@uipath/admin-tool 1.203.0-preview.205 → 1.204.0-preview.206

package/dist/index-0t7092fj.js

@@ -0,0 +1,2375 @@
+import {
+  ExternalApiResourceApi,
+  ExternalClientApi,
+  GroupApi,
+  ReferenceTokenApi,
+  RobotAccountApi,
+  SettingApi,
+  UserApi,
+  createApiClient,
+  createIdentityConfig
+} from "./tool-mhb6cezm.js";
+import"./tool-016jy57n.js";
+import {
+  DEFAULT_PAGE_SIZE,
+  Option,
+  OutputFormatter,
+  RESULTS,
+  catchError,
+  extractErrorMessage,
+  logger,
+  processContext,
+  splitScopeList
+} from "./tool-v13kh7v7.js";
+import"./tool-1yh8g550.js";
+
+// ../identity-commands/src/commands/external-apps.ts
+var INSTRUCTIONS = {
+  list: "Verify you are logged in. Run 'external-apps list --help' for options.",
+  get: "Verify the app ID exists. Use 'external-apps list' to find valid IDs.",
+  create: "Verify scopes are correct. Provide --user-scope and/or --app-scope.",
+  update: "Verify the app ID is correct.",
+  delete: "Verify the app ID exists. The app may have already been deleted.",
+  generateSecret: "Verify the app ID is correct.",
+  deleteSecret: "Verify the secret ID exists. Use 'external-apps get' to find valid secret IDs.",
+  fedCredList: "Verify the client ID is correct.",
+  fedCredGet: "Verify the credential ID exists. Use 'federated-credentials list' to find valid IDs.",
+  fedCredCreate: "Provide --name, --issuer, --audience, and --subject. These must match the external identity provider.",
+  fedCredUpdate: "Verify the credential ID exists and provide the updated fields.",
+  fedCredDelete: "Verify the credential ID exists. It may have already been deleted."
+};
+var EXTERNAL_APPS_LIST_EXAMPLES = [
+  {
+    Description: "List external apps in a partition",
+    Command: "uip admin external-apps list",
+    Output: {
+      Code: "ExternalClientList",
+      Data: [
+        {
+          id: "my-app",
+          name: "My Application",
+          isConfidential: true
+        }
+      ]
+    }
+  }
+];
+var EXTERNAL_APPS_GET_EXAMPLES = [
+  {
+    Description: "Get external app details",
+    Command: "uip admin external-apps get my-app",
+    Output: {
+      Code: "ExternalClientDetails",
+      Data: {
+        id: "my-app",
+        name: "My Application",
+        isConfidential: true,
+        redirectUri: "https://example.com/callback"
+      }
+    }
+  }
+];
+var EXTERNAL_APPS_CREATE_EXAMPLES = [
+  {
+    Description: "Create a confidential app with application scopes",
+    Command: 'uip admin external-apps create "My App" --app-scope "OR.Folders,OR.Assets"',
+    Output: {
+      Code: "ExternalClientCreated",
+      Data: {
+        id: "my-app",
+        name: "My App",
+        isConfidential: true,
+        secret: "generated-secret-value"
+      }
+    }
+  },
+  {
+    Description: "Create a confidential app with both user and application scopes",
+    Command: 'uip admin external-apps create "My App" --user-scope "OR.Folders" --app-scope "OR.Jobs" --redirect-uri "https://example.com/callback"',
+    Output: {
+      Code: "ExternalClientCreated",
+      Data: {
+        id: "my-app",
+        name: "My App",
+        isConfidential: true,
+        secret: "generated-secret-value"
+      }
+    }
+  },
+  {
+    Description: "Create a non-confidential app with user scopes",
+    Command: 'uip admin external-apps create "My SPA" --non-confidential --user-scope "OR.Folders" --redirect-uri "http://localhost:3000/callback"',
+    Output: {
+      Code: "ExternalClientCreated",
+      Data: {
+        id: "my-spa",
+        name: "My SPA",
+        isConfidential: false
+      }
+    }
+  }
+];
+var EXTERNAL_APPS_GENERATE_SECRET_EXAMPLES = [
+  {
+    Description: "Generate a new secret for an external app",
+    Command: "uip admin external-apps generate-secret my-app",
+    Output: {
+      Code: "ExternalClientSecretGenerated",
+      Data: {
+        id: 1,
+        secret: "generated-secret-value"
+      }
+    }
+  }
+];
+var EXTERNAL_APPS_UPDATE_EXAMPLES = [
+  {
+    Description: "Update app name and scopes",
+    Command: 'uip admin external-apps update my-app-id --name "Updated App" --app-scope "OR.Folders"',
+    Output: {
+      Code: "ExternalClientUpdated"
+    }
+  }
+];
+var EXTERNAL_APPS_DELETE_EXAMPLES = [
+  {
+    Description: "Delete an external app",
+    Command: "uip admin external-apps delete my-app-id",
+    Output: {
+      Code: "ExternalClientDeleted",
+      Data: { Id: "my-app-id", Status: "Deleted successfully" }
+    }
+  }
+];
+var EXTERNAL_APPS_DELETE_SECRET_EXAMPLES = [
+  {
+    Description: "Delete a secret from an external app",
+    Command: "uip admin external-apps delete-secret 12345",
+    Output: {
+      Code: "ExternalClientSecretDeleted",
+      Data: { Id: "12345", Status: "Deleted successfully" }
+    }
+  }
+];
+var FED_CRED_LIST_EXAMPLES = [
+  {
+    Description: "List federated credentials for an external app",
+    Command: "uip admin external-apps federated-credentials list my-app-id",
+    Output: {
+      Code: "FederatedCredentialList",
+      Data: [
+        {
+          id: "fc000000-0000-0000-0000-000000000001",
+          name: "GitHub Actions",
+          issuer: "https://token.actions.githubusercontent.com"
+        }
+      ]
+    }
+  }
+];
+var FED_CRED_GET_EXAMPLES = [
+  {
+    Description: "Get a federated credential by ID",
+    Command: "uip admin external-apps federated-credentials get my-app-id fc000000-0000-0000-0000-000000000001",
+    Output: {
+      Code: "FederatedCredentialDetails",
+      Data: {
+        id: "fc000000-0000-0000-0000-000000000001",
+        name: "GitHub Actions",
+        issuer: "https://token.actions.githubusercontent.com",
+        audience: "api://AzureADTokenExchange",
+        subject: "repo:org/repo:ref:refs/heads/main"
+      }
+    }
+  }
+];
+var FED_CRED_CREATE_EXAMPLES = [
+  {
+    Description: "Create a federated credential for GitHub Actions OIDC",
+    Command: 'uip admin external-apps federated-credentials create my-app-id --name "GitHub Actions" --issuer "https://token.actions.githubusercontent.com" --audience "api://AzureADTokenExchange" --subject "repo:org/repo:ref:refs/heads/main"',
+    Output: {
+      Code: "FederatedCredentialCreated"
+    }
+  }
+];
+var FED_CRED_UPDATE_EXAMPLES = [
+  {
+    Description: "Update a federated credential",
+    Command: 'uip admin external-apps federated-credentials update my-app-id fc000000-0000-0000-0000-000000000001 --name "GitHub Actions (prod)" --issuer "https://token.actions.githubusercontent.com" --audience "api://AzureADTokenExchange" --subject "repo:org/repo:environment:production"',
+    Output: {
+      Code: "FederatedCredentialUpdated"
+    }
+  }
+];
+var FED_CRED_DELETE_EXAMPLES = [
+  {
+    Description: "Delete a federated credential",
+    Command: "uip admin external-apps federated-credentials delete my-app-id fc000000-0000-0000-0000-000000000001",
+    Output: {
+      Code: "FederatedCredentialDeleted",
+      Data: {
+        Id: "fc000000-0000-0000-0000-000000000001",
+        Status: "Deleted successfully"
+      }
+    }
+  }
+];
+function parseScopes(list, type) {
+  return splitScopeList(list).map((name) => ({ name, type }));
+}
+function foldDeprecatedScopeAlias(options) {
+  if (options.scope !== undefined && options.appScope === undefined) {
+    options.appScope = options.scope;
+    return "--scope";
+  }
+  return "--app-scope";
+}
+function findBlankScopeOption(options, appScopeOption) {
+  if (options.userScope !== undefined && splitScopeList(options.userScope).length === 0) {
+    return "--user-scope";
+  }
+  if (options.appScope !== undefined && splitScopeList(options.appScope).length === 0) {
+    return appScopeOption;
+  }
+  return;
+}
+function reportBlankScopeOption(option) {
+  OutputFormatter.error({
+    Result: RESULTS.Failure,
+    Message: `No scope names found in ${option}.`,
+    Instructions: `Pass one or more scopes, comma- or space-separated (e.g. ${option} "OR.Folders,OR.Assets").`
+  });
+  processContext.exit(1);
+}
+function warnDeprecatedOrganization(org) {
+  if (org !== undefined) {
+    logger.warn("--organization is deprecated and ignored; organization is derived from login context");
+  }
+}
+var registerExternalAppsCommand = (program) => {
+  const externalApps = program.command("external-apps").description("Manage external OAuth2 clients. List, get, create, update, delete clients and manage secrets.");
+  externalApps.command("list").description("List external apps in a partition.").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(EXTERNAL_APPS_LIST_EXAMPLES).trackedAction(processContext, async (options) => {
+    warnDeprecatedOrganization(options.organization);
+    const [error, result] = await catchError((async () => {
+      const { api, organizationId } = await createApiClient(ExternalClientApi, {
+        loginValidity: options.loginValidity,
+        organization: options.organization
+      });
+      const orgId = organizationId;
+      return await api.externalClientGet({
+        partitionGlobalId: orgId
+      });
+    })());
+    if (error) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: await extractErrorMessage(error),
+        Instructions: INSTRUCTIONS.list
+      });
+      processContext.exit(1);
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "ExternalClientList",
+      Data: result ?? []
+    });
+  });
+  externalApps.command("get").description("Get external app details. " + "Use 'external-apps list' to retrieve the client ID.").argument("<client-id>", "External app ID").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(EXTERNAL_APPS_GET_EXAMPLES).trackedAction(processContext, async (clientId, options) => {
+    warnDeprecatedOrganization(options.organization);
+    const [error, client] = await catchError((async () => {
+      const { api, organizationId } = await createApiClient(ExternalClientApi, {
+        loginValidity: options.loginValidity,
+        organization: options.organization
+      });
+      const orgId = organizationId;
+      return await api.externalClientGetWithClientId({
+        partitionGlobalId: orgId,
+        clientId
+      });
+    })());
+    if (error) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: await extractErrorMessage(error),
+        Instructions: INSTRUCTIONS.get
+      });
+      processContext.exit(1);
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "ExternalClientDetails",
+      Data: client
+    });
+  });
+  externalApps.command("create").description("Create an external app (confidential by default). " + "Use --non-confidential for public clients (SPAs, mobile apps).").argument("<name>", "App display name").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("--redirect-uri <uri>", "Redirect URI(s) for OAuth2 flow (comma-separated for multiple)").option("--user-scope <scopes>", "User (delegated) scopes, comma- or space-separated").option("--app-scope <scopes>", "Application (app-only) scopes, comma- or space-separated").option("--scope <scopes>", "Alias for --app-scope (deprecated)").option("--non-confidential", "Create a non-confidential (public) app — no client secret, requires redirect URI").option("--no-secret", "Skip generating a client secret on creation").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(EXTERNAL_APPS_CREATE_EXAMPLES).trackedAction(processContext, async (name, options) => {
+    warnDeprecatedOrganization(options.organization);
+    const appScopeOption = foldDeprecatedScopeAlias(options);
+    const blankOption = findBlankScopeOption(options, appScopeOption);
+    if (blankOption) {
+      reportBlankScopeOption(blankOption);
+      return;
+    }
+    if (!options.userScope && !options.appScope) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: "At least one of --user-scope or --app-scope is required.",
+        Instructions: "Use --user-scope for delegated permissions and/or --app-scope for app-only permissions."
+      });
+      processContext.exit(1);
+      return;
+    }
+    const isConfidential = !options.nonConfidential;
+    const hasUserScopes = !!options.userScope;
+    if (!isConfidential && options.appScope) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: "Non-confidential apps only support user scopes. Use --user-scope instead of --app-scope.",
+        Instructions: "Remove --app-scope and use --user-scope for delegated permissions."
+      });
+      processContext.exit(1);
+      return;
+    }
+    if (!options.redirectUri && (!isConfidential || hasUserScopes)) {
+      const reason = !isConfidential ? "Non-confidential apps require" : "User scopes require";
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: `${reason} --redirect-uri for the OAuth2 authorization code flow.`,
+        Instructions: "Provide --redirect-uri (e.g. http://localhost:3000/callback)."
+      });
+      processContext.exit(1);
+      return;
+    }
+    const scopes = [
+      ...parseScopes(options.userScope, "user"),
+      ...parseScopes(options.appScope, "application")
+    ];
+    const generateFirstSecret = isConfidential && options.secret !== false;
+    const [error, result] = await catchError((async () => {
+      const { api, organizationId } = await createApiClient(ExternalClientApi, {
+        loginValidity: options.loginValidity,
+        organization: options.organization
+      });
+      const orgId = organizationId;
+      const createCommand = {
+        partitionGlobalId: orgId,
+        name,
+        isConfidential,
+        scopes,
+        redirectUri: options.redirectUri,
+        generateFirstSecret
+      };
+      return await api.externalClientCreate({
+        createExternalClientCommand: createCommand
+      });
+    })());
+    if (error) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: await extractErrorMessage(error),
+        Instructions: INSTRUCTIONS.create
+      });
+      processContext.exit(1);
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "ExternalClientCreated",
+      Data: result
+    });
+  });
+  externalApps.command("update").description("Update an external app. Use 'external-apps list' to retrieve the client ID.").argument("<client-id>", "External app ID").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("-n, --name <name>", "New display name").option("--redirect-uri <uri>", "Redirect URI(s) for OAuth2 flow (comma-separated for multiple)").option("--user-scope <scopes>", "User (delegated) scopes, comma- or space-separated").option("--app-scope <scopes>", "Application (app-only) scopes, comma- or space-separated").option("--scope <scopes>", "Alias for --app-scope (deprecated)").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(EXTERNAL_APPS_UPDATE_EXAMPLES).trackedAction(processContext, async (clientId, options) => {
+    warnDeprecatedOrganization(options.organization);
+    const appScopeOption = foldDeprecatedScopeAlias(options);
+    const hasScopes = options.userScope !== undefined || options.appScope !== undefined;
+    if (options.name === undefined && options.redirectUri === undefined && !hasScopes) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: "No fields to update",
+        Instructions: "Provide at least one of --name, --redirect-uri, --user-scope, or --app-scope."
+      });
+      processContext.exit(1);
+      return;
+    }
+    const blankOption = findBlankScopeOption(options, appScopeOption);
+    if (blankOption) {
+      reportBlankScopeOption(blankOption);
+      return;
+    }
+    const [fetchError, fetchResult] = await catchError((async () => {
+      const { api: api2, organizationId } = await createApiClient(ExternalClientApi, {
+        loginValidity: options.loginValidity,
+        organization: options.organization
+      });
+      const orgId2 = organizationId;
+      const current2 = await api2.externalClientGetWithClientId({
+        partitionGlobalId: orgId2,
+        clientId
+      });
+      return { api: api2, orgId: orgId2, current: current2 };
+    })());
+    if (fetchError) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: await extractErrorMessage(fetchError),
+        Instructions: INSTRUCTIONS.update
+      });
+      processContext.exit(1);
+      return;
+    }
+    const { api, orgId, current } = fetchResult;
+    if (!current.isConfidential && options.appScope) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: "Non-confidential apps only support user scopes. Use --user-scope instead of --app-scope.",
+        Instructions: "Remove --app-scope and use --user-scope for delegated permissions."
+      });
+      processContext.exit(1);
+      return;
+    }
+    const hasUserScopes = options.userScope !== undefined;
+    const effectiveRedirectUri = options.redirectUri ?? current.redirectUri;
+    if (hasUserScopes && !effectiveRedirectUri) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: "User scopes require a redirect URI. Provide --redirect-uri or set one first.",
+        Instructions: "Provide --redirect-uri (e.g. http://localhost:3000/callback)."
+      });
+      processContext.exit(1);
+      return;
+    }
+    const scopes = hasScopes ? [
+      ...parseScopes(options.userScope, "user"),
+      ...parseScopes(options.appScope, "application")
+    ] : current.resources?.flatMap((r) => r.scopes ?? []) ?? [];
+    const updateCommand = {
+      scopes
+    };
+    if (options.name !== undefined)
+      updateCommand.name = options.name;
+    if (options.redirectUri !== undefined)
+      updateCommand.redirectUri = options.redirectUri;
+    const [error, result] = await catchError(api.externalClientUpdate({
+      partitionGlobalId: orgId,
+      clientId,
+      updateExternalClientCommand: updateCommand
+    }));
+    if (error) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: await extractErrorMessage(error),
+        Instructions: INSTRUCTIONS.update
+      });
+      processContext.exit(1);
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "ExternalClientUpdated",
+      Data: result
+    });
+  });
+  externalApps.command("delete").description("Delete an external app. " + "Use 'external-apps list' to retrieve the client ID.").argument("<client-id>", "External app ID").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(EXTERNAL_APPS_DELETE_EXAMPLES).trackedAction(processContext, async (clientId, options) => {
+    warnDeprecatedOrganization(options.organization);
+    const [error] = await catchError((async () => {
+      const { api, organizationId } = await createApiClient(ExternalClientApi, {
+        loginValidity: options.loginValidity,
+        organization: options.organization
+      });
+      const orgId = organizationId;
+      return await api.externalClientDelete({
+        partitionGlobalId: orgId,
+        clientId
+      });
+    })());
+    if (error) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: await extractErrorMessage(error),
+        Instructions: INSTRUCTIONS.delete
+      });
+      processContext.exit(1);
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "ExternalClientDeleted",
+      Data: {
+        Id: clientId,
+        Status: "Deleted successfully"
+      }
+    });
+  });
+  externalApps.command("generate-secret").description("Generate a new secret for an external app. " + "Returns the secret value (only shown once).").argument("<client-id>", "External app ID").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("--description <text>", "Description for the secret").option("--expiration <date>", "Expiration date (ISO 8601)").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(EXTERNAL_APPS_GENERATE_SECRET_EXAMPLES).trackedAction(processContext, async (clientId, options) => {
+    warnDeprecatedOrganization(options.organization);
+    const [error, result] = await catchError((async () => {
+      const { api, organizationId } = await createApiClient(ExternalClientApi, {
+        loginValidity: options.loginValidity,
+        organization: options.organization
+      });
+      const orgId = organizationId;
+      return await api.externalClientGenerateSecret({
+        createClientSecretCommand: {
+          clientId,
+          partitionGlobalId: orgId,
+          description: options.description,
+          expiryTime: options.expiration ? new Date(options.expiration) : undefined
+        }
+      });
+    })());
+    if (error) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: await extractErrorMessage(error),
+        Instructions: INSTRUCTIONS.generateSecret
+      });
+      processContext.exit(1);
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "ExternalClientSecretGenerated",
+      Data: result
+    });
+  });
+  externalApps.command("delete-secret").description("Delete a specific secret from an external app.").argument("<secret-id>", "Secret ID (numeric)").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(EXTERNAL_APPS_DELETE_SECRET_EXAMPLES).trackedAction(processContext, async (secretId, options) => {
+    warnDeprecatedOrganization(options.organization);
+    const [error] = await catchError((async () => {
+      const { api, organizationId } = await createApiClient(ExternalClientApi, {
+        loginValidity: options.loginValidity,
+        organization: options.organization
+      });
+      const orgId = organizationId;
+      return await api.externalClientDeleteSecret({
+        partitionGlobalId: orgId,
+        secretId: Number.parseInt(secretId, 10)
+      });
+    })());
+    if (error) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: await extractErrorMessage(error),
+        Instructions: INSTRUCTIONS.deleteSecret
+      });
+      processContext.exit(1);
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "ExternalClientSecretDeleted",
+      Data: {
+        Id: secretId,
+        Status: "Deleted successfully"
+      }
+    });
+  });
+  const fedCreds = externalApps.command("federated-credentials").description("Manage federated credentials for external apps. " + "Enable workload identity federation with external identity providers (e.g. GitHub Actions, Azure AD).");
+  fedCreds.command("list").description("List federated credentials for an external app.").argument("<client-id>", "External app ID").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(FED_CRED_LIST_EXAMPLES).trackedAction(processContext, async (clientId, options) => {
+    warnDeprecatedOrganization(options.organization);
+    const [error, result] = await catchError((async () => {
+      const { api, organizationId } = await createApiClient(ExternalClientApi, {
+        loginValidity: options.loginValidity,
+        organization: options.organization
+      });
+      const orgId = organizationId;
+      return await api.externalClientGetFederatedCredentials({
+        partitionGlobalId: orgId,
+        clientId
+      });
+    })());
+    if (error) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: await extractErrorMessage(error),
+        Instructions: INSTRUCTIONS.fedCredList
+      });
+      processContext.exit(1);
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "FederatedCredentialList",
+      Data: result ?? []
+    });
+  });
+  fedCreds.command("get").description("Get a federated credential by ID.").argument("<client-id>", "External app ID").argument("<credential-id>", "Federated credential ID (UUID)").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(FED_CRED_GET_EXAMPLES).trackedAction(processContext, async (clientId, credentialId, options) => {
+    warnDeprecatedOrganization(options.organization);
+    const [error, result] = await catchError((async () => {
+      const { api, organizationId } = await createApiClient(ExternalClientApi, {
+        loginValidity: options.loginValidity,
+        organization: options.organization
+      });
+      const orgId = organizationId;
+      return await api.externalClientGetFederatedCredentialByIdByCredentialId({
+        partitionGlobalId: orgId,
+        clientId,
+        credentialId
+      });
+    })());
+    if (error) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: await extractErrorMessage(error),
+        Instructions: INSTRUCTIONS.fedCredGet
+      });
+      processContext.exit(1);
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "FederatedCredentialDetails",
+      Data: result
+    });
+  });
+  fedCreds.command("create").description("Create a federated credential for an external app. " + "Maps an external identity (e.g. GitHub Actions OIDC) to this app.").argument("<client-id>", "External app ID").requiredOption("-n, --name <name>", "Credential name").requiredOption("--issuer <url>", "Token issuer URL (e.g. https://token.actions.githubusercontent.com)").requiredOption("--audience <audience>", "Expected audience claim (e.g. api://AzureADTokenExchange)").requiredOption("--subject <subject>", "Expected subject claim (e.g. repo:org/repo:ref:refs/heads/main)").option("--description <text>", "Description for the credential").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(FED_CRED_CREATE_EXAMPLES).trackedAction(processContext, async (clientId, options) => {
+    warnDeprecatedOrganization(options.organization);
+    const [error, result] = await catchError((async () => {
+      const { api, organizationId } = await createApiClient(ExternalClientApi, {
+        loginValidity: options.loginValidity,
+        organization: options.organization
+      });
+      const orgId = organizationId;
+      const cmd = {
+        name: options.name,
+        issuer: options.issuer,
+        audience: options.audience,
+        subject: options.subject,
+        description: options.description
+      };
+      return await api.externalClientCreateFederatedCredential({
+        partitionGlobalId: orgId,
+        clientId,
+        createFederatedCredentialCommand: cmd
+      });
+    })());
+    if (error) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: await extractErrorMessage(error),
+        Instructions: INSTRUCTIONS.fedCredCreate
+      });
+      processContext.exit(1);
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "FederatedCredentialCreated",
+      Data: result
+    });
+  });
+  fedCreds.command("update").description("Update a federated credential.").argument("<client-id>", "External app ID").argument("<credential-id>", "Federated credential ID (UUID)").requiredOption("-n, --name <name>", "Credential name").requiredOption("--issuer <url>", "Token issuer URL").requiredOption("--audience <audience>", "Expected audience claim").requiredOption("--subject <subject>", "Expected subject claim").option("--description <text>", "Description for the credential").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(FED_CRED_UPDATE_EXAMPLES).trackedAction(processContext, async (clientId, credentialId, options) => {
+    warnDeprecatedOrganization(options.organization);
+    const [error, result] = await catchError((async () => {
+      const { api, organizationId } = await createApiClient(ExternalClientApi, {
+        loginValidity: options.loginValidity,
+        organization: options.organization
+      });
+      const orgId = organizationId;
+      const cmd = {
+        name: options.name,
+        issuer: options.issuer,
+        audience: options.audience,
+        subject: options.subject,
+        description: options.description
+      };
+      return await api.externalClientUpdateFederatedCredential({
+        partitionGlobalId: orgId,
+        clientId,
+        credentialId,
+        updateFederatedCredentialCommand: cmd
+      });
+    })());
+    if (error) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: await extractErrorMessage(error),
+        Instructions: INSTRUCTIONS.fedCredUpdate
+      });
+      processContext.exit(1);
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "FederatedCredentialUpdated",
+      Data: result
+    });
+  });
+  fedCreds.command("delete").description("Delete a federated credential from an external app.").argument("<client-id>", "External app ID").argument("<credential-id>", "Federated credential ID (UUID)").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(FED_CRED_DELETE_EXAMPLES).trackedAction(processContext, async (clientId, credentialId, options) => {
+    warnDeprecatedOrganization(options.organization);
+    const [error] = await catchError((async () => {
+      const { api, organizationId } = await createApiClient(ExternalClientApi, {
+        loginValidity: options.loginValidity,
+        organization: options.organization
+      });
+      const orgId = organizationId;
+      return await api.externalClientDeleteFederatedCredential({
+        partitionGlobalId: orgId,
+        clientId,
+        credentialId
+      });
+    })());
+    if (error) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: await extractErrorMessage(error),
+        Instructions: INSTRUCTIONS.fedCredDelete
+      });
+      processContext.exit(1);
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "FederatedCredentialDeleted",
+      Data: {
+        Id: credentialId,
+        Status: "Deleted successfully"
+      }
+    });
+  });
+};
+
+// ../identity-commands/src/commands/groups.ts
+var INSTRUCTIONS2 = {
+  list: "Verify you are logged in. Run 'groups list --help' for options.",
+  get: "Verify the group ID exists. Use 'groups list' to find valid IDs.",
+  create: "Verify the group name is correct. Group names must be unique within a partition.",
+  update: "Verify the group ID is correct. Use 'groups list' to find valid IDs.",
+  delete: "Verify the group ID exists. The group may have already been deleted.",
+  listMembers: "Verify the group ID is correct.",
+  addMembers: "Verify the group ID and user IDs are correct. Use 'users list' to find valid user IDs.",
+  revokeMembers: "Verify the user IDs are current members of the group."
+};
+var GROUPS_LIST_EXAMPLES = [
+  {
+    Description: "List groups in a partition",
+    Command: "uip admin groups list",
+    Output: {
+      Code: "GroupList",
+      Data: [
+        {
+          id: "a1b2c3d4-0000-0000-0000-000000000001",
+          name: "Administrators",
+          displayName: "Administrators",
+          type: "BuiltIn",
+          creationTime: "2026-01-15T10:00:00.000Z"
+        }
+      ]
+    }
+  }
+];
+var GROUPS_GET_EXAMPLES = [
+  {
+    Description: "Get group details",
+    Command: "uip admin groups get a1b2c3d4-0000-0000-0000-000000000001",
+    Output: {
+      Code: "GroupDetails",
+      Data: {
+        id: "a1b2c3d4-0000-0000-0000-000000000001",
+        name: "Administrators",
+        displayName: "Administrators",
+        type: "BuiltIn",
+        creationTime: "2026-01-15T10:00:00.000Z"
+      }
+    }
+  }
+];
+var GROUPS_CREATE_EXAMPLES = [
+  {
+    Description: "Create a new group",
+    Command: 'uip admin groups create "DevOps Team"',
+    Output: {
+      Code: "GroupCreated",
+      Data: {
+        id: "a1b2c3d4-0000-0000-0000-000000000002",
+        name: "DevOps Team",
+        displayName: "DevOps Team",
+        type: "Custom"
+      }
+    }
+  }
+];
+var GROUPS_UPDATE_EXAMPLES = [
+  {
+    Description: "Rename a group",
+    Command: 'uip admin groups update a1b2c3d4-0000-0000-0000-000000000001 --name "Renamed Group"',
+    Output: {
+      Code: "GroupUpdated"
+    }
+  }
+];
+var GROUPS_DELETE_EXAMPLES = [
+  {
+    Description: "Delete a group",
+    Command: "uip admin groups delete a1b2c3d4-0000-0000-0000-000000000002",
+    Output: {
+      Code: "GroupDeleted",
+      Data: {
+        Id: "a1b2c3d4-0000-0000-0000-000000000002",
+        Status: "Deleted successfully"
+      }
+    }
+  }
+];
+var MEMBERS_LIST_EXAMPLES = [
+  {
+    Description: "List members of a group",
+    Command: "uip admin groups members list a1b2c3d4-0000-0000-0000-000000000001",
+    Output: {
+      Code: "GroupMembers"
+    }
+  }
+];
+var MEMBERS_ADD_EXAMPLES = [
+  {
+    Description: "Add users to a group",
+    Command: 'uip admin groups members add a1b2c3d4-0000-0000-0000-000000000001 --user-ids "user-id-1,user-id-2"',
+    Output: {
+      Code: "GroupMembersAdded"
+    }
+  }
+];
+var MEMBERS_REVOKE_EXAMPLES = [
+  {
+    Description: "Revoke users from a group",
+    Command: 'uip admin groups members revoke a1b2c3d4-0000-0000-0000-000000000001 --user-ids "user-id-1"',
+    Output: {
+      Code: "GroupMembersRevoked"
+    }
+  }
+];
+function warnDeprecatedOrganization2(org) {
+  if (org !== undefined) {
+    logger.warn("--organization is deprecated and ignored; organization is derived from login context");
+  }
+}
+var registerGroupsCommand = (program) => {
+  const groups = program.command("groups").description("Manage groups. List, get, create, update, and delete groups within a partition.");
+  groups.command("list").description("List all groups in a partition. " + "Returns group ID, name, type, and creation time.").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(GROUPS_LIST_EXAMPLES).trackedAction(processContext, async (options) => {
+    warnDeprecatedOrganization2(options.organization);
+    const [error, result] = await catchError((async () => {
+      const { api, organizationId } = await createApiClient(GroupApi, {
+        loginValidity: options.loginValidity
+      });
+      const orgId = organizationId;
+      return await api.groupGetGroups({
+        partitionGlobalId: orgId
+      });
+    })());
+    if (error) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: await extractErrorMessage(error),
+        Instructions: INSTRUCTIONS2.list
+      });
+      processContext.exit(1);
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "GroupList",
+      Data: result ?? []
+    });
+  });
+  groups.command("get").description("Get group details by ID. " + "Use 'groups list' to retrieve the group ID.").argument("<group-id>", "Group ID (UUID)").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(GROUPS_GET_EXAMPLES).trackedAction(processContext, async (groupId, options) => {
+    warnDeprecatedOrganization2(options.organization);
+    const [error, group] = await catchError((async () => {
+      const { api, organizationId } = await createApiClient(GroupApi, {
+        loginValidity: options.loginValidity
+      });
+      const orgId = organizationId;
+      return await api.groupGetGroup({
+        partitionGlobalId: orgId,
+        groupId
+      });
+    })());
+    if (error) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: await extractErrorMessage(error),
+        Instructions: INSTRUCTIONS2.get
+      });
+      processContext.exit(1);
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "GroupDetails",
+      Data: group
+    });
+  });
+  groups.command("create").description("Create a new local group in a partition.").argument("<name>", "Group name").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(GROUPS_CREATE_EXAMPLES).trackedAction(processContext, async (name, options) => {
+    warnDeprecatedOrganization2(options.organization);
+    const [error, result] = await catchError((async () => {
+      const { api, organizationId } = await createApiClient(GroupApi, {
+        loginValidity: options.loginValidity
+      });
+      const orgId = organizationId;
+      const createCommand = {
+        id: crypto.randomUUID(),
+        name,
+        partitionGlobalId: orgId
+      };
+      return await api.groupCreateGroup({
+        createGroupCommand: createCommand
+      });
+    })());
+    if (error) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: await extractErrorMessage(error),
+        Instructions: INSTRUCTIONS2.create
+      });
+      processContext.exit(1);
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "GroupCreated",
+      Data: result
+    });
+  });
+  groups.command("update").description("Update a group. Use 'groups list' to retrieve the group ID.").argument("<group-id>", "Group ID (UUID)").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("-n, --name <name>", "New group name").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(GROUPS_UPDATE_EXAMPLES).trackedAction(processContext, async (groupId, options) => {
+    warnDeprecatedOrganization2(options.organization);
+    if (options.name === undefined) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: "No fields to update",
+        Instructions: "Provide --name to rename the group."
+      });
+      processContext.exit(1);
+      return;
+    }
+    const [error, result] = await catchError((async () => {
+      const { api, organizationId } = await createApiClient(GroupApi, {
+        loginValidity: options.loginValidity
+      });
+      const orgId = organizationId;
+      const updateCommand = {
+        partitionGlobalId: orgId,
+        name: options.name
+      };
+      return await api.groupUpdateGroup({
+        groupId,
+        updateGroupCommand: updateCommand
+      });
+    })());
+    if (error) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: await extractErrorMessage(error),
+        Instructions: INSTRUCTIONS2.update
+      });
+      processContext.exit(1);
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "GroupUpdated",
+      Data: result
+    });
+  });
+  groups.command("delete").description("Delete a group. " + "Use 'groups list' to retrieve the group ID.").argument("<group-id>", "Group ID (UUID)").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(GROUPS_DELETE_EXAMPLES).trackedAction(processContext, async (groupId, options) => {
+    warnDeprecatedOrganization2(options.organization);
+    const [error] = await catchError((async () => {
+      const { api, organizationId } = await createApiClient(GroupApi, {
+        loginValidity: options.loginValidity
+      });
+      const orgId = organizationId;
+      return await api.groupDelete({
+        partitionGlobalId: orgId,
+        groupId
+      });
+    })());
+    if (error) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: await extractErrorMessage(error),
+        Instructions: INSTRUCTIONS2.delete
+      });
+      processContext.exit(1);
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "GroupDeleted",
+      Data: {
+        Id: groupId,
+        Status: "Deleted successfully"
+      }
+    });
+  });
+  const members = groups.command("members").description("Manage group membership. List, add, or revoke members.");
+  members.command("list").description("List members of a group. " + "Use 'groups list' to retrieve the group ID.").argument("<group-id>", "Group ID (UUID)").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("-l, --limit <number>", "Number of items to return", "50").option("--offset <number>", "Number of items to skip", "0").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(MEMBERS_LIST_EXAMPLES).trackedAction(processContext, async (groupId, options) => {
+    warnDeprecatedOrganization2(options.organization);
+    const [error, result] = await catchError((async () => {
+      const { api, organizationId } = await createApiClient(GroupApi, {
+        loginValidity: options.loginValidity
+      });
+      const orgId = organizationId;
+      return await api.groupGetGroupMembers({
+        partitionGlobalId: orgId,
+        groupId,
+        top: Number.parseInt(options.limit, 10),
+        skip: Number.parseInt(options.offset || "0", 10)
+      });
+    })());
+    if (error) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: await extractErrorMessage(error),
+        Instructions: INSTRUCTIONS2.listMembers
+      });
+      processContext.exit(1);
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "GroupMembers",
+      Data: result.results ?? []
+    });
+  });
+  members.command("add").description("Add users to a group. Pass comma-separated user IDs.").argument("<group-id>", "Group ID (UUID)").option("--organization <id>", "(deprecated, ignored) organization is derived from login").requiredOption("--user-ids <ids>", "Comma-separated user IDs to add").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(MEMBERS_ADD_EXAMPLES).trackedAction(processContext, async (groupId, options) => {
+    warnDeprecatedOrganization2(options.organization);
+    const userIds = options.userIds.split(",").map((id) => id.trim());
+    const [error, result] = await catchError((async () => {
+      const { api, organizationId } = await createApiClient(GroupApi, {
+        loginValidity: options.loginValidity
+      });
+      const orgId = organizationId;
+      const group = await api.groupGetGroup({
+        partitionGlobalId: orgId,
+        groupId
+      });
+      return await api.groupUpdateGroup({
+        groupId,
+        updateGroupCommand: {
+          partitionGlobalId: orgId,
+          name: group.name,
+          directoryUserIDsToAdd: userIds
+        }
+      });
+    })());
+    if (error) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: await extractErrorMessage(error),
+        Instructions: INSTRUCTIONS2.addMembers
+      });
+      processContext.exit(1);
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "GroupMembersAdded",
+      Data: result
+    });
+  });
+  members.command("revoke").description("Revoke users from a group. Pass comma-separated user IDs.").argument("<group-id>", "Group ID (UUID)").option("--organization <id>", "(deprecated, ignored) organization is derived from login").requiredOption("--user-ids <ids>", "Comma-separated user IDs to revoke").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(MEMBERS_REVOKE_EXAMPLES).trackedAction(processContext, async (groupId, options) => {
+    warnDeprecatedOrganization2(options.organization);
+    const userIds = options.userIds.split(",").map((id) => id.trim());
+    const [error, result] = await catchError((async () => {
+      const { api, organizationId } = await createApiClient(GroupApi, {
+        loginValidity: options.loginValidity
+      });
+      const orgId = organizationId;
+      const group = await api.groupGetGroup({
+        partitionGlobalId: orgId,
+        groupId
+      });
+      return await api.groupUpdateGroup({
+        groupId,
+        updateGroupCommand: {
+          partitionGlobalId: orgId,
+          name: group.name,
+          directoryUserIDsToRemove: userIds
+        }
+      });
+    })());
+    if (error) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: await extractErrorMessage(error),
+        Instructions: INSTRUCTIONS2.revokeMembers
+      });
+      processContext.exit(1);
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "GroupMembersRevoked",
+      Data: result
+    });
+  });
+};
+
+// ../identity-commands/src/commands/pat.ts
+var ISO_DATE_PATTERN = /^\d{4}-\d{2}-\d{2}$/;
+function parseIsoDate(value) {
+  if (!ISO_DATE_PATTERN.test(value))
+    return null;
+  const date = new Date(value);
+  if (Number.isNaN(date.getTime()))
+    return null;
+  const [year, month, day] = value.split("-").map(Number);
+  if (date.getUTCFullYear() !== year || date.getUTCMonth() + 1 !== month || date.getUTCDate() !== day) {
+    return null;
+  }
+  return date;
+}
+function parsePaginationInt(value, _name) {
+  const num = Number.parseInt(value, 10);
+  if (Number.isNaN(num) || num < 0 || String(num) !== value)
+    return null;
+  return num;
+}
+var INSTRUCTIONS3 = {
+  list: "Verify you are logged in to the correct organization. Run 'pat list --help' for options.",
+  create: "Provide --description, --expiration, and --scope. Use 'pat list' to verify existing tokens.",
+  revoke: "Verify the token ID exists. Use 'pat list' to find valid IDs.",
+  regenerate: "Verify the token ID exists and provide a new --expiration date."
+};
+var PAT_LIST_EXAMPLES = [
+  {
+    Description: "List personal access tokens",
+    Command: "uip admin pat list",
+    Output: {
+      Code: "PatList",
+      Data: [
+        {
+          id: "a1b2c3d4-0000-0000-0000-000000000001",
+          description: "CI/CD token",
+          expiration: "2027-01-15T00:00:00.000Z",
+          scopes: ["OR.Folders.Read"]
+        }
+      ]
+    }
+  }
+];
+var PAT_CREATE_EXAMPLES = [
+  {
+    Description: "Create a personal access token",
+    Command: 'uip admin pat create --description "CI/CD token" --expiration 2027-01-15 --scope "OR.Folders.Read,OR.Jobs.Read"',
+    Output: {
+      Code: "PatCreated"
+    }
+  }
+];
+var PAT_REVOKE_EXAMPLES = [
+  {
+    Description: "Revoke a personal access token",
+    Command: "uip admin pat revoke a1b2c3d4-0000-0000-0000-000000000001",
+    Output: {
+      Code: "PatRevoked"
+    }
+  }
+];
+var PAT_REGENERATE_EXAMPLES = [
+  {
+    Description: "Regenerate a personal access token with a new expiration",
+    Command: "uip admin pat regenerate a1b2c3d4-0000-0000-0000-000000000001 --expiration 2028-01-15",
+    Output: {
+      Code: "PatRegenerated"
+    }
+  }
+];
+var registerPatCommand = (program) => {
+  const pat = program.command("pat").description("Manage personal access tokens (PATs). " + "Create, list, revoke, and regenerate tokens for API authentication.");
+  pat.command("list").description("List personal access tokens. " + "By default lists your own tokens. Use --scope all to list all tokens in the organization (requires admin).").option("--scope <scope>", 'Token scope: "all" lists all tokens in the org (admin), omit for current user only').option("--search <term>", "Filter tokens by user search term. Implies --scope all.", undefined).option("-l, --limit <number>", "Number of items to return", String(DEFAULT_PAGE_SIZE)).option("--offset <number>", "Number of items to skip", "0").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(PAT_LIST_EXAMPLES).trackedAction(processContext, async (options) => {
+    if (options.scope !== undefined && options.scope !== "all") {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: `Invalid scope: "${options.scope}". Only "all" is supported.`,
+        Instructions: "Use --scope all to list all tokens in the organization, or omit for your own tokens."
+      });
+      processContext.exit(1);
+      return;
+    }
+    const isAll = options.scope === "all" || options.search !== undefined;
+    const top = parsePaginationInt(options.limit, "limit");
+    const skip = parsePaginationInt(options.offset || "0", "offset");
+    if (top === null || skip === null) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: `Invalid pagination: --limit "${options.limit}", --offset "${options.offset || "0"}". Must be non-negative integers.`,
+        Instructions: INSTRUCTIONS3.list
+      });
+      processContext.exit(1);
+      return;
+    }
+    const [error, result] = await catchError((async () => {
+      const { api, organizationId } = await createApiClient(ReferenceTokenApi, {
+        loginValidity: options.loginValidity
+      });
+      if (isAll) {
+        return await api.referenceTokenGetTokensForPartition({
+          partitionGlobalId: organizationId,
+          userSearchTerm: options.search,
+          top,
+          skip
+        });
+      }
+      const tokens = await api.referenceTokenGetTokens();
+      return { results: tokens.slice(skip, skip + top) };
+    })());
+    if (error) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: await extractErrorMessage(error),
+        Instructions: INSTRUCTIONS3.list
+      });
+      processContext.exit(1);
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "PatList",
+      Data: result.results ?? []
+    });
+  });
+  pat.command("create").description("Create a new personal access token. " + "Returns the token value (shown only once).").requiredOption("--description <text>", "Description for the token").requiredOption("--expiration <date>", "Expiration date (ISO 8601, e.g. 2027-01-15)").requiredOption("--scope <scopes>", "Comma-separated list of scopes (e.g. OR.Folders.Read,OR.Jobs.Read)").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(PAT_CREATE_EXAMPLES).trackedAction(processContext, async (options) => {
+    const scopes = options.scope.split(",").map((s) => s.trim()).filter(Boolean);
+    if (scopes.length === 0) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: "No valid scopes provided.",
+        Instructions: "Provide at least one scope (e.g. OR.Folders.Read)."
+      });
+      processContext.exit(1);
+      return;
+    }
+    const expiration = parseIsoDate(options.expiration);
+    if (expiration === null) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: `Invalid expiration date: "${options.expiration}".`,
+        Instructions: "Provide a date in YYYY-MM-DD format (e.g. 2027-01-15)."
+      });
+      processContext.exit(1);
+      return;
+    }
+    const [error, result] = await catchError((async () => {
+      const { api } = await createApiClient(ReferenceTokenApi, {
+        loginValidity: options.loginValidity
+      });
+      return await api.referenceTokenCreateToken({
+        createReferenceTokenCommand: {
+          description: options.description,
+          expiration,
+          scopes
+        }
+      });
+    })());
+    if (error) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: await extractErrorMessage(error),
+        Instructions: INSTRUCTIONS3.create
+      });
+      processContext.exit(1);
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "PatCreated",
+      Data: {
+        Token: result,
+        Warning: "Save this token now. It will not be shown again."
+      }
+    });
+  });
+  pat.command("revoke").description("Revoke a personal access token. " + "Use 'pat list' to retrieve the token ID.").argument("<id>", "Token ID (UUID)").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(PAT_REVOKE_EXAMPLES).trackedAction(processContext, async (tokenId, options) => {
+    const [error] = await catchError((async () => {
+      const { api } = await createApiClient(ReferenceTokenApi, {
+        loginValidity: options.loginValidity
+      });
+      await api.referenceTokenDeleteToken({
+        referenceTokenId: tokenId
+      });
+    })());
+    if (error) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: await extractErrorMessage(error),
+        Instructions: INSTRUCTIONS3.revoke
+      });
+      processContext.exit(1);
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "PatRevoked",
+      Data: {
+        Id: tokenId,
+        Status: "Revoked successfully"
+      }
+    });
+  });
+  pat.command("regenerate").description("Regenerate a personal access token with a new expiration. " + "Returns the new token value (shown only once).").argument("<id>", "Token ID (UUID)").requiredOption("--expiration <date>", "New expiration date (ISO 8601, e.g. 2028-01-15)").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(PAT_REGENERATE_EXAMPLES).trackedAction(processContext, async (tokenId, options) => {
+    const expiration = parseIsoDate(options.expiration);
+    if (expiration === null) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: `Invalid expiration date: "${options.expiration}".`,
+        Instructions: "Provide a date in YYYY-MM-DD format (e.g. 2028-01-15)."
+      });
+      processContext.exit(1);
+      return;
+    }
+    const [error, result] = await catchError((async () => {
+      const { api } = await createApiClient(ReferenceTokenApi, {
+        loginValidity: options.loginValidity
+      });
+      return await api.referenceTokenRegenerateToken({
+        referenceTokenId: tokenId,
+        regenerateReferenceTokenCommand: {
+          expiration
+        }
+      });
+    })());
+    if (error) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: await extractErrorMessage(error),
+        Instructions: INSTRUCTIONS3.regenerate
+      });
+      processContext.exit(1);
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "PatRegenerated",
+      Data: {
+        Id: tokenId,
+        Token: result,
+        Warning: "Save this token now. It will not be shown again."
+      }
+    });
+  });
+};
+
+// ../identity-commands/src/commands/robot-accounts.ts
+var INSTRUCTIONS4 = {
+  list: "Verify you are logged in. Run 'robot-accounts list --help' for options.",
+  get: "Verify the robot account ID exists. Use 'robot-accounts list' to find valid IDs.",
+  create: "Verify the robot account name is correct. Names must be unique within a partition.",
+  update: "Verify the robot account ID is correct.",
+  delete: "Verify the robot account ID exists. The account may have already been deleted."
+};
+var ROBOT_ACCOUNTS_LIST_EXAMPLES = [
+  {
+    Description: "List robot accounts in a partition",
+    Command: "uip admin robot-accounts list --limit 5",
+    Output: {
+      Code: "RobotAccountList",
+      Data: [
+        {
+          id: "a1b2c3d4-0000-0000-0000-000000000001",
+          name: "automation-bot",
+          displayName: "Automation Bot",
+          creationTime: "2026-01-15T10:00:00.000Z"
+        }
+      ]
+    }
+  }
+];
+var ROBOT_ACCOUNTS_GET_EXAMPLES = [
+  {
+    Description: "Get robot account details",
+    Command: "uip admin robot-accounts get a1b2c3d4-0000-0000-0000-000000000001",
+    Output: {
+      Code: "RobotAccountDetails",
+      Data: {
+        id: "a1b2c3d4-0000-0000-0000-000000000001",
+        name: "automation-bot",
+        displayName: "Automation Bot",
+        creationTime: "2026-01-15T10:00:00.000Z",
+        groupIds: []
+      }
+    }
+  }
+];
+var ROBOT_ACCOUNTS_CREATE_EXAMPLES = [
+  {
+    Description: "Create a robot account",
+    Command: 'uip admin robot-accounts create "automation-bot" --display-name "Automation Bot"',
+    Output: {
+      Code: "RobotAccountCreated",
+      Data: {
+        id: "a1b2c3d4-0000-0000-0000-000000000002",
+        name: "automation-bot",
+        displayName: "Automation Bot"
+      }
+    }
+  }
+];
+var ROBOT_ACCOUNTS_UPDATE_EXAMPLES = [
+  {
+    Description: "Update robot account display name",
+    Command: 'uip admin robot-accounts update a1b2c3d4-0000-0000-0000-000000000001 --display-name "Updated Bot"',
+    Output: {
+      Code: "RobotAccountUpdated"
+    }
+  }
+];
+var ROBOT_ACCOUNTS_DELETE_EXAMPLES = [
+  {
+    Description: "Delete a robot account",
+    Command: "uip admin robot-accounts delete a1b2c3d4-0000-0000-0000-000000000001",
+    Output: {
+      Code: "RobotAccountDeleted",
+      Data: {
+        Id: "a1b2c3d4-0000-0000-0000-000000000001",
+        Status: "Deleted successfully"
+      }
+    }
+  }
+];
+function warnDeprecatedOrganization3(org) {
+  if (org !== undefined) {
+    logger.warn("--organization is deprecated and ignored; organization is derived from login context");
+  }
+}
+var registerRobotAccountsCommand = (program) => {
+  const robotAccounts = program.command("robot-accounts").description("Manage robot accounts. List, get, create, update, and delete robot accounts within a partition.");
+  robotAccounts.command("list").description("List robot accounts in a partition. " + "Returns account ID, name, display name, and creation time.").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("-s, --search <term>", "Search by name").option("--sort-by <field>", "Sort results by field (e.g., 'Name')").addOption(new Option("--sort-order <direction>", "Sort direction (default: asc)").choices(["asc", "desc"])).option("-l, --limit <number>", "Number of items to return", String(DEFAULT_PAGE_SIZE)).option("--offset <number>", "Number of items to skip", "0").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(ROBOT_ACCOUNTS_LIST_EXAMPLES).trackedAction(processContext, async (options) => {
+    warnDeprecatedOrganization3(options.organization);
+    const [error, result] = await catchError((async () => {
+      const { api, organizationId } = await createApiClient(RobotAccountApi, {
+        loginValidity: options.loginValidity
+      });
+      const orgId = organizationId;
+      return await api.robotAccountGetRobotAccounts({
+        partitionGlobalId: orgId,
+        searchTerm: options.search,
+        sortBy: options.sortBy,
+        sortOrder: options.sortOrder,
+        top: Number.parseInt(options.limit, 10),
+        skip: Number.parseInt(options.offset || "0", 10)
+      });
+    })());
+    if (error) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: await extractErrorMessage(error),
+        Instructions: INSTRUCTIONS4.list
+      });
+      processContext.exit(1);
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "RobotAccountList",
+      Data: result.results ?? []
+    });
+  });
+  robotAccounts.command("get").description("Get robot account details by ID. " + "Use 'robot-accounts list' to retrieve the ID.").argument("<robot-account-id>", "Robot account ID (UUID)").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(ROBOT_ACCOUNTS_GET_EXAMPLES).trackedAction(processContext, async (robotAccountId, options) => {
+    warnDeprecatedOrganization3(options.organization);
+    const [error, account] = await catchError((async () => {
+      const { api, organizationId } = await createApiClient(RobotAccountApi, {
+        loginValidity: options.loginValidity
+      });
+      const orgId = organizationId;
+      return await api.robotAccountGetRobotAccount({
+        partitionGlobalId: orgId,
+        robotAccountId
+      });
+    })());
+    if (error) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: await extractErrorMessage(error),
+        Instructions: INSTRUCTIONS4.get
+      });
+      processContext.exit(1);
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "RobotAccountDetails",
+      Data: account
+    });
+  });
+  robotAccounts.command("create").description("Create a new robot account in a partition.").argument("<name>", "Robot account name").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("--display-name <display-name>", "Display name").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(ROBOT_ACCOUNTS_CREATE_EXAMPLES).trackedAction(processContext, async (name, options) => {
+    warnDeprecatedOrganization3(options.organization);
+    const [error, result] = await catchError((async () => {
+      const { api, organizationId } = await createApiClient(RobotAccountApi, {
+        loginValidity: options.loginValidity
+      });
+      const orgId = organizationId;
+      const createCommand = {
+        name,
+        displayName: options.displayName ?? name,
+        partitionGlobalId: orgId
+      };
+      return await api.robotAccountCreateRobotAccount({
+        createRobotAccountCommand: createCommand
+      });
+    })());
+    if (error) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: await extractErrorMessage(error),
+        Instructions: INSTRUCTIONS4.create
+      });
+      processContext.exit(1);
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "RobotAccountCreated",
+      Data: result
+    });
+  });
+  robotAccounts.command("update").description("Update a robot account. Use 'robot-accounts list' to retrieve the ID.").argument("<robot-account-id>", "Robot account ID (UUID)").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("--display-name <display-name>", "New display name").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(ROBOT_ACCOUNTS_UPDATE_EXAMPLES).trackedAction(processContext, async (robotAccountId, options) => {
+    warnDeprecatedOrganization3(options.organization);
+    if (options.displayName === undefined) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: "No fields to update",
+        Instructions: "Provide --display-name to update the robot account."
+      });
+      processContext.exit(1);
+      return;
+    }
+    const [error, result] = await catchError((async () => {
+      const { api, organizationId } = await createApiClient(RobotAccountApi, {
+        loginValidity: options.loginValidity
+      });
+      const orgId = organizationId;
+      const updateCommand = {
+        partitionGlobalId: orgId,
+        displayName: options.displayName
+      };
+      return await api.robotAccountUpdateRobotAccount({
+        robotAccountId,
+        updateRobotAccountCommand: updateCommand
+      });
+    })());
+    if (error) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: await extractErrorMessage(error),
+        Instructions: INSTRUCTIONS4.update
+      });
+      processContext.exit(1);
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "RobotAccountUpdated",
+      Data: result
+    });
+  });
+  robotAccounts.command("delete").description("Delete a robot account. " + "Use 'robot-accounts list' to retrieve the ID.").argument("<robot-account-id>", "Robot account ID (UUID)").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(ROBOT_ACCOUNTS_DELETE_EXAMPLES).trackedAction(processContext, async (robotAccountId, options) => {
+    warnDeprecatedOrganization3(options.organization);
+    const [error] = await catchError((async () => {
+      const { api, organizationId } = await createApiClient(RobotAccountApi, {
+        loginValidity: options.loginValidity
+      });
+      const orgId = organizationId;
+      await api.robotAccountDelete({
+        partitionGlobalId: orgId,
+        robotAccountId
+      });
+    })());
+    if (error) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: await extractErrorMessage(error),
+        Instructions: INSTRUCTIONS4.delete
+      });
+      processContext.exit(1);
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "RobotAccountDeleted",
+      Data: {
+        Id: robotAccountId,
+        Status: "Deleted successfully"
+      }
+    });
+  });
+};
+
+// ../identity-commands/src/commands/scopes.ts
+var INSTRUCTIONS5 = {
+  list: "Verify you are logged in. Run 'uip login status' to check."
+};
+var SCOPES_LIST_EXAMPLES = [
+  {
+    Description: "List available OAuth2 scopes",
+    Command: "uip admin scopes list",
+    Output: {
+      Code: "ScopesList",
+      Data: [
+        {
+          name: "UiPath.Orchestrator",
+          displayName: "Orchestrator API Access",
+          scopes: [
+            {
+              name: "OR.Folders",
+              displayName: "OR.Folders",
+              type: "user"
+            }
+          ]
+        }
+      ]
+    }
+  }
+];
+var registerScopesCommand = (program) => {
+  const scopes = program.command("scopes").description("Browse available OAuth2 scopes for external apps and personal access tokens.");
+  scopes.command("list").description("List all available OAuth2 scopes grouped by resource.").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(SCOPES_LIST_EXAMPLES).trackedAction(processContext, async (options) => {
+    const [error, result] = await catchError((async () => {
+      const { api } = await createApiClient(ExternalApiResourceApi, {
+        loginValidity: options.loginValidity
+      });
+      return await api.externalApiResourceGet();
+    })());
+    if (error) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: await extractErrorMessage(error),
+        Instructions: INSTRUCTIONS5.list
+      });
+      processContext.exit(1);
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "ScopesList",
+      Data: result ?? []
+    });
+  });
+};
+
+// ../identity-commands/src/commands/smtp.ts
+var SMTP_SETTING_KEYS = [
+  "Email.Smtp.Host",
+  "Email.Smtp.Port",
+  "Email.Smtp.UserName",
+  "Email.Smtp.Password",
+  "Email.Smtp.Domain",
+  "Email.Smtp.EnableSsl",
+  "Email.Smtp.UseDefaultCredentials",
+  "Email.Smtp.FromEmail",
+  "Email.Smtp.FromDisplayName",
+  "Email.Smtp.ConnectionTimeout"
+];
+var SMTP_SETTING_KEYS_READ = SMTP_SETTING_KEYS.filter((k) => k !== "Email.Smtp.Password");
+var INSTRUCTIONS6 = {
+  get: "Verify you are logged in to the correct organization. Run 'smtp get --help' for options.",
+  update: "Verify you are logged in and at least one SMTP field is provided.",
+  delete: "Verify you are logged in. The settings may have already been deleted.",
+  test: "Verify --recipient is a valid email address. Use 'smtp get' to check current settings."
+};
+function settingsToSmtpData(settings) {
+  const data = {};
+  for (const setting of settings) {
+    switch (setting.key) {
+      case "Email.Smtp.Host":
+        data.host = setting.value ?? undefined;
+        break;
+      case "Email.Smtp.Port":
+        data.port = setting.value ?? undefined;
+        break;
+      case "Email.Smtp.UserName":
+        data.userName = setting.value ?? undefined;
+        break;
+      case "Email.Smtp.Domain":
+        data.domain = setting.value ?? undefined;
+        break;
+      case "Email.Smtp.EnableSsl":
+        data.enableSsl = setting.value ?? undefined;
+        break;
+      case "Email.Smtp.UseDefaultCredentials":
+        data.useDefaultCredentials = setting.value ?? undefined;
+        break;
+      case "Email.Smtp.FromEmail":
+        data.fromAddress = setting.value ?? undefined;
+        break;
+      case "Email.Smtp.FromDisplayName":
+        data.fromDisplayName = setting.value ?? undefined;
+        break;
+      case "Email.Smtp.ConnectionTimeout":
+        data.connectionTimeout = setting.value ?? undefined;
+        break;
+    }
+  }
+  return data;
+}
+function settingsToSmtpConfig(settings) {
+  const config = {};
+  for (const setting of settings) {
+    const val = setting.value ?? undefined;
+    switch (setting.key) {
+      case "Email.Smtp.Host":
+        config.host = val;
+        break;
+      case "Email.Smtp.Port":
+        config.port = val ? Number.parseInt(val, 10) : undefined;
+        break;
+      case "Email.Smtp.UserName":
+        config.userName = val;
+        break;
+      case "Email.Smtp.Password":
+        config.password = val;
+        break;
+      case "Email.Smtp.Domain":
+        config.domain = val;
+        break;
+      case "Email.Smtp.EnableSsl":
+        config.enableSsl = val?.toLowerCase() === "true";
+        break;
+      case "Email.Smtp.UseDefaultCredentials":
+        config.useDefaultCredentials = val?.toLowerCase() === "true";
+        break;
+      case "Email.Smtp.FromEmail":
+        config.fromAddress = val;
+        break;
+      case "Email.Smtp.FromDisplayName":
+        config.fromDisplayName = val;
+        break;
+      case "Email.Smtp.ConnectionTimeout":
+        config.connectionTimeout = val ? Number.parseInt(val, 10) : undefined;
+        break;
+    }
+  }
+  return config;
+}
+function stripUndefined(obj) {
+  const result = {};
+  for (const [key, value] of Object.entries(obj)) {
+    if (value !== undefined) {
+      result[key] = value;
+    }
+  }
+  return result;
+}
+function buildSettingsFromOptions(options) {
+  const settings = [];
+  if (options.host !== undefined) {
+    settings.push({ key: "Email.Smtp.Host", value: options.host });
+  }
+  if (options.port !== undefined) {
+    settings.push({ key: "Email.Smtp.Port", value: options.port });
+  }
+  if (options.username !== undefined) {
+    settings.push({ key: "Email.Smtp.UserName", value: options.username });
+  }
+  if (options.password !== undefined) {
+    settings.push({ key: "Email.Smtp.Password", value: options.password });
+  }
+  if (options.domain !== undefined) {
+    settings.push({ key: "Email.Smtp.Domain", value: options.domain });
+  }
+  if (options.enableSsl !== undefined) {
+    settings.push({
+      key: "Email.Smtp.EnableSsl",
+      value: options.enableSsl
+    });
+  }
+  if (options.useDefaultCredentials !== undefined) {
+    settings.push({
+      key: "Email.Smtp.UseDefaultCredentials",
+      value: options.useDefaultCredentials
+    });
+  }
+  if (options.fromAddress !== undefined) {
+    settings.push({
+      key: "Email.Smtp.FromEmail",
+      value: options.fromAddress
+    });
+  }
+  if (options.fromDisplayName !== undefined) {
+    settings.push({
+      key: "Email.Smtp.FromDisplayName",
+      value: options.fromDisplayName
+    });
+  }
+  if (options.connectionTimeout !== undefined) {
+    settings.push({
+      key: "Email.Smtp.ConnectionTimeout",
+      value: options.connectionTimeout
+    });
+  }
+  return settings;
+}
+function buildSmtpConfig(options) {
+  const hasAny = options.host !== undefined || options.port !== undefined || options.username !== undefined || options.password !== undefined || options.domain !== undefined || options.enableSsl !== undefined || options.useDefaultCredentials !== undefined || options.fromAddress !== undefined || options.fromDisplayName !== undefined || options.connectionTimeout !== undefined;
+  if (!hasAny) {
+    return;
+  }
+  return {
+    host: options.host,
+    port: options.port !== undefined ? Number.parseInt(options.port, 10) : undefined,
+    userName: options.username,
+    password: options.password,
+    domain: options.domain,
+    enableSsl: options.enableSsl !== undefined ? options.enableSsl === "true" : undefined,
+    useDefaultCredentials: options.useDefaultCredentials !== undefined ? options.useDefaultCredentials === "true" : undefined,
+    fromAddress: options.fromAddress,
+    fromDisplayName: options.fromDisplayName,
+    connectionTimeout: options.connectionTimeout !== undefined ? Number.parseInt(options.connectionTimeout, 10) : undefined
+  };
+}
+var SMTP_GET_EXAMPLES = [
+  {
+    Description: "Get current SMTP settings",
+    Command: "uip admin smtp get",
+    Output: {
+      Code: "SmtpSettings",
+      Data: {
+        host: "smtp.example.com",
+        port: "587",
+        userName: "noreply@example.com",
+        enableSsl: "True",
+        fromAddress: "noreply@example.com",
+        fromDisplayName: "UiPath Platform"
+      }
+    }
+  }
+];
+var SMTP_UPDATE_EXAMPLES = [
+  {
+    Description: "Update SMTP host and port",
+    Command: "uip admin smtp update --host smtp.example.com --port 587",
+    Output: {
+      Code: "SmtpSettingsUpdated"
+    }
+  },
+  {
+    Description: "Configure full SMTP settings",
+    Command: "uip admin smtp update --host smtp.example.com --port 587 --username user@example.com --password secret --from-address noreply@example.com --enable-ssl true",
+    Output: {
+      Code: "SmtpSettingsUpdated"
+    }
+  }
+];
+var SMTP_DELETE_EXAMPLES = [
+  {
+    Description: "Delete all SMTP settings",
+    Command: "uip admin smtp delete",
+    Output: {
+      Code: "SmtpSettingsDeleted",
+      Data: {
+        Status: "Deleted successfully"
+      }
+    }
+  }
+];
+var SMTP_TEST_EXAMPLES = [
+  {
+    Description: "Test current SMTP settings by sending a test email",
+    Command: "uip admin smtp test --recipient admin@example.com",
+    Output: {
+      Code: "SmtpTestSent",
+      Data: {
+        Recipient: "admin@example.com",
+        Status: "Test email sent successfully"
+      }
+    }
+  },
+  {
+    Description: "Test with custom SMTP settings without saving them",
+    Command: "uip admin smtp test --recipient admin@example.com --host smtp.example.com --port 587 --username user@example.com --password secret",
+    Output: {
+      Code: "SmtpTestSent",
+      Data: {
+        Recipient: "admin@example.com",
+        Status: "Test email sent successfully"
+      }
+    }
+  }
+];
+function parsePort(value) {
+  const n = Number(value);
+  if (!Number.isInteger(n) || n < 1 || n > 65535) {
+    throw new Error("Port must be an integer between 1 and 65535.");
+  }
+  return String(n);
+}
+function parseTimeout(value) {
+  const n = Number(value);
+  if (!Number.isInteger(n) || n < 1 || n > 300000) {
+    throw new Error("Connection timeout must be an integer between 1 and 300000.");
+  }
+  return String(n);
+}
+function addSmtpOptions(command) {
+  return command.option("--host <host>", "SMTP server hostname").option("--port <port>", "SMTP server port", parsePort).option("--username <username>", "SMTP authentication username").option("--password <password>", "SMTP authentication password").option("--domain <domain>", "SMTP authentication domain").addOption(new Option("--enable-ssl <value>", "Enable SSL/TLS (true or false)").choices(["true", "false"])).addOption(new Option("--use-default-credentials <value>", "Use Windows default credentials (true or false)").choices(["true", "false"])).option("--from-address <email>", "Sender email address").option("--from-display-name <name>", "Sender display name").option("--connection-timeout <ms>", "Connection timeout in milliseconds (1-300000)", parseTimeout);
+}
+var registerSmtpCommand = (program) => {
+  const smtp = program.command("smtp").description("Manage SMTP email settings. Get, update, delete, and test SMTP configuration.");
+  smtp.command("get").description("Get current SMTP settings for the organization. " + "Returns host, port, sender address, SSL, and timeout configuration. " + "Password values are not returned.").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(SMTP_GET_EXAMPLES).trackedAction(processContext, async (options) => {
+    const [error, result] = await catchError((async () => {
+      const { api, organizationId } = await createApiClient(SettingApi, {
+        loginValidity: options.loginValidity
+      });
+      const orgId = organizationId;
+      return await api.settingGetSettingsBulk({
+        key: SMTP_SETTING_KEYS_READ,
+        partitionGlobalId: orgId
+      });
+    })());
+    if (error) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: await extractErrorMessage(error),
+        Instructions: INSTRUCTIONS6.get
+      });
+      processContext.exit(1);
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "SmtpSettings",
+      Data: settingsToSmtpData(result)
+    });
+  });
+  const update = smtp.command("update").description("Update SMTP settings for the organization. " + "Only provided fields are updated; unspecified fields remain unchanged.").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10));
+  addSmtpOptions(update).examples(SMTP_UPDATE_EXAMPLES).trackedAction(processContext, async (options) => {
+    const userSettings = buildSettingsFromOptions(options);
+    if (userSettings.length === 0) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: "No SMTP fields to update",
+        Instructions: "Provide at least one SMTP option (e.g. --host, --port). Run 'smtp update --help' for all options."
+      });
+      processContext.exit(1);
+      return;
+    }
+    const [error, result] = await catchError((async () => {
+      const { api, organizationId } = await createApiClient(SettingApi, {
+        loginValidity: options.loginValidity
+      });
+      const orgId = organizationId;
+      const existing = await api.settingGetSettingsBulk({
+        key: SMTP_SETTING_KEYS_READ,
+        partitionGlobalId: orgId
+      });
+      const merged = new Map;
+      for (const s of existing) {
+        if (s.key) {
+          merged.set(s.key, s.value ?? null);
+        }
+      }
+      for (const s of userSettings) {
+        merged.set(s.key, s.value ?? null);
+      }
+      const settings = [...merged.entries()].map(([key, value]) => ({ key, value }));
+      return await api.settingUpdateSettings({
+        bulkCreateOrUpdateSettingsCommand: {
+          settings,
+          partitionGlobalId: orgId
+        }
+      });
+    })());
+    if (error) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: await extractErrorMessage(error),
+        Instructions: INSTRUCTIONS6.update
+      });
+      processContext.exit(1);
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "SmtpSettingsUpdated",
+      Data: settingsToSmtpData(result)
+    });
+  });
+  smtp.command("delete").description("Delete all SMTP settings for the organization. " + "This removes all email configuration.").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(SMTP_DELETE_EXAMPLES).trackedAction(processContext, async (options) => {
+    const [error] = await catchError((async () => {
+      const { api, organizationId } = await createApiClient(SettingApi, {
+        loginValidity: options.loginValidity
+      });
+      const orgId = organizationId;
+      return await api.settingBulkDelete({
+        bulkDeleteSettingsCommand: {
+          settings: SMTP_SETTING_KEYS,
+          partitionGlobalId: orgId
+        }
+      });
+    })());
+    if (error) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: await extractErrorMessage(error),
+        Instructions: INSTRUCTIONS6.delete
+      });
+      processContext.exit(1);
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "SmtpSettingsDeleted",
+      Data: {
+        Status: "Deleted successfully"
+      }
+    });
+  });
+  const test = smtp.command("test").description("Test SMTP settings by sending a test email to a recipient. " + "Uses saved settings by default. " + "Pass SMTP options to test custom settings without saving them.").requiredOption("--recipient <email>", "Email address to send the test email to").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10));
+  addSmtpOptions(test).examples(SMTP_TEST_EXAMPLES).trackedAction(processContext, async (options) => {
+    const customConfig = buildSmtpConfig(options);
+    if (customConfig !== undefined && options.password === undefined && options.useDefaultCredentials !== "true") {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: "The --password option is required when testing with custom SMTP settings (unless --use-default-credentials true)",
+        Instructions: "Provide --password, --use-default-credentials true, or omit all SMTP options to test with saved settings."
+      });
+      processContext.exit(1);
+      return;
+    }
+    const [error] = await catchError((async () => {
+      const { api, organizationId } = await createApiClient(SettingApi, {
+        loginValidity: options.loginValidity
+      });
+      let smtpSettings = customConfig;
+      if (smtpSettings !== undefined) {
+        const saved = await api.settingGetSettingsBulk({
+          key: SMTP_SETTING_KEYS_READ,
+          partitionGlobalId: organizationId
+        });
+        const base = settingsToSmtpConfig(saved);
+        smtpSettings = {
+          ...base,
+          ...stripUndefined(smtpSettings)
+        };
+      }
+      return await api.settingVerifySmtpSetting({
+        verifySmtpSettingsCommand: {
+          recipient: options.recipient,
+          smtpSettings
+        }
+      });
+    })());
+    if (error) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: await extractErrorMessage(error),
+        Instructions: INSTRUCTIONS6.test
+      });
+      processContext.exit(1);
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "SmtpTestSent",
+      Data: {
+        Recipient: options.recipient,
+        Status: "Test email sent successfully"
+      }
+    });
+  });
+};
+
+// ../identity-commands/src/commands/users.ts
+var INSTRUCTIONS7 = {
+  list: "Verify you are logged in. Run 'users list --help' for options.",
+  get: "Verify the user ID exists. Use 'users list' to find valid IDs.",
+  create: "Verify --email is correct. The username may already exist.",
+  update: "Verify the user ID exists. Use 'users list' to find valid IDs.",
+  delete: "Verify the user ID exists. The user may have already been deleted.",
+  invite: "Verify the email address is valid and the org allows invitations."
+};
+var USERS_LIST_EXAMPLES = [
+  {
+    Description: "List users in a partition",
+    Command: "uip admin users list --limit 5",
+    Output: {
+      Code: "UserList",
+      Data: [
+        {
+          id: "a1b2c3d4-0000-0000-0000-000000000001",
+          userName: "admin@example.com",
+          email: "admin@example.com",
+          name: "Admin",
+          surname: "User",
+          displayName: "Admin User",
+          creationTime: "2026-01-15T10:00:00.000Z"
+        }
+      ]
+    }
+  }
+];
+var USERS_GET_EXAMPLES = [
+  {
+    Description: "Get user details by ID",
+    Command: "uip admin users get a1b2c3d4-0000-0000-0000-000000000001",
+    Output: {
+      Code: "UserDetails",
+      Data: {
+        id: "a1b2c3d4-0000-0000-0000-000000000001",
+        userName: "admin@example.com",
+        email: "admin@example.com",
+        name: "Admin",
+        surname: "User",
+        displayName: "Admin User",
+        creationTime: "2026-01-15T10:00:00.000Z"
+      }
+    }
+  }
+];
+var USERS_CREATE_EXAMPLES = [
+  {
+    Description: "Create a new user",
+    Command: 'uip admin users create newuser --email "user@example.com" --name "John" --surname "Doe"',
+    Output: {
+      Code: "UserCreated",
+      Data: {
+        Succeeded: true
+      }
+    }
+  }
+];
+var USERS_DELETE_EXAMPLES = [
+  {
+    Description: "Delete a user by ID",
+    Command: "uip admin users delete a1b2c3d4-0000-0000-0000-000000000001",
+    Output: {
+      Code: "UserDeleted",
+      Data: {
+        Id: "a1b2c3d4-0000-0000-0000-000000000001",
+        Status: "Deleted successfully"
+      }
+    }
+  }
+];
+var USERS_UPDATE_EXAMPLES = [
+  {
+    Description: "Update user name and email",
+    Command: 'uip admin users update a1b2c3d4-0000-0000-0000-000000000001 --name "Jane" --surname "Doe" --email "jane@example.com"',
+    Output: {
+      Code: "UserUpdated"
+    }
+  }
+];
+var USERS_INVITE_EXAMPLES = [
+  {
+    Description: "Invite a user by email",
+    Command: 'uip admin users invite --email "user@example.com"',
+    Output: {
+      Code: "UsersInvited",
+      Data: {
+        succeeded: true
+      }
+    }
+  }
+];
+function warnDeprecatedOrganization4(org) {
+  if (org !== undefined) {
+    logger.warn("--organization is deprecated and ignored; organization is derived from login context");
+  }
+}
+var registerUsersCommand = (program) => {
+  const users = program.command("users").description("Manage users. List, get, create, update, and delete users.");
+  users.command("list").description("List users in a partition. " + "Returns user ID, username, email, name, and creation time.").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("-s, --search <term>", "Search users by name or email").option("--sort-by <field>", "Sort results by field (e.g., 'UserName', 'Email')").addOption(new Option("--sort-order <direction>", "Sort direction (default: asc)").choices(["asc", "desc"])).option("-l, --limit <number>", "Number of items to return", String(DEFAULT_PAGE_SIZE)).option("--offset <number>", "Number of items to skip", "0").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(USERS_LIST_EXAMPLES).trackedAction(processContext, async (options) => {
+    warnDeprecatedOrganization4(options.organization);
+    const [error, result] = await catchError((async () => {
+      const { api, organizationId } = await createApiClient(UserApi, {
+        loginValidity: options.loginValidity
+      });
+      const orgId = organizationId;
+      return await api.userGetUsers({
+        partitionGlobalId: orgId,
+        searchTerm: options.search,
+        sortBy: options.sortBy,
+        sortOrder: options.sortOrder,
+        top: Number.parseInt(options.limit, 10),
+        skip: Number.parseInt(options.offset || "0", 10)
+      });
+    })());
+    if (error) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: await extractErrorMessage(error),
+        Instructions: INSTRUCTIONS7.list
+      });
+      processContext.exit(1);
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "UserList",
+      Data: result.results ?? []
+    });
+  });
+  users.command("get").description("Get user details by ID. Use 'users list' to retrieve the user ID.").argument("<user-id>", "User ID (UUID)").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(USERS_GET_EXAMPLES).trackedAction(processContext, async (userId, options) => {
+    warnDeprecatedOrganization4(options.organization);
+    const [error, user] = await catchError((async () => {
+      const { api } = await createApiClient(UserApi, {
+        loginValidity: options.loginValidity
+      });
+      return await api.userGetUser({ userId });
+    })());
+    if (error) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: await extractErrorMessage(error),
+        Instructions: INSTRUCTIONS7.get
+      });
+      processContext.exit(1);
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "UserDetails",
+      Data: user
+    });
+  });
+  users.command("create").description("Create a new user. Provide a username and email address.").argument("<username>", "Username for the new user").option("--organization <id>", "(deprecated, ignored) organization is derived from login").requiredOption("-e, --email <email>", "Email address").option("-n, --name <name>", "First name").option("--surname <surname>", "Last name").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(USERS_CREATE_EXAMPLES).trackedAction(processContext, async (username, options) => {
+    warnDeprecatedOrganization4(options.organization);
+    const [error, result] = await catchError((async () => {
+      const { api, organizationId } = await createApiClient(UserApi, {
+        loginValidity: options.loginValidity
+      });
+      const orgId = organizationId;
+      const createCommand = {
+        partitionGlobalId: orgId,
+        userName: username,
+        email: options.email,
+        name: options.name,
+        surname: options.surname
+      };
+      return await api.userCreateUser({
+        createUserCommand: createCommand
+      });
+    })());
+    if (error) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: await extractErrorMessage(error),
+        Instructions: INSTRUCTIONS7.create
+      });
+      processContext.exit(1);
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "UserCreated",
+      Data: result
+    });
+  });
+  users.command("update").description("Update an existing user. Use 'users list' to retrieve the user ID.").argument("<user-id>", "User ID (UUID)").option("-e, --email <email>", "New email address").option("-n, --name <name>", "New first name").option("--surname <surname>", "New last name").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(USERS_UPDATE_EXAMPLES).trackedAction(processContext, async (userId, options) => {
+    warnDeprecatedOrganization4(options.organization);
+    if (options.email === undefined && options.name === undefined && options.surname === undefined) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: "No fields to update",
+        Instructions: "Provide at least one of --email, --name, or --surname."
+      });
+      processContext.exit(1);
+      return;
+    }
+    const updateCommand = {};
+    if (options.email !== undefined)
+      updateCommand.email = options.email;
+    if (options.name !== undefined)
+      updateCommand.name = options.name;
+    if (options.surname !== undefined)
+      updateCommand.surname = options.surname;
+    const [error, result] = await catchError((async () => {
+      const { api } = await createApiClient(UserApi, {
+        loginValidity: options.loginValidity
+      });
+      return await api.userUpdate({
+        userId,
+        updateUserCommand: updateCommand
+      });
+    })());
+    if (error) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: await extractErrorMessage(error),
+        Instructions: INSTRUCTIONS7.update
+      });
+      processContext.exit(1);
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "UserUpdated",
+      Data: result
+    });
+  });
+  users.command("delete").description("Delete a user by ID. Use 'users list' to retrieve the user ID.").argument("<user-id>", "User ID (UUID)").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(USERS_DELETE_EXAMPLES).trackedAction(processContext, async (userId, options) => {
+    warnDeprecatedOrganization4(options.organization);
+    const [error] = await catchError((async () => {
+      const { api } = await createApiClient(UserApi, {
+        loginValidity: options.loginValidity
+      });
+      return await api.userDelete({ userId });
+    })());
+    if (error) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: await extractErrorMessage(error),
+        Instructions: INSTRUCTIONS7.delete
+      });
+      processContext.exit(1);
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "UserDeleted",
+      Data: {
+        Id: userId,
+        Status: "Deleted successfully"
+      }
+    });
+  });
+  users.command("invite").description("Invite users by email. Sends an invitation to join the organization.").requiredOption("-e, --email <emails>", "Comma-separated email addresses to invite").option("-n, --name <name>", "First name for the invited user").option("--surname <surname>", "Last name for the invited user").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(USERS_INVITE_EXAMPLES).trackedAction(processContext, async (options) => {
+    warnDeprecatedOrganization4(options.organization);
+    const [error, result] = await catchError((async () => {
+      const { config } = await createIdentityConfig({
+        loginValidity: options.loginValidity
+      });
+      const baseUrl = config.basePath.replace(/\/[^/]+\/identity_$/, "");
+      const redirectUrl = `${baseUrl}/portal_/cloudrpa`;
+      const api = new UserApi(config);
+      const invitedUsers = options.email.split(",").map((e) => ({
+        email: e.trim(),
+        name: options.name,
+        surname: options.surname,
+        redirectUrl
+      }));
+      return await api.userInviteUsers({
+        invitedUser: invitedUsers
+      });
+    })());
+    if (error) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: await extractErrorMessage(error),
+        Instructions: INSTRUCTIONS7.invite
+      });
+      processContext.exit(1);
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "UsersInvited",
+      Data: result
+    });
+  });
+};
+
+// ../identity-commands/src/index.ts
+var registerCommands = async (program) => {
+  registerExternalAppsCommand(program);
+  registerGroupsCommand(program);
+  registerPatCommand(program);
+  registerRobotAccountsCommand(program);
+  registerScopesCommand(program);
+  registerSmtpCommand(program);
+  registerUsersCommand(program);
+};
+export {
+  registerCommands
+};
+
+//# debugId=BCA0BD64AB49604664756E2164756E21