@uipath/audit-commands 1.203.0-preview.203 → 1.204.0-preview.206

package/dist/index.js

@@ -2133,8 +2133,156 @@ function getGlobalTelemetryProperties() {
   return telemetryPropsSlot.get();
 }
 
+// ../../common/src/telemetry/telemetry-dimensions.ts
+var BaseDimensions = {
+  ApplicationName: "ApplicationName",
+  ProductVersion: "ProductVersion",
+  InstallationId: "InstallationId",
+  CloudUserId: "CloudUserId",
+  CloudTenantId: "CloudTenantId",
+  CloudOrganizationId: "CloudOrganizationId",
+  IsInternalUser: "IsInternalUser",
+  Environment: "Environment",
+  BaseUrl: "BaseUrl",
+  Region: "Region",
+  Agent: "Agent",
+  AgentVersion: "AgentVersion",
+  AgentModel: "AgentModel",
+  ToolName: "ToolName",
+  ToolVersion: "ToolVersion",
+  ExecutionContext: "ExecutionContext",
+  CiProvider: "CiProvider",
+  SessionIdSource: "SessionIdSource",
+  SessionId: "SessionId"
+};
+var CommandDimensions = {
+  IsCommand: "IsCommand",
+  IsReexec: "IsReexec",
+  CommandName: "CommandName",
+  ExitCode: "ExitCode",
+  TerminalOutcome: "TerminalOutcome",
+  ErrorClass: "ErrorClass",
+  TerminalSignal: "TerminalSignal",
+  ErrorMessage: "ErrorMessage",
+  SkillName: "SkillName",
+  ProductArea: "ProductArea",
+  Mode: "Mode"
+};
+var ShipDimensions = {
+  ShipKind: "ShipKind",
+  Target: "Target",
+  ProjectType: "ProjectType",
+  ProjectTypes: "ProjectTypes",
+  ArtifactCorrelationKey: "ArtifactCorrelationKey",
+  PackageName: "PackageName",
+  PackageVersion: "PackageVersion",
+  PackageVersionKey: "PackageVersionKey",
+  DeploymentKey: "DeploymentKey",
+  SolutionId: "SolutionId",
+  FolderKey: "FolderKey",
+  FeedId: "FeedId"
+};
+var ErrorDimensions = {
+  Result: "Result",
+  ErrorCode: "ErrorCode",
+  Retry: "Retry",
+  ErrorMessage: "ErrorMessage"
+};
+var AuthDimensions = {
+  AuthenticationMethod: "AuthenticationMethod",
+  Success: "Success",
+  Reason: "Reason"
+};
+var SkillsDimensions = {
+  SchemaVersion: "SchemaVersion",
+  AgentType: "AgentType",
+  SkillsVersion: "SkillsVersion",
+  UipSubcommand: "UipSubcommand",
+  FileExtension: "FileExtension",
+  SubagentModel: "SubagentModel",
+  SubagentType: "SubagentType",
+  PermissionMode: "PermissionMode",
+  EffortLevel: "EffortLevel",
+  SessionSource: "SessionSource",
+  Outcome: "Outcome",
+  DurationMs: "DurationMs",
+  Source: "Source"
+};
+var PackagerDimensions = {
+  ProjectId: "ProjectId",
+  ProjectType: "ProjectType",
+  SolutionId: "SolutionId"
+};
+var ScopeDimensions = {
+  FolderId: "FolderId"
+};
+var ID_DIMENSIONS = new Set([
+  BaseDimensions.CloudUserId,
+  BaseDimensions.CloudTenantId,
+  BaseDimensions.CloudOrganizationId,
+  BaseDimensions.InstallationId,
+  ShipDimensions.ArtifactCorrelationKey,
+  ShipDimensions.PackageVersionKey,
+  ShipDimensions.DeploymentKey,
+  ShipDimensions.SolutionId,
+  ShipDimensions.FolderKey,
+  ShipDimensions.FeedId,
+  PackagerDimensions.ProjectId
+]);
+var NON_IDENTIFIER_PLACEHOLDER_PATTERN = /^(?:\[[A-Z_]+\]|<[^>]+>)$/;
+var RESERVED_DIMENSION_NAMES = new Set([
+  ...Object.values(BaseDimensions),
+  ...Object.values(CommandDimensions),
+  ...Object.values(ShipDimensions),
+  ...Object.values(ErrorDimensions),
+  ...Object.values(AuthDimensions),
+  ...Object.values(SkillsDimensions),
+  ...Object.values(PackagerDimensions),
+  ...Object.values(ScopeDimensions)
+]);
+var CURATED_DIMENSIONS = new Set([
+  BaseDimensions.ApplicationName,
+  BaseDimensions.ProductVersion,
+  BaseDimensions.InstallationId,
+  BaseDimensions.CloudUserId,
+  BaseDimensions.CloudTenantId,
+  BaseDimensions.CloudOrganizationId,
+  BaseDimensions.IsInternalUser,
+  BaseDimensions.Environment,
+  BaseDimensions.BaseUrl,
+  BaseDimensions.Region,
+  BaseDimensions.Agent,
+  BaseDimensions.AgentVersion,
+  BaseDimensions.ToolVersion,
+  BaseDimensions.ExecutionContext,
+  BaseDimensions.CiProvider,
+  BaseDimensions.SessionIdSource,
+  BaseDimensions.SessionId,
+  ...Object.values(CommandDimensions),
+  ...Object.values(ShipDimensions)
+]);
+function lowercaseIdDimensionValues(properties) {
+  let changed = false;
+  const result = {
+    ...properties
+  };
+  for (const key of Object.keys(result)) {
+    const value = result[key];
+    if (!ID_DIMENSIONS.has(key) || typeof value !== "string" || NON_IDENTIFIER_PLACEHOLDER_PATTERN.test(value)) {
+      continue;
+    }
+    const lowered = value.toLowerCase();
+    if (lowered !== value) {
+      result[key] = lowered;
+      changed = true;
+    }
+  }
+  return changed ? result : properties;
+}
+
 // ../../common/src/sdk-user-agent.ts
 var USER_AGENT_HEADER = "User-Agent";
+var AGENT_PROPERTY = BaseDimensions.Agent;
 var sdkUserAgentHostToken = singleton("SdkUserAgentHostToken");
 function userAgentPatchKey(userAgent) {
   return Symbol.for(`@uipath/common/sdk-user-agent/${userAgent}`);
@@ -2414,6 +2562,19 @@ class FetchError extends Error {
     }
   }
 }
+
+class RequiredError extends Error {
+  field;
+  name = "RequiredError";
+  constructor(field, msg) {
+    super(msg);
+    this.field = field;
+    const actualProto = new.target.prototype;
+    if (Object.setPrototypeOf) {
+      Object.setPrototypeOf(this, actualProto);
+    }
+  }
+}
 function querystring(params, prefix = "") {
   return Object.keys(params).map((key) => querystringSingleKey(key, params[key], prefix)).filter((part) => part.length > 0).join("&");
 }
@@ -2461,8 +2622,8 @@ var package_default = {
   name: "@uipath/audit-sdk",
   author: "UiPath",
   license: "SEE LICENSE IN LICENSE.txt",
-  version: "1.203.0",
-  description: "SDK for the UiPath Audit Service — query audit event sources, list events, and download long-term-store exports.",
+  version: "1.204.0",
+  description: "SDK for the UiPath Audit Service — query audit event sources, list events, download long-term-store exports, and manage audit exclusion rules.",
   repository: {
     type: "git",
     url: "https://github.com/UiPath/cli.git",
@@ -2620,6 +2781,208 @@ function AuditEventSourceDtoFromJSONTyped(json, ignoreDiscriminator) {
   };
 }
 
+// ../audit-sdk/generated/src/models/ExclusionSelectorDto.ts
+function ExclusionSelectorDtoFromJSON(json) {
+  return ExclusionSelectorDtoFromJSONTyped(json, false);
+}
+function ExclusionSelectorDtoFromJSONTyped(json, ignoreDiscriminator) {
+  if (json == null) {
+    return json;
+  }
+  return {
+    type: json["type"] == null ? undefined : json["type"],
+    values: json["values"] == null ? undefined : json["values"]
+  };
+}
+function ExclusionSelectorDtoToJSON(json) {
+  return ExclusionSelectorDtoToJSONTyped(json, false);
+}
+function ExclusionSelectorDtoToJSONTyped(value, ignoreDiscriminator = false) {
+  if (value == null) {
+    return value;
+  }
+  return {
+    type: value["type"],
+    values: value["values"]
+  };
+}
+
+// ../audit-sdk/generated/src/models/ExclusionRuleDto.ts
+function ExclusionRuleDtoFromJSON(json) {
+  return ExclusionRuleDtoFromJSONTyped(json, false);
+}
+function ExclusionRuleDtoFromJSONTyped(json, ignoreDiscriminator) {
+  if (json == null) {
+    return json;
+  }
+  return {
+    policyId: json["policyId"] == null ? undefined : json["policyId"],
+    name: json["name"] == null ? undefined : json["name"],
+    enforcement: json["enforcement"] == null ? undefined : json["enforcement"],
+    isActive: json["isActive"] == null ? undefined : json["isActive"],
+    activatedOn: json["activatedOn"] == null ? undefined : new Date(json["activatedOn"]),
+    selectors: json["selectors"] == null ? undefined : json["selectors"].map(ExclusionSelectorDtoFromJSON),
+    createdOn: json["createdOn"] == null ? undefined : new Date(json["createdOn"]),
+    lastModifiedOn: json["lastModifiedOn"] == null ? undefined : new Date(json["lastModifiedOn"])
+  };
+}
+
+// ../audit-sdk/generated/src/models/ExclusionRuleWriteDto.ts
+function ExclusionRuleWriteDtoToJSON(json) {
+  return ExclusionRuleWriteDtoToJSONTyped(json, false);
+}
+function ExclusionRuleWriteDtoToJSONTyped(value, ignoreDiscriminator = false) {
+  if (value == null) {
+    return value;
+  }
+  return {
+    name: value["name"],
+    enforcement: value["enforcement"],
+    isActive: value["isActive"],
+    selectors: value["selectors"] == null ? undefined : value["selectors"].map(ExclusionSelectorDtoToJSON)
+  };
+}
+
+// ../audit-sdk/generated/src/apis/EventConfigApi.ts
+class EventConfigApi extends BaseAPI {
+  async eventConfigCreateRuleRequestOpts(requestParameters) {
+    if (requestParameters["exclusionRuleWriteDto"] == null) {
+      throw new RequiredError("exclusionRuleWriteDto", 'Required parameter "exclusionRuleWriteDto" was null or undefined when calling eventConfigCreateRule().');
+    }
+    const queryParameters = {};
+    const headerParameters = {};
+    headerParameters["Content-Type"] = "application/json";
+    if (this.configuration && this.configuration.apiKey) {
+      headerParameters["Authorization"] = await this.configuration.apiKey("Authorization");
+    }
+    let urlPath = `/api/EventConfig/rules`;
+    return {
+      path: urlPath,
+      method: "POST",
+      headers: headerParameters,
+      query: queryParameters,
+      body: ExclusionRuleWriteDtoToJSON(requestParameters["exclusionRuleWriteDto"])
+    };
+  }
+  async eventConfigCreateRuleRaw(requestParameters, initOverrides) {
+    const requestOptions = await this.eventConfigCreateRuleRequestOpts(requestParameters);
+    const response = await this.request(requestOptions, initOverrides);
+    return new JSONApiResponse(response, (jsonValue) => ExclusionRuleDtoFromJSON(jsonValue));
+  }
+  async eventConfigCreateRule(requestParameters, initOverrides) {
+    const response = await this.eventConfigCreateRuleRaw(requestParameters, initOverrides);
+    return await response.value();
+  }
+  async eventConfigDeleteRuleRequestOpts(requestParameters) {
+    if (requestParameters["policyId"] == null) {
+      throw new RequiredError("policyId", 'Required parameter "policyId" was null or undefined when calling eventConfigDeleteRule().');
+    }
+    const queryParameters = {};
+    const headerParameters = {};
+    if (this.configuration && this.configuration.apiKey) {
+      headerParameters["Authorization"] = await this.configuration.apiKey("Authorization");
+    }
+    let urlPath = `/api/EventConfig/rules/{policyId}`;
+    urlPath = urlPath.replace(`{${"policyId"}}`, encodeURIComponent(String(requestParameters["policyId"])));
+    return {
+      path: urlPath,
+      method: "DELETE",
+      headers: headerParameters,
+      query: queryParameters
+    };
+  }
+  async eventConfigDeleteRuleRaw(requestParameters, initOverrides) {
+    const requestOptions = await this.eventConfigDeleteRuleRequestOpts(requestParameters);
+    const response = await this.request(requestOptions, initOverrides);
+    return new VoidApiResponse(response);
+  }
+  async eventConfigDeleteRule(requestParameters, initOverrides) {
+    await this.eventConfigDeleteRuleRaw(requestParameters, initOverrides);
+  }
+  async eventConfigGetRuleRequestOpts(requestParameters) {
+    if (requestParameters["policyId"] == null) {
+      throw new RequiredError("policyId", 'Required parameter "policyId" was null or undefined when calling eventConfigGetRule().');
+    }
+    const queryParameters = {};
+    const headerParameters = {};
+    if (this.configuration && this.configuration.apiKey) {
+      headerParameters["Authorization"] = await this.configuration.apiKey("Authorization");
+    }
+    let urlPath = `/api/EventConfig/rules/{policyId}`;
+    urlPath = urlPath.replace(`{${"policyId"}}`, encodeURIComponent(String(requestParameters["policyId"])));
+    return {
+      path: urlPath,
+      method: "GET",
+      headers: headerParameters,
+      query: queryParameters
+    };
+  }
+  async eventConfigGetRuleRaw(requestParameters, initOverrides) {
+    const requestOptions = await this.eventConfigGetRuleRequestOpts(requestParameters);
+    const response = await this.request(requestOptions, initOverrides);
+    return new JSONApiResponse(response, (jsonValue) => ExclusionRuleDtoFromJSON(jsonValue));
+  }
+  async eventConfigGetRule(requestParameters, initOverrides) {
+    const response = await this.eventConfigGetRuleRaw(requestParameters, initOverrides);
+    return await response.value();
+  }
+  async eventConfigGetRulesRequestOpts() {
+    const queryParameters = {};
+    const headerParameters = {};
+    if (this.configuration && this.configuration.apiKey) {
+      headerParameters["Authorization"] = await this.configuration.apiKey("Authorization");
+    }
+    let urlPath = `/api/EventConfig/rules`;
+    return {
+      path: urlPath,
+      method: "GET",
+      headers: headerParameters,
+      query: queryParameters
+    };
+  }
+  async eventConfigGetRulesRaw(initOverrides) {
+    const requestOptions = await this.eventConfigGetRulesRequestOpts();
+    const response = await this.request(requestOptions, initOverrides);
+    return new JSONApiResponse(response, (jsonValue) => jsonValue.map(ExclusionRuleDtoFromJSON));
+  }
+  async eventConfigGetRules(initOverrides) {
+    const response = await this.eventConfigGetRulesRaw(initOverrides);
+    return await response.value();
+  }
+  async eventConfigReplaceRuleRequestOpts(requestParameters) {
+    if (requestParameters["policyId"] == null) {
+      throw new RequiredError("policyId", 'Required parameter "policyId" was null or undefined when calling eventConfigReplaceRule().');
+    }
+    if (requestParameters["exclusionRuleWriteDto"] == null) {
+      throw new RequiredError("exclusionRuleWriteDto", 'Required parameter "exclusionRuleWriteDto" was null or undefined when calling eventConfigReplaceRule().');
+    }
+    const queryParameters = {};
+    const headerParameters = {};
+    headerParameters["Content-Type"] = "application/json";
+    if (this.configuration && this.configuration.apiKey) {
+      headerParameters["Authorization"] = await this.configuration.apiKey("Authorization");
+    }
+    let urlPath = `/api/EventConfig/rules/{policyId}`;
+    urlPath = urlPath.replace(`{${"policyId"}}`, encodeURIComponent(String(requestParameters["policyId"])));
+    return {
+      path: urlPath,
+      method: "PUT",
+      headers: headerParameters,
+      query: queryParameters,
+      body: ExclusionRuleWriteDtoToJSON(requestParameters["exclusionRuleWriteDto"])
+    };
+  }
+  async eventConfigReplaceRuleRaw(requestParameters, initOverrides) {
+    const requestOptions = await this.eventConfigReplaceRuleRequestOpts(requestParameters);
+    const response = await this.request(requestOptions, initOverrides);
+    return new JSONApiResponse(response, (jsonValue) => ExclusionRuleDtoFromJSON(jsonValue));
+  }
+  async eventConfigReplaceRule(requestParameters, initOverrides) {
+    const response = await this.eventConfigReplaceRuleRaw(requestParameters, initOverrides);
+    return await response.value();
+  }
+}
+
 // ../audit-sdk/generated/src/apis/QueryApi.ts
 class QueryApi extends BaseAPI {
   async queryDownloadAuditEventsFromLongTermStoreRequestOpts(requestParameters) {
@@ -3283,6 +3646,11 @@ var pickName = (claims) => {
   const username = asString(claims?.preferred_username);
   return asString(claims?.name) ?? (looksLikeEmail(username) ? undefined : username);
 };
+var pickScopes = (claims) => {
+  const raw = claims?.scope;
+  const scopes = Array.isArray(raw) ? raw.filter((entry) => asString(entry) !== undefined) : typeof raw === "string" ? raw.split(/\s+/).filter(Boolean) : [];
+  return scopes.length > 0 ? scopes : undefined;
+};
 var resolveSessionIdentity = (accessToken, authFlow) => {
   const claims = accessToken ? decodeClaims(accessToken) : undefined;
   const email = pickEmail(claims);
@@ -3308,6 +3676,7 @@ var resolveSessionIdentity = (accessToken, authFlow) => {
     identity.clientId = clientId;
   return identity;
 };
+var readTokenScopes = (accessToken) => accessToken ? pickScopes(decodeClaims(accessToken)) : undefined;
 
 // ../../auth/src/envAuth.ts
 var ENV_AUTH_ENABLE_VAR = "UIPATH_CLI_ENABLE_ENV_AUTH";
@@ -3380,6 +3749,7 @@ var readAuthFromEnv = () => {
   const expiration = getTokenExpiration(accessToken);
   const loginStatus = expiration && expiration <= new Date ? "Expired" : "Logged in";
   const identity = resolveSessionIdentity(accessToken);
+  const scopes = readTokenScopes(accessToken);
   return {
     loginStatus,
     accessToken,
@@ -3390,7 +3760,8 @@ var readAuthFromEnv = () => {
     tenantId,
     expiration,
     source: "env-vars" /* EnvironmentVariables */,
-    ...identity ? { identity } : {}
+    ...identity ? { identity } : {},
+    ...scopes ? { scopes } : {}
   };
 };
 
@@ -4028,10 +4399,15 @@ async function buildFileStatus(tokens, credentials, globalHint) {
 }
 function identityFields(accessToken, credentials) {
   const identity = resolveSessionIdentity(accessToken, parseAuthFlow(credentials[AUTH_FLOW_ENV_VAR]));
-  return identity ? { identity } : {};
+  const scopes = readTokenScopes(accessToken);
+  return {
+    ...identity ? { identity } : {},
+    ...scopes ? { scopes } : {}
+  };
 }
 function buildRobotStatus(robotCreds) {
   const identity = resolveSessionIdentity(robotCreds.accessToken);
+  const scopes = readTokenScopes(robotCreds.accessToken);
   return {
     loginStatus: "Logged in",
     accessToken: robotCreds.accessToken,
@@ -4043,7 +4419,8 @@ function buildRobotStatus(robotCreds) {
     issuer: robotCreds.issuer,
     expiration: getTokenExpiration(robotCreds.accessToken),
     source: "robot" /* Robot */,
-    ...identity ? { identity } : {}
+    ...identity ? { identity } : {},
+    ...scopes ? { scopes } : {}
   };
 }
 var isFileNotFoundError = (error) => {
@@ -4325,6 +4702,47 @@ async function createApiClient(ApiClass, options) {
   const config = await createAuditConfig(options);
   return new ApiClass(config);
 }
+// ../../common/src/guid.ts
+var GUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function isGuid(value) {
+  return GUID_REGEX.test(value);
+}
+
+// ../audit-sdk/src/exclusion-rules.ts
+class ExclusionRuleLookupError extends Error {
+  reason;
+  candidates;
+  constructor(message, reason, candidates = []) {
+    super(message);
+    this.name = "ExclusionRuleLookupError";
+    this.reason = reason;
+    this.candidates = candidates;
+  }
+}
+function describe(rule) {
+  return `${rule.policyId} (${rule.isActive ? "active" : "inactive"})`;
+}
+async function resolveExclusionRule(api, nameOrId) {
+  const value = nameOrId.trim();
+  if (isGuid(value)) {
+    return { policyId: value };
+  }
+  const rules = await api.eventConfigGetRules() ?? [];
+  const matches = rules.filter((rule) => rule.name === value);
+  const resolved = matches.length > 0 ? matches : rules.filter((rule) => rule.name?.toLowerCase() === value.toLowerCase());
+  if (resolved.length === 1) {
+    const rule = resolved[0];
+    if (rule.policyId) {
+      return { policyId: rule.policyId, rule };
+    }
+    throw new ExclusionRuleLookupError(`The rule named '${value}' was listed without a policy id, so it cannot be addressed.`, "unidentifiable");
+  }
+  if (resolved.length > 1) {
+    const candidates = resolved.map((rule) => rule.policyId).filter((id) => typeof id === "string");
+    throw new ExclusionRuleLookupError(`'${value}' matches ${resolved.length} rules: ${resolved.map(describe).join(", ")}.`, "ambiguous", candidates);
+  }
+  throw new ExclusionRuleLookupError(`No exclusion rule named '${value}' exists in this organization.`, "not-found");
+}
 // ../../common/src/telemetry/pseudonymize.ts
 var PSEUDONYM_DOMAIN = "uipath-cli/telemetry/pseudonym/v1:";
 var PSEUDONYM_HEX_LENGTH = 32;
@@ -4832,9 +5250,60 @@ function settlePromiseLike2(thenable) {
   return Promise.resolve(thenable).then((data) => [undefined, data]).catch((error) => [toError(error), undefined]);
 }
 
+// ../../common/src/error-graph.ts
+function* walkErrorGraph(error) {
+  const queue = [error];
+  const seen = new Set;
+  for (let steps = 0;queue.length > 0 && steps < 32; steps++) {
+    const current = queue.shift();
+    if (current === null || typeof current !== "object")
+      continue;
+    if (seen.has(current))
+      continue;
+    seen.add(current);
+    const cur = current;
+    yield cur;
+    if (cur.cause !== undefined)
+      queue.push(cur.cause);
+    if (Array.isArray(cur.errors))
+      queue.push(...cur.errors);
+  }
+  return;
+}
+function parseHttpStatusFromMessage(message) {
+  const match = /^HTTP\s+(\d{3})(?::|\s|-|$)/i.exec(message.trim());
+  if (!match)
+    return;
+  const status = Number(match[1]);
+  return Number.isInteger(status) && status >= 100 && status <= 599 ? status : undefined;
+}
+function findHttpStatusInGraph(error) {
+  for (const node of walkErrorGraph(error)) {
+    const response = node.response;
+    const explicit = typeof node.status === "number" ? node.status : response?.status;
+    if (typeof explicit === "number" && explicit >= 400 && explicit <= 599) {
+      return explicit;
+    }
+    if (typeof node.message === "string") {
+      const parsed = parseHttpStatusFromMessage(node.message);
+      if (parsed !== undefined && parsed >= 400) {
+        return parsed;
+      }
+    }
+  }
+  return;
+}
+
+// ../../common/src/local-permission-codes.ts
+var LOCAL_PERMISSION_ERROR_CODES = new Set([
+  "EACCES",
+  "EPERM",
+  "EROFS"
+]);
+
 // ../../common/src/error-handler.ts
-var DEFAULT_401 = "Unauthorized (401). Run `uip login` to authenticate.";
-var DEFAULT_403 = "Forbidden (403). Ensure the account has the required permissions.";
+var DEFAULT_401 = "Unauthorized (401). The session is missing or expired, or its token carries no scope for this API. Run `uip login status --detailed` to see the session and its scopes.";
+var DEFAULT_403 = "Forbidden (403). The account lacks permission for this operation, or the token carries no scope for this API. Run `uip login status --detailed` to see the token's scopes.";
 var DEFAULT_405 = "Method Not Allowed (405). The endpoint may not exist or the base URL may be incorrect.";
 var DEFAULT_413 = "Payload too large (413). The upload exceeded the server or CDN size limit. Reduce the package size — for example, exclude unused dependencies or remove large files from the project — and try again.";
 var HTML_RESPONSE_MESSAGE = "Received HTML instead of the expected JSON response.";
@@ -4861,14 +5330,14 @@ var TLS_ERROR_CODES = new Set([
 ]);
 var TLS_INSTRUCTIONS = "The server's TLS certificate could not be verified. Most often a " + "corporate proxy/firewall re-signs HTTPS with a root CA that Node does " + "not trust — set NODE_EXTRA_CA_CERTS to that CA's PEM file (and HTTPS_PROXY " + "if you connect through a proxy). If the certificate is instead expired or " + "its hostname does not match, fix the endpoint URL or the system clock. " + "Then retry.";
 var NETWORK_INSTRUCTIONS = "Could not reach the UiPath service. Check your network connection and " + "VPN, confirm any HTTP_PROXY/HTTPS_PROXY/NO_PROXY settings are correct, " + "then retry.";
-var LOCAL_PERMISSION_ERROR_CODES = new Set(["EACCES", "EPERM", "EROFS"]);
-var LOCAL_PERMISSION_MESSAGE_PATTERN = /\b(EACCES|EPERM|EROFS)\b/;
+var LOCAL_PERMISSION_MESSAGE_PATTERN = new RegExp(`\\b(${[...LOCAL_PERMISSION_ERROR_CODES].join("|")})\\b`);
 function localPermissionInstructions(code, path2) {
   const target = path2 !== undefined ? `'${path2}'` : "a local file or resource";
   if (code === "EROFS") {
     return `The filesystem containing ${target} is read-only (EROFS), so the ` + "CLI could not write to it. This is a local environment problem, " + "not a UiPath service error — retrying will not help. Use a " + "writable location, or give this environment write access to the " + "path.";
   }
-  const remedy = process.platform === "win32" ? "Re-run from an elevated terminal, close any program holding " + "the file open, or grant your user access to the path." : "Grant this user (or the sandbox the command runs in) access " + "to the path, or run the command outside the sandbox.";
+  const onWindows = typeof process !== "undefined" && process.platform === "win32";
+  const remedy = onWindows ? "Re-run from an elevated terminal, close any program holding " + "the file open, or grant your user access to the path." : "Grant this user (or the sandbox the command runs in) access " + "to the path, or run the command outside the sandbox.";
   return `The operating system denied access to ${target} (${code}). This is ` + "a local permission problem, not a UiPath service error — retrying " + `without a permission change will not help. ${remedy}`;
 }
 function describeConnectivityError(error) {
@@ -4922,48 +5391,6 @@ function localPermissionPath(path2, message) {
     return path2;
   return message ? /'([^']+)'/.exec(message)?.[1] : undefined;
 }
-function* walkErrorGraph(error) {
-  const queue = [error];
-  const seen = new Set;
-  for (let steps = 0;queue.length > 0 && steps < 32; steps++) {
-    const current = queue.shift();
-    if (current === null || typeof current !== "object")
-      continue;
-    if (seen.has(current))
-      continue;
-    seen.add(current);
-    const cur = current;
-    yield cur;
-    if (cur.cause !== undefined)
-      queue.push(cur.cause);
-    if (Array.isArray(cur.errors))
-      queue.push(...cur.errors);
-  }
-  return;
-}
-function parseHttpStatusFromMessage(message) {
-  const match = /^HTTP\s+(\d{3})(?::|\s|-|$)/i.exec(message.trim());
-  if (!match)
-    return;
-  const status = Number(match[1]);
-  return Number.isInteger(status) && status >= 100 && status <= 599 ? status : undefined;
-}
-function findHttpStatusInGraph(error) {
-  for (const node of walkErrorGraph(error)) {
-    const response = node.response;
-    const explicit = typeof node.status === "number" ? node.status : response?.status;
-    if (typeof explicit === "number" && explicit >= 400 && explicit <= 599) {
-      return explicit;
-    }
-    if (typeof node.message === "string") {
-      const parsed = parseHttpStatusFromMessage(node.message);
-      if (parsed !== undefined && parsed >= 400) {
-        return parsed;
-      }
-    }
-  }
-  return;
-}
 function isHtmlDocument(body) {
   return /^\s*(<!doctype html|<html\b)/i.test(body);
 }
@@ -5491,6 +5918,9 @@ var AUTH_ERROR_CODES = new Set([
   "authentication_required",
   "permission_denied"
 ]);
+var LOCAL_PERMISSION_CLI_ERROR_CODES = new Set([
+  "local_permission_denied"
+]);
 var VALIDATION_ERROR_CODES = new Set(["invalid_argument"]);
 var NETWORK_HTTP_ERROR_CODES = new Set([
   "network_error",
@@ -5631,6 +6061,9 @@ function classifyFromErrorCode(errorCode2) {
   if (AUTH_ERROR_CODES.has(errorCode2)) {
     return "auth";
   }
+  if (LOCAL_PERMISSION_CLI_ERROR_CODES.has(errorCode2)) {
+    return "local_permission";
+  }
   if (VALIDATION_ERROR_CODES.has(errorCode2)) {
     return "validation";
   }
@@ -5642,6 +6075,15 @@ function classifyFromErrorCode(errorCode2) {
   }
   return;
 }
+function hasLocalPermissionCode(error) {
+  for (const node of walkErrorGraph(error)) {
+    const code = node.code;
+    if (typeof code === "string" && LOCAL_PERMISSION_ERROR_CODES.has(code)) {
+      return true;
+    }
+  }
+  return false;
+}
 function classifyFromError(error) {
   const code = findCodeInCauseChain(error);
   if (code) {
@@ -5658,6 +6100,9 @@ function classifyFromError(error) {
       return "missing_dependency";
     }
   }
+  if (hasLocalPermissionCode(error)) {
+    return "local_permission";
+  }
   const message = stringField(error, "message");
   if (message?.includes("fetch failed") === true) {
     return "network_http";
@@ -5673,7 +6118,7 @@ function classifyError2(input) {
   if (recorded?.errorClass) {
     return recorded.errorClass;
   }
-  const status = recorded?.context?.httpStatus;
+  const status = recorded?.context?.httpStatus ?? findHttpStatusInGraph(input.error);
   if (status !== undefined) {
     return classifyHttpStatus(status);
   }
@@ -5696,17 +6141,18 @@ function buildCommandTerminalTelemetryProperties(input) {
   const errorClass = outcome === "success" || outcome === "no_op" ? undefined : outcome === "cancelled" ? "user_cancelled" : classifyError2(input);
   const terminalSignal = terminalSignalFor(input, outcome);
   return {
-    exit_code: input.exitCode,
-    terminal_outcome: outcome,
-    ...errorClass ? { error_class: errorClass } : {},
-    ...terminalSignal ? { terminal_signal: terminalSignal } : {}
+    [CommandDimensions.ExitCode]: input.exitCode,
+    [CommandDimensions.TerminalOutcome]: outcome,
+    ...errorClass ? { [CommandDimensions.ErrorClass]: errorClass } : {},
+    ...terminalSignal ? { [CommandDimensions.TerminalSignal]: terminalSignal } : {}
   };
 }
 
 // ../../common/src/telemetry/telemetry-events.ts
 var CommonTelemetryEvents = {
-  Error: "uip.error",
-  ShipSucceeded: "uip.ship.succeeded"
+  Start: "Application.Start",
+  Error: "Application.Error",
+  ShipSucceeded: "Cli.ShipSucceeded"
 };
 
 // ../../common/src/registry.ts
@@ -5914,8 +6360,8 @@ function detectExecutionContext(options = {}) {
 function getExecutionContextTelemetryProperties() {
   const detected = detectExecutionContext();
   return {
-    execution_context: detected.executionContext,
-    ...detected.ciProvider ? { ci_provider: detected.ciProvider } : {}
+    [BaseDimensions.ExecutionContext]: detected.executionContext,
+    ...detected.ciProvider ? { [BaseDimensions.CiProvider]: detected.ciProvider } : {}
   };
 }
 // ../../common/src/telemetry/node-context-storage.ts
@@ -5958,7 +6404,7 @@ function getInboundTraceContext() {
 var TELEMETRY_SESSION_ID_ENV = "UIPATH_SESSION_ID";
 var SESSION_ID_MAX_LENGTH = 64;
 var RANDOM_SESSION_ID_LENGTH = 32;
-var TELEMETRY_SESSION_SOURCE_PROPERTY = "session_id_source";
+var TELEMETRY_SESSION_SOURCE_PROPERTY = "SessionIdSource";
 var CONTROL_CHARACTERS = /\p{Cc}/gu;
 var INHERITED_SESSION_SOURCES = [
   { envVar: "CLAUDE_CODE_SESSION_ID", source: "claude-code" },
@@ -6010,6 +6456,9 @@ function resolveTelemetrySession() {
   telemetrySessionSlot.set(resolved);
   return resolved;
 }
+function getTelemetrySessionId() {
+  return resolveTelemetrySession().id;
+}
 function getTelemetrySessionSource() {
   return resolveTelemetrySession().source;
 }
@@ -6084,7 +6533,10 @@ class TelemetryService {
     } catch (error) {
       const durationMs = clock.elapsedMs();
       const err = error instanceof Error ? error : new Error(String(error));
-      await this.telemetryProvider.trackRequest(this.spanFor(name, durationMs, false, { ...properties, errorMessage: err.message }, context));
+      await this.telemetryProvider.trackRequest(this.spanFor(name, durationMs, false, {
+        ...properties,
+        [CommandDimensions.ErrorMessage]: err.message
+      }, context));
       throw error;
     }
   }
@@ -6155,7 +6607,10 @@ class TelemetryService {
       const durationMs = clock.elapsedMs();
       const err = error instanceof Error ? error : new Error(String(error));
       await this.telemetryProvider.trackDependency({
-        ...this.spanFor(name, durationMs, false, { ...properties, errorMessage: err.message }, childContext),
+        ...this.spanFor(name, durationMs, false, {
+          ...properties,
+          [CommandDimensions.ErrorMessage]: err.message
+        }, childContext),
         type
       });
       throw error;
@@ -6190,9 +6645,10 @@ class TelemetryService {
       ...globalProperties,
       ...this.defaultProperties,
       ...redactProperties(properties ?? {}),
-      [TELEMETRY_SESSION_SOURCE_PROPERTY]: getTelemetrySessionSource()
+      [TELEMETRY_SESSION_SOURCE_PROPERTY]: getTelemetrySessionSource(),
+      [BaseDimensions.SessionId]: this.telemetryProvider.getSessionId?.() ?? getTelemetrySessionId()
     };
-    return enriched;
+    return lowercaseIdDimensionValues(enriched);
   }
   generateId() {
     const bytes = new Uint8Array(8);
@@ -6953,7 +7409,165 @@ class FilterImplicitLimitError extends Error {
     this.instructions = "Pass --limit <n> to choose how many records the filter applies to. " + "To filter over all records, pass the command's maximum accepted --limit (see the option's description in --help).";
   }
 }
-function applyFilter(data, filter) {
+function countRecords(data) {
+  if (Array.isArray(data))
+    return data.length;
+  return data == null ? 0 : 1;
+}
+function availableFields(data) {
+  const records = Array.isArray(data) ? data : [data];
+  const keys = new Set;
+  for (const record of records) {
+    if (record && typeof record === "object" && !Array.isArray(record)) {
+      for (const key of Object.keys(record))
+        keys.add(key);
+    }
+  }
+  return [...keys];
+}
+function decodeQuotedIdentifier(whole, inner) {
+  const [error, decoded] = catchError2(() => JSON.parse(whole));
+  if (!error && typeof decoded === "string")
+    return decoded;
+  return inner.replace(/\\(.)/g, "$1");
+}
+function referencedFields(filter) {
+  const top = new Set;
+  const nested = new Set;
+  const withoutValueLiterals = filter.replace(/'(?:\\.|[^'\\])*'/g, " ").replace(/`(?:\\.|[^`\\])*`/g, " ");
+  const isPathTail = (text, index) => text[index - 1] === "." && /[A-Za-z0-9_"]/.test(text[index - 2] ?? "");
+  const quoted = [];
+  const withoutLiterals = withoutValueLiterals.replace(/"((?:\\.|[^"\\])*)"/g, (whole, name, index) => {
+    const isAlias = /^\s*:/.test(withoutValueLiterals.slice(index + whole.length));
+    if (!isAlias) {
+      quoted.push({
+        name: decodeQuotedIdentifier(whole, name),
+        index,
+        tail: isPathTail(withoutValueLiterals, index)
+      });
+    }
+    return `"${" ".repeat(whole.length - 2)}"`;
+  });
+  const descent = /[A-Za-z0-9_"]\s*[.[]/.exec(withoutLiterals);
+  const rootEnd = descent ? descent.index + 1 : Number.POSITIVE_INFINITY;
+  const place = (name, index, tail) => {
+    if (tail || index >= rootEnd)
+      nested.add(name);
+    else
+      top.add(name);
+  };
+  for (const entry of quoted)
+    place(entry.name, entry.index, entry.tail);
+  const identifiers = withoutLiterals.matchAll(/([A-Za-z_][A-Za-z0-9_]*)(\s*[:(])?/g);
+  const reserved = new Set(["true", "false", "null", "and", "or", "not"]);
+  for (const match of identifiers) {
+    const [, name, trailing] = match;
+    if (trailing || reserved.has(name))
+      continue;
+    place(name, match.index, isPathTail(withoutLiterals, match.index));
+  }
+  return {
+    top: [...top],
+    nested: [...nested].filter((name) => !top.has(name)),
+    hasPredicate: /\[\s*\?/.test(withoutValueLiterals)
+  };
+}
+function appearsBelowTopLevel(data, name) {
+  let budget = 2000;
+  const visit = (value, depth) => {
+    if (budget-- <= 0 || depth > 4)
+      return false;
+    if (value === null || typeof value !== "object")
+      return false;
+    if (Array.isArray(value))
+      return value.some((entry) => visit(entry, depth));
+    const record = value;
+    if (depth > 0 && Object.hasOwn(record, name))
+      return true;
+    return Object.values(record).some((entry) => visit(entry, depth + 1));
+  };
+  return visit(data, 0);
+}
+function alwaysNullKeys(records) {
+  const objects = records.filter((r) => r != null && typeof r === "object" && !Array.isArray(r));
+  if (objects.length === 0 || objects.length !== records.length)
+    return [];
+  const keys = [...new Set(objects.flatMap((o) => Object.keys(o)))];
+  if (keys.length === 0)
+    return [];
+  const nullKeys = keys.filter((key) => objects.every((record) => record[key] === null));
+  return nullKeys.length === keys.length ? nullKeys : [];
+}
+function carriesOnlyNulls(value) {
+  if (value === null)
+    return true;
+  if (Array.isArray(value)) {
+    return value.length > 0 && value.every(carriesOnlyNulls);
+  }
+  if (typeof value === "object" && value !== undefined) {
+    const values = Object.values(value);
+    return values.length > 0 && values.every(carriesOnlyNulls);
+  }
+  return false;
+}
+function nameList(names, cap2 = 12) {
+  const shown = names.slice(0, cap2).map((n) => `\`${n}\``);
+  const rest = names.length - shown.length;
+  return shown.join(", ") + (rest > 0 ? `, and ${rest} more` : "");
+}
+function buildFilterWarning(filter, data, outcome) {
+  const present = availableFields(data);
+  const refs = referencedFields(filter);
+  const unknown = refs.top.filter((name) => !present.includes(name) && !appearsBelowTopLevel(data, name));
+  const unchecked = refs.nested.filter((name) => !present.includes(name));
+  const count = countRecords(data);
+  const scope = `${count} record(s)`;
+  const isNotAField = (names) => `${nameList(names)} ${names.length === 1 ? "is not a field" : "are not fields"} on the ${scope} it read`;
+  const soundness = unchecked.length > 0 ? `${nameList(unchecked)} ${unchecked.length === 1 ? "reads" : "read"} below the top level, so ${unchecked.length === 1 ? "it was" : "they were"} not checked against the record keys` : refs.top.length > 0 ? "every field it names exists" : "";
+  const withSoundness = (base) => soundness ? `${base}, and ${soundness}` : base;
+  let detail;
+  let lede;
+  if (outcome.kind === "null-elements") {
+    lede = "returned only null values";
+    const projected = `all ${outcome.count} of the elements it projected are null`;
+    if (unknown.length > 0) {
+      detail = `${projected}, because ${isNotAField(unknown)}`;
+    } else if (unchecked.length > 0) {
+      detail = withSoundness(projected);
+    } else {
+      detail = `${projected}, and every field it names exists — a multi-select list ` + `(\`[A, B]\`) reads each entry against \`Data\` itself, so on a list ` + `result use \`[].[A, B]\` or \`[].{a: A, b: B}\` to read the records`;
+    }
+  } else if (outcome.kind === "null-rows") {
+    lede = "returned only null values";
+    const projected = `every value it projected is null on all ${outcome.count} row(s)`;
+    detail = unknown.length > 0 ? `${projected}, because ${isNotAField(unknown)}` : withSoundness(projected);
+  } else if (outcome.kind === "null-values") {
+    lede = "returned only null values";
+    const projected = `every key it projected (${nameList(outcome.keys)}) is null`;
+    const sameSet = unknown.length === outcome.keys.length && outcome.keys.every((k) => unknown.includes(k));
+    if (sameSet) {
+      detail = `${isNotAField(outcome.keys)}, so every key it projected is null`;
+    } else if (unknown.length > 0) {
+      detail = `${projected}, because ${isNotAField(unknown)}`;
+    } else {
+      detail = withSoundness(`${projected} on all ${scope}`);
+    }
+  } else {
+    lede = "returned nothing";
+    if (unknown.length > 0) {
+      detail = isNotAField(unknown);
+    } else {
+      const selection = refs.hasPredicate ? "no record matched" : "the expression resolved to no value";
+      detail = withSoundness(`${selection} — it read ${scope}`);
+    }
+  }
+  const fields = present.length > 0 ? ` Available fields: ${nameList(present)}.` : "";
+  return `--output-filter ${JSON.stringify(filter)} ${lede}: ${detail}.${fields}`;
+}
+function appendWarning(existing, note) {
+  return existing ? `${existing} ${note}` : note;
+}
+function applyFilter(data, filter, onWarning) {
   const codec = requireJmespath();
   let result;
   try {
@@ -6961,9 +7575,34 @@ function applyFilter(data, filter) {
   } catch (err) {
     throw new FilterEvaluationError(filter, err);
   }
-  if (result == null)
+  const inputCount = countRecords(data);
+  const warn = (outcome) => {
+    if (inputCount === 0)
+      return;
+    const note = buildFilterWarning(filter, data, outcome);
+    getOutputSink().writeErr(`[WARN] ${note}
+`);
+    onWarning?.(note);
+  };
+  const warnIfAllNull = (records) => {
+    const keys = alwaysNullKeys(records);
+    if (keys.length > 0)
+      warn({ kind: "null-values", keys });
+  };
+  if (result == null) {
+    warn({ kind: "empty" });
     return [];
+  }
   if (Array.isArray(result)) {
+    if (result.length === 0) {
+      warn({ kind: "empty" });
+    } else if (result.every((entry) => entry === null)) {
+      warn({ kind: "null-elements", count: result.length });
+    } else if (result.every((entry) => Array.isArray(entry)) && carriesOnlyNulls(result)) {
+      warn({ kind: "null-rows", count: result.length });
+    } else {
+      warnIfAllNull(result);
+    }
     if (result.length > 0 && typeof result[0] !== "object") {
       const fieldMatch = filter.match(/\.(\w+)$/);
       const key = fieldMatch ? fieldMatch[1] : "Value";
@@ -6971,10 +7610,30 @@ function applyFilter(data, filter) {
     }
     return result;
   }
-  if (typeof result === "object")
+  if (typeof result === "object") {
+    warnIfAllNull([result]);
     return result;
+  }
   return { Value: result };
 }
+function filterFailureData(envelope) {
+  const filter = getOutputFilter();
+  const data = envelope.Data;
+  if (!filter || data == null)
+    return;
+  let note;
+  const [filterError, filtered] = catchError2(() => applyFilter(data, filter, (n) => {
+    note = n;
+  }));
+  if (filterError) {
+    envelope.Warning = appendWarning(envelope.Warning, `--output-filter was not applied, so Data is shown in full: ${filterError.message}`);
+    return;
+  }
+  envelope.Data = filtered;
+  if (note) {
+    envelope.Warning = appendWarning(envelope.Warning, note);
+  }
+}
 function defaultErrorCodeForResult(result) {
   switch (result) {
     case RESULTS.AuthenticationError:
@@ -7018,7 +7677,7 @@ function defaultErrorCodeForHttpStatus(status) {
     return "server_error";
   return;
 }
-var LOCAL_PERMISSION_TEXT_PATTERN = /(?:\b|\()(?:EACCES|EPERM|EROFS)(?::\s|\))/;
+var LOCAL_PERMISSION_TEXT_PATTERN = new RegExp(`(?:\\b|\\()(?:${[...LOCAL_PERMISSION_ERROR_CODES].join("|")})(?::\\s|\\))`);
 function defaultErrorCodeForFailure(data) {
   if (data.Result === RESULTS.Failure) {
     const status = data.Context?.httpStatus ?? parseHttpStatusFromMessage2(data.Message);
@@ -7057,8 +7716,14 @@ var OutputFormatter;
     }
     const filter = getOutputFilter();
     if (filter) {
-      const filtered = applyFilter(data.Data, filter);
+      let note;
+      const filtered = applyFilter(data.Data, filter, (n) => {
+        note = n;
+      });
       data.Data = normalize ? normalizeDataKeys(filtered, verbatim, subtrees && { refs: subtrees.refs, mode: "skip" }) : filtered;
+      if (note) {
+        data.Warning = appendWarning(data.Warning, note);
+      }
     }
     logOutput(normalizeOutputKeys(data), getOutputFormat(), options?.tableRowStyle);
   }
@@ -7086,12 +7751,13 @@ var OutputFormatter;
     delete envelope.TelemetryErrorClass;
     delete envelope.TelemetryTerminalOutcome;
     delete envelope.TelemetryTerminalSignal;
+    filterFailureData(envelope);
     if (!suppressTelemetry) {
       telemetry.trackEvent(CommonTelemetryEvents.Error, {
-        result: data.Result,
-        errorCode: data.ErrorCode,
-        retry: data.Retry,
-        message: data.Message
+        [ErrorDimensions.Result]: data.Result,
+        [ErrorDimensions.ErrorCode]: data.ErrorCode,
+        [ErrorDimensions.Retry]: data.Retry,
+        [ErrorDimensions.ErrorMessage]: data.Message
       });
     }
     logOutput(normalizeOutputKeys(envelope), getOutputFormat());
@@ -7134,13 +7800,20 @@ var OutputFormatter;
   OutputFormatter.log = log;
   function formatToString(data) {
     const filter = getOutputFilter();
+    const envelope = data;
     if ("Data" in data && data.Data != null) {
       data.Data = normalizeDataKeys(data.Data);
       if (filter) {
-        data.Data = normalizeDataKeys(applyFilter(data.Data, filter));
+        let note;
+        data.Data = normalizeDataKeys(applyFilter(data.Data, filter, (n) => {
+          note = n;
+        }));
+        if (note) {
+          envelope.Warning = appendWarning(envelope.Warning, note);
+        }
       }
     }
-    const output = normalizeOutputKeys(data);
+    const output = normalizeOutputKeys(envelope);
     const lines = [];
     const sink = getOutputSink();
     printOutput(output, getOutputFormat(), (msg) => {
@@ -7190,7 +7863,7 @@ var LEGACY_SKILL_NAMESPACE = "uipath:";
 var MAX_SKILL_NAME_LENGTH = 80;
 var SKILL_NAME_PATTERN = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
 function productMode(productArea, mode) {
-  return { product_area: productArea, mode };
+  return { ProductArea: productArea, Mode: mode };
 }
 function attributionRecord(groups) {
   const record = {};
@@ -7248,6 +7921,7 @@ var COMMAND_ATTRIBUTION = commandAttribution([
   ["rpa", "build", ["uip.rpa-legacy"]],
   ["conversational", "operate", ["uip.conversational"]],
   ["agents", "build", ["uip.codedagent", "uip.agent"]],
+  ["coding-agents", "build", ["uip.coder"]],
   ["agenthub", "build", ["uip.agenthub"]],
   ["coded-apps", "build", ["uip.codedapp"]],
   ["functions", "build", ["uip.function", "uip.functions"]],
@@ -7333,32 +8007,64 @@ function normalizeSkillName(value) {
 function buildCommandTelemetryAttribution(commandPath, skillSource) {
   const skillName = normalizeSkillName(skillSource);
   return {
-    ...skillName ? { skill_name: skillName } : {},
+    ...skillName ? { SkillName: skillName } : {},
     ...getCommandProductModeAttribution(commandPath)
   };
 }
+var AGENT_SESSION_ENV = {
+  [BaseDimensions.AgentModel]: "UIPATH_AGENT_MODEL",
+  [SkillsDimensions.PermissionMode]: "UIPATH_PERMISSION_MODE",
+  [SkillsDimensions.EffortLevel]: "UIPATH_EFFORT_LEVEL",
+  [SkillsDimensions.SkillsVersion]: "UIPATH_SKILLS_VERSION"
+};
+var MAX_TELEMETRY_TOKEN_LENGTH = 120;
+function sanitizeTelemetryToken(value) {
+  return value.replace(/[^A-Za-z0-9:._/ -]/g, "_").slice(0, MAX_TELEMETRY_TOKEN_LENGTH);
+}
+function buildAgentSessionTelemetry(env) {
+  const dimensions = {};
+  for (const [key, variable] of Object.entries(AGENT_SESSION_ENV)) {
+    const value = env[variable]?.trim();
+    if (value) {
+      dimensions[key] = sanitizeTelemetryToken(value);
+    }
+  }
+  return dimensions;
+}
 
 // ../../common/src/telemetry/command-name.ts
-var TELEMETRY_COMMAND_ROOT = "uip";
+var TELEMETRY_NAME_ROOT = "Cli";
+var CLI_COMMAND_ROOT = "uip";
+var TELEMETRY_NAME_BARE_ACTION = "Invoke";
 function commandTelemetryName(parts) {
+  const action = vetCommandTokens(parts).map(pascalizeToken).join("");
+  return `${TELEMETRY_NAME_ROOT}.${action || TELEMETRY_NAME_BARE_ACTION}`;
+}
+function commandInvocationPath(parts) {
+  return [CLI_COMMAND_ROOT, ...vetCommandTokens(parts)].join(" ");
+}
+function vetCommandTokens(parts) {
   const tokens = [];
   for (const part of parts) {
-    const pieces = String(part ?? "").split(/\s+/).filter((token) => token && !token.startsWith("-") && token !== TELEMETRY_COMMAND_ROOT);
+    const pieces = String(part ?? "").split(/\s+/).filter((token) => token && !token.startsWith("-") && token !== CLI_COMMAND_ROOT);
     if (pieces.every(isCommandToken)) {
       tokens.push(...pieces);
       continue;
     }
     tokens.push(UNKNOWN_TOKEN);
   }
-  return [TELEMETRY_COMMAND_ROOT, ...tokens].join(".");
+  return tokens;
+}
+function pascalizeToken(token) {
+  return token.split("-").filter(Boolean).map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join("");
 }
-var COMMAND_TOKEN_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
+var COMMAND_TOKEN_PATTERN = /^[a-z][a-z0-9-]*$/;
 var MAX_COMMAND_TOKEN_LENGTH = 32;
 var GUID_TOKEN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 function isCommandToken(token) {
-  return token.length <= MAX_COMMAND_TOKEN_LENGTH && COMMAND_TOKEN_PATTERN.test(token) && !GUID_TOKEN.test(token) && !/^\d+$/.test(token);
+  return token.length <= MAX_COMMAND_TOKEN_LENGTH && COMMAND_TOKEN_PATTERN.test(token) && !GUID_TOKEN.test(token);
 }
-var UNKNOWN_TOKEN = "<unknown>";
+var UNKNOWN_TOKEN = "unknown";
 
 // ../../common/src/telemetry/invocation-request.ts
 var requestContextSlot = singleton("TelemetryInvocationRequestContext");
@@ -7463,7 +8169,7 @@ function withheldArgumentValues(cmd) {
   });
   return values;
 }
-function deriveCommandPath(cmd) {
+function deriveCommandParts(cmd) {
   const parts = [];
   let current = cmd;
   while (current) {
@@ -7476,14 +8182,13 @@ function deriveCommandPath(cmd) {
   if (parts.length > 1) {
     parts.shift();
   }
-  return commandTelemetryName(parts);
+  return parts;
 }
 function isErrorContext(value) {
   return value !== null && typeof value === "object";
 }
 function commandHelpHint(commandPath) {
-  const command = commandPath.replace(/\./g, " ");
-  return `An unexpected error occurred. Run '${command} --help' to verify command syntax, or run with --log-level debug for details.`;
+  return `An unexpected error occurred. Run '${commandPath} --help' to verify command syntax, or run with --log-level debug for details.`;
 }
 function isPromptCancellation(error) {
   return error instanceof Error && error.name === "ExitPromptError";
@@ -7508,7 +8213,9 @@ Command.prototype.trackedAction = function(context, fn, properties) {
       yaml: getOutputFormat() === "yaml",
       filter: getOutputFilter() !== undefined
     });
-    const telemetryName = deriveCommandPath(command);
+    const commandParts = deriveCommandParts(command);
+    const telemetryName = commandTelemetryName(commandParts);
+    const commandPath = commandInvocationPath(commandParts);
     const props = typeof properties === "function" ? properties(...args) : properties;
     markCommandStart();
     const supplied = recordSuppliedArgumentValues(withheldArgumentValues(command));
@@ -7543,7 +8250,7 @@ Command.prototype.trackedAction = function(context, fn, properties) {
           Result: finalResult,
           ...customErrorCode ? { ErrorCode: customErrorCode } : {},
           Message: errorMessage2,
-          Instructions: customInstructions ?? commandHelpHint(telemetryName),
+          Instructions: customInstructions ?? commandHelpHint(commandPath),
           ...customRetry ? { Retry: customRetry } : {},
           ...customContext ? { Context: customContext } : {}
         });
@@ -7560,8 +8267,8 @@ Command.prototype.trackedAction = function(context, fn, properties) {
         recordedFailure,
         pollSignal: context.pollSignal
       });
-      if (terminalTelemetry.error_class === "internal" && error) {
-        telemetry.trackException(error instanceof Error ? error : new Error(String(error)), { command_name: telemetryName }, getInvocationRequestContext());
+      if (terminalTelemetry[CommandDimensions.ErrorClass] === "internal" && error) {
+        telemetry.trackException(error instanceof Error ? error : new Error(String(error)), { [CommandDimensions.CommandName]: commandPath }, getInvocationRequestContext());
       }
       const commandParams = extractCommandParams(command);
       if (props) {
@@ -7572,10 +8279,12 @@ Command.prototype.trackedAction = function(context, fn, properties) {
       const baseProperties = redactProperties({
         ...commandParams,
         ...props,
-        ...buildCommandTelemetryAttribution(telemetryName, process.env.UIPATH_SKILL),
-        command: "true",
+        ...buildCommandTelemetryAttribution(commandPath, process.env.UIPATH_SKILL),
+        ...buildAgentSessionTelemetry(process.env),
+        [CommandDimensions.CommandName]: commandPath,
+        [CommandDimensions.IsCommand]: "true",
         ...terminalTelemetry,
-        ...errorMessage2 ? { errorMessage: errorMessage2 } : {}
+        ...errorMessage2 ? { [CommandDimensions.ErrorMessage]: errorMessage2 } : {}
       });
       emitInvocationRequest(telemetryName, success, baseProperties);
     } finally {
@@ -7806,6 +8515,40 @@ var BOOLEAN_FLAGS = new Set(HOST_GLOBAL_FLAGS);
 // ../../common/src/interactivity-context.ts
 var modeSlot = singleton("InteractivityMode");
 var interactiveFlagSlot = singleton("InteractiveFlag");
+// ../../common/src/mime-types.ts
+var MIME_TYPES_BY_EXTENSION = Object.freeze({
+  pdf: "application/pdf",
+  png: "image/png",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  gif: "image/gif",
+  webp: "image/webp",
+  bmp: "image/bmp",
+  tif: "image/tiff",
+  tiff: "image/tiff",
+  svg: "image/svg+xml",
+  txt: "text/plain",
+  log: "text/plain",
+  md: "text/markdown",
+  csv: "text/csv",
+  tsv: "text/tab-separated-values",
+  json: "application/json",
+  xml: "application/xml",
+  html: "text/html",
+  htm: "text/html",
+  yaml: "application/yaml",
+  yml: "application/yaml",
+  doc: "application/msword",
+  docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  xls: "application/vnd.ms-excel",
+  xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  ppt: "application/vnd.ms-powerpoint",
+  pptx: "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+  zip: "application/zip",
+  mp3: "audio/mpeg",
+  wav: "audio/wav",
+  mp4: "video/mp4"
+});
 // ../../common/src/option-validators.ts
 function parseLimit(raw, _previous) {
   return parseBoundedInt(raw, "--limit", { min: 1, max: 1e4 });
@@ -7871,6 +8614,530 @@ var ScreenLogger;
 var shippedKeysSlot = singleton("ShipSucceededDedupeKeys");
 // ../../common/src/tool-provider.ts
 var factorySlot = singleton("PackagerFactoryProvider");
+// src/commands/exclusions.ts
+var ENFORCEMENT = "Exclude";
+var ID_DIMENSIONS2 = [
+  { option: "excludeTenant", flag: "--exclude-tenant", dimension: "Tenant" },
+  { option: "source", flag: "--source", dimension: "EventSource" },
+  { option: "target", flag: "--target", dimension: "EventTarget" },
+  { option: "type", flag: "--type", dimension: "EventType" }
+];
+var STATUS_VALUES = ["Success", "Failure"];
+var SELECTOR_FLAGS = [
+  ...ID_DIMENSIONS2.map((d) => d.flag),
+  "--status"
+];
+var GUID_RE = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+var EMPTY_GUID = "00000000-0000-0000-0000-000000000000";
+var WRITE_BODY_KEYS = ["name", "enforcement", "isActive", "selectors"];
+var SELECTOR_KEYS = ["type", "values"];
+var MAX_FILE_LENGTH = 64 * 1024;
+var SAMPLE_ID = "3f6b1d84-9a1e-4c2b-8e71-2f9c5d0a7b13";
+var SAMPLE_NAME = "Mute successful robot logins";
+var SAMPLE_TYPE_ID = "0f54d68a-15fd-427d-a86a-2812bb7fbb28";
+var CODE_INSTRUCTIONS = {
+  RuleNotFound: "Check the name or id with 'uip admin audit org exclusions list'. A rule owned by another organization also reads as not found.",
+  DuplicateRuleName: "Another ACTIVE rule already uses that name. Pick a different --name, or update the existing rule. An inactive rule may keep a name in use.",
+  OverlappingRuleExists: "An active rule already excludes everything this one would — its id is in the message. Delete or narrow that rule, or save this one with --inactive to stage it alongside.",
+  RuleLimitExceeded: "The organization is at its exclusion-rule cap. Delete a rule with 'uip admin audit org exclusions delete <rule>' before adding another.",
+  EmptySelectorsNotAllowed: `Pass at least one of ${SELECTOR_FLAGS.join(" / ")}. A rule that constrains nothing would exclude every event in the organization.`,
+  InvalidSelectorValue: "Selector values are GUIDs, except --status which takes 'Success' or 'Failure'.",
+  UnknownSelectorValue: "No audit metadata defines that id. Discover valid source / target / type ids with 'uip admin audit org sources --output json'.",
+  SelectorValueNotPermitted: "That value cannot be excluded: UiPath's own monitoring events and audit-configuration changes always stay in the trail. Narrow the rule to the events you own.",
+  SelectorLimitExceeded: "Too many selectors, or too many values in one selector. Split the rule into several narrower ones.",
+  RuleModifiedConcurrently: "Another admin changed the rule while this call was in flight. Re-read it with 'exclusions get <rule>' and retry.",
+  InvalidRequest: "The body was rejected before it reached the rule logic — the message names the field. Server-owned fields (policyId, timestamps) may not be sent."
+};
+function fallbackInstructions(verb, message, status) {
+  if (/Not logged in/i.test(message))
+    return "Run 'uip login' and retry.";
+  if (status === 401)
+    return "Token may be missing the 'Audit.Read' scope. Run 'uip logout && uip login' to mint a fresh token.";
+  if (status === 403)
+    return "Reading rules needs audit-read permission; creating, replacing or deleting one needs an Administrators-group membership and a user token — a service-to-service token is refused on writes.";
+  if (verb === "list" || verb === "get")
+    return "Confirm you are logged in against the right organization with 'uip login status'.";
+  if (verb === "delete")
+    return "Check the name or id with 'uip admin audit org exclusions list'.";
+  return `Pass --name plus at least one of ${SELECTOR_FLAGS.join(" / ")}, or --file with an ExclusionRuleWriteDto body.`;
+}
+async function emitFailure(verb, error) {
+  const details = await extractErrorDetails(error);
+  OutputFormatter.error({
+    Result: details.result,
+    ErrorCode: details.errorCode,
+    Retry: details.retry,
+    Message: details.message,
+    Instructions: codeInstructions(details.context?.errorCode) ?? fallbackInstructions(verb, details.message, details.context?.httpStatus),
+    ...details.context ? { Context: details.context } : {}
+  });
+  processContext.exit(EXIT_CODES[details.result] ?? EXIT_CODES.Failure);
+}
+function codeInstructions(code) {
+  if (code === undefined)
+    return;
+  return Object.hasOwn(CODE_INSTRUCTIONS, code) ? CODE_INSTRUCTIONS[code] : undefined;
+}
+var LOOKUP_INSTRUCTIONS = {
+  ambiguous: "A name is unique only among ACTIVE rules, so an inactive rule may share it. Pass the policy id of the one you mean.",
+  unidentifiable: "Nothing can address that rule - not even the id, which the service did not return. Re-read the list with 'uip admin audit org exclusions list'; a rule still listed without a policyId needs fixing server-side.",
+  "not-found": "Check the name with 'uip admin audit org exclusions list', or pass the rule's policy id instead."
+};
+function emitLookupError(verb, error) {
+  const isCallerError = error.reason === "ambiguous";
+  OutputFormatter.error({
+    Result: isCallerError ? RESULTS.ValidationError : RESULTS.Failure,
+    ErrorCode: isCallerError ? "invalid_argument" : "not_found",
+    Retry: "RetryWillNotFix",
+    Message: error.message,
+    Instructions: error.reason === "not-found" ? `${LOOKUP_INSTRUCTIONS["not-found"]} ('${verb}' takes either.)` : LOOKUP_INSTRUCTIONS[error.reason]
+  });
+  processContext.exit(isCallerError ? EXIT_CODES.ValidationError : EXIT_CODES.Failure);
+}
+
+class BodyError extends Error {
+  instructions;
+  constructor(message, instructions) {
+    super(message);
+    this.name = "BodyError";
+    this.instructions = instructions;
+  }
+}
+async function emitBodyFailure(verb, error) {
+  if (!(error instanceof BodyError)) {
+    await emitFailure(verb, error);
+    return;
+  }
+  OutputFormatter.error({
+    Result: RESULTS.ValidationError,
+    Message: error.message,
+    Instructions: error.instructions
+  });
+  processContext.exit(EXIT_CODES.ValidationError);
+}
+var FILE_BODY_INSTRUCTIONS = "A rule body carries only name, enforcement, isActive and selectors. policyId and the timestamps are server-owned and are rejected rather than ignored.";
+var FILE_READ_INSTRUCTIONS = "Check the --file path and that the file holds one JSON object shaped like an ExclusionRuleWriteDto.";
+var ID_INSTRUCTIONS = "Selector ids are GUIDs. Discover source / target / type ids with 'uip admin audit org sources --output json'.";
+function assertIds(label, values) {
+  for (const value of values) {
+    const trimmed = value.trim();
+    if (!GUID_RE.test(trimmed) || trimmed.toLowerCase() === EMPTY_GUID) {
+      throw new BodyError(`${label} expects a GUID, got '${value}'.`, ID_INSTRUCTIONS);
+    }
+  }
+}
+function assertNotGuidShaped(name) {
+  if (isGuid(name)) {
+    throw new BodyError(`'${name}' cannot be used as a rule name: it is shaped like a policy id.`, "Pick a name that is not a bare GUID. 'get', 'update' and 'delete' read a GUID as a policy id, so a rule named like one could not be reached by name — and would shadow whichever rule owns that id.");
+  }
+}
+var STATUS_ALIASES = new Map([
+  ["success", "Success"],
+  ["0", "Success"],
+  ["failure", "Failure"],
+  ["1", "Failure"]
+]);
+var DIMENSION_NAMES = [
+  ...ID_DIMENSIONS2.map((dimension) => dimension.dimension),
+  "Status"
+];
+function validateSelector(raw, seen) {
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    throw new BodyError("Each selector must be a JSON object.", FILE_BODY_INSTRUCTIONS);
+  }
+  const selector = raw;
+  const unknownKeys = Object.keys(selector).filter((key) => !SELECTOR_KEYS.includes(key));
+  if (unknownKeys.length > 0) {
+    throw new BodyError(`Unsupported field(s) in a selector: ${unknownKeys.join(", ")}.`, `A selector carries only ${SELECTOR_KEYS.join(" and ")}: a 'type' naming the dimension and its 'values'.`);
+  }
+  const type = selector.type;
+  if (typeof type !== "string" || !DIMENSION_NAMES.includes(type)) {
+    throw new BodyError(`'${String(type)}' is not an exclusion dimension.`, `A selector's 'type' is one of ${DIMENSION_NAMES.join(", ")}.`);
+  }
+  if (seen.has(type)) {
+    throw new BodyError(`Two selectors constrain '${type}'.`, "A rule constrains each dimension at most once. Put every value for a dimension in that one selector's 'values'.");
+  }
+  seen.add(type);
+  const values = selector.values;
+  if (!Array.isArray(values) || values.length === 0 || values.some((value) => typeof value !== "string")) {
+    throw new BodyError(`The '${type}' selector needs a non-empty 'values' array of strings.`, "A selector names the values it matches; an empty one would constrain nothing on that dimension.");
+  }
+  const label = `selector '${type}'`;
+  if (type === "Status") {
+    return {
+      type,
+      values: values.map((value) => canonicalStatus(value, label))
+    };
+  }
+  assertIds(label, values);
+  return { type, values: values.map((value) => value.trim()) };
+}
+function canonicalStatus(value, label = "--status") {
+  const match = STATUS_ALIASES.get(value.trim().toLowerCase());
+  if (!match) {
+    throw new BodyError(`${label} expects ${STATUS_VALUES.join(" or ")}, got '${value}'.`, "Use --status Success or --status Failure (case-insensitive; 0 and 1 work too, as on `audit <scope> events`). One or the other: a rule that excludes both outcomes constrains nothing on this dimension.");
+  }
+  return match;
+}
+function bodyFromFlags(options) {
+  const name = options.name?.trim();
+  if (!name) {
+    throw new BodyError("--name is required.", `Pass --name "<rule name>". It must be unique among the organization's active rules.`);
+  }
+  assertNotGuidShaped(name);
+  const selectors = [];
+  for (const { option, flag, dimension } of ID_DIMENSIONS2) {
+    const values = options[option];
+    if (!values?.length)
+      continue;
+    assertIds(flag, values);
+    selectors.push({
+      type: dimension,
+      values: values.map((v) => v.trim())
+    });
+  }
+  if (options.status !== undefined) {
+    selectors.push({
+      type: "Status",
+      values: [canonicalStatus(options.status)]
+    });
+  }
+  if (selectors.length === 0) {
+    throw new BodyError("A rule must constrain at least one dimension.", CODE_INSTRUCTIONS.EmptySelectorsNotAllowed);
+  }
+  return {
+    name,
+    enforcement: ENFORCEMENT,
+    isActive: options.inactive !== true,
+    selectors
+  };
+}
+function validateWriteBody(parsed) {
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new BodyError("The file must contain a JSON object.", FILE_READ_INSTRUCTIONS);
+  }
+  const body = parsed;
+  const unknown = Object.keys(body).filter((key) => !WRITE_BODY_KEYS.includes(key));
+  if (unknown.length > 0) {
+    throw new BodyError(`Unsupported field(s) in --file: ${unknown.join(", ")}.`, FILE_BODY_INSTRUCTIONS);
+  }
+  if (typeof body.name !== "string" || body.name.trim() === "") {
+    throw new BodyError("The file must set a non-empty 'name'.", "Give the rule a name in the file's 'name' field. It must be unique among the organization's active rules.");
+  }
+  const name = body.name.trim();
+  assertNotGuidShaped(name);
+  if (body.selectors !== undefined && body.selectors !== null && !Array.isArray(body.selectors)) {
+    throw new BodyError("'selectors' must be an array.", FILE_BODY_INSTRUCTIONS);
+  }
+  const seenDimensions = new Set;
+  const selectors = Array.isArray(body.selectors) ? body.selectors.map((selector) => validateSelector(selector, seenDimensions)) : [];
+  if (selectors.length === 0) {
+    throw new BodyError("A rule must constrain at least one dimension.", "Give the file's 'selectors' at least one entry. A rule that constrains nothing would exclude every event in the organization.");
+  }
+  return {
+    ...body,
+    name,
+    selectors,
+    enforcement: body.enforcement ?? ENFORCEMENT,
+    isActive: body.isActive ?? true
+  };
+}
+function tooLarge(amount, unit) {
+  return new BodyError(`--file is ${amount} ${unit}; a rule body may not exceed ${MAX_FILE_LENGTH}.`, "Point --file at a single rule body. The file is one rule, not an export of many.");
+}
+async function bodyFromFile(file) {
+  const fs2 = getFileSystem();
+  const stats = await fs2.stat(file);
+  if (stats && stats.size > MAX_FILE_LENGTH) {
+    throw tooLarge(stats.size, "bytes");
+  }
+  const content = await fs2.readFile(file, "utf-8");
+  if (content === null || content === undefined) {
+    throw new BodyError(`File not found: ${file}`, FILE_READ_INSTRUCTIONS);
+  }
+  const raw = String(content);
+  const byteLength = new TextEncoder().encode(raw).length;
+  if (byteLength > MAX_FILE_LENGTH) {
+    throw tooLarge(byteLength, "bytes");
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new BodyError(`--file is not valid JSON: ${err instanceof Error ? err.message : String(err)}`, FILE_READ_INSTRUCTIONS);
+  }
+  return validateWriteBody(parsed);
+}
+async function resolveBody(options) {
+  const inlineFlags = [
+    options.name !== undefined && "--name",
+    options.inactive === true && "--inactive",
+    ...ID_DIMENSIONS2.map(({ option, flag }) => options[option]?.length && flag),
+    options.status !== undefined && "--status"
+  ].filter((flag) => typeof flag === "string");
+  if (options.file !== undefined) {
+    if (inlineFlags.length > 0) {
+      throw new BodyError(`--file cannot be combined with ${inlineFlags.join(", ")}.`, "Pass either --file with the whole body, or the inline flags — not both. Merging them would leave it ambiguous which input owns a field both set.");
+    }
+    return await bodyFromFile(options.file);
+  }
+  return bodyFromFlags(options);
+}
+async function getApi(options) {
+  return await createApiClient(EventConfigApi, {
+    scope: "org",
+    loginValidity: options.loginValidity
+  });
+}
+var RULE_ARGUMENT = [
+  "<rule>",
+  "Rule name, or its policy id. A name is matched against the organization's rules; an id is used as it stands."
+];
+async function resolveTarget(verb, rule, options) {
+  const [apiError, api] = await catchError2(getApi(options));
+  if (apiError || !api) {
+    await emitFailure(verb, apiError);
+    return;
+  }
+  const [lookupError, target] = await catchError2(resolveExclusionRule(api, rule));
+  if (lookupError || !target) {
+    if (lookupError instanceof ExclusionRuleLookupError) {
+      emitLookupError(verb, lookupError);
+    } else {
+      await emitFailure(verb, lookupError);
+    }
+    return;
+  }
+  return { api, policyId: target.policyId, resolved: target.rule };
+}
+function withLoginValidity(cmd) {
+  return cmd.option("--login-validity <minutes>", "Override the interactive-login token lifetime for this call. Rarely needed.", (v) => Number.parseInt(v, 10));
+}
+function withWriteOptions(cmd) {
+  return withLoginValidity(cmd.option("--name <name>", "Rule name, unique among the organization's ACTIVE rules. Max 256 characters.").option("--exclude-tenant <guid...>", "Tenant selector: exclude events from these tenants only. Repeatable. Not spelled --tenant-id, which on the read verbs picks the tenant a call runs against rather than the tenants a rule matches. A tenant outside this organization is accepted but matches nothing, so a typo reads as a rule that silently never fires.").option("--source <guid...>", "EventSource selector. Repeatable. Discover ids with `audit org sources`.").option("--target <guid...>", "EventTarget selector. Repeatable. Discover ids with `audit org sources`.").option("--type <guid...>", "EventType selector. Repeatable. Discover ids with `audit org sources`.").option("--status <status>", "Status selector: 'Success' or 'Failure' (case-insensitive). Single-valued, like --status on `audit <scope> events` — a selector holding both statuses matches every event, which is what omitting the flag already does.").option("--inactive", "Save the rule without activating it. Nothing is excluded until it is active, and an inactive rule may reuse an active rule's name or match set.").option("--file <path>", "Path to a JSON file holding the whole rule body (name, enforcement, isActive, selectors). Mutually exclusive with the flags above."));
+}
+var SAMPLE_RULE = {
+  policyId: SAMPLE_ID,
+  name: SAMPLE_NAME,
+  enforcement: ENFORCEMENT,
+  isActive: true,
+  activatedOn: "2026-09-17T09:14:22.000Z",
+  selectors: [
+    { type: "EventType", values: [SAMPLE_TYPE_ID] },
+    { type: "Status", values: ["Success"] }
+  ],
+  createdOn: "2026-09-17T09:14:22.000Z",
+  lastModifiedOn: "2026-09-17T09:14:22.000Z"
+};
+var LIST_EXAMPLES = [
+  {
+    Description: "List the organization's exclusion rules, ordered by name",
+    Command: "uip admin audit org exclusions list",
+    Output: { Code: "AuditOrgExclusionsList", Data: [SAMPLE_RULE] }
+  }
+];
+var GET_EXAMPLES = [
+  {
+    Description: "Read one rule by the name it was given",
+    Command: `uip admin audit org exclusions get "${SAMPLE_NAME}"`,
+    Output: { Code: "AuditOrgExclusionsGet", Data: SAMPLE_RULE }
+  },
+  {
+    Description: "Read it by policy id instead, which skips the name lookup",
+    Command: `uip admin audit org exclusions get ${SAMPLE_ID}`,
+    Output: { Code: "AuditOrgExclusionsGet", Data: SAMPLE_RULE }
+  }
+];
+var CREATE_EXAMPLES = [
+  {
+    Description: "Stop recording successful events of one event type (the two selectors are AND-ed)",
+    Command: `uip admin audit org exclusions create --name "Mute successful robot logins" --type ${SAMPLE_TYPE_ID} --status Success`,
+    Output: { Code: "AuditOrgExclusionsCreated", Data: SAMPLE_RULE }
+  },
+  {
+    Description: "Stage a rule without activating it, so it excludes nothing until it is turned on",
+    Command: `uip admin audit org exclusions create --name "Staged" --source ${SAMPLE_ID} --inactive`,
+    Output: {
+      Code: "AuditOrgExclusionsCreated",
+      Data: { ...SAMPLE_RULE, isActive: false, activatedOn: null }
+    }
+  },
+  {
+    Description: "Create from a JSON body instead of flags",
+    Command: "uip admin audit org exclusions create --file ./rule.json",
+    Output: { Code: "AuditOrgExclusionsCreated", Data: SAMPLE_RULE }
+  }
+];
+var UPDATE_EXAMPLES = [
+  {
+    Description: "Replace a rule in full — every field is resent, and omitted selectors are dropped",
+    Command: `uip admin audit org exclusions update "${SAMPLE_NAME}" --name "${SAMPLE_NAME}" --type ${SAMPLE_TYPE_ID} --status Success`,
+    Output: { Code: "AuditOrgExclusionsUpdated", Data: SAMPLE_RULE }
+  }
+];
+var DELETE_EXAMPLES = [
+  {
+    Description: "Delete a rule, so its events are recorded again from now on",
+    Command: `uip admin audit org exclusions delete "${SAMPLE_NAME}"`,
+    Output: { Code: "AuditOrgExclusionsDeleted", Data: {} }
+  }
+];
+function registerExclusionCommands(org) {
+  const exclusions = org.command("exclusions").description([
+    "Manage the organization's audit exclusion rules — which events the audit trail stops recording.",
+    "",
+    "A rule carries one selector per dimension (Tenant, EventSource, EventTarget, EventType, Status).",
+    "Values inside a selector are OR-ed, and selectors are AND-ed: `--type A --type B --status Success`",
+    "excludes successful events of type A or B. A rule with no selector is refused — it would",
+    "exclude everything.",
+    "",
+    "Exclusion starts when the rule becomes active and is never retroactive: events already in the",
+    "trail stay there, and widening a rule's match set re-stamps that start time. An inactive rule",
+    "excludes nothing, which is how you stage a replacement next to the rule it takes over from.",
+    "",
+    "`get`, `update` and `delete` take the rule's name or its policy id. A name is unique only",
+    "among ACTIVE rules, so if an inactive rule shares one the CLI asks for the id rather than",
+    "guessing which you meant.",
+    "",
+    "Org-scoped only (there is no `audit tenant exclusions`): name the tenants a rule applies to with",
+    "--exclude-tenant. Reading rules needs audit-read permission; every write needs a user token whose",
+    "identity is in the Administrators group.",
+    "",
+    "Two things can never be excluded: UiPath's own monitoring events, and audit-configuration",
+    "changes — including the rules themselves."
+  ].join(`
+`));
+  withLoginValidity(exclusions.command("list").description([
+    "List every exclusion rule in the organization, ordered by name.",
+    "",
+    "The set is capped server-side, so there is no pagination. A rule whose stored",
+    "document cannot be parsed is still listed, with an empty `selectors` array, so",
+    "it can be deleted."
+  ].join(`
+`)).examples(LIST_EXAMPLES)).trackedAction(processContext, async (options) => {
+    const [error, result] = await catchError2((async () => await (await getApi(options)).eventConfigGetRules())());
+    if (error) {
+      await emitFailure("list", error);
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "AuditOrgExclusionsList",
+      Data: result ?? []
+    });
+  });
+  withLoginValidity(exclusions.command("get").description("Read one exclusion rule, by name or by policy id.").argument(...RULE_ARGUMENT).examples(GET_EXAMPLES)).trackedAction(processContext, async (rule, options) => {
+    const target = await resolveTarget("get", rule, options);
+    if (!target)
+      return;
+    if (target.resolved) {
+      OutputFormatter.success({
+        Result: RESULTS.Success,
+        Code: "AuditOrgExclusionsGet",
+        Data: target.resolved
+      });
+      return;
+    }
+    const [error, result] = await catchError2(target.api.eventConfigGetRule({ policyId: target.policyId }));
+    if (error) {
+      await emitFailure("get", error);
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "AuditOrgExclusionsGet",
+      Data: result
+    });
+  });
+  withWriteOptions(exclusions.command("create").description([
+    "Create an exclusion rule.",
+    "",
+    "The rule is active unless --inactive is passed, and an active rule is refused when",
+    "another active rule already carries the same name or already excludes everything",
+    "this one would."
+  ].join(`
+`)).examples(CREATE_EXAMPLES)).trackedAction(processContext, async (options) => {
+    const [bodyError, body] = await catchError2(resolveBody(options));
+    if (bodyError) {
+      await emitBodyFailure("create", bodyError);
+      return;
+    }
+    const [error, result] = await catchError2((async () => await (await getApi(options)).eventConfigCreateRule({
+      exclusionRuleWriteDto: body
+    }))());
+    if (error) {
+      await emitFailure("create", error);
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "AuditOrgExclusionsCreated",
+      Data: result
+    });
+  });
+  withWriteOptions(exclusions.command("update").description([
+    "Replace an exclusion rule in full.",
+    "",
+    "This is a replacement, not a patch: whatever you leave out is dropped, so resend",
+    "every flag the rule should keep (read it first with `exclusions get`). Renaming a",
+    "rule leaves its exclusion start time alone; changing which events it matches",
+    "re-stamps that time, so the widened rule does not cover events it never matched.",
+    "",
+    "Activation is part of the replacement: without --inactive the rule comes back",
+    "ACTIVE, so editing a rule you deliberately staged inactive starts it excluding",
+    "events. Pass --inactive again to keep it staged.",
+    "",
+    "Pass <rule> before the selector flags. Those flags take a list, so a value",
+    "written after one is read as another of its values."
+  ].join(`
+`)).argument(...RULE_ARGUMENT).examples(UPDATE_EXAMPLES)).trackedAction(processContext, async (rule, options) => {
+    const [bodyError, body] = await catchError2(resolveBody(options));
+    if (bodyError) {
+      await emitBodyFailure("update", bodyError);
+      return;
+    }
+    const target = await resolveTarget("update", rule, options);
+    if (!target)
+      return;
+    const [error, result] = await catchError2(target.api.eventConfigReplaceRule({
+      policyId: target.policyId,
+      exclusionRuleWriteDto: body
+    }));
+    if (error) {
+      await emitFailure("update", error);
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "AuditOrgExclusionsUpdated",
+      Data: result
+    });
+  });
+  withLoginValidity(exclusions.command("delete").description([
+    "Delete an exclusion rule.",
+    "",
+    "Events it was excluding are recorded again from now on. Events suppressed while",
+    "it was active are gone for good — deleting the rule does not bring them back."
+  ].join(`
+`)).argument(...RULE_ARGUMENT).examples(DELETE_EXAMPLES)).trackedAction(processContext, async (rule, options) => {
+    const target = await resolveTarget("delete", rule, options);
+    if (!target)
+      return;
+    const [error] = await catchError2(target.api.eventConfigDeleteRule({
+      policyId: target.policyId
+    }));
+    if (error) {
+      await emitFailure("delete", error);
+      return;
+    }
+    OutputFormatter.success({
+      Result: RESULTS.Success,
+      Code: "AuditOrgExclusionsDeleted",
+      Data: {}
+    });
+  });
+}
+
 // src/utils/chunked-export.ts
 import { Buffer as Buffer2 } from "node:buffer";
 
@@ -8885,23 +10152,27 @@ function registerExport(parent, opts) {
 // src/commands/audit.ts
 var registerAuditCommand = (program2) => {
   const audit = program2.command("audit").description([
-    "Query and export UiPath audit events.",
+    "Query and export UiPath audit events, and configure which events are recorded.",
     "",
-    "Subject subgroups (verb-symmetric — same three verbs under each):",
+    "Subject subgroups:",
     "  org    — organization-scoped audit (admin events that are tenant-agnostic).",
     "  tenant — tenant-scoped audit (events scoped to the active or --tenant-id-overridden tenant).",
     "",
-    "Verbs:",
+    "Read verbs (the same three under each subject):",
     "  sources — list event sources/targets/types visible at this scope.",
     "  events  — paginated query of audit events with cursor and filters.",
     "  export  — chunked download from the long-term store as a ZIP of day-wise files or a single merged CSV (requires --from-date / --to-date).",
     "",
+    "Configuration (org only):",
+    "  exclusions — CRUD over the exclusion rules that stop matching events being recorded at all.",
+    "",
     "Typical workflow: `audit <scope> sources` (discover IDs) → `audit <scope> events --source <guid>",
     "--from-date … --to-date …` (find the rows) → `audit <scope> export --from-date … --to-date … --output-path …`."
   ].join(`
 `));
   const org = audit.command("org").description("Organization-scoped audit operations.");
   registerScopeCommands(org, { scope: "org", codeSuffix: "Org" });
+  registerExclusionCommands(org);
   const tenant = audit.command("tenant").description("Tenant-scoped audit operations.");
   registerScopeCommands(tenant, { scope: "tenant", codeSuffix: "Tenant" });
 };
@@ -8914,4 +10185,4 @@ export {
   registerCommands
 };
 
-//# debugId=CB93B8471D4DB1E864756E2164756E21
+//# debugId=A3B08992C797FBE564756E2164756E21