@uipath/gov-tool 1.204.0-preview.254 → 1.205.0-preview.256

package/dist/tool.js

@@ -915,6 +915,16 @@ class NodeFileSystem {
   async rename(oldPath, newPath) {
     await fs6.rename(oldPath, newPath);
   }
+  async isSymbolicLink(filePath) {
+    try {
+      return (await fs6.lstat(filePath)).isSymbolicLink();
+    } catch (error) {
+      if (this.isEnoent(error) || this.hasErrnoCode(error, "ENOTDIR")) {
+        return false;
+      }
+      throw error;
+    }
+  }
   async realpath(filePath) {
     try {
       return await fs6.realpath(filePath);
@@ -7654,7 +7664,7 @@ var package_default = {
   name: "@uipath/gov-tool",
   author: "UiPath",
   license: "SEE LICENSE IN LICENSE.txt",
-  version: "1.204.0-preview.254",
+  version: "1.205.0-preview.256",
   description: "Manage UiPath governance — AOps policies, Access policies, and compliance packs.",
   private: false,
   repository: {
@@ -7786,7 +7796,9 @@ var ErrorDimensions = {
   Result: "Result",
   ErrorCode: "ErrorCode",
   Retry: "Retry",
-  ErrorMessage: "ErrorMessage"
+  ErrorMessage: "ErrorMessage",
+  HttpStatus: "HttpStatus",
+  UpstreamErrorCode: "UpstreamErrorCode"
 };
 var AuthDimensions = {
   AuthenticationMethod: "AuthenticationMethod",
@@ -8210,7 +8222,7 @@ var package_default2 = {
   name: "@uipath/authz-sdk",
   author: "UiPath",
   license: "SEE LICENSE IN LICENSE.txt",
-  version: "1.204.0",
+  version: "1.205.0",
   description: "SDK for the UiPath Authorization Service API.",
   repository: {
     type: "git",
@@ -8921,22 +8933,12 @@ var resolveConfigAsync = async ({
     baseUrl = DEFAULT_BASE_URL;
   }
   baseUrl = normalizeAndValidateBaseUrl(baseUrl);
-  let clientId = customClientId;
-  if (!clientId && fileAuth.clientId) {
-    clientId = fileAuth.clientId;
-  }
-  if (!clientId) {
-    clientId = DEFAULT_CLIENT_ID;
-  }
-  let clientSecret = customClientSecret;
-  if (!clientSecret && fileAuth.clientSecret) {
-    clientSecret = fileAuth.clientSecret;
-  }
-  const isExternalAppAuth = clientId !== DEFAULT_CLIENT_ID && (Boolean(clientSecret) || Boolean(customClientAssertion));
+  const clientId = customClientId || DEFAULT_CLIENT_ID;
+  const isExternalAppAuth = clientId !== DEFAULT_CLIENT_ID && (Boolean(customClientSecret) || Boolean(customClientAssertion));
   const scopes = resolveScopes(isExternalAppAuth, customScopes, fileAuth.scopes);
   return {
     clientId,
-    clientSecret,
+    clientSecret: customClientSecret,
     scopes,
     baseUrl,
     authorizationEndpoint: `${baseUrl}/identity_/connect/authorize`,
@@ -9111,6 +9113,16 @@ var resolveIdentityType = (claims, authFlow, email) => {
   }
   return;
 };
+var resolveApplicationSubtype = (claims, authFlow) => {
+  switch (asString(claims?.sub_type)) {
+    case "service.external":
+      return "External";
+    case "service.internal":
+      return "Internal";
+    default:
+      return authFlow === "client_credentials" || authFlow === "federated_credentials" ? "External" : undefined;
+  }
+};
 var looksLikeEmail = (value) => value?.includes("@") ?? false;
 var pickEmail = (claims) => {
   for (const candidate of [claims?.email, claims?.preferred_username]) {
@@ -9152,6 +9164,12 @@ var resolveSessionIdentity = (accessToken, authFlow) => {
   const clientId = asString(claims?.client_id);
   if (clientId)
     identity.clientId = clientId;
+  const subType = asString(claims?.sub_type);
+  if (subType)
+    identity.subType = subType;
+  const applicationSubtype = resolveApplicationSubtype(claims, authFlow);
+  if (applicationSubtype)
+    identity.applicationSubtype = applicationSubtype;
   return identity;
 };
 var readTokenScopes = (accessToken) => accessToken ? pickScopes(decodeClaims(accessToken)) : undefined;
@@ -9446,6 +9464,40 @@ var tryRobotClientFallback = async (options = {}) => {
   }
 };
 
+// ../../auth/src/tenantSelection.ts
+var LOGIN_STATUS_HINT = "Run 'uip login status' to see the organization the CLI is signed in to.";
+var organizationHint = (organizationId) => `The request used '${organizationId}' as the organization. ${LOGIN_STATUS_HINT}`;
+var IDENTIFIER_STATUSES = new Set([400, 403, 404]);
+var describeNonJsonResponse = (organizationId, response, parseError) => {
+  if (response.redirected) {
+    return `Could not find organization '${organizationId}': the request was ` + `redirected to a sign-in page instead of the organization's tenant ` + `list. ${LOGIN_STATUS_HINT}`;
+  }
+  const contentType = response.headers.get("content-type") ?? "unknown";
+  return `The organization service returned a '${contentType}' response instead ` + `of JSON: ${parseError.message}. ${organizationHint(organizationId)}`;
+};
+var fetchTenantsAndOrganizations = async (baseUrl, accessToken, organizationId, signal) => {
+  const url = `${baseUrl}/${organizationId}/portal_/api/filtering/leftnav/tenantsAndOrganizationInfo`;
+  const response = await fetch(url, {
+    headers: {
+      Authorization: `Bearer ${accessToken}`
+    },
+    ...signal ? { signal } : {}
+  });
+  if (!response.ok) {
+    if (response.status === 401) {
+      throw new Error(`Unauthorized: the access token was rejected, it was not ` + `issued for organization '${organizationId}', or ` + `'${organizationId}' was not accepted as an organization ` + `URL segment in this environment. ` + LOGIN_STATUS_HINT);
+    }
+    const errorText = await response.text();
+    const message = `Failed to get tenants and organizations: ${response.status} ${errorText}`;
+    throw new Error(IDENTIFIER_STATUSES.has(response.status) ? `${message}. ${organizationHint(organizationId)}` : message);
+  }
+  const [parseError, data] = await catchError(response.json());
+  if (parseError) {
+    throw new Error(describeNonJsonResponse(organizationId, response, parseError));
+  }
+  return data;
+};
+
 // ../../auth/src/tokenRefresh.ts
 var TOKEN_REFRESH_REAUTHENTICATE_MESSAGE = "Token refresh failed. Run 'uip login' to re-authenticate.";
 
@@ -9660,6 +9712,8 @@ var saveEnvFileAsync = async ({
 };
 
 // ../../auth/src/loginStatus.ts
+var defaultRobotTenantIdCache = new Map;
+var ROBOT_TENANT_LOOKUP_TIMEOUT_MS = 5000;
 var getLoginStatusAsync = async (options = {}) => {
   return getLoginStatusWithDeps(options);
 };
@@ -9672,12 +9726,20 @@ var getLoginStatusWithDeps = async (options = {}, deps = {}) => {
     refreshToken: refreshTokenFn = refreshAccessToken,
     resolveConfig = resolveConfigAsync,
     robotFallback = tryRobotClientFallback,
+    fetchTenantsAndOrgs = fetchTenantsAndOrganizations,
+    robotTenantIdCache = defaultRobotTenantIdCache,
+    robotTenantLookupTimeoutMs = ROBOT_TENANT_LOOKUP_TIMEOUT_MS,
     loadBreaker = loadRefreshBreaker,
     saveBreaker = saveRefreshBreaker,
     clearBreaker = clearRefreshBreaker
   } = deps;
+  const robotDeps = {
+    fetchTenantsAndOrgs,
+    cache: robotTenantIdCache,
+    lookupTimeoutMs: robotTenantLookupTimeoutMs
+  };
   if (isRobotAuthEnforced()) {
-    return resolveRobotEnforcedStatus(robotFallback);
+    return resolveRobotEnforcedStatus(robotFallback, robotDeps);
   }
   if (isEnvAuthEnabled()) {
     return readAuthFromEnv();
@@ -9695,7 +9757,7 @@ var getLoginStatusWithDeps = async (options = {}, deps = {}) => {
         hint: `No credentials found for profile "${activeProfile}". Run 'uip login --profile ${activeProfile}' to authenticate this profile.`
       };
     }
-    return resolveBorrowedRobotStatus(robotFallback);
+    return resolveBorrowedRobotStatus(robotFallback, robotDeps);
   }
   const loaded = await loadFileCredentials(loadEnvFile, absolutePath);
   if ("status" in loaded) {
@@ -9737,7 +9799,7 @@ var getLoginStatusWithDeps = async (options = {}, deps = {}) => {
   }
   return buildFileStatus(tokens, credentials, globalHint);
 };
-async function resolveRobotEnforcedStatus(robotFallback) {
+async function resolveRobotEnforcedStatus(robotFallback, deps) {
   if (isEnvAuthEnabled()) {
     throw new EnvAuthConfigError(`${ENV_AUTH_ENABLE_VAR}=true and ${ENFORCE_ROBOT_AUTH_VAR}=true ` + `are mutually exclusive. Unset one of them and re-run.`);
   }
@@ -9748,11 +9810,11 @@ async function resolveRobotEnforcedStatus(robotFallback) {
       hint: `${ENFORCE_ROBOT_AUTH_VAR}=true but the UiPath Robot ` + `session is unavailable. Start and sign in to the Assistant, ` + `or unset ${ENFORCE_ROBOT_AUTH_VAR} to fall back to file or ` + `env-var authentication.`
     };
   }
-  return buildRobotStatus(robotCreds);
+  return buildRobotStatus(robotCreds, deps);
 }
-async function resolveBorrowedRobotStatus(robotFallback) {
+async function resolveBorrowedRobotStatus(robotFallback, deps) {
   const robotCreds = await robotFallback();
-  return robotCreds ? buildRobotStatus(robotCreds) : { loginStatus: "Not logged in" };
+  return robotCreds ? buildRobotStatus(robotCreds, deps) : { loginStatus: "Not logged in" };
 }
 async function loadFileCredentials(loadEnvFile, absolutePath) {
   let credentials;
@@ -9887,9 +9949,10 @@ function identityFields(accessToken, credentials) {
     ...scopes ? { scopes } : {}
   };
 }
-function buildRobotStatus(robotCreds) {
+async function buildRobotStatus(robotCreds, deps) {
   const identity = resolveSessionIdentity(robotCreds.accessToken);
   const scopes = readTokenScopes(robotCreds.accessToken);
+  const tenant = robotCreds.tenantId ? { tenantId: robotCreds.tenantId } : await resolveRobotTenantId(robotCreds, deps);
   return {
     loginStatus: "Logged in",
     accessToken: robotCreds.accessToken,
@@ -9897,14 +9960,62 @@ function buildRobotStatus(robotCreds) {
     organizationName: robotCreds.organizationName,
     organizationId: robotCreds.organizationId,
     tenantName: robotCreds.tenantName,
-    tenantId: robotCreds.tenantId,
+    tenantId: tenant.tenantId,
     issuer: robotCreds.issuer,
     expiration: getTokenExpiration(robotCreds.accessToken),
     source: "robot" /* Robot */,
+    ...tenant.hint ? { hint: tenant.hint } : {},
     ...identity ? { identity } : {},
     ...scopes ? { scopes } : {}
   };
 }
+async function resolveRobotTenantId(robotCreds, deps) {
+  const { baseUrl, accessToken, tenantName } = robotCreds;
+  const organization = robotCreds.organizationName ?? robotCreds.organizationId;
+  if (!tenantName || !organization) {
+    return {};
+  }
+  const key = `${baseUrl}|${organization}|${tenantName}|${accessToken}`;
+  let pending = deps.cache.get(key);
+  if (!pending) {
+    pending = catchError(lookupRobotTenantId({ baseUrl, accessToken, organization, tenantName }, deps)).then(([error, resolution]) => {
+      const settled = error ? { hint: tenantLookupFailureHint(tenantName, error.message) } : resolution;
+      if (!settled.tenantId) {
+        deps.cache.delete(key);
+      }
+      return settled;
+    });
+    deps.cache.set(key, pending);
+  }
+  return pending;
+}
+async function lookupRobotTenantId(target, deps) {
+  const { baseUrl, accessToken, organization, tenantName } = target;
+  const [error, data] = await catchError(deps.fetchTenantsAndOrgs(baseUrl, accessToken, organization, AbortSignal.timeout(deps.lookupTimeoutMs)));
+  if (error) {
+    const reason = error.name === "TimeoutError" ? `the tenant list did not answer within ${deps.lookupTimeoutMs} ms.` : error.message;
+    return { hint: tenantLookupFailureHint(tenantName, reason) };
+  }
+  const rows = data?.tenants;
+  const tenants = Array.isArray(rows) ? rows.filter((tenant) => typeof tenant?.id === "string" && typeof tenant?.name === "string") : [];
+  const wantedName = decodePathSegment(tenantName);
+  const wanted = wantedName.toLowerCase();
+  const match = tenants.find((tenant) => tenant.name === wantedName) ?? tenants.find((tenant) => tenant.name.toLowerCase() === wanted);
+  if (!match) {
+    const names = tenants.map((tenant) => tenant.name).join(", ");
+    return {
+      hint: `The Robot session targets tenant '${tenantName}', but ` + `organization '${organization}' lists no tenant of that name` + `${names ? ` (available: ${names})` : ""}. Commands that need ` + `the tenant id will fail until it can be resolved.`
+    };
+  }
+  return { tenantId: match.id };
+}
+function tenantLookupFailureHint(tenantName, reason) {
+  return `Could not resolve the id of tenant '${tenantName}' from the ` + `Robot session: ${reason} Commands that need the tenant id will ` + `fail until it can be resolved.`;
+}
+function decodePathSegment(segment) {
+  const [error, decoded] = catchError(() => decodeURIComponent(segment));
+  return error ? segment : decoded;
+}
 var isFileNotFoundError = (error) => {
   if (!(error instanceof Object))
     return false;
@@ -10148,8 +10259,6 @@ init_constants();
 // ../../auth/src/interactive.ts
 init_src();
 init_constants();
-// ../../auth/src/tenantSelection.ts
-var IDENTIFIER_STATUSES = new Set([400, 403, 404]);
 
 // ../../auth/src/selectTenant.ts
 var TENANT_SELECTION_REQUIRED_CODE = "TENANT_SELECTION_REQUIRED";
@@ -11160,7 +11269,7 @@ function setGlobalLogFilePath(path3) {
 function getGlobalLogFilePath() {
   return logFilePathSlot.get("");
 }
-var DEFAULT_LOG_LEVEL = 3 /* ERROR */;
+var DEFAULT_LOG_LEVEL = 2 /* WARN */;
 
 class SimpleLogger {
   __brand = "SimpleLogger";
@@ -12267,7 +12376,9 @@ var CLI_ERROR_CODES = [
   "timeout",
   "server_error",
   "method_not_allowed",
+  "not_supported",
   "configuration_error",
+  "execution_failed",
   "unknown_error"
 ];
 var RETRY_HINTS = [
@@ -13224,7 +13335,9 @@ var OutputFormatter;
         [ErrorDimensions.Result]: data.Result,
         [ErrorDimensions.ErrorCode]: data.ErrorCode,
         [ErrorDimensions.Retry]: data.Retry,
-        [ErrorDimensions.ErrorMessage]: data.Message
+        [ErrorDimensions.ErrorMessage]: data.Message,
+        [ErrorDimensions.HttpStatus]: data.Context?.httpStatus?.toString(),
+        [ErrorDimensions.UpstreamErrorCode]: data.Context?.errorCode
       });
     }
     logOutput(normalizeOutputKeys(envelope), getOutputFormat());
@@ -13984,6 +14097,8 @@ var BOOLEAN_FLAGS = new Set(HOST_GLOBAL_FLAGS);
 // ../../common/src/interactivity-context.ts
 var modeSlot = singleton("InteractivityMode");
 var interactiveFlagSlot = singleton("InteractiveFlag");
+// ../../common/src/json-option.ts
+init_src();
 // ../../common/src/mime-types.ts
 var MIME_TYPES_BY_EXTENSION = Object.freeze({
   pdf: "application/pdf",
@@ -14304,7 +14419,7 @@ var registerAccessPolicyCommand = (program2) => {
     "Use this to inspect the policy's selectors, rules, and enforcement before editing,",
     "or to seed a follow-up `access-policy update` (save the output, edit, then re-submit)."
   ].join(`
-`)).argument("<policyId>", "Policy UUID. Obtain from `access-policy list` (the `id` field of each result).").examples(GET_EXAMPLES)).trackedAction(processContext, async (policyId, options) => {
+`)).argument("<policy-id>", "Policy UUID. Obtain from `access-policy list` (the `id` field of each result).").examples(GET_EXAMPLES)).trackedAction(processContext, async (policyId, options) => {
     const api = await getPapApi(options);
     if (!api)
       return;
@@ -14394,7 +14509,7 @@ var registerAccessPolicyCommand = (program2) => {
     "Pass multiple IDs space-separated to delete in a single request.",
     "Deletion is permanent — use `access-policy get <id>` first if you need a backup of the definition."
   ].join(`
-`)).argument("<policyId...>", "One or more policy UUIDs. Obtain from `access-policy list`.").examples(DELETE_EXAMPLES)).trackedAction(processContext, async (policyIds, options) => {
+`)).argument("<policy-id...>", "One or more policy UUIDs. Obtain from `access-policy list`.").examples(DELETE_EXAMPLES)).trackedAction(processContext, async (policyIds, options) => {
     const api = await getPapApi(options);
     if (!api)
       return;
@@ -14748,7 +14863,7 @@ var package_default3 = {
   name: "@uipath/aops-policy-sdk",
   author: "UiPath",
   license: "SEE LICENSE IN LICENSE.txt",
-  version: "1.204.0-preview.254",
+  version: "1.205.0-preview.256",
   description: "SDK for the UiPath AOps Governance API — policy management and deployment.",
   repository: {
     type: "git",
@@ -18391,7 +18506,7 @@ var registerDeployedPolicyCommands = (aopsPolicy) => {
     "Output: the resolved policy's data payload, or `{ Message: 'No policy applies.' }` when the service returns 204",
     "(no rule matches and no default exists). Use `deployed-policy list` to see every rule, not just the effective one."
   ].join(`
-`)).argument("<license-type>", "License type (e.g. Attended, Unattended). Must match a name from `license-type list`.").argument("<product-name>", "Product name (e.g. StudioX). Must match a name from `product list`.").argument("<tenantIdentifier>", "Tenant GUID. From `deployment tenant list`.").option("--s2s-token <token>", "Service-to-service bearer token. Overrides the user token from 'uip login' for this call only. Still requires `uip login` for base URL / org context. For security, prefer setting the UIP_S2S_TOKEN environment variable — tokens passed as CLI arguments are visible in process listings (ps aux, /proc/*/cmdline).").option("--user-id <userId>", "Resolve the effective policy for this specific user (runs the full user→group→tenant walk). Requires --s2s-token.").option("--tenant-only", "Resolve the tenant-level policy only, ignoring user/group overrides. Requires --s2s-token.").option("--download [path]", "Write the resolved policy to a JSON file instead of printing it, exactly as the service returned it. [path] is the JSON file to write; a directory saves '<product name>-<policy name>.json' inside it, and leaving it off saves that name in the current directory.").option("--login-validity <minutes>", "Override the interactive-login token lifetime. Ignored when --s2s-token is set (the S2S token lifetime is controlled by the caller).", (v) => Number.parseInt(v, 10)).examples(GET_EXAMPLES2).trackedAction(processContext, async (licenseType, productName, tenantIdentifier, options) => {
+`)).argument("<license-type>", "License type (e.g. Attended, Unattended). Must match a name from `license-type list`.").argument("<product-name>", "Product name (e.g. StudioX). Must match a name from `product list`.").argument("<tenant-identifier>", "Tenant GUID. From `deployment tenant list`.").option("--s2s-token <token>", "Service-to-service bearer token. Overrides the user token from 'uip login' for this call only. Still requires `uip login` for base URL / org context. For security, prefer setting the UIP_S2S_TOKEN environment variable — tokens passed as CLI arguments are visible in process listings (ps aux, /proc/*/cmdline).").option("--user-id <userId>", "Resolve the effective policy for this specific user (runs the full user→group→tenant walk). Requires --s2s-token.").option("--tenant-only", "Resolve the tenant-level policy only, ignoring user/group overrides. Requires --s2s-token.").option("--download [path]", "Write the resolved policy to a JSON file instead of printing it, exactly as the service returned it. [path] is the JSON file to write; a directory saves '<product name>-<policy name>.json' inside it, and leaving it off saves that name in the current directory.").option("--login-validity <minutes>", "Override the interactive-login token lifetime. Ignored when --s2s-token is set (the S2S token lifetime is controlled by the caller).", (v) => Number.parseInt(v, 10)).examples(GET_EXAMPLES2).trackedAction(processContext, async (licenseType, productName, tenantIdentifier, options) => {
     const s2sToken = resolveS2sToken(options);
     const validationError = validateGetOptions(options, s2sToken);
     if (validationError) {
@@ -18490,7 +18605,7 @@ var registerDeployedPolicyCommands = (aopsPolicy) => {
     "user or use `deployed-policy get --s2s-token --user-id <id>` for the effective single policy.",
     "Returns an empty array when no rules apply."
   ].join(`
-`)).argument("<license-type>", "License type (e.g. Attended, Unattended). Must match a name from `license-type list`.").argument("<product-name>", "Product name (e.g. StudioX). Must match a name from `product list`.").argument("<tenantIdentifier>", "Tenant GUID. From `deployment tenant list`.").option("--download [path]", "Write each applicable rule to its own JSON file, exactly as the service returned it, and pack them into a zip instead of printing them. Each entry is named '<product name>-<policy name>.json'. [path] is the zip file to write; a directory saves '<product name>-deployed-policies.zip' inside it, and leaving it off saves that name in the current directory.").option("--login-validity <minutes>", "Override the interactive-login token lifetime for this call. Rarely needed.", (v) => Number.parseInt(v, 10)).examples(LIST_EXAMPLES2).trackedAction(processContext, async (licenseType, productName, tenantIdentifier, options) => {
+`)).argument("<license-type>", "License type (e.g. Attended, Unattended). Must match a name from `license-type list`.").argument("<product-name>", "Product name (e.g. StudioX). Must match a name from `product list`.").argument("<tenant-identifier>", "Tenant GUID. From `deployment tenant list`.").option("--download [path]", "Write each applicable rule to its own JSON file, exactly as the service returned it, and pack them into a zip instead of printing them. Each entry is named '<product name>-<policy name>.json'. [path] is the zip file to write; a directory saves '<product name>-deployed-policies.zip' inside it, and leaving it off saves that name in the current directory.").option("--login-validity <minutes>", "Override the interactive-login token lifetime for this call. Rarely needed.", (v) => Number.parseInt(v, 10)).examples(LIST_EXAMPLES2).trackedAction(processContext, async (licenseType, productName, tenantIdentifier, options) => {
     const download = downloadTarget(options.download);
     const [error, result] = await catchError2((async () => {
       const api = await createApiClient2(PolicyApi, {
@@ -18681,7 +18796,7 @@ var registerDeploymentGroupCommands = (deployment) => {
     "Returns only group-level overrides — tenant inheritance is NOT resolved here.",
     "Returns an empty array when the group has no overrides."
   ].join(`
-`)).argument("<groupIdentifier>", "Group GUID. From `deployment group list` (the `identifier` field).").option("--login-validity <minutes>", "Override the interactive-login token lifetime for this call. Rarely needed.", (v) => Number.parseInt(v, 10)).examples(GET_EXAMPLES3).trackedAction(processContext, async (groupIdentifier, options) => {
+`)).argument("<group-identifier>", "Group GUID. From `deployment group list` (the `identifier` field).").option("--login-validity <minutes>", "Override the interactive-login token lifetime for this call. Rarely needed.", (v) => Number.parseInt(v, 10)).examples(GET_EXAMPLES3).trackedAction(processContext, async (groupIdentifier, options) => {
     const [error, result] = await catchError2((async () => {
       const api = await createApiClient2(PolicyApi, {
         loginValidity: options.loginValidity
@@ -18731,7 +18846,7 @@ var registerDeploymentGroupCommands = (deployment) => {
     "  policyIdentifier = null — pins 'No Policy' at group level (blocks tenant inheritance for members).",
     "  policyIdentifier = GUID — pins that policy for this group + product."
   ].join(`
-`)).argument("<groupIdentifier>", "Group GUID to configure. From `deployment group list`, or the upstream identity provider.").requiredOption("--group <group>", "Display name stored alongside the override (surfaced in audit logs / UI).").requiredOption("--input <path>", "Path to the JSON file holding the assignment array (see command description for the shape).").option("--source <source>", "Identity-provider source for the group (e.g. 'local', 'aad', 'cloud'). Defaults to 'local'. Used only on the upsert path (when the group already exists in governance); on first-time registration the server resolves source from CIS.", "local").option("--login-validity <minutes>", "Override the interactive-login token lifetime for this call. Rarely needed.", (v) => Number.parseInt(v, 10)).examples(CONFIGURE_EXAMPLES).trackedAction(processContext, async (groupIdentifier, options) => {
+`)).argument("<group-identifier>", "Group GUID to configure. From `deployment group list`, or the upstream identity provider.").requiredOption("--group <group>", "Display name stored alongside the override (surfaced in audit logs / UI).").requiredOption("--input <path>", "Path to the JSON file holding the assignment array (see command description for the shape).").option("--source <source>", "Identity-provider source for the group (e.g. 'local', 'aad', 'cloud'). Defaults to 'local'. Used only on the upsert path (when the group already exists in governance); on first-time registration the server resolves source from CIS.", "local").option("--login-validity <minutes>", "Override the interactive-login token lifetime for this call. Rarely needed.", (v) => Number.parseInt(v, 10)).examples(CONFIGURE_EXAMPLES).trackedAction(processContext, async (groupIdentifier, options) => {
     const [error, result] = await catchError2((async () => {
       const raw = await readJsonFile(options.input);
       const entries = parseGroupPolicyInput(raw);
@@ -18790,7 +18905,7 @@ var registerDeploymentGroupCommands = (deployment) => {
     "After deletion, the group's members fall back to user-level or tenant-level assignments.",
     "The group itself remains in the upstream identity provider — this only clears governance state."
   ].join(`
-`)).argument("<groupIdentifier>", "Group GUID to delete. From `deployment group list`.").option("--login-validity <minutes>", "Override the interactive-login token lifetime for this call. Rarely needed.", (v) => Number.parseInt(v, 10)).examples(DELETE_EXAMPLES2).trackedAction(processContext, async (groupIdentifier, options) => {
+`)).argument("<group-identifier>", "Group GUID to delete. From `deployment group list`.").option("--login-validity <minutes>", "Override the interactive-login token lifetime for this call. Rarely needed.", (v) => Number.parseInt(v, 10)).examples(DELETE_EXAMPLES2).trackedAction(processContext, async (groupIdentifier, options) => {
     const [error, result] = await catchError2((async () => {
       const api = await createApiClient2(GroupApi, {
         loginValidity: options.loginValidity
@@ -18979,7 +19094,7 @@ var registerDeploymentTenantCommands = (deployment) => {
     "Fetch one tenant and the full list of its (productIdentifier, licenseTypeIdentifier, policyIdentifier)",
     "assignments. Use this to inspect current state before editing and re-submitting via `tenant configure`."
   ].join(`
-`)).argument("<tenantIdentifier>", "Tenant GUID. Obtain from `deployment tenant list` (the `identifier` field).").option("--login-validity <minutes>", "Override the interactive-login token lifetime for this call. Rarely needed.", (v) => Number.parseInt(v, 10)).examples(GET_EXAMPLES4).trackedAction(processContext, async (tenantIdentifier, options) => {
+`)).argument("<tenant-identifier>", "Tenant GUID. Obtain from `deployment tenant list` (the `identifier` field).").option("--login-validity <minutes>", "Override the interactive-login token lifetime for this call. Rarely needed.", (v) => Number.parseInt(v, 10)).examples(GET_EXAMPLES4).trackedAction(processContext, async (tenantIdentifier, options) => {
     const [error, result] = await catchError2((async () => {
       const api = await createApiClient2(TenantApi, {
         loginValidity: options.loginValidity
@@ -19028,7 +19143,7 @@ var registerDeploymentTenantCommands = (deployment) => {
     "  Set policyIdentifier to null — pins 'No Policy' at tenant level (blocks inheritance).",
     "  Set policyIdentifier to a GUID — pins that policy for this (product, license type)."
   ].join(`
-`)).argument("<tenantIdentifier>", "Tenant GUID to configure. From `deployment tenant list`.").requiredOption("--tenant-name <tenantName>", "Tenant display name. Must match the tenant's name in the governance service (from `tenant get`/`tenant list`).").requiredOption("--input <path>", "Path to the JSON file holding the assignment array (see command description for the shape).").option("--login-validity <minutes>", "Override the interactive-login token lifetime for this call. Rarely needed.", (v) => Number.parseInt(v, 10)).examples(CONFIGURE_EXAMPLES2).trackedAction(processContext, async (tenantIdentifier, options) => {
+`)).argument("<tenant-identifier>", "Tenant GUID to configure. From `deployment tenant list`.").requiredOption("--tenant-name <tenantName>", "Tenant display name. Must match the tenant's name in the governance service (from `tenant get`/`tenant list`).").requiredOption("--input <path>", "Path to the JSON file holding the assignment array (see command description for the shape).").option("--login-validity <minutes>", "Override the interactive-login token lifetime for this call. Rarely needed.", (v) => Number.parseInt(v, 10)).examples(CONFIGURE_EXAMPLES2).trackedAction(processContext, async (tenantIdentifier, options) => {
     const [error, result] = await catchError2((async () => {
       const raw = await readJsonFile(options.input);
       const entries = parseTenantPolicyInput(raw);
@@ -19085,7 +19200,7 @@ var registerDeploymentTenantCommands = (deployment) => {
     "",
     "Output includes both the removed entries and the new tenantPolicies snapshot so you can audit the change."
   ].join(`
-`)).argument("<tenantIdentifier>", "Tenant GUID. From `deployment tenant list`.").requiredOption("--product-name <product-name>", "Product to unpin (e.g. StudioX). Matches the `productIdentifier` field on the tenant's saved entries.").option("--license-type <license-type>", "Narrow the removal to one license type. Omit to remove every license-type entry for the product.").option("--login-validity <minutes>", "Override the interactive-login token lifetime for this call. Rarely needed.", (v) => Number.parseInt(v, 10)).examples(REMOVE_EXAMPLES).trackedAction(processContext, async (tenantIdentifier, options) => {
+`)).argument("<tenant-identifier>", "Tenant GUID. From `deployment tenant list`.").requiredOption("--product-name <product-name>", "Product to unpin (e.g. StudioX). Matches the `productIdentifier` field on the tenant's saved entries.").option("--license-type <license-type>", "Narrow the removal to one license type. Omit to remove every license-type entry for the product.").option("--login-validity <minutes>", "Override the interactive-login token lifetime for this call. Rarely needed.", (v) => Number.parseInt(v, 10)).examples(REMOVE_EXAMPLES).trackedAction(processContext, async (tenantIdentifier, options) => {
     const [error, result] = await catchError2((async () => {
       const tenantApi = await createApiClient2(TenantApi, {
         loginValidity: options.loginValidity
@@ -19271,7 +19386,7 @@ var registerDeploymentUserCommands = (deployment) => {
     "For the effective policy that actually applies at runtime, use `deployed-policy get` with --user-id.",
     "Returns an empty array when the user has no overrides."
   ].join(`
-`)).argument("<userIdentifier>", "User GUID. From `deployment user list` (the `identifier` field).").option("--login-validity <minutes>", "Override the interactive-login token lifetime for this call. Rarely needed.", (v) => Number.parseInt(v, 10)).examples(GET_EXAMPLES5).trackedAction(processContext, async (userIdentifier, options) => {
+`)).argument("<user-identifier>", "User GUID. From `deployment user list` (the `identifier` field).").option("--login-validity <minutes>", "Override the interactive-login token lifetime for this call. Rarely needed.", (v) => Number.parseInt(v, 10)).examples(GET_EXAMPLES5).trackedAction(processContext, async (userIdentifier, options) => {
     const [error, result] = await catchError2((async () => {
       const api = await createApiClient2(PolicyApi, {
         loginValidity: options.loginValidity
@@ -19321,7 +19436,7 @@ var registerDeploymentUserCommands = (deployment) => {
     "  policyIdentifier = null — pins 'No Policy' at user level (blocks group/tenant inheritance).",
     "  policyIdentifier = GUID — pins that policy for this user + product."
   ].join(`
-`)).argument("<userIdentifier>", "User GUID to configure. From `deployment user list`, or the upstream identity provider.").requiredOption("--user <user>", "Display name stored alongside the override (surfaced in audit logs / UI).").requiredOption("--input <path>", "Path to the JSON file holding the assignment array (see command description for the shape).").option("--source <source>", "Identity-provider source for the user (e.g. 'local', 'aad', 'cloud'). Defaults to 'local'. Used only on the upsert path (when the user already exists in governance); on first-time registration the server resolves source from CIS.", "local").option("--email <email>", "Email used only when registering a brand-new user with the governance service. Ignored once the user is already known to governance. Defaults to --user when omitted.").option("--login-validity <minutes>", "Override the interactive-login token lifetime for this call. Rarely needed.", (v) => Number.parseInt(v, 10)).examples(CONFIGURE_EXAMPLES3).trackedAction(processContext, async (userIdentifier, options) => {
+`)).argument("<user-identifier>", "User GUID to configure. From `deployment user list`, or the upstream identity provider.").requiredOption("--user <user>", "Display name stored alongside the override (surfaced in audit logs / UI).").requiredOption("--input <path>", "Path to the JSON file holding the assignment array (see command description for the shape).").option("--source <source>", "Identity-provider source for the user (e.g. 'local', 'aad', 'cloud'). Defaults to 'local'. Used only on the upsert path (when the user already exists in governance); on first-time registration the server resolves source from CIS.", "local").option("--email <email>", "Email used only when registering a brand-new user with the governance service. Ignored once the user is already known to governance. Defaults to --user when omitted.").option("--login-validity <minutes>", "Override the interactive-login token lifetime for this call. Rarely needed.", (v) => Number.parseInt(v, 10)).examples(CONFIGURE_EXAMPLES3).trackedAction(processContext, async (userIdentifier, options) => {
     const [error, result] = await catchError2((async () => {
       const raw = await readJsonFile(options.input);
       const entries = parseUserPolicyInput(raw);
@@ -19380,7 +19495,7 @@ var registerDeploymentUserCommands = (deployment) => {
     "After deletion, the user falls back to group/tenant inheritance for all products.",
     "Equivalent to `user configure` with an empty array but doesn't require a JSON file."
   ].join(`
-`)).argument("<userIdentifier>", "User GUID whose overrides should be cleared. From `deployment user list`.").option("--login-validity <minutes>", "Override the interactive-login token lifetime for this call. Rarely needed.", (v) => Number.parseInt(v, 10)).examples(DELETE_EXAMPLES3).trackedAction(processContext, async (userIdentifier, options) => {
+`)).argument("<user-identifier>", "User GUID whose overrides should be cleared. From `deployment user list`.").option("--login-validity <minutes>", "Override the interactive-login token lifetime for this call. Rarely needed.", (v) => Number.parseInt(v, 10)).examples(DELETE_EXAMPLES3).trackedAction(processContext, async (userIdentifier, options) => {
     const [error, result] = await catchError2((async () => {
       const api = await createApiClient2(UserApi, {
         loginValidity: options.loginValidity
@@ -19526,12 +19641,12 @@ var registerProductCommands = (aopsPolicy) => {
     "Inspect the catalog of products that publish governance templates to this organization.",
     "Products are read-only — they're registered by the governance service, not created via the CLI.",
     "Use these commands to discover valid values for the --product-name option on `policy create/update`,",
-    "the <productIdentifier> argument on `template get`, and `deployment tenant|user|group configure` entries."
+    "the <product-identifier> argument on `template get`, and `deployment tenant|user|group configure` entries."
   ].join(`
 `));
   product.command("list").description([
     "List every product visible to the organization, with its name, label, and identifier.",
-    "The `name` field is what `policy create --product-name`, `template get <productIdentifier>`,",
+    "The `name` field is what `policy create --product-name`, `template get <product-identifier>`,",
     "and `deployment … configure` entries expect. The `label` is the human-readable display name."
   ].join(`
 `)).option("--login-validity <minutes>", "Override the interactive-login token lifetime for this call. Rarely needed.", (v) => Number.parseInt(v, 10)).examples(LIST_EXAMPLES7).trackedAction(processContext, async (options) => {
@@ -19556,7 +19671,7 @@ var registerProductCommands = (aopsPolicy) => {
       Data: result ?? []
     });
   });
-  product.command("get").description("Fetch a single product record (name, label, identifier, flags). Use to verify a name is valid before calling `policy create` or `template get`.").argument("<productIdentifier>", "Product name (e.g. StudioX) or GUID. Either the `name` or the `identifier` from `product list` is accepted.").option("--login-validity <minutes>", "Override the interactive-login token lifetime for this call. Rarely needed.", (v) => Number.parseInt(v, 10)).examples(GET_EXAMPLES6).trackedAction(processContext, async (productIdentifier, options) => {
+  product.command("get").description("Fetch a single product record (name, label, identifier, flags). Use to verify a name is valid before calling `policy create` or `template get`.").argument("<product-identifier>", "Product name (e.g. StudioX) or GUID. Either the `name` or the `identifier` from `product list` is accepted.").option("--login-validity <minutes>", "Override the interactive-login token lifetime for this call. Rarely needed.", (v) => Number.parseInt(v, 10)).examples(GET_EXAMPLES6).trackedAction(processContext, async (productIdentifier, options) => {
     const [error, result] = await catchError2((async () => {
       const api = await createApiClient2(ProductApi, {
         loginValidity: options.loginValidity
@@ -21882,7 +21997,7 @@ var registerTemplateCommands = (aopsPolicy) => {
     "     when creating or updating a policy."
   ].join(`
 `));
-  template.command("get").description("Fetch the active Form.io policy template for one product and emit policy artifacts. " + "Pass --output-form-data to write the fillable blueprint (the object you fill in and submit back on create/update); display-only components (hidden, button, submit, HTML, content) are skipped and missing leaves get type-appropriate defaults (false for checkbox, [] for editgrid, {} for selectboxes, null for text/select). " + "Pass --output-template-locale-resource to write a human-readable reference derived from the DTO: every product-scoped locale key is replaced with its English string (with a sibling `<prop>-key` preserving the original for traceability) and `defaultData.data` is replaced with a flat annotated map ({ value, type, label, description?, tooltip? }); cross-product prefixes (e.g. `AutomationOps.submit`) are left unresolved. " + "If neither --output flag is passed, the template and form-data are returned in the stdout Success payload (`Data.template` and `Data.formData`) for piping/scripting.").argument("<productIdentifier>", "Product name or identifier (e.g. StudioX, AITrustLayer). Use 'uip gov aops-policy product list' to list options.").option("--output-form-data <path>", "Write the fillable form-data blueprint JSON (the object you edit and submit back).").option("--output-template-locale-resource <path>", "Write the locale-resolved template reference JSON (open this to understand every field, option label, description, tooltip, and validation message).").option("--login-validity <minutes>", "Login token validity in minutes", (v) => Number.parseInt(v, 10)).examples(GET_EXAMPLES7).trackedAction(processContext, async (productIdentifier, options) => {
+  template.command("get").description("Fetch the active Form.io policy template for one product and emit policy artifacts. " + "Pass --output-form-data to write the fillable blueprint (the object you fill in and submit back on create/update); display-only components (hidden, button, submit, HTML, content) are skipped and missing leaves get type-appropriate defaults (false for checkbox, [] for editgrid, {} for selectboxes, null for text/select). " + "Pass --output-template-locale-resource to write a human-readable reference derived from the DTO: every product-scoped locale key is replaced with its English string (with a sibling `<prop>-key` preserving the original for traceability) and `defaultData.data` is replaced with a flat annotated map ({ value, type, label, description?, tooltip? }); cross-product prefixes (e.g. `AutomationOps.submit`) are left unresolved. " + "If neither --output flag is passed, the template and form-data are returned in the stdout Success payload (`Data.template` and `Data.formData`) for piping/scripting.").argument("<product-identifier>", "Product name or identifier (e.g. StudioX, AITrustLayer). Use 'uip gov aops-policy product list' to list options.").option("--output-form-data <path>", "Write the fillable form-data blueprint JSON (the object you edit and submit back).").option("--output-template-locale-resource <path>", "Write the locale-resolved template reference JSON (open this to understand every field, option label, description, tooltip, and validation message).").option("--login-validity <minutes>", "Login token validity in minutes", (v) => Number.parseInt(v, 10)).examples(GET_EXAMPLES7).trackedAction(processContext, async (productIdentifier, options) => {
     const [templateError, dto] = await catchError2((async () => {
       const api = await createApiClient2(ContentApi, {
         loginValidity: options.loginValidity
@@ -22280,7 +22395,7 @@ var registerAopsPolicyCommand = (program2) => {
     "Use this to inspect what values were submitted, or to seed a follow-up `policy update`",
     "(edit the returned data, save it to a JSON file, pass it back via --input)."
   ].join(`
-`)).argument("<policyIdentifier>", "Policy GUID. Obtain from `policy list` (the `identifier` field of each returned policy).").option("--download [path]", "Write the policy to a JSON file instead of printing it: the raw body of the service's download endpoint (GET /api/Policy/{id}/download) — { policy-name, description, availability, version, product-name, data }, form data included, keys exactly as the service sent them. [path] is the JSON file to write; a directory saves '<product name>-<policy name>.json' inside it, and leaving it off saves that name in the current directory.").option("--login-validity <minutes>", "Override the interactive-login token lifetime for this call. Rarely needed.", (v) => Number.parseInt(v, 10)).examples(GET_EXAMPLES8).trackedAction(processContext, async (policyIdentifier, options) => {
+`)).argument("<policy-identifier>", "Policy GUID. Obtain from `policy list` (the `identifier` field of each returned policy).").option("--download [path]", "Write the policy to a JSON file instead of printing it: the raw body of the service's download endpoint (GET /api/Policy/{id}/download) — { policy-name, description, availability, version, product-name, data }, form data included, keys exactly as the service sent them. [path] is the JSON file to write; a directory saves '<product name>-<policy name>.json' inside it, and leaving it off saves that name in the current directory.").option("--login-validity <minutes>", "Override the interactive-login token lifetime for this call. Rarely needed.", (v) => Number.parseInt(v, 10)).examples(GET_EXAMPLES8).trackedAction(processContext, async (policyIdentifier, options) => {
     const download = downloadTarget(options.download);
     if (download.requested) {
       const [downloadError, written] = await catchError2((async () => {
@@ -22421,7 +22536,7 @@ var registerAopsPolicyCommand = (program2) => {
     "`deployment tenant|user|group remove` (or `configure` with a filtered list) on every subject first,",
     "then retry delete."
   ].join(`
-`)).argument("<policyIdentifier>", "Policy GUID to delete. From `policy list`.").option("--login-validity <minutes>", "Override the interactive-login token lifetime for this call. Rarely needed.", (v) => Number.parseInt(v, 10)).examples(DELETE_EXAMPLES4).trackedAction(processContext, async (policyIdentifier, options) => {
+`)).argument("<policy-identifier>", "Policy GUID to delete. From `policy list`.").option("--login-validity <minutes>", "Override the interactive-login token lifetime for this call. Rarely needed.", (v) => Number.parseInt(v, 10)).examples(DELETE_EXAMPLES4).trackedAction(processContext, async (policyIdentifier, options) => {
     const [error, result] = await catchError2((async () => {
       const api = await createApiClient2(PolicyApi, {
         loginValidity: options.loginValidity
@@ -22699,7 +22814,7 @@ var package_default4 = {
   name: "@uipath/compliance-packs-sdk",
   author: "UiPath",
   license: "SEE LICENSE IN LICENSE.txt",
-  version: "1.204.0",
+  version: "1.205.0",
   description: "SDK for the UiPath Governance Server Compliance Packs API.",
   repository: {
     type: "git",
@@ -23913,4 +24028,4 @@ export {
   registerCommands
 };
 
-//# debugId=7ED981E4F2C128D864756E2164756E21
+//# debugId=6E546F401684292F64756E2164756E21

package/package.json

@@ -2,7 +2,7 @@
     "name": "@uipath/gov-tool",
     "author": "UiPath",
     "license": "SEE LICENSE IN LICENSE.txt",
-    "version": "1.204.0-preview.254",
+    "version": "1.205.0-preview.256",
     "description": "Manage UiPath governance — AOps policies, Access policies, and compliance packs.",
     "private": false,
     "repository": {
@@ -24,5 +24,5 @@
     "files": [
         "dist"
     ],
-    "gitHead": "3ee79cdec05b36231a8da9e8de6bf0043585526a"
+    "gitHead": "63740c6cbb7ff282fa9118cc16a148eb030b245f"
 }