@uipath/identity-tool 1.1.0 → 1.2.0

package/dist/tool.js

@@ -667,6 +667,7 @@ var init_open = __esm(() => {
 });
 
 // ../../filesystem/src/node.ts
+import { randomUUID } from "node:crypto";
 import { existsSync } from "node:fs";
 import * as fs6 from "node:fs/promises";
 import * as os2 from "node:os";
@@ -748,6 +749,90 @@ class NodeFileSystem {
   async mkdir(dirPath) {
     await fs6.mkdir(dirPath, { recursive: true });
   }
+  async acquireLock(lockPath) {
+    const canonicalPath = await this.canonicalizeLockTarget(lockPath);
+    const lockFile = `${canonicalPath}.lock`;
+    const ownerId = randomUUID();
+    const start = Date.now();
+    while (true) {
+      try {
+        await fs6.writeFile(lockFile, ownerId, { flag: "wx" });
+        return this.createLockRelease(lockFile, ownerId);
+      } catch (error) {
+        if (!this.hasErrnoCode(error, "EEXIST")) {
+          throw error;
+        }
+        const stats = await fs6.stat(lockFile).catch(() => null);
+        if (stats && Date.now() - stats.mtimeMs > LOCK_STALE_MS) {
+          const reclaimed = await fs6.rm(lockFile, { force: true }).then(() => true).catch(() => false);
+          if (reclaimed)
+            continue;
+        }
+        if (Date.now() - start > LOCK_MAX_WAIT_MS) {
+          throw new Error(`ELOCKED: timed out waiting for lock on ${canonicalPath}`);
+        }
+        await new Promise((resolve2) => setTimeout(resolve2, LOCK_RETRY_MIN_MS + Math.random() * LOCK_RETRY_JITTER_MS));
+      }
+    }
+  }
+  async canonicalizeLockTarget(lockPath) {
+    const absolute = path2.resolve(lockPath);
+    const fullReal = await fs6.realpath(absolute).catch(() => null);
+    if (fullReal)
+      return fullReal;
+    const parent = path2.dirname(absolute);
+    const base = path2.basename(absolute);
+    const canonicalParent = await fs6.realpath(parent).catch(() => parent);
+    return path2.join(canonicalParent, base);
+  }
+  createLockRelease(lockFile, ownerId) {
+    const heartbeatStart = Date.now();
+    let heartbeatTimer;
+    let stopped = false;
+    const stopHeartbeat = () => {
+      stopped = true;
+      if (heartbeatTimer)
+        clearTimeout(heartbeatTimer);
+    };
+    const scheduleNextHeartbeat = () => {
+      if (stopped)
+        return;
+      if (Date.now() - heartbeatStart >= LOCK_MAX_HOLD_MS) {
+        stopped = true;
+        return;
+      }
+      heartbeatTimer = setTimeout(() => {
+        runHeartbeat();
+      }, LOCK_HEARTBEAT_MS);
+      heartbeatTimer.unref?.();
+    };
+    const runHeartbeat = async () => {
+      if (stopped)
+        return;
+      const current = await fs6.readFile(lockFile, "utf-8").catch(() => null);
+      if (stopped)
+        return;
+      if (current !== ownerId) {
+        stopped = true;
+        return;
+      }
+      const now = Date.now() / 1000;
+      await fs6.utimes(lockFile, now, now).catch(() => {});
+      scheduleNextHeartbeat();
+    };
+    scheduleNextHeartbeat();
+    let released = false;
+    return async () => {
+      if (released)
+        return;
+      released = true;
+      stopHeartbeat();
+      const current = await fs6.readFile(lockFile, "utf-8").catch(() => null);
+      if (current === ownerId) {
+        await fs6.rm(lockFile, { force: true });
+      }
+    };
+  }
   async rm(filePath) {
     await fs6.rm(filePath, { recursive: true, force: true });
   }
@@ -793,9 +878,13 @@ class NodeFileSystem {
     }
   }
   isEnoent(error) {
-    return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+    return this.hasErrnoCode(error, "ENOENT");
+  }
+  hasErrnoCode(error, code) {
+    return typeof error === "object" && error !== null && "code" in error && error.code === code;
   }
 }
+var LOCK_HEARTBEAT_MS = 5000, LOCK_STALE_MS = 15000, LOCK_MAX_WAIT_MS = 20000, LOCK_MAX_HOLD_MS = 60000, LOCK_RETRY_MIN_MS = 100, LOCK_RETRY_JITTER_MS = 200;
 var init_node = __esm(() => {
   init_open();
 });
@@ -2941,7 +3030,7 @@ function isBrowser() {
 
 // ../../../node_modules/@uipath/coreipc/index.js
 var require_coreipc = __commonJS((exports, module) => {
-  var __dirname = "/Users/alexandru.oltean/github/cli/node_modules/@uipath/coreipc";
+  var __dirname = "/home/runner/work/cli/cli/node_modules/@uipath/coreipc";
   /*! For license information please see index.js.LICENSE.txt */
   (function(e, t) {
     typeof exports == "object" && typeof module == "object" ? module.exports = t() : typeof define == "function" && define.amd ? define([], t) : typeof exports == "object" ? exports.ipc = t() : e.ipc = t();
@@ -21133,10 +21222,15 @@ var require_dist = __commonJS((exports) => {
   exports.RobotProxyConstructor = RobotProxyConstructor;
   __exportStar(require_agent(), exports);
 });
+// ../../auth/src/server.ts
+var init_server = __esm(() => {
+  init_constants();
+});
 // package.json
 var package_default = {
   name: "@uipath/identity-tool",
-  version: "1.1.0",
+  license: "MIT",
+  version: "1.2.0",
   description: "Manage Identity Server users, groups, robot accounts, and external apps.",
   private: false,
   repository: {
@@ -21313,10 +21407,15 @@ async function extractErrorDetails(error, options) {
   }
   if (parsedBody?.errorCode && typeof parsedBody.errorCode === "string") {
     context.errorCode = parsedBody.errorCode;
+  } else if (parsedBody?.code && typeof parsedBody.code === "string") {
+    context.errorCode = parsedBody.code;
   }
   if (parsedBody?.requestId && typeof parsedBody.requestId === "string") {
     context.requestId = parsedBody.requestId;
   }
+  if (parsedBody?.traceId && typeof parsedBody.traceId === "string") {
+    context.traceId = parsedBody.traceId;
+  }
   if (status === 429) {
     const resp = response;
     const headersObj = resp?.headers;
@@ -21336,7 +21435,35 @@ async function extractErrorDetails(error, options) {
     }
   }
   const hasContext = Object.keys(context).length > 0;
-  return { result, message, details, ...hasContext ? { context } : {} };
+  let parsedErrors;
+  if (parsedBody?.errors && typeof parsedBody.errors === "object") {
+    const errors = {};
+    for (const [field, raw] of Object.entries(parsedBody.errors)) {
+      if (Array.isArray(raw)) {
+        const messages = raw.map((entry) => {
+          if (typeof entry === "string")
+            return entry;
+          if (entry && typeof entry === "object" && typeof entry.message === "string") {
+            return entry.message;
+          }
+          return String(entry);
+        }).filter(Boolean);
+        if (messages.length > 0)
+          errors[field] = messages;
+      } else if (typeof raw === "string") {
+        errors[field] = [raw];
+      }
+    }
+    if (Object.keys(errors).length > 0)
+      parsedErrors = errors;
+  }
+  return {
+    result,
+    message,
+    details,
+    ...hasContext ? { context } : {},
+    ...parsedErrors ? { parsedErrors } : {}
+  };
 }
 async function extractErrorMessage(error, options) {
   const { message } = await extractErrorDetails(error, options);
@@ -26484,6 +26611,60 @@ function escapeNonAscii(jsonText) {
 function needsAsciiSafeJson(sink) {
   return process.platform === "win32" && !sink.capabilities.isInteractive;
 }
+function isPlainRecord(value) {
+  if (value === null || typeof value !== "object")
+    return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+function toLowerCamelCaseKey(key) {
+  if (!key)
+    return key;
+  if (/[_\-\s]/.test(key)) {
+    const [firstPart, ...restParts] = key.split(/[_\-\s]+/).filter(Boolean);
+    if (!firstPart)
+      return key;
+    return [
+      toLowerCamelCaseSimpleKey(firstPart),
+      ...restParts.map((part) => {
+        const normalized = toLowerCamelCaseSimpleKey(part);
+        return normalized.charAt(0).toUpperCase() + normalized.slice(1);
+      })
+    ].join("");
+  }
+  return toLowerCamelCaseSimpleKey(key);
+}
+function toLowerCamelCaseSimpleKey(key) {
+  if (/^[A-Z0-9]+$/.test(key))
+    return key.toLowerCase();
+  return key.replace(/^[A-Z]+(?=[A-Z][a-z]|\d|$)|^[A-Z]/, (match) => match.toLowerCase());
+}
+function toPascalCaseKey(key) {
+  const lowerCamelKey = toLowerCamelCaseKey(key);
+  return lowerCamelKey ? lowerCamelKey.charAt(0).toUpperCase() + lowerCamelKey.slice(1) : lowerCamelKey;
+}
+function toPascalCaseData(value) {
+  if (Array.isArray(value))
+    return value.map(toPascalCaseData);
+  if (!isPlainRecord(value))
+    return value;
+  const result = {};
+  for (const [key, nestedValue] of Object.entries(value)) {
+    result[toPascalCaseKey(key)] = toPascalCaseData(nestedValue);
+  }
+  return result;
+}
+function normalizeDataKeys(data) {
+  return toPascalCaseData(data);
+}
+function normalizeOutputKeys(data) {
+  const result = {};
+  for (const [key, value] of Object.entries(data)) {
+    const pascalKey = toPascalCaseKey(key);
+    result[pascalKey] = pascalKey === "Data" ? value : toPascalCaseData(value);
+  }
+  return result;
+}
 function printOutput(data, format = "json", logFn, asciiSafe = false) {
   if (!data) {
     logFn("Empty response object. No data to display.");
@@ -26546,7 +26727,7 @@ function wrapText(text, width) {
 function printTable(data, logFn, externalLogValue) {
   if (data.length === 0)
     return;
-  const keys = Object.keys(data[0]).filter((key) => key !== "Code" && key !== "Log");
+  const keys = Object.keys(data[0]).filter((key) => !["code", "log"].includes(key.toLowerCase()));
   const maxWidths = keys.map((key) => Math.max(key.length, ...data.map((item) => cellToString(item[key]).length)));
   const header = keys.map((key, i2) => key.padEnd(maxWidths[i2])).join(" | ");
   logFn(header);
@@ -26561,7 +26742,7 @@ function printTable(data, logFn, externalLogValue) {
   }
 }
 function printVerticalTable(data, logFn = console.log, externalLogValue) {
-  const keys = Object.keys(data).filter((key) => key !== "Code" && key !== "Log");
+  const keys = Object.keys(data).filter((key) => !["code", "log"].includes(key.toLowerCase()));
   if (keys.length === 0)
     return;
   const maxKeyWidth = Math.max(...keys.map((key) => key.length));
@@ -26577,7 +26758,7 @@ function printVerticalTable(data, logFn = console.log, externalLogValue) {
 function printResizableTable(data, logFn = console.log, externalLogValue) {
   if (data.length === 0)
     return;
-  const keys = Object.keys(data[0]).filter((key) => key !== "Code" && key !== "Log");
+  const keys = Object.keys(data[0]).filter((key) => !["code", "log"].includes(key.toLowerCase()));
   if (keys.length === 0)
     return;
   if (!process.stdout.isTTY) {
@@ -26653,8 +26834,26 @@ function printResizableTable(data, logFn = console.log, externalLogValue) {
 function toYaml(data) {
   return dump(data);
 }
+class FilterEvaluationError extends Error {
+  __brand = "FilterEvaluationError";
+  filter;
+  instructions;
+  result = RESULTS.ValidationError;
+  constructor(filter, cause) {
+    const underlying = cause instanceof Error ? cause.message : String(cause);
+    super(`Filter '${filter}' failed to evaluate: ${underlying}`);
+    this.name = "FilterEvaluationError";
+    this.filter = filter;
+    this.instructions = `The --output-filter expression '${filter}' failed at evaluation time. ` + "Note that --output-filter operates on the 'Data' field of the envelope, not the full object. " + "For example, on a list result use 'length(@)' instead of 'Data | length(@)'.";
+  }
+}
 function applyFilter(data, filter) {
-  const result = search(data, filter);
+  let result;
+  try {
+    result = search(data, filter);
+  } catch (err) {
+    throw new FilterEvaluationError(filter, err);
+  }
   if (result == null)
     return [];
   if (Array.isArray(result)) {
@@ -26671,13 +26870,18 @@ function applyFilter(data, filter) {
 }
 var OutputFormatter;
 ((OutputFormatter) => {
-  function success(data) {
+  function success(data, options) {
     data.Log ??= getLogFilePath() || undefined;
+    const normalize = !options?.preserveDataKeys;
+    if (normalize) {
+      data.Data = normalizeDataKeys(data.Data);
+    }
     const filter = getOutputFilter();
     if (filter) {
-      data.Data = applyFilter(data.Data, filter);
+      const filtered = applyFilter(data.Data, filter);
+      data.Data = normalize ? normalizeDataKeys(filtered) : filtered;
     }
-    logOutput(data, getOutputFormat());
+    logOutput(normalizeOutputKeys(data), getOutputFormat());
   }
   OutputFormatter.success = success;
   function error(data) {
@@ -26687,7 +26891,7 @@ var OutputFormatter;
       result: data.Result,
       message: data.Message
     });
-    logOutput(data, getOutputFormat());
+    logOutput(normalizeOutputKeys(data), getOutputFormat());
   }
   OutputFormatter.error = error;
   function emitList(code, items, opts) {
@@ -26708,13 +26912,14 @@ var OutputFormatter;
   function log(data) {
     const format = getOutputFormat();
     const sink = getOutputSink();
+    const normalized = toPascalCaseData(data);
     if (format === "json") {
-      const json2 = JSON.stringify(data);
+      const json2 = JSON.stringify(normalized);
       const safe = needsAsciiSafeJson(sink) ? escapeNonAscii(json2) : json2;
       sink.writeErr(`${safe}
 `);
     } else {
-      for (const [key, value] of Object.entries(data)) {
+      for (const [key, value] of Object.entries(normalized)) {
         sink.writeErr(`${key}: ${value}
 `);
       }
@@ -26723,12 +26928,16 @@ var OutputFormatter;
   OutputFormatter.log = log;
   function formatToString(data) {
     const filter = getOutputFilter();
-    if (filter && "Data" in data && data.Data != null) {
-      data.Data = applyFilter(data.Data, filter);
+    if ("Data" in data && data.Data != null) {
+      data.Data = normalizeDataKeys(data.Data);
+      if (filter) {
+        data.Data = normalizeDataKeys(applyFilter(data.Data, filter));
+      }
     }
+    const output = normalizeOutputKeys(data);
     const lines = [];
     const sink = getOutputSink();
-    printOutput(data, getOutputFormat(), (msg) => {
+    printOutput(output, getOutputFormat(), (msg) => {
       lines.push(msg);
     }, needsAsciiSafeJson(sink));
     return lines.join(`
@@ -28139,6 +28348,22 @@ JSONPath.prototype.safeVm = {
   Script: SafeScript
 };
 JSONPath.prototype.vm = vm;
+// ../../common/src/polling/types.ts
+var PollOutcome = {
+  Completed: "completed",
+  Timeout: "timeout",
+  Interrupted: "interrupted",
+  Aborted: "aborted",
+  Failed: "failed"
+};
+
+// ../../common/src/polling/poll-failure-mapping.ts
+var REASON_BY_OUTCOME = {
+  [PollOutcome.Timeout]: "poll_timeout",
+  [PollOutcome.Failed]: "poll_failed",
+  [PollOutcome.Interrupted]: "poll_failed",
+  [PollOutcome.Aborted]: "poll_aborted"
+};
 // ../../common/src/polling/terminal-statuses.ts
 var TERMINAL_STATUSES = new Set([
   "completed",
@@ -28166,6 +28391,105 @@ var ScreenLogger;
   }
   ScreenLogger.progress = progress;
 })(ScreenLogger ||= {});
+// ../../common/src/sdk-user-agent.ts
+var USER_AGENT_HEADER = "User-Agent";
+var sdkUserAgentHostToken = singleton("SdkUserAgentHostToken");
+function userAgentPatchKey(userAgent) {
+  return Symbol.for(`@uipath/common/sdk-user-agent/${userAgent}`);
+}
+function splitUserAgentTokens(value) {
+  return value?.trim().split(/\s+/).filter(Boolean) ?? [];
+}
+function appendUserAgentToken(value, userAgent) {
+  const tokens = splitUserAgentTokens(value);
+  const seen = new Set(tokens);
+  for (const token of splitUserAgentTokens(userAgent)) {
+    if (!seen.has(token)) {
+      tokens.push(token);
+      seen.add(token);
+    }
+  }
+  return tokens.join(" ");
+}
+function getEffectiveUserAgent(userAgent) {
+  return appendUserAgentToken(sdkUserAgentHostToken.get(), userAgent);
+}
+function isHeadersLike(headers) {
+  return typeof headers === "object" && headers !== null && "get" in headers && typeof headers.get === "function" && "set" in headers && typeof headers.set === "function";
+}
+function getSdkUserAgentToken(pkg) {
+  const packageName = pkg.name.replace(/^@uipath\//, "");
+  return getEffectiveUserAgent(`${packageName}/${pkg.version}`);
+}
+function addSdkUserAgentHeader(headers, userAgent) {
+  const result = { ...headers ?? {} };
+  const effectiveUserAgent = getEffectiveUserAgent(userAgent);
+  const headerName = Object.keys(result).find((key) => key.toLowerCase() === USER_AGENT_HEADER.toLowerCase());
+  if (headerName) {
+    result[headerName] = appendUserAgentToken(result[headerName], effectiveUserAgent);
+  } else {
+    result[USER_AGENT_HEADER] = effectiveUserAgent;
+  }
+  return result;
+}
+function withSdkUserAgentHeader(headers, userAgent) {
+  const effectiveUserAgent = getEffectiveUserAgent(userAgent);
+  if (isHeadersLike(headers)) {
+    headers.set(USER_AGENT_HEADER, appendUserAgentToken(headers.get(USER_AGENT_HEADER), effectiveUserAgent));
+    return headers;
+  }
+  if (Array.isArray(headers)) {
+    const result = headers.map((entry) => {
+      const [key, value] = entry;
+      return [key, value];
+    });
+    const headerIndex = result.findIndex(([key]) => key.toLowerCase() === USER_AGENT_HEADER.toLowerCase());
+    if (headerIndex >= 0) {
+      const [key, value] = result[headerIndex];
+      result[headerIndex] = [
+        key,
+        appendUserAgentToken(value, effectiveUserAgent)
+      ];
+    } else {
+      result.push([USER_AGENT_HEADER, effectiveUserAgent]);
+    }
+    return result;
+  }
+  return addSdkUserAgentHeader(typeof headers === "object" && headers !== null ? { ...headers } : {}, effectiveUserAgent);
+}
+function withUserAgentInitOverride(initOverrides, userAgent) {
+  return async (requestContext) => {
+    const initWithUserAgent = {
+      ...requestContext.init,
+      headers: withSdkUserAgentHeader(requestContext.init.headers, userAgent)
+    };
+    const override = typeof initOverrides === "function" ? await initOverrides({
+      ...requestContext,
+      init: initWithUserAgent
+    }) : initOverrides;
+    return {
+      ...override ?? {},
+      headers: withSdkUserAgentHeader(override?.headers ?? initWithUserAgent.headers, userAgent)
+    };
+  };
+}
+function installSdkUserAgentHeader(BaseApiClass, userAgent) {
+  const prototype = BaseApiClass.prototype;
+  const patchKey = userAgentPatchKey(userAgent);
+  if (prototype[patchKey]) {
+    return;
+  }
+  if (typeof prototype.request !== "function") {
+    throw new Error("Generated BaseAPI request function not found.");
+  }
+  const originalRequest = prototype.request;
+  prototype.request = function requestWithUserAgent(context, initOverrides) {
+    return originalRequest.call(this, context, withUserAgentInitOverride(initOverrides, userAgent));
+  };
+  Object.defineProperty(prototype, patchKey, {
+    value: true
+  });
+}
 // ../../common/src/tool-provider.ts
 var factorySlot = singleton("PackagerFactoryProvider");
 // ../../common/src/telemetry/pii-redactor.ts
@@ -28348,13 +28672,17 @@ Command.prototype.trackedAction = function(context, fn, properties) {
     const [error] = await catchError(fn(...args));
     if (error) {
       errorMessage = error instanceof Error ? error.message : String(error);
-      logger.error(`[trackedAction] ${telemetryName} failed: ${errorMessage}`);
+      logger.debug(`[trackedAction] ${telemetryName} failed: ${errorMessage}`);
+      const typed = error;
+      const customInstructions = typeof typed.instructions === "string" ? typed.instructions : undefined;
+      const customResult = typeof typed.result === "string" && typed.result !== RESULTS.Success && Object.values(RESULTS).includes(typed.result) ? typed.result : undefined;
+      const finalResult = customResult ?? RESULTS.Failure;
       OutputFormatter.error({
-        Result: RESULTS.Failure,
+        Result: finalResult,
         Message: errorMessage,
-        Instructions: "An unexpected error occurred. Run with --log-level debug for details."
+        Instructions: customInstructions ?? "An unexpected error occurred. Run with --log-level debug for details."
       });
-      context.exit(1);
+      context.exit(EXIT_CODES[finalResult]);
     }
     const durationMs = performance.now() - startTime;
     const success = !error && (process.exitCode === undefined || process.exitCode === 0);
@@ -28625,6 +28953,57 @@ class TextApiResponse {
     return await this.raw.text();
   }
 }
+// ../identity-sdk/package.json
+var package_default2 = {
+  name: "@uipath/identity-sdk",
+  license: "MIT",
+  version: "1.2.0",
+  repository: {
+    type: "git",
+    url: "https://github.com/UiPath/cli.git",
+    directory: "packages/admin/identity-sdk"
+  },
+  publishConfig: {
+    registry: "https://npm.pkg.github.com/@uipath"
+  },
+  keywords: [
+    "uipath",
+    "identity",
+    "sdk"
+  ],
+  type: "module",
+  main: "./dist/index.js",
+  types: "./dist/src/index.d.ts",
+  exports: {
+    ".": {
+      types: "./dist/src/index.d.ts",
+      default: "./dist/index.js"
+    }
+  },
+  files: [
+    "dist"
+  ],
+  private: true,
+  scripts: {
+    build: "bun build ./src/index.ts --outdir dist --format esm --target node && tsc -p tsconfig.build.json --noCheck",
+    generate: "bun run src/scripts/generate-sdk.ts",
+    lint: "biome check .",
+    test: "vitest run",
+    "test:coverage": "vitest run --coverage"
+  },
+  devDependencies: {
+    "@uipath/auth": "workspace:*",
+    "@uipath/common": "workspace:*",
+    "@uipath/filesystem": "workspace:*",
+    "@openapitools/openapi-generator-cli": "^2.31.1",
+    "@types/node": "^25.5.2",
+    typescript: "^6.0.2"
+  }
+};
+
+// ../identity-sdk/src/user-agent.ts
+var SDK_USER_AGENT = getSdkUserAgentToken(package_default2);
+installSdkUserAgentHeader(BaseAPI, SDK_USER_AGENT);
 
 // ../identity-sdk/generated/src/models/ApiScopeType.ts
 function ApiScopeTypeFromJSON(json2) {
@@ -31157,32 +31536,7 @@ class InvalidBaseUrlError extends Error {
     this.name = "InvalidBaseUrlError";
   }
 }
-var DEFAULT_SCOPES = [
-  "offline_access",
-  "ProcessMining",
-  "OrchestratorApiUserAccess",
-  "StudioWebBackend",
-  "IdentityServerApi",
-  "ConnectionService",
-  "DataService",
-  "DataServiceApiUserAccess",
-  "DocumentUnderstanding",
-  "EnterpriseContextService",
-  "Directory",
-  "JamJamApi",
-  "LLMGateway",
-  "LLMOps",
-  "OMS",
-  "RCS.FolderAuthorization",
-  "RCS.TagsManagement",
-  "TestmanagerApiUserAccess",
-  "AutomationSolutions",
-  "StudioWebTypeCacheService",
-  "Docs.GPT.Search",
-  "Insights",
-  "ReferenceToken",
-  "Audit.Read"
-];
+var DEFAULT_SCOPES = ["openid", "profile", "offline_access"];
 var normalizeAndValidateBaseUrl = (rawUrl) => {
   let baseUrl = rawUrl;
   if (baseUrl.endsWith("/identity_/")) {
@@ -31232,7 +31586,8 @@ var resolveConfigAsync = async ({
   if (!clientSecret && fileAuth.clientSecret) {
     clientSecret = fileAuth.clientSecret;
   }
-  const scopes = customScopes && customScopes.length > 0 ? customScopes : fileAuth.scopes && fileAuth.scopes.length > 0 ? fileAuth.scopes : DEFAULT_SCOPES;
+  const isExternalAppAuth = clientId !== DEFAULT_CLIENT_ID && Boolean(clientSecret);
+  const scopes = customScopes && customScopes.length > 0 ? customScopes : fileAuth.scopes && fileAuth.scopes.length > 0 ? fileAuth.scopes : isExternalAppAuth ? [] : DEFAULT_SCOPES;
   return {
     clientId,
     clientSecret,
@@ -31732,6 +32087,129 @@ function normalizeTokenRefreshFailure() {
 function normalizeTokenRefreshUnavailableFailure() {
   return "token refresh failed before authentication completed";
 }
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function computeExpirationThreshold(ensureTokenValidityMinutes) {
+  return new Date(Date.now() + (ensureTokenValidityMinutes ?? 0) * 60 * 1000);
+}
+async function runRefreshLocked(inputs) {
+  const {
+    absolutePath,
+    refreshToken: callerRefreshToken,
+    customAuthority,
+    ensureTokenValidityMinutes,
+    loadEnvFile,
+    saveEnvFile,
+    refreshFn,
+    resolveConfig
+  } = inputs;
+  const expirationThreshold = computeExpirationThreshold(ensureTokenValidityMinutes);
+  let fresh;
+  try {
+    fresh = await loadEnvFile({ envPath: absolutePath });
+  } catch (error) {
+    return {
+      kind: "fail",
+      status: {
+        loginStatus: "Refresh Failed",
+        hint: "Could not read the auth file while refreshing. Retry, or run 'uip login' to re-authenticate.",
+        tokenRefresh: {
+          attempted: false,
+          success: false,
+          errorMessage: `auth file read failed: ${errorMessage(error)}`
+        }
+      }
+    };
+  }
+  const freshAccess = fresh.UIPATH_ACCESS_TOKEN;
+  const freshExp = freshAccess ? getTokenExpiration(freshAccess) : undefined;
+  if (freshAccess && freshExp && freshExp > expirationThreshold) {
+    return {
+      kind: "ok",
+      accessToken: freshAccess,
+      refreshToken: fresh.UIPATH_REFRESH_TOKEN ?? callerRefreshToken,
+      expiration: freshExp,
+      tokenRefresh: { attempted: false, success: true }
+    };
+  }
+  const tokenForIdP = fresh.UIPATH_REFRESH_TOKEN ?? callerRefreshToken;
+  let refreshedAccess;
+  let refreshedRefresh;
+  try {
+    const config = await resolveConfig({ customAuthority });
+    const refreshed = await refreshFn({
+      refreshToken: tokenForIdP,
+      tokenEndpoint: config.tokenEndpoint,
+      clientId: config.clientId,
+      expectedAuthority: customAuthority
+    });
+    refreshedAccess = refreshed.accessToken;
+    refreshedRefresh = refreshed.refreshToken;
+  } catch (error) {
+    const isOAuthFailure = isTokenRefreshOAuthFailure(error);
+    const hint = isOAuthFailure ? "Run 'uip login' to re-authenticate — the stored refresh token is invalid or expired." : "Token refresh failed. Check your network connection, then retry or run 'uip login' to re-authenticate.";
+    const message = isOAuthFailure ? normalizeTokenRefreshFailure() : normalizeTokenRefreshUnavailableFailure();
+    return {
+      kind: "fail",
+      status: {
+        loginStatus: "Refresh Failed",
+        hint,
+        tokenRefresh: {
+          attempted: true,
+          success: false,
+          errorMessage: message
+        }
+      }
+    };
+  }
+  const refreshedExp = getTokenExpiration(refreshedAccess);
+  if (!refreshedExp || refreshedExp <= new Date) {
+    return {
+      kind: "fail",
+      status: {
+        loginStatus: "Refresh Failed",
+        hint: "The identity server returned an unusable token. Run 'uip login' to re-authenticate.",
+        tokenRefresh: {
+          attempted: true,
+          success: false,
+          errorMessage: "refreshed token has no valid expiration claim"
+        }
+      }
+    };
+  }
+  try {
+    await saveEnvFile({
+      envPath: absolutePath,
+      data: {
+        UIPATH_ACCESS_TOKEN: refreshedAccess,
+        UIPATH_REFRESH_TOKEN: refreshedRefresh
+      },
+      merge: true
+    });
+    return {
+      kind: "ok",
+      accessToken: refreshedAccess,
+      refreshToken: refreshedRefresh,
+      expiration: refreshedExp,
+      tokenRefresh: { attempted: true, success: true }
+    };
+  } catch (error) {
+    const msg = errorMessage(error);
+    return {
+      kind: "ok",
+      accessToken: refreshedAccess,
+      refreshToken: refreshedRefresh,
+      expiration: refreshedExp,
+      persistenceWarning: `Access token refreshed in memory but could not be written to ${absolutePath}: ${msg}. The next CLI invocation will fail until the file can be updated — run 'uip login' to re-authenticate.`,
+      tokenRefresh: {
+        attempted: true,
+        success: true,
+        errorMessage: `persistence failed: ${msg}`
+      }
+    };
+  }
+}
 var getLoginStatusWithDeps = async (options = {}, deps = {}) => {
   const {
     resolveEnvFilePath = resolveEnvFilePathAsync,
@@ -31806,73 +32284,103 @@ var getLoginStatusWithDeps = async (options = {}, deps = {}) => {
   let refreshToken = credentials.UIPATH_REFRESH_TOKEN;
   let expiration = getTokenExpiration(accessToken);
   let persistenceWarning;
+  let lockReleaseFailed = false;
   let tokenRefresh;
-  const expirationThreshold = new Date(Date.now() + (ensureTokenValidityMinutes ?? 0) * 60 * 1000);
-  if (expiration && expiration <= expirationThreshold && refreshToken) {
-    let refreshedAccess;
-    let refreshedRefresh;
+  const outerThreshold = computeExpirationThreshold(ensureTokenValidityMinutes);
+  const tryGlobalCredsHint = async () => {
+    const fs7 = getFs();
+    const globalPath = fs7.path.join(fs7.env.homedir(), envFilePath);
+    if (absolutePath === globalPath)
+      return;
+    if (!await fs7.exists(globalPath))
+      return;
     try {
-      const config = await resolveConfig({
-        customAuthority: credentials.UIPATH_URL
-      });
-      const refreshed = await refreshTokenFn({
-        refreshToken,
-        tokenEndpoint: config.tokenEndpoint,
-        clientId: config.clientId,
-        expectedAuthority: credentials.UIPATH_URL
-      });
-      refreshedAccess = refreshed.accessToken;
-      refreshedRefresh = refreshed.refreshToken;
-    } catch (error) {
-      const isOAuthFailure = isTokenRefreshOAuthFailure(error);
-      const hint = isOAuthFailure ? "Run 'uip login' to re-authenticate — the stored refresh token is invalid or expired." : "Token refresh failed. Check your network connection, then retry or run 'uip login' to re-authenticate.";
-      const errorMessage = isOAuthFailure ? normalizeTokenRefreshFailure() : normalizeTokenRefreshUnavailableFailure();
-      return {
-        loginStatus: "Refresh Failed",
-        hint,
-        tokenRefresh: {
-          attempted: true,
-          success: false,
-          errorMessage
-        }
-      };
+      const globalCreds = await loadEnvFile({ envPath: globalPath });
+      if (!globalCreds.UIPATH_ACCESS_TOKEN)
+        return;
+      const globalExp = getTokenExpiration(globalCreds.UIPATH_ACCESS_TOKEN);
+      if (globalExp && globalExp <= new Date)
+        return;
+      return `Local credentials file at ${absolutePath} has expired credentials. Valid credentials exist in ${globalPath}. Remove the local file or run 'uip login' to re-authenticate.`;
+    } catch {
+      return;
     }
-    const refreshedExp = getTokenExpiration(refreshedAccess);
-    if (!refreshedExp || refreshedExp <= new Date) {
+  };
+  if (expiration && expiration <= outerThreshold && refreshToken) {
+    let release;
+    try {
+      release = await getFs().acquireLock(absolutePath);
+    } catch (error) {
+      const msg = errorMessage(error);
+      const globalHint = await tryGlobalCredsHint();
+      if (globalHint) {
+        return {
+          loginStatus: "Expired",
+          accessToken,
+          refreshToken,
+          baseUrl: credentials.UIPATH_URL,
+          organizationName: credentials.UIPATH_ORGANIZATION_NAME,
+          organizationId: credentials.UIPATH_ORGANIZATION_ID,
+          tenantName: credentials.UIPATH_TENANT_NAME,
+          tenantId: credentials.UIPATH_TENANT_ID,
+          expiration,
+          source: "file" /* File */,
+          hint: globalHint,
+          tokenRefresh: {
+            attempted: false,
+            success: false,
+            errorMessage: `lock acquisition failed: ${msg}`
+          }
+        };
+      }
       return {
         loginStatus: "Refresh Failed",
-        hint: "The identity server returned an unusable token. Run 'uip login' to re-authenticate.",
+        hint: "Could not acquire the auth-file lock — too many concurrent `uip` processes, or a permission issue on the auth directory. Retry, or run 'uip login' to re-authenticate.",
         tokenRefresh: {
-          attempted: true,
+          attempted: false,
           success: false,
-          errorMessage: "refreshed token has no valid expiration claim"
+          errorMessage: `lock acquisition failed: ${msg}`
         }
       };
     }
-    accessToken = refreshedAccess;
-    refreshToken = refreshedRefresh;
-    expiration = refreshedExp;
+    let lockedFailure;
     try {
-      await saveEnvFile({
-        envPath: absolutePath,
-        data: {
-          UIPATH_ACCESS_TOKEN: accessToken,
-          UIPATH_REFRESH_TOKEN: refreshToken
-        },
-        merge: true
+      const outcome = await runRefreshLocked({
+        absolutePath,
+        refreshToken,
+        customAuthority: credentials.UIPATH_URL,
+        ensureTokenValidityMinutes,
+        loadEnvFile,
+        saveEnvFile,
+        refreshFn: refreshTokenFn,
+        resolveConfig
       });
-      tokenRefresh = {
-        attempted: true,
-        success: true
-      };
-    } catch (error) {
-      const msg = error instanceof Error ? error.message : String(error);
-      persistenceWarning = `Access token refreshed in memory but could not be written to ${absolutePath}: ${msg}. The next CLI invocation will fail until the file can be updated — run 'uip login' to re-authenticate.`;
-      tokenRefresh = {
-        attempted: true,
-        success: true,
-        errorMessage: `persistence failed: ${msg}`
-      };
+      if (outcome.kind === "fail") {
+        lockedFailure = outcome.status;
+      } else {
+        accessToken = outcome.accessToken;
+        refreshToken = outcome.refreshToken;
+        expiration = outcome.expiration;
+        tokenRefresh = outcome.tokenRefresh;
+        if (outcome.persistenceWarning) {
+          persistenceWarning = outcome.persistenceWarning;
+        }
+      }
+    } finally {
+      try {
+        await release();
+      } catch {
+        lockReleaseFailed = true;
+      }
+    }
+    if (lockedFailure) {
+      const globalHint = await tryGlobalCredsHint();
+      const base = globalHint ? {
+        ...lockedFailure,
+        loginStatus: "Expired",
+        hint: globalHint
+      } : lockedFailure;
+      return lockReleaseFailed ? { ...base, lockReleaseFailed: true } : base;
     }
   }
   const result = {
@@ -31887,23 +32395,13 @@ var getLoginStatusWithDeps = async (options = {}, deps = {}) => {
     expiration,
     source: "file" /* File */,
     ...persistenceWarning ? { hint: persistenceWarning, persistenceFailed: true } : {},
+    ...lockReleaseFailed ? { lockReleaseFailed: true } : {},
     ...tokenRefresh ? { tokenRefresh } : {}
   };
   if (result.loginStatus === "Expired") {
-    const fs7 = getFs();
-    const globalPath = fs7.path.join(fs7.env.homedir(), envFilePath);
-    if (absolutePath !== globalPath && await fs7.exists(globalPath)) {
-      try {
-        const globalCreds = await loadEnvFile({
-          envPath: globalPath
-        });
-        if (globalCreds.UIPATH_ACCESS_TOKEN) {
-          const globalExp = getTokenExpiration(globalCreds.UIPATH_ACCESS_TOKEN);
-          if (!globalExp || globalExp > new Date) {
-            result.hint = `Local credentials file at ${absolutePath} has expired credentials. Valid credentials exist in ${globalPath}. Remove the local file or run 'uip login' to re-authenticate.`;
-          }
-        }
-      } catch {}
+    const globalHint = await tryGlobalCredsHint();
+    if (globalHint) {
+      result.hint = globalHint;
     }
   }
   return result;
@@ -31951,23 +32449,31 @@ var getAuthContext = async (options = {}) => {
 init_src();
 // ../../auth/src/logout.ts
 init_src();
+
+// ../../auth/src/index.ts
+init_server();
+
 // ../identity-sdk/src/client-factory.ts
 async function createIdentityConfig(options) {
   const ctx = await getAuthContext({
     ensureTokenValidityMinutes: options?.loginValidity,
-    requireOrganizationId: true,
+    requireOrganizationId: options?.organization === undefined,
     requireTenantName: true
   });
-  const identityBasePath = `${ctx.baseUrl}/${ctx.organizationId}/identity_`;
-  const headers = {
+  const organizationId = options?.organization ?? ctx.organizationId;
+  if (organizationId === undefined || organizationId.length === 0) {
+    throw new Error("Organization ID not available. Provide --organization or log in with an organization context.");
+  }
+  const identityBasePath = `${ctx.baseUrl}/${organizationId}/identity_`;
+  const headers = addSdkUserAgentHeader({
     Authorization: `Bearer ${ctx.accessToken}`
-  };
+  }, SDK_USER_AGENT);
   return {
     config: new Configuration({
       basePath: identityBasePath,
       headers
     }),
-    organizationId: ctx.organizationId ?? ""
+    organizationId
   };
 }
 async function createApiClient(ApiClass, options) {
@@ -31976,14 +32482,14 @@ async function createApiClient(ApiClass, options) {
 }
 // src/commands/external-apps.ts
 var INSTRUCTIONS = {
-  list: "Verify --organization is a valid org ID. Run 'external-apps list --help' for options.",
+  list: "Verify you are logged in. Run 'external-apps list --help' for options.",
   get: "Verify the app ID exists. Use 'external-apps list' to find valid IDs.",
-  create: "Verify --organization and scopes are correct. Provide --user-scope and/or --app-scope.",
-  update: "Verify the app ID and --organization are correct.",
+  create: "Verify scopes are correct. Provide --user-scope and/or --app-scope.",
+  update: "Verify the app ID is correct.",
   delete: "Verify the app ID exists. The app may have already been deleted.",
-  generateSecret: "Verify the app ID and --organization are correct.",
+  generateSecret: "Verify the app ID is correct.",
   deleteSecret: "Verify the secret ID exists. Use 'external-apps get' to find valid secret IDs.",
-  fedCredList: "Verify the client ID and --organization are correct.",
+  fedCredList: "Verify the client ID is correct.",
   fedCredGet: "Verify the credential ID exists. Use 'federated-credentials list' to find valid IDs.",
   fedCredCreate: "Provide --name, --issuer, --audience, and --subject. These must match the external identity provider.",
   fedCredUpdate: "Verify the credential ID exists and provide the updated fields.",
@@ -32170,14 +32676,21 @@ function parseScopes(csv, type2) {
     return [];
   return csv.split(",").map((s) => ({ name: s.trim(), type: type2 }));
 }
+function warnDeprecatedOrganization(org) {
+  if (org !== undefined) {
+    logger.warn("--organization is deprecated and ignored; organization is derived from login context");
+  }
+}
 var registerExternalAppsCommand = (program2) => {
   const externalApps = program2.command("external-apps").description("Manage external OAuth2 clients. List, get, create, update, delete clients and manage secrets.");
-  externalApps.command("list").description("List external apps in a partition.").option("--organization <id>", "Organization ID (defaults to logged-in org)").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(EXTERNAL_APPS_LIST_EXAMPLES).trackedAction(processContext, async (options) => {
+  externalApps.command("list").description("List external apps in a partition.").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(EXTERNAL_APPS_LIST_EXAMPLES).trackedAction(processContext, async (options) => {
+    warnDeprecatedOrganization(options.organization);
     const [error, result] = await catchError((async () => {
       const { api, organizationId } = await createApiClient(ExternalClientApi, {
-        loginValidity: options.loginValidity
+        loginValidity: options.loginValidity,
+        organization: options.organization
       });
-      const orgId = options.organization ?? organizationId;
+      const orgId = organizationId;
       return await api.externalClientGet({
         partitionGlobalId: orgId
       });
@@ -32197,12 +32710,14 @@ var registerExternalAppsCommand = (program2) => {
       Data: result ?? []
     });
   });
-  externalApps.command("get").description("Get external app details. " + "Use 'external-apps list' to retrieve the client ID.").argument("<client-id>", "External app ID").option("--organization <id>", "Organization ID (defaults to logged-in org)").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(EXTERNAL_APPS_GET_EXAMPLES).trackedAction(processContext, async (clientId, options) => {
+  externalApps.command("get").description("Get external app details. " + "Use 'external-apps list' to retrieve the client ID.").argument("<client-id>", "External app ID").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(EXTERNAL_APPS_GET_EXAMPLES).trackedAction(processContext, async (clientId, options) => {
+    warnDeprecatedOrganization(options.organization);
     const [error, client] = await catchError((async () => {
       const { api, organizationId } = await createApiClient(ExternalClientApi, {
-        loginValidity: options.loginValidity
+        loginValidity: options.loginValidity,
+        organization: options.organization
       });
-      const orgId = options.organization ?? organizationId;
+      const orgId = organizationId;
       return await api.externalClientGetWithClientId({
         partitionGlobalId: orgId,
         clientId
@@ -32223,7 +32738,8 @@ var registerExternalAppsCommand = (program2) => {
       Data: client
     });
   });
-  externalApps.command("create").description("Create an external app (confidential by default). " + "Use --non-confidential for public clients (SPAs, mobile apps).").argument("<name>", "App display name").option("--organization <id>", "Organization ID (defaults to logged-in org)").option("--redirect-uri <uri>", "Redirect URI(s) for OAuth2 flow (comma-separated for multiple)").option("--user-scope <scopes>", "Comma-separated user (delegated) scopes").option("--app-scope <scopes>", "Comma-separated application (app-only) scopes").option("--scope <scopes>", "Alias for --app-scope (deprecated)").option("--non-confidential", "Create a non-confidential (public) app — no client secret, requires redirect URI").option("--no-secret", "Skip generating a client secret on creation").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(EXTERNAL_APPS_CREATE_EXAMPLES).trackedAction(processContext, async (name, options) => {
+  externalApps.command("create").description("Create an external app (confidential by default). " + "Use --non-confidential for public clients (SPAs, mobile apps).").argument("<name>", "App display name").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("--redirect-uri <uri>", "Redirect URI(s) for OAuth2 flow (comma-separated for multiple)").option("--user-scope <scopes>", "Comma-separated user (delegated) scopes").option("--app-scope <scopes>", "Comma-separated application (app-only) scopes").option("--scope <scopes>", "Alias for --app-scope (deprecated)").option("--non-confidential", "Create a non-confidential (public) app — no client secret, requires redirect URI").option("--no-secret", "Skip generating a client secret on creation").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(EXTERNAL_APPS_CREATE_EXAMPLES).trackedAction(processContext, async (name, options) => {
+    warnDeprecatedOrganization(options.organization);
     if (options.scope && !options.appScope) {
       options.appScope = options.scope;
     }
@@ -32264,9 +32780,10 @@ var registerExternalAppsCommand = (program2) => {
     const generateFirstSecret = isConfidential && options.secret !== false;
     const [error, result] = await catchError((async () => {
       const { api, organizationId } = await createApiClient(ExternalClientApi, {
-        loginValidity: options.loginValidity
+        loginValidity: options.loginValidity,
+        organization: options.organization
       });
-      const orgId = options.organization ?? organizationId;
+      const orgId = organizationId;
       const createCommand2 = {
         partitionGlobalId: orgId,
         name,
@@ -32294,7 +32811,8 @@ var registerExternalAppsCommand = (program2) => {
       Data: result
     });
   });
-  externalApps.command("update").description("Update an external app. Use 'external-apps list' to retrieve the client ID.").argument("<client-id>", "External app ID").option("--organization <id>", "Organization ID (defaults to logged-in org)").option("-n, --name <name>", "New display name").option("--redirect-uri <uri>", "Redirect URI(s) for OAuth2 flow (comma-separated for multiple)").option("--user-scope <scopes>", "Comma-separated user (delegated) scopes").option("--app-scope <scopes>", "Comma-separated application (app-only) scopes").option("--scope <scopes>", "Alias for --app-scope (deprecated)").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(EXTERNAL_APPS_UPDATE_EXAMPLES).trackedAction(processContext, async (clientId, options) => {
+  externalApps.command("update").description("Update an external app. Use 'external-apps list' to retrieve the client ID.").argument("<client-id>", "External app ID").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("-n, --name <name>", "New display name").option("--redirect-uri <uri>", "Redirect URI(s) for OAuth2 flow (comma-separated for multiple)").option("--user-scope <scopes>", "Comma-separated user (delegated) scopes").option("--app-scope <scopes>", "Comma-separated application (app-only) scopes").option("--scope <scopes>", "Alias for --app-scope (deprecated)").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(EXTERNAL_APPS_UPDATE_EXAMPLES).trackedAction(processContext, async (clientId, options) => {
+    warnDeprecatedOrganization(options.organization);
     if (options.scope && !options.appScope) {
       options.appScope = options.scope;
     }
@@ -32310,9 +32828,10 @@ var registerExternalAppsCommand = (program2) => {
     }
     const [fetchError, fetchResult] = await catchError((async () => {
       const { api: api2, organizationId } = await createApiClient(ExternalClientApi, {
-        loginValidity: options.loginValidity
+        loginValidity: options.loginValidity,
+        organization: options.organization
       });
-      const orgId2 = options.organization ?? organizationId;
+      const orgId2 = organizationId;
       const current2 = await api2.externalClientGetWithClientId({
         partitionGlobalId: orgId2,
         clientId
@@ -32380,12 +32899,14 @@ var registerExternalAppsCommand = (program2) => {
       Data: result
     });
   });
-  externalApps.command("delete").description("Delete an external app. " + "Use 'external-apps list' to retrieve the client ID.").argument("<client-id>", "External app ID").option("--organization <id>", "Organization ID (defaults to logged-in org)").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(EXTERNAL_APPS_DELETE_EXAMPLES).trackedAction(processContext, async (clientId, options) => {
+  externalApps.command("delete").description("Delete an external app. " + "Use 'external-apps list' to retrieve the client ID.").argument("<client-id>", "External app ID").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(EXTERNAL_APPS_DELETE_EXAMPLES).trackedAction(processContext, async (clientId, options) => {
+    warnDeprecatedOrganization(options.organization);
     const [error] = await catchError((async () => {
       const { api, organizationId } = await createApiClient(ExternalClientApi, {
-        loginValidity: options.loginValidity
+        loginValidity: options.loginValidity,
+        organization: options.organization
       });
-      const orgId = options.organization ?? organizationId;
+      const orgId = organizationId;
       return await api.externalClientDelete({
         partitionGlobalId: orgId,
         clientId
@@ -32409,12 +32930,14 @@ var registerExternalAppsCommand = (program2) => {
       }
     });
   });
-  externalApps.command("generate-secret").description("Generate a new secret for an external app. " + "Returns the secret value (only shown once).").argument("<client-id>", "External app ID").option("--organization <id>", "Organization ID (defaults to logged-in org)").option("--description <text>", "Description for the secret").option("--expiration <date>", "Expiration date (ISO 8601)").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(EXTERNAL_APPS_GENERATE_SECRET_EXAMPLES).trackedAction(processContext, async (clientId, options) => {
+  externalApps.command("generate-secret").description("Generate a new secret for an external app. " + "Returns the secret value (only shown once).").argument("<client-id>", "External app ID").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("--description <text>", "Description for the secret").option("--expiration <date>", "Expiration date (ISO 8601)").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(EXTERNAL_APPS_GENERATE_SECRET_EXAMPLES).trackedAction(processContext, async (clientId, options) => {
+    warnDeprecatedOrganization(options.organization);
     const [error, result] = await catchError((async () => {
       const { api, organizationId } = await createApiClient(ExternalClientApi, {
-        loginValidity: options.loginValidity
+        loginValidity: options.loginValidity,
+        organization: options.organization
       });
-      const orgId = options.organization ?? organizationId;
+      const orgId = organizationId;
       return await api.externalClientGenerateSecret({
         createClientSecretCommand: {
           clientId,
@@ -32439,12 +32962,14 @@ var registerExternalAppsCommand = (program2) => {
       Data: result
     });
   });
-  externalApps.command("delete-secret").description("Delete a specific secret from an external app.").argument("<secret-id>", "Secret ID (numeric)").option("--organization <id>", "Organization ID (defaults to logged-in org)").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(EXTERNAL_APPS_DELETE_SECRET_EXAMPLES).trackedAction(processContext, async (secretId, options) => {
+  externalApps.command("delete-secret").description("Delete a specific secret from an external app.").argument("<secret-id>", "Secret ID (numeric)").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(EXTERNAL_APPS_DELETE_SECRET_EXAMPLES).trackedAction(processContext, async (secretId, options) => {
+    warnDeprecatedOrganization(options.organization);
     const [error] = await catchError((async () => {
       const { api, organizationId } = await createApiClient(ExternalClientApi, {
-        loginValidity: options.loginValidity
+        loginValidity: options.loginValidity,
+        organization: options.organization
       });
-      const orgId = options.organization ?? organizationId;
+      const orgId = organizationId;
       return await api.externalClientDeleteSecret({
         partitionGlobalId: orgId,
         secretId: Number.parseInt(secretId, 10)
@@ -32469,10 +32994,14 @@ var registerExternalAppsCommand = (program2) => {
     });
   });
   const fedCreds = externalApps.command("federated-credentials").description("Manage federated credentials for external apps. " + "Enable workload identity federation with external identity providers (e.g. GitHub Actions, Azure AD).");
-  fedCreds.command("list").description("List federated credentials for an external app.").argument("<client-id>", "External app ID").option("--organization <id>", "Organization ID (defaults to logged-in org)").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(FED_CRED_LIST_EXAMPLES).trackedAction(processContext, async (clientId, options) => {
+  fedCreds.command("list").description("List federated credentials for an external app.").argument("<client-id>", "External app ID").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(FED_CRED_LIST_EXAMPLES).trackedAction(processContext, async (clientId, options) => {
+    warnDeprecatedOrganization(options.organization);
     const [error, result] = await catchError((async () => {
-      const { api, organizationId } = await createApiClient(ExternalClientApi, { loginValidity: options.loginValidity });
-      const orgId = options.organization ?? organizationId;
+      const { api, organizationId } = await createApiClient(ExternalClientApi, {
+        loginValidity: options.loginValidity,
+        organization: options.organization
+      });
+      const orgId = organizationId;
       return await api.externalClientGetFederatedCredentials({
         partitionGlobalId: orgId,
         clientId
@@ -32493,10 +33022,14 @@ var registerExternalAppsCommand = (program2) => {
       Data: result ?? []
     });
   });
-  fedCreds.command("get").description("Get a federated credential by ID.").argument("<client-id>", "External app ID").argument("<credential-id>", "Federated credential ID (UUID)").option("--organization <id>", "Organization ID (defaults to logged-in org)").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(FED_CRED_GET_EXAMPLES).trackedAction(processContext, async (clientId, credentialId, options) => {
+  fedCreds.command("get").description("Get a federated credential by ID.").argument("<client-id>", "External app ID").argument("<credential-id>", "Federated credential ID (UUID)").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(FED_CRED_GET_EXAMPLES).trackedAction(processContext, async (clientId, credentialId, options) => {
+    warnDeprecatedOrganization(options.organization);
     const [error, result] = await catchError((async () => {
-      const { api, organizationId } = await createApiClient(ExternalClientApi, { loginValidity: options.loginValidity });
-      const orgId = options.organization ?? organizationId;
+      const { api, organizationId } = await createApiClient(ExternalClientApi, {
+        loginValidity: options.loginValidity,
+        organization: options.organization
+      });
+      const orgId = organizationId;
       return await api.externalClientGetFederatedCredentialByIdByCredentialId({
         partitionGlobalId: orgId,
         clientId,
@@ -32518,10 +33051,14 @@ var registerExternalAppsCommand = (program2) => {
       Data: result
     });
   });
-  fedCreds.command("create").description("Create a federated credential for an external app. " + "Maps an external identity (e.g. GitHub Actions OIDC) to this app.").argument("<client-id>", "External app ID").requiredOption("-n, --name <name>", "Credential name").requiredOption("--issuer <url>", "Token issuer URL (e.g. https://token.actions.githubusercontent.com)").requiredOption("--audience <audience>", "Expected audience claim (e.g. api://AzureADTokenExchange)").requiredOption("--subject <subject>", "Expected subject claim (e.g. repo:org/repo:ref:refs/heads/main)").option("--description <text>", "Description for the credential").option("--organization <id>", "Organization ID (defaults to logged-in org)").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(FED_CRED_CREATE_EXAMPLES).trackedAction(processContext, async (clientId, options) => {
+  fedCreds.command("create").description("Create a federated credential for an external app. " + "Maps an external identity (e.g. GitHub Actions OIDC) to this app.").argument("<client-id>", "External app ID").requiredOption("-n, --name <name>", "Credential name").requiredOption("--issuer <url>", "Token issuer URL (e.g. https://token.actions.githubusercontent.com)").requiredOption("--audience <audience>", "Expected audience claim (e.g. api://AzureADTokenExchange)").requiredOption("--subject <subject>", "Expected subject claim (e.g. repo:org/repo:ref:refs/heads/main)").option("--description <text>", "Description for the credential").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(FED_CRED_CREATE_EXAMPLES).trackedAction(processContext, async (clientId, options) => {
+    warnDeprecatedOrganization(options.organization);
     const [error, result] = await catchError((async () => {
-      const { api, organizationId } = await createApiClient(ExternalClientApi, { loginValidity: options.loginValidity });
-      const orgId = options.organization ?? organizationId;
+      const { api, organizationId } = await createApiClient(ExternalClientApi, {
+        loginValidity: options.loginValidity,
+        organization: options.organization
+      });
+      const orgId = organizationId;
       const cmd = {
         name: options.name,
         issuer: options.issuer,
@@ -32550,10 +33087,14 @@ var registerExternalAppsCommand = (program2) => {
       Data: result
     });
   });
-  fedCreds.command("update").description("Update a federated credential.").argument("<client-id>", "External app ID").argument("<credential-id>", "Federated credential ID (UUID)").requiredOption("-n, --name <name>", "Credential name").requiredOption("--issuer <url>", "Token issuer URL").requiredOption("--audience <audience>", "Expected audience claim").requiredOption("--subject <subject>", "Expected subject claim").option("--description <text>", "Description for the credential").option("--organization <id>", "Organization ID (defaults to logged-in org)").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(FED_CRED_UPDATE_EXAMPLES).trackedAction(processContext, async (clientId, credentialId, options) => {
+  fedCreds.command("update").description("Update a federated credential.").argument("<client-id>", "External app ID").argument("<credential-id>", "Federated credential ID (UUID)").requiredOption("-n, --name <name>", "Credential name").requiredOption("--issuer <url>", "Token issuer URL").requiredOption("--audience <audience>", "Expected audience claim").requiredOption("--subject <subject>", "Expected subject claim").option("--description <text>", "Description for the credential").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(FED_CRED_UPDATE_EXAMPLES).trackedAction(processContext, async (clientId, credentialId, options) => {
+    warnDeprecatedOrganization(options.organization);
     const [error, result] = await catchError((async () => {
-      const { api, organizationId } = await createApiClient(ExternalClientApi, { loginValidity: options.loginValidity });
-      const orgId = options.organization ?? organizationId;
+      const { api, organizationId } = await createApiClient(ExternalClientApi, {
+        loginValidity: options.loginValidity,
+        organization: options.organization
+      });
+      const orgId = organizationId;
       const cmd = {
         name: options.name,
         issuer: options.issuer,
@@ -32583,10 +33124,14 @@ var registerExternalAppsCommand = (program2) => {
       Data: result
     });
   });
-  fedCreds.command("delete").description("Delete a federated credential from an external app.").argument("<client-id>", "External app ID").argument("<credential-id>", "Federated credential ID (UUID)").option("--organization <id>", "Organization ID (defaults to logged-in org)").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(FED_CRED_DELETE_EXAMPLES).trackedAction(processContext, async (clientId, credentialId, options) => {
+  fedCreds.command("delete").description("Delete a federated credential from an external app.").argument("<client-id>", "External app ID").argument("<credential-id>", "Federated credential ID (UUID)").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(FED_CRED_DELETE_EXAMPLES).trackedAction(processContext, async (clientId, credentialId, options) => {
+    warnDeprecatedOrganization(options.organization);
     const [error] = await catchError((async () => {
-      const { api, organizationId } = await createApiClient(ExternalClientApi, { loginValidity: options.loginValidity });
-      const orgId = options.organization ?? organizationId;
+      const { api, organizationId } = await createApiClient(ExternalClientApi, {
+        loginValidity: options.loginValidity,
+        organization: options.organization
+      });
+      const orgId = organizationId;
       return await api.externalClientDeleteFederatedCredential({
         partitionGlobalId: orgId,
         clientId,
@@ -32615,12 +33160,12 @@ var registerExternalAppsCommand = (program2) => {
 
 // src/commands/groups.ts
 var INSTRUCTIONS2 = {
-  list: "Verify --organization is a valid org ID. Run 'groups list --help' for options.",
+  list: "Verify you are logged in. Run 'groups list --help' for options.",
   get: "Verify the group ID exists. Use 'groups list' to find valid IDs.",
-  create: "Verify --organization is correct. Group names must be unique within a partition.",
-  update: "Verify the group ID and --organization are correct. Use 'groups list' to find valid IDs.",
+  create: "Verify the group name is correct. Group names must be unique within a partition.",
+  update: "Verify the group ID is correct. Use 'groups list' to find valid IDs.",
   delete: "Verify the group ID exists. The group may have already been deleted.",
-  listMembers: "Verify the group ID and --organization are correct.",
+  listMembers: "Verify the group ID is correct.",
   addMembers: "Verify the group ID and user IDs are correct. Use 'users list' to find valid user IDs.",
   revokeMembers: "Verify the user IDs are current members of the group."
 };
@@ -32722,14 +33267,20 @@ var MEMBERS_REVOKE_EXAMPLES = [
     }
   }
 ];
+function warnDeprecatedOrganization2(org) {
+  if (org !== undefined) {
+    logger.warn("--organization is deprecated and ignored; organization is derived from login context");
+  }
+}
 var registerGroupsCommand = (program2) => {
   const groups = program2.command("groups").description("Manage groups. List, get, create, update, and delete groups within a partition.");
-  groups.command("list").description("List all groups in a partition. " + "Returns group ID, name, type, and creation time.").option("--organization <id>", "Organization ID (defaults to logged-in org)").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(GROUPS_LIST_EXAMPLES).trackedAction(processContext, async (options) => {
+  groups.command("list").description("List all groups in a partition. " + "Returns group ID, name, type, and creation time.").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(GROUPS_LIST_EXAMPLES).trackedAction(processContext, async (options) => {
+    warnDeprecatedOrganization2(options.organization);
     const [error, result] = await catchError((async () => {
       const { api, organizationId } = await createApiClient(GroupApi, {
         loginValidity: options.loginValidity
       });
-      const orgId = options.organization ?? organizationId;
+      const orgId = organizationId;
       return await api.groupGetGroups({
         partitionGlobalId: orgId
       });
@@ -32749,12 +33300,13 @@ var registerGroupsCommand = (program2) => {
       Data: result ?? []
     });
   });
-  groups.command("get").description("Get group details by ID. " + "Use 'groups list' to retrieve the group ID.").argument("<group-id>", "Group ID (UUID)").option("--organization <id>", "Organization ID (defaults to logged-in org)").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(GROUPS_GET_EXAMPLES).trackedAction(processContext, async (groupId, options) => {
+  groups.command("get").description("Get group details by ID. " + "Use 'groups list' to retrieve the group ID.").argument("<group-id>", "Group ID (UUID)").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(GROUPS_GET_EXAMPLES).trackedAction(processContext, async (groupId, options) => {
+    warnDeprecatedOrganization2(options.organization);
     const [error, group] = await catchError((async () => {
       const { api, organizationId } = await createApiClient(GroupApi, {
         loginValidity: options.loginValidity
       });
-      const orgId = options.organization ?? organizationId;
+      const orgId = organizationId;
       return await api.groupGetGroup({
         partitionGlobalId: orgId,
         groupId
@@ -32775,12 +33327,13 @@ var registerGroupsCommand = (program2) => {
       Data: group
     });
   });
-  groups.command("create").description("Create a new local group in a partition.").argument("<name>", "Group name").option("--organization <id>", "Organization ID (defaults to logged-in org)").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(GROUPS_CREATE_EXAMPLES).trackedAction(processContext, async (name, options) => {
+  groups.command("create").description("Create a new local group in a partition.").argument("<name>", "Group name").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(GROUPS_CREATE_EXAMPLES).trackedAction(processContext, async (name, options) => {
+    warnDeprecatedOrganization2(options.organization);
     const [error, result] = await catchError((async () => {
       const { api, organizationId } = await createApiClient(GroupApi, {
         loginValidity: options.loginValidity
       });
-      const orgId = options.organization ?? organizationId;
+      const orgId = organizationId;
       const createCommand2 = {
         id: crypto.randomUUID(),
         name,
@@ -32805,7 +33358,8 @@ var registerGroupsCommand = (program2) => {
       Data: result
     });
   });
-  groups.command("update").description("Update a group. Use 'groups list' to retrieve the group ID.").argument("<group-id>", "Group ID (UUID)").option("--organization <id>", "Organization ID (defaults to logged-in org)").option("-n, --name <name>", "New group name").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(GROUPS_UPDATE_EXAMPLES).trackedAction(processContext, async (groupId, options) => {
+  groups.command("update").description("Update a group. Use 'groups list' to retrieve the group ID.").argument("<group-id>", "Group ID (UUID)").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("-n, --name <name>", "New group name").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(GROUPS_UPDATE_EXAMPLES).trackedAction(processContext, async (groupId, options) => {
+    warnDeprecatedOrganization2(options.organization);
     if (options.name === undefined) {
       OutputFormatter.error({
         Result: RESULTS.Failure,
@@ -32819,7 +33373,7 @@ var registerGroupsCommand = (program2) => {
       const { api, organizationId } = await createApiClient(GroupApi, {
         loginValidity: options.loginValidity
       });
-      const orgId = options.organization ?? organizationId;
+      const orgId = organizationId;
       const updateCommand = {
         partitionGlobalId: orgId,
         name: options.name
@@ -32844,12 +33398,13 @@ var registerGroupsCommand = (program2) => {
       Data: result
     });
   });
-  groups.command("delete").description("Delete a group. " + "Use 'groups list' to retrieve the group ID.").argument("<group-id>", "Group ID (UUID)").option("--organization <id>", "Organization ID (defaults to logged-in org)").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(GROUPS_DELETE_EXAMPLES).trackedAction(processContext, async (groupId, options) => {
+  groups.command("delete").description("Delete a group. " + "Use 'groups list' to retrieve the group ID.").argument("<group-id>", "Group ID (UUID)").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(GROUPS_DELETE_EXAMPLES).trackedAction(processContext, async (groupId, options) => {
+    warnDeprecatedOrganization2(options.organization);
     const [error] = await catchError((async () => {
       const { api, organizationId } = await createApiClient(GroupApi, {
         loginValidity: options.loginValidity
       });
-      const orgId = options.organization ?? organizationId;
+      const orgId = organizationId;
       return await api.groupDelete({
         partitionGlobalId: orgId,
         groupId
@@ -32874,12 +33429,13 @@ var registerGroupsCommand = (program2) => {
     });
   });
   const members = groups.command("members").description("Manage group membership. List, add, or revoke members.");
-  members.command("list").description("List members of a group. " + "Use 'groups list' to retrieve the group ID.").argument("<group-id>", "Group ID (UUID)").option("--organization <id>", "Organization ID (defaults to logged-in org)").option("-l, --limit <number>", "Number of items to return", "50").option("--offset <number>", "Number of items to skip", "0").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(MEMBERS_LIST_EXAMPLES).trackedAction(processContext, async (groupId, options) => {
+  members.command("list").description("List members of a group. " + "Use 'groups list' to retrieve the group ID.").argument("<group-id>", "Group ID (UUID)").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("-l, --limit <number>", "Number of items to return", "50").option("--offset <number>", "Number of items to skip", "0").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(MEMBERS_LIST_EXAMPLES).trackedAction(processContext, async (groupId, options) => {
+    warnDeprecatedOrganization2(options.organization);
     const [error, result] = await catchError((async () => {
       const { api, organizationId } = await createApiClient(GroupApi, {
         loginValidity: options.loginValidity
       });
-      const orgId = options.organization ?? organizationId;
+      const orgId = organizationId;
       return await api.groupGetGroupMembers({
         partitionGlobalId: orgId,
         groupId,
@@ -32902,13 +33458,14 @@ var registerGroupsCommand = (program2) => {
       Data: result.results ?? []
     });
   });
-  members.command("add").description("Add users to a group. Pass comma-separated user IDs.").argument("<group-id>", "Group ID (UUID)").option("--organization <id>", "Organization ID (defaults to logged-in org)").requiredOption("--user-ids <ids>", "Comma-separated user IDs to add").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(MEMBERS_ADD_EXAMPLES).trackedAction(processContext, async (groupId, options) => {
+  members.command("add").description("Add users to a group. Pass comma-separated user IDs.").argument("<group-id>", "Group ID (UUID)").option("--organization <id>", "(deprecated, ignored) organization is derived from login").requiredOption("--user-ids <ids>", "Comma-separated user IDs to add").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(MEMBERS_ADD_EXAMPLES).trackedAction(processContext, async (groupId, options) => {
+    warnDeprecatedOrganization2(options.organization);
     const userIds = options.userIds.split(",").map((id) => id.trim());
     const [error, result] = await catchError((async () => {
       const { api, organizationId } = await createApiClient(GroupApi, {
         loginValidity: options.loginValidity
       });
-      const orgId = options.organization ?? organizationId;
+      const orgId = organizationId;
       const group = await api.groupGetGroup({
         partitionGlobalId: orgId,
         groupId
@@ -32937,13 +33494,14 @@ var registerGroupsCommand = (program2) => {
       Data: result
     });
   });
-  members.command("revoke").description("Revoke users from a group. Pass comma-separated user IDs.").argument("<group-id>", "Group ID (UUID)").option("--organization <id>", "Organization ID (defaults to logged-in org)").requiredOption("--user-ids <ids>", "Comma-separated user IDs to revoke").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(MEMBERS_REVOKE_EXAMPLES).trackedAction(processContext, async (groupId, options) => {
+  members.command("revoke").description("Revoke users from a group. Pass comma-separated user IDs.").argument("<group-id>", "Group ID (UUID)").option("--organization <id>", "(deprecated, ignored) organization is derived from login").requiredOption("--user-ids <ids>", "Comma-separated user IDs to revoke").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(MEMBERS_REVOKE_EXAMPLES).trackedAction(processContext, async (groupId, options) => {
+    warnDeprecatedOrganization2(options.organization);
     const userIds = options.userIds.split(",").map((id) => id.trim());
     const [error, result] = await catchError((async () => {
       const { api, organizationId } = await createApiClient(GroupApi, {
         loginValidity: options.loginValidity
       });
-      const orgId = options.organization ?? organizationId;
+      const orgId = organizationId;
       const group = await api.groupGetGroup({
         partitionGlobalId: orgId,
         groupId
@@ -33221,10 +33779,10 @@ var registerPatCommand = (program2) => {
 
 // src/commands/robot-accounts.ts
 var INSTRUCTIONS4 = {
-  list: "Verify --organization is a valid org ID. Run 'robot-accounts list --help' for options.",
+  list: "Verify you are logged in. Run 'robot-accounts list --help' for options.",
   get: "Verify the robot account ID exists. Use 'robot-accounts list' to find valid IDs.",
-  create: "Verify --organization is correct. Robot account names must be unique within a partition.",
-  update: "Verify the robot account ID and --organization are correct.",
+  create: "Verify the robot account name is correct. Names must be unique within a partition.",
+  update: "Verify the robot account ID is correct.",
   delete: "Verify the robot account ID exists. The account may have already been deleted."
 };
 var ROBOT_ACCOUNTS_LIST_EXAMPLES = [
@@ -33296,14 +33854,20 @@ var ROBOT_ACCOUNTS_DELETE_EXAMPLES = [
     }
   }
 ];
+function warnDeprecatedOrganization3(org) {
+  if (org !== undefined) {
+    logger.warn("--organization is deprecated and ignored; organization is derived from login context");
+  }
+}
 var registerRobotAccountsCommand = (program2) => {
   const robotAccounts = program2.command("robot-accounts").description("Manage robot accounts. List, get, create, update, and delete robot accounts within a partition.");
-  robotAccounts.command("list").description("List robot accounts in a partition. " + "Returns account ID, name, display name, and creation time.").option("--organization <id>", "Organization ID (defaults to logged-in org)").option("-s, --search <term>", "Search by name").option("--sort-by <field>", "Sort results by field (e.g., 'Name')").addOption(new Option("--sort-order <direction>", "Sort direction (default: asc)").choices(["asc", "desc"])).option("-l, --limit <number>", "Number of items to return", String(DEFAULT_PAGE_SIZE)).option("--offset <number>", "Number of items to skip", "0").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(ROBOT_ACCOUNTS_LIST_EXAMPLES).trackedAction(processContext, async (options) => {
+  robotAccounts.command("list").description("List robot accounts in a partition. " + "Returns account ID, name, display name, and creation time.").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("-s, --search <term>", "Search by name").option("--sort-by <field>", "Sort results by field (e.g., 'Name')").addOption(new Option("--sort-order <direction>", "Sort direction (default: asc)").choices(["asc", "desc"])).option("-l, --limit <number>", "Number of items to return", String(DEFAULT_PAGE_SIZE)).option("--offset <number>", "Number of items to skip", "0").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(ROBOT_ACCOUNTS_LIST_EXAMPLES).trackedAction(processContext, async (options) => {
+    warnDeprecatedOrganization3(options.organization);
     const [error, result] = await catchError((async () => {
       const { api, organizationId } = await createApiClient(RobotAccountApi, {
         loginValidity: options.loginValidity
       });
-      const orgId = options.organization ?? organizationId;
+      const orgId = organizationId;
       return await api.robotAccountGetRobotAccounts({
         partitionGlobalId: orgId,
         searchTerm: options.search,
@@ -33328,12 +33892,13 @@ var registerRobotAccountsCommand = (program2) => {
       Data: result.results ?? []
     });
   });
-  robotAccounts.command("get").description("Get robot account details by ID. " + "Use 'robot-accounts list' to retrieve the ID.").argument("<robot-account-id>", "Robot account ID (UUID)").option("--organization <id>", "Organization ID (defaults to logged-in org)").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(ROBOT_ACCOUNTS_GET_EXAMPLES).trackedAction(processContext, async (robotAccountId, options) => {
+  robotAccounts.command("get").description("Get robot account details by ID. " + "Use 'robot-accounts list' to retrieve the ID.").argument("<robot-account-id>", "Robot account ID (UUID)").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(ROBOT_ACCOUNTS_GET_EXAMPLES).trackedAction(processContext, async (robotAccountId, options) => {
+    warnDeprecatedOrganization3(options.organization);
     const [error, account] = await catchError((async () => {
       const { api, organizationId } = await createApiClient(RobotAccountApi, {
         loginValidity: options.loginValidity
       });
-      const orgId = options.organization ?? organizationId;
+      const orgId = organizationId;
       return await api.robotAccountGetRobotAccount({
         partitionGlobalId: orgId,
         robotAccountId
@@ -33354,12 +33919,13 @@ var registerRobotAccountsCommand = (program2) => {
       Data: account
     });
   });
-  robotAccounts.command("create").description("Create a new robot account in a partition.").argument("<name>", "Robot account name").option("--organization <id>", "Organization ID (defaults to logged-in org)").option("--display-name <display-name>", "Display name").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(ROBOT_ACCOUNTS_CREATE_EXAMPLES).trackedAction(processContext, async (name, options) => {
+  robotAccounts.command("create").description("Create a new robot account in a partition.").argument("<name>", "Robot account name").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("--display-name <display-name>", "Display name").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(ROBOT_ACCOUNTS_CREATE_EXAMPLES).trackedAction(processContext, async (name, options) => {
+    warnDeprecatedOrganization3(options.organization);
     const [error, result] = await catchError((async () => {
       const { api, organizationId } = await createApiClient(RobotAccountApi, {
         loginValidity: options.loginValidity
       });
-      const orgId = options.organization ?? organizationId;
+      const orgId = organizationId;
       const createCommand2 = {
         name,
         displayName: options.displayName ?? name,
@@ -33384,7 +33950,8 @@ var registerRobotAccountsCommand = (program2) => {
       Data: result
     });
   });
-  robotAccounts.command("update").description("Update a robot account. Use 'robot-accounts list' to retrieve the ID.").argument("<robot-account-id>", "Robot account ID (UUID)").option("--organization <id>", "Organization ID (defaults to logged-in org)").option("--display-name <display-name>", "New display name").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(ROBOT_ACCOUNTS_UPDATE_EXAMPLES).trackedAction(processContext, async (robotAccountId, options) => {
+  robotAccounts.command("update").description("Update a robot account. Use 'robot-accounts list' to retrieve the ID.").argument("<robot-account-id>", "Robot account ID (UUID)").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("--display-name <display-name>", "New display name").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(ROBOT_ACCOUNTS_UPDATE_EXAMPLES).trackedAction(processContext, async (robotAccountId, options) => {
+    warnDeprecatedOrganization3(options.organization);
     if (options.displayName === undefined) {
       OutputFormatter.error({
         Result: RESULTS.Failure,
@@ -33398,7 +33965,7 @@ var registerRobotAccountsCommand = (program2) => {
       const { api, organizationId } = await createApiClient(RobotAccountApi, {
         loginValidity: options.loginValidity
       });
-      const orgId = options.organization ?? organizationId;
+      const orgId = organizationId;
       const updateCommand = {
         partitionGlobalId: orgId,
         displayName: options.displayName
@@ -33423,12 +33990,13 @@ var registerRobotAccountsCommand = (program2) => {
       Data: result
     });
   });
-  robotAccounts.command("delete").description("Delete a robot account. " + "Use 'robot-accounts list' to retrieve the ID.").argument("<robot-account-id>", "Robot account ID (UUID)").option("--organization <id>", "Organization ID (defaults to logged-in org)").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(ROBOT_ACCOUNTS_DELETE_EXAMPLES).trackedAction(processContext, async (robotAccountId, options) => {
+  robotAccounts.command("delete").description("Delete a robot account. " + "Use 'robot-accounts list' to retrieve the ID.").argument("<robot-account-id>", "Robot account ID (UUID)").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(ROBOT_ACCOUNTS_DELETE_EXAMPLES).trackedAction(processContext, async (robotAccountId, options) => {
+    warnDeprecatedOrganization3(options.organization);
     const [error] = await catchError((async () => {
       const { api, organizationId } = await createApiClient(RobotAccountApi, {
         loginValidity: options.loginValidity
       });
-      const orgId = options.organization ?? organizationId;
+      const orgId = organizationId;
       await api.robotAccountDelete({
         partitionGlobalId: orgId,
         robotAccountId
@@ -33930,9 +34498,9 @@ var registerSmtpCommand = (program2) => {
 
 // src/commands/users.ts
 var INSTRUCTIONS7 = {
-  list: "Verify --organization is a valid org ID. Run 'users list --help' for options.",
+  list: "Verify you are logged in. Run 'users list --help' for options.",
   get: "Verify the user ID exists. Use 'users list' to find valid IDs.",
-  create: "Verify --organization and --email are correct. The username may already exist.",
+  create: "Verify --email is correct. The username may already exist.",
   update: "Verify the user ID exists. Use 'users list' to find valid IDs.",
   delete: "Verify the user ID exists. The user may have already been deleted.",
   invite: "Verify the email address is valid and the org allows invitations."
@@ -34021,14 +34589,20 @@ var USERS_INVITE_EXAMPLES = [
     }
   }
 ];
+function warnDeprecatedOrganization4(org) {
+  if (org !== undefined) {
+    logger.warn("--organization is deprecated and ignored; organization is derived from login context");
+  }
+}
 var registerUsersCommand = (program2) => {
   const users = program2.command("users").description("Manage users. List, get, create, update, and delete users.");
-  users.command("list").description("List users in a partition. " + "Returns user ID, username, email, name, and creation time.").option("--organization <id>", "Organization ID (defaults to logged-in org)").option("-s, --search <term>", "Search users by name or email").option("--sort-by <field>", "Sort results by field (e.g., 'UserName', 'Email')").addOption(new Option("--sort-order <direction>", "Sort direction (default: asc)").choices(["asc", "desc"])).option("-l, --limit <number>", "Number of items to return", String(DEFAULT_PAGE_SIZE)).option("--offset <number>", "Number of items to skip", "0").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(USERS_LIST_EXAMPLES).trackedAction(processContext, async (options) => {
+  users.command("list").description("List users in a partition. " + "Returns user ID, username, email, name, and creation time.").option("--organization <id>", "(deprecated, ignored) organization is derived from login").option("-s, --search <term>", "Search users by name or email").option("--sort-by <field>", "Sort results by field (e.g., 'UserName', 'Email')").addOption(new Option("--sort-order <direction>", "Sort direction (default: asc)").choices(["asc", "desc"])).option("-l, --limit <number>", "Number of items to return", String(DEFAULT_PAGE_SIZE)).option("--offset <number>", "Number of items to skip", "0").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(USERS_LIST_EXAMPLES).trackedAction(processContext, async (options) => {
+    warnDeprecatedOrganization4(options.organization);
     const [error, result] = await catchError((async () => {
       const { api, organizationId } = await createApiClient(UserApi, {
         loginValidity: options.loginValidity
       });
-      const orgId = options.organization ?? organizationId;
+      const orgId = organizationId;
       return await api.userGetUsers({
         partitionGlobalId: orgId,
         searchTerm: options.search,
@@ -34054,6 +34628,7 @@ var registerUsersCommand = (program2) => {
     });
   });
   users.command("get").description("Get user details by ID. Use 'users list' to retrieve the user ID.").argument("<user-id>", "User ID (UUID)").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(USERS_GET_EXAMPLES).trackedAction(processContext, async (userId, options) => {
+    warnDeprecatedOrganization4(options.organization);
     const [error, user] = await catchError((async () => {
       const { api } = await createApiClient(UserApi, {
         loginValidity: options.loginValidity
@@ -34075,12 +34650,13 @@ var registerUsersCommand = (program2) => {
       Data: user
     });
   });
-  users.command("create").description("Create a new user. Provide a username and email address.").argument("<username>", "Username for the new user").option("--organization <id>", "Organization ID (defaults to logged-in org)").requiredOption("-e, --email <email>", "Email address").option("-n, --name <name>", "First name").option("--surname <surname>", "Last name").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(USERS_CREATE_EXAMPLES).trackedAction(processContext, async (username, options) => {
+  users.command("create").description("Create a new user. Provide a username and email address.").argument("<username>", "Username for the new user").option("--organization <id>", "(deprecated, ignored) organization is derived from login").requiredOption("-e, --email <email>", "Email address").option("-n, --name <name>", "First name").option("--surname <surname>", "Last name").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(USERS_CREATE_EXAMPLES).trackedAction(processContext, async (username, options) => {
+    warnDeprecatedOrganization4(options.organization);
     const [error, result] = await catchError((async () => {
       const { api, organizationId } = await createApiClient(UserApi, {
         loginValidity: options.loginValidity
       });
-      const orgId = options.organization ?? organizationId;
+      const orgId = organizationId;
       const createCommand2 = {
         partitionGlobalId: orgId,
         userName: username,
@@ -34108,6 +34684,7 @@ var registerUsersCommand = (program2) => {
     });
   });
   users.command("update").description("Update an existing user. Use 'users list' to retrieve the user ID.").argument("<user-id>", "User ID (UUID)").option("-e, --email <email>", "New email address").option("-n, --name <name>", "New first name").option("--surname <surname>", "New last name").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(USERS_UPDATE_EXAMPLES).trackedAction(processContext, async (userId, options) => {
+    warnDeprecatedOrganization4(options.organization);
     if (options.email === undefined && options.name === undefined && options.surname === undefined) {
       OutputFormatter.error({
         Result: RESULTS.Failure,
@@ -34149,6 +34726,7 @@ var registerUsersCommand = (program2) => {
     });
   });
   users.command("delete").description("Delete a user by ID. Use 'users list' to retrieve the user ID.").argument("<user-id>", "User ID (UUID)").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(USERS_DELETE_EXAMPLES).trackedAction(processContext, async (userId, options) => {
+    warnDeprecatedOrganization4(options.organization);
     const [error] = await catchError((async () => {
       const { api } = await createApiClient(UserApi, {
         loginValidity: options.loginValidity
@@ -34174,6 +34752,7 @@ var registerUsersCommand = (program2) => {
     });
   });
   users.command("invite").description("Invite users by email. Sends an invitation to join the organization.").requiredOption("-e, --email <emails>", "Comma-separated email addresses to invite").option("-n, --name <name>", "First name for the invited user").option("--surname <surname>", "Last name for the invited user").option("--login-validity <minutes>", "Override token validity (minutes)", (v) => Number.parseInt(v, 10)).examples(USERS_INVITE_EXAMPLES).trackedAction(processContext, async (options) => {
+    warnDeprecatedOrganization4(options.organization);
     const [error, result] = await catchError((async () => {
       const { config } = await createIdentityConfig({
         loginValidity: options.loginValidity