@uipath/admin-tool 1.203.0-preview.205 → 1.204.0-preview.206

package/dist/index-xd0zd702.js

@@ -0,0 +1,2740 @@
+import {
+  UserApi,
+  createApiClient
+} from "./tool-mhb6cezm.js";
+import {
+  getLoginStatusAsync
+} from "./tool-016jy57n.js";
+import {
+  InvalidArgumentError,
+  Option,
+  OutputFormatter,
+  RESULTS,
+  addSdkUserAgentHeader,
+  catchError,
+  extractErrorMessage,
+  getFileSystem,
+  getSdkUserAgentToken,
+  installSdkUserAgentHeader,
+  processContext
+} from "./tool-v13kh7v7.js";
+import"./tool-1yh8g550.js";
+
+// ../authz-sdk/generated/src/runtime.ts
+var BASE_PATH = "http://localhost".replace(/\/+$/, "");
+
+class Configuration {
+  configuration;
+  constructor(configuration = {}) {
+    this.configuration = configuration;
+  }
+  set config(configuration) {
+    this.configuration = configuration;
+  }
+  get basePath() {
+    return this.configuration.basePath != null ? this.configuration.basePath : BASE_PATH;
+  }
+  get fetchApi() {
+    return this.configuration.fetchApi;
+  }
+  get middleware() {
+    return this.configuration.middleware || [];
+  }
+  get queryParamsStringify() {
+    return this.configuration.queryParamsStringify || querystring;
+  }
+  get username() {
+    return this.configuration.username;
+  }
+  get password() {
+    return this.configuration.password;
+  }
+  get apiKey() {
+    const apiKey = this.configuration.apiKey;
+    if (apiKey) {
+      return typeof apiKey === "function" ? apiKey : () => apiKey;
+    }
+    return;
+  }
+  get accessToken() {
+    const accessToken = this.configuration.accessToken;
+    if (accessToken) {
+      return typeof accessToken === "function" ? accessToken : async () => accessToken;
+    }
+    return;
+  }
+  get headers() {
+    return this.configuration.headers;
+  }
+  get credentials() {
+    return this.configuration.credentials;
+  }
+}
+var DefaultConfig = new Configuration;
+
+class BaseAPI {
+  configuration;
+  static jsonRegex = new RegExp("^(:?application/json|[^;/ \t]+/[^;/ \t]+[+]json)[ \t]*(:?;.*)?$", "i");
+  middleware;
+  constructor(configuration = DefaultConfig) {
+    this.configuration = configuration;
+    this.middleware = configuration.middleware;
+  }
+  withMiddleware(...middlewares) {
+    const next = this.clone();
+    next.middleware = next.middleware.concat(...middlewares);
+    return next;
+  }
+  withPreMiddleware(...preMiddlewares) {
+    const middlewares = preMiddlewares.map((pre) => ({ pre }));
+    return this.withMiddleware(...middlewares);
+  }
+  withPostMiddleware(...postMiddlewares) {
+    const middlewares = postMiddlewares.map((post) => ({ post }));
+    return this.withMiddleware(...middlewares);
+  }
+  isJsonMime(mime) {
+    if (!mime) {
+      return false;
+    }
+    return BaseAPI.jsonRegex.test(mime);
+  }
+  async request(context, initOverrides) {
+    const { url, init } = await this.createFetchParams(context, initOverrides);
+    const response = await this.fetchApi(url, init);
+    if (response && (response.status >= 200 && response.status < 300)) {
+      return response;
+    }
+    throw new ResponseError(response, "Response returned an error code");
+  }
+  async createFetchParams(context, initOverrides) {
+    let url = this.configuration.basePath + context.path;
+    if (context.query !== undefined && Object.keys(context.query).length !== 0) {
+      url += "?" + this.configuration.queryParamsStringify(context.query);
+    }
+    const headers = Object.assign({}, this.configuration.headers, context.headers);
+    Object.keys(headers).forEach((key) => headers[key] === undefined ? delete headers[key] : {});
+    const initOverrideFn = typeof initOverrides === "function" ? initOverrides : async () => initOverrides;
+    const initParams = {
+      method: context.method,
+      headers,
+      body: context.body,
+      credentials: this.configuration.credentials
+    };
+    const overriddenInit = {
+      ...initParams,
+      ...await initOverrideFn({
+        init: initParams,
+        context
+      })
+    };
+    let body;
+    if (isFormData(overriddenInit.body) || overriddenInit.body instanceof URLSearchParams || isBlob(overriddenInit.body)) {
+      body = overriddenInit.body;
+    } else if (this.isJsonMime(headers["Content-Type"])) {
+      body = JSON.stringify(overriddenInit.body);
+    } else {
+      body = overriddenInit.body;
+    }
+    const init = {
+      ...overriddenInit,
+      body
+    };
+    return { url, init };
+  }
+  fetchApi = async (url, init) => {
+    let fetchParams = { url, init };
+    for (const middleware of this.middleware) {
+      if (middleware.pre) {
+        fetchParams = await middleware.pre({
+          fetch: this.fetchApi,
+          ...fetchParams
+        }) || fetchParams;
+      }
+    }
+    let response = undefined;
+    try {
+      response = await (this.configuration.fetchApi || fetch)(fetchParams.url, fetchParams.init);
+    } catch (e) {
+      for (const middleware of this.middleware) {
+        if (middleware.onError) {
+          response = await middleware.onError({
+            fetch: this.fetchApi,
+            url: fetchParams.url,
+            init: fetchParams.init,
+            error: e,
+            response: response ? response.clone() : undefined
+          }) || response;
+        }
+      }
+      if (response === undefined) {
+        if (e instanceof Error) {
+          throw new FetchError(e, "The request failed and the interceptors did not return an alternative response");
+        } else {
+          throw e;
+        }
+      }
+    }
+    for (const middleware of this.middleware) {
+      if (middleware.post) {
+        response = await middleware.post({
+          fetch: this.fetchApi,
+          url: fetchParams.url,
+          init: fetchParams.init,
+          response: response.clone()
+        }) || response;
+      }
+    }
+    return response;
+  };
+  clone() {
+    const constructor = this.constructor;
+    const next = new constructor(this.configuration);
+    next.middleware = this.middleware.slice();
+    return next;
+  }
+}
+function isBlob(value) {
+  return typeof Blob !== "undefined" && value instanceof Blob;
+}
+function isFormData(value) {
+  return typeof FormData !== "undefined" && value instanceof FormData;
+}
+
+class ResponseError extends Error {
+  response;
+  name = "ResponseError";
+  constructor(response, msg) {
+    super(msg);
+    this.response = response;
+  }
+}
+
+class FetchError extends Error {
+  cause;
+  name = "FetchError";
+  constructor(cause, msg) {
+    super(msg);
+    this.cause = cause;
+  }
+}
+
+class RequiredError extends Error {
+  field;
+  name = "RequiredError";
+  constructor(field, msg) {
+    super(msg);
+    this.field = field;
+  }
+}
+function querystring(params, prefix = "") {
+  return Object.keys(params).map((key) => querystringSingleKey(key, params[key], prefix)).filter((part) => part.length > 0).join("&");
+}
+function querystringSingleKey(key, value, keyPrefix = "") {
+  const fullKey = keyPrefix + (keyPrefix.length ? `[${key}]` : key);
+  if (value instanceof Array) {
+    const multiValue = value.map((singleValue) => encodeURIComponent(String(singleValue))).join(`&${encodeURIComponent(fullKey)}=`);
+    return `${encodeURIComponent(fullKey)}=${multiValue}`;
+  }
+  if (value instanceof Set) {
+    const valueAsArray = Array.from(value);
+    return querystringSingleKey(key, valueAsArray, keyPrefix);
+  }
+  if (value instanceof Date) {
+    return `${encodeURIComponent(fullKey)}=${encodeURIComponent(value.toISOString())}`;
+  }
+  if (value instanceof Object) {
+    return querystring(value, fullKey);
+  }
+  return `${encodeURIComponent(fullKey)}=${encodeURIComponent(String(value))}`;
+}
+class JSONApiResponse {
+  raw;
+  transformer;
+  constructor(raw, transformer = (jsonValue) => jsonValue) {
+    this.raw = raw;
+    this.transformer = transformer;
+  }
+  async value() {
+    return this.transformer(await this.raw.json());
+  }
+}
+
+class VoidApiResponse {
+  raw;
+  constructor(raw) {
+    this.raw = raw;
+  }
+  async value() {
+    return;
+  }
+}
+// ../authz-sdk/package.json
+var package_default = {
+  name: "@uipath/authz-sdk",
+  author: "UiPath",
+  license: "SEE LICENSE IN LICENSE.txt",
+  version: "1.204.0",
+  description: "SDK for the UiPath Authorization Service API.",
+  repository: {
+    type: "git",
+    url: "https://github.com/UiPath/cli.git",
+    directory: "packages/admin/authz-sdk"
+  },
+  publishConfig: {
+    registry: "https://npm.pkg.github.com/@uipath"
+  },
+  keywords: [
+    "uipath",
+    "authorization",
+    "authz",
+    "sdk"
+  ],
+  type: "module",
+  main: "./dist/index.js",
+  types: "./dist/src/index.d.ts",
+  exports: {
+    ".": {
+      types: "./dist/src/index.d.ts",
+      default: "./dist/index.js"
+    }
+  },
+  files: [
+    "dist"
+  ],
+  private: true,
+  scripts: {
+    build: "bun build ./src/index.ts --outdir dist --format esm --target node --sourcemap=linked && tsc -p tsconfig.build.json --noCheck",
+    typecheck: "tsc --noEmit",
+    generate: "bun run src/scripts/generate-sdk.ts",
+    lint: "biome check ."
+  },
+  devDependencies: {
+    "@openapitools/openapi-generator-cli": "^2.31.1",
+    "@types/node": "^25.5.2",
+    "@uipath/auth": "workspace:*",
+    "@uipath/common": "workspace:*",
+    "@uipath/filesystem": "workspace:*",
+    typescript: "^7.0.2"
+  }
+};
+
+// ../authz-sdk/src/user-agent.ts
+var SDK_USER_AGENT = getSdkUserAgentToken(package_default);
+installSdkUserAgentHeader(BaseAPI, SDK_USER_AGENT);
+
+// ../authz-sdk/generated/src/models/ActionDetailDto.ts
+function ActionDetailDtoFromJSON(json) {
+  return ActionDetailDtoFromJSONTyped(json, false);
+}
+function ActionDetailDtoFromJSONTyped(json, ignoreDiscriminator) {
+  if (json == null) {
+    return json;
+  }
+  return {
+    id: json["id"],
+    name: json["name"],
+    namespace: json["namespace"],
+    serviceDisplayName: json["serviceDisplayName"],
+    resourceType: json["resourceType"],
+    resourceAction: json["resourceAction"],
+    resourceGroup: json["resourceGroup"],
+    description: json["description"],
+    scopeType: json["scopeType"] == null ? undefined : json["scopeType"],
+    originalResourceAction: json["originalResourceAction"] == null ? undefined : json["originalResourceAction"]
+  };
+}
+
+// ../authz-sdk/generated/src/models/AddCustomRoleRequestDto.ts
+function AddCustomRoleRequestDtoToJSON(json) {
+  return AddCustomRoleRequestDtoToJSONTyped(json, false);
+}
+function AddCustomRoleRequestDtoToJSONTyped(value, ignoreDiscriminator = false) {
+  if (value == null) {
+    return value;
+  }
+  return {
+    id: value["id"],
+    roleName: value["roleName"],
+    roleService: value["roleService"],
+    roleDescription: value["roleDescription"],
+    tenantId: value["tenantId"],
+    organizationId: value["organizationId"],
+    actionsGrantedByRole: value["actionsGrantedByRole"],
+    roleScopeType: value["roleScopeType"]
+  };
+}
+
+// ../authz-sdk/generated/src/models/PrincipalType.ts
+var PrincipalType = {
+  User: "User",
+  Group: "Group",
+  ExternalApplication: "ExternalApplication",
+  Robot: "Robot"
+};
+function PrincipalTypeToJSON(value) {
+  return value;
+}
+
+// ../authz-sdk/generated/src/models/AddRoleAssignmentRequest.ts
+function AddRoleAssignmentRequestToJSON(json) {
+  return AddRoleAssignmentRequestToJSONTyped(json, false);
+}
+function AddRoleAssignmentRequestToJSONTyped(value, ignoreDiscriminator = false) {
+  if (value == null) {
+    return value;
+  }
+  return {
+    roleId: value["roleId"],
+    roleName: value["roleName"],
+    scope: value["scope"],
+    type: value["type"],
+    securityPrincipalType: PrincipalTypeToJSON(value["securityPrincipalType"]),
+    securityPrincipalId: value["securityPrincipalId"],
+    createdOn: value["createdOn"] == null ? value["createdOn"] : value["createdOn"].toISOString(),
+    tenantId: value["tenantId"]
+  };
+}
+
+// ../authz-sdk/generated/src/models/BulkDeleteRoleAssignmentRequestDto.ts
+function BulkDeleteRoleAssignmentRequestDtoToJSON(json) {
+  return BulkDeleteRoleAssignmentRequestDtoToJSONTyped(json, false);
+}
+function BulkDeleteRoleAssignmentRequestDtoToJSONTyped(value, ignoreDiscriminator = false) {
+  if (value == null) {
+    return value;
+  }
+  return {
+    serviceId: value["serviceId"],
+    scopeToDelete: value["scopeToDelete"],
+    securityPrincipalToDelete: value["securityPrincipalToDelete"]
+  };
+}
+
+// ../authz-sdk/generated/src/models/BulkUpdateRoleAssignmentsDto.ts
+function BulkUpdateRoleAssignmentsDtoToJSON(json) {
+  return BulkUpdateRoleAssignmentsDtoToJSONTyped(json, false);
+}
+function BulkUpdateRoleAssignmentsDtoToJSONTyped(value, ignoreDiscriminator = false) {
+  if (value == null) {
+    return value;
+  }
+  return {
+    roleAssignmentsToAdd: value["roleAssignmentsToAdd"].map(AddRoleAssignmentRequestToJSON),
+    roleAssignmentsToDelete: value["roleAssignmentsToDelete"]
+  };
+}
+
+// ../authz-sdk/generated/src/models/RoleApiDto.ts
+function RoleApiDtoFromJSON(json) {
+  return RoleApiDtoFromJSONTyped(json, false);
+}
+function RoleApiDtoFromJSONTyped(json, ignoreDiscriminator) {
+  if (json == null) {
+    return json;
+  }
+  return {
+    id: json["id"],
+    name: json["name"],
+    description: json["description"],
+    type: json["type"],
+    scopeType: json["scopeType"],
+    createdBy: json["createdBy"],
+    createdOn: new Date(json["createdOn"]),
+    tenantId: json["tenantId"],
+    ownerServiceId: json["ownerServiceId"],
+    ownerServiceName: json["ownerServiceName"],
+    actionDetails: json["actionDetails"].map(ActionDetailDtoFromJSON)
+  };
+}
+
+// ../authz-sdk/generated/src/models/RoleApiDtoPagedResult.ts
+function RoleApiDtoPagedResultFromJSON(json) {
+  return RoleApiDtoPagedResultFromJSONTyped(json, false);
+}
+function RoleApiDtoPagedResultFromJSONTyped(json, ignoreDiscriminator) {
+  if (json == null) {
+    return json;
+  }
+  return {
+    totalCount: json["totalCount"] == null ? undefined : json["totalCount"],
+    results: json["results"] == null ? undefined : json["results"].map(RoleApiDtoFromJSON)
+  };
+}
+
+// ../authz-sdk/generated/src/models/RoleAssignmentDto.ts
+function RoleAssignmentDtoFromJSON(json) {
+  return RoleAssignmentDtoFromJSONTyped(json, false);
+}
+function RoleAssignmentDtoFromJSONTyped(json, ignoreDiscriminator) {
+  if (json == null) {
+    return json;
+  }
+  return {
+    id: json["id"],
+    securityPrincipalId: json["securityPrincipalId"],
+    securityPrincipalType: json["securityPrincipalType"],
+    type: json["type"],
+    scope: json["scope"],
+    roleId: json["roleId"],
+    roleName: json["roleName"],
+    roleType: json["roleType"],
+    createdBy: json["createdBy"],
+    createdOn: new Date(json["createdOn"]),
+    inherited: json["inherited"] == null ? undefined : json["inherited"],
+    mutable: json["mutable"] == null ? undefined : json["mutable"]
+  };
+}
+
+// ../authz-sdk/generated/src/models/RoleAssignmentDtoPerSecurityPrincipalIdDto.ts
+function RoleAssignmentDtoPerSecurityPrincipalIdDtoFromJSON(json) {
+  return RoleAssignmentDtoPerSecurityPrincipalIdDtoFromJSONTyped(json, false);
+}
+function RoleAssignmentDtoPerSecurityPrincipalIdDtoFromJSONTyped(json, ignoreDiscriminator) {
+  if (json == null) {
+    return json;
+  }
+  return {
+    securityPrincipalId: json["securityPrincipalId"],
+    roleAssignmentDtos: json["roleAssignmentDtos"].map(RoleAssignmentDtoFromJSON),
+    displayName: json["displayName"],
+    email: json["email"],
+    type: json["type"],
+    source: json["source"]
+  };
+}
+
+// ../authz-sdk/generated/src/models/RoleAssignmentDtoPerSecurityPrincipalIdDtoPagedResult.ts
+function RoleAssignmentDtoPerSecurityPrincipalIdDtoPagedResultFromJSON(json) {
+  return RoleAssignmentDtoPerSecurityPrincipalIdDtoPagedResultFromJSONTyped(json, false);
+}
+function RoleAssignmentDtoPerSecurityPrincipalIdDtoPagedResultFromJSONTyped(json, ignoreDiscriminator) {
+  if (json == null) {
+    return json;
+  }
+  return {
+    totalCount: json["totalCount"] == null ? undefined : json["totalCount"],
+    results: json["results"] == null ? undefined : json["results"].map(RoleAssignmentDtoPerSecurityPrincipalIdDtoFromJSON)
+  };
+}
+
+// ../authz-sdk/generated/src/apis/ActionApi.ts
+class ActionApi extends BaseAPI {
+  async apiActionsGetRaw(requestParameters, initOverrides) {
+    const queryParameters = {};
+    if (requestParameters["serviceName"] != null) {
+      queryParameters["serviceName"] = requestParameters["serviceName"];
+    }
+    if (requestParameters["scopeType"] != null) {
+      queryParameters["scopeType"] = requestParameters["scopeType"];
+    }
+    const headerParameters = {};
+    if (this.configuration && this.configuration.accessToken) {
+      const token = this.configuration.accessToken;
+      const tokenString = await token("bearerAuth", []);
+      if (tokenString) {
+        headerParameters["Authorization"] = `Bearer ${tokenString}`;
+      }
+    }
+    let urlPath = `/api/actions`;
+    const response = await this.request({
+      path: urlPath,
+      method: "GET",
+      headers: headerParameters,
+      query: queryParameters
+    }, initOverrides);
+    return new JSONApiResponse(response, (jsonValue) => jsonValue.map(ActionDetailDtoFromJSON));
+  }
+  async apiActionsGet(requestParameters = {}, initOverrides) {
+    const response = await this.apiActionsGetRaw(requestParameters, initOverrides);
+    return await response.value();
+  }
+}
+
+// ../authz-sdk/generated/src/apis/RoleApi.ts
+class RoleApi extends BaseAPI {
+  async apiRolesGetRaw(requestParameters, initOverrides) {
+    const queryParameters = {};
+    if (requestParameters["scopeType"] != null) {
+      queryParameters["scopeType"] = requestParameters["scopeType"];
+    }
+    if (requestParameters["serviceName"] != null) {
+      queryParameters["serviceName"] = requestParameters["serviceName"];
+    }
+    if (requestParameters["contains"] != null) {
+      queryParameters["contains"] = requestParameters["contains"];
+    }
+    if (requestParameters["tenantId"] != null) {
+      queryParameters["tenantId"] = requestParameters["tenantId"];
+    }
+    if (requestParameters["top"] != null) {
+      queryParameters["top"] = requestParameters["top"];
+    }
+    if (requestParameters["skip"] != null) {
+      queryParameters["skip"] = requestParameters["skip"];
+    }
+    if (requestParameters["sortBy"] != null) {
+      queryParameters["sortBy"] = requestParameters["sortBy"];
+    }
+    if (requestParameters["sortOrder"] != null) {
+      queryParameters["sortOrder"] = requestParameters["sortOrder"];
+    }
+    if (requestParameters["roleType"] != null) {
+      queryParameters["roleType"] = requestParameters["roleType"];
+    }
+    const headerParameters = {};
+    if (requestParameters["xUipathInternalAccountid"] != null) {
+      headerParameters["x-uipath-internal-accountid"] = String(requestParameters["xUipathInternalAccountid"]);
+    }
+    if (this.configuration && this.configuration.accessToken) {
+      const token = this.configuration.accessToken;
+      const tokenString = await token("bearerAuth", []);
+      if (tokenString) {
+        headerParameters["Authorization"] = `Bearer ${tokenString}`;
+      }
+    }
+    let urlPath = `/api/roles`;
+    const response = await this.request({
+      path: urlPath,
+      method: "GET",
+      headers: headerParameters,
+      query: queryParameters
+    }, initOverrides);
+    return new JSONApiResponse(response, (jsonValue) => RoleApiDtoPagedResultFromJSON(jsonValue));
+  }
+  async apiRolesGet(requestParameters = {}, initOverrides) {
+    const response = await this.apiRolesGetRaw(requestParameters, initOverrides);
+    return await response.value();
+  }
+  async apiRolesPutRaw(requestParameters, initOverrides) {
+    const queryParameters = {};
+    const headerParameters = {};
+    headerParameters["Content-Type"] = "application/json";
+    if (requestParameters["xUipathInternalAccountid"] != null) {
+      headerParameters["x-uipath-internal-accountid"] = String(requestParameters["xUipathInternalAccountid"]);
+    }
+    if (this.configuration && this.configuration.accessToken) {
+      const token = this.configuration.accessToken;
+      const tokenString = await token("bearerAuth", []);
+      if (tokenString) {
+        headerParameters["Authorization"] = `Bearer ${tokenString}`;
+      }
+    }
+    let urlPath = `/api/roles`;
+    const response = await this.request({
+      path: urlPath,
+      method: "PUT",
+      headers: headerParameters,
+      query: queryParameters,
+      body: AddCustomRoleRequestDtoToJSON(requestParameters["addCustomRoleRequestDto"])
+    }, initOverrides);
+    return new VoidApiResponse(response);
+  }
+  async apiRolesPut(requestParameters = {}, initOverrides) {
+    await this.apiRolesPutRaw(requestParameters, initOverrides);
+  }
+  async apiRolesRoleIdDeleteRaw(requestParameters, initOverrides) {
+    if (requestParameters["roleId"] == null) {
+      throw new RequiredError("roleId", 'Required parameter "roleId" was null or undefined when calling apiRolesRoleIdDelete().');
+    }
+    const queryParameters = {};
+    const headerParameters = {};
+    if (requestParameters["xUipathInternalAccountid"] != null) {
+      headerParameters["x-uipath-internal-accountid"] = String(requestParameters["xUipathInternalAccountid"]);
+    }
+    if (this.configuration && this.configuration.accessToken) {
+      const token = this.configuration.accessToken;
+      const tokenString = await token("bearerAuth", []);
+      if (tokenString) {
+        headerParameters["Authorization"] = `Bearer ${tokenString}`;
+      }
+    }
+    let urlPath = `/api/roles/{roleId}`;
+    urlPath = urlPath.replace(`{${"roleId"}}`, encodeURIComponent(String(requestParameters["roleId"])));
+    const response = await this.request({
+      path: urlPath,
+      method: "DELETE",
+      headers: headerParameters,
+      query: queryParameters
+    }, initOverrides);
+    return new VoidApiResponse(response);
+  }
+  async apiRolesRoleIdDelete(requestParameters, initOverrides) {
+    await this.apiRolesRoleIdDeleteRaw(requestParameters, initOverrides);
+  }
+  async apiRolesRoleIdGetRaw(requestParameters, initOverrides) {
+    if (requestParameters["roleId"] == null) {
+      throw new RequiredError("roleId", 'Required parameter "roleId" was null or undefined when calling apiRolesRoleIdGet().');
+    }
+    const queryParameters = {};
+    const headerParameters = {};
+    if (requestParameters["xUipathInternalAccountid"] != null) {
+      headerParameters["x-uipath-internal-accountid"] = String(requestParameters["xUipathInternalAccountid"]);
+    }
+    if (this.configuration && this.configuration.accessToken) {
+      const token = this.configuration.accessToken;
+      const tokenString = await token("bearerAuth", []);
+      if (tokenString) {
+        headerParameters["Authorization"] = `Bearer ${tokenString}`;
+      }
+    }
+    let urlPath = `/api/roles/{roleId}`;
+    urlPath = urlPath.replace(`{${"roleId"}}`, encodeURIComponent(String(requestParameters["roleId"])));
+    const response = await this.request({
+      path: urlPath,
+      method: "GET",
+      headers: headerParameters,
+      query: queryParameters
+    }, initOverrides);
+    return new JSONApiResponse(response, (jsonValue) => RoleApiDtoFromJSON(jsonValue));
+  }
+  async apiRolesRoleIdGet(requestParameters, initOverrides) {
+    const response = await this.apiRolesRoleIdGetRaw(requestParameters, initOverrides);
+    return await response.value();
+  }
+}
+
+// ../authz-sdk/generated/src/apis/RoleAssignmentApi.ts
+class RoleAssignmentApi extends BaseAPI {
+  async apiUserroleassignmentsBulkdeletePostRaw(requestParameters, initOverrides) {
+    const queryParameters = {};
+    const headerParameters = {};
+    headerParameters["Content-Type"] = "application/json";
+    if (requestParameters["xUipathInternalAccountid"] != null) {
+      headerParameters["x-uipath-internal-accountid"] = String(requestParameters["xUipathInternalAccountid"]);
+    }
+    if (this.configuration && this.configuration.accessToken) {
+      const token = this.configuration.accessToken;
+      const tokenString = await token("bearerAuth", []);
+      if (tokenString) {
+        headerParameters["Authorization"] = `Bearer ${tokenString}`;
+      }
+    }
+    let urlPath = `/api/userroleassignments/bulkdelete`;
+    const response = await this.request({
+      path: urlPath,
+      method: "POST",
+      headers: headerParameters,
+      query: queryParameters,
+      body: BulkDeleteRoleAssignmentRequestDtoToJSON(requestParameters["bulkDeleteRoleAssignmentRequestDto"])
+    }, initOverrides);
+    return new VoidApiResponse(response);
+  }
+  async apiUserroleassignmentsBulkdeletePost(requestParameters = {}, initOverrides) {
+    await this.apiUserroleassignmentsBulkdeletePostRaw(requestParameters, initOverrides);
+  }
+  async apiUserroleassignmentsExportGetRaw(requestParameters, initOverrides) {
+    const queryParameters = {};
+    if (requestParameters["exportOutputType"] != null) {
+      queryParameters["exportOutputType"] = requestParameters["exportOutputType"];
+    }
+    if (requestParameters["expandGroupMemberships"] != null) {
+      queryParameters["expandGroupMemberships"] = requestParameters["expandGroupMemberships"];
+    }
+    const headerParameters = {};
+    if (requestParameters["xUipathInternalAccountid"] != null) {
+      headerParameters["x-uipath-internal-accountid"] = String(requestParameters["xUipathInternalAccountid"]);
+    }
+    if (this.configuration && this.configuration.accessToken) {
+      const token = this.configuration.accessToken;
+      const tokenString = await token("bearerAuth", []);
+      if (tokenString) {
+        headerParameters["Authorization"] = `Bearer ${tokenString}`;
+      }
+    }
+    let urlPath = `/api/userroleassignments/export`;
+    const response = await this.request({
+      path: urlPath,
+      method: "GET",
+      headers: headerParameters,
+      query: queryParameters
+    }, initOverrides);
+    return new VoidApiResponse(response);
+  }
+  async apiUserroleassignmentsExportGet(requestParameters = {}, initOverrides) {
+    await this.apiUserroleassignmentsExportGetRaw(requestParameters, initOverrides);
+  }
+  async apiUserroleassignmentsGetRaw(requestParameters, initOverrides) {
+    const queryParameters = {};
+    if (requestParameters["scope"] != null) {
+      queryParameters["scope"] = requestParameters["scope"];
+    }
+    if (requestParameters["serviceName"] != null) {
+      queryParameters["serviceName"] = requestParameters["serviceName"];
+    }
+    if (requestParameters["securityPrincipalId"] != null) {
+      queryParameters["securityPrincipalId"] = requestParameters["securityPrincipalId"];
+    }
+    if (requestParameters["roleIds"] != null) {
+      queryParameters["roleIds"] = requestParameters["roleIds"];
+    }
+    if (requestParameters["top"] != null) {
+      queryParameters["top"] = requestParameters["top"];
+    }
+    if (requestParameters["skip"] != null) {
+      queryParameters["skip"] = requestParameters["skip"];
+    }
+    if (requestParameters["noInheritance"] != null) {
+      queryParameters["noInheritance"] = requestParameters["noInheritance"];
+    }
+    if (requestParameters["roleScopeType"] != null) {
+      queryParameters["roleScopeType"] = requestParameters["roleScopeType"];
+    }
+    const headerParameters = {};
+    if (requestParameters["xUipathInternalAccountid"] != null) {
+      headerParameters["x-uipath-internal-accountid"] = String(requestParameters["xUipathInternalAccountid"]);
+    }
+    if (this.configuration && this.configuration.accessToken) {
+      const token = this.configuration.accessToken;
+      const tokenString = await token("bearerAuth", []);
+      if (tokenString) {
+        headerParameters["Authorization"] = `Bearer ${tokenString}`;
+      }
+    }
+    let urlPath = `/api/userroleassignments`;
+    const response = await this.request({
+      path: urlPath,
+      method: "GET",
+      headers: headerParameters,
+      query: queryParameters
+    }, initOverrides);
+    return new JSONApiResponse(response, (jsonValue) => RoleAssignmentDtoPerSecurityPrincipalIdDtoPagedResultFromJSON(jsonValue));
+  }
+  async apiUserroleassignmentsGet(requestParameters = {}, initOverrides) {
+    const response = await this.apiUserroleassignmentsGetRaw(requestParameters, initOverrides);
+    return await response.value();
+  }
+  async apiUserroleassignmentsPatchRaw(requestParameters, initOverrides) {
+    const queryParameters = {};
+    const headerParameters = {};
+    headerParameters["Content-Type"] = "application/json";
+    if (requestParameters["xUipathInternalAccountid"] != null) {
+      headerParameters["x-uipath-internal-accountid"] = String(requestParameters["xUipathInternalAccountid"]);
+    }
+    if (this.configuration && this.configuration.accessToken) {
+      const token = this.configuration.accessToken;
+      const tokenString = await token("bearerAuth", []);
+      if (tokenString) {
+        headerParameters["Authorization"] = `Bearer ${tokenString}`;
+      }
+    }
+    let urlPath = `/api/userroleassignments`;
+    const response = await this.request({
+      path: urlPath,
+      method: "PATCH",
+      headers: headerParameters,
+      query: queryParameters,
+      body: BulkUpdateRoleAssignmentsDtoToJSON(requestParameters["bulkUpdateRoleAssignmentsDto"])
+    }, initOverrides);
+    return new VoidApiResponse(response);
+  }
+  async apiUserroleassignmentsPatch(requestParameters = {}, initOverrides) {
+    await this.apiUserroleassignmentsPatchRaw(requestParameters, initOverrides);
+  }
+}
+// ../authz-sdk/src/client-factory.ts
+async function resolveConfig(plane, options) {
+  const status = await getLoginStatusAsync({
+    ensureTokenValidityMinutes: options?.loginValidity
+  });
+  if (status.loginStatus !== "Logged in" || !status.baseUrl || !status.accessToken) {
+    throw new Error(status.hint ? `Not logged in. ${status.hint}` : "Not logged in. Run 'uip login' first.");
+  }
+  if (!status.organizationId) {
+    throw new Error("Organization ID not available. Ensure you are logged in with an organization context.");
+  }
+  const basePath = `${status.baseUrl}/${status.organizationId}/${plane}_`;
+  const bearerToken = options?.s2sToken ?? status.accessToken;
+  return {
+    config: new Configuration({
+      basePath,
+      accessToken: async () => bearerToken,
+      headers: addSdkUserAgentHeader(undefined, SDK_USER_AGENT)
+    }),
+    organizationId: status.organizationId,
+    tenantId: status.tenantId,
+    tenantName: status.tenantName
+  };
+}
+async function createAuthzConfig(plane, options) {
+  const { config } = await resolveConfig(plane, options);
+  return config;
+}
+async function createApiClient2(ApiClass, plane, options) {
+  const { config, organizationId, tenantId, tenantName } = await resolveConfig(plane, options);
+  return {
+    api: new ApiClass(config),
+    organizationId,
+    tenantId,
+    tenantName
+  };
+}
+async function createPapClient(ApiClass, options) {
+  return createApiClient2(ApiClass, "pap", options);
+}
+// ../authz-commands/src/commands/_shared.ts
+var LOGIN_INSTRUCTIONS = "Ensure you are logged in with 'uip login' and have access to the Authorization service.";
+var NON_NEGATIVE_INTEGER_RE = /^\d+$/;
+var parseIntOption = (raw) => {
+  const trimmed = raw.trim();
+  if (!NON_NEGATIVE_INTEGER_RE.test(trimmed)) {
+    throw new Error(`Expected a non-negative integer, got '${raw}'.`);
+  }
+  const parsed = Number.parseInt(trimmed, 10);
+  if (!Number.isFinite(parsed)) {
+    throw new Error(`Expected a non-negative integer, got '${raw}'.`);
+  }
+  return parsed;
+};
+var withLoginValidity = (cmd) => {
+  cmd.option("--login-validity <minutes>", "Override the interactive-login token lifetime for this call. Rarely needed.", parseIntOption);
+  return cmd;
+};
+async function loadJsonFile(file, typeLabel) {
+  const fs = getFileSystem();
+  const [readErr, content] = await catchError(fs.readFile(file, "utf-8"));
+  if (readErr || content === null) {
+    return [
+      {
+        message: readErr?.message ?? `File not found: ${file}`,
+        instructions: `Verify the file exists at '${file}' and is readable.`
+      },
+      null
+    ];
+  }
+  const [parseErr, parsed] = catchError(() => JSON.parse(content));
+  if (parseErr) {
+    return [
+      {
+        message: parseErr.message,
+        instructions: `The file must be valid JSON conforming to ${typeLabel}.`
+      },
+      null
+    ];
+  }
+  return [null, parsed];
+}
+var emitLoadError = (err) => {
+  OutputFormatter.error({
+    Result: RESULTS.Failure,
+    Message: err.message,
+    Instructions: err.instructions
+  });
+  processContext.exit(1);
+};
+var emitFailure = async (error, instructions) => {
+  OutputFormatter.error({
+    Result: RESULTS.Failure,
+    Message: await extractErrorMessage(error),
+    Instructions: instructions
+  });
+  processContext.exit(1);
+};
+var GUID_RE = /^[0-9a-fA-F-]{36}$/;
+async function extractResponseData(response) {
+  const [readErr, text] = await catchError(response.raw.clone().text());
+  if (readErr || !text)
+    return;
+  const [, parsed] = catchError(() => JSON.parse(text));
+  if (typeof parsed === "string" && GUID_RE.test(parsed)) {
+    return { operationId: parsed };
+  }
+  if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+    return parsed;
+  }
+  return;
+}
+var ORG_SCOPE_TYPE = "Organization";
+var TENANT_SCOPE_TYPE = "Tenant";
+var FOLDER_SCOPE_TYPE = "Folder";
+var PROJECT_SCOPE_TYPE = "Project";
+var KNOWN_SERVICES = [
+  "apps",
+  "authz",
+  "automationops",
+  "casemanagement",
+  "centralizedaccess",
+  "dataservice",
+  "documentunderstanding",
+  "identity",
+  "insights",
+  "licensing",
+  "oms",
+  "orchestrator",
+  "platform",
+  "processmining",
+  "reinfer",
+  "studio",
+  "taskmining",
+  "testmanager"
+];
+var TENANT_SERVICES = new Set([
+  "orchestrator",
+  "dataservice",
+  "insights",
+  "taskmining",
+  "testmanager",
+  "documentunderstanding",
+  "processmining",
+  "reinfer",
+  "casemanagement"
+]);
+var ORG_SERVICES = new Set([
+  "apps",
+  "automationops",
+  "identity",
+  "licensing",
+  "oms",
+  "platform",
+  "authz",
+  "centralizedaccess",
+  "studio"
+]);
+var DELTA_SYNC_SERVICES = new Set([
+  "orchestrator",
+  "dataservice",
+  "insights",
+  "taskmining",
+  "testmanager",
+  "automationops",
+  "casemanagement",
+  "processmining"
+]);
+var PLATFORM_SERVICES = new Set([
+  "authz",
+  "oms",
+  "platform",
+  "identity",
+  "licensing"
+]);
+var isRoleAuthoringBlocked = (name) => {
+  if (name === undefined || name === null)
+    return null;
+  const lower = name.toLowerCase();
+  if (DELTA_SYNC_SERVICES.has(lower))
+    return "delta-sync";
+  if (PLATFORM_SERVICES.has(lower))
+    return "platform";
+  return null;
+};
+var ROLE_AUTHORING_HINTS = {
+  orchestrator: "Use `uip or roles create | edit | delete` instead.",
+  dataservice: "Manage Data Service roles via the Data Service UI or API — the CLI does not expose role management for this service.",
+  insights: "Manage Insights roles via the Insights UI or API — the CLI does not expose role management for this service.",
+  taskmining: "Manage Task Mining roles via the Task Mining UI or API — the CLI does not expose role management for this service.",
+  testmanager: "Manage Test Manager roles via the Test Manager UI or API — the CLI does not expose role management for this service.",
+  automationops: "Manage Automation Ops roles via the Automation Ops UI or API — the CLI does not expose role management for this service.",
+  casemanagement: "Manage Case Management roles via the Case Management UI or API — the CLI does not expose role management for this service.",
+  processmining: "Manage Process Mining roles via the Process Mining UI or API — the CLI does not expose role management for this service.",
+  authz: "Roles for the Authorization service are platform-owned and cannot be customized.",
+  oms: "Roles for OMS are platform-owned and cannot be customized.",
+  platform: "Roles for the Platform service are platform-owned and cannot be customized.",
+  identity: "Roles for Identity are platform-owned and cannot be customized.",
+  licensing: "Roles for Licensing are platform-owned and cannot be customized."
+};
+var SERVICE_OPTION_HINT = `Known services: ${KNOWN_SERVICES.join(", ")} (free-form — other names accepted).`;
+var inferRoleService = (role) => {
+  const raw = role;
+  const namespaces = raw?.actionDetails?.map((a) => a.namespace?.toLowerCase()).filter((x) => x !== undefined && x.length > 0) ?? [];
+  const nonAuthz = Array.from(new Set(namespaces.filter((ns) => ns !== "authz")));
+  if (nonAuthz.length === 1)
+    return nonAuthz[0];
+  if (nonAuthz.length > 1)
+    return;
+  return namespaces.includes("authz") ? "authz" : undefined;
+};
+var rejectIfRoleAuthoringBlocked = (serviceName, action) => {
+  const reason = isRoleAuthoringBlocked(serviceName);
+  if (reason === null)
+    return false;
+  const lower = serviceName.toLowerCase();
+  const message = reason === "delta-sync" ? `Custom roles for '${lower}' are owned by the '${lower}' service itself and cannot be ${action}d through 'uip admin authorization roles'.` : `'${lower}' is a platform-level service; its roles are platform-owned and cannot be ${action}d by tenants.`;
+  OutputFormatter.error({
+    Result: RESULTS.Failure,
+    Message: message,
+    Instructions: ROLE_AUTHORING_HINTS[lower] ?? "This service does not allow custom-role authoring through the Authorization CLI."
+  });
+  processContext.exit(1);
+  return true;
+};
+var CENTRALIZED_ACCESS_SERVICE = "centralizedaccess";
+var EMPTY_TENANT_GUID = "00000000-0000-0000-0000-000000000000";
+var ROLE_AUTHORING_SCOPES = [
+  "Organization",
+  "TenantGlobal",
+  "Tenant",
+  "Project"
+];
+var ROLE_LIST_SCOPES = [
+  "Organization",
+  "TenantGlobal",
+  "Tenant",
+  "Project",
+  "Folder"
+];
+var makeScopeCanonicalizer = (scopes) => (value) => {
+  const lower = value.toLowerCase();
+  const match = scopes.find((s) => s.toLowerCase() === lower);
+  if (match === undefined) {
+    throw new InvalidArgumentError(`Allowed choices are ${scopes.join(", ")} (case-insensitive).`);
+  }
+  return match;
+};
+var canonicalizeRoleAuthoringScope = makeScopeCanonicalizer(ROLE_AUTHORING_SCOPES);
+var canonicalizeRoleListScope = makeScopeCanonicalizer(ROLE_LIST_SCOPES);
+var ASSIGNMENT_LIST_SCOPES = [
+  "Organization",
+  "Tenant",
+  "Project",
+  "Folder",
+  "App"
+];
+var canonicalizeAssignmentListScope = (value) => {
+  if (value.toLowerCase() === "tenantglobal") {
+    throw new InvalidArgumentError("TenantGlobal is not a valid assignment scope. Pass --scope Tenant for tenant-wide assignments.");
+  }
+  return makeScopeCanonicalizer(ASSIGNMENT_LIST_SCOPES)(value);
+};
+var ASSIGNMENT_CREATE_SCOPES = [
+  "Organization",
+  "TenantGlobal",
+  "Tenant",
+  "Project",
+  "Folder",
+  "App"
+];
+var canonicalizeAssignmentCreateScope = makeScopeCanonicalizer(ASSIGNMENT_CREATE_SCOPES);
+var eligibleAuthoringServices = () => KNOWN_SERVICES.filter((s) => s !== CENTRALIZED_ACCESS_SERVICE && !DELTA_SYNC_SERVICES.has(s) && !PLATFORM_SERVICES.has(s));
+var emitShapeError = (message, instructions) => {
+  OutputFormatter.error({
+    Result: RESULTS.Failure,
+    Message: message,
+    Instructions: instructions
+  });
+  processContext.exit(1);
+  return null;
+};
+var shapeCustomRoleBody = (ctx) => {
+  const { scope, serviceFlag, tenantIdFlag, loginTenantId } = ctx;
+  const validatedService = (() => {
+    const s = serviceFlag?.toLowerCase();
+    if (s === undefined || s.length === 0)
+      return;
+    if (s === CENTRALIZED_ACCESS_SERVICE) {
+      emitShapeError(`'${s}' is not a valid --service value.`, "For roles not bound to a specific service, use --scope Organization, --scope TenantGlobal, or --scope Tenant (without --service) instead.");
+      return null;
+    }
+    if (isRoleAuthoringBlocked(s) !== null) {
+      rejectIfRoleAuthoringBlocked(s, "create");
+      return null;
+    }
+    if (!TENANT_SERVICES.has(s) && !ORG_SERVICES.has(s)) {
+      emitShapeError(`Unknown service '${s}'.`, `Pass --service set to one of: ${eligibleAuthoringServices().join(", ")}.`);
+      return null;
+    }
+    return s;
+  })();
+  if (validatedService === null)
+    return null;
+  let resolvedScope;
+  if (scope !== undefined) {
+    resolvedScope = scope;
+  } else if (validatedService !== undefined) {
+    resolvedScope = TENANT_SERVICES.has(validatedService) ? "Tenant" : "Organization";
+  } else {
+    return emitShapeError("Either --scope or --service must be provided.", "Pass --scope <Organization|TenantGlobal|Tenant|Project>, or --service <name> to infer the scope from the service registry.");
+  }
+  if (resolvedScope === "Project" && validatedService === undefined) {
+    return emitShapeError("--scope Project requires --service <service>.", `Pass --service set to a service that registers Project-scoped permissions (e.g. documentunderstanding, reinfer).`);
+  }
+  const roleService = validatedService ?? CENTRALIZED_ACCESS_SERVICE;
+  if (resolvedScope === "Organization") {
+    if (tenantIdFlag !== undefined) {
+      return emitShapeError("--tenant-id is not allowed for an Organization-scope role; this shape is not bound to a single tenant.", "Drop --tenant-id, or pass --scope Tenant / --scope Project for a tenant-bound role.");
+    }
+    return { roleService, roleScopeType: ORG_SCOPE_TYPE };
+  }
+  if (resolvedScope === "TenantGlobal") {
+    if (tenantIdFlag !== undefined) {
+      return emitShapeError("--tenant-id is not allowed for --scope TenantGlobal; this shape is a cross-tenant template.", "Drop --tenant-id, or pass --scope Tenant for a tenant-bound role.");
+    }
+    return { roleService, roleScopeType: TENANT_SCOPE_TYPE };
+  }
+  const tenantId = tenantIdFlag ?? loginTenantId;
+  if (tenantId === undefined) {
+    return emitShapeError(`--scope ${resolvedScope} requires a tenant id, but --tenant-id was not provided and the login context has no tenant.`, "Pass --tenant-id <guid>, or log in to a tenant before retrying.");
+  }
+  return {
+    roleService,
+    roleScopeType: resolvedScope === "Project" ? PROJECT_SCOPE_TYPE : TENANT_SCOPE_TYPE,
+    tenantId
+  };
+};
+var shapePermissionsListFilter = (ctx) => {
+  const { scope, serviceFlag } = ctx;
+  if (scope === undefined && serviceFlag === undefined) {
+    return { scopeType: undefined, serviceName: undefined };
+  }
+  const service = serviceFlag?.toLowerCase();
+  if (service === CENTRALIZED_ACCESS_SERVICE) {
+    return emitShapeError(`'${service}' is not a valid --service value.`, "For non-service-specific permissions, use --scope Organization, --scope TenantGlobal, or --scope Tenant (without --service) instead.");
+  }
+  let resolvedScope;
+  if (scope !== undefined) {
+    resolvedScope = scope;
+  } else if (service !== undefined) {
+    if (TENANT_SERVICES.has(service))
+      resolvedScope = "Tenant";
+    else if (ORG_SERVICES.has(service))
+      resolvedScope = "Organization";
+  }
+  const scopeType = resolvedScope === "Organization" ? ORG_SCOPE_TYPE : resolvedScope === "TenantGlobal" || resolvedScope === "Tenant" ? TENANT_SCOPE_TYPE : resolvedScope === "Project" ? PROJECT_SCOPE_TYPE : undefined;
+  return {
+    scopeType,
+    serviceName: service
+  };
+};
+var shapeRoleListFilter = (ctx) => {
+  const { scope, serviceFlag, tenantIdFlag, loginTenantId } = ctx;
+  if (scope === undefined && serviceFlag === undefined) {
+    return {
+      scopeType: undefined,
+      serviceName: undefined,
+      tenantId: tenantIdFlag
+    };
+  }
+  const service = serviceFlag?.toLowerCase();
+  if (service === CENTRALIZED_ACCESS_SERVICE) {
+    return emitShapeError(`'${service}' is not a valid --service value.`, "For roles not bound to a specific service, use --scope Organization, --scope TenantGlobal, or --scope Tenant (without --service) instead.");
+  }
+  let resolvedScope;
+  if (scope !== undefined) {
+    resolvedScope = scope;
+  } else if (service !== undefined) {
+    if (TENANT_SERVICES.has(service))
+      resolvedScope = "Tenant";
+    else if (ORG_SERVICES.has(service))
+      resolvedScope = "Organization";
+  }
+  const serviceName = service ?? CENTRALIZED_ACCESS_SERVICE;
+  if (resolvedScope === undefined) {
+    return {
+      scopeType: undefined,
+      serviceName: service,
+      tenantId: tenantIdFlag
+    };
+  }
+  if (resolvedScope === "Organization") {
+    if (tenantIdFlag !== undefined) {
+      return emitShapeError("--tenant-id is not allowed for an Organization-scope role filter; the server fixes tenantId for org-scope queries.", "Drop --tenant-id, or pass --scope Tenant / --scope Project / --scope Folder.");
+    }
+    return {
+      scopeType: [ORG_SCOPE_TYPE],
+      serviceName,
+      tenantId: service === undefined ? undefined : EMPTY_TENANT_GUID
+    };
+  }
+  if (resolvedScope === "TenantGlobal") {
+    if (tenantIdFlag !== undefined) {
+      return emitShapeError("--tenant-id is not allowed for --scope TenantGlobal; the server fixes tenantId to the zero-GUID marker.", "Drop --tenant-id, or pass --scope Tenant for a tenant-bound filter.");
+    }
+    return {
+      scopeType: [TENANT_SCOPE_TYPE],
+      serviceName,
+      tenantId: EMPTY_TENANT_GUID
+    };
+  }
+  const tenantId = tenantIdFlag ?? loginTenantId;
+  if (tenantId === undefined) {
+    return emitShapeError(`--scope ${resolvedScope} requires a tenant id, but --tenant-id was not provided and the login context has no tenant.`, "Pass --tenant-id <guid>, or log in to a tenant before retrying.");
+  }
+  const scopeTypeValue = resolvedScope === "Project" ? PROJECT_SCOPE_TYPE : resolvedScope === "Folder" ? FOLDER_SCOPE_TYPE : TENANT_SCOPE_TYPE;
+  return {
+    scopeType: [scopeTypeValue],
+    serviceName,
+    tenantId
+  };
+};
+var shapeAssignmentListFilter = (ctx) => {
+  const {
+    scope,
+    serviceFlag,
+    scopeIdFlag,
+    scopePathFlag,
+    tenantIdFlag,
+    loginTenantId
+  } = ctx;
+  const service = serviceFlag?.toLowerCase();
+  if (service === CENTRALIZED_ACCESS_SERVICE) {
+    return emitShapeError(`'${service}' is not a valid --service value.`, "For assignments not bound to a specific service, use --scope Organization or --scope Tenant (without --service) instead.");
+  }
+  if (scopePathFlag !== undefined) {
+    return {
+      scope: scopePathFlag,
+      serviceName: service,
+      roleScopeType: undefined
+    };
+  }
+  const isSubScope = scope === "Project" || scope === "Folder" || scope === "App";
+  if (isSubScope) {
+    if (service === undefined) {
+      return emitShapeError(`--scope ${scope} requires --service <service>.`, "Sub-scope assignment queries are always service-bound; pass --service <name>, or use --scope-path <path> for verbatim filtering.");
+    }
+    if (scopeIdFlag === undefined) {
+      return emitShapeError(`--scope ${scope} requires --scope-id <id>.`, `Pass --scope-id with the ${scope === "Project" ? "project id" : scope === "Folder" ? "folder name/id" : "app id"} to compose the scope path, or use --scope-path <path> for a verbatim match.`);
+    }
+    const tenantId2 = tenantIdFlag ?? loginTenantId;
+    if (tenantId2 === undefined) {
+      return emitShapeError(`--scope ${scope} requires a tenant id, but --tenant-id was not provided and the login context has no tenant.`, "Pass --tenant-id <guid>, or log in to a tenant before retrying.");
+    }
+    const segment = scope.toLowerCase();
+    return {
+      scope: `/tenant/${tenantId2}/${service}/${segment}/${scopeIdFlag}`,
+      serviceName: service,
+      roleScopeType: undefined
+    };
+  }
+  if (service !== undefined) {
+    const explicitOrg = scope === "Organization";
+    const inferredOrg = scope === undefined && ORG_SERVICES.has(service);
+    if (explicitOrg || inferredOrg) {
+      if (tenantIdFlag !== undefined) {
+        return emitShapeError("--tenant-id is not allowed for an Organization-scope assignment query (scope=/ has no tenant binding).", "Drop --tenant-id, or pass --scope Tenant / Project / Folder / App for a tenant-bound query.");
+      }
+      return {
+        scope: "/",
+        serviceName: service,
+        roleScopeType: "organization"
+      };
+    }
+    const tenantId2 = tenantIdFlag ?? loginTenantId;
+    if (tenantId2 === undefined) {
+      return emitShapeError("Tenant-scope assignment query requires a tenant id, but --tenant-id was not provided and the login context has no tenant.", "Pass --tenant-id <guid>, or log in to a tenant before retrying.");
+    }
+    return {
+      scope: `/tenant/${tenantId2}/${service}`,
+      serviceName: service,
+      roleScopeType: undefined
+    };
+  }
+  if (scope === "Organization") {
+    if (tenantIdFlag !== undefined) {
+      return emitShapeError("--tenant-id is not allowed for --scope Organization; the assignment query is scoped to / (whole org).", "Drop --tenant-id, or pass --scope Tenant for a tenant-bound query.");
+    }
+    return {
+      scope: "/",
+      serviceName: CENTRALIZED_ACCESS_SERVICE,
+      roleScopeType: "organization"
+    };
+  }
+  if (scope === "Tenant") {
+    const tenantId2 = tenantIdFlag ?? loginTenantId;
+    if (tenantId2 === undefined) {
+      return emitShapeError("--scope Tenant requires a tenant id, but --tenant-id was not provided and the login context has no tenant.", "Pass --tenant-id <guid>, or log in to a tenant before retrying.");
+    }
+    return {
+      scope: `/tenant/${tenantId2}`,
+      serviceName: CENTRALIZED_ACCESS_SERVICE,
+      roleScopeType: undefined
+    };
+  }
+  const tenantId = tenantIdFlag ?? loginTenantId;
+  if (tenantId === undefined) {
+    return emitShapeError("assignments list needs --scope, --service, --scope-path, or --tenant-id; the login context has no tenant to default to.", "Pass --tenant-id <guid>, --scope Organization|Tenant, --service <name>, or --scope-path <path>. See `assignments list --help`.");
+  }
+  return {
+    scope: `/tenant/${tenantId}`,
+    serviceName: CENTRALIZED_ACCESS_SERVICE,
+    roleScopeType: undefined
+  };
+};
+var shapeAssignmentCreateScope = (ctx) => {
+  const {
+    scope,
+    serviceFlag,
+    scopeIdFlag,
+    scopePathFlag,
+    tenantIdFlag,
+    loginTenantId
+  } = ctx;
+  const service = serviceFlag?.toLowerCase();
+  if (service === CENTRALIZED_ACCESS_SERVICE) {
+    return emitShapeError(`'${service}' is not a valid --service value.`, "For assignments not bound to a specific service, use --scope Organization, --scope Tenant, or --scope TenantGlobal (without --service) instead.");
+  }
+  if (scopePathFlag !== undefined) {
+    return { scope: scopePathFlag, tenantId: undefined };
+  }
+  if (service !== undefined) {
+    const reason = isRoleAuthoringBlocked(service);
+    if (reason !== null) {
+      const message = reason === "delta-sync" ? `Role assignments for '${service}' are owned by the '${service}' service itself and cannot be created through 'uip admin authorization roles assignments'.` : `'${service}' is a platform-level service; its role assignments are platform-owned and cannot be created by tenants.`;
+      return emitShapeError(message, ROLE_AUTHORING_HINTS[service] ?? "This service does not allow assignment authoring through the Authorization CLI.");
+    }
+  }
+  const isSubScope = scope === "Project" || scope === "Folder" || scope === "App";
+  if (isSubScope) {
+    if (service === undefined) {
+      return emitShapeError(`--scope ${scope} requires --service <service>.`, "Sub-scope assignments are always service-bound; pass --service <name>, or use --scope-path <path> for verbatim assignment.");
+    }
+    if (scopeIdFlag === undefined) {
+      return emitShapeError(`--scope ${scope} requires --scope-id <id>.`, `Pass --scope-id with the ${scope === "Project" ? "project id" : scope === "Folder" ? "folder name/id" : "app id"} to compose the scope path, or use --scope-path <path> for a verbatim assignment.`);
+    }
+    const tenantId2 = tenantIdFlag ?? loginTenantId;
+    if (tenantId2 === undefined) {
+      return emitShapeError(`--scope ${scope} requires a tenant id, but --tenant-id was not provided and the login context has no tenant.`, "Pass --tenant-id <guid>, or log in to a tenant before retrying.");
+    }
+    const segment = scope.toLowerCase();
+    return {
+      scope: `/tenant/${tenantId2}/${service}/${segment}/${scopeIdFlag}`,
+      tenantId: tenantId2
+    };
+  }
+  if (service !== undefined) {
+    const explicitOrg = scope === "Organization";
+    const inferredOrg = scope === undefined && ORG_SERVICES.has(service);
+    if (explicitOrg || inferredOrg) {
+      if (tenantIdFlag !== undefined) {
+        return emitShapeError("--tenant-id is not allowed for an Organization-scope assignment (scope=/ has no tenant binding).", "Drop --tenant-id, or pass --scope Tenant / Project / Folder / App for a tenant-bound assignment.");
+      }
+      return { scope: "/", tenantId: undefined };
+    }
+    const tenantId2 = tenantIdFlag ?? loginTenantId;
+    if (tenantId2 === undefined) {
+      return emitShapeError("Tenant-scope assignment requires a tenant id, but --tenant-id was not provided and the login context has no tenant.", "Pass --tenant-id <guid>, or log in to a tenant before retrying.");
+    }
+    return {
+      scope: `/tenant/${tenantId2}/${service}`,
+      tenantId: tenantId2
+    };
+  }
+  if (scope === "Organization") {
+    if (tenantIdFlag !== undefined) {
+      return emitShapeError("--tenant-id is not allowed for --scope Organization; the assignment is bound to / (whole org).", "Drop --tenant-id, or pass --scope Tenant / TenantGlobal for a tenant-bound assignment.");
+    }
+    return { scope: "/", tenantId: undefined };
+  }
+  if (scope === "Tenant" || scope === "TenantGlobal") {
+    const tenantId2 = tenantIdFlag ?? loginTenantId;
+    if (tenantId2 === undefined) {
+      return emitShapeError(`--scope ${scope} requires a tenant id, but --tenant-id was not provided and the login context has no tenant.`, "Pass --tenant-id <guid>, or log in to a tenant before retrying.");
+    }
+    return { scope: `/tenant/${tenantId2}`, tenantId: tenantId2 };
+  }
+  const tenantId = tenantIdFlag ?? loginTenantId;
+  if (tenantId === undefined) {
+    return emitShapeError("assignments create (inline) requires --tenant-id, --scope, --service, or --scope-path; the login context has no tenant to default to.", "Pass --tenant-id <guid>, --scope <Organization|TenantGlobal|Tenant|Project|Folder|App>, --service <name>, or --scope-path <path>. See `assignments create --help`.");
+  }
+  return { scope: `/tenant/${tenantId}`, tenantId };
+};
+async function loadActionsFile(file) {
+  const [parseErr, parsed] = await loadJsonFile(file, "string[]");
+  if (parseErr)
+    return [parseErr, null];
+  if (!Array.isArray(parsed)) {
+    return [
+      {
+        message: `Expected --file to contain a JSON array of action strings, got ${parsed === null ? "null" : typeof parsed}.`,
+        instructions: 'The file must be a JSON array of action names, e.g. ["STUDIO.X.Y", "STUDIO.A.B"].'
+      },
+      null
+    ];
+  }
+  const nonStrings = parsed.filter((v) => typeof v !== "string");
+  if (nonStrings.length > 0) {
+    return [
+      {
+        message: `--file contains non-string elements; every action must be a string.`,
+        instructions: 'The file must be a JSON array of action names, e.g. ["STUDIO.X.Y", "STUDIO.A.B"].'
+      },
+      null
+    ];
+  }
+  return [null, parsed];
+}
+
+// ../authz-commands/src/commands/check-access.ts
+var SCOPE_CHOICES = [TENANT_SCOPE_TYPE, FOLDER_SCOPE_TYPE];
+var CHECK_ACCESS_EXAMPLES = [
+  {
+    Description: "Effective permissions for a user (by UUID) at the login tenant (default scope)",
+    Command: "uip admin authorization check-access <user-guid>",
+    Output: {
+      Code: "AuthzCheckAccess",
+      Data: {
+        roleAssignments: { totalCount: 0, results: [] },
+        grantedServicesMetadata: [],
+        grantedRolesMetadata: []
+      }
+    }
+  },
+  {
+    Description: "Resolve the user by email substring — the identity API does the lookup",
+    Command: "uip admin authorization check-access alice@example.com",
+    Output: {
+      Code: "AuthzCheckAccess",
+      Data: {
+        roleAssignments: { totalCount: 0, results: [] },
+        grantedServicesMetadata: [],
+        grantedRolesMetadata: []
+      }
+    }
+  },
+  {
+    Description: "Target a non-login tenant explicitly",
+    Command: "uip admin authorization check-access <user-guid> --tenant-id <tenant-guid>",
+    Output: {
+      Code: "AuthzCheckAccess",
+      Data: {
+        roleAssignments: { totalCount: 0, results: [] },
+        grantedServicesMetadata: [],
+        grantedRolesMetadata: []
+      }
+    }
+  },
+  {
+    Description: "Restrict the result to a single service",
+    Command: "uip admin authorization check-access <user-guid> --service orchestrator",
+    Output: {
+      Code: "AuthzCheckAccess",
+      Data: {
+        roleAssignments: { totalCount: 0, results: [] },
+        grantedServicesMetadata: [],
+        grantedRolesMetadata: []
+      }
+    }
+  },
+  {
+    Description: "Folder scope — folder id required, parent tenant defaults to login tenant",
+    Command: "uip admin authorization check-access <user-guid> --scope Folder --folder-id <folder-guid>",
+    Output: {
+      Code: "AuthzCheckAccess",
+      Data: {
+        roleAssignments: { totalCount: 0, results: [] },
+        grantedServicesMetadata: [],
+        grantedRolesMetadata: []
+      }
+    }
+  },
+  {
+    Description: "Pass a full request body (advanced — e.g. RoleNameStartsWith filter)",
+    Command: "uip admin authorization check-access --file ./check-access.json",
+    Output: {
+      Code: "AuthzCheckAccess",
+      Data: {
+        roleAssignments: { totalCount: 0, results: [] },
+        grantedServicesMetadata: [],
+        grantedRolesMetadata: []
+      }
+    }
+  }
+];
+async function postPdpJson(path, body, options) {
+  const config = await createAuthzConfig("pdp", {
+    loginValidity: options.loginValidity
+  });
+  if (!config.accessToken) {
+    throw new Error("No access token resolved from login context. Re-run 'uip login' and retry.");
+  }
+  const token = await config.accessToken("bearerAuth", []);
+  if (!token) {
+    throw new Error("Empty access token from login context. Re-run 'uip login' and retry.");
+  }
+  const response = await fetch(`${config.basePath}${path}`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${token}`
+    },
+    body: JSON.stringify(body)
+  });
+  if (!response.ok) {
+    const errorText = await response.text();
+    throw new Error(`HTTP ${response.status}: ${errorText}`);
+  }
+  if (response.status === 204) {
+    return;
+  }
+  return await response.json();
+}
+var GUID_RE2 = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+var formatCandidate = (u) => {
+  const label = u.email ?? u.userName ?? u.displayName ?? "(no email)";
+  return `${label} (${u.id ?? "no-id"})`;
+};
+async function resolveIdentityToId(identity, options) {
+  if (GUID_RE2.test(identity))
+    return identity;
+  const [clientErr, client] = await catchError(createApiClient(UserApi, {
+    loginValidity: options.loginValidity
+  }));
+  if (clientErr) {
+    await emitFailure(clientErr, "Failed to initialize the identity API client for user lookup. Re-run 'uip login' and retry, or pass a user UUID directly.");
+    return null;
+  }
+  const [searchErr, result] = await catchError(client.api.userGetUsers({
+    partitionGlobalId: client.organizationId,
+    searchTerm: identity,
+    top: 25,
+    skip: 0
+  }));
+  if (searchErr) {
+    await emitFailure(searchErr, `User lookup for '${identity}' failed. Pass the user UUID directly to skip the search.`);
+    return null;
+  }
+  const users = result?.results ?? [];
+  if (users.length === 0) {
+    OutputFormatter.error({
+      Result: RESULTS.Failure,
+      Message: `No user matched '${identity}'.`,
+      Instructions: "Pass a user UUID, or a substring of the user's name/email. Use 'uip admin users list --search <fragment>' to discover ids."
+    });
+    processContext.exit(1);
+    return null;
+  }
+  if (users.length === 1) {
+    const id = users[0].id;
+    if (id !== undefined && id !== "")
+      return id;
+  } else {
+    const lower = identity.toLowerCase();
+    const exact = users.find((u) => u.email?.toLowerCase() === lower || u.userName?.toLowerCase() === lower);
+    if (exact?.id !== undefined && exact.id !== "")
+      return exact.id;
+    const preview = users.slice(0, 5).map(formatCandidate).join("; ");
+    const more = users.length > 5 ? `; ... (+${users.length - 5} more)` : "";
+    OutputFormatter.error({
+      Result: RESULTS.Failure,
+      Message: `Multiple users matched '${identity}'. Pass a UUID or a more specific value.`,
+      Instructions: `Candidates: ${preview}${more}.`
+    });
+    processContext.exit(1);
+    return null;
+  }
+  OutputFormatter.error({
+    Result: RESULTS.Failure,
+    Message: `User search matched '${identity}' but the result has no id field.`,
+    Instructions: "Pass the user UUID directly. Verify the identity service is responding correctly."
+  });
+  processContext.exit(1);
+  return null;
+}
+async function resolveTenantId(options) {
+  if (options.tenantId !== undefined)
+    return options.tenantId;
+  const [loginErr, status] = await catchError(getLoginStatusAsync({
+    ensureTokenValidityMinutes: options.loginValidity
+  }));
+  if (loginErr) {
+    await emitFailure(loginErr, "Re-run 'uip login' and retry.");
+    return null;
+  }
+  if (status?.tenantId !== undefined && status.tenantId !== "") {
+    return status.tenantId;
+  }
+  OutputFormatter.error({
+    Result: RESULTS.Failure,
+    Message: "No tenant id resolved: --tenant-id was not provided and the login session is not bound to a tenant.",
+    Instructions: "Pass --tenant-id <guid>, or re-run 'uip login' and select a tenant."
+  });
+  processContext.exit(1);
+  return null;
+}
+var registerCheckAccessCommand = (authz) => {
+  withLoginValidity(authz.command("check-access").description([
+    "Compute the effective permissions a security principal has within a",
+    "tenant or folder scope, via the Policy Decision Point (PDP).",
+    "",
+    "The positional `<identity>` is either a user UUID (used as-is) or a",
+    "substring against user name/email; the latter is resolved via the",
+    "identity user-search API. Pass a UUID when the substring is ambiguous.",
+    "",
+    "Scope (default Tenant):",
+    "  --scope Tenant  — both Id and ParentId on the PDP request are the",
+    "                    tenant id. Use --tenant-id <guid> to target a",
+    "                    non-login tenant; otherwise the login tenant is",
+    "                    used.",
+    "  --scope Folder  — requires --folder-id <guid> (the Id). ParentId is",
+    "                    the owning tenant; --tenant-id overrides, else",
+    "                    the login tenant is used.",
+    "",
+    "Use --service to restrict the result to a single service",
+    "(sets ServiceName on the request body). For advanced filters",
+    "(RoleNameStartsWith) pass --file <path> with the full request body:",
+    "  {",
+    '    "SecurityPrincipalId": "<guid>",',
+    '    "RoleNameStartsWith": "<filter>",',
+    '    "ServiceName": "<filter>",',
+    '    "ScopeIdentifier": {',
+    '      "ScopeType": "Tenant" | "Folder",',
+    '      "Value": { "Id": "<guid>", "ParentId": "<guid>" }',
+    "    }",
+    "  }"
+  ].join(`
+`)).argument("[identity]", "User UUID, name, or email. Required unless --file is supplied.").option("--file <path>", "Path to a JSON file containing the full check-access request body. Mutually exclusive with the positional and scope flags.").addOption(new Option("--scope <type>", "Scope at which to evaluate access. Defaults to Tenant when omitted.").choices(SCOPE_CHOICES)).option("--tenant-id <guid>", "Tenant UUID. Defaults to the login tenant. For Tenant scope it is used as both Id and ParentId; for Folder scope it is the ParentId.").option("--folder-id <guid>", "Folder UUID. Required when --scope Folder. Used as the scope Id.").option("--service <service>", `Restrict the result to a specific service (sets ServiceName on the request body). ${SERVICE_OPTION_HINT}`).examples(CHECK_ACCESS_EXAMPLES)).trackedAction(processContext, async (identityArg, options) => {
+    const inlineProvided = identityArg !== undefined || options.scope !== undefined || options.tenantId !== undefined || options.folderId !== undefined || options.service !== undefined;
+    if (options.file !== undefined && inlineProvided) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: "--file is mutually exclusive with the <identity> positional and inline flags (--scope / --tenant-id / --folder-id / --service).",
+        Instructions: "Pass either --file for the full request body, or the positional + inline flags for the typical query."
+      });
+      processContext.exit(1);
+      return;
+    }
+    if (options.file === undefined && !inlineProvided) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: "Provide either <identity> or --file.",
+        Instructions: "Inline (minimum): check-access <user-uuid-or-name>. File: --file <path>."
+      });
+      processContext.exit(1);
+      return;
+    }
+    let body;
+    if (options.file !== undefined) {
+      const [loadErr, loaded] = await loadJsonFile(options.file, "GetEffectiveAccessRoleAssignmentsRequestDto");
+      if (loadErr) {
+        emitLoadError(loadErr);
+        return;
+      }
+      body = loaded;
+    } else {
+      if (identityArg === undefined) {
+        OutputFormatter.error({
+          Result: RESULTS.Failure,
+          Message: "Inline mode requires <identity>.",
+          Instructions: "Pass a user UUID or a substring of the user's name/email as the positional argument."
+        });
+        processContext.exit(1);
+        return;
+      }
+      const scope = options.scope ?? TENANT_SCOPE_TYPE;
+      if (scope === FOLDER_SCOPE_TYPE && options.folderId === undefined) {
+        OutputFormatter.error({
+          Result: RESULTS.Failure,
+          Message: "--scope Folder requires --folder-id.",
+          Instructions: "Pass --folder-id <folder-guid>. Use --tenant-id <tenant-guid> to target a non-login tenant."
+        });
+        processContext.exit(1);
+        return;
+      }
+      const securityPrincipalId = await resolveIdentityToId(identityArg, options);
+      if (securityPrincipalId === null)
+        return;
+      const tenantId = await resolveTenantId(options);
+      if (tenantId === null)
+        return;
+      const value = scope === FOLDER_SCOPE_TYPE ? {
+        Id: options.folderId,
+        ParentId: tenantId
+      } : { Id: tenantId, ParentId: tenantId };
+      const inlineBody = {
+        SecurityPrincipalId: securityPrincipalId,
+        ScopeIdentifier: {
+          ScopeType: scope,
+          Value: value
+        }
+      };
+      if (options.service !== undefined) {
+        inlineBody.ServiceName = options.service;
+      }
+      body = inlineBody;
+    }
+    const [error, result] = await catchError(postPdpJson("/api/geteffectiveaccess", body, options));
+    if (error) {
+      await emitFailure(error, "Verify the request shape and that ScopeType is 'Tenant' or 'Folder'.");
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "AuthzCheckAccess",
+      Data: result ?? {}
+    });
+  });
+};
+
+// ../authz-commands/src/commands/permissions.ts
+var LIST_EXAMPLES = [
+  {
+    Description: "List every permission definition known to the platform",
+    Command: "uip admin authorization permissions list",
+    Output: {
+      Code: "AuthzPermissionsList",
+      Data: [
+        {
+          id: "<action-guid>",
+          name: "OR.FOLDERS.READ",
+          namespace: "ORCHESTRATOR",
+          serviceDisplayName: "Orchestrator",
+          resourceType: "Folders",
+          resourceAction: "Read",
+          resourceGroup: "Folder",
+          description: "View folders",
+          scopeType: "Folder"
+        }
+      ]
+    }
+  },
+  {
+    Description: "Permissions usable in an Organization-shape role (e.g. for `roles create --scope Organization`)",
+    Command: "uip admin authorization permissions list --scope Organization",
+    Output: { Code: "AuthzPermissionsList", Data: [] }
+  },
+  {
+    Description: "Permissions for an org-service role — scope is inferred (apps → Organization)",
+    Command: "uip admin authorization permissions list --service apps",
+    Output: { Code: "AuthzPermissionsList", Data: [] }
+  },
+  {
+    Description: "Permissions for a tenant-service role — scope is inferred (documentunderstanding → Tenant)",
+    Command: "uip admin authorization permissions list --service documentunderstanding",
+    Output: { Code: "AuthzPermissionsList", Data: [] }
+  },
+  {
+    Description: "Project-scope override for a service that registers Project perms (DU, Reinfer)",
+    Command: "uip admin authorization permissions list --scope Project --service documentunderstanding",
+    Output: { Code: "AuthzPermissionsList", Data: [] }
+  }
+];
+var registerPermissionsCommands = (authz) => {
+  const perms = authz.command("permissions").description("Read-only catalog of permission definitions across services.");
+  withLoginValidity(perms.command("list").description([
+    "List permission definitions, optionally filtered to those usable in a",
+    "given custom-role shape.",
+    "",
+    "`--scope` mirrors `roles create --scope`:",
+    "",
+    "  Organization  All Organization-scoped permissions.",
+    "  TenantGlobal  All Tenant-scoped permissions.",
+    "  Tenant        All Tenant-scoped permissions.",
+    "  Project       All Project-scoped permissions.",
+    "",
+    "`--service` is optional and combines with any scope. When --scope is",
+    "omitted, --service alone infers the scope from the service registry",
+    "(tenant-service → Tenant; org-service → Organization), so the result",
+    "matches what `roles create --service <svc>` would accept. Pass an",
+    "explicit --scope to override — e.g. `--scope Project --service",
+    "documentunderstanding` lists DU's Project-scope permissions."
+  ].join(`
+`)).option("--service <service>", "Owning service (e.g. apps, documentunderstanding). Combines with --scope, or used alone sets the scope from the service registry.").addOption(new Option("--scope <type>", "Filter by role shape: Organization, TenantGlobal, Tenant, or Project (case-insensitive). Optional when --service is provided (the registry infers the scope).").argParser(canonicalizeRoleAuthoringScope)).examples(LIST_EXAMPLES)).trackedAction(processContext, async (options) => {
+    const [err, client] = await catchError(createPapClient(ActionApi, {
+      loginValidity: options.loginValidity
+    }));
+    if (err) {
+      await emitFailure(err, LOGIN_INSTRUCTIONS);
+      return;
+    }
+    const filter = shapePermissionsListFilter({
+      scope: options.scope,
+      serviceFlag: options.service
+    });
+    if (filter === null)
+      return;
+    const [error, result] = await catchError(client.api.apiActionsGet({
+      serviceName: filter.serviceName,
+      scopeType: filter.scopeType
+    }));
+    if (error) {
+      await emitFailure(error, "Verify --service and --scope values; the catalog should always be readable when logged in.");
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "AuthzPermissionsList",
+      Data: result ?? []
+    });
+  });
+};
+
+// ../authz-commands/src/commands/assignments.ts
+var PRINCIPAL_TYPE_VALUES = Object.values(PrincipalType);
+var LIST_EXAMPLES2 = [
+  {
+    Description: "List direct role assignments at the login tenant scope (default)",
+    Command: "uip admin authorization roles assignments list",
+    Output: {
+      Code: "AuthzAssignmentsList",
+      Data: {
+        totalCount: 1,
+        results: [
+          {
+            securityPrincipalId: "<user-guid>",
+            displayName: "Jane Doe",
+            email: "jane.doe@acme.example",
+            type: "User",
+            source: "Local",
+            roleAssignmentDtos: [
+              {
+                id: "<assignment-guid>",
+                securityPrincipalId: "<user-guid>",
+                securityPrincipalType: "User",
+                type: "Direct",
+                scope: "/tenant/<tenant-guid>",
+                roleId: "<role-guid>",
+                roleName: "Tenant Administrator",
+                roleType: "BuiltIn",
+                createdBy: "<user-guid>",
+                createdOn: "<iso-date>",
+                inherited: false,
+                mutable: true
+              }
+            ]
+          }
+        ]
+      }
+    }
+  },
+  {
+    Description: "List a different tenant's direct assignments (target a tenant by UUID)",
+    Command: "uip admin authorization roles assignments list --scope Tenant --tenant-id 11111111-2222-3333-4444-555555555555",
+    Output: {
+      Code: "AuthzAssignmentsList",
+      Data: { totalCount: 0, results: [] }
+    }
+  },
+  {
+    Description: "List tenant assignments including inherited (organization-level) ones",
+    Command: "uip admin authorization roles assignments list --include-inherited",
+    Output: {
+      Code: "AuthzAssignmentsList",
+      Data: { totalCount: 0, results: [] }
+    }
+  },
+  {
+    Description: "List organization-scope assignments (root)",
+    Command: "uip admin authorization roles assignments list --scope Organization",
+    Output: {
+      Code: "AuthzAssignmentsList",
+      Data: { totalCount: 0, results: [] }
+    }
+  },
+  {
+    Description: "List Folder-scope assignments for a service (--service and --scope-id are both required; scope is composed server-side)",
+    Command: "uip admin authorization roles assignments list --scope Folder --service orchestrator --scope-id Insights",
+    Output: {
+      Code: "AuthzAssignmentsList",
+      Data: { totalCount: 0, results: [] }
+    }
+  },
+  {
+    Description: "List Project-scope assignments for a service (--service and --scope-id are both required; scope is composed server-side)",
+    Command: "uip admin authorization roles assignments list --scope Project --service documentunderstanding --scope-id f4d490de3a697c65",
+    Output: {
+      Code: "AuthzAssignmentsList",
+      Data: { totalCount: 0, results: [] }
+    }
+  },
+  {
+    Description: "Advanced: send an exact scope path verbatim to the API (overrides --scope, --service, --scope-id, and --tenant-id)",
+    Command: "uip admin authorization roles assignments list --scope-path /tenant/11111111-2222-3333-4444-555555555555/reinfer",
+    Output: {
+      Code: "AuthzAssignmentsList",
+      Data: { totalCount: 0, results: [] }
+    }
+  },
+  {
+    Description: "Filter assignments by service — scope is inferred from the service registry (apps → Organization, documentunderstanding → Tenant)",
+    Command: "uip admin authorization roles assignments list --service apps",
+    Output: {
+      Code: "AuthzAssignmentsList",
+      Data: { totalCount: 0, results: [] }
+    }
+  },
+  {
+    Description: "Filter assignments by identity (user / group / robot)",
+    Command: "uip admin authorization roles assignments list --identity-id b44fc962-d544-4c99-b520-71121070ec17",
+    Output: {
+      Code: "AuthzAssignmentsList",
+      Data: { totalCount: 0, results: [] }
+    }
+  }
+];
+var CREATE_EXAMPLES = [
+  {
+    Description: "Assign a tenant-scoped role to a user (tenant id auto-fills from the login session)",
+    Command: "uip admin authorization roles assignments create --role-id 98dc776b-835c-407f-9d58-6676318ac968 --identity-id b44fc962-d544-4c99-b520-71121070ec17 --identity-type User",
+    Output: { Code: "AuthzAssignmentCreated", Data: {} }
+  },
+  {
+    Description: "Assign a role on a specific tenant (override the auto-fill)",
+    Command: "uip admin authorization roles assignments create --role-id <role-guid> --identity-id <user-guid> --identity-type User --tenant-id 11111111-2222-3333-4444-555555555555",
+    Output: { Code: "AuthzAssignmentCreated", Data: {} }
+  },
+  {
+    Description: "Assign a role at a project/folder/app scope (--scope + --service + --scope-id, or pass an exact path via --scope-path)",
+    Command: "uip admin authorization roles assignments create --role-id <role-guid> --identity-id <group-guid> --identity-type Group --scope Project --service documentunderstanding --scope-id <project-id>",
+    Output: { Code: "AuthzAssignmentCreated", Data: {} }
+  },
+  {
+    Description: "Batch: create multiple role assignments from a JSON file (array of AddRoleAssignmentRequest). Schema per entry: { roleId, securityPrincipalId, securityPrincipalType: 'User'|'Group'|'Robot'|'ExternalApplication', scope?: '<scope-path>' }",
+    Command: "uip admin authorization roles assignments create --file ./assignments.json",
+    Output: { Code: "AuthzAssignmentCreated", Data: {} }
+  }
+];
+var DELETE_EXAMPLES = [
+  {
+    Description: "Delete a single role assignment by id (find ids via `roles assignments list`)",
+    Command: "uip admin authorization roles assignments delete 0fae98e1-0f2e-4f8d-bdab-7ce1cf475676",
+    Output: { Code: "AuthzAssignmentDeleted", Data: {} }
+  },
+  {
+    Description: 'Batch: delete multiple role assignments from a JSON file. The file must be a JSON array of assignment-id strings, e.g. ["0fae...","1aab..."]',
+    Command: "uip admin authorization roles assignments delete --file ./assignment-ids.json",
+    Output: { Code: "AuthzAssignmentDeleted", Data: {} }
+  }
+];
+async function getApi(options) {
+  const [err, client] = await catchError(createPapClient(RoleAssignmentApi, {
+    loginValidity: options.loginValidity
+  }));
+  if (err) {
+    await emitFailure(err, LOGIN_INSTRUCTIONS);
+    return null;
+  }
+  return client;
+}
+var registerAssignmentsCommands = (roles) => {
+  const assignments = roles.command("assignments").description("Manage who-has-what-role within the organization (Policy Administration Point).");
+  withLoginValidity(assignments.command("list").description([
+    "List role assignments for the caller's organization, grouped by",
+    "identity. The /api/userroleassignments endpoint takes an exact-match",
+    "`scope` path; the CLI composes it from --scope, --service, --scope-id",
+    "and --tenant-id along the same scope/service axes as `roles list`",
+    "(note: `assignments list` defaults to the login tenant when those",
+    "flags are omitted; `roles list` returns an unfiltered pass-through):",
+    "",
+    "  (no scope flags)                      scope=/tenant/<tid>  (default),",
+    "                                        serviceName=centralizedaccess",
+    "  --scope Organization (no --service)   scope=/, serviceName=centralizedaccess,",
+    "                                        roleScopeType=organization",
+    "  --scope Tenant       (no --service)   scope=/tenant/<tid>,",
+    "                                        serviceName=centralizedaccess",
+    "  --service <org-svc>                   scope=/, serviceName=<svc>,",
+    "                                        roleScopeType=organization",
+    "  --service <tenant-svc>                scope=/tenant/<tid>/<svc>,",
+    "                                        serviceName=<svc>",
+    "  --scope Project|Folder|App            scope=/tenant/<tid>/<svc>/",
+    "    --service <svc> --scope-id <id>     <project|folder|app>/<id>,",
+    "                                        serviceName=<svc>",
+    "  --scope-path <path>                   verbatim (advanced escape hatch)",
+    "",
+    "TenantGlobal is not a valid assignment scope. Listing works for every",
+    "service (including services that manage their own role assignments",
+    "and platform-level services); only authoring is blocked.",
+    "",
+    "By default `noInheritance=true` so only direct assignments at the",
+    "requested scope are returned. Pass --include-inherited to walk up the",
+    "scope tree (Org -> Tenant -> sub-scope)."
+  ].join(`
+`)).option("--limit <n>", "Page size — maximum number of assignment groups to return (server caps at 10).", parseIntOption, 10).option("--offset <n>", "Number of records to skip before the returned page (zero-based).", parseIntOption, 0).option("--service <service>", "Owning service (e.g. apps, documentunderstanding). Combines with --scope, or used alone sets the scope path from the service registry.").option("--identity-id <id>", "Restrict to assignments for a single identity (user / group / external app).").addOption(new Option("--scope <type>", "Scope: Organization, Tenant, Project, Folder, or App (case-insensitive). TenantGlobal is not allowed. Project/Folder/App require --service and --scope-id. Defaults to the login tenant when all of --scope, --service, and --scope-path are omitted.").argParser(canonicalizeAssignmentListScope)).option("--scope-id <id>", "Project id / folder name/id / app id for --scope Project|Folder|App. Combined with --service to build the sub-scope path.").option("--scope-path <path>", "Advanced: send this exact path verbatim to the API (server-side exact match). Overrides --scope, --tenant-id, and --scope-id.").option("--tenant-id <guid>", "Tenant UUID. Used for Tenant / Project / Folder / App scopes; defaults to the login tenant when omitted.").option("--include-inherited", "Include assignments inherited from parent scopes (default: direct only).").examples(LIST_EXAMPLES2)).trackedAction(processContext, async (options) => {
+    const client = await getApi(options);
+    if (!client)
+      return;
+    const filter = shapeAssignmentListFilter({
+      scope: options.scope,
+      serviceFlag: options.service,
+      scopeIdFlag: options.scopeId,
+      scopePathFlag: options.scopePath,
+      tenantIdFlag: options.tenantId,
+      loginTenantId: client.tenantId
+    });
+    if (filter === null)
+      return;
+    const noInheritance = options.includeInherited !== true;
+    const [error, result] = await catchError(client.api.apiUserroleassignmentsGet({
+      xUipathInternalAccountid: client.organizationId,
+      top: options.limit,
+      skip: options.offset,
+      serviceName: filter.serviceName,
+      securityPrincipalId: options.identityId,
+      scope: filter.scope,
+      roleScopeType: filter.roleScopeType,
+      noInheritance
+    }));
+    if (error) {
+      await emitFailure(error, "Verify --service / --identity-id / --scope / --tenant-id values; ensure the organization has assignments to list.");
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "AuthzAssignmentsList",
+      Data: result
+    });
+  });
+  withLoginValidity(assignments.command("create").description([
+    "Create one or more role assignments.",
+    "",
+    "Inline mode: --role-id + --identity-id + --identity-type, plus the same",
+    "scope-composition flags as `assignments list` (--scope / --service /",
+    "--scope-id / --scope-path / --tenant-id). The CLI composes the body's",
+    "`scope` path using the same matrix:",
+    "",
+    "  (no scope flags)                      scope=/tenant/<tid>  (default)",
+    "  --scope Organization                  scope=/",
+    "  --scope Tenant | TenantGlobal         scope=/tenant/<tid>",
+    "  --service <org-svc>                   scope=/",
+    "  --service <tenant-svc>                scope=/tenant/<tid>/<svc>",
+    "  --scope Project|Folder|App            scope=/tenant/<tid>/<svc>/",
+    "    --service <svc> --scope-id <id>     <project|folder|app>/<id>",
+    "  --scope-path <path>                   verbatim (advanced)",
+    "",
+    "TenantGlobal is accepted on create (assigns a TenantGlobal-shape role",
+    "to a specific tenant); the resulting path is /tenant/<tid>, same as",
+    "--scope Tenant.",
+    "",
+    "Services that manage their own role assignments (orchestrator,",
+    "dataservice, insights, taskmining, testmanager, automationops,",
+    "casemanagement, processmining) and platform-level services (authz,",
+    "oms, platform, identity, licensing) are rejected when passed via",
+    "--service — same rule as `roles create`. Use --scope-path for",
+    "verbatim assignments against those services.",
+    "",
+    "Batch mode (--file): pass a JSON array of AddRoleAssignmentRequest;",
+    "each entry carries its own `scope` field, so the inline flags above",
+    "are not used. All entries are sent atomically.",
+    "  {",
+    '    "roleId":                  "<role-guid>",',
+    '    "securityPrincipalId":     "<identity-guid>",',
+    '    "securityPrincipalType":   "User" | "Group" | "Robot" | "ExternalApplication",',
+    '    "scope":                   "<scope-path>",',
+    '    "tenantId":                "<tenant-guid>"   // optional',
+    "  }"
+  ].join(`
+`)).option("--file <path>", "Path to a JSON file containing an array of AddRoleAssignmentRequest objects (batch mode).").option("--role-id <guid>", "Role UUID to assign.").option("--identity-id <guid>", "Security principal UUID (user / group / external app / robot).").addOption(new Option("--identity-type <type>", "Type of the security principal.").choices(PRINCIPAL_TYPE_VALUES)).option("--service <service>", "Owning service (e.g. apps, documentunderstanding). Combines with --scope, or used alone sets the scope path from the service registry.").addOption(new Option("--scope <type>", "Scope: Organization, TenantGlobal, Tenant, Project, Folder, or App (case-insensitive). Project/Folder/App require --service and --scope-id. Defaults to the login tenant when all of --scope, --service, and --scope-path are omitted.").argParser(canonicalizeAssignmentCreateScope)).option("--scope-id <id>", "Project id / folder name/id / app id for --scope Project|Folder|App. Combined with --service to build the sub-scope path.").option("--scope-path <path>", "Advanced: send this exact path verbatim in the assignment body (overrides --scope, --service, --scope-id, --tenant-id).").option("--tenant-id <guid>", "Tenant UUID for Tenant / TenantGlobal / Project / Folder / App scopes. Defaults to the login tenant when omitted.").examples(CREATE_EXAMPLES)).trackedAction(processContext, async (options) => {
+    const inlineProvided = options.roleId !== undefined || options.identityId !== undefined || options.identityType !== undefined || options.scope !== undefined || options.service !== undefined || options.scopeId !== undefined || options.scopePath !== undefined || options.tenantId !== undefined;
+    if (options.file !== undefined && inlineProvided) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: "--file is mutually exclusive with the inline flags (--role-id / --identity-id / --identity-type / --scope / --service / --scope-id / --scope-path / --tenant-id).",
+        Instructions: "Pass either --file for batch mode, or the inline flags for a single assignment."
+      });
+      processContext.exit(1);
+      return;
+    }
+    if (options.file === undefined && !inlineProvided) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: "Provide either --file or the inline flags (--role-id, --identity-id, --identity-type, plus --scope/--service/--scope-path).",
+        Instructions: "Single assignment: --role-id <guid> --identity-id <guid> --identity-type User|Group|ExternalApplication|Robot, plus --scope/--service/--scope-path. Batch: --file <path>."
+      });
+      processContext.exit(1);
+      return;
+    }
+    const client = await getApi(options);
+    if (!client)
+      return;
+    let body;
+    if (options.file !== undefined) {
+      const [loadErr, loaded] = await loadJsonFile(options.file, "AddRoleAssignmentRequest[]");
+      if (loadErr) {
+        emitLoadError(loadErr);
+        return;
+      }
+      if (!Array.isArray(loaded) || loaded.length === 0) {
+        OutputFormatter.error({
+          Result: RESULTS.Failure,
+          Message: "Expected --file to contain a non-empty JSON array of AddRoleAssignmentRequest objects.",
+          Instructions: "Wrap each assignment in a `[]` array; use `roles assignments delete` for removals."
+        });
+        processContext.exit(1);
+        return;
+      }
+      body = loaded;
+    } else {
+      if (options.roleId === undefined || options.identityId === undefined || options.identityType === undefined) {
+        OutputFormatter.error({
+          Result: RESULTS.Failure,
+          Message: "Inline mode requires --role-id, --identity-id and --identity-type.",
+          Instructions: "Add the missing flag(s), or switch to --file for batch mode."
+        });
+        processContext.exit(1);
+        return;
+      }
+      const shaped = shapeAssignmentCreateScope({
+        scope: options.scope,
+        serviceFlag: options.service,
+        scopeIdFlag: options.scopeId,
+        scopePathFlag: options.scopePath,
+        tenantIdFlag: options.tenantId,
+        loginTenantId: client.tenantId
+      });
+      if (shaped === null)
+        return;
+      body = [
+        {
+          roleId: options.roleId,
+          securityPrincipalId: options.identityId,
+          securityPrincipalType: options.identityType,
+          scope: shaped.scope,
+          tenantId: shaped.tenantId
+        }
+      ];
+    }
+    const [error, response] = await catchError(client.api.apiUserroleassignmentsPatchRaw({
+      xUipathInternalAccountid: client.organizationId,
+      bulkUpdateRoleAssignmentsDto: {
+        roleAssignmentsToAdd: body,
+        roleAssignmentsToDelete: []
+      }
+    }));
+    if (error || !response) {
+      await emitFailure(error ?? new Error("Empty response"), "Verify the assignment fields (roleId / securityPrincipalId / securityPrincipalType / scope-path).");
+      return;
+    }
+    const responseBody = await extractResponseData(response);
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "AuthzAssignmentCreated",
+      Data: responseBody ?? {}
+    });
+  });
+  withLoginValidity(assignments.command("delete").description([
+    "Delete one or more role assignments by id.",
+    "",
+    "Single removal: pass the assignment UUID positionally.",
+    "Batch:          pass --file with a JSON array of assignment-id",
+    "                strings, e.g.",
+    '                  ["0fae98e1-...", "1aab33cf-..."]',
+    "",
+    "All ids are sent to the bulk-update endpoint atomically; partial",
+    "failure rolls back the whole batch (best-effort, per the API contract).",
+    "Discover assignment ids with `uip admin authorization roles",
+    "assignments list`.",
+    "",
+    "Idempotency note: the bulk-update endpoint silently no-ops on",
+    "unknown / already-deleted ids and still returns Success — this",
+    "command does NOT verify the ids existed beforehand. If you need",
+    "to confirm the deletion happened, list before/after."
+  ].join(`
+`)).argument("[id]", "Single assignment UUID. Mutually exclusive with --file.").option("--file <path>", "Path to a JSON file containing an array of assignment-id strings (batch mode).").examples(DELETE_EXAMPLES)).trackedAction(processContext, async (idArg, options) => {
+    if (options.file !== undefined && idArg !== undefined) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: "Positional <id> is mutually exclusive with --file.",
+        Instructions: "Pass either the positional UUID for a single deletion, or --file <path> for batch mode."
+      });
+      processContext.exit(1);
+      return;
+    }
+    if (options.file === undefined && idArg === undefined) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: "Provide either a positional assignment UUID or --file.",
+        Instructions: "Single deletion: pass the UUID positionally. Batch: --file <path>."
+      });
+      processContext.exit(1);
+      return;
+    }
+    let body;
+    if (options.file !== undefined) {
+      const [loadErr, loaded] = await loadJsonFile(options.file, "string[] (assignment ids)");
+      if (loadErr) {
+        emitLoadError(loadErr);
+        return;
+      }
+      if (!Array.isArray(loaded) || loaded.length === 0 || loaded.some((entry) => typeof entry !== "string")) {
+        OutputFormatter.error({
+          Result: RESULTS.Failure,
+          Message: "Expected --file to contain a non-empty JSON array of assignment-id strings.",
+          Instructions: 'Format: ["<assignment-guid>", ...]. Use `roles assignments create` to add assignments.'
+        });
+        processContext.exit(1);
+        return;
+      }
+      body = loaded;
+    } else {
+      body = [idArg];
+    }
+    const client = await getApi(options);
+    if (!client)
+      return;
+    const [error, response] = await catchError(client.api.apiUserroleassignmentsPatchRaw({
+      xUipathInternalAccountid: client.organizationId,
+      bulkUpdateRoleAssignmentsDto: {
+        roleAssignmentsToAdd: [],
+        roleAssignmentsToDelete: body
+      }
+    }));
+    if (error || !response) {
+      await emitFailure(error ?? new Error("Empty response"), "Verify each id is a valid assignment id obtained from `roles assignments list`.");
+      return;
+    }
+    const responseBody = await extractResponseData(response);
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "AuthzAssignmentDeleted",
+      Data: responseBody ?? {}
+    });
+  });
+};
+
+// ../authz-commands/src/commands/roles.ts
+var SAMPLE_ID = "11111111-2222-3333-4444-555555555555";
+var LIST_EXAMPLES3 = [
+  {
+    Description: "List the first 20 roles in the organization",
+    Command: "uip admin authorization roles list",
+    Output: {
+      Code: "AuthzRolesList",
+      Data: {
+        totalCount: 1,
+        results: [
+          {
+            id: SAMPLE_ID,
+            name: "Folder Admin",
+            description: "Folder admin role",
+            type: "BuiltIn",
+            scopeType: "Folder",
+            ownerServiceName: "orchestrator",
+            ownerServiceId: "<service-guid>",
+            tenantId: "<tenant-guid>",
+            createdBy: "<user-guid>",
+            createdOn: "<iso-date>",
+            actionDetails: []
+          }
+        ]
+      }
+    }
+  },
+  {
+    Description: "Filter by role shape — org-wide roles only",
+    Command: "uip admin authorization roles list --scope Organization",
+    Output: {
+      Code: "AuthzRolesList",
+      Data: { totalCount: 0, results: [] }
+    }
+  },
+  {
+    Description: "Filter by service — scope is inferred from the service registry (apps → Organization)",
+    Command: "uip admin authorization roles list --service apps --filter Admin",
+    Output: {
+      Code: "AuthzRolesList",
+      Data: { totalCount: 0, results: [] }
+    }
+  },
+  {
+    Description: "Filter by tenant-service — scope is inferred (documentunderstanding → Tenant)",
+    Command: "uip admin authorization roles list --service documentunderstanding",
+    Output: {
+      Code: "AuthzRolesList",
+      Data: { totalCount: 0, results: [] }
+    }
+  }
+];
+var GET_EXAMPLES = [
+  {
+    Description: "Fetch a role by id",
+    Command: `uip admin authorization roles get ${SAMPLE_ID}`,
+    Output: {
+      Code: "AuthzRoleGet",
+      Data: {
+        id: SAMPLE_ID,
+        name: "Folder Admin",
+        description: "Folder admin role",
+        type: "BuiltIn",
+        scopeType: "Folder",
+        ownerServiceName: "orchestrator",
+        ownerServiceId: "<service-guid>",
+        tenantId: "<tenant-guid>",
+        createdBy: "<user-guid>",
+        createdOn: "<iso-date>",
+        actionDetails: [
+          {
+            id: "<action-guid>",
+            name: "OR.FOLDERS.READ",
+            namespace: "ORCHESTRATOR",
+            serviceDisplayName: "Orchestrator",
+            resourceType: "Folders",
+            resourceAction: "Read",
+            resourceGroup: "Folder",
+            description: "View folders"
+          }
+        ]
+      }
+    }
+  }
+];
+var CREATE_EXAMPLES2 = [
+  {
+    Description: "Organization role — actions in --file, identity via inline flags.",
+    Command: 'uip admin authorization roles create --scope Organization --name "Org Reader" --description "Read-only org admin" --file ./actions.json',
+    Output: {
+      Code: "AuthzRoleCreated",
+      Data: { createdRoleId: "<new-role-guid>" }
+    }
+  },
+  {
+    Description: "Tenant-wide role within the login tenant (default) or a specific tenant via --tenant-id.",
+    Command: 'uip admin authorization roles create --scope Tenant --name "Tenant Reader" --file ./actions.json',
+    Output: {
+      Code: "AuthzRoleCreated",
+      Data: { createdRoleId: "<new-role-guid>" }
+    }
+  },
+  {
+    Description: "Tenant-global template (Tenant scope, no tenant id) — applies across tenants.",
+    Command: 'uip admin authorization roles create --scope TenantGlobal --name "Tenant Reader Template" --file ./actions.json',
+    Output: {
+      Code: "AuthzRoleCreated",
+      Data: { createdRoleId: "<new-role-guid>" }
+    }
+  },
+  {
+    Description: "Org-service role — --service names the owning service; the CLI infers the scope from the service registry (apps → Organization).",
+    Command: 'uip admin authorization roles create --service apps --name "Apps Author" --file ./actions.json',
+    Output: {
+      Code: "AuthzRoleCreated",
+      Data: { createdRoleId: "<new-role-guid>" }
+    }
+  },
+  {
+    Description: "Tenant-service role — the CLI infers Tenant scope from the registry (documentunderstanding → Tenant).",
+    Command: 'uip admin authorization roles create --service documentunderstanding --name "DU Tenant Editor" --file ./actions.json',
+    Output: {
+      Code: "AuthzRoleCreated",
+      Data: { createdRoleId: "<new-role-guid>" }
+    }
+  },
+  {
+    Description: "Project-scoped role for a service that registers Project-scope permissions (e.g. Document Understanding, Reinfer).",
+    Command: 'uip admin authorization roles create --scope Project --service documentunderstanding --name "DU Project Editor" --file ./actions.json',
+    Output: {
+      Code: "AuthzRoleCreated",
+      Data: { createdRoleId: "<new-role-guid>" }
+    }
+  }
+];
+var UPDATE_EXAMPLES = [
+  {
+    Description: "Update an existing tenant-wide role by id; CLI re-derives scope/tenant from --scope.",
+    Command: `uip admin authorization roles update ${SAMPLE_ID} --scope Tenant --name "Tenant Reader" --file ./actions.json`,
+    Output: {
+      Code: "AuthzRoleUpdated",
+      Data: { createdRoleId: SAMPLE_ID }
+    }
+  }
+];
+var DELETE_EXAMPLES2 = [
+  {
+    Description: "Delete a custom role by id",
+    Command: `uip admin authorization roles delete ${SAMPLE_ID}`,
+    Output: { Code: "AuthzRoleDeleted", Data: {} }
+  }
+];
+async function getApi2(options) {
+  const [err, client] = await catchError(createPapClient(RoleApi, { loginValidity: options.loginValidity }));
+  if (err) {
+    await emitFailure(err, LOGIN_INSTRUCTIONS);
+    return null;
+  }
+  return client;
+}
+var registerRolesCommands = (authz) => {
+  const roles = authz.command("roles").description("Manage custom role definitions on the Policy Administration Point (PAP).");
+  withLoginValidity(roles.command("list").description([
+    "List roles for the caller's organization. Returns both built-in and",
+    "custom roles by default; pass `--role-type BuiltIn|Custom` to restrict.",
+    "",
+    "Filter by `--scope` and `--service` (with `--tenant-id` for Tenant /",
+    "Project / Folder scopes). The CLI maps the flags directly to the PAP",
+    "`GET /api/roles` query parameters:",
+    "",
+    "  --scope Organization (no --service)   serviceName=centralizedaccess,",
+    "                                        scopeType=Organization",
+    "  --scope TenantGlobal (no --service)   serviceName=centralizedaccess,",
+    "                                        scopeType=Tenant,",
+    "                                        tenantId=00000000-…",
+    "  --scope Tenant       (no --service)   serviceName=centralizedaccess,",
+    "                                        scopeType=Tenant,",
+    "                                        tenantId=<login>",
+    "  --service <org-svc>                   scopeType=Organization,",
+    "                                        tenantId=00000000-…",
+    "  --service <tenant-svc>                scopeType=Tenant (default;",
+    "                                        Project/Folder via --scope),",
+    "                                        tenantId=<login>",
+    "",
+    "Listing works for every service, including services that manage their",
+    "own role catalog (orchestrator, dataservice, insights, taskmining,",
+    "testmanager, automationops, casemanagement, processmining) and",
+    "platform-level services (authz, oms, platform, identity, licensing)",
+    "— only authoring is blocked.",
+    "",
+    "`--filter` is a substring match on role name."
+  ].join(`
+`)).option("--limit <n>", "Page size — maximum number of roles to return.", parseIntOption, 20).option("--offset <n>", "Number of records to skip before the returned page (zero-based).", parseIntOption, 0).option("--filter <fragment>", "Substring filter on role name.").option("--service <service>", "Owning service (e.g. apps, documentunderstanding). Combines with --scope, or sets the scope from the service registry when used alone.").addOption(new Option("--scope <type>", "Filter by role shape: Organization, TenantGlobal, Tenant, Project, or Folder (case-insensitive). Optional when --service is provided (the registry infers the scope).").argParser(canonicalizeRoleListScope)).addOption(new Option("--role-type <type>", "Filter by role type (BuiltIn / Custom).").choices(["BuiltIn", "Custom"])).option("--tenant-id <guid>", "Restrict to roles scoped to a specific tenant UUID. Use `uip admin tenants list --filter <name>` to look up a UUID by name.").examples(LIST_EXAMPLES3)).trackedAction(processContext, async (options) => {
+    const client = await getApi2(options);
+    if (!client)
+      return;
+    const filter = shapeRoleListFilter({
+      scope: options.scope,
+      serviceFlag: options.service,
+      tenantIdFlag: options.tenantId,
+      loginTenantId: client.tenantId
+    });
+    if (filter === null)
+      return;
+    const [error, result] = await catchError(client.api.apiRolesGet({
+      xUipathInternalAccountid: client.organizationId,
+      top: options.limit,
+      skip: options.offset,
+      contains: options.filter,
+      serviceName: filter.serviceName,
+      scopeType: filter.scopeType,
+      roleType: options.roleType,
+      tenantId: filter.tenantId
+    }));
+    if (error) {
+      await emitFailure(error, "Verify the filter values; if --filter contains special characters, quote the value.");
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "AuthzRolesList",
+      Data: result
+    });
+  });
+  withLoginValidity(roles.command("get").description("Fetch a single role by id. Built-in roles are read-only and have a fixed id.").argument("<id>", "Role UUID. Obtain from `roles list`.").examples(GET_EXAMPLES)).trackedAction(processContext, async (id, options) => {
+    const client = await getApi2(options);
+    if (!client)
+      return;
+    const [error, result] = await catchError(client.api.apiRolesRoleIdGet({
+      roleId: id,
+      xUipathInternalAccountid: client.organizationId
+    }));
+    if (error) {
+      await emitFailure(error, "Check the role UUID with 'uip admin authorization roles list'.");
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "AuthzRoleGet",
+      Data: result
+    });
+  });
+  withLoginValidity(roles.command("create").description([
+    "Create a custom role. The endpoint is a PUT-style upsert; this command",
+    "always creates (the role id is generated server-side). Use",
+    "`roles update <id>` to modify an existing role.",
+    "",
+    "Role identity is supplied via inline flags (--name, --description,",
+    "--service) and the role's granted actions come from --file, which",
+    "must contain a JSON array of action names, e.g.",
+    '`["STUDIO.X.Y", "STUDIO.A.B"]`.',
+    "",
+    "The role's shape comes from `--scope` and/or `--service` (at least",
+    "one is required):",
+    "",
+    "  --scope Organization              Org-wide role. --tenant-id not",
+    "                                    allowed.",
+    "  --scope TenantGlobal              Tenant-wide template applied across",
+    "                                    all tenants. --tenant-id not allowed.",
+    "  --scope Tenant                    Tenant-wide role within one tenant.",
+    "                                    --tenant-id selects the tenant",
+    "                                    (defaults to the login tenant).",
+    "  --scope Project --service <svc>   Project-scoped role for a service",
+    "                                    that registers Project-scope perms",
+    "                                    (e.g. documentunderstanding, reinfer).",
+    "                                    --tenant-id selects the tenant",
+    "                                    (defaults to login).",
+    "  --service <svc>                   Service-specific role. The scope is",
+    "                                    inferred from the service registry —",
+    "                                    tenant-service → Tenant scope,",
+    "                                    org-service → Organization scope.",
+    "                                    Combine with --scope to override.",
+    "",
+    "Examples of the inference (the CLI passes --service through verbatim",
+    "as the roleService — no abbreviation):",
+    "  --service apps                    → Organization scope, roleService=apps",
+    "  --service documentunderstanding   → Tenant scope, roleService=documentunderstanding",
+    "  --scope Project",
+    "    --service documentunderstanding → Project scope, roleService=documentunderstanding",
+    "",
+    "When --scope is given without --service, roleService defaults to the",
+    "platform's centralized-access marker (cross-cutting role).",
+    "",
+    "Services that manage their own role catalog (orchestrator, dataservice,",
+    "insights, taskmining, testmanager, automationops, casemanagement,",
+    "processmining) and platform-level services (authz, oms, platform,",
+    "identity, licensing) cannot be used with --service."
+  ].join(`
+`)).requiredOption("--name <name>", "Role display name.").option("--description <text>", "Optional human-readable description of the role.").option("--service <service>", "Owning service (e.g. apps, documentunderstanding). Used alone, infers the scope from the service registry; combine with --scope to override.").requiredOption("--file <path>", `Path to a JSON file containing the role's granted actions as an array of strings, e.g. ["STUDIO.X.Y", "STUDIO.A.B"].`).addOption(new Option("--scope <type>", "Role shape: Organization, TenantGlobal, Tenant, or Project (case-insensitive). Optional when --service is provided (inferred from the service registry).").argParser(canonicalizeRoleAuthoringScope)).option("--tenant-id <guid>", "Tenant UUID. Only valid when the resolved scope is Tenant or Project. Defaults to the login tenant when omitted.").examples(CREATE_EXAMPLES2)).trackedAction(processContext, async (options) => {
+    const client = await getApi2(options);
+    if (!client)
+      return;
+    const shaped = shapeCustomRoleBody({
+      scope: options.scope,
+      serviceFlag: options.service,
+      tenantIdFlag: options.tenantId,
+      loginTenantId: client.tenantId
+    });
+    if (shaped === null)
+      return;
+    const [loadErr, actions] = await loadActionsFile(options.file);
+    if (loadErr) {
+      emitLoadError(loadErr);
+      return;
+    }
+    const requestBody = {
+      roleName: options.name,
+      roleDescription: options.description ?? "",
+      roleService: shaped.roleService,
+      roleScopeType: shaped.roleScopeType,
+      tenantId: shaped.tenantId ?? null,
+      organizationId: client.organizationId,
+      actionsGrantedByRole: actions
+    };
+    const [error, response] = await catchError(client.api.apiRolesPutRaw({
+      xUipathInternalAccountid: client.organizationId,
+      addCustomRoleRequestDto: requestBody
+    }));
+    if (error || !response) {
+      await emitFailure(error ?? new Error("Empty response"), "Verify --file contains a JSON array of action strings, and that --name and --scope are correct.");
+      return;
+    }
+    const responseBody = await extractResponseData(response);
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "AuthzRoleCreated",
+      Data: responseBody ?? {}
+    });
+  });
+  withLoginValidity(roles.command("update").description([
+    "Update an existing custom role by id. The endpoint is the same",
+    "PUT-style upsert as `create`; the positional id is sent on the body.",
+    "",
+    "Role identity is supplied via inline flags (--name, --description,",
+    "--service) and the role's granted actions come from --file (a JSON",
+    "array of action names, same shape as `roles create`).",
+    "",
+    "Pass `--scope` and/or `--service` to declare the role's shape after",
+    "the update. The CLI re-derives roleService / roleScopeType / tenantId",
+    "from those flags + the login context using the same matrix as",
+    "`roles create` — see `roles create --help` for the full mapping.",
+    "",
+    "Same authoring restrictions as `create`: --service rejects services",
+    "that manage their own role catalog (orchestrator, dataservice,",
+    "insights, taskmining, testmanager, automationops, casemanagement,",
+    "processmining) and platform-level services (authz, oms, platform,",
+    "identity, licensing)."
+  ].join(`
+`)).argument("<id>", "Role UUID. Obtain from `roles list`.").requiredOption("--name <name>", "Role display name.").option("--description <text>", "Human-readable description of the role. When omitted, the role's current description is preserved (the CLI fetches the role first to read its current value). Pass an empty string to explicitly clear the description.").option("--service <service>", "Owning service (e.g. apps, documentunderstanding). Used alone, infers the scope from the service registry; combine with --scope to override.").requiredOption("--file <path>", `Path to a JSON file containing the role's granted actions as an array of strings, e.g. ["STUDIO.X.Y", "STUDIO.A.B"].`).addOption(new Option("--scope <type>", "Role shape: Organization, TenantGlobal, Tenant, or Project (case-insensitive). Optional when --service is provided.").argParser(canonicalizeRoleAuthoringScope)).option("--tenant-id <guid>", "Tenant UUID. Only valid when the resolved scope is Tenant or Project. Defaults to the login tenant when omitted.").examples(UPDATE_EXAMPLES)).trackedAction(processContext, async (id, options) => {
+    const client = await getApi2(options);
+    if (!client)
+      return;
+    const shaped = shapeCustomRoleBody({
+      scope: options.scope,
+      serviceFlag: options.service,
+      tenantIdFlag: options.tenantId,
+      loginTenantId: client.tenantId
+    });
+    if (shaped === null)
+      return;
+    const [loadErr, actions] = await loadActionsFile(options.file);
+    if (loadErr) {
+      emitLoadError(loadErr);
+      return;
+    }
+    let resolvedDescription;
+    if (options.description !== undefined) {
+      resolvedDescription = options.description;
+    } else {
+      const [fetchErr, role] = await catchError(client.api.apiRolesRoleIdGet({
+        roleId: id,
+        xUipathInternalAccountid: client.organizationId
+      }));
+      if (fetchErr) {
+        await emitFailure(fetchErr, "Check the role UUID with 'uip admin authorization roles list'.");
+        return;
+      }
+      resolvedDescription = role.description;
+    }
+    const [error, response] = await catchError(client.api.apiRolesPutRaw({
+      xUipathInternalAccountid: client.organizationId,
+      addCustomRoleRequestDto: {
+        id,
+        roleName: options.name,
+        roleDescription: resolvedDescription,
+        roleService: shaped.roleService,
+        roleScopeType: shaped.roleScopeType,
+        tenantId: shaped.tenantId ?? null,
+        organizationId: client.organizationId,
+        actionsGrantedByRole: actions
+      }
+    }));
+    if (error || !response) {
+      await emitFailure(error ?? new Error("Empty response"), "Verify the role UUID and that --file contains a JSON array of action strings.");
+      return;
+    }
+    const responseBody = await extractResponseData(response);
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "AuthzRoleUpdated",
+      Data: responseBody ?? {}
+    });
+  });
+  withLoginValidity(roles.command("delete").description([
+    "Delete a custom role by id. Built-in and host-organization roles",
+    "cannot be deleted; nor can roles owned by their originating service",
+    "or by platform-level services (the CLI pre-fetches the role and",
+    "refuses with a redirect)."
+  ].join(`
+`)).argument("<id>", "Role UUID. Obtain from `roles list`.").examples(DELETE_EXAMPLES2)).trackedAction(processContext, async (id, options) => {
+    const client = await getApi2(options);
+    if (!client)
+      return;
+    const [fetchErr, role] = await catchError(client.api.apiRolesRoleIdGet({
+      roleId: id,
+      xUipathInternalAccountid: client.organizationId
+    }));
+    if (fetchErr) {
+      await emitFailure(fetchErr, "Check the role UUID with 'uip admin authorization roles list'.");
+      return;
+    }
+    const ownerServiceName = role.ownerServiceName;
+    const owningService = typeof ownerServiceName === "string" && ownerServiceName.length > 0 ? ownerServiceName : inferRoleService(role);
+    if (rejectIfRoleAuthoringBlocked(owningService, "delete"))
+      return;
+    const [error, response] = await catchError(client.api.apiRolesRoleIdDeleteRaw({
+      roleId: id,
+      xUipathInternalAccountid: client.organizationId
+    }));
+    if (error || !response) {
+      await emitFailure(error ?? new Error("Empty response"), "Check the role UUID with 'uip admin authorization roles list'.");
+      return;
+    }
+    const responseBody = await extractResponseData(response);
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "AuthzRoleDeleted",
+      Data: responseBody ?? {}
+    });
+  });
+  registerAssignmentsCommands(roles);
+};
+
+// ../authz-commands/src/commands/authz.ts
+var registerAuthzCommands = (program) => {
+  const authorization = program.command("authorization").description([
+    "Manage UiPath Authorization-service primitives (roles, role assignments,",
+    "permissions catalog, and effective-access lookups).",
+    "",
+    "Subcommand groups:",
+    "  roles         — custom role CRUD plus nested `assignments` (PAP).",
+    "  permissions   — read-only catalog of permission definitions.",
+    "  check-access  — compute effective permissions for a principal (PDP)."
+  ].join(`
+`));
+  registerRolesCommands(authorization);
+  registerPermissionsCommands(authorization);
+  registerCheckAccessCommand(authorization);
+};
+
+// ../authz-commands/src/index.ts
+var registerCommands = async (program) => {
+  registerAuthzCommands(program);
+};
+export {
+  registerCommands
+};
+
+//# debugId=BC57231B618E4E9864756E2164756E21