@uipath/audit-tool 1.196.0 → 1.197.0-preview.59

package/dist/tool.js

@@ -19555,9 +19555,9 @@ var require_utils = __commonJS((exports, module) => {
       return typeof input === "string" ? encoder(input) : Buffer.alloc(0);
     }
   };
-  Utils.readBigUInt64LE = function(buffer, index2) {
-    const lo = buffer.readUInt32LE(index2);
-    const hi = buffer.readUInt32LE(index2 + 4);
+  Utils.readBigUInt64LE = function(buffer, index) {
+    const lo = buffer.readUInt32LE(index);
+    const hi = buffer.readUInt32LE(index + 4);
     return hi * 4294967296 + lo;
   };
   Utils.fromDOS2Date = function(val) {
@@ -20595,9 +20595,9 @@ var require_zipFile = __commonJS((exports, module) => {
         throw Utils.Errors.DISK_ENTRY_TOO_LARGE();
       }
       entryList = new Array(mainHeader.diskEntries);
-      var index2 = mainHeader.offset;
+      var index = mainHeader.offset;
       for (var i = 0;i < entryList.length; i++) {
-        var tmp = index2, entry = new ZipEntry(opts, inBuffer);
+        var tmp = index, entry = new ZipEntry(opts, inBuffer);
         entry.header = inBuffer.slice(tmp, tmp += Utils.Constants.CENHDR);
         entry.entryName = inBuffer.slice(tmp, tmp += entry.header.fileNameLength);
         if (entry.header.extraLength) {
@@ -20605,7 +20605,7 @@ var require_zipFile = __commonJS((exports, module) => {
         }
         if (entry.header.commentLength)
           entry.comment = inBuffer.slice(tmp, tmp + entry.header.commentLength);
-        index2 += entry.header.centralHeaderSize;
+        index += entry.header.centralHeaderSize;
         entryList[i] = entry;
         entryTable[entry.entryName] = entry;
       }
@@ -20701,9 +20701,9 @@ var require_zipFile = __commonJS((exports, module) => {
           readEntries();
         }
         const entry = entryTable[entryName];
-        const index2 = entryList.indexOf(entry);
-        if (index2 >= 0) {
-          entryList.splice(index2, 1);
+        const index = entryList.indexOf(entry);
+        if (index >= 0) {
+          entryList.splice(index, 1);
           delete entryTable[entryName];
           mainHeader.totalEntries = entryList.length;
         }
@@ -21435,7 +21435,7 @@ var require_adm_zip = __commonJS((exports, module) => {
 var package_default = {
   name: "@uipath/audit-tool",
   license: "MIT",
-  version: "1.196.0",
+  version: "1.197.0-preview.59",
   description: "CLI plugin for the UiPath Audit Service — query event sources, paginate events, and export ZIPs from the long-term store.",
   private: false,
   repository: {
@@ -21446,7 +21446,9 @@ var package_default = {
   publishConfig: {
     registry: "https://npm.pkg.github.com/@uipath"
   },
-  keywords: ["cli-tool"],
+  keywords: [
+    "cli-tool"
+  ],
   type: "module",
   main: "./dist/tool.js",
   exports: {
@@ -21455,9 +21457,11 @@ var package_default = {
   bin: {
     "audit-tool": "./dist/index.js"
   },
-  files: ["dist"],
+  files: [
+    "dist"
+  ],
   scripts: {
-    build: "bun build ./src/tool.ts --outdir dist --format esm --target node --external commander && bun build ./src/index.ts --outdir dist --format esm --target node",
+    build: "bun build ./src/tool.ts --outdir dist --format esm --target node --external commander --sourcemap=linked && bun build ./src/index.ts --outdir dist --format esm --target node --sourcemap=linked",
     package: "bun run build && bun pm pack",
     lint: "biome check .",
     "lint:fix": "biome check --write .",
@@ -21506,6 +21510,12 @@ function singleton(ctorOrName) {
   };
 }
 
+// ../../common/src/telemetry/global-telemetry-properties.ts
+var telemetryPropsSlot = singleton("TelemetryDefaultProps");
+function getGlobalTelemetryProperties() {
+  return telemetryPropsSlot.get();
+}
+
 // ../../common/src/sdk-user-agent.ts
 var USER_AGENT_HEADER = "User-Agent";
 var sdkUserAgentHostToken = singleton("SdkUserAgentHostToken");
@@ -21529,8 +21539,8 @@ function appendUserAgentToken(value, userAgent) {
 function getEffectiveUserAgent(userAgent) {
   return appendUserAgentToken(sdkUserAgentHostToken.get(), userAgent);
 }
-function isHeadersLike(headers) {
-  return typeof headers === "object" && headers !== null && "get" in headers && typeof headers.get === "function" && "set" in headers && typeof headers.set === "function";
+function getHeaderName(headers, headerName) {
+  return Object.keys(headers).find((key) => key.toLowerCase() === headerName.toLowerCase());
 }
 function getSdkUserAgentToken(pkg) {
   const packageName = pkg.name.replace(/^@uipath\//, "");
@@ -21538,59 +21548,31 @@ function getSdkUserAgentToken(pkg) {
 }
 function addSdkUserAgentHeader(headers, userAgent) {
   const result = { ...headers ?? {} };
-  const effectiveUserAgent = getEffectiveUserAgent(userAgent);
-  const headerName = Object.keys(result).find((key) => key.toLowerCase() === USER_AGENT_HEADER.toLowerCase());
-  if (headerName) {
-    result[headerName] = appendUserAgentToken(result[headerName], effectiveUserAgent);
-  } else {
-    result[USER_AGENT_HEADER] = effectiveUserAgent;
-  }
+  const headerName = getHeaderName(result, USER_AGENT_HEADER);
+  result[headerName ?? USER_AGENT_HEADER] = appendUserAgentToken(headerName ? result[headerName] : undefined, getEffectiveUserAgent(userAgent));
   return result;
 }
-function withSdkUserAgentHeader(headers, userAgent) {
-  const effectiveUserAgent = getEffectiveUserAgent(userAgent);
-  if (isHeadersLike(headers)) {
-    headers.set(USER_AGENT_HEADER, appendUserAgentToken(headers.get(USER_AGENT_HEADER), effectiveUserAgent));
-    return headers;
-  }
-  if (Array.isArray(headers)) {
-    const result = headers.map((entry) => {
-      const [key, value] = entry;
-      return [key, value];
-    });
-    const headerIndex = result.findIndex(([key]) => key.toLowerCase() === USER_AGENT_HEADER.toLowerCase());
-    if (headerIndex >= 0) {
-      const [key, value] = result[headerIndex];
-      result[headerIndex] = [
-        key,
-        appendUserAgentToken(value, effectiveUserAgent)
-      ];
-    } else {
-      result.push([USER_AGENT_HEADER, effectiveUserAgent]);
-    }
-    return result;
-  }
-  return addSdkUserAgentHeader(typeof headers === "object" && headers !== null ? { ...headers } : {}, effectiveUserAgent);
+function asHeaderRecord(headers) {
+  return typeof headers === "object" && headers !== null ? { ...headers } : {};
 }
-function withUserAgentInitOverride(initOverrides, userAgent) {
+function withForwardedHeadersInitOverride(initOverrides, forward) {
   return async (requestContext) => {
-    const initWithUserAgent = {
+    const initWithHeaders = {
       ...requestContext.init,
-      headers: withSdkUserAgentHeader(requestContext.init.headers, userAgent)
+      headers: forward(asHeaderRecord(requestContext.init.headers))
     };
     const override = typeof initOverrides === "function" ? await initOverrides({
       ...requestContext,
-      init: initWithUserAgent
+      init: initWithHeaders
     }) : initOverrides;
     return {
       ...override ?? {},
-      headers: withSdkUserAgentHeader(override?.headers ?? initWithUserAgent.headers, userAgent)
+      headers: forward(asHeaderRecord(override?.headers ?? initWithHeaders.headers))
     };
   };
 }
-function installSdkUserAgentHeader(BaseApiClass, userAgent) {
+function installRequestHeaderForwarding(BaseApiClass, patchKey, forward) {
   const prototype = BaseApiClass.prototype;
-  const patchKey = userAgentPatchKey(userAgent);
   if (prototype[patchKey]) {
     return;
   }
@@ -21598,13 +21580,16 @@ function installSdkUserAgentHeader(BaseApiClass, userAgent) {
     throw new Error("Generated BaseAPI request function not found.");
   }
   const originalRequest = prototype.request;
-  prototype.request = function requestWithUserAgent(context, initOverrides) {
-    return originalRequest.call(this, context, withUserAgentInitOverride(initOverrides, userAgent));
+  prototype.request = function requestWithForwardedHeaders(context, initOverrides) {
+    return originalRequest.call(this, context, withForwardedHeadersInitOverride(initOverrides, forward));
   };
   Object.defineProperty(prototype, patchKey, {
     value: true
   });
 }
+function installSdkUserAgentHeader(BaseApiClass, userAgent) {
+  installRequestHeaderForwarding(BaseApiClass, userAgentPatchKey(userAgent), (headers) => addSdkUserAgentHeader(headers, userAgent));
+}
 
 // ../audit-sdk/generated/src/runtime.ts
 var BASE_PATH = "https://localhost:7008".replace(/\/+$/, "");
@@ -21858,7 +21843,7 @@ class VoidApiResponse {
 var package_default2 = {
   name: "@uipath/audit-sdk",
   license: "MIT",
-  version: "1.196.0",
+  version: "1.197.0",
   description: "SDK for the UiPath Audit Service — query audit event sources, list events, and download long-term-store exports.",
   repository: {
     type: "git",
@@ -21868,7 +21853,11 @@ var package_default2 = {
   publishConfig: {
     registry: "https://npm.pkg.github.com/@uipath"
   },
-  keywords: ["uipath", "audit", "sdk"],
+  keywords: [
+    "uipath",
+    "audit",
+    "sdk"
+  ],
   type: "module",
   main: "./dist/index.js",
   types: "./dist/src/index.d.ts",
@@ -21878,10 +21867,12 @@ var package_default2 = {
       default: "./dist/index.js"
     }
   },
-  files: ["dist"],
+  files: [
+    "dist"
+  ],
   private: true,
   scripts: {
-    build: "bun build ./src/index.ts --outdir dist --format esm --target node && tsc -p tsconfig.build.json --noCheck",
+    build: "bun build ./src/index.ts --outdir dist --format esm --target node --sourcemap=linked && tsc -p tsconfig.build.json --noCheck",
     generate: "bun run src/scripts/generate-sdk.ts",
     lint: "biome check ."
   },
@@ -22178,6 +22169,12 @@ var normalizeAndValidateBaseUrl = (rawUrl) => {
   }
   return url.pathname.length > 1 ? url.origin : baseUrl;
 };
+var resolveScopes = (isExternalAppAuth, customScopes, fileScopes) => {
+  const requestedScopes = customScopes?.length ? customScopes : fileScopes ?? [];
+  if (isExternalAppAuth)
+    return requestedScopes;
+  return [...new Set([...DEFAULT_SCOPES, ...requestedScopes])];
+};
 var resolveConfigAsync = async ({
   customAuthority,
   customClientId,
@@ -22208,7 +22205,7 @@ var resolveConfigAsync = async ({
     clientSecret = fileAuth.clientSecret;
   }
   const isExternalAppAuth = clientId !== DEFAULT_CLIENT_ID && Boolean(clientSecret);
-  const scopes = customScopes && customScopes.length > 0 ? customScopes : fileAuth.scopes && fileAuth.scopes.length > 0 ? fileAuth.scopes : isExternalAppAuth ? [] : DEFAULT_SCOPES;
+  const scopes = resolveScopes(isExternalAppAuth, customScopes, fileAuth.scopes);
   return {
     clientId,
     clientSecret,
@@ -22223,6 +22220,76 @@ var resolveConfigAsync = async ({
 init_constants();
 // ../../auth/src/loginStatus.ts
 init_src();
+
+// ../../auth/src/authProfile.ts
+init_src();
+init_constants();
+var DEFAULT_AUTH_PROFILE = "default";
+var PROFILE_DIR = "profiles";
+var PROFILE_NAME_RE = /^[A-Za-z0-9._-]+$/;
+var ACTIVE_AUTH_PROFILE_KEY = Symbol.for("@uipath/auth/ActiveAuthProfile");
+var AUTH_PROFILE_STORAGE_KEY = Symbol.for("@uipath/auth/ProfileStorage");
+var globalSlot2 = globalThis;
+function isAuthProfileStorage(value) {
+  return value !== null && typeof value === "object" && "getStore" in value && "run" in value;
+}
+function createProfileStorage() {
+  const [error, mod] = catchError(() => __require("node:async_hooks"));
+  if (error || typeof mod?.AsyncLocalStorage !== "function") {
+    return {
+      getStore: () => {
+        return;
+      },
+      run: (_store, fn) => fn()
+    };
+  }
+  return new mod.AsyncLocalStorage;
+}
+function getProfileStorage() {
+  const existing = globalSlot2[AUTH_PROFILE_STORAGE_KEY];
+  if (isAuthProfileStorage(existing)) {
+    return existing;
+  }
+  const storage = createProfileStorage();
+  globalSlot2[AUTH_PROFILE_STORAGE_KEY] = storage;
+  return storage;
+}
+var profileStorage = getProfileStorage();
+
+class AuthProfileValidationError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AuthProfileValidationError";
+  }
+}
+function normalizeAuthProfileName(profile) {
+  if (profile === undefined || profile === DEFAULT_AUTH_PROFILE) {
+    return;
+  }
+  if (profile.length === 0 || profile === "." || profile === ".." || !PROFILE_NAME_RE.test(profile)) {
+    throw new AuthProfileValidationError(`Invalid profile name "${profile}". Profile names may contain only letters, numbers, '.', '_', and '-'.`);
+  }
+  return profile;
+}
+function getActiveAuthProfile() {
+  const scopedState = profileStorage.getStore();
+  if (scopedState !== undefined) {
+    return scopedState.profile;
+  }
+  return globalSlot2[ACTIVE_AUTH_PROFILE_KEY]?.profile;
+}
+function resolveAuthProfileFilePath(profile) {
+  const normalized = normalizeAuthProfileName(profile);
+  if (normalized === undefined) {
+    throw new AuthProfileValidationError(`"${DEFAULT_AUTH_PROFILE}" is the built-in profile and does not have a profile file path.`);
+  }
+  const fs7 = getFileSystem();
+  return fs7.path.join(fs7.env.homedir(), UIPATH_HOME_DIR, PROFILE_DIR, normalized, AUTH_FILENAME);
+}
+function getActiveAuthProfileFilePath() {
+  const profile = getActiveAuthProfile();
+  return profile ? resolveAuthProfileFilePath(profile) : undefined;
+}
 // ../../auth/src/utils/jwt.ts
 class InvalidIssuerError extends Error {
   expected;
@@ -22351,23 +22418,74 @@ var readAuthFromEnv = () => {
     organizationId,
     tenantName,
     tenantId,
-    expiration
+    expiration,
+    source: "env" /* Env */
   };
 };
 
+// ../../auth/src/refreshCircuitBreaker.ts
+init_src();
+var BREAKER_SUFFIX = ".refresh-state";
+var BACKOFF_BASE_MS = 60000;
+var BACKOFF_CAP_MS = 60 * 60 * 1000;
+var SURFACE_WINDOW_MS = 60 * 60 * 1000;
+async function refreshTokenFingerprint(refreshToken) {
+  const bytes = new TextEncoder().encode(refreshToken);
+  if (globalThis.crypto?.subtle) {
+    const digest = await globalThis.crypto.subtle.digest("SHA-256", bytes);
+    return Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, "0")).join("").slice(0, 16);
+  }
+  const { createHash } = await import("node:crypto");
+  return createHash("sha256").update(refreshToken).digest("hex").slice(0, 16);
+}
+function breakerPathFor(authPath) {
+  return `${authPath}${BREAKER_SUFFIX}`;
+}
+async function loadRefreshBreaker(authPath) {
+  const fs7 = getFileSystem();
+  try {
+    const content = await fs7.readFile(breakerPathFor(authPath), "utf-8");
+    if (!content)
+      return {};
+    const parsed = JSON.parse(content);
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+async function saveRefreshBreaker(authPath, state) {
+  try {
+    const fs7 = getFileSystem();
+    const path3 = breakerPathFor(authPath);
+    await fs7.mkdir(fs7.path.dirname(path3));
+    const tempPath = `${path3}.tmp`;
+    await fs7.writeFile(tempPath, JSON.stringify(state));
+    await fs7.rename(tempPath, path3);
+  } catch {}
+}
+async function clearRefreshBreaker(authPath) {
+  const fs7 = getFileSystem();
+  const path3 = breakerPathFor(authPath);
+  try {
+    if (await fs7.exists(path3)) {
+      await fs7.rm(path3);
+    }
+  } catch {}
+}
+function nextBackoffMs(attempts) {
+  const shift = Math.max(0, attempts - 1);
+  return Math.min(BACKOFF_BASE_MS * 2 ** shift, BACKOFF_CAP_MS);
+}
+function shouldSurface(state, nowMs) {
+  if (state.lastSurfacedAtMs === undefined)
+    return true;
+  return nowMs - state.lastSurfacedAtMs >= SURFACE_WINDOW_MS;
+}
+
 // ../../auth/src/robotClientFallback.ts
 init_src();
 var DEFAULT_TIMEOUT_MS = 1000;
 var CLOSE_TIMEOUT_MS = 500;
-var NOTICE_SENTINEL = Symbol.for("@uipath/auth/robotFallbackNoticePrinted");
-var printNoticeOnce = () => {
-  const slot = globalThis;
-  if (slot[NOTICE_SENTINEL])
-    return;
-  slot[NOTICE_SENTINEL] = true;
-  catchError(() => process.stderr.write(`Using UiPath Robot credentials. Run 'uip login' for a dedicated session.
-`));
-};
 var ROBOT_USER_SERVICES_PIPE = "UiPathUserServices";
 var ROBOT_USER_SERVICES_ALTERNATE_PIPE = `${ROBOT_USER_SERVICES_PIPE}Alternate`;
 var PIPE_NAME_MAX_LENGTH = 103;
@@ -22483,7 +22601,6 @@ var tryRobotClientFallback = async (options = {}) => {
         issuerFromToken = issClaim;
       }
     }
-    printNoticeOnce();
     return {
       accessToken,
       baseUrl: parsedUrl.baseUrl,
@@ -22708,18 +22825,327 @@ var saveEnvFileAsync = async ({
 };
 
 // ../../auth/src/loginStatus.ts
-function normalizeTokenRefreshFailure() {
-  return "stored refresh token is invalid or expired";
+var getLoginStatusAsync = async (options = {}) => {
+  return getLoginStatusWithDeps(options);
+};
+var getLoginStatusWithDeps = async (options = {}, deps = {}) => {
+  const {
+    resolveEnvFilePath = resolveEnvFilePathAsync,
+    loadEnvFile = loadEnvFileAsync,
+    saveEnvFile = saveEnvFileAsync,
+    getFs = getFileSystem,
+    refreshToken: refreshTokenFn = refreshAccessToken,
+    resolveConfig = resolveConfigAsync,
+    robotFallback = tryRobotClientFallback,
+    loadBreaker = loadRefreshBreaker,
+    saveBreaker = saveRefreshBreaker,
+    clearBreaker = clearRefreshBreaker
+  } = deps;
+  if (isRobotAuthEnforced()) {
+    return resolveRobotEnforcedStatus(robotFallback);
+  }
+  if (isEnvAuthEnabled()) {
+    return readAuthFromEnv();
+  }
+  const activeProfile = getActiveAuthProfile();
+  const activeProfileFilePath = getActiveAuthProfileFilePath();
+  const usingActiveProfile = activeProfile !== undefined && (options.envFilePath === undefined || options.envFilePath === activeProfileFilePath);
+  const envFilePath = options.envFilePath ?? activeProfileFilePath ?? DEFAULT_ENV_FILENAME;
+  const { ensureTokenValidityMinutes } = options;
+  const { absolutePath } = await resolveEnvFilePath(envFilePath);
+  if (absolutePath === undefined) {
+    if (usingActiveProfile) {
+      return {
+        loginStatus: "Not logged in",
+        hint: `No credentials found for profile "${activeProfile}". Run 'uip login --profile ${activeProfile}' to authenticate this profile.`
+      };
+    }
+    return resolveBorrowedRobotStatus(robotFallback);
+  }
+  const loaded = await loadFileCredentials(loadEnvFile, absolutePath);
+  if ("status" in loaded) {
+    return loaded.status;
+  }
+  const { credentials } = loaded;
+  const globalHint = () => usingActiveProfile ? Promise.resolve(undefined) : getGlobalCredsHint(getFs, loadEnvFile, absolutePath, envFilePath);
+  const expiration = getTokenExpiration(credentials.UIPATH_ACCESS_TOKEN);
+  const outerThreshold = computeExpirationThreshold(ensureTokenValidityMinutes);
+  let tokens = {
+    accessToken: credentials.UIPATH_ACCESS_TOKEN,
+    refreshToken: credentials.UIPATH_REFRESH_TOKEN,
+    expiration,
+    lockReleaseFailed: false
+  };
+  const refreshToken = credentials.UIPATH_REFRESH_TOKEN;
+  if (expiration && expiration <= outerThreshold && refreshToken) {
+    const refreshed = await attemptRefresh({
+      absolutePath,
+      credentials,
+      accessToken: credentials.UIPATH_ACCESS_TOKEN,
+      refreshToken,
+      expiration,
+      ensureTokenValidityMinutes,
+      getFs,
+      loadEnvFile,
+      saveEnvFile,
+      refreshFn: refreshTokenFn,
+      resolveConfig,
+      loadBreaker,
+      saveBreaker,
+      clearBreaker,
+      globalHint
+    });
+    if (refreshed.kind === "terminal") {
+      return refreshed.status;
+    }
+    tokens = refreshed.tokens;
+  }
+  return buildFileStatus(tokens, credentials, globalHint);
+};
+async function resolveRobotEnforcedStatus(robotFallback) {
+  if (isEnvAuthEnabled()) {
+    throw new EnvAuthConfigError(`${ENV_AUTH_ENABLE_VAR}=true and ${ENFORCE_ROBOT_AUTH_VAR}=true ` + `are mutually exclusive. Unset one of them and re-run.`);
+  }
+  const robotCreds = await robotFallback({ force: true });
+  if (!robotCreds) {
+    return {
+      loginStatus: "Not logged in",
+      hint: `${ENFORCE_ROBOT_AUTH_VAR}=true but the UiPath Robot ` + `session is unavailable. Start and sign in to the Assistant, ` + `or unset ${ENFORCE_ROBOT_AUTH_VAR} to fall back to file or ` + `env-var authentication.`
+    };
+  }
+  return buildRobotStatus(robotCreds);
 }
-function normalizeTokenRefreshUnavailableFailure() {
-  return "token refresh failed before authentication completed";
+async function resolveBorrowedRobotStatus(robotFallback) {
+  const robotCreds = await robotFallback();
+  return robotCreds ? buildRobotStatus(robotCreds) : { loginStatus: "Not logged in" };
 }
-function errorMessage(error) {
-  return error instanceof Error ? error.message : String(error);
+async function loadFileCredentials(loadEnvFile, absolutePath) {
+  let credentials;
+  try {
+    credentials = await loadEnvFile({ envPath: absolutePath });
+  } catch (error) {
+    if (isFileNotFoundError(error)) {
+      return { status: { loginStatus: "Not logged in" } };
+    }
+    throw error;
+  }
+  if (!credentials.UIPATH_ACCESS_TOKEN) {
+    return { status: { loginStatus: "Not logged in" } };
+  }
+  return { credentials };
+}
+async function getGlobalCredsHint(getFs, loadEnvFile, absolutePath, envFilePath) {
+  const fs7 = getFs();
+  const globalPath = fs7.path.join(fs7.env.homedir(), envFilePath);
+  if (absolutePath === globalPath)
+    return;
+  if (!await fs7.exists(globalPath))
+    return;
+  try {
+    const globalCreds = await loadEnvFile({ envPath: globalPath });
+    if (!globalCreds.UIPATH_ACCESS_TOKEN)
+      return;
+    const globalExp = getTokenExpiration(globalCreds.UIPATH_ACCESS_TOKEN);
+    if (globalExp && globalExp <= new Date)
+      return;
+    return `Local credentials file at ${absolutePath} has expired credentials. Valid credentials exist in ${globalPath}. Remove the local file or run 'uip login' to re-authenticate.`;
+  } catch {
+    return;
+  }
 }
 function computeExpirationThreshold(ensureTokenValidityMinutes) {
   return new Date(Date.now() + (ensureTokenValidityMinutes ?? 0) * 60 * 1000);
 }
+async function attemptRefresh(ctx) {
+  const shortCircuit = await circuitBreakerShortCircuit(ctx);
+  if (shortCircuit) {
+    return { kind: "terminal", status: shortCircuit };
+  }
+  let release;
+  try {
+    release = await ctx.getFs().acquireLock(ctx.absolutePath);
+  } catch (error) {
+    return {
+      kind: "terminal",
+      status: await lockAcquireFailureStatus(ctx, error)
+    };
+  }
+  let lockedFailure;
+  let lockReleaseFailed = false;
+  let success;
+  try {
+    const outcome = await runRefreshLocked({
+      absolutePath: ctx.absolutePath,
+      refreshToken: ctx.refreshToken,
+      customAuthority: ctx.credentials.UIPATH_URL,
+      ensureTokenValidityMinutes: ctx.ensureTokenValidityMinutes,
+      loadEnvFile: ctx.loadEnvFile,
+      saveEnvFile: ctx.saveEnvFile,
+      refreshFn: ctx.refreshFn,
+      resolveConfig: ctx.resolveConfig,
+      loadBreaker: ctx.loadBreaker,
+      saveBreaker: ctx.saveBreaker,
+      clearBreaker: ctx.clearBreaker
+    });
+    if (outcome.kind === "fail") {
+      lockedFailure = outcome.status;
+    } else {
+      success = outcome;
+    }
+  } finally {
+    try {
+      await release();
+    } catch {
+      lockReleaseFailed = true;
+    }
+  }
+  if (lockedFailure) {
+    const globalHint = await ctx.globalHint();
+    const base = globalHint ? { ...lockedFailure, loginStatus: "Expired", hint: globalHint } : lockedFailure;
+    return {
+      kind: "terminal",
+      status: lockReleaseFailed ? { ...base, lockReleaseFailed: true } : base
+    };
+  }
+  return {
+    kind: "refreshed",
+    tokens: {
+      accessToken: success?.accessToken,
+      refreshToken: success?.refreshToken,
+      expiration: success?.expiration,
+      tokenRefresh: success?.tokenRefresh,
+      persistenceWarning: success?.persistenceWarning,
+      lockReleaseFailed
+    }
+  };
+}
+async function buildFileStatus(tokens, credentials, globalHint) {
+  const result = {
+    loginStatus: tokens.expiration && tokens.expiration <= new Date ? "Expired" : "Logged in",
+    accessToken: tokens.accessToken,
+    refreshToken: tokens.refreshToken,
+    baseUrl: credentials.UIPATH_URL,
+    organizationName: credentials.UIPATH_ORGANIZATION_NAME,
+    organizationId: credentials.UIPATH_ORGANIZATION_ID,
+    tenantName: credentials.UIPATH_TENANT_NAME,
+    tenantId: credentials.UIPATH_TENANT_ID,
+    expiration: tokens.expiration,
+    source: "file" /* File */,
+    ...tokens.persistenceWarning ? { hint: tokens.persistenceWarning, persistenceFailed: true } : {},
+    ...tokens.lockReleaseFailed ? { lockReleaseFailed: true } : {},
+    ...tokens.tokenRefresh ? { tokenRefresh: tokens.tokenRefresh } : {}
+  };
+  if (result.loginStatus === "Expired") {
+    const hint = await globalHint();
+    if (hint) {
+      result.hint = hint;
+    }
+  }
+  return result;
+}
+function buildRobotStatus(robotCreds) {
+  return {
+    loginStatus: "Logged in",
+    accessToken: robotCreds.accessToken,
+    baseUrl: robotCreds.baseUrl,
+    organizationName: robotCreds.organizationName,
+    organizationId: robotCreds.organizationId,
+    tenantName: robotCreds.tenantName,
+    tenantId: robotCreds.tenantId,
+    issuer: robotCreds.issuer,
+    expiration: getTokenExpiration(robotCreds.accessToken),
+    source: "robot" /* Robot */
+  };
+}
+var isFileNotFoundError = (error) => {
+  if (!(error instanceof Object))
+    return false;
+  return error.code === "ENOENT";
+};
+async function circuitBreakerShortCircuit(ctx) {
+  const {
+    absolutePath,
+    refreshToken,
+    accessToken,
+    credentials,
+    expiration,
+    loadBreaker,
+    saveBreaker,
+    clearBreaker
+  } = ctx;
+  const fingerprint = await refreshTokenFingerprint(refreshToken);
+  const breaker = await loadBreaker(absolutePath).catch(() => ({}));
+  if (breaker.deadTokenFp && breaker.deadTokenFp !== fingerprint) {
+    await clearBreaker(absolutePath);
+    breaker.deadTokenFp = undefined;
+  }
+  const nowMs = Date.now();
+  const tokenIsDead = breaker.deadTokenFp === fingerprint;
+  const inBackoff = breaker.backoffUntilMs !== undefined && nowMs < breaker.backoffUntilMs;
+  if (!tokenIsDead && !inBackoff)
+    return;
+  const globalHint = await ctx.globalHint();
+  const suppressed = !shouldSurface(breaker, nowMs);
+  if (!suppressed) {
+    await saveBreaker(absolutePath, {
+      ...breaker,
+      lastSurfacedAtMs: nowMs
+    });
+  }
+  const deadHint = "Run 'uip login' to re-authenticate — the stored refresh token is invalid or expired. In a non-interactive context, authenticate with: uip login --client-id <id> --client-secret <secret> -t <tenant>.";
+  const backoffHint = "Token refresh is temporarily backed off after a recent network error and will retry automatically once the backoff window elapses.";
+  return {
+    loginStatus: globalHint ? "Expired" : "Refresh Failed",
+    ...globalHint ? {
+      accessToken,
+      refreshToken,
+      baseUrl: credentials.UIPATH_URL,
+      organizationName: credentials.UIPATH_ORGANIZATION_NAME,
+      organizationId: credentials.UIPATH_ORGANIZATION_ID,
+      tenantName: credentials.UIPATH_TENANT_NAME,
+      tenantId: credentials.UIPATH_TENANT_ID,
+      expiration,
+      source: "file" /* File */
+    } : {},
+    hint: globalHint ?? (tokenIsDead ? deadHint : backoffHint),
+    refreshCircuitOpen: true,
+    refreshTelemetrySuppressed: suppressed,
+    tokenRefresh: { attempted: false, success: false }
+  };
+}
+async function lockAcquireFailureStatus(ctx, error) {
+  const msg = errorMessage(error);
+  const globalHint = await ctx.globalHint();
+  if (globalHint) {
+    return {
+      loginStatus: "Expired",
+      accessToken: ctx.accessToken,
+      refreshToken: ctx.refreshToken,
+      baseUrl: ctx.credentials.UIPATH_URL,
+      organizationName: ctx.credentials.UIPATH_ORGANIZATION_NAME,
+      organizationId: ctx.credentials.UIPATH_ORGANIZATION_ID,
+      tenantName: ctx.credentials.UIPATH_TENANT_NAME,
+      tenantId: ctx.credentials.UIPATH_TENANT_ID,
+      expiration: ctx.expiration,
+      source: "file" /* File */,
+      hint: globalHint,
+      tokenRefresh: {
+        attempted: false,
+        success: false,
+        errorMessage: `lock acquisition failed: ${msg}`
+      }
+    };
+  }
+  return {
+    loginStatus: "Refresh Failed",
+    hint: "Could not acquire the auth-file lock — too many concurrent `uip` processes, or a permission issue on the auth directory. Retry, or run 'uip login' to re-authenticate.",
+    tokenRefresh: {
+      attempted: false,
+      success: false,
+      errorMessage: `lock acquisition failed: ${msg}`
+    }
+  };
+}
 async function runRefreshLocked(inputs) {
   const {
     absolutePath,
@@ -22729,7 +23155,10 @@ async function runRefreshLocked(inputs) {
     loadEnvFile,
     saveEnvFile,
     refreshFn,
-    resolveConfig
+    resolveConfig,
+    loadBreaker,
+    saveBreaker,
+    clearBreaker
   } = inputs;
   const expirationThreshold = computeExpirationThreshold(ensureTokenValidityMinutes);
   let fresh;
@@ -22752,6 +23181,7 @@ async function runRefreshLocked(inputs) {
   const freshAccess = fresh.UIPATH_ACCESS_TOKEN;
   const freshExp = freshAccess ? getTokenExpiration(freshAccess) : undefined;
   if (freshAccess && freshExp && freshExp > expirationThreshold) {
+    await clearBreaker(absolutePath);
     return {
       kind: "ok",
       accessToken: freshAccess,
@@ -22775,8 +23205,21 @@ async function runRefreshLocked(inputs) {
     refreshedRefresh = refreshed.refreshToken;
   } catch (error) {
     const isOAuthFailure = isTokenRefreshOAuthFailure(error);
-    const hint = isOAuthFailure ? "Run 'uip login' to re-authenticate — the stored refresh token is invalid or expired." : "Token refresh failed. Check your network connection, then retry or run 'uip login' to re-authenticate.";
+    const hint = isOAuthFailure ? "Run 'uip login' to re-authenticate — the stored refresh token is invalid or expired. In a non-interactive context, authenticate with: uip login --client-id <id> --client-secret <secret> -t <tenant>." : "Token refresh failed. Check your network connection, then retry or run 'uip login' to re-authenticate.";
     const message = isOAuthFailure ? normalizeTokenRefreshFailure() : normalizeTokenRefreshUnavailableFailure();
+    const fp = await refreshTokenFingerprint(tokenForIdP);
+    if (isOAuthFailure) {
+      await saveBreaker(absolutePath, { deadTokenFp: fp });
+    } else {
+      const prior = await loadBreaker(absolutePath).catch(() => ({}));
+      const attempts = (prior.attempts ?? 0) + 1;
+      await saveBreaker(absolutePath, {
+        ...prior,
+        deadTokenFp: undefined,
+        attempts,
+        backoffUntilMs: Date.now() + nextBackoffMs(attempts)
+      });
+    }
     return {
       kind: "fail",
       status: {
@@ -22805,6 +23248,7 @@ async function runRefreshLocked(inputs) {
       }
     };
   }
+  await clearBreaker(absolutePath);
   try {
     await saveEnvFile({
       envPath: absolutePath,
@@ -22837,231 +23281,42 @@ async function runRefreshLocked(inputs) {
     };
   }
 }
-var getLoginStatusWithDeps = async (options = {}, deps = {}) => {
-  const {
-    resolveEnvFilePath = resolveEnvFilePathAsync,
-    loadEnvFile = loadEnvFileAsync,
-    saveEnvFile = saveEnvFileAsync,
-    getFs = getFileSystem,
-    refreshToken: refreshTokenFn = refreshAccessToken,
-    resolveConfig = resolveConfigAsync,
-    robotFallback = tryRobotClientFallback
-  } = deps;
-  if (isRobotAuthEnforced()) {
-    if (isEnvAuthEnabled()) {
-      throw new EnvAuthConfigError(`${ENV_AUTH_ENABLE_VAR}=true and ${ENFORCE_ROBOT_AUTH_VAR}=true ` + `are mutually exclusive. Unset one of them and re-run.`);
-    }
-    const robotCreds = await robotFallback({ force: true });
-    if (!robotCreds) {
-      return {
-        loginStatus: "Not logged in",
-        hint: `${ENFORCE_ROBOT_AUTH_VAR}=true but the UiPath Robot ` + `session is unavailable. Start and sign in to the Assistant, ` + `or unset ${ENFORCE_ROBOT_AUTH_VAR} to fall back to file or ` + `env-var authentication.`
-      };
-    }
-    const expiration2 = getTokenExpiration(robotCreds.accessToken);
-    return {
-      loginStatus: "Logged in",
-      accessToken: robotCreds.accessToken,
-      baseUrl: robotCreds.baseUrl,
-      organizationName: robotCreds.organizationName,
-      organizationId: robotCreds.organizationId,
-      tenantName: robotCreds.tenantName,
-      tenantId: robotCreds.tenantId,
-      issuer: robotCreds.issuer,
-      expiration: expiration2,
-      source: "robot" /* Robot */
-    };
+function normalizeTokenRefreshFailure() {
+  return "stored refresh token is invalid or expired";
+}
+function normalizeTokenRefreshUnavailableFailure() {
+  return "token refresh failed before authentication completed";
+}
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+// ../../auth/src/interactive.ts
+init_src();
+
+// ../../auth/src/selectTenant.ts
+var TENANT_SELECTION_REQUIRED_CODE = "TENANT_SELECTION_REQUIRED";
+var INVALID_TENANT_CODE = "INVALID_TENANT";
+var TENANT_SELECTION_CODES = new Set([
+  TENANT_SELECTION_REQUIRED_CODE,
+  INVALID_TENANT_CODE
+]);
+// ../../auth/src/logout.ts
+init_src();
+
+// ../../auth/src/index.ts
+init_server();
+
+// ../audit-sdk/src/client-factory.ts
+async function createAuditConfig(options) {
+  const status = await getLoginStatusAsync({
+    ensureTokenValidityMinutes: options.loginValidity
+  });
+  if (status.loginStatus !== "Logged in" || !status.baseUrl || !status.accessToken) {
+    const message = status.hint ? `Not logged in. ${status.hint}` : "Not logged in. Run 'uip login' first.";
+    throw new Error(message);
   }
-  if (isEnvAuthEnabled()) {
-    return readAuthFromEnv();
-  }
-  const { envFilePath = DEFAULT_ENV_FILENAME, ensureTokenValidityMinutes } = options;
-  const { absolutePath } = await resolveEnvFilePath(envFilePath);
-  if (absolutePath === undefined) {
-    const robotCreds = await robotFallback();
-    if (robotCreds) {
-      const expiration2 = getTokenExpiration(robotCreds.accessToken);
-      const status = {
-        loginStatus: "Logged in",
-        accessToken: robotCreds.accessToken,
-        baseUrl: robotCreds.baseUrl,
-        organizationName: robotCreds.organizationName,
-        organizationId: robotCreds.organizationId,
-        tenantName: robotCreds.tenantName,
-        tenantId: robotCreds.tenantId,
-        issuer: robotCreds.issuer,
-        expiration: expiration2,
-        source: "robot" /* Robot */
-      };
-      return status;
-    }
-    return { loginStatus: "Not logged in" };
-  }
-  let credentials;
-  try {
-    credentials = await loadEnvFile({ envPath: absolutePath });
-  } catch (error) {
-    if (isFileNotFoundError(error)) {
-      return { loginStatus: "Not logged in" };
-    }
-    throw error;
-  }
-  if (!credentials.UIPATH_ACCESS_TOKEN) {
-    return { loginStatus: "Not logged in" };
-  }
-  let accessToken = credentials.UIPATH_ACCESS_TOKEN;
-  let refreshToken = credentials.UIPATH_REFRESH_TOKEN;
-  let expiration = getTokenExpiration(accessToken);
-  let persistenceWarning;
-  let lockReleaseFailed = false;
-  let tokenRefresh;
-  const outerThreshold = computeExpirationThreshold(ensureTokenValidityMinutes);
-  const tryGlobalCredsHint = async () => {
-    const fs7 = getFs();
-    const globalPath = fs7.path.join(fs7.env.homedir(), envFilePath);
-    if (absolutePath === globalPath)
-      return;
-    if (!await fs7.exists(globalPath))
-      return;
-    try {
-      const globalCreds = await loadEnvFile({ envPath: globalPath });
-      if (!globalCreds.UIPATH_ACCESS_TOKEN)
-        return;
-      const globalExp = getTokenExpiration(globalCreds.UIPATH_ACCESS_TOKEN);
-      if (globalExp && globalExp <= new Date)
-        return;
-      return `Local credentials file at ${absolutePath} has expired credentials. Valid credentials exist in ${globalPath}. Remove the local file or run 'uip login' to re-authenticate.`;
-    } catch {
-      return;
-    }
-  };
-  if (expiration && expiration <= outerThreshold && refreshToken) {
-    let release;
-    try {
-      release = await getFs().acquireLock(absolutePath);
-    } catch (error) {
-      const msg = errorMessage(error);
-      const globalHint = await tryGlobalCredsHint();
-      if (globalHint) {
-        return {
-          loginStatus: "Expired",
-          accessToken,
-          refreshToken,
-          baseUrl: credentials.UIPATH_URL,
-          organizationName: credentials.UIPATH_ORGANIZATION_NAME,
-          organizationId: credentials.UIPATH_ORGANIZATION_ID,
-          tenantName: credentials.UIPATH_TENANT_NAME,
-          tenantId: credentials.UIPATH_TENANT_ID,
-          expiration,
-          source: "file" /* File */,
-          hint: globalHint,
-          tokenRefresh: {
-            attempted: false,
-            success: false,
-            errorMessage: `lock acquisition failed: ${msg}`
-          }
-        };
-      }
-      return {
-        loginStatus: "Refresh Failed",
-        hint: "Could not acquire the auth-file lock — too many concurrent `uip` processes, or a permission issue on the auth directory. Retry, or run 'uip login' to re-authenticate.",
-        tokenRefresh: {
-          attempted: false,
-          success: false,
-          errorMessage: `lock acquisition failed: ${msg}`
-        }
-      };
-    }
-    let lockedFailure;
-    try {
-      const outcome = await runRefreshLocked({
-        absolutePath,
-        refreshToken,
-        customAuthority: credentials.UIPATH_URL,
-        ensureTokenValidityMinutes,
-        loadEnvFile,
-        saveEnvFile,
-        refreshFn: refreshTokenFn,
-        resolveConfig
-      });
-      if (outcome.kind === "fail") {
-        lockedFailure = outcome.status;
-      } else {
-        accessToken = outcome.accessToken;
-        refreshToken = outcome.refreshToken;
-        expiration = outcome.expiration;
-        tokenRefresh = outcome.tokenRefresh;
-        if (outcome.persistenceWarning) {
-          persistenceWarning = outcome.persistenceWarning;
-        }
-      }
-    } finally {
-      try {
-        await release();
-      } catch {
-        lockReleaseFailed = true;
-      }
-    }
-    if (lockedFailure) {
-      const globalHint = await tryGlobalCredsHint();
-      const base = globalHint ? {
-        ...lockedFailure,
-        loginStatus: "Expired",
-        hint: globalHint
-      } : lockedFailure;
-      return lockReleaseFailed ? { ...base, lockReleaseFailed: true } : base;
-    }
-  }
-  const result = {
-    loginStatus: expiration && expiration <= new Date ? "Expired" : "Logged in",
-    accessToken,
-    refreshToken,
-    baseUrl: credentials.UIPATH_URL,
-    organizationName: credentials.UIPATH_ORGANIZATION_NAME,
-    organizationId: credentials.UIPATH_ORGANIZATION_ID,
-    tenantName: credentials.UIPATH_TENANT_NAME,
-    tenantId: credentials.UIPATH_TENANT_ID,
-    expiration,
-    source: "file" /* File */,
-    ...persistenceWarning ? { hint: persistenceWarning, persistenceFailed: true } : {},
-    ...lockReleaseFailed ? { lockReleaseFailed: true } : {},
-    ...tokenRefresh ? { tokenRefresh } : {}
-  };
-  if (result.loginStatus === "Expired") {
-    const globalHint = await tryGlobalCredsHint();
-    if (globalHint) {
-      result.hint = globalHint;
-    }
-  }
-  return result;
-};
-var isFileNotFoundError = (error) => {
-  if (!(error instanceof Object))
-    return false;
-  return error.code === "ENOENT";
-};
-var getLoginStatusAsync = async (options = {}) => {
-  return getLoginStatusWithDeps(options);
-};
-// ../../auth/src/interactive.ts
-init_src();
-// ../../auth/src/logout.ts
-init_src();
-
-// ../../auth/src/index.ts
-init_server();
-
-// ../audit-sdk/src/client-factory.ts
-async function createAuditConfig(options) {
-  const status = await getLoginStatusAsync({
-    ensureTokenValidityMinutes: options.loginValidity
-  });
-  if (status.loginStatus !== "Logged in" || !status.baseUrl || !status.accessToken) {
-    const message = status.hint ? `Not logged in. ${status.hint}` : "Not logged in. Run 'uip login' first.";
-    throw new Error(message);
-  }
-  if (!status.organizationId) {
-    throw new Error("Organization ID not available. Ensure you are logged in with an organization context.");
+  if (!status.organizationId) {
+    throw new Error("Organization ID not available. Ensure you are logged in with an organization context.");
   }
   let suffix;
   if (options.scope === "tenant") {
@@ -23132,27 +23387,54 @@ var NETWORK_ERROR_CODES = new Set([
   "ENETUNREACH",
   "EAI_FAIL"
 ]);
-function isHtmlDocument(body) {
-  return /^\s*(<!doctype html|<html\b)/i.test(body);
-}
-function extractNetworkErrorCode(error) {
-  if (error === null || typeof error !== "object") {
-    return;
-  }
-  const err = error;
-  const code = typeof err.code === "string" ? err.code : undefined;
-  if (code && NETWORK_ERROR_CODES.has(code)) {
-    return code;
-  }
-  const cause = err.cause;
-  if (cause !== null && typeof cause === "object") {
-    const causeCode = cause.code;
-    if (typeof causeCode === "string" && NETWORK_ERROR_CODES.has(causeCode)) {
-      return causeCode;
+var TLS_ERROR_CODES = new Set([
+  "SELF_SIGNED_CERT_IN_CHAIN",
+  "DEPTH_ZERO_SELF_SIGNED_CERT",
+  "UNABLE_TO_VERIFY_LEAF_SIGNATURE",
+  "UNABLE_TO_GET_ISSUER_CERT_LOCALLY",
+  "UNABLE_TO_GET_ISSUER_CERT",
+  "CERT_HAS_EXPIRED",
+  "CERT_UNTRUSTED",
+  "ERR_TLS_CERT_ALTNAME_INVALID"
+]);
+var TLS_INSTRUCTIONS = "The server's TLS certificate could not be verified. Most often a " + "corporate proxy/firewall re-signs HTTPS with a root CA that Node does " + "not trust — set NODE_EXTRA_CA_CERTS to that CA's PEM file (and HTTPS_PROXY " + "if you connect through a proxy). If the certificate is instead expired or " + "its hostname does not match, fix the endpoint URL or the system clock. " + "Then retry.";
+var NETWORK_INSTRUCTIONS = "Could not reach the UiPath service. Check your network connection and " + "VPN, confirm any HTTP_PROXY/HTTPS_PROXY/NO_PROXY settings are correct, " + "then retry.";
+function describeConnectivityError(error) {
+  let current = error;
+  for (let depth = 0;depth < 5 && current !== null && typeof current === "object"; depth++) {
+    const cur = current;
+    const code = typeof cur.code === "string" ? cur.code : undefined;
+    const message = typeof cur.message === "string" ? cur.message : undefined;
+    if (code && TLS_ERROR_CODES.has(code)) {
+      return {
+        code,
+        kind: "tls",
+        message: message ?? code,
+        instructions: TLS_INSTRUCTIONS
+      };
+    }
+    if (code && NETWORK_ERROR_CODES.has(code)) {
+      return {
+        code,
+        kind: "network",
+        message: message ?? code,
+        instructions: NETWORK_INSTRUCTIONS
+      };
     }
+    current = cur.cause;
   }
   return;
 }
+function parseHttpStatusFromMessage(message) {
+  const match = /^HTTP\s+(\d{3})(?::|\s|-|$)/i.exec(message.trim());
+  if (!match)
+    return;
+  const status = Number(match[1]);
+  return Number.isInteger(status) && status >= 100 && status <= 599 ? status : undefined;
+}
+function isHtmlDocument(body) {
+  return /^\s*(<!doctype html|<html\b)/i.test(body);
+}
 function retryHintForRetryAfter(seconds) {
   if (seconds <= 1) {
     return "RetryAfter1Second";
@@ -23193,15 +23475,28 @@ function classifyError(status, error) {
   if (status !== undefined && status >= 500 && status < 600) {
     return { errorCode: "server_error", retry: "RetryLater" };
   }
-  if (extractNetworkErrorCode(error)) {
-    return { errorCode: "network_error", retry: "RetryLater" };
+  const connectivity = describeConnectivityError(error);
+  if (connectivity) {
+    return {
+      errorCode: "network_error",
+      retry: connectivity.kind === "tls" ? "RetryWillNotFix" : "RetryLater"
+    };
   }
   return { errorCode: "unknown_error", retry: "RetryWillNotFix" };
 }
+function formatHttpStatusMessage(status, rawMessage, extractedMessage, inferredStatus) {
+  if (extractedMessage) {
+    return `HTTP ${status}: ${extractedMessage}`;
+  }
+  return inferredStatus !== undefined ? rawMessage : `HTTP ${status}: ${rawMessage}`;
+}
 async function extractErrorDetails(error, options) {
   const err = error !== null && error !== undefined && typeof error === "object" ? error : {};
   const response = err.response;
-  const status = err.status ?? response?.status;
+  const rawMessage = typeof err.message === "string" ? err.message : "Unknown error";
+  const explicitStatus = err.status ?? response?.status;
+  const inferredStatus = explicitStatus === undefined ? parseHttpStatusFromMessage(rawMessage) : undefined;
+  const status = explicitStatus ?? inferredStatus;
   const isSuccessfulResponse = status !== undefined && status >= 200 && status < 300;
   let rawBody;
   let extractedMessage;
@@ -23236,7 +23531,6 @@ async function extractErrorDetails(error, options) {
       }
     }
   }
-  const rawMessage = typeof err.message === "string" ? err.message : "Unknown error";
   let message;
   let result = "Failure";
   const classification = classifyError(status, error);
@@ -23250,10 +23544,10 @@ async function extractErrorDetails(error, options) {
   } else if (status === 405) {
     message = DEFAULT_405;
   } else if (status === 400 || status === 422) {
-    message = extractedMessage ? `HTTP ${status}: ${extractedMessage}` : `HTTP ${status}: ${rawMessage}`;
+    message = formatHttpStatusMessage(status, rawMessage, extractedMessage, inferredStatus);
     result = "ValidationError";
   } else if (status === 429) {
-    message = extractedMessage ? `HTTP ${status}: ${extractedMessage}` : `HTTP ${status}: ${rawMessage}`;
+    message = formatHttpStatusMessage(status, rawMessage, extractedMessage, inferredStatus);
   } else if (extractedMessage) {
     if (isSuccessfulResponse && rawMessage !== "Unknown error") {
       message = rawMessage;
@@ -23261,7 +23555,9 @@ async function extractErrorDetails(error, options) {
       message = status ? `HTTP ${status}: ${extractedMessage}` : extractedMessage;
     }
   } else if (status) {
-    if (rawMessage === "Unknown error" && response) {
+    if (inferredStatus !== undefined) {
+      message = rawMessage;
+    } else if (rawMessage === "Unknown error" && response) {
       const statusText = response.statusText;
       message = statusText ? `HTTP ${status} ${statusText}` : `HTTP ${status} - request failed`;
     } else {
@@ -23270,6 +23566,12 @@ async function extractErrorDetails(error, options) {
   } else {
     message = rawMessage;
   }
+  if (status === undefined) {
+    const connectivity = describeConnectivityError(error);
+    if (connectivity && connectivity.message !== message && !message.includes(connectivity.message)) {
+      message = `${message}: ${connectivity.message}`;
+    }
+  }
   let details = rawMessage;
   if (rawBody) {
     if (parsedBody) {
@@ -23392,6 +23694,7 @@ var CONSOLE_FALLBACK = {
   writeLog: (str) => process.stdout.write(str),
   capabilities: {
     isInteractive: false,
+    canReadInput: false,
     supportsColor: false,
     outputWidth: 80
   }
@@ -28397,12 +28700,6 @@ class NodeContextStorage {
     return this.storage.getStore();
   }
 }
-// ../../common/src/telemetry/global-telemetry-properties.ts
-var telemetryPropsSlot = singleton("TelemetryDefaultProps");
-function getGlobalTelemetryProperties() {
-  return telemetryPropsSlot.get();
-}
-
 // ../../common/src/telemetry/telemetry-service.ts
 class TelemetryService {
   telemetryProvider;
@@ -28592,6 +28889,29 @@ function isPlainRecord(value) {
   const prototype = Object.getPrototypeOf(value);
   return prototype === Object.prototype || prototype === null;
 }
+function extractPagedRows(value) {
+  if (Array.isArray(value) || !isPlainRecord(value))
+    return null;
+  const entries = Object.values(value);
+  if (entries.length === 0)
+    return null;
+  let rows = null;
+  let hasScalarSibling = false;
+  for (const entry of entries) {
+    if (Array.isArray(entry)) {
+      if (rows !== null)
+        return null;
+      rows = entry;
+    } else if (entry !== null && typeof entry === "object") {
+      return null;
+    } else {
+      hasScalarSibling = true;
+    }
+  }
+  if (rows === null || !hasScalarSibling)
+    return null;
+  return rows;
+}
 function toLowerCamelCaseKey(key) {
   if (!key)
     return key;
@@ -28656,7 +28976,8 @@ function printOutput(data, format = "json", logFn, asciiSafe = false) {
       break;
     case "plain": {
       if ("Data" in data && data.Data != null) {
-        const items = Array.isArray(data.Data) ? data.Data : [data.Data];
+        const pagedRows = extractPagedRows(data.Data);
+        const items = pagedRows ?? (Array.isArray(data.Data) ? data.Data : [data.Data]);
         items.forEach((item) => {
           const values = Object.values(item).map((v) => v ?? "").join("\t");
           logFn(values);
@@ -28668,10 +28989,13 @@ function printOutput(data, format = "json", logFn, asciiSafe = false) {
       break;
     }
     default: {
-      if ("Data" in data && data.Data != null && !(Array.isArray(data.Data) && data.Data.length === 0)) {
+      const hasData = "Data" in data && data.Data != null;
+      const pagedRows = hasData ? extractPagedRows(data.Data) : null;
+      const rows = pagedRows ? pagedRows : Array.isArray(data.Data) ? data.Data : null;
+      if (hasData && !(rows !== null && rows.length === 0)) {
         const logValue = data.Log;
-        if (Array.isArray(data.Data)) {
-          printResizableTable(data.Data, logFn, logValue);
+        if (rows !== null) {
+          printResizableTable(rows, logFn, logValue);
         } else {
           printVerticalTable(data.Data, logFn, logValue);
         }
@@ -28859,6 +29183,44 @@ function defaultErrorCodeForResult(result) {
       return "unknown_error";
   }
 }
+function parseHttpStatusFromMessage2(message) {
+  const match = /^HTTP\s+(\d{3})(?::|\s|-|$)/i.exec(message.trim());
+  if (!match)
+    return;
+  const status = Number(match[1]);
+  return Number.isInteger(status) && status >= 100 && status <= 599 ? status : undefined;
+}
+function defaultErrorCodeForHttpStatus(status) {
+  if (status === undefined)
+    return;
+  if (status === 400 || status === 409 || status === 422) {
+    return "invalid_argument";
+  }
+  if (status === 401)
+    return "authentication_required";
+  if (status === 403)
+    return "permission_denied";
+  if (status === 404)
+    return "not_found";
+  if (status === 405)
+    return "method_not_allowed";
+  if (status === 408)
+    return "timeout";
+  if (status === 429)
+    return "rate_limited";
+  if (status >= 500 && status < 600)
+    return "server_error";
+  return;
+}
+function defaultErrorCodeForFailure(data) {
+  if (data.Result === RESULTS.Failure) {
+    const status = data.Context?.httpStatus ?? parseHttpStatusFromMessage2(data.Message);
+    const errorCode2 = defaultErrorCodeForHttpStatus(status);
+    if (errorCode2)
+      return errorCode2;
+  }
+  return defaultErrorCodeForResult(data.Result);
+}
 function defaultRetryForErrorCode(errorCode2) {
   switch (errorCode2) {
     case "network_error":
@@ -28888,16 +29250,19 @@ var OutputFormatter;
   OutputFormatter.success = success;
   function error(data) {
     data.Log ??= getLogFilePath() || undefined;
-    data.ErrorCode ??= defaultErrorCodeForResult(data.Result);
+    data.ErrorCode ??= defaultErrorCodeForFailure(data);
     data.Retry ??= defaultRetryForErrorCode(data.ErrorCode);
     process.exitCode = EXIT_CODES[data.Result] ?? 1;
-    telemetry.trackEvent(CommonTelemetryEvents.Error, {
-      result: data.Result,
-      errorCode: data.ErrorCode,
-      retry: data.Retry,
-      message: data.Message
-    });
-    logOutput(normalizeOutputKeys(data), getOutputFormat());
+    const { SuppressTelemetry, ...envelope } = data;
+    if (!SuppressTelemetry) {
+      telemetry.trackEvent(CommonTelemetryEvents.Error, {
+        result: data.Result,
+        errorCode: data.ErrorCode,
+        retry: data.Retry,
+        message: data.Message
+      });
+    }
+    logOutput(normalizeOutputKeys(envelope), getOutputFormat());
   }
   OutputFormatter.error = error;
   function emitList(code, items, opts) {
@@ -29190,1409 +29555,6 @@ var savedOriginalsSlot = singleton("ConsoleGuardOriginals");
 var DEFAULT_AUTH_TIMEOUT_MS2 = 5 * 60 * 1000;
 // ../../common/src/interactivity-context.ts
 var modeSlot = singleton("InteractivityMode");
-// ../../../node_modules/jsonpath-plus/dist/index-node-esm.js
-import vm from "vm";
-
-class Hooks {
-  add(name, callback, first) {
-    if (typeof arguments[0] != "string") {
-      for (let name2 in arguments[0]) {
-        this.add(name2, arguments[0][name2], arguments[1]);
-      }
-    } else {
-      (Array.isArray(name) ? name : [name]).forEach(function(name2) {
-        this[name2] = this[name2] || [];
-        if (callback) {
-          this[name2][first ? "unshift" : "push"](callback);
-        }
-      }, this);
-    }
-  }
-  run(name, env) {
-    this[name] = this[name] || [];
-    this[name].forEach(function(callback) {
-      callback.call(env && env.context ? env.context : env, env);
-    });
-  }
-}
-
-class Plugins {
-  constructor(jsep) {
-    this.jsep = jsep;
-    this.registered = {};
-  }
-  register(...plugins) {
-    plugins.forEach((plugin) => {
-      if (typeof plugin !== "object" || !plugin.name || !plugin.init) {
-        throw new Error("Invalid JSEP plugin format");
-      }
-      if (this.registered[plugin.name]) {
-        return;
-      }
-      plugin.init(this.jsep);
-      this.registered[plugin.name] = plugin;
-    });
-  }
-}
-
-class Jsep {
-  static get version() {
-    return "1.4.0";
-  }
-  static toString() {
-    return "JavaScript Expression Parser (JSEP) v" + Jsep.version;
-  }
-  static addUnaryOp(op_name) {
-    Jsep.max_unop_len = Math.max(op_name.length, Jsep.max_unop_len);
-    Jsep.unary_ops[op_name] = 1;
-    return Jsep;
-  }
-  static addBinaryOp(op_name, precedence, isRightAssociative) {
-    Jsep.max_binop_len = Math.max(op_name.length, Jsep.max_binop_len);
-    Jsep.binary_ops[op_name] = precedence;
-    if (isRightAssociative) {
-      Jsep.right_associative.add(op_name);
-    } else {
-      Jsep.right_associative.delete(op_name);
-    }
-    return Jsep;
-  }
-  static addIdentifierChar(char) {
-    Jsep.additional_identifier_chars.add(char);
-    return Jsep;
-  }
-  static addLiteral(literal_name, literal_value) {
-    Jsep.literals[literal_name] = literal_value;
-    return Jsep;
-  }
-  static removeUnaryOp(op_name) {
-    delete Jsep.unary_ops[op_name];
-    if (op_name.length === Jsep.max_unop_len) {
-      Jsep.max_unop_len = Jsep.getMaxKeyLen(Jsep.unary_ops);
-    }
-    return Jsep;
-  }
-  static removeAllUnaryOps() {
-    Jsep.unary_ops = {};
-    Jsep.max_unop_len = 0;
-    return Jsep;
-  }
-  static removeIdentifierChar(char) {
-    Jsep.additional_identifier_chars.delete(char);
-    return Jsep;
-  }
-  static removeBinaryOp(op_name) {
-    delete Jsep.binary_ops[op_name];
-    if (op_name.length === Jsep.max_binop_len) {
-      Jsep.max_binop_len = Jsep.getMaxKeyLen(Jsep.binary_ops);
-    }
-    Jsep.right_associative.delete(op_name);
-    return Jsep;
-  }
-  static removeAllBinaryOps() {
-    Jsep.binary_ops = {};
-    Jsep.max_binop_len = 0;
-    return Jsep;
-  }
-  static removeLiteral(literal_name) {
-    delete Jsep.literals[literal_name];
-    return Jsep;
-  }
-  static removeAllLiterals() {
-    Jsep.literals = {};
-    return Jsep;
-  }
-  get char() {
-    return this.expr.charAt(this.index);
-  }
-  get code() {
-    return this.expr.charCodeAt(this.index);
-  }
-  constructor(expr) {
-    this.expr = expr;
-    this.index = 0;
-  }
-  static parse(expr) {
-    return new Jsep(expr).parse();
-  }
-  static getMaxKeyLen(obj) {
-    return Math.max(0, ...Object.keys(obj).map((k) => k.length));
-  }
-  static isDecimalDigit(ch) {
-    return ch >= 48 && ch <= 57;
-  }
-  static binaryPrecedence(op_val) {
-    return Jsep.binary_ops[op_val] || 0;
-  }
-  static isIdentifierStart(ch) {
-    return ch >= 65 && ch <= 90 || ch >= 97 && ch <= 122 || ch >= 128 && !Jsep.binary_ops[String.fromCharCode(ch)] || Jsep.additional_identifier_chars.has(String.fromCharCode(ch));
-  }
-  static isIdentifierPart(ch) {
-    return Jsep.isIdentifierStart(ch) || Jsep.isDecimalDigit(ch);
-  }
-  throwError(message) {
-    const error = new Error(message + " at character " + this.index);
-    error.index = this.index;
-    error.description = message;
-    throw error;
-  }
-  runHook(name, node) {
-    if (Jsep.hooks[name]) {
-      const env = {
-        context: this,
-        node
-      };
-      Jsep.hooks.run(name, env);
-      return env.node;
-    }
-    return node;
-  }
-  searchHook(name) {
-    if (Jsep.hooks[name]) {
-      const env = {
-        context: this
-      };
-      Jsep.hooks[name].find(function(callback) {
-        callback.call(env.context, env);
-        return env.node;
-      });
-      return env.node;
-    }
-  }
-  gobbleSpaces() {
-    let ch = this.code;
-    while (ch === Jsep.SPACE_CODE || ch === Jsep.TAB_CODE || ch === Jsep.LF_CODE || ch === Jsep.CR_CODE) {
-      ch = this.expr.charCodeAt(++this.index);
-    }
-    this.runHook("gobble-spaces");
-  }
-  parse() {
-    this.runHook("before-all");
-    const nodes = this.gobbleExpressions();
-    const node = nodes.length === 1 ? nodes[0] : {
-      type: Jsep.COMPOUND,
-      body: nodes
-    };
-    return this.runHook("after-all", node);
-  }
-  gobbleExpressions(untilICode) {
-    let nodes = [], ch_i, node;
-    while (this.index < this.expr.length) {
-      ch_i = this.code;
-      if (ch_i === Jsep.SEMCOL_CODE || ch_i === Jsep.COMMA_CODE) {
-        this.index++;
-      } else {
-        if (node = this.gobbleExpression()) {
-          nodes.push(node);
-        } else if (this.index < this.expr.length) {
-          if (ch_i === untilICode) {
-            break;
-          }
-          this.throwError('Unexpected "' + this.char + '"');
-        }
-      }
-    }
-    return nodes;
-  }
-  gobbleExpression() {
-    const node = this.searchHook("gobble-expression") || this.gobbleBinaryExpression();
-    this.gobbleSpaces();
-    return this.runHook("after-expression", node);
-  }
-  gobbleBinaryOp() {
-    this.gobbleSpaces();
-    let to_check = this.expr.substr(this.index, Jsep.max_binop_len);
-    let tc_len = to_check.length;
-    while (tc_len > 0) {
-      if (Jsep.binary_ops.hasOwnProperty(to_check) && (!Jsep.isIdentifierStart(this.code) || this.index + to_check.length < this.expr.length && !Jsep.isIdentifierPart(this.expr.charCodeAt(this.index + to_check.length)))) {
-        this.index += tc_len;
-        return to_check;
-      }
-      to_check = to_check.substr(0, --tc_len);
-    }
-    return false;
-  }
-  gobbleBinaryExpression() {
-    let node, biop, prec, stack, biop_info, left, right, i, cur_biop;
-    left = this.gobbleToken();
-    if (!left) {
-      return left;
-    }
-    biop = this.gobbleBinaryOp();
-    if (!biop) {
-      return left;
-    }
-    biop_info = {
-      value: biop,
-      prec: Jsep.binaryPrecedence(biop),
-      right_a: Jsep.right_associative.has(biop)
-    };
-    right = this.gobbleToken();
-    if (!right) {
-      this.throwError("Expected expression after " + biop);
-    }
-    stack = [left, biop_info, right];
-    while (biop = this.gobbleBinaryOp()) {
-      prec = Jsep.binaryPrecedence(biop);
-      if (prec === 0) {
-        this.index -= biop.length;
-        break;
-      }
-      biop_info = {
-        value: biop,
-        prec,
-        right_a: Jsep.right_associative.has(biop)
-      };
-      cur_biop = biop;
-      const comparePrev = (prev) => biop_info.right_a && prev.right_a ? prec > prev.prec : prec <= prev.prec;
-      while (stack.length > 2 && comparePrev(stack[stack.length - 2])) {
-        right = stack.pop();
-        biop = stack.pop().value;
-        left = stack.pop();
-        node = {
-          type: Jsep.BINARY_EXP,
-          operator: biop,
-          left,
-          right
-        };
-        stack.push(node);
-      }
-      node = this.gobbleToken();
-      if (!node) {
-        this.throwError("Expected expression after " + cur_biop);
-      }
-      stack.push(biop_info, node);
-    }
-    i = stack.length - 1;
-    node = stack[i];
-    while (i > 1) {
-      node = {
-        type: Jsep.BINARY_EXP,
-        operator: stack[i - 1].value,
-        left: stack[i - 2],
-        right: node
-      };
-      i -= 2;
-    }
-    return node;
-  }
-  gobbleToken() {
-    let ch, to_check, tc_len, node;
-    this.gobbleSpaces();
-    node = this.searchHook("gobble-token");
-    if (node) {
-      return this.runHook("after-token", node);
-    }
-    ch = this.code;
-    if (Jsep.isDecimalDigit(ch) || ch === Jsep.PERIOD_CODE) {
-      return this.gobbleNumericLiteral();
-    }
-    if (ch === Jsep.SQUOTE_CODE || ch === Jsep.DQUOTE_CODE) {
-      node = this.gobbleStringLiteral();
-    } else if (ch === Jsep.OBRACK_CODE) {
-      node = this.gobbleArray();
-    } else {
-      to_check = this.expr.substr(this.index, Jsep.max_unop_len);
-      tc_len = to_check.length;
-      while (tc_len > 0) {
-        if (Jsep.unary_ops.hasOwnProperty(to_check) && (!Jsep.isIdentifierStart(this.code) || this.index + to_check.length < this.expr.length && !Jsep.isIdentifierPart(this.expr.charCodeAt(this.index + to_check.length)))) {
-          this.index += tc_len;
-          const argument = this.gobbleToken();
-          if (!argument) {
-            this.throwError("missing unaryOp argument");
-          }
-          return this.runHook("after-token", {
-            type: Jsep.UNARY_EXP,
-            operator: to_check,
-            argument,
-            prefix: true
-          });
-        }
-        to_check = to_check.substr(0, --tc_len);
-      }
-      if (Jsep.isIdentifierStart(ch)) {
-        node = this.gobbleIdentifier();
-        if (Jsep.literals.hasOwnProperty(node.name)) {
-          node = {
-            type: Jsep.LITERAL,
-            value: Jsep.literals[node.name],
-            raw: node.name
-          };
-        } else if (node.name === Jsep.this_str) {
-          node = {
-            type: Jsep.THIS_EXP
-          };
-        }
-      } else if (ch === Jsep.OPAREN_CODE) {
-        node = this.gobbleGroup();
-      }
-    }
-    if (!node) {
-      return this.runHook("after-token", false);
-    }
-    node = this.gobbleTokenProperty(node);
-    return this.runHook("after-token", node);
-  }
-  gobbleTokenProperty(node) {
-    this.gobbleSpaces();
-    let ch = this.code;
-    while (ch === Jsep.PERIOD_CODE || ch === Jsep.OBRACK_CODE || ch === Jsep.OPAREN_CODE || ch === Jsep.QUMARK_CODE) {
-      let optional;
-      if (ch === Jsep.QUMARK_CODE) {
-        if (this.expr.charCodeAt(this.index + 1) !== Jsep.PERIOD_CODE) {
-          break;
-        }
-        optional = true;
-        this.index += 2;
-        this.gobbleSpaces();
-        ch = this.code;
-      }
-      this.index++;
-      if (ch === Jsep.OBRACK_CODE) {
-        node = {
-          type: Jsep.MEMBER_EXP,
-          computed: true,
-          object: node,
-          property: this.gobbleExpression()
-        };
-        if (!node.property) {
-          this.throwError('Unexpected "' + this.char + '"');
-        }
-        this.gobbleSpaces();
-        ch = this.code;
-        if (ch !== Jsep.CBRACK_CODE) {
-          this.throwError("Unclosed [");
-        }
-        this.index++;
-      } else if (ch === Jsep.OPAREN_CODE) {
-        node = {
-          type: Jsep.CALL_EXP,
-          arguments: this.gobbleArguments(Jsep.CPAREN_CODE),
-          callee: node
-        };
-      } else if (ch === Jsep.PERIOD_CODE || optional) {
-        if (optional) {
-          this.index--;
-        }
-        this.gobbleSpaces();
-        node = {
-          type: Jsep.MEMBER_EXP,
-          computed: false,
-          object: node,
-          property: this.gobbleIdentifier()
-        };
-      }
-      if (optional) {
-        node.optional = true;
-      }
-      this.gobbleSpaces();
-      ch = this.code;
-    }
-    return node;
-  }
-  gobbleNumericLiteral() {
-    let number = "", ch, chCode;
-    while (Jsep.isDecimalDigit(this.code)) {
-      number += this.expr.charAt(this.index++);
-    }
-    if (this.code === Jsep.PERIOD_CODE) {
-      number += this.expr.charAt(this.index++);
-      while (Jsep.isDecimalDigit(this.code)) {
-        number += this.expr.charAt(this.index++);
-      }
-    }
-    ch = this.char;
-    if (ch === "e" || ch === "E") {
-      number += this.expr.charAt(this.index++);
-      ch = this.char;
-      if (ch === "+" || ch === "-") {
-        number += this.expr.charAt(this.index++);
-      }
-      while (Jsep.isDecimalDigit(this.code)) {
-        number += this.expr.charAt(this.index++);
-      }
-      if (!Jsep.isDecimalDigit(this.expr.charCodeAt(this.index - 1))) {
-        this.throwError("Expected exponent (" + number + this.char + ")");
-      }
-    }
-    chCode = this.code;
-    if (Jsep.isIdentifierStart(chCode)) {
-      this.throwError("Variable names cannot start with a number (" + number + this.char + ")");
-    } else if (chCode === Jsep.PERIOD_CODE || number.length === 1 && number.charCodeAt(0) === Jsep.PERIOD_CODE) {
-      this.throwError("Unexpected period");
-    }
-    return {
-      type: Jsep.LITERAL,
-      value: parseFloat(number),
-      raw: number
-    };
-  }
-  gobbleStringLiteral() {
-    let str = "";
-    const startIndex = this.index;
-    const quote = this.expr.charAt(this.index++);
-    let closed = false;
-    while (this.index < this.expr.length) {
-      let ch = this.expr.charAt(this.index++);
-      if (ch === quote) {
-        closed = true;
-        break;
-      } else if (ch === "\\") {
-        ch = this.expr.charAt(this.index++);
-        switch (ch) {
-          case "n":
-            str += `
-`;
-            break;
-          case "r":
-            str += "\r";
-            break;
-          case "t":
-            str += "\t";
-            break;
-          case "b":
-            str += "\b";
-            break;
-          case "f":
-            str += "\f";
-            break;
-          case "v":
-            str += "\v";
-            break;
-          default:
-            str += ch;
-        }
-      } else {
-        str += ch;
-      }
-    }
-    if (!closed) {
-      this.throwError('Unclosed quote after "' + str + '"');
-    }
-    return {
-      type: Jsep.LITERAL,
-      value: str,
-      raw: this.expr.substring(startIndex, this.index)
-    };
-  }
-  gobbleIdentifier() {
-    let ch = this.code, start = this.index;
-    if (Jsep.isIdentifierStart(ch)) {
-      this.index++;
-    } else {
-      this.throwError("Unexpected " + this.char);
-    }
-    while (this.index < this.expr.length) {
-      ch = this.code;
-      if (Jsep.isIdentifierPart(ch)) {
-        this.index++;
-      } else {
-        break;
-      }
-    }
-    return {
-      type: Jsep.IDENTIFIER,
-      name: this.expr.slice(start, this.index)
-    };
-  }
-  gobbleArguments(termination) {
-    const args = [];
-    let closed = false;
-    let separator_count = 0;
-    while (this.index < this.expr.length) {
-      this.gobbleSpaces();
-      let ch_i = this.code;
-      if (ch_i === termination) {
-        closed = true;
-        this.index++;
-        if (termination === Jsep.CPAREN_CODE && separator_count && separator_count >= args.length) {
-          this.throwError("Unexpected token " + String.fromCharCode(termination));
-        }
-        break;
-      } else if (ch_i === Jsep.COMMA_CODE) {
-        this.index++;
-        separator_count++;
-        if (separator_count !== args.length) {
-          if (termination === Jsep.CPAREN_CODE) {
-            this.throwError("Unexpected token ,");
-          } else if (termination === Jsep.CBRACK_CODE) {
-            for (let arg = args.length;arg < separator_count; arg++) {
-              args.push(null);
-            }
-          }
-        }
-      } else if (args.length !== separator_count && separator_count !== 0) {
-        this.throwError("Expected comma");
-      } else {
-        const node = this.gobbleExpression();
-        if (!node || node.type === Jsep.COMPOUND) {
-          this.throwError("Expected comma");
-        }
-        args.push(node);
-      }
-    }
-    if (!closed) {
-      this.throwError("Expected " + String.fromCharCode(termination));
-    }
-    return args;
-  }
-  gobbleGroup() {
-    this.index++;
-    let nodes = this.gobbleExpressions(Jsep.CPAREN_CODE);
-    if (this.code === Jsep.CPAREN_CODE) {
-      this.index++;
-      if (nodes.length === 1) {
-        return nodes[0];
-      } else if (!nodes.length) {
-        return false;
-      } else {
-        return {
-          type: Jsep.SEQUENCE_EXP,
-          expressions: nodes
-        };
-      }
-    } else {
-      this.throwError("Unclosed (");
-    }
-  }
-  gobbleArray() {
-    this.index++;
-    return {
-      type: Jsep.ARRAY_EXP,
-      elements: this.gobbleArguments(Jsep.CBRACK_CODE)
-    };
-  }
-}
-var hooks = new Hooks;
-Object.assign(Jsep, {
-  hooks,
-  plugins: new Plugins(Jsep),
-  COMPOUND: "Compound",
-  SEQUENCE_EXP: "SequenceExpression",
-  IDENTIFIER: "Identifier",
-  MEMBER_EXP: "MemberExpression",
-  LITERAL: "Literal",
-  THIS_EXP: "ThisExpression",
-  CALL_EXP: "CallExpression",
-  UNARY_EXP: "UnaryExpression",
-  BINARY_EXP: "BinaryExpression",
-  ARRAY_EXP: "ArrayExpression",
-  TAB_CODE: 9,
-  LF_CODE: 10,
-  CR_CODE: 13,
-  SPACE_CODE: 32,
-  PERIOD_CODE: 46,
-  COMMA_CODE: 44,
-  SQUOTE_CODE: 39,
-  DQUOTE_CODE: 34,
-  OPAREN_CODE: 40,
-  CPAREN_CODE: 41,
-  OBRACK_CODE: 91,
-  CBRACK_CODE: 93,
-  QUMARK_CODE: 63,
-  SEMCOL_CODE: 59,
-  COLON_CODE: 58,
-  unary_ops: {
-    "-": 1,
-    "!": 1,
-    "~": 1,
-    "+": 1
-  },
-  binary_ops: {
-    "||": 1,
-    "??": 1,
-    "&&": 2,
-    "|": 3,
-    "^": 4,
-    "&": 5,
-    "==": 6,
-    "!=": 6,
-    "===": 6,
-    "!==": 6,
-    "<": 7,
-    ">": 7,
-    "<=": 7,
-    ">=": 7,
-    "<<": 8,
-    ">>": 8,
-    ">>>": 8,
-    "+": 9,
-    "-": 9,
-    "*": 10,
-    "/": 10,
-    "%": 10,
-    "**": 11
-  },
-  right_associative: new Set(["**"]),
-  additional_identifier_chars: new Set(["$", "_"]),
-  literals: {
-    true: true,
-    false: false,
-    null: null
-  },
-  this_str: "this"
-});
-Jsep.max_unop_len = Jsep.getMaxKeyLen(Jsep.unary_ops);
-Jsep.max_binop_len = Jsep.getMaxKeyLen(Jsep.binary_ops);
-var jsep = (expr) => new Jsep(expr).parse();
-var stdClassProps = Object.getOwnPropertyNames(class Test {
-});
-Object.getOwnPropertyNames(Jsep).filter((prop) => !stdClassProps.includes(prop) && jsep[prop] === undefined).forEach((m) => {
-  jsep[m] = Jsep[m];
-});
-jsep.Jsep = Jsep;
-var CONDITIONAL_EXP = "ConditionalExpression";
-var ternary = {
-  name: "ternary",
-  init(jsep2) {
-    jsep2.hooks.add("after-expression", function gobbleTernary(env) {
-      if (env.node && this.code === jsep2.QUMARK_CODE) {
-        this.index++;
-        const test = env.node;
-        const consequent = this.gobbleExpression();
-        if (!consequent) {
-          this.throwError("Expected expression");
-        }
-        this.gobbleSpaces();
-        if (this.code === jsep2.COLON_CODE) {
-          this.index++;
-          const alternate = this.gobbleExpression();
-          if (!alternate) {
-            this.throwError("Expected expression");
-          }
-          env.node = {
-            type: CONDITIONAL_EXP,
-            test,
-            consequent,
-            alternate
-          };
-          if (test.operator && jsep2.binary_ops[test.operator] <= 0.9) {
-            let newTest = test;
-            while (newTest.right.operator && jsep2.binary_ops[newTest.right.operator] <= 0.9) {
-              newTest = newTest.right;
-            }
-            env.node.test = newTest.right;
-            newTest.right = env.node;
-            env.node = test;
-          }
-        } else {
-          this.throwError("Expected :");
-        }
-      }
-    });
-  }
-};
-jsep.plugins.register(ternary);
-var FSLASH_CODE = 47;
-var BSLASH_CODE = 92;
-var index = {
-  name: "regex",
-  init(jsep2) {
-    jsep2.hooks.add("gobble-token", function gobbleRegexLiteral(env) {
-      if (this.code === FSLASH_CODE) {
-        const patternIndex = ++this.index;
-        let inCharSet = false;
-        while (this.index < this.expr.length) {
-          if (this.code === FSLASH_CODE && !inCharSet) {
-            const pattern = this.expr.slice(patternIndex, this.index);
-            let flags = "";
-            while (++this.index < this.expr.length) {
-              const code = this.code;
-              if (code >= 97 && code <= 122 || code >= 65 && code <= 90 || code >= 48 && code <= 57) {
-                flags += this.char;
-              } else {
-                break;
-              }
-            }
-            let value;
-            try {
-              value = new RegExp(pattern, flags);
-            } catch (e) {
-              this.throwError(e.message);
-            }
-            env.node = {
-              type: jsep2.LITERAL,
-              value,
-              raw: this.expr.slice(patternIndex - 1, this.index)
-            };
-            env.node = this.gobbleTokenProperty(env.node);
-            return env.node;
-          }
-          if (this.code === jsep2.OBRACK_CODE) {
-            inCharSet = true;
-          } else if (inCharSet && this.code === jsep2.CBRACK_CODE) {
-            inCharSet = false;
-          }
-          this.index += this.code === BSLASH_CODE ? 2 : 1;
-        }
-        this.throwError("Unclosed Regex");
-      }
-    });
-  }
-};
-var PLUS_CODE = 43;
-var MINUS_CODE = 45;
-var plugin = {
-  name: "assignment",
-  assignmentOperators: new Set(["=", "*=", "**=", "/=", "%=", "+=", "-=", "<<=", ">>=", ">>>=", "&=", "^=", "|=", "||=", "&&=", "??="]),
-  updateOperators: [PLUS_CODE, MINUS_CODE],
-  assignmentPrecedence: 0.9,
-  init(jsep2) {
-    const updateNodeTypes = [jsep2.IDENTIFIER, jsep2.MEMBER_EXP];
-    plugin.assignmentOperators.forEach((op) => jsep2.addBinaryOp(op, plugin.assignmentPrecedence, true));
-    jsep2.hooks.add("gobble-token", function gobbleUpdatePrefix(env) {
-      const code = this.code;
-      if (plugin.updateOperators.some((c) => c === code && c === this.expr.charCodeAt(this.index + 1))) {
-        this.index += 2;
-        env.node = {
-          type: "UpdateExpression",
-          operator: code === PLUS_CODE ? "++" : "--",
-          argument: this.gobbleTokenProperty(this.gobbleIdentifier()),
-          prefix: true
-        };
-        if (!env.node.argument || !updateNodeTypes.includes(env.node.argument.type)) {
-          this.throwError(`Unexpected ${env.node.operator}`);
-        }
-      }
-    });
-    jsep2.hooks.add("after-token", function gobbleUpdatePostfix(env) {
-      if (env.node) {
-        const code = this.code;
-        if (plugin.updateOperators.some((c) => c === code && c === this.expr.charCodeAt(this.index + 1))) {
-          if (!updateNodeTypes.includes(env.node.type)) {
-            this.throwError(`Unexpected ${env.node.operator}`);
-          }
-          this.index += 2;
-          env.node = {
-            type: "UpdateExpression",
-            operator: code === PLUS_CODE ? "++" : "--",
-            argument: env.node,
-            prefix: false
-          };
-        }
-      }
-    });
-    jsep2.hooks.add("after-expression", function gobbleAssignment(env) {
-      if (env.node) {
-        updateBinariesToAssignments(env.node);
-      }
-    });
-    function updateBinariesToAssignments(node) {
-      if (plugin.assignmentOperators.has(node.operator)) {
-        node.type = "AssignmentExpression";
-        updateBinariesToAssignments(node.left);
-        updateBinariesToAssignments(node.right);
-      } else if (!node.operator) {
-        Object.values(node).forEach((val) => {
-          if (val && typeof val === "object") {
-            updateBinariesToAssignments(val);
-          }
-        });
-      }
-    }
-  }
-};
-jsep.plugins.register(index, plugin);
-jsep.addUnaryOp("typeof");
-jsep.addUnaryOp("void");
-jsep.addLiteral("null", null);
-jsep.addLiteral("undefined", undefined);
-var BLOCKED_PROTO_PROPERTIES = new Set(["constructor", "__proto__", "__defineGetter__", "__defineSetter__", "__lookupGetter__", "__lookupSetter__"]);
-var SafeEval = {
-  evalAst(ast, subs) {
-    switch (ast.type) {
-      case "BinaryExpression":
-      case "LogicalExpression":
-        return SafeEval.evalBinaryExpression(ast, subs);
-      case "Compound":
-        return SafeEval.evalCompound(ast, subs);
-      case "ConditionalExpression":
-        return SafeEval.evalConditionalExpression(ast, subs);
-      case "Identifier":
-        return SafeEval.evalIdentifier(ast, subs);
-      case "Literal":
-        return SafeEval.evalLiteral(ast, subs);
-      case "MemberExpression":
-        return SafeEval.evalMemberExpression(ast, subs);
-      case "UnaryExpression":
-        return SafeEval.evalUnaryExpression(ast, subs);
-      case "ArrayExpression":
-        return SafeEval.evalArrayExpression(ast, subs);
-      case "CallExpression":
-        return SafeEval.evalCallExpression(ast, subs);
-      case "AssignmentExpression":
-        return SafeEval.evalAssignmentExpression(ast, subs);
-      default:
-        throw SyntaxError("Unexpected expression", ast);
-    }
-  },
-  evalBinaryExpression(ast, subs) {
-    const result = {
-      "||": (a, b) => a || b(),
-      "&&": (a, b) => a && b(),
-      "|": (a, b) => a | b(),
-      "^": (a, b) => a ^ b(),
-      "&": (a, b) => a & b(),
-      "==": (a, b) => a == b(),
-      "!=": (a, b) => a != b(),
-      "===": (a, b) => a === b(),
-      "!==": (a, b) => a !== b(),
-      "<": (a, b) => a < b(),
-      ">": (a, b) => a > b(),
-      "<=": (a, b) => a <= b(),
-      ">=": (a, b) => a >= b(),
-      "<<": (a, b) => a << b(),
-      ">>": (a, b) => a >> b(),
-      ">>>": (a, b) => a >>> b(),
-      "+": (a, b) => a + b(),
-      "-": (a, b) => a - b(),
-      "*": (a, b) => a * b(),
-      "/": (a, b) => a / b(),
-      "%": (a, b) => a % b()
-    }[ast.operator](SafeEval.evalAst(ast.left, subs), () => SafeEval.evalAst(ast.right, subs));
-    return result;
-  },
-  evalCompound(ast, subs) {
-    let last;
-    for (let i = 0;i < ast.body.length; i++) {
-      if (ast.body[i].type === "Identifier" && ["var", "let", "const"].includes(ast.body[i].name) && ast.body[i + 1] && ast.body[i + 1].type === "AssignmentExpression") {
-        i += 1;
-      }
-      const expr = ast.body[i];
-      last = SafeEval.evalAst(expr, subs);
-    }
-    return last;
-  },
-  evalConditionalExpression(ast, subs) {
-    if (SafeEval.evalAst(ast.test, subs)) {
-      return SafeEval.evalAst(ast.consequent, subs);
-    }
-    return SafeEval.evalAst(ast.alternate, subs);
-  },
-  evalIdentifier(ast, subs) {
-    if (Object.hasOwn(subs, ast.name)) {
-      return subs[ast.name];
-    }
-    throw ReferenceError(`${ast.name} is not defined`);
-  },
-  evalLiteral(ast) {
-    return ast.value;
-  },
-  evalMemberExpression(ast, subs) {
-    const prop = String(ast.computed ? SafeEval.evalAst(ast.property) : ast.property.name);
-    const obj = SafeEval.evalAst(ast.object, subs);
-    if (obj === undefined || obj === null) {
-      throw TypeError(`Cannot read properties of ${obj} (reading '${prop}')`);
-    }
-    if (!Object.hasOwn(obj, prop) && BLOCKED_PROTO_PROPERTIES.has(prop)) {
-      throw TypeError(`Cannot read properties of ${obj} (reading '${prop}')`);
-    }
-    const result = obj[prop];
-    if (typeof result === "function") {
-      return result.bind(obj);
-    }
-    return result;
-  },
-  evalUnaryExpression(ast, subs) {
-    const result = {
-      "-": (a) => -SafeEval.evalAst(a, subs),
-      "!": (a) => !SafeEval.evalAst(a, subs),
-      "~": (a) => ~SafeEval.evalAst(a, subs),
-      "+": (a) => +SafeEval.evalAst(a, subs),
-      typeof: (a) => typeof SafeEval.evalAst(a, subs),
-      void: (a) => void SafeEval.evalAst(a, subs)
-    }[ast.operator](ast.argument);
-    return result;
-  },
-  evalArrayExpression(ast, subs) {
-    return ast.elements.map((el) => SafeEval.evalAst(el, subs));
-  },
-  evalCallExpression(ast, subs) {
-    const args = ast.arguments.map((arg) => SafeEval.evalAst(arg, subs));
-    const func = SafeEval.evalAst(ast.callee, subs);
-    if (func === Function) {
-      throw new Error("Function constructor is disabled");
-    }
-    return func(...args);
-  },
-  evalAssignmentExpression(ast, subs) {
-    if (ast.left.type !== "Identifier") {
-      throw SyntaxError("Invalid left-hand side in assignment");
-    }
-    const id = ast.left.name;
-    const value = SafeEval.evalAst(ast.right, subs);
-    subs[id] = value;
-    return subs[id];
-  }
-};
-
-class SafeScript {
-  constructor(expr) {
-    this.code = expr;
-    this.ast = jsep(this.code);
-  }
-  runInNewContext(context) {
-    const keyMap = Object.assign(Object.create(null), context);
-    return SafeEval.evalAst(this.ast, keyMap);
-  }
-}
-function push(arr, item) {
-  arr = arr.slice();
-  arr.push(item);
-  return arr;
-}
-function unshift(item, arr) {
-  arr = arr.slice();
-  arr.unshift(item);
-  return arr;
-}
-
-class NewError extends Error {
-  constructor(value) {
-    super('JSONPath should not be called with "new" (it prevents return ' + "of (unwrapped) scalar values)");
-    this.avoidNew = true;
-    this.value = value;
-    this.name = "NewError";
-  }
-}
-function JSONPath(opts, expr, obj, callback, otherTypeCallback) {
-  if (!(this instanceof JSONPath)) {
-    try {
-      return new JSONPath(opts, expr, obj, callback, otherTypeCallback);
-    } catch (e) {
-      if (!e.avoidNew) {
-        throw e;
-      }
-      return e.value;
-    }
-  }
-  if (typeof opts === "string") {
-    otherTypeCallback = callback;
-    callback = obj;
-    obj = expr;
-    expr = opts;
-    opts = null;
-  }
-  const optObj = opts && typeof opts === "object";
-  opts = opts || {};
-  this.json = opts.json || obj;
-  this.path = opts.path || expr;
-  this.resultType = opts.resultType || "value";
-  this.flatten = opts.flatten || false;
-  this.wrap = Object.hasOwn(opts, "wrap") ? opts.wrap : true;
-  this.sandbox = opts.sandbox || {};
-  this.eval = opts.eval === undefined ? "safe" : opts.eval;
-  this.ignoreEvalErrors = typeof opts.ignoreEvalErrors === "undefined" ? false : opts.ignoreEvalErrors;
-  this.parent = opts.parent || null;
-  this.parentProperty = opts.parentProperty || null;
-  this.callback = opts.callback || callback || null;
-  this.otherTypeCallback = opts.otherTypeCallback || otherTypeCallback || function() {
-    throw new TypeError("You must supply an otherTypeCallback callback option " + "with the @other() operator.");
-  };
-  if (opts.autostart !== false) {
-    const args = {
-      path: optObj ? opts.path : expr
-    };
-    if (!optObj) {
-      args.json = obj;
-    } else if ("json" in opts) {
-      args.json = opts.json;
-    }
-    const ret = this.evaluate(args);
-    if (!ret || typeof ret !== "object") {
-      throw new NewError(ret);
-    }
-    return ret;
-  }
-}
-JSONPath.prototype.evaluate = function(expr, json, callback, otherTypeCallback) {
-  let currParent = this.parent, currParentProperty = this.parentProperty;
-  let {
-    flatten,
-    wrap
-  } = this;
-  this.currResultType = this.resultType;
-  this.currEval = this.eval;
-  this.currSandbox = this.sandbox;
-  callback = callback || this.callback;
-  this.currOtherTypeCallback = otherTypeCallback || this.otherTypeCallback;
-  json = json || this.json;
-  expr = expr || this.path;
-  if (expr && typeof expr === "object" && !Array.isArray(expr)) {
-    if (!expr.path && expr.path !== "") {
-      throw new TypeError('You must supply a "path" property when providing an object ' + "argument to JSONPath.evaluate().");
-    }
-    if (!Object.hasOwn(expr, "json")) {
-      throw new TypeError('You must supply a "json" property when providing an object ' + "argument to JSONPath.evaluate().");
-    }
-    ({
-      json
-    } = expr);
-    flatten = Object.hasOwn(expr, "flatten") ? expr.flatten : flatten;
-    this.currResultType = Object.hasOwn(expr, "resultType") ? expr.resultType : this.currResultType;
-    this.currSandbox = Object.hasOwn(expr, "sandbox") ? expr.sandbox : this.currSandbox;
-    wrap = Object.hasOwn(expr, "wrap") ? expr.wrap : wrap;
-    this.currEval = Object.hasOwn(expr, "eval") ? expr.eval : this.currEval;
-    callback = Object.hasOwn(expr, "callback") ? expr.callback : callback;
-    this.currOtherTypeCallback = Object.hasOwn(expr, "otherTypeCallback") ? expr.otherTypeCallback : this.currOtherTypeCallback;
-    currParent = Object.hasOwn(expr, "parent") ? expr.parent : currParent;
-    currParentProperty = Object.hasOwn(expr, "parentProperty") ? expr.parentProperty : currParentProperty;
-    expr = expr.path;
-  }
-  currParent = currParent || null;
-  currParentProperty = currParentProperty || null;
-  if (Array.isArray(expr)) {
-    expr = JSONPath.toPathString(expr);
-  }
-  if (!expr && expr !== "" || !json) {
-    return;
-  }
-  const exprList = JSONPath.toPathArray(expr);
-  if (exprList[0] === "$" && exprList.length > 1) {
-    exprList.shift();
-  }
-  this._hasParentSelector = null;
-  const result = this._trace(exprList, json, ["$"], currParent, currParentProperty, callback).filter(function(ea) {
-    return ea && !ea.isParentSelector;
-  });
-  if (!result.length) {
-    return wrap ? [] : undefined;
-  }
-  if (!wrap && result.length === 1 && !result[0].hasArrExpr) {
-    return this._getPreferredOutput(result[0]);
-  }
-  return result.reduce((rslt, ea) => {
-    const valOrPath = this._getPreferredOutput(ea);
-    if (flatten && Array.isArray(valOrPath)) {
-      rslt = rslt.concat(valOrPath);
-    } else {
-      rslt.push(valOrPath);
-    }
-    return rslt;
-  }, []);
-};
-JSONPath.prototype._getPreferredOutput = function(ea) {
-  const resultType = this.currResultType;
-  switch (resultType) {
-    case "all": {
-      const path3 = Array.isArray(ea.path) ? ea.path : JSONPath.toPathArray(ea.path);
-      ea.pointer = JSONPath.toPointer(path3);
-      ea.path = typeof ea.path === "string" ? ea.path : JSONPath.toPathString(ea.path);
-      return ea;
-    }
-    case "value":
-    case "parent":
-    case "parentProperty":
-      return ea[resultType];
-    case "path":
-      return JSONPath.toPathString(ea[resultType]);
-    case "pointer":
-      return JSONPath.toPointer(ea.path);
-    default:
-      throw new TypeError("Unknown result type");
-  }
-};
-JSONPath.prototype._handleCallback = function(fullRetObj, callback, type) {
-  if (callback) {
-    const preferredOutput = this._getPreferredOutput(fullRetObj);
-    fullRetObj.path = typeof fullRetObj.path === "string" ? fullRetObj.path : JSONPath.toPathString(fullRetObj.path);
-    callback(preferredOutput, type, fullRetObj);
-  }
-};
-JSONPath.prototype._trace = function(expr, val, path3, parent, parentPropName, callback, hasArrExpr, literalPriority) {
-  let retObj;
-  if (!expr.length) {
-    retObj = {
-      path: path3,
-      value: val,
-      parent,
-      parentProperty: parentPropName,
-      hasArrExpr
-    };
-    this._handleCallback(retObj, callback, "value");
-    return retObj;
-  }
-  const loc = expr[0], x = expr.slice(1);
-  const ret = [];
-  function addRet(elems) {
-    if (Array.isArray(elems)) {
-      elems.forEach((t) => {
-        ret.push(t);
-      });
-    } else {
-      ret.push(elems);
-    }
-  }
-  if ((typeof loc !== "string" || literalPriority) && val && Object.hasOwn(val, loc)) {
-    addRet(this._trace(x, val[loc], push(path3, loc), val, loc, callback, hasArrExpr));
-  } else if (loc === "*") {
-    this._walk(val, (m) => {
-      addRet(this._trace(x, val[m], push(path3, m), val, m, callback, true, true));
-    });
-  } else if (loc === "..") {
-    addRet(this._trace(x, val, path3, parent, parentPropName, callback, hasArrExpr));
-    this._walk(val, (m) => {
-      if (typeof val[m] === "object") {
-        addRet(this._trace(expr.slice(), val[m], push(path3, m), val, m, callback, true));
-      }
-    });
-  } else if (loc === "^") {
-    this._hasParentSelector = true;
-    return {
-      path: path3.slice(0, -1),
-      expr: x,
-      isParentSelector: true
-    };
-  } else if (loc === "~") {
-    retObj = {
-      path: push(path3, loc),
-      value: parentPropName,
-      parent,
-      parentProperty: null
-    };
-    this._handleCallback(retObj, callback, "property");
-    return retObj;
-  } else if (loc === "$") {
-    addRet(this._trace(x, val, path3, null, null, callback, hasArrExpr));
-  } else if (/^(-?\d*):(-?\d*):?(\d*)$/u.test(loc)) {
-    addRet(this._slice(loc, x, val, path3, parent, parentPropName, callback));
-  } else if (loc.indexOf("?(") === 0) {
-    if (this.currEval === false) {
-      throw new Error("Eval [?(expr)] prevented in JSONPath expression.");
-    }
-    const safeLoc = loc.replace(/^\?\((.*?)\)$/u, "$1");
-    const nested = /@.?([^?]*)[['](\??\(.*?\))(?!.\)\])[\]']/gu.exec(safeLoc);
-    if (nested) {
-      this._walk(val, (m) => {
-        const npath = [nested[2]];
-        const nvalue = nested[1] ? val[m][nested[1]] : val[m];
-        const filterResults = this._trace(npath, nvalue, path3, parent, parentPropName, callback, true);
-        if (filterResults.length > 0) {
-          addRet(this._trace(x, val[m], push(path3, m), val, m, callback, true));
-        }
-      });
-    } else {
-      this._walk(val, (m) => {
-        if (this._eval(safeLoc, val[m], m, path3, parent, parentPropName)) {
-          addRet(this._trace(x, val[m], push(path3, m), val, m, callback, true));
-        }
-      });
-    }
-  } else if (loc[0] === "(") {
-    if (this.currEval === false) {
-      throw new Error("Eval [(expr)] prevented in JSONPath expression.");
-    }
-    addRet(this._trace(unshift(this._eval(loc, val, path3.at(-1), path3.slice(0, -1), parent, parentPropName), x), val, path3, parent, parentPropName, callback, hasArrExpr));
-  } else if (loc[0] === "@") {
-    let addType = false;
-    const valueType = loc.slice(1, -2);
-    switch (valueType) {
-      case "scalar":
-        if (!val || !["object", "function"].includes(typeof val)) {
-          addType = true;
-        }
-        break;
-      case "boolean":
-      case "string":
-      case "undefined":
-      case "function":
-        if (typeof val === valueType) {
-          addType = true;
-        }
-        break;
-      case "integer":
-        if (Number.isFinite(val) && !(val % 1)) {
-          addType = true;
-        }
-        break;
-      case "number":
-        if (Number.isFinite(val)) {
-          addType = true;
-        }
-        break;
-      case "nonFinite":
-        if (typeof val === "number" && !Number.isFinite(val)) {
-          addType = true;
-        }
-        break;
-      case "object":
-        if (val && typeof val === valueType) {
-          addType = true;
-        }
-        break;
-      case "array":
-        if (Array.isArray(val)) {
-          addType = true;
-        }
-        break;
-      case "other":
-        addType = this.currOtherTypeCallback(val, path3, parent, parentPropName);
-        break;
-      case "null":
-        if (val === null) {
-          addType = true;
-        }
-        break;
-      default:
-        throw new TypeError("Unknown value type " + valueType);
-    }
-    if (addType) {
-      retObj = {
-        path: path3,
-        value: val,
-        parent,
-        parentProperty: parentPropName
-      };
-      this._handleCallback(retObj, callback, "value");
-      return retObj;
-    }
-  } else if (loc[0] === "`" && val && Object.hasOwn(val, loc.slice(1))) {
-    const locProp = loc.slice(1);
-    addRet(this._trace(x, val[locProp], push(path3, locProp), val, locProp, callback, hasArrExpr, true));
-  } else if (loc.includes(",")) {
-    const parts = loc.split(",");
-    for (const part of parts) {
-      addRet(this._trace(unshift(part, x), val, path3, parent, parentPropName, callback, true));
-    }
-  } else if (!literalPriority && val && Object.hasOwn(val, loc)) {
-    addRet(this._trace(x, val[loc], push(path3, loc), val, loc, callback, hasArrExpr, true));
-  }
-  if (this._hasParentSelector) {
-    for (let t = 0;t < ret.length; t++) {
-      const rett = ret[t];
-      if (rett && rett.isParentSelector) {
-        const tmp = this._trace(rett.expr, val, rett.path, parent, parentPropName, callback, hasArrExpr);
-        if (Array.isArray(tmp)) {
-          ret[t] = tmp[0];
-          const tl = tmp.length;
-          for (let tt = 1;tt < tl; tt++) {
-            t++;
-            ret.splice(t, 0, tmp[tt]);
-          }
-        } else {
-          ret[t] = tmp;
-        }
-      }
-    }
-  }
-  return ret;
-};
-JSONPath.prototype._walk = function(val, f) {
-  if (Array.isArray(val)) {
-    const n = val.length;
-    for (let i = 0;i < n; i++) {
-      f(i);
-    }
-  } else if (val && typeof val === "object") {
-    Object.keys(val).forEach((m) => {
-      f(m);
-    });
-  }
-};
-JSONPath.prototype._slice = function(loc, expr, val, path3, parent, parentPropName, callback) {
-  if (!Array.isArray(val)) {
-    return;
-  }
-  const len = val.length, parts = loc.split(":"), step = parts[2] && Number.parseInt(parts[2]) || 1;
-  let start = parts[0] && Number.parseInt(parts[0]) || 0, end = parts[1] && Number.parseInt(parts[1]) || len;
-  start = start < 0 ? Math.max(0, start + len) : Math.min(len, start);
-  end = end < 0 ? Math.max(0, end + len) : Math.min(len, end);
-  const ret = [];
-  for (let i = start;i < end; i += step) {
-    const tmp = this._trace(unshift(i, expr), val, path3, parent, parentPropName, callback, true);
-    tmp.forEach((t) => {
-      ret.push(t);
-    });
-  }
-  return ret;
-};
-JSONPath.prototype._eval = function(code, _v, _vname, path3, parent, parentPropName) {
-  this.currSandbox._$_parentProperty = parentPropName;
-  this.currSandbox._$_parent = parent;
-  this.currSandbox._$_property = _vname;
-  this.currSandbox._$_root = this.json;
-  this.currSandbox._$_v = _v;
-  const containsPath = code.includes("@path");
-  if (containsPath) {
-    this.currSandbox._$_path = JSONPath.toPathString(path3.concat([_vname]));
-  }
-  const scriptCacheKey = this.currEval + "Script:" + code;
-  if (!JSONPath.cache[scriptCacheKey]) {
-    let script = code.replaceAll("@parentProperty", "_$_parentProperty").replaceAll("@parent", "_$_parent").replaceAll("@property", "_$_property").replaceAll("@root", "_$_root").replaceAll(/@([.\s)[])/gu, "_$_v$1");
-    if (containsPath) {
-      script = script.replaceAll("@path", "_$_path");
-    }
-    if (this.currEval === "safe" || this.currEval === true || this.currEval === undefined) {
-      JSONPath.cache[scriptCacheKey] = new this.safeVm.Script(script);
-    } else if (this.currEval === "native") {
-      JSONPath.cache[scriptCacheKey] = new this.vm.Script(script);
-    } else if (typeof this.currEval === "function" && this.currEval.prototype && Object.hasOwn(this.currEval.prototype, "runInNewContext")) {
-      const CurrEval = this.currEval;
-      JSONPath.cache[scriptCacheKey] = new CurrEval(script);
-    } else if (typeof this.currEval === "function") {
-      JSONPath.cache[scriptCacheKey] = {
-        runInNewContext: (context) => this.currEval(script, context)
-      };
-    } else {
-      throw new TypeError(`Unknown "eval" property "${this.currEval}"`);
-    }
-  }
-  try {
-    return JSONPath.cache[scriptCacheKey].runInNewContext(this.currSandbox);
-  } catch (e) {
-    if (this.ignoreEvalErrors) {
-      return false;
-    }
-    throw new Error("jsonPath: " + e.message + ": " + code);
-  }
-};
-JSONPath.cache = {};
-JSONPath.toPathString = function(pathArr) {
-  const x = pathArr, n = x.length;
-  let p = "$";
-  for (let i = 1;i < n; i++) {
-    if (!/^(~|\^|@.*?\(\))$/u.test(x[i])) {
-      p += /^[0-9*]+$/u.test(x[i]) ? "[" + x[i] + "]" : "['" + x[i] + "']";
-    }
-  }
-  return p;
-};
-JSONPath.toPointer = function(pointer) {
-  const x = pointer, n = x.length;
-  let p = "";
-  for (let i = 1;i < n; i++) {
-    if (!/^(~|\^|@.*?\(\))$/u.test(x[i])) {
-      p += "/" + x[i].toString().replaceAll("~", "~0").replaceAll("/", "~1");
-    }
-  }
-  return p;
-};
-JSONPath.toPathArray = function(expr) {
-  const {
-    cache
-  } = JSONPath;
-  if (cache[expr]) {
-    return cache[expr].concat();
-  }
-  const subx = [];
-  const normalized = expr.replaceAll(/@(?:null|boolean|number|string|integer|undefined|nonFinite|scalar|array|object|function|other)\(\)/gu, ";$&;").replaceAll(/[['](\??\(.*?\))[\]'](?!.\])/gu, function($0, $1) {
-    return "[#" + (subx.push($1) - 1) + "]";
-  }).replaceAll(/\[['"]([^'\]]*)['"]\]/gu, function($0, prop) {
-    return "['" + prop.replaceAll(".", "%@%").replaceAll("~", "%%@@%%") + "']";
-  }).replaceAll("~", ";~;").replaceAll(/['"]?\.['"]?(?![^[]*\])|\[['"]?/gu, ";").replaceAll("%@%", ".").replaceAll("%%@@%%", "~").replaceAll(/(?:;)?(\^+)(?:;)?/gu, function($0, ups) {
-    return ";" + ups.split("").join(";") + ";";
-  }).replaceAll(/;;;|;;/gu, ";..;").replaceAll(/;$|'?\]|'$/gu, "");
-  const exprList = normalized.split(";").map(function(exp) {
-    const match = exp.match(/#(\d+)/u);
-    return !match || !match[1] ? exp : subx[match[1]];
-  });
-  cache[expr] = exprList;
-  return cache[expr].concat();
-};
-JSONPath.prototype.safeVm = {
-  Script: SafeScript
-};
-JSONPath.prototype.vm = vm;
 // ../../common/src/option-aliases.ts
 import { Option } from "commander";
 // ../../common/src/option-validators.ts
@@ -30648,6 +29610,18 @@ var FAILURE_STATUSES = new Set([
   "canceled",
   "stopped"
 ]);
+// ../../common/src/preview.ts
+import { Command as Command3 } from "commander";
+var previewSlot = singleton("PreviewBuild");
+function isPreviewBuild() {
+  return previewSlot.get(false) ?? false;
+}
+Command3.prototype.previewCommand = function(nameAndArgs, opts) {
+  if (isPreviewBuild()) {
+    return this.command(nameAndArgs, opts);
+  }
+  return new Command3(nameAndArgs.split(/\s+/)[0] ?? nameAndArgs);
+};
 // ../../common/src/screen-logger.ts
 var ScreenLogger;
 ((ScreenLogger) => {
@@ -30752,8 +29726,27 @@ async function forEachExportEntry(api, from, to, onEntry) {
   }
   return { days: chunks.length, nonEmptyDays };
 }
-async function downloadChunkedExport(api, from, to) {
-  const out = new import_adm_zip.default;
+function exportBaseName(from, to, generatedAt) {
+  const day = (d) => d.toISOString().slice(0, 10);
+  const stamp = generatedAt.toISOString().slice(0, 19).replace(/[-:]/g, "");
+  return `audit_${day(from)}_${day(to)}_${stamp}`;
+}
+function toJsonFileName(preferredName) {
+  return `${basenameNoExt(preferredName)}.json`;
+}
+function isSafeExportEntryName(name) {
+  return name.length > 0 && name !== "." && name !== ".." && !name.includes("/") && !name.includes("\\") && !name.includes("\x00");
+}
+function isWithinDir(dir, resolved) {
+  let end = dir.length;
+  while (end > 0 && (dir[end - 1] === "/" || dir[end - 1] === "\\")) {
+    end -= 1;
+  }
+  const base = dir.slice(0, end);
+  return resolved === base || resolved.startsWith(`${base}/`) || resolved.startsWith(`${base}\\`);
+}
+async function downloadChunkedJsonExport(api, from, to) {
+  const files = [];
   const used = new Set;
   function addUnique(preferredName, isoDay, data) {
     let name = preferredName;
@@ -30768,10 +29761,10 @@ async function downloadChunkedExport(api, from, to) {
       }
     }
     used.add(name);
-    out.addFile(name, data);
+    files.push({ name, data });
   }
-  const { days, nonEmptyDays } = await forEachExportEntry(api, from, to, ({ isoDay, preferredName, data }) => addUnique(preferredName, isoDay, data));
-  return { buffer: out.toBuffer(), days, nonEmptyDays };
+  const { days, nonEmptyDays } = await forEachExportEntry(api, from, to, ({ isoDay, preferredName, data }) => addUnique(toJsonFileName(preferredName), isoDay, data));
+  return { files, days, nonEmptyDays };
 }
 var PREFERRED_CSV_COLUMNS = [
   "Id",
@@ -30880,12 +29873,14 @@ function instructionsFor(verb, error) {
   if (/Invalid --status/.test(msg))
     return "Use --status Success or --status Failure (case-insensitive).";
   if (/Invalid --file-format/.test(msg))
-    return "Use --file-format zip (default) or --file-format csv.";
+    return "Use --file-format json (default) or --file-format csv.";
+  if (/unsafe name|outside the output folder/i.test(msg))
+    return "The export contained a file whose name would escape --output-path. This indicates a malformed server response — re-run, and report it if it persists.";
   if (verb === "sources")
     return "Confirm scope (org vs tenant) matches your intent and that you are logged in.";
   if (verb === "events")
     return "Discover GUIDs via 'audit <scope> sources --output json' before passing --source/--target/--type. Verify --from-date/--to-date are ISO 8601.";
-  return "Verify --from-date/--to-date are ISO 8601 and the --output-file directory is writable. Single-day chunk failures are transient — re-run.";
+  return "Verify --from-date/--to-date are ISO 8601 and the --output-path directory is writable. Single-day chunk failures are transient — re-run.";
 }
 function registerScopeCommands(parent, opts) {
   registerSources(parent, opts);
@@ -31098,10 +30093,10 @@ function registerEvents(parent, opts) {
   });
 }
 function parseFormat(raw) {
-  const normalized = (raw ?? "zip").trim().toLowerCase();
-  if (normalized === "zip" || normalized === "csv")
+  const normalized = (raw ?? "json").trim().toLowerCase();
+  if (normalized === "json" || normalized === "csv")
     return normalized;
-  throw new Error(`Invalid --file-format '${raw}'. Use 'zip' or 'csv'.`);
+  throw new Error(`Invalid --file-format '${raw}'. Use 'json' or 'csv'.`);
 }
 function exportExamples({
   scope,
@@ -31109,31 +30104,34 @@ function exportExamples({
 }) {
   return [
     {
-      Description: `Export ${scope} audit events for January 2026 to a ZIP of day-wise files`,
-      Command: `uip admin audit ${scope} export --from-date 2026-01-01 --to-date 2026-02-01 --output-file ./audit-${scope}-jan.zip`,
+      Description: `Export ${scope} audit events for January 2026 — a timestamped folder of day-wise JSON files is created under the base dir`,
+      Command: `uip admin audit ${scope} export --from-date 2026-01-01 --to-date 2026-02-01 --output-path ./audit-exports`,
       Output: {
         Code: `Audit${codeSuffix}Export`,
         Data: {
-          Path: `./audit-${scope}-jan.zip`,
+          Path: `./audit-exports/audit_2026-01-01_2026-02-01_20260617T112630`,
+          Format: "json",
+          Files: 27,
           Bytes: 12345,
-          Format: "zip",
           Days: 31,
-          NonEmptyDays: 27
+          NonEmptyDays: 27,
+          GeneratedAt: "2026-06-17T11:26:30.000Z"
         }
       }
     },
     {
-      Description: `Export the same window into a single merged CSV instead of a ZIP`,
-      Command: `uip admin audit ${scope} export --from-date 2026-01-01 --to-date 2026-02-01 --file-format csv --output-file ./audit-${scope}-jan.csv`,
+      Description: `Export the same window into a single merged CSV (a uniquely-named .csv under the base dir) instead of a folder`,
+      Command: `uip admin audit ${scope} export --from-date 2026-01-01 --to-date 2026-02-01 --file-format csv --output-path ./audit-exports`,
       Output: {
         Code: `Audit${codeSuffix}Export`,
         Data: {
-          Path: `./audit-${scope}-jan.csv`,
-          Bytes: 98765,
+          Path: `./audit-exports/audit_2026-01-01_2026-02-01_20260617T112630.csv`,
           Format: "csv",
+          Bytes: 98765,
           Days: 31,
           NonEmptyDays: 27,
-          Events: 1234
+          Events: 1234,
+          GeneratedAt: "2026-06-17T11:26:30.000Z"
         }
       }
     }
@@ -31144,22 +30142,33 @@ function registerExport(parent, opts) {
   const cmd = parent.command("export").description([
     `Export audit events from the long-term store at the ${scope} scope.`,
     "",
-    "Issues one HTTP call per UTC day inside [--from-date, --to-date], aggregates the daily",
-    "responses in memory, and writes a single file at --output-file once the full window has",
-    "been fetched. On any chunk failure the export is aborted atomically — no file is written,",
-    "and the structured Failure result identifies the day that failed.",
+    "Issues one HTTP call per UTC day inside [--from-date, --to-date] and aggregates the daily",
+    "responses in memory before writing them out. The full window is fetched first: on any chunk",
+    "failure the export is aborted atomically — nothing is written, and the structured Failure",
+    "result identifies the day that failed.",
     "",
-    "--file-format controls the shape of that file:",
-    "  zip (default) — a ZIP containing one JSON file per UTC day.",
-    "  csv           — a single CSV with every event merged under a shared header."
+    "--output-path is a base DIRECTORY, not a file path — pass a folder and the CLI",
+    "generates the per-export name for you (you do NOT supply a filename). Each run creates",
+    "a uniquely-named output inside it, stamped with the window + generation time",
+    "(e.g. audit_2026-01-01_2026-02-01_20260617T112630), so repeated exports of the same",
+    "window never collide. --file-format controls the shape:",
+    "  json (default) — a folder of one JSON file per UTC day.",
+    "  csv            — a single CSV file with every event merged under a shared header."
   ].join(`
-`)).requiredOption("--output-file <path>", "Path to write the export to. Parent directory must exist; existing file is overwritten.").requiredOption("--from-date <iso>", "Start of time interval (ISO 8601). Required.").requiredOption("--to-date <iso>", "End of time interval (ISO 8601). Required.").option("--file-format <format>", "Exported file format: 'zip' (default — one file per UTC day inside a ZIP) or 'csv' (a single merged CSV of every event).", "zip").option("--login-validity <minutes>", "Override the interactive-login token lifetime for this call. Rarely needed.", (v) => Number.parseInt(v, 10));
+`)).option("--output-path <dir>", "Base directory for the export (created if missing). Pass a directory only — do NOT include a filename or extension; the CLI generates the per-export name. A uniquely-named output is created inside it — a folder of day-wise JSON files ('json') or a single '.csv' file ('csv'), named audit_<from>_<to>_<generated-at> (to the second) so repeated exports don't collide.").option("--output-file <dir>", "Deprecated alias for --output-path (kept for backward compatibility). Despite the name it is treated as a base DIRECTORY, not a file path. Prefer --output-path.").requiredOption("--from-date <iso>", "Start of time interval (ISO 8601). Required.").requiredOption("--to-date <iso>", "End of time interval (ISO 8601). Required.").option("--file-format <format>", "Output format: 'json' (default — day-wise JSON files written into the --output-path folder) or 'csv' (a single merged CSV of every event).", "json").option("--login-validity <minutes>", "Override the interactive-login token lifetime for this call. Rarely needed.", (v) => Number.parseInt(v, 10));
   if (scope === "tenant") {
     cmd.option("--tenant-id <guid>", "Override the tenant ID from login context.");
   }
   cmd.examples(exportExamples(opts)).trackedAction(processContext, async (options) => {
     const [error, summary] = await catchError2((async () => {
       const format = parseFormat(options.fileFormat);
+      const outputPath = options.outputPath ?? options.outputFile;
+      if (outputPath === undefined) {
+        throw new Error("Missing required option '--output-path <dir>'.");
+      }
+      if (options.outputFile !== undefined) {
+        logger.warn(options.outputPath !== undefined ? "--output-file is deprecated and ignored when --output-path is also provided; using --output-path." : "--output-file is deprecated; use --output-path instead. It is treated as a base directory.");
+      }
       const api = await createApiClient(QueryApi, {
         scope,
         tenantId: options.tenantId,
@@ -31167,17 +30176,51 @@ function registerExport(parent, opts) {
       });
       const from = new Date(options.fromDate);
       const to = new Date(options.toDate);
-      const result = format === "csv" ? await downloadChunkedCsvExport(api, from, to) : await downloadChunkedExport(api, from, to);
       const fs7 = getFileSystem();
-      const absolutePath = fs7.path.resolve(options.outputFile);
-      await fs7.writeFile(absolutePath, result.buffer);
+      const generatedAt = new Date;
+      const baseDir = fs7.path.resolve(outputPath);
+      const baseName = exportBaseName(from, to, generatedAt);
+      if (format === "csv") {
+        const result2 = await downloadChunkedCsvExport(api, from, to);
+        await fs7.mkdir(baseDir);
+        const target = fs7.path.join(baseDir, `${baseName}.csv`);
+        await fs7.writeFile(target, result2.buffer);
+        return {
+          Path: target,
+          Format: "csv",
+          Bytes: result2.buffer.byteLength,
+          Days: result2.days,
+          NonEmptyDays: result2.nonEmptyDays,
+          Events: result2.eventCount,
+          GeneratedAt: generatedAt.toISOString()
+        };
+      }
+      const result = await downloadChunkedJsonExport(api, from, to);
+      const outDir = fs7.path.join(baseDir, baseName);
+      const targets = result.files.map((file) => {
+        if (!isSafeExportEntryName(file.name)) {
+          throw new Error(`Export contained a file with an unsafe name '${file.name}'.`);
+        }
+        const target = fs7.path.join(outDir, file.name);
+        if (!isWithinDir(outDir, fs7.path.resolve(target))) {
+          throw new Error(`Export file '${file.name}' resolves outside the output folder.`);
+        }
+        return { target, data: file.data };
+      });
+      await fs7.mkdir(outDir);
+      let bytes = 0;
+      for (const { target, data } of targets) {
+        await fs7.writeFile(target, data);
+        bytes += data.byteLength;
+      }
       return {
-        Path: absolutePath,
-        Bytes: result.buffer.byteLength,
-        Format: format,
+        Path: outDir,
+        Format: "json",
+        Files: result.files.length,
+        Bytes: bytes,
         Days: result.days,
         NonEmptyDays: result.nonEmptyDays,
-        ..."eventCount" in result ? { Events: result.eventCount } : {}
+        GeneratedAt: generatedAt.toISOString()
       };
     })());
     if (error) {
@@ -31212,7 +30255,7 @@ var registerAuditCommand = (program) => {
     "  export  — chunked download from the long-term store as a ZIP of day-wise files or a single merged CSV (requires --from-date / --to-date).",
     "",
     "Typical workflow: `audit <scope> sources` (discover IDs) → `audit <scope> events --source <guid>",
-    "--from-date … --to-date …` (find the rows) → `audit <scope> export --from-date … --to-date … --output-file …`."
+    "--from-date … --to-date …` (find the rows) → `audit <scope> export --from-date … --to-date … --output-path …`."
   ].join(`
 `));
   const org = audit.command("org").description("Organization-scoped audit operations.");
@@ -31235,3 +30278,5 @@ export {
   registerCommands,
   metadata
 };
+
+//# debugId=670B4C8B265E390D64756E2164756E21