@uipath/ixp-tool 1.204.0-preview.254 → 1.205.0-preview.256

package/dist/index.js

@@ -3,7 +3,7 @@ import {
   Command,
   package_default,
   registerCommands
-} from "./tool-vsg7smdq.js";
+} from "./tool-6j0f3qjh.js";
 import"./tool-1de529jm.js";
 
 // src/index.ts

package/dist/{tool-vsg7smdq.js → tool-6j0f3qjh.js}

@@ -2101,7 +2101,7 @@ var package_default = {
   name: "@uipath/ixp-tool",
   author: "UiPath",
   license: "SEE LICENSE IN LICENSE.txt",
-  version: "1.204.0-preview.254",
+  version: "1.205.0-preview.256",
   description: "Manage UiPath IXP projects, prompts, predictions, and model publishing.",
   private: false,
   repository: {
@@ -2324,6 +2324,16 @@ class NodeFileSystem {
   async rename(oldPath, newPath) {
     await fs.rename(oldPath, newPath);
   }
+  async isSymbolicLink(filePath) {
+    try {
+      return (await fs.lstat(filePath)).isSymbolicLink();
+    } catch (error) {
+      if (this.isEnoent(error) || this.hasErrnoCode(error, "ENOTDIR")) {
+        return false;
+      }
+      throw error;
+    }
+  }
   async realpath(filePath) {
     try {
       return await fs.realpath(filePath);
@@ -3355,7 +3365,7 @@ function setGlobalLogFilePath(path2) {
 function getGlobalLogFilePath() {
   return logFilePathSlot.get("");
 }
-var DEFAULT_LOG_LEVEL = 3 /* ERROR */;
+var DEFAULT_LOG_LEVEL = 2 /* WARN */;
 
 class SimpleLogger {
   __brand = "SimpleLogger";
@@ -3622,7 +3632,9 @@ var ErrorDimensions = {
   Result: "Result",
   ErrorCode: "ErrorCode",
   Retry: "Retry",
-  ErrorMessage: "ErrorMessage"
+  ErrorMessage: "ErrorMessage",
+  HttpStatus: "HttpStatus",
+  UpstreamErrorCode: "UpstreamErrorCode"
 };
 var AuthDimensions = {
   AuthenticationMethod: "AuthenticationMethod",
@@ -4616,7 +4628,9 @@ var CLI_ERROR_CODES = [
   "timeout",
   "server_error",
   "method_not_allowed",
+  "not_supported",
   "configuration_error",
+  "execution_failed",
   "unknown_error"
 ];
 var RETRY_HINTS = [
@@ -5573,7 +5587,9 @@ var OutputFormatter;
         [ErrorDimensions.Result]: data.Result,
         [ErrorDimensions.ErrorCode]: data.ErrorCode,
         [ErrorDimensions.Retry]: data.Retry,
-        [ErrorDimensions.ErrorMessage]: data.Message
+        [ErrorDimensions.ErrorMessage]: data.Message,
+        [ErrorDimensions.HttpStatus]: data.Context?.httpStatus?.toString(),
+        [ErrorDimensions.UpstreamErrorCode]: data.Context?.errorCode
       });
     }
     logOutput(normalizeOutputKeys(envelope), getOutputFormat());
@@ -6347,6 +6363,52 @@ var BOOLEAN_FLAGS = new Set(HOST_GLOBAL_FLAGS);
 // ../common/src/interactivity-context.ts
 var modeSlot = singleton("InteractivityMode");
 var interactiveFlagSlot = singleton("InteractiveFlag");
+// ../common/src/json-option.ts
+function jsonFileOptionHelp(inlineFlag) {
+  return `Path to a file holding the ${inlineFlag} JSON. Use it on Windows cmd/PowerShell, where quotes inside an inline JSON argument are stripped before the CLI sees them.`;
+}
+async function readJsonOption(source) {
+  const read = await readJsonOptionText(source);
+  return read === undefined ? undefined : parseJsonOptionText(read, source);
+}
+async function readJsonOptionText(source) {
+  const { inline, file, inlineFlag, fileFlag } = source;
+  if (file !== undefined) {
+    const fs2 = getFileSystem();
+    const bytes = await fs2.readFile(file);
+    if (bytes === null) {
+      throw new Error(`File not found: ${fs2.path.resolve(file)}`);
+    }
+    const text = decodeJsonFile(bytes).trim();
+    if (text === "") {
+      throw new Error(`Expected JSON in ${file} but the file is empty.`);
+    }
+    return { text, origin: "file", label: `${fileFlag} ${file}` };
+  }
+  if (inline === undefined) {
+    return;
+  }
+  return { text: inline, origin: "inline", label: inlineFlag };
+}
+function decodeJsonFile(bytes) {
+  const utf16le = bytes[0] === 255 && bytes[1] === 254;
+  return new TextDecoder(utf16le ? "utf-16le" : "utf-8").decode(bytes);
+}
+function parseJsonOptionText(read, flags) {
+  try {
+    return JSON.parse(read.text);
+  } catch (err) {
+    const detail = err instanceof Error ? err.message : String(err);
+    const hint = read.origin === "inline" ? windowsJsonHint(flags) : "";
+    throw new Error(`${read.label} is not valid JSON: ${detail}.${hint}`);
+  }
+}
+function windowsJsonHint(flags) {
+  if (process.platform !== "win32") {
+    return "";
+  }
+  return ` On Windows cmd/PowerShell, quotes inside an inline JSON argument are stripped and \`& | < > ^\` split the command — pass the file with \`${flags.fileFlag} <path>\` instead.`;
+}
 // ../common/src/mime-types.ts
 var MIME_TYPES_BY_EXTENSION = Object.freeze({
   pdf: "application/pdf",
@@ -6386,6 +6448,35 @@ function warnDeprecatedOptionAlias(deprecatedFlag, preferredFlag) {
   getOutputSink().writeErr(`[WARN] ${deprecatedFlag} is deprecated. Use ${preferredFlag} instead.
 `);
 }
+function addDeprecatedOptionAlias(command, deprecatedFlags, preferredLong) {
+  const preferred = command.options.find((option) => option.long === preferredLong);
+  if (preferred === undefined) {
+    throw new Error(`${preferredLong} must be registered before its deprecated alias`);
+  }
+  const deprecated = new Option(deprecatedFlags, `Deprecated alias for ${preferredLong}`).hideHelp();
+  const preferredKey = preferred.attributeName();
+  const deprecatedLabel = [deprecated.short, deprecated.long].filter((flag) => flag !== undefined).join("/");
+  let aliasUsed = false;
+  const conflict = () => command.error(`error: option '${deprecated.flags}' cannot be used with option '${preferred.flags}'`, {
+    code: "commander.conflictingOption",
+    exitCode: EXIT_CODES.ValidationError
+  });
+  command.on(`option:${preferred.name()}`, () => {
+    if (aliasUsed)
+      conflict();
+  });
+  command.on(`option:${deprecated.name()}`, (value) => {
+    if (!aliasUsed) {
+      if (command.getOptionValueSource(preferredKey) === "cli") {
+        conflict();
+      }
+      warnDeprecatedOptionAlias(deprecatedLabel, preferredLong);
+      aliasUsed = true;
+    }
+    command.setOptionValueWithSource(preferredKey, value, "cli");
+  });
+  return command.addOption(deprecated);
+}
 var TENANT_SWITCH_COMMAND = "uip login tenant set <tenant>";
 function createHiddenDeprecatedTenantOption(flags = "-t, --tenant <tenant-name>") {
   return new Option(flags, `Tenant name. Deprecated; use ${TENANT_SWITCH_COMMAND} to switch active tenants.`).hideHelp().argParser((tenant) => {
@@ -6398,6 +6489,30 @@ function warnDeprecatedTenantOption(tenant) {
     return;
   warnDeprecatedOptionAlias("--tenant", TENANT_SWITCH_COMMAND);
 }
+// ../common/src/option-groups.ts
+function requireOneOfOptions(command, longFlags) {
+  const options = longFlags.map((long) => {
+    const option = command.options.find((o) => o.long === long);
+    if (option === undefined) {
+      throw new Error(`${long} must be registered on '${command.name()}' before requireOneOfOptions`);
+    }
+    return option;
+  });
+  const flags = options.map((option) => `'${option.flags}'`).join(" or ");
+  command.hook("preAction", (thisCommand) => {
+    const given = options.some((option) => {
+      const source = thisCommand.getOptionValueSource(option.attributeName());
+      return source !== undefined && source !== "default";
+    });
+    if (given) {
+      return;
+    }
+    thisCommand.error(`error: required option ${flags} not specified`, {
+      code: "commander.missingMandatoryOptionValue",
+      exitCode: EXIT_CODES.ValidationError
+    });
+  });
+}
 // ../common/src/option-validators.ts
 function parseLimit(raw, _previous) {
   return parseBoundedInt(raw, "--limit", { min: 1, max: 1e4 });
@@ -6661,22 +6776,12 @@ var resolveConfigAsync = async ({
     baseUrl = DEFAULT_BASE_URL;
   }
   baseUrl = normalizeAndValidateBaseUrl(baseUrl);
-  let clientId = customClientId;
-  if (!clientId && fileAuth.clientId) {
-    clientId = fileAuth.clientId;
-  }
-  if (!clientId) {
-    clientId = DEFAULT_CLIENT_ID;
-  }
-  let clientSecret = customClientSecret;
-  if (!clientSecret && fileAuth.clientSecret) {
-    clientSecret = fileAuth.clientSecret;
-  }
-  const isExternalAppAuth = clientId !== DEFAULT_CLIENT_ID && (Boolean(clientSecret) || Boolean(customClientAssertion));
+  const clientId = customClientId || DEFAULT_CLIENT_ID;
+  const isExternalAppAuth = clientId !== DEFAULT_CLIENT_ID && (Boolean(customClientSecret) || Boolean(customClientAssertion));
   const scopes = resolveScopes(isExternalAppAuth, customScopes, fileAuth.scopes);
   return {
     clientId,
-    clientSecret,
+    clientSecret: customClientSecret,
     scopes,
     baseUrl,
     authorizationEndpoint: `${baseUrl}/identity_/connect/authorize`,
@@ -6850,6 +6955,16 @@ var resolveIdentityType = (claims, authFlow, email) => {
   }
   return;
 };
+var resolveApplicationSubtype = (claims, authFlow) => {
+  switch (asString(claims?.sub_type)) {
+    case "service.external":
+      return "External";
+    case "service.internal":
+      return "Internal";
+    default:
+      return authFlow === "client_credentials" || authFlow === "federated_credentials" ? "External" : undefined;
+  }
+};
 var looksLikeEmail = (value) => value?.includes("@") ?? false;
 var pickEmail = (claims) => {
   for (const candidate of [claims?.email, claims?.preferred_username]) {
@@ -6891,6 +7006,12 @@ var resolveSessionIdentity = (accessToken, authFlow) => {
   const clientId = asString(claims?.client_id);
   if (clientId)
     identity.clientId = clientId;
+  const subType = asString(claims?.sub_type);
+  if (subType)
+    identity.subType = subType;
+  const applicationSubtype = resolveApplicationSubtype(claims, authFlow);
+  if (applicationSubtype)
+    identity.applicationSubtype = applicationSubtype;
   return identity;
 };
 var readTokenScopes = (accessToken) => accessToken ? pickScopes(decodeClaims(accessToken)) : undefined;
@@ -7183,6 +7304,40 @@ var tryRobotClientFallback = async (options = {}) => {
   }
 };
 
+// ../auth/src/tenantSelection.ts
+var LOGIN_STATUS_HINT = "Run 'uip login status' to see the organization the CLI is signed in to.";
+var organizationHint = (organizationId) => `The request used '${organizationId}' as the organization. ${LOGIN_STATUS_HINT}`;
+var IDENTIFIER_STATUSES = new Set([400, 403, 404]);
+var describeNonJsonResponse = (organizationId, response, parseError) => {
+  if (response.redirected) {
+    return `Could not find organization '${organizationId}': the request was ` + `redirected to a sign-in page instead of the organization's tenant ` + `list. ${LOGIN_STATUS_HINT}`;
+  }
+  const contentType = response.headers.get("content-type") ?? "unknown";
+  return `The organization service returned a '${contentType}' response instead ` + `of JSON: ${parseError.message}. ${organizationHint(organizationId)}`;
+};
+var fetchTenantsAndOrganizations = async (baseUrl, accessToken, organizationId, signal) => {
+  const url = `${baseUrl}/${organizationId}/portal_/api/filtering/leftnav/tenantsAndOrganizationInfo`;
+  const response = await fetch(url, {
+    headers: {
+      Authorization: `Bearer ${accessToken}`
+    },
+    ...signal ? { signal } : {}
+  });
+  if (!response.ok) {
+    if (response.status === 401) {
+      throw new Error(`Unauthorized: the access token was rejected, it was not ` + `issued for organization '${organizationId}', or ` + `'${organizationId}' was not accepted as an organization ` + `URL segment in this environment. ` + LOGIN_STATUS_HINT);
+    }
+    const errorText = await response.text();
+    const message = `Failed to get tenants and organizations: ${response.status} ${errorText}`;
+    throw new Error(IDENTIFIER_STATUSES.has(response.status) ? `${message}. ${organizationHint(organizationId)}` : message);
+  }
+  const [parseError, data] = await catchError2(response.json());
+  if (parseError) {
+    throw new Error(describeNonJsonResponse(organizationId, response, parseError));
+  }
+  return data;
+};
+
 // ../auth/src/tokenRefresh.ts
 var TOKEN_REFRESH_REAUTHENTICATE_MESSAGE = "Token refresh failed. Run 'uip login' to re-authenticate.";
 
@@ -7395,6 +7550,8 @@ var saveEnvFileAsync = async ({
 };
 
 // ../auth/src/loginStatus.ts
+var defaultRobotTenantIdCache = new Map;
+var ROBOT_TENANT_LOOKUP_TIMEOUT_MS = 5000;
 var getLoginStatusAsync = async (options = {}) => {
   return getLoginStatusWithDeps(options);
 };
@@ -7407,12 +7564,20 @@ var getLoginStatusWithDeps = async (options = {}, deps = {}) => {
     refreshToken: refreshTokenFn = refreshAccessToken,
     resolveConfig = resolveConfigAsync,
     robotFallback = tryRobotClientFallback,
+    fetchTenantsAndOrgs = fetchTenantsAndOrganizations,
+    robotTenantIdCache = defaultRobotTenantIdCache,
+    robotTenantLookupTimeoutMs = ROBOT_TENANT_LOOKUP_TIMEOUT_MS,
     loadBreaker = loadRefreshBreaker,
     saveBreaker = saveRefreshBreaker,
     clearBreaker = clearRefreshBreaker
   } = deps;
+  const robotDeps = {
+    fetchTenantsAndOrgs,
+    cache: robotTenantIdCache,
+    lookupTimeoutMs: robotTenantLookupTimeoutMs
+  };
   if (isRobotAuthEnforced()) {
-    return resolveRobotEnforcedStatus(robotFallback);
+    return resolveRobotEnforcedStatus(robotFallback, robotDeps);
   }
   if (isEnvAuthEnabled()) {
     return readAuthFromEnv();
@@ -7430,7 +7595,7 @@ var getLoginStatusWithDeps = async (options = {}, deps = {}) => {
         hint: `No credentials found for profile "${activeProfile}". Run 'uip login --profile ${activeProfile}' to authenticate this profile.`
       };
     }
-    return resolveBorrowedRobotStatus(robotFallback);
+    return resolveBorrowedRobotStatus(robotFallback, robotDeps);
   }
   const loaded = await loadFileCredentials(loadEnvFile, absolutePath);
   if ("status" in loaded) {
@@ -7472,7 +7637,7 @@ var getLoginStatusWithDeps = async (options = {}, deps = {}) => {
   }
   return buildFileStatus(tokens, credentials, globalHint);
 };
-async function resolveRobotEnforcedStatus(robotFallback) {
+async function resolveRobotEnforcedStatus(robotFallback, deps) {
   if (isEnvAuthEnabled()) {
     throw new EnvAuthConfigError(`${ENV_AUTH_ENABLE_VAR}=true and ${ENFORCE_ROBOT_AUTH_VAR}=true ` + `are mutually exclusive. Unset one of them and re-run.`);
   }
@@ -7483,11 +7648,11 @@ async function resolveRobotEnforcedStatus(robotFallback) {
       hint: `${ENFORCE_ROBOT_AUTH_VAR}=true but the UiPath Robot ` + `session is unavailable. Start and sign in to the Assistant, ` + `or unset ${ENFORCE_ROBOT_AUTH_VAR} to fall back to file or ` + `env-var authentication.`
     };
   }
-  return buildRobotStatus(robotCreds);
+  return buildRobotStatus(robotCreds, deps);
 }
-async function resolveBorrowedRobotStatus(robotFallback) {
+async function resolveBorrowedRobotStatus(robotFallback, deps) {
   const robotCreds = await robotFallback();
-  return robotCreds ? buildRobotStatus(robotCreds) : { loginStatus: "Not logged in" };
+  return robotCreds ? buildRobotStatus(robotCreds, deps) : { loginStatus: "Not logged in" };
 }
 async function loadFileCredentials(loadEnvFile, absolutePath) {
   let credentials;
@@ -7622,9 +7787,10 @@ function identityFields(accessToken, credentials) {
     ...scopes ? { scopes } : {}
   };
 }
-function buildRobotStatus(robotCreds) {
+async function buildRobotStatus(robotCreds, deps) {
   const identity = resolveSessionIdentity(robotCreds.accessToken);
   const scopes = readTokenScopes(robotCreds.accessToken);
+  const tenant = robotCreds.tenantId ? { tenantId: robotCreds.tenantId } : await resolveRobotTenantId(robotCreds, deps);
   return {
     loginStatus: "Logged in",
     accessToken: robotCreds.accessToken,
@@ -7632,14 +7798,62 @@ function buildRobotStatus(robotCreds) {
     organizationName: robotCreds.organizationName,
     organizationId: robotCreds.organizationId,
     tenantName: robotCreds.tenantName,
-    tenantId: robotCreds.tenantId,
+    tenantId: tenant.tenantId,
     issuer: robotCreds.issuer,
     expiration: getTokenExpiration(robotCreds.accessToken),
     source: "robot" /* Robot */,
+    ...tenant.hint ? { hint: tenant.hint } : {},
     ...identity ? { identity } : {},
     ...scopes ? { scopes } : {}
   };
 }
+async function resolveRobotTenantId(robotCreds, deps) {
+  const { baseUrl, accessToken, tenantName } = robotCreds;
+  const organization = robotCreds.organizationName ?? robotCreds.organizationId;
+  if (!tenantName || !organization) {
+    return {};
+  }
+  const key = `${baseUrl}|${organization}|${tenantName}|${accessToken}`;
+  let pending = deps.cache.get(key);
+  if (!pending) {
+    pending = catchError2(lookupRobotTenantId({ baseUrl, accessToken, organization, tenantName }, deps)).then(([error, resolution]) => {
+      const settled = error ? { hint: tenantLookupFailureHint(tenantName, error.message) } : resolution;
+      if (!settled.tenantId) {
+        deps.cache.delete(key);
+      }
+      return settled;
+    });
+    deps.cache.set(key, pending);
+  }
+  return pending;
+}
+async function lookupRobotTenantId(target, deps) {
+  const { baseUrl, accessToken, organization, tenantName } = target;
+  const [error, data] = await catchError2(deps.fetchTenantsAndOrgs(baseUrl, accessToken, organization, AbortSignal.timeout(deps.lookupTimeoutMs)));
+  if (error) {
+    const reason = error.name === "TimeoutError" ? `the tenant list did not answer within ${deps.lookupTimeoutMs} ms.` : error.message;
+    return { hint: tenantLookupFailureHint(tenantName, reason) };
+  }
+  const rows = data?.tenants;
+  const tenants = Array.isArray(rows) ? rows.filter((tenant) => typeof tenant?.id === "string" && typeof tenant?.name === "string") : [];
+  const wantedName = decodePathSegment(tenantName);
+  const wanted = wantedName.toLowerCase();
+  const match = tenants.find((tenant) => tenant.name === wantedName) ?? tenants.find((tenant) => tenant.name.toLowerCase() === wanted);
+  if (!match) {
+    const names = tenants.map((tenant) => tenant.name).join(", ");
+    return {
+      hint: `The Robot session targets tenant '${tenantName}', but ` + `organization '${organization}' lists no tenant of that name` + `${names ? ` (available: ${names})` : ""}. Commands that need ` + `the tenant id will fail until it can be resolved.`
+    };
+  }
+  return { tenantId: match.id };
+}
+function tenantLookupFailureHint(tenantName, reason) {
+  return `Could not resolve the id of tenant '${tenantName}' from the ` + `Robot session: ${reason} Commands that need the tenant id will ` + `fail until it can be resolved.`;
+}
+function decodePathSegment(segment) {
+  const [error, decoded] = catchError2(() => decodeURIComponent(segment));
+  return error ? segment : decoded;
+}
 var isFileNotFoundError = (error) => {
   if (!(error instanceof Object))
     return false;
@@ -7875,9 +8089,6 @@ function normalizeTokenRefreshUnavailableFailure() {
 function errorMessage(error) {
   return error instanceof Error ? error.message : String(error);
 }
-// ../auth/src/tenantSelection.ts
-var IDENTIFIER_STATUSES = new Set([400, 403, 404]);
-
 // ../auth/src/selectTenant.ts
 var TENANT_SELECTION_REQUIRED_CODE = "TENANT_SELECTION_REQUIRED";
 var INVALID_TENANT_CODE = "INVALID_TENANT";
@@ -7890,7 +8101,7 @@ var package_default2 = {
   name: "@uipath/ixp-sdk",
   author: "UiPath",
   license: "SEE LICENSE IN LICENSE.txt",
-  version: "1.204.0-preview.254",
+  version: "1.205.0-preview.256",
   description: "SDK for the UiPath IXP (Intelligent eXtraction Platform) API — projects, taxonomies, prompts, predictions, and model publishing.",
   repository: {
     type: "git",
@@ -8329,13 +8540,8 @@ var MAX_TITLE_LENGTH = 1024;
 var MAX_FOLDER_KEY_LENGTH = 256;
 
 // src/commands/data-types.ts
-function parseChoicesJson(raw) {
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch (e) {
-    throw new Error(`--choices is not valid JSON: ${e instanceof Error ? e.message : String(e)}`);
-  }
+var CHOICES_FLAGS = { inlineFlag: "--choices", fileFlag: "--choices-file" };
+function parseChoicesJson(parsed) {
   if (!Array.isArray(parsed)) {
     throw new Error("--choices must be a JSON array");
   }
@@ -8398,6 +8604,19 @@ var DATA_TYPES_ADD_EXAMPLES = [
         InputValue: "exact-match"
       }
     }
+  },
+  {
+    Description: "Create a Choice data type with the choices read from a file (use this on Windows PowerShell, which strips quotes from inline JSON)",
+    Command: 'uip ixp data-types add my-invoices --name "Citizenship" --kind choice --instructions "Borrower citizenship status." --input-value exact-match --choices-file choices.json',
+    Output: {
+      Code: "IxpDataTypesAdd",
+      Data: {
+        ProjectName: "my-invoices",
+        Name: "Citizenship",
+        Kind: "choice",
+        InputValue: "exact-match"
+      }
+    }
   }
 ];
 var DATA_TYPES_UPDATE_INSTRUCTIONS_EXAMPLES = [
@@ -8442,9 +8661,14 @@ var DATA_TYPES_DELETE_EXAMPLES = [
 ];
 var registerDataTypesCommand = (program2) => {
   const dataTypes = program2.command("data-types").description("Manage data types (entity_defs) — the reusable type definitions fields reference via field_type_id");
-  dataTypes.command("add").description("Create a new data type in the project").argument("<project-name>", "Project name").requiredOption("--name <name>", `Data type name (at most ${MAX_NAME_LENGTH} characters)`).requiredOption("--kind <kind>", "Underlying data type kind: text, date, money, number, boolean, choice").requiredOption("--instructions <text>", `Instructions describing what this type represents and where its values appear (at most ${MAX_INSTRUCTIONS_LENGTH} characters)`).option("--input-value <mode>", "Whether the value appears verbatim in the document (exact-match) or is inferred/computed (inferred). Required when --kind is text or choice; forbidden for date, money, number, and boolean (those kinds don't have this property — matches the IXP UI's radio visibility).").option("--choices <json>", 'Required when --kind choice. JSON array of choices: [{"value":"<canonical>","alternates":["<alt1>","<alt2>",...]}]. `value` (required) is the canonical display name (model output). `alternates` (optional, defaults to []) are alternate spellings the model maps to `value` — omit or set to [] when the canonical value is the only matched form.').addOption(createHiddenDeprecatedTenantOption("-t, --tenant <tenant-name>")).examples(DATA_TYPES_ADD_EXAMPLES).trackedAction(processContext, async (projectName, options) => {
+  dataTypes.command("add").description("Create a new data type in the project").argument("<project-name>", "Project name").requiredOption("--name <name>", `Data type name (at most ${MAX_NAME_LENGTH} characters)`).requiredOption("--kind <kind>", "Underlying data type kind: text, date, money, number, boolean, choice").requiredOption("--instructions <text>", `Instructions describing what this type represents and where its values appear (at most ${MAX_INSTRUCTIONS_LENGTH} characters)`).option("--input-value <mode>", "Whether the value appears verbatim in the document (exact-match) or is inferred/computed (inferred). Required when --kind is text or choice; forbidden for date, money, number, and boolean (those kinds don't have this property — matches the IXP UI's radio visibility).").option("--choices <json>", 'Required when --kind choice. JSON array of choices: [{"value":"<canonical>","alternates":["<alt1>","<alt2>",...]}]. `value` (required) is the canonical display name (model output). `alternates` (optional, defaults to []) are alternate spellings the model maps to `value` — omit or set to [] when the canonical value is the only matched form.').addOption(new Option("--choices-file <path>", jsonFileOptionHelp("--choices")).conflicts("choices")).addOption(createHiddenDeprecatedTenantOption("-t, --tenant <tenant-name>")).examples(DATA_TYPES_ADD_EXAMPLES).trackedAction(processContext, async (projectName, options) => {
     const [err, response] = await catchError((async () => {
-      const choices = options.choices ? parseChoicesJson(options.choices) : undefined;
+      const rawChoices = await readJsonOption({
+        inline: options.choices,
+        file: options.choicesFile,
+        ...CHOICES_FLAGS
+      });
+      const choices = rawChoices === undefined ? undefined : parseChoicesJson(rawChoices);
       const config = await createIxpConfig({
         tenant: options.tenant
       });
@@ -8852,7 +9076,7 @@ var registerDocumentsCommand = (program2) => {
       Data: page
     }, { preserveDataKeys: true });
   });
-  document.command("download").description("Download the original document file (PDF/PNG/JPG/etc.) for viewing").argument("<project-name>", "Project name").argument("<document-id>", "Document ID").option("-o, --output <path>", "Output file path (extension auto-corrected to match content type)", defaultDownloadPath()).addOption(createHiddenDeprecatedTenantOption("-t, --tenant <tenant-name>")).examples(DOCUMENTS_DOWNLOAD_EXAMPLES).trackedAction(processContext, async (projectName, documentUid, options) => {
+  const download = document.command("download").description("Download the original document file (PDF/PNG/JPG/etc.) for viewing").argument("<project-name>", "Project name").argument("<document-id>", "Document ID").option("-o, --output-file <path>", "Output file path (extension auto-corrected to match content type)", defaultDownloadPath()).addOption(createHiddenDeprecatedTenantOption("-t, --tenant <tenant-name>")).examples(DOCUMENTS_DOWNLOAD_EXAMPLES).trackedAction(processContext, async (projectName, documentUid, options) => {
     const [err, result] = await catchError((async () => {
       const config = await createIxpConfig({
         tenant: options.tenant
@@ -8861,7 +9085,7 @@ var registerDocumentsCommand = (program2) => {
       const bytes = new Uint8Array(buffer);
       const detectedExt = extensionForContentType(contentType);
       const fs2 = getFileSystem();
-      const finalPath = applyDetectedExtension(options.output, detectedExt);
+      const finalPath = applyDetectedExtension(options.outputFile, detectedExt);
       await fs2.writeFile(finalPath, bytes);
       return {
         path: finalPath,
@@ -8884,6 +9108,7 @@ var registerDocumentsCommand = (program2) => {
       }
     });
   });
+  addDeprecatedOptionAlias(download, "--output <path>", "--output-file");
   document.command("upload").description("Upload a document file to an existing project").argument("<project-name>", "Project name").argument("<file>", "Path to the document file to upload").addOption(createHiddenDeprecatedTenantOption("-t, --tenant <tenant-name>")).examples(DOCUMENTS_UPLOAD_EXAMPLES).trackedAction(processContext, async (projectName, file, options) => {
     const [err, response] = await catchError((async () => {
       const fs2 = getFileSystem();
@@ -8940,6 +9165,7 @@ var registerDocumentsCommand = (program2) => {
 };
 
 // src/commands/fields.ts
+var UPDATES_FLAGS = { inlineFlag: "--updates", fileFlag: "--updates-file" };
 var FIELDS_ADD_EXAMPLES = [
   {
     Description: "Add a new field to a field group",
@@ -9011,6 +9237,18 @@ var FIELDS_UPDATE_PROMPTS_EXAMPLES = [
         Unmatched: []
       }
     }
+  },
+  {
+    Description: "Read the updates from a file (use this on Windows PowerShell, which strips quotes from inline JSON)",
+    Command: "uip ixp fields update-prompts my-invoices --updates-file updates.json",
+    Output: {
+      Code: "IxpFieldsUpdatePrompts",
+      Data: {
+        ProjectName: "my-invoices",
+        FieldsUpdated: 2,
+        Unmatched: []
+      }
+    }
   }
 ];
 var registerFieldsCommand = (program2) => {
@@ -9095,9 +9333,13 @@ var registerFieldsCommand = (program2) => {
       Data: response
     }, { preserveDataKeys: true });
   });
-  fields.command("update-prompts").description("Bulk-update per-field extraction instructions. Match by field name within each update's field group; existing definitions preserved.").argument("<project-name>", "Project name").requiredOption("--updates <json>", `JSON array of per-field instruction updates: [{"group":"Invoice","name":"Invoice Number","instructions":"..."}]. "group" is the field group (label_def) name, "name" is the field (moon_form) name within that group. Each \`instructions\` is at most ${MAX_INSTRUCTIONS_LENGTH} characters, each \`name\` at most ${MAX_NAME_LENGTH}.`).addOption(createHiddenDeprecatedTenantOption("-t, --tenant <tenant-name>")).examples(FIELDS_UPDATE_PROMPTS_EXAMPLES).trackedAction(processContext, async (projectName, options) => {
+  const updatePrompts = fields.command("update-prompts").description("Bulk-update per-field extraction instructions. Match by field name within each update's field group; existing definitions preserved.").argument("<project-name>", "Project name").option("--updates <json>", `JSON array of per-field instruction updates: [{"group":"Invoice","name":"Invoice Number","instructions":"..."}]. "group" is the field group (label_def) name, "name" is the field (moon_form) name within that group. Each \`instructions\` is at most ${MAX_INSTRUCTIONS_LENGTH} characters, each \`name\` at most ${MAX_NAME_LENGTH}. Required unless --updates-file is given.`).addOption(new Option("--updates-file <path>", jsonFileOptionHelp("--updates")).conflicts("updates")).addOption(createHiddenDeprecatedTenantOption("-t, --tenant <tenant-name>")).examples(FIELDS_UPDATE_PROMPTS_EXAMPLES).trackedAction(processContext, async (projectName, options) => {
     const [err, response] = await catchError((async () => {
-      const rawUpdates = JSON.parse(options.updates);
+      const rawUpdates = await readJsonOption({
+        inline: options.updates,
+        file: options.updatesFile,
+        ...UPDATES_FLAGS
+      });
       if (!Array.isArray(rawUpdates)) {
         throw new Error('--updates must be a JSON array, e.g. [{"group":"Invoice","name":"Invoice Number","instructions":"..."}]');
       }
@@ -9117,16 +9359,13 @@ var registerFieldsCommand = (program2) => {
       Data: response
     }, { preserveDataKeys: true });
   });
+  requireOneOfOptions(updatePrompts, ["--updates", "--updates-file"]);
 };
 
 // src/commands/groups.ts
-function parseFieldsJson(raw) {
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch (e) {
-    throw new Error(`--fields is not valid JSON: ${e instanceof Error ? e.message : String(e)}`);
-  }
+var FIELDS_FLAGS = { inlineFlag: "--fields", fileFlag: "--fields-file" };
+var UPDATES_FLAGS2 = { inlineFlag: "--updates", fileFlag: "--updates-file" };
+function parseFieldsJson(parsed) {
   if (!Array.isArray(parsed)) {
     throw new Error("--fields must be a JSON array");
   }
@@ -9156,13 +9395,7 @@ function parseFieldsJson(raw) {
   }
   return result;
 }
-function parseUpdatesJson(raw) {
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch (e) {
-    throw new Error(`--updates is not valid JSON: ${e instanceof Error ? e.message : String(e)}`);
-  }
+function parseUpdatesJson(parsed) {
   if (!Array.isArray(parsed)) {
     throw new Error('--updates must be a JSON array, e.g. [{"name":"Invoice","instructions":"..."}]');
   }
@@ -9194,6 +9427,18 @@ var GROUPS_ADD_EXAMPLES = [
         FieldsCreated: 3
       }
     }
+  },
+  {
+    Description: "Create a field group with the fields read from a file (use this on Windows PowerShell, which strips quotes from inline JSON)",
+    Command: 'uip ixp groups add my-invoices --name Invoice --instructions "Header fields" --fields-file fields.json',
+    Output: {
+      Code: "IxpGroupsAdd",
+      Data: {
+        ProjectName: "my-invoices",
+        Group: "Invoice",
+        FieldsCreated: 3
+      }
+    }
   }
 ];
 var GROUPS_DELETE_EXAMPLES = [
@@ -9235,13 +9480,29 @@ var GROUPS_UPDATE_PROMPTS_EXAMPLES = [
         Unmatched: []
       }
     }
+  },
+  {
+    Description: "Read the updates from a file (use this on Windows PowerShell, which strips quotes from inline JSON)",
+    Command: "uip ixp groups update-prompts my-invoices --updates-file updates.json",
+    Output: {
+      Code: "IxpGroupsUpdatePrompts",
+      Data: {
+        ProjectName: "my-invoices",
+        GroupsUpdated: 1,
+        Unmatched: []
+      }
+    }
   }
 ];
 var registerGroupsCommand = (program2) => {
   const groups = program2.command("groups").description("Manage field groups (label_defs) — the document type containers for fields");
-  groups.command("add").description("Create a new field group with instructions and at least one field").argument("<project-name>", "Project name").requiredOption("--name <name>", `New field group name (at most ${MAX_NAME_LENGTH} characters)`).requiredOption("--instructions <text>", `Instructions for the group — describes what kind of document/section it covers (at most ${MAX_INSTRUCTIONS_LENGTH} characters)`).requiredOption("--fields <json>", `JSON array of fields to create in the group (at least one): [{"name":"...","type":"<type-name>","instructions":"..."}]. \`type\` is the name of an entity_def in the project taxonomy. \`name\` and \`type\` are at most ${MAX_NAME_LENGTH} characters, \`instructions\` at most ${MAX_INSTRUCTIONS_LENGTH}.`).addOption(createHiddenDeprecatedTenantOption("-t, --tenant <tenant-name>")).examples(GROUPS_ADD_EXAMPLES).trackedAction(processContext, async (projectName, options) => {
+  const add = groups.command("add").description("Create a new field group with instructions and at least one field").argument("<project-name>", "Project name").requiredOption("--name <name>", `New field group name (at most ${MAX_NAME_LENGTH} characters)`).requiredOption("--instructions <text>", `Instructions for the group — describes what kind of document/section it covers (at most ${MAX_INSTRUCTIONS_LENGTH} characters)`).option("--fields <json>", `JSON array of fields to create in the group (at least one): [{"name":"...","type":"<type-name>","instructions":"..."}]. \`type\` is the name of an entity_def in the project taxonomy. \`name\` and \`type\` are at most ${MAX_NAME_LENGTH} characters, \`instructions\` at most ${MAX_INSTRUCTIONS_LENGTH}. Required unless --fields-file is given.`).addOption(new Option("--fields-file <path>", jsonFileOptionHelp("--fields")).conflicts("fields")).addOption(createHiddenDeprecatedTenantOption("-t, --tenant <tenant-name>")).examples(GROUPS_ADD_EXAMPLES).trackedAction(processContext, async (projectName, options) => {
     const [err, response] = await catchError((async () => {
-      const fields = parseFieldsJson(options.fields);
+      const fields = parseFieldsJson(await readJsonOption({
+        inline: options.fields,
+        file: options.fieldsFile,
+        ...FIELDS_FLAGS
+      }));
       const config = await createIxpConfig({
         tenant: options.tenant
       });
@@ -9263,6 +9524,7 @@ var registerGroupsCommand = (program2) => {
       Data: response
     }, { preserveDataKeys: true });
   });
+  requireOneOfOptions(add, ["--fields", "--fields-file"]);
   groups.command("delete").description("Delete a field group. IRREVERSIBLE: all annotations on all fields in the group are deleted.").argument("<project-name>", "Project name").requiredOption("--name <name>", "Field group name to delete").addOption(createHiddenDeprecatedTenantOption("-t, --tenant <tenant-name>")).option("-y, --yes", "Confirm this irreversible operation (required; the CLI never prompts)").examples(GROUPS_DELETE_EXAMPLES).trackedAction(processContext, async (projectName, options) => {
     if (!requireConfirmation(options, `delete group '${options.name}'`))
       return;
@@ -9303,9 +9565,13 @@ var registerGroupsCommand = (program2) => {
       Data: response
     }, { preserveDataKeys: true });
   });
-  groups.command("update-prompts").description("Bulk-update field group (label_def) extraction instructions. Match by group name; existing fields preserved.").argument("<project-name>", "Project name").requiredOption("--updates <json>", `JSON array of field group instruction updates: [{"name":"Invoice","instructions":"..."}]. Match by label_def name. Each \`instructions\` is at most ${MAX_INSTRUCTIONS_LENGTH} characters, each \`name\` at most ${MAX_NAME_LENGTH}.`).addOption(createHiddenDeprecatedTenantOption("-t, --tenant <tenant-name>")).examples(GROUPS_UPDATE_PROMPTS_EXAMPLES).trackedAction(processContext, async (projectName, options) => {
+  const updatePrompts = groups.command("update-prompts").description("Bulk-update field group (label_def) extraction instructions. Match by group name; existing fields preserved.").argument("<project-name>", "Project name").option("--updates <json>", `JSON array of field group instruction updates: [{"name":"Invoice","instructions":"..."}]. Match by label_def name. Each \`instructions\` is at most ${MAX_INSTRUCTIONS_LENGTH} characters, each \`name\` at most ${MAX_NAME_LENGTH}. Required unless --updates-file is given.`).addOption(new Option("--updates-file <path>", jsonFileOptionHelp("--updates")).conflicts("updates")).addOption(createHiddenDeprecatedTenantOption("-t, --tenant <tenant-name>")).examples(GROUPS_UPDATE_PROMPTS_EXAMPLES).trackedAction(processContext, async (projectName, options) => {
     const [err, response] = await catchError((async () => {
-      const updates = parseUpdatesJson(options.updates);
+      const updates = parseUpdatesJson(await readJsonOption({
+        inline: options.updates,
+        file: options.updatesFile,
+        ...UPDATES_FLAGS2
+      }));
       const config = await createIxpConfig({
         tenant: options.tenant
       });
@@ -9325,14 +9591,16 @@ var registerGroupsCommand = (program2) => {
       Data: response
     }, { preserveDataKeys: true });
   });
+  requireOneOfOptions(updatePrompts, ["--updates", "--updates-file"]);
 };
 
 // src/commands/labellings.ts
+var UPDATES_FLAGS3 = { inlineFlag: "--updates", fileFlag: "--updates-file" };
 function validateConfirmMode(documentUid, options) {
-  if (options.updates && options.occurrence !== undefined) {
+  if (options.updates !== undefined && options.occurrence !== undefined) {
     throw new Error("--occurrence and --updates are mutually exclusive. Use --occurrence for a single occurrence; use --updates to batch multiple occurrences in one call.");
   }
-  if (options.updates) {
+  if (options.updates !== undefined) {
     if (options.fields || options.corrections) {
       throw new Error("--updates cannot be combined with --fields or --corrections. Move per-field corrections into the corrections map inside --updates.");
     }
@@ -9354,8 +9622,8 @@ function validateConfirmMode(documentUid, options) {
     return;
   }
 }
-function parseConfirmUpdates(updatesJson) {
-  const parsed = JSON.parse(updatesJson);
+function parseConfirmUpdates(updates) {
+  const parsed = updates;
   if (!Array.isArray(parsed) || parsed.length === 0) {
     throw new Error("--updates must be a non-empty JSON array of {occurrence, fields?, corrections?} entries.");
   }
@@ -9416,7 +9684,7 @@ function buildConfirmBody(options) {
   return options.modelVersion === undefined ? body : { ...body, ModelVersion: options.modelVersion };
 }
 function buildConfirmTargeting(options) {
-  if (options.updates && options.group) {
+  if (options.updates !== undefined && options.group) {
     return {
       Group: options.group,
       Updates: parseConfirmUpdates(options.updates)
@@ -9438,10 +9706,10 @@ function buildConfirmTargeting(options) {
   };
 }
 function validateUnconfirmMode(options) {
-  if (options.updates && options.occurrence !== undefined) {
+  if (options.updates !== undefined && options.occurrence !== undefined) {
     throw new Error("--occurrence and --updates are mutually exclusive. Use --occurrence for a single occurrence; use --updates to unconfirm several occurrences in one call.");
   }
-  if (options.updates) {
+  if (options.updates !== undefined) {
     if (options.fields) {
       throw new Error("--updates cannot be combined with --fields. List the field IDs inside each --updates entry instead.");
     }
@@ -9457,8 +9725,8 @@ function validateUnconfirmMode(options) {
     throw new Error("Provide --fields <ids> to unconfirm specific fields, or --group <name> to unconfirm a repeatable field group (optionally narrowed with --occurrence/--updates/--fields).");
   }
 }
-function parseUnconfirmUpdates(updatesJson) {
-  const parsed = JSON.parse(updatesJson);
+function parseUnconfirmUpdates(updates) {
+  const parsed = updates;
   if (!Array.isArray(parsed) || parsed.length === 0) {
     throw new Error("--updates must be a non-empty JSON array of {occurrence, fields?} entries.");
   }
@@ -9483,7 +9751,7 @@ function parseUnconfirmUpdates(updatesJson) {
   });
 }
 function buildUnconfirmBody(options) {
-  if (options.updates && options.group) {
+  if (options.updates !== undefined && options.group) {
     return {
       Group: options.group,
       Updates: parseUnconfirmUpdates(options.updates)
@@ -9677,6 +9945,19 @@ var LABELLINGS_UNCONFIRM_EXAMPLES = [
         Unmatched: []
       }
     }
+  },
+  {
+    Description: "Batched per-occurrence unconfirm with the entries read from a file (use this on Windows PowerShell, which strips quotes from inline JSON)",
+    Command: 'uip ixp labellings unconfirm my-invoices 5f3a9c21-7e4b-4d8a-9f12-6c0b8e3d2a14.7f3c8a21 --group "Line Items" --updates-file updates.json',
+    Output: {
+      Code: "IxpLabellingsUnconfirm",
+      Data: {
+        ProjectName: "my-invoices",
+        DocumentId: "5f3a9c21-7e4b-4d8a-9f12-6c0b8e3d2a14.7f3c8a21",
+        FieldsUnconfirmed: 4,
+        Unmatched: []
+      }
+    }
   }
 ];
 var LABELLINGS_MARK_MISSING_EXAMPLES = [
@@ -9743,7 +10024,7 @@ async function listAllDocumentIds(config, projectName) {
 }
 var registerLabellingsCommand = (program2) => {
   const labelling = program2.command("labellings").description("Manage IXP labellings and predictions");
-  labelling.command("confirm").description("Confirm IXP-generated predictions as ground truth for one document. Omitting <document-id> confirms every document in the project — deprecated, and removed in the next release. For a repeatable field group, narrow with --group: alone it confirms every occurrence; add --occurrence to confirm ONE occurrence (the ergonomic single-line form); or use --updates to confirm SEVERAL occurrences in one atomic call (one request). --updates is the superset — --occurrence <N> equals --updates with a single entry — so reach for --occurrence for one line and --updates when several lines need confirming together (or with different per-line fields/corrections).").argument("<project-name>", "Project name").argument("[document-id]", "Document ID. Omitting it confirms every document in the project — deprecated, and removed in the next release.").addOption(createHiddenDeprecatedTenantOption("-t, --tenant <tenant-name>")).option("-f, --fields <field-ids>", "Comma-separated field IDs to confirm (omit to confirm all predicted fields). Without --group, confirms each field_id across every occurrence it appears in. With --group + --occurrence, confirms only within that specific occurrence.").option("-c, --corrections <json>", 'Override predicted values while keeping references: [{"field_id":"...","value":"corrected"}]. Applies across every occurrence the field appears in (or just the targeted occurrence when --group + --occurrence are given).').option("--group <name>", 'Target field group (label_def). Must be the FULL label path exactly as shown in the "Name" field of `get-predictions` (e.g. "Invoice > Line Items"), not just the leaf name. On its own, confirms every occurrence of the group as-is. Add --occurrence to target a single occurrence, or --updates to batch specific occurrences in one call. Combine with --fields to limit to specific fields within the group.').option("--occurrence <index>", "Single-occurrence form: 0-based index of ONE occurrence within --group to confirm. Use --fields to limit to specific fields in that occurrence; omit --fields to confirm every predicted field there. Requires --group. Mutually exclusive with --updates — for several occurrences in one call, use --updates instead.").option("--updates <json>", 'Batched form: confirm SEVERAL occurrences of --group in one atomic call. JSON array of {"occurrence":<0-based-index>,"fields"?:["<field_id>",...],"corrections"?:{"<field_id>":"<value>"}}. Per entry: omit "fields" to confirm every predicted field in that occurrence (same default as --occurrence without --fields), or list specific ones. Un-selected fields in a selected occurrence carry forward their existing annotation; occurrences not listed are left as-is. Equivalent to running --occurrence once per entry, but in a single request. Mutually exclusive with --fields, --corrections, and --occurrence.').option("-m, --model-version <version>", "Optimistic-concurrency guard: the model version (from `get-predictions`' ModelVersion) the predictions being confirmed were reviewed against. If a retrain has produced a newer version since, the confirm is rejected instead of stamping drifted values as ground truth — re-read predictions and review again. Omit to skip the check.", (raw) => parseBoundedInt(raw, "--model-version", {
+  labelling.command("confirm").description("Confirm IXP-generated predictions as ground truth for one document. Omitting <document-id> confirms every document in the project — deprecated, and removed in the next release. For a repeatable field group, narrow with --group: alone it confirms every occurrence; add --occurrence to confirm ONE occurrence (the ergonomic single-line form); or use --updates to confirm SEVERAL occurrences in one atomic call (one request). --updates is the superset — --occurrence <N> equals --updates with a single entry — so reach for --occurrence for one line and --updates when several lines need confirming together (or with different per-line fields/corrections).").argument("<project-name>", "Project name").argument("[document-id]", "Document ID. Omitting it confirms every document in the project — deprecated, and removed in the next release.").addOption(createHiddenDeprecatedTenantOption("-t, --tenant <tenant-name>")).option("-f, --fields <field-ids>", "Comma-separated field IDs to confirm (omit to confirm all predicted fields). Without --group, confirms each field_id across every occurrence it appears in. With --group + --occurrence, confirms only within that specific occurrence.").option("-c, --corrections <json>", 'Override predicted values while keeping references: [{"field_id":"...","value":"corrected"}]. Applies across every occurrence the field appears in (or just the targeted occurrence when --group + --occurrence are given).').option("--group <name>", 'Target field group (label_def). Must be the FULL label path exactly as shown in the "Name" field of `get-predictions` (e.g. "Invoice > Line Items"), not just the leaf name. On its own, confirms every occurrence of the group as-is. Add --occurrence to target a single occurrence, or --updates to batch specific occurrences in one call. Combine with --fields to limit to specific fields within the group.').option("--occurrence <index>", "Single-occurrence form: 0-based index of ONE occurrence within --group to confirm. Use --fields to limit to specific fields in that occurrence; omit --fields to confirm every predicted field there. Requires --group. Mutually exclusive with --updates — for several occurrences in one call, use --updates instead.").option("--updates <json>", 'Batched form: confirm SEVERAL occurrences of --group in one atomic call. JSON array of {"occurrence":<0-based-index>,"fields"?:["<field_id>",...],"corrections"?:{"<field_id>":"<value>"}}. Per entry: omit "fields" to confirm every predicted field in that occurrence (same default as --occurrence without --fields), or list specific ones. Un-selected fields in a selected occurrence carry forward their existing annotation; occurrences not listed are left as-is. Equivalent to running --occurrence once per entry, but in a single request. Mutually exclusive with --fields, --corrections, and --occurrence.').addOption(new Option("--updates-file <path>", jsonFileOptionHelp("--updates")).conflicts("updates")).option("-m, --model-version <version>", "Optimistic-concurrency guard: the model version (from `get-predictions`' ModelVersion) the predictions being confirmed were reviewed against. If a retrain has produced a newer version since, the confirm is rejected instead of stamping drifted values as ground truth — re-read predictions and review again. Omit to skip the check.", (raw) => parseBoundedInt(raw, "--model-version", {
     min: 0,
     max: Number.MAX_SAFE_INTEGER
   })).examples(LABELLINGS_CONFIRM_EXAMPLES).trackedAction(processContext, async (projectName, documentUid, options) => {
@@ -9751,11 +10032,19 @@ var registerLabellingsCommand = (program2) => {
       getOutputSink().writeErr(PROJECT_WIDE_DEPRECATION_WARNING);
     }
     const [err, result] = await catchError((async () => {
-      validateConfirmMode(documentUid, options);
+      validateConfirmMode(documentUid, {
+        ...options,
+        updates: options.updates ?? options.updatesFile
+      });
+      const updates = await readJsonOption({
+        inline: options.updates,
+        file: options.updatesFile,
+        ...UPDATES_FLAGS3
+      });
       const config = await createIxpConfig({
         tenant: options.tenant
       });
-      const body = buildConfirmBody(options);
+      const body = buildConfirmBody({ ...options, updates });
       if (documentUid) {
         const res = await confirmLabelling(config, projectName, documentUid, body);
         return {
@@ -9790,13 +10079,21 @@ var registerLabellingsCommand = (program2) => {
       }
     });
   });
-  labelling.command("unconfirm").description("Remove confirmations from a document — the targeted fields go back to un-annotated state. Use to roll back an earlier confirm or mark-missing when you realize it was a mistake. Every other annotation on the document is carried forward. With --fields alone, each field_id is unconfirmed across every occurrence it appears in. For a repeatable field group, narrow with --group: alone it unconfirms every occurrence; add --occurrence to roll back ONE occurrence (the ergonomic single-line form); or use --updates to roll back SEVERAL occurrences in one atomic call. Mirrors `confirm`'s targeting flags.").argument("<project-name>", "Project name").argument("<document-id>", "Document ID").option("-f, --fields <field-ids>", "Comma-separated field IDs to unconfirm. Without --group, unconfirms each field_id across every occurrence it appears in. With --group + --occurrence, limits to that specific occurrence; omit it to unconfirm every annotated field in the targeted occurrence(s).").option("--group <name>", 'Target field group (label_def). Must be the FULL label path exactly as shown in the "Name" field of `get-predictions` (e.g. "Invoice > Line Items"), not just the leaf name. On its own, unconfirms every occurrence of the group. Add --occurrence to target a single occurrence, or --updates to batch specific occurrences in one call. Combine with --fields to limit to specific fields within the group.').option("--occurrence <index>", "Single-occurrence form: 0-based index of ONE occurrence within --group to unconfirm. Use --fields to limit to specific fields in that occurrence; omit --fields to unconfirm every annotated field there. Requires --group. Mutually exclusive with --updates.").option("--updates <json>", 'Batched form: unconfirm SEVERAL occurrences of --group in one atomic call. JSON array of {"occurrence":<0-based-index>,"fields"?:["<field_id>",...]}. Per entry: omit "fields" to unconfirm every annotated field in that occurrence, or list specific ones. Occurrences not listed are left as-is. Mutually exclusive with --fields and --occurrence.').addOption(createHiddenDeprecatedTenantOption("-t, --tenant <tenant-name>")).examples(LABELLINGS_UNCONFIRM_EXAMPLES).trackedAction(processContext, async (projectName, documentUid, options) => {
+  labelling.command("unconfirm").description("Remove confirmations from a document — the targeted fields go back to un-annotated state. Use to roll back an earlier confirm or mark-missing when you realize it was a mistake. Every other annotation on the document is carried forward. With --fields alone, each field_id is unconfirmed across every occurrence it appears in. For a repeatable field group, narrow with --group: alone it unconfirms every occurrence; add --occurrence to roll back ONE occurrence (the ergonomic single-line form); or use --updates to roll back SEVERAL occurrences in one atomic call. Mirrors `confirm`'s targeting flags.").argument("<project-name>", "Project name").argument("<document-id>", "Document ID").option("-f, --fields <field-ids>", "Comma-separated field IDs to unconfirm. Without --group, unconfirms each field_id across every occurrence it appears in. With --group + --occurrence, limits to that specific occurrence; omit it to unconfirm every annotated field in the targeted occurrence(s).").option("--group <name>", 'Target field group (label_def). Must be the FULL label path exactly as shown in the "Name" field of `get-predictions` (e.g. "Invoice > Line Items"), not just the leaf name. On its own, unconfirms every occurrence of the group. Add --occurrence to target a single occurrence, or --updates to batch specific occurrences in one call. Combine with --fields to limit to specific fields within the group.').option("--occurrence <index>", "Single-occurrence form: 0-based index of ONE occurrence within --group to unconfirm. Use --fields to limit to specific fields in that occurrence; omit --fields to unconfirm every annotated field there. Requires --group. Mutually exclusive with --updates.").option("--updates <json>", 'Batched form: unconfirm SEVERAL occurrences of --group in one atomic call. JSON array of {"occurrence":<0-based-index>,"fields"?:["<field_id>",...]}. Per entry: omit "fields" to unconfirm every annotated field in that occurrence, or list specific ones. Occurrences not listed are left as-is. Mutually exclusive with --fields and --occurrence.').addOption(new Option("--updates-file <path>", jsonFileOptionHelp("--updates")).conflicts("updates")).addOption(createHiddenDeprecatedTenantOption("-t, --tenant <tenant-name>")).examples(LABELLINGS_UNCONFIRM_EXAMPLES).trackedAction(processContext, async (projectName, documentUid, options) => {
     const [err, result] = await catchError((async () => {
-      validateUnconfirmMode(options);
+      validateUnconfirmMode({
+        ...options,
+        updates: options.updates ?? options.updatesFile
+      });
+      const updates = await readJsonOption({
+        inline: options.updates,
+        file: options.updatesFile,
+        ...UPDATES_FLAGS3
+      });
       const config = await createIxpConfig({
         tenant: options.tenant
       });
-      return await unconfirmLabelling(config, projectName, documentUid, buildUnconfirmBody(options));
+      return await unconfirmLabelling(config, projectName, documentUid, buildUnconfirmBody({ ...options, updates }));
     })());
     if (err) {
       await emitError(err, "Failed to unconfirm fields");
@@ -10750,4 +11047,4 @@ var registerCommands = async (program2) => {
 
 export { package_default, Command, metadata, registerCommands };
 
-//# debugId=95A3C2252B9957AE64756E2164756E21
+//# debugId=2CB8F8700FFEB6D264756E2164756E21

package/dist/tool.js

@@ -1,7 +1,7 @@
 import {
   metadata,
   registerCommands
-} from "./tool-vsg7smdq.js";
+} from "./tool-6j0f3qjh.js";
 import"./tool-1de529jm.js";
 export {
   metadata,

package/package.json

@@ -2,7 +2,7 @@
     "name": "@uipath/ixp-tool",
     "author": "UiPath",
     "license": "SEE LICENSE IN LICENSE.txt",
-    "version": "1.204.0-preview.254",
+    "version": "1.205.0-preview.256",
     "description": "Manage UiPath IXP projects, prompts, predictions, and model publishing.",
     "private": false,
     "repository": {
@@ -27,5 +27,5 @@
     "files": [
         "dist"
     ],
-    "gitHead": "3ee79cdec05b36231a8da9e8de6bf0043585526a"
+    "gitHead": "63740c6cbb7ff282fa9118cc16a148eb030b245f"
 }