \`${prepareFor(target)}\` `
         + `discovers the connection and writes both the connection and the folder entry into bindings.json; by hand, `
         + `read Id and FolderKey from \`uip is connections list --all-folders --output json\` (the default listing `
         + `shows only your own folder, so a connection shared from another folder is invisible without --all-folders).`;
 }
+/**
+ * The names a populated bindings.json declares when it does NOT declare `name`,
+ * else `undefined`.
+ *
+ * `undefined` — nothing to refuse — when no bindings.json is loaded, when it
+ * declares no entries (offline authoring: the symbolic name is the only honest
+ * placeholder there), when `name` is itself a GUID (an author may write the
+ * resource key directly), or when any entry answers to `name`. "Answers" is the
+ * union of `entry()`, `resolve()` and `declared()`, so an entry that is declared
+ * but carries no `resourceKey` is NOT refused here — it stays the
+ * `CONNECTION_STUB` warning, which is the route a simulated or validate-only task
+ * with nothing real to bind is meant to take.
+ */
+export function undeclaredBinding(bindings, name) {
+    if (!bindings || typeof bindings.declared !== 'function')
+        return undefined;
+    const declared = bindings.declared();
+    if (declared.length === 0)
+        return undefined;
+    if (GUID_RE.test(name))
+        return undefined;
+    if (declared.includes(name))
+        return undefined;
+    if (typeof bindings.entry === 'function' && bindings.entry(name) !== undefined)
+        return undefined;
+    if (bindings.resolve(name) !== undefined)
+        return undefined;
+    return declared;
+}
+function prepareFor(target) {
+    return prepareCommand(target?.key ?? '<connector-key>', target?.action ?? '<action>');
+}
+/**
+ * Why compile refuses `name`, and how to bind it.
+ *
+ * It names NO declared label as the one to use. bindings.json rows carry a label,
+ * a resource key and a kind (`ConnectionId` / `FolderKey`), never the connector
+ * they were bound for, so compile cannot tell which declared label — if any — is
+ * this connector's. Suggesting one sent a Data Service step to `connection:
+ * 'slack'` (the only `ConnectionId` row), and following that compiled the Slack
+ * connection id into the Data Service node with no warning at all: a real GUID of
+ * the wrong connector, which nothing downstream detects. The partial-prepare shape
+ * (ipe-drive-to-slack 09-23: `slack` bound, `drive` not yet) is exactly where
+ * that advice was on offer. So the message lists what is declared, says that a
+ * row is only reusable if it was bound for THIS connector, and gives the
+ * `prepare` command for this step's own connector and operation.
+ */
+export function bindingUndeclaredMessage(where, name, attribute, declared, target) {
+    const key = attribute === 'connection' ? 'connection id' : 'folder key';
+    const flag = attribute === 'connection' ? '--bind-connection' : '--bind-folder';
+    return `${where}: ${attribute} "${name}" is not declared in bindings.json (it declares: ${declared.join(', ')}), `
+        + `so the .flow would carry "${name}" as its ${key} and the run would fault with `
+        + `"'Connection' has an invalid GUID value: '${name}'". Bind this one: `
+        + `\`${prepareFor(target)} ${flag} ${name}\` (several candidates: add \`--connection-id <id>\` from the list it prints). `
+        + `Switch to a declared label only if that row was bound for this same connector: bindings.json does not record `
+        + `which connector a row belongs to, and another connector's ${key} compiles without any warning and faults only at run time. `
+        + `A connector with nothing real to bind yet (a simulated or validate-only task, or one not prepared yet) `
+        + `declares the label with a placeholder resourceKey instead, which compiles with a CONNECTION_STUB warning — `
+        + `never an invented GUID.`;
+}

package/dist/serialize.js

@@ -14,7 +14,7 @@ import { Expr, toExpr, SCHEDULE_PRESETS, DELAY_PRESETS, parseIxpProjectType, fla
 import { FlowAction, FlowTrigger } from './core/node-classes.js';
 import { connectorRawNodeRefusal } from './core/connector-raw-node.js';
 import { dataFabricUnknownInputs } from './core/typed-raw-node.js';
-import { bindingSelfNameMessage } from './core/binding-messages.js';
+import { BindingRefusal, GUID_RE, bindingSelfNameMessage, bindingUndeclaredMessage, undeclaredBinding } from './core/binding-messages.js';
 import { OUTCOME_HANDLE_NODE_TYPES, assertHitlExitInvariant, hitlExitModel, hitlExitViolation, outcomeSlug } from './core/hitl-routing.js';
 import { declaredExits, hasExits, stopsAtEnd } from './core/step-ports.js';
 import { buildConfiguration, transportHttpMethod } from './config.js';
@@ -3064,8 +3064,6 @@ function renderValue(val, rename = NO_RENAME) {
         return val.literal ? val.value : '=js:' + renameRefs(val.js, rename);
     return val;
 }
-/** A tenant resource key — an Integration Service connection id or an Orchestrator folder key — is a GUID. */
-const GUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 /**
  * The all-zero prefix authors reach for when they need "a GUID" and have none:
  * `00000000-0000-0000-0000-000000000001`. No tenant issues these. The same
@@ -3087,6 +3085,12 @@ function connectionStubReason(value) {
         return 'not a GUID';
     return undefined;
 }
+/** What `registry prepare` takes for an event subscription: its connector key and curated event name. */
+function eventTarget(sub) {
+    return typeof sub.connector === 'string' && sub.connector !== ''
+        ? { key: sub.connector, ...(typeof sub.event === 'string' && sub.event !== '' ? { action: sub.event } : {}) }
+        : undefined;
+}
 /**
  * Resolve a symbolic connection/folder name to the resource key that is inlined
  * as `connectionId` / `connectionFolderKey`.
@@ -3100,30 +3104,55 @@ function connectionStubReason(value) {
  * `bindings.json` that never declares the name, and one that declares it with
  * its own name as the `resourceKey`.
  *
- * Only the SELF-REFERENTIAL case is an error here. Emitting the symbolic name
- * when nothing resolves it is long-established and deliberate — compiling
- * against partial or absent bindings is how a flow is authored offline, and the
- * name is the only honest placeholder available. A binding that declares the
- * name and then answers with the name is different: someone wrote the entry, so
- * the intent to bind is explicit, and the one thing it cannot mean is "the
- * resource key is the string `is-sandboxes`".
+ * Two cases are errors here, and they are the two where the author's intent to
+ * bind is on record and the emitted value still cannot be a resource key:
+ *
+ * - SELF-REFERENTIAL (`BINDING_SELF_NAME`): an entry declares the name and then
+ *   answers with the name. Someone wrote the entry, and the one thing it cannot
+ *   mean is "the resource key is the string `is-sandboxes`".
+ * - UNDECLARED IN A POPULATED FILE (`BINDING_UNDECLARED`): bindings.json declares
+ *   entries, none of them answers to this label, and the label is not itself a
+ *   GUID. The file is the author's statement of what is bound, so a label it
+ *   does not carry is a mismatch between two names for one connection, not
+ *   offline authoring. Measured: the 2026-09-23 orchestrator-paths run bound
+ *   `slack` (prepare's default label) while the source said `is-sandboxes`;
+ *   compile warned, exited 0, and the Slack node answered `400 'Connection' has
+ *   an invalid GUID value: 'is-sandboxes'`. Across the eval archive this shape
+ *   warned 15 times; 13 were fixed before the final compile and the 2 that were
+ *   not are that row's failures (09-18, 09-23) — no green run shipped it.
  *
  * Everything else that cannot be a resource key is a WARNING (`CONNECTION_STUB`),
- * never an error: an unbound symbol, an all-zero GUID, an `<angle>` placeholder,
- * a label. The archive shows those in green runs of simulated and validate-only
- * tasks, where no connection exists to bind — refusing them would push an author
- * with nothing real to bind into inventing a plausible GUID instead, which is
- * worse because nothing can tell. But the 2026-09-01 orchestrator-paths run
- * compiled `00000000-0000-0000-0000-000000000001` with no signal at all and the
- * Slack node answered `401 Invalid Organization or User secret` at dispatch;
- * the author deserves to hear that BEFORE the run.
+ * never an error: a symbol when NO bindings.json is loaded or it declares no
+ * entries, an entry declared without a resourceKey, an all-zero GUID, an
+ * `<angle>` placeholder, a label. Compiling against absent bindings is how a flow
+ * is authored offline, and the name is the only honest placeholder available;
+ * the archive shows those in green runs of simulated and validate-only tasks,
+ * where no connection exists to bind. Refusing them would push an author with
+ * nothing real to bind into inventing a plausible GUID instead, which is worse
+ * because nothing can tell. That is also the route for a connector that is not
+ * bound YET in a file that binds others (a two-connector flow with one prepared,
+ * or a simulated connector next to real ones): declare its label with a
+ * placeholder resourceKey and it stays a warning. Mid-loop compiles took that
+ * state in three archived runs (ipe-drive-to-slack 09-23 `drive`, ipe-jira-
+ * lifecycle 09-04 `entra`, customer-escalation-simulated 09-03 `zendesk`), and
+ * each fixed it before the final compile, so what now costs one refused compile
+ * there was never shipped. The 2026-09-01 orchestrator-paths run compiled
+ * `00000000-0000-0000-0000-000000000001` with no signal at all and the Slack node
+ * answered `401 Invalid Organization or User secret` at dispatch; the author
+ * deserves to hear that BEFORE the run.
  */
-function resolveBinding(opts, name, attribute, where) {
+function resolveBinding(opts, name, attribute, where, target) {
     if (name === undefined)
         return undefined;
     const resolved = opts.bindings?.resolve(name);
     if (resolved === name) {
-        throw new Error(bindingSelfNameMessage(where, name, attribute));
+        throw new BindingRefusal('BINDING_SELF_NAME', bindingSelfNameMessage(where, name, attribute, target));
+    }
+    if (resolved === undefined) {
+        const declared = undeclaredBinding(opts.bindings, name);
+        if (declared) {
+            throw new BindingRefusal('BINDING_UNDECLARED', bindingUndeclaredMessage(where, name, attribute, declared, target));
+        }
     }
     const value = resolved ?? name;
     const reason = connectionStubReason(value);
@@ -3136,8 +3165,10 @@ function resolveBinding(opts, name, attribute, where) {
             + `and writes both entries into bindings.json (several candidates: pass \`--connection-id <id>\` from the list it `
             + `prints); by hand, read Id and FolderKey from \`uip is connections list --all-folders --output json\`.`;
         const message = resolved === undefined
-            ? `${where}: ${attribute} "${name}" has no bindings.json entry`
-                + `${describeDeclared(opts.bindings)}, so the .flow carries the symbolic name as its ${key} and the run `
+            ? `${where}: ${declaredWithoutKey(opts.bindings, name)
+                ? `binding "${name}" is declared in bindings.json with no resourceKey`
+                : `${attribute} "${name}" has no bindings.json entry${describeDeclared(opts.bindings)}`}`
+                + `, so the .flow carries the symbolic name as its ${key} and the run `
                 + `faults at dispatch with ${fault}. ${remedy}`
             : `${where}: binding "${name}" resolves to "${value}", which is ${reason} and so never a tenant ${key}. `
                 + `The .flow carries it and the run faults at dispatch with ${fault}. ${remedy}`;
@@ -3145,6 +3176,10 @@ function resolveBinding(opts, name, attribute, where) {
     }
     return value;
 }
+/** An entry answers to `name` but carries no resourceKey or default — the placeholder route, still a warning. */
+function declaredWithoutKey(bindings, name) {
+    return (bindings?.declared?.() ?? []).includes(name) || bindings?.entry?.(name) !== undefined;
+}
 /** " (bindings.json declares: a, b)" / " (no bindings.json was loaded)" — what the author CAN refer to. */
 function describeDeclared(bindings) {
     const names = bindings?.declared?.() ?? [];
@@ -3282,8 +3317,8 @@ function flattenWhere(where, declared) {
     return out;
 }
 function eventDetail(rc, sub, nodeId, opts) {
-    const conn = resolveBinding(opts, sub.connection, 'connection', `event node "${nodeId}"`);
-    const folder = resolveBinding(opts, sub.folder, 'folder', `event node "${nodeId}"`);
+    const conn = resolveBinding(opts, sub.connection, 'connection', `event node "${nodeId}"`, eventTarget(sub));
+    const folder = resolveBinding(opts, sub.folder, 'folder', `event node "${nodeId}"`, eventTarget(sub));
     const op = (rc.entry?.operation ?? {});
     const filters = sub.filters ?? [];
     // A GENERIC event (`activityType: GenericTrigger` — Data Fabric, Salesforce,
@@ -4106,8 +4141,8 @@ export function serialize(built, opts = {}) {
         const { entries } = connectionResourceBindings({
             def: eventTriggerRc.v1def,
             connectorKey: eventTriggerRc.connectorKey,
-            connectionId: resolveBinding(opts, sub.connection, 'connection', 'event trigger'),
-            folderKey: resolveBinding(opts, sub.folder, 'folder', 'event trigger'),
+            connectionId: resolveBinding(opts, sub.connection, 'connection', 'event trigger', eventTarget(sub)),
+            folderKey: resolveBinding(opts, sub.folder, 'folder', 'event trigger', eventTarget(sub)),
         }, resourceBindings);
         for (const b of entries)
             resourceBindings.set(b.id, b);
@@ -4231,8 +4266,8 @@ export function serialize(built, opts = {}) {
             const id = stepUid(scope, step.name);
             const node = makeNode(rc.nodeType, id, step.name, { parentId, requestedVersion: step.options?.version, def: rc.v1def });
             declareListOutputType(node, rc);
-            const conn = resolveBinding(opts, spec.connection, 'connection', `connector "${step.name}"`);
-            const folder = resolveBinding(opts, spec.folder, 'folder', `connector "${step.name}"`);
+            const conn = resolveBinding(opts, spec.connection, 'connection', `connector "${step.name}"`, { key: spec.key, action: spec.action });
+            const folder = resolveBinding(opts, spec.folder, 'folder', `connector "${step.name}"`, { key: spec.key, action: spec.action });
             // The platform reaches the connection through the flow's `bindings[]`,
             // never through `inputs.detail` — without this pair the run faults with
             // `[102010]` (board G-19; see connectionResourceBindings).
@@ -5131,8 +5166,8 @@ export function serialize(built, opts = {}) {
             const { entries: waitConnBindings } = connectionResourceBindings({
                 def: rc.v1def,
                 connectorKey: rc.connectorKey,
-                connectionId: resolveBinding(opts, sub.connection, 'connection', `waitForEvent "${step.name}"`),
-                folderKey: resolveBinding(opts, sub.folder, 'folder', `waitForEvent "${step.name}"`),
+                connectionId: resolveBinding(opts, sub.connection, 'connection', `waitForEvent "${step.name}"`, eventTarget(sub)),
+                folderKey: resolveBinding(opts, sub.folder, 'folder', `waitForEvent "${step.name}"`, eventTarget(sub)),
             }, resourceBindings);
             for (const b of waitConnBindings)
                 resourceBindings.set(b.id, b);
@@ -5986,8 +6021,8 @@ export function serialize(built, opts = {}) {
                 const { entries } = connectionResourceBindings({
                     def: rc.v1def,
                     connectorKey: rc.connectorKey,
-                    connectionId: resolveBinding(opts, sub.connection, 'connection', 'onEvent() entry point'),
-                    folderKey: resolveBinding(opts, sub.folder, 'folder', 'onEvent() entry point'),
+                    connectionId: resolveBinding(opts, sub.connection, 'connection', 'onEvent() entry point', eventTarget(sub)),
+                    folderKey: resolveBinding(opts, sub.folder, 'folder', 'onEvent() entry point', eventTarget(sub)),
                 }, resourceBindings);
                 for (const b of entries)
                     resourceBindings.set(b.id, b);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uipath/maestro-builder-sdk",
-  "version": "6.9.0",
+  "version": "6.9.1",
   "description": "Build UiPath Flow, Case, and BPMN artifacts by writing TypeScript.",
   "license": "MIT",
   "homepage": "https://docs.uipath.com/maestro",
@@ -87,5 +87,5 @@
     "@types/node": "^22.7.0",
     "esbuild": "^0.28.1"
   },
-  "gitref": "b7baf691c4126ec18eb3388d0d0a70b09301f24d"
+  "gitref": "f637225ed0a30014831ffab8733374625126f6fb"
 }