@uipath/orchestrator-tool 1.204.0 → 1.205.0-preview.258

package/dist/{tool-s5ktt6fh.js → tool-16fzb4dj.js}

@@ -16,6 +16,7 @@ import {
   FoldersNavigationApi,
   HttpTriggersApi,
   InvalidArgumentError,
+  JobAttachmentsApi,
   JobDtoToJSON,
   JobsApi,
   LibrariesApi,
@@ -51,12 +52,12 @@ import {
   TriggerLogsApi,
   UsersApi,
   WebhooksApi,
+  addDeprecatedOptionAlias,
   carriedErrorCode,
   carriedRetry,
   catchError,
   createApiClient,
   createHiddenDeprecatedTenantOption,
-  createOrchestratorConfig,
   extractErrorDetails,
   extractErrorMessage,
   extractErrorMessageSync,
@@ -64,6 +65,7 @@ import {
   isGuid,
   isPreviewBuild,
   logger,
+  nullArrayToEmptyMiddleware,
   parseHttpStatusFromMessage,
   pollUntil,
   processContext,
@@ -78,10 +80,10 @@ import {
   trackShipSucceeded,
   unzipSync,
   uploadJobAttachment
-} from "./tool-ckjbpn0a.js";
+} from "./tool-qeyyg5yr.js";
 import {
   getFileSystem
-} from "./tool-ayyhwvs8.js";
+} from "./tool-6mw7b49q.js";
 import {
   __require
 } from "./tool-1de529jm.js";
@@ -90,7 +92,7 @@ var package_default = {
   name: "@uipath/orchestrator-tool",
   author: "UiPath",
   license: "SEE LICENSE IN LICENSE.txt",
-  version: "1.204.0",
+  version: "1.205.0-preview.258",
   description: "Manage Orchestrator folders, jobs, processes, and releases.",
   private: false,
   repository: {
@@ -1299,7 +1301,7 @@ async function resolveJob(jobKey, options) {
 var ATTACHMENTS_DOWNLOAD_EXAMPLES = [
   {
     Description: "Download an attachment to a specific output path",
-    Command: "uip or attachments download a1b2c3d4-0000-0000-0000-000000000001 --output ./report.pdf",
+    Command: "uip or attachments download a1b2c3d4-0000-0000-0000-000000000001 --destination ./report.pdf",
     Output: {
       Code: "AttachmentDownloaded",
       Data: {
@@ -1335,7 +1337,7 @@ var ATTACHMENTS_LIST_EXAMPLES = [
 ];
 var registerAttachmentsCommand = (program) => {
   const attachments = program.command("attachments").description("Manage job attachments. " + "Download files attached to jobs (screenshots, reports, data files). " + "Attachments are tenant-scoped — no folder context needed.");
-  attachments.command("download").description("Download a job attachment to local disk. " + "Uses the DownloadAttachmentFile endpoint which returns a redirect to the blob storage URI. " + "Use job 'get' output to find attachment IDs.").argument("<attachment-id>", "Attachment ID (GUID)").addOption(createHiddenDeprecatedTenantOption("-t, --tenant <tenant-name>")).option("-o, --output <path>", "Output file path (defaults to attachment-<id> in current directory)").examples(ATTACHMENTS_DOWNLOAD_EXAMPLES).trackedAction(processContext, async (attachmentId, options) => {
+  const download = attachments.command("download").description("Download a job attachment to local disk. " + "Uses the DownloadAttachmentFile endpoint which returns a redirect to the blob storage URI. " + "Use job 'get' output to find attachment IDs.").argument("<attachment-id>", "Attachment ID (GUID)").addOption(createHiddenDeprecatedTenantOption("-t, --tenant <tenant-name>")).option("-d, --destination <path>", "Output file path (defaults to attachment-<id> in current directory)").examples(ATTACHMENTS_DOWNLOAD_EXAMPLES).trackedAction(processContext, async (attachmentId, options) => {
     const [apiError, api] = await catchError(createApiClient(AttachmentsApi, {
       tenant: options.tenant
     }));
@@ -1394,8 +1396,8 @@ var registerAttachmentsCommand = (program) => {
       processContext.exit(1);
       return;
     }
-    const fileName = options.output || `attachment-${attachmentId}`;
-    const { getFileSystem: getFileSystem2 } = await import("./index-r2vc4whd.js");
+    const fileName = options.destination || `attachment-${attachmentId}`;
+    const { getFileSystem: getFileSystem2 } = await import("./index-rkqk9b39.js");
     const fs = getFileSystem2();
     const [writeError] = await catchError(fs.writeFile(fileName, Buffer.from(buffer)));
     if (writeError) {
@@ -1417,38 +1419,32 @@ var registerAttachmentsCommand = (program) => {
       }
     });
   });
+  addDeprecatedOptionAlias(download, "-o, --output <path>", "--destination");
   attachments.command("list").description("List attachments for a job. " + "Shows attachment ID, name, and category. " + "Use the attachment ID with 'attachments download' or 'jobs start --attachment-id'.").requiredOption("--job-key <key>", "Job key (GUID) — list attachments for this job").addOption(createHiddenDeprecatedTenantOption("-t, --tenant <tenant-name>")).option("--all-fields", "Return all fields from the API response (default: curated subset)").examples(ATTACHMENTS_LIST_EXAMPLES).trackedAction(processContext, async (options) => {
     const resolved = await resolveOrReportError(resolveJob(options.jobKey, { tenant: options.tenant }), "Error listing attachments");
     if (resolved === null)
       return;
-    const [cfgError, config] = await catchError(createOrchestratorConfig({
+    const [apiError, api] = await catchError(createApiClient(JobAttachmentsApi, {
       tenant: options.tenant,
       folderId: resolved.folderId.toString()
     }));
-    if (cfgError) {
+    if (apiError) {
       OutputFormatter.error({
         Result: RESULTS.Failure,
         Message: "Error listing attachments",
-        Instructions: cfgError.message
+        Instructions: apiError.message
       });
       processContext.exit(1);
       return;
     }
-    const headers = {
-      ...config.headers
-    };
-    const [error, response] = await catchError(fetch(`${config.basePath}/api/JobAttachments/GetByJobKey?jobKey=${encodeURIComponent(options.jobKey)}`, { headers }));
-    if (error || !response.ok) {
-      const msg = error ? error.message : `HTTP ${response.status}: ${response.statusText}`;
-      OutputFormatter.error({
-        Result: RESULTS.Failure,
-        Message: "Error listing attachments",
-        Instructions: msg
-      });
-      processContext.exit(1);
+    const [error, response] = await catchError(api.withMiddleware(nullArrayToEmptyMiddleware).jobAttachmentsGetByJobKeyRaw({
+      jobKey: options.jobKey
+    }));
+    if (error) {
+      await reportFailure("Error listing attachments", error);
       return;
     }
-    const [parseError, items] = await catchError(response.json());
+    const [parseError, items] = await catchError(response.raw.json());
     if (parseError) {
       OutputFormatter.error({
         Result: RESULTS.Failure,
@@ -3447,6 +3443,7 @@ var registerFeedsCommand = (program) => {
 };
 
 // src/commands/folders.ts
+var VALID_RUNTIMES_PROCESS_TYPES = ["Process", "Agent", "Function", "Api"];
 var FOLDERS_LIST_EXAMPLES = [
   {
     Description: "List folders in the tenant",
@@ -3944,7 +3941,14 @@ var registerFoldersCommand = (program) => {
       }
     });
   });
-  folders.command("runtimes").description("List runtime allocations for a folder. " + "Shows how many runtime slots of each type (Unattended, Attended, NonProduction, etc.) " + "are total, connected, and available in the specified folder. " + "Useful for checking capacity before starting jobs.").argument("<folder-key-or-path>", "Folder key (GUID) or path — use 'folders list' to find").addOption(createHiddenDeprecatedTenantOption("-t, --tenant <tenant-name>")).examples(FOLDERS_RUNTIMES_EXAMPLES).trackedAction(processContext, async (folderKeyArg, options) => {
+  folders.command("runtimes").description("List runtime allocations for a folder. " + "Shows how many runtime slots of each type (Unattended, Attended, NonProduction, etc.) " + "are total, connected, and available in the specified folder. " + "Useful for checking capacity before starting jobs.").argument("<folder-key-or-path>", "Folder key (GUID) or path — use 'folders list' to find").addOption(new Option("--process-type <type>", "Report the runtimes a job of this process type can use. The Local row then counts only that job's slot pool, as the Start Job dialog does").choices(VALID_RUNTIMES_PROCESS_TYPES).argParser((value) => {
+    const matched = VALID_RUNTIMES_PROCESS_TYPES.find((v) => v.toLowerCase() === value.toLowerCase());
+    if (!matched) {
+      throw new InvalidArgumentError(`Allowed choices are ${VALID_RUNTIMES_PROCESS_TYPES.join(", ")}.`);
+    }
+    return matched;
+  })).addOption(createHiddenDeprecatedTenantOption("-t, --tenant <tenant-name>")).examples(FOLDERS_RUNTIMES_EXAMPLES).trackedAction(processContext, async (folderKeyArg, options) => {
+    const processType = options.processType;
     const folderInput = resolveFolderInput(folderKeyArg);
     const [folderError, folder] = await catchError(resolveFolder(folderInput, { tenant: options.tenant }));
     if (folderError) {
@@ -3964,7 +3968,8 @@ var registerFoldersCommand = (program) => {
       return;
     }
     const [getError, result] = await catchError(api.machinesGetRuntimesForFolderByFolderid({
-      folderId: folder.id
+      folderId: folder.id,
+      processType
     }));
     if (getError) {
       await reportFailure("Error listing runtimes", getError);
@@ -4136,7 +4141,7 @@ async function downloadAttachment(attachmentId, outputPath, options) {
   if (bufferError) {
     throw new Error(`Failed to read attachment data: ${bufferError.message}`);
   }
-  const { getFileSystem: getFileSystem2 } = await import("./index-r2vc4whd.js");
+  const { getFileSystem: getFileSystem2 } = await import("./index-rkqk9b39.js");
   const fs = getFileSystem2();
   const [writeError] = await catchError(fs.writeFile(outputPath, Buffer.from(buffer)));
   if (writeError) {
@@ -4151,7 +4156,7 @@ async function downloadAttachment(attachmentId, outputPath, options) {
 
 // src/utils/attachment-uploader.ts
 async function uploadAttachment(filePath, name, options) {
-  const { getFileSystem: getFileSystem2 } = await import("./index-r2vc4whd.js");
+  const { getFileSystem: getFileSystem2 } = await import("./index-rkqk9b39.js");
   const fs = getFileSystem2();
   const [readError, fileBuffer] = await catchError(fs.readFile(filePath));
   if (readError) {
@@ -4195,7 +4200,7 @@ async function parseAttachmentArg(arg) {
     }
     return { name, path };
   }
-  const { getFileSystem: getFileSystem2 } = await import("./index-r2vc4whd.js");
+  const { getFileSystem: getFileSystem2 } = await import("./index-rkqk9b39.js");
   const fs = getFileSystem2();
   return { name: fs.path.basename(arg), path: arg };
 }
@@ -4794,7 +4799,7 @@ var registerJobsCommand = (program) => {
       Data: data
     });
   });
-  jobs.command("start").description("Start a job for a process. Returns the created job(s) with keys. " + "The <process-key> is the GUID from 'processes list' (not 'packages list'). " + "Folder is optional — if not provided, it is inferred from the process. " + "Use 'packages entry-points' to see input/output argument schemas for the process.").argument("<process-key>", "Process key (GUID) from 'processes list'. Identifies which process to run.").addOption(createHiddenDeprecatedTenantOption("-t, --tenant <tenant-name>")).option("--folder-path <path>", "Folder path (optional — inferred from process if not provided)").option("--folder-key <key>", "Folder key (optional — inferred from process if not provided)").option("--strategy <strategy>", "Execution strategy (ModernJobsCount, All, Specific, JobsCount)", "ModernJobsCount").option("--jobs-count <number>", "Number of jobs to create (for JobsCount/ModernJobsCount strategy)", "1").option("--input-arguments <json>", "Input arguments as JSON string (mutually exclusive with --input-file). " + "Auto-offloads to InputFile if >10K chars. " + "Use 'packages entry-points' to see the expected schema.").option("--input-file <path>", "Upload a file as the job's InputFile (mutually exclusive with --input-arguments). " + "The file is uploaded as an attachment and its ID is set on the InputFile field.").option("--attachment <[name=]path>", "Upload a file and attach it to the job (repeatable). " + "Format: path (auto-names from filename) or name=path (explicit name). " + "Example: --attachment ./doc.pdf --attachment invoice=./report.pdf", (val, prev) => prev ? [...prev, val] : [val]).option("--attachment-id <guid>", "Attach an existing attachment by ID (repeatable). " + "Use 'attachments list --job-key <key>' to find IDs from a previous job.", (val, prev) => prev ? [...prev, val] : [val]).option("--runtime-type <type>", "Execution runtime (Unattended, Headless, Serverless, NonProduction, Development, TestAutomation). Defaults to folder configuration.").option("--user-keys <keys>", "Comma-separated user keys (GUIDs) to run as. Use 'users list' to find keys.").option("--machine-keys <keys>", "Comma-separated machine keys (GUIDs) to target. Use 'machines list' to find keys.").option("--environment-variables <pairs>", "Environment variables as newline-separated KEY=VALUE pairs").option("--run-as-me", "Run job under the caller's identity").option("--healing-agent", "Enable Healing Agent (Autopilot for Robots) for this run. Use to recover from selector failures and similar runtime errors. Tenant-level Autopilot must already be enabled.").option("--job-priority <priority>", "Job priority (Low, Normal, High)").option("--reference <reference>", "User-specified reference for the job").option("--wait-for-completion", "Poll until the job reaches a terminal state (Successful, Faulted, Stopped) and return its output").option("--timeout <seconds>", "Maximum time to wait for completion in seconds (default: 300)", "300").option("--poll-interval <seconds>", "Seconds between status checks (default: 5)", "5").option("--output-dir <path>", "Directory for downloading OutputFile (default: current directory). Only with --wait-for-completion.").option("--no-download", "Skip automatic OutputFile download. Only with --wait-for-completion.").examples(JOBS_START_EXAMPLES).trackedAction(processContext, async (releaseKey, options) => {
+  jobs.command("start").description("Start a job for a process. Returns the created job(s) with keys. " + "The <process-key> is the GUID from 'processes list' (not 'packages list'). " + "Folder is optional — if not provided, it is inferred from the process. " + "Use 'packages entry-points' to see input/output argument schemas for the process.").argument("<process-key>", "Process key (GUID) from 'processes list'. Identifies which process to run.").addOption(createHiddenDeprecatedTenantOption("-t, --tenant <tenant-name>")).option("--folder-path <path>", "Folder path (optional — inferred from process if not provided)").option("--folder-key <key>", "Folder key (optional — inferred from process if not provided)").option("--strategy <strategy>", "Execution strategy (ModernJobsCount, All, Specific, JobsCount)", "ModernJobsCount").option("--jobs-count <number>", "Number of jobs to create (for JobsCount/ModernJobsCount strategy)", "1").option("--input-arguments <json>", "Input arguments as JSON string (mutually exclusive with --input-file). " + "Auto-offloads to InputFile if >10K chars. " + "Use 'packages entry-points' to see the expected schema.").option("--input-file <path>", "Upload a file as the job's InputFile (mutually exclusive with --input-arguments). " + "The file is uploaded as an attachment and its ID is set on the InputFile field.").option("--attachment <[name=]path>", "Upload a file and attach it to the job (repeatable). " + "Format: path (auto-names from filename) or name=path (explicit name). " + "Example: --attachment ./doc.pdf --attachment invoice=./report.pdf", (val, prev) => prev ? [...prev, val] : [val]).option("--attachment-id <guid>", "Attach an existing attachment by ID (repeatable). " + "Use 'attachments list --job-key <key>' to find IDs from a previous job.", (val, prev) => prev ? [...prev, val] : [val]).option("--runtime-type <type>", "Execution runtime (Unattended, Headless, Serverless, NonProduction, Development, TestAutomation, Local). Local runs Agent, Function and API workflow jobs on the folder machines' local slots. Defaults to folder configuration.").option("--user-keys <keys>", "Comma-separated user keys (GUIDs) to run as. Use 'users list' to find keys.").option("--machine-keys <keys>", "Comma-separated machine keys (GUIDs) to target. Use 'machines list' to find keys.").option("--environment-variables <pairs>", "Environment variables as newline-separated KEY=VALUE pairs").option("--run-as-me", "Run job under the caller's identity").option("--healing-agent", "Enable Healing Agent (Autopilot for Robots) for this run. Use to recover from selector failures and similar runtime errors. Tenant-level Autopilot must already be enabled.").option("--job-priority <priority>", "Job priority (Low, Normal, High)").option("--reference <reference>", "User-specified reference for the job").option("--wait-for-completion", "Poll until the job reaches a terminal state (Successful, Faulted, Stopped) and return its output").option("--timeout <seconds>", "Maximum time to wait for completion in seconds (default: 300)", "300").option("--poll-interval <seconds>", "Seconds between status checks (default: 5)", "5").option("--output-dir <path>", "Directory for downloading OutputFile (default: current directory). Only with --wait-for-completion.").option("--no-download", "Skip automatic OutputFile download. Only with --wait-for-completion.").examples(JOBS_START_EXAMPLES).trackedAction(processContext, async (releaseKey, options) => {
     const validStrategies = [
       "ModernJobsCount",
       "All",
@@ -4975,7 +4980,8 @@ var registerJobsCommand = (program) => {
         "Serverless",
         "NonProduction",
         "Development",
-        "TestAutomation"
+        "TestAutomation",
+        "Local"
       ];
       const matchedRuntimeType = validRuntimeTypes.find((v) => v.toLowerCase() === options.runtimeType?.toLowerCase());
       if (!matchedRuntimeType) {
@@ -5360,7 +5366,7 @@ var registerJobsCommand = (program) => {
     });
     processContext.exit(1);
   });
-  jobs.command("healing-data").description("Download healing agent (Autopilot for Robots) recovery data as a ZIP file. " + "Contains screenshots, UI element data, and recovery logs. " + "Only available for jobs where the healing agent was active. " + "Triggers an async export, polls until complete, then downloads the ZIP.").argument("<job-key>", "Job key (GUID)").addOption(createHiddenDeprecatedTenantOption("-t, --tenant <tenant-name>")).option("--directory-prefix <prefix>", "Path prefix to filter exported files").option("-o, --output <path>", "Output file path (defaults to healing-agent-data-<job-key>.zip)").examples(JOBS_HEALING_DATA_EXAMPLES).trackedAction(processContext, async (jobKey, options) => {
+  const healingData = jobs.command("healing-data").description("Download healing agent (Autopilot for Robots) recovery data as a ZIP file. " + "Contains screenshots, UI element data, and recovery logs. " + "Only available for jobs where the healing agent was active. " + "Triggers an async export, polls until complete, then downloads the ZIP.").argument("<job-key>", "Job key (GUID)").addOption(createHiddenDeprecatedTenantOption("-t, --tenant <tenant-name>")).option("--directory-prefix <prefix>", "Path prefix to filter exported files").option("-d, --destination <path>", "Output file path (defaults to healing-agent-data-<job-key>.zip)").examples(JOBS_HEALING_DATA_EXAMPLES).trackedAction(processContext, async (jobKey, options) => {
     const resolved = await resolveJobForCommand(jobKey, options.tenant, "Error getting healing data");
     if (resolved === null)
       return;
@@ -5485,8 +5491,8 @@ var registerJobsCommand = (program) => {
       processContext.exit(1);
       return;
     }
-    const fileName = options.output || `healing-agent-data-${jobKey}.zip`;
-    const { getFileSystem: getFileSystem2 } = await import("./index-r2vc4whd.js");
+    const fileName = options.destination || `healing-agent-data-${jobKey}.zip`;
+    const { getFileSystem: getFileSystem2 } = await import("./index-rkqk9b39.js");
     const fs = getFileSystem2();
     const [writeError] = await catchError(fs.writeFile(fileName, Buffer.from(buffer)));
     if (writeError) {
@@ -5509,6 +5515,7 @@ var registerJobsCommand = (program) => {
       }
     });
   });
+  addDeprecatedOptionAlias(healingData, "-o, --output <path>", "--destination");
   jobs.command("history").description("Get state transition history for a job. " + "Shows timestamps for each state change (Pending → Running → Successful/Faulted). " + "Useful for understanding job lifecycle and identifying delays. " + "Folder context is resolved automatically from the job key.").argument("<job-key>", "Job key (GUID)").addOption(createHiddenDeprecatedTenantOption("-t, --tenant <tenant-name>")).examples(JOBS_HISTORY_EXAMPLES).trackedAction(processContext, async (jobKey, options) => {
     const command = await resolveJobWithJobsApi(jobKey, options.tenant, "Error getting job history");
     if (command === null)
@@ -5547,7 +5554,7 @@ async function buildJobCompletionOutput(job, elapsedMs, options) {
     data.Duration = `${Math.round(elapsedMs / 1000)}s`;
   }
   if (job.outputFile && options.download !== false) {
-    const { getFileSystem: getFileSystem2 } = await import("./index-r2vc4whd.js");
+    const { getFileSystem: getFileSystem2 } = await import("./index-rkqk9b39.js");
     const fsHelper = getFileSystem2();
     const outputDir = options.outputDir || ".";
     const fileName = fsHelper.path.join(outputDir, `output-${job.key || "job"}.dat`);
@@ -6388,6 +6395,12 @@ function formatMachineDetail(machine) {
     HeadlessSlots: machine.headlessSlots ?? 0,
     NonProductionSlots: machine.nonProductionSlots ?? 0,
     TestAutomationSlots: machine.testAutomationSlots ?? 0,
+    AgentSlots: machine.agentSlots ?? 0,
+    FunctionSlots: machine.functionSlots ?? 0,
+    VerticalsRpaSlots: machine.verticalsRpaSlots ?? 0,
+    VerticalsAgentSlots: machine.verticalsAgentSlots ?? 0,
+    VerticalsFunctionSlots: machine.verticalsFunctionSlots ?? 0,
+    ExecutionOptions: machine.executionOptions || "None",
     LicenseKey: machine.licenseKey || ""
   };
 }
@@ -6406,6 +6419,84 @@ function parseSlotOption(value, flag, errorContext) {
   }
   return n;
 }
+var SLOT_OPTIONS = [
+  {
+    flag: "--unattended-slots",
+    option: "unattendedSlots",
+    field: "unattendedSlots"
+  },
+  {
+    flag: "--headless-slots",
+    option: "headlessSlots",
+    field: "headlessSlots"
+  },
+  {
+    flag: "--non-production-slots",
+    option: "nonProductionSlots",
+    field: "nonProductionSlots"
+  },
+  {
+    flag: "--testing-slots",
+    option: "testingSlots",
+    field: "testAutomationSlots"
+  },
+  {
+    flag: "--agent-slots",
+    option: "agentSlots",
+    field: "agentSlots"
+  },
+  {
+    flag: "--function-slots",
+    option: "functionSlots",
+    field: "functionSlots"
+  },
+  {
+    flag: "--verticals-rpa-slots",
+    option: "verticalsRpaSlots",
+    field: "verticalsRpaSlots"
+  },
+  {
+    flag: "--verticals-agent-slots",
+    option: "verticalsAgentSlots",
+    field: "verticalsAgentSlots"
+  },
+  {
+    flag: "--verticals-function-slots",
+    option: "verticalsFunctionSlots",
+    field: "verticalsFunctionSlots"
+  }
+];
+var VALID_EXECUTION_OPTIONS = ["None", "AgentsOnUnattended", "RunVerticals"];
+function parseMachineSlotOptions(options, errorContext) {
+  const body = {};
+  for (const slot of SLOT_OPTIONS) {
+    const value = parseSlotOption(options[slot.option], slot.flag, errorContext);
+    if (value === null)
+      return null;
+    if (value !== undefined)
+      body[slot.field] = value;
+  }
+  if (options.executionOptions !== undefined) {
+    const values = options.executionOptions.flatMap((v) => v.split(",")).map((v) => v.trim()).filter((v) => v.length > 0);
+    const matched = values.map((v) => VALID_EXECUTION_OPTIONS.find((valid) => valid.toLowerCase() === v.toLowerCase()));
+    if (matched.length === 0 || matched.some((m) => m === undefined)) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: errorContext,
+        Instructions: `Invalid --execution-options '${options.executionOptions.join(" ")}'. Must be one or more of: ${VALID_EXECUTION_OPTIONS.join(", ")}`
+      });
+      processContext.exit(1);
+      return null;
+    }
+    const unique = [...new Set(matched)];
+    const flags = unique.filter((m) => m !== "None" || unique.length === 1);
+    body.executionOptions = flags.join(", ");
+  }
+  return body;
+}
+function addSlotOptions(command) {
+  return command.option("--unattended-slots <number>", "Number of unattended robot slots to allocate").option("--headless-slots <number>", "Number of headless robot slots to allocate").option("--non-production-slots <number>", "Number of non-production robot slots to allocate").option("--testing-slots <number>", "Number of test automation robot slots to allocate").option("--agent-slots <number>", "Number of Agent jobs that can run in parallel on the machine's Local runtime").option("--function-slots <number>", "Number of Function and API workflow jobs that can run in parallel on the machine's Local runtime").option("--verticals-rpa-slots <number>", "Number of Local RPA slots reserved for Vertical Solution legs. Used only with --execution-options RunVerticals").option("--verticals-agent-slots <number>", "Number of Local Agent slots reserved for Vertical Solution legs. Used only with --execution-options RunVerticals").option("--verticals-function-slots <number>", "Number of Local Function slots reserved for Vertical Solution legs. Used only with --execution-options RunVerticals").option("--execution-options <options...>", "Machine execution options, space-separated: None, AgentsOnUnattended (Function and API workflow jobs " + "use the Unattended slots), RunVerticals (the machine runs Vertical Solution legs on its vertical slots). " + "Replaces the current value");
+}
 var MACHINES_LIST_EXAMPLES = [
   {
     Description: "List all machines in the tenant",
@@ -6424,6 +6515,12 @@ var MACHINES_LIST_EXAMPLES = [
           HeadlessSlots: 0,
           NonProductionSlots: 0,
           TestAutomationSlots: 0,
+          AgentSlots: 0,
+          FunctionSlots: 0,
+          VerticalsRpaSlots: 0,
+          VerticalsAgentSlots: 0,
+          VerticalsFunctionSlots: 0,
+          ExecutionOptions: "None",
           LicenseKey: "b1c2d3e4-0000-0000-0000-000000000100"
         },
         {
@@ -6437,6 +6534,12 @@ var MACHINES_LIST_EXAMPLES = [
           HeadlessSlots: 0,
           NonProductionSlots: 0,
           TestAutomationSlots: 0,
+          AgentSlots: 0,
+          FunctionSlots: 0,
+          VerticalsRpaSlots: 0,
+          VerticalsAgentSlots: 0,
+          VerticalsFunctionSlots: 0,
+          ExecutionOptions: "None",
           LicenseKey: "b1c2d3e4-0000-0000-0000-000000000200"
         }
       ]
@@ -6460,6 +6563,12 @@ var MACHINES_GET_EXAMPLES = [
         HeadlessSlots: 0,
         NonProductionSlots: 0,
         TestAutomationSlots: 0,
+        AgentSlots: 0,
+        FunctionSlots: 0,
+        VerticalsRpaSlots: 0,
+        VerticalsAgentSlots: 0,
+        VerticalsFunctionSlots: 0,
+        ExecutionOptions: "None",
         LicenseKey: "b1c2d3e4-0000-0000-0000-000000000100"
       }
     }
@@ -6482,6 +6591,38 @@ var MACHINES_CREATE_EXAMPLES = [
         HeadlessSlots: 0,
         NonProductionSlots: 0,
         TestAutomationSlots: 0,
+        AgentSlots: 0,
+        FunctionSlots: 0,
+        VerticalsRpaSlots: 0,
+        VerticalsAgentSlots: 0,
+        VerticalsFunctionSlots: 0,
+        ExecutionOptions: "None",
+        LicenseKey: ""
+      }
+    }
+  },
+  {
+    Description: "Create a template for local Agent and Function jobs, with slots reserved for Vertical Solution legs",
+    Command: 'uip or machines create --name "local-worker" --agent-slots 2 --function-slots 2 --verticals-agent-slots 1 --execution-options RunVerticals',
+    Output: {
+      Code: "MachineCreated",
+      Data: {
+        Name: "local-worker",
+        ID: 104,
+        Key: "a1b2c3d4-0000-0000-0000-000000000011",
+        Type: "Template",
+        Scope: "Default",
+        Description: "",
+        UnattendedSlots: 0,
+        HeadlessSlots: 0,
+        NonProductionSlots: 0,
+        TestAutomationSlots: 0,
+        AgentSlots: 2,
+        FunctionSlots: 2,
+        VerticalsRpaSlots: 0,
+        VerticalsAgentSlots: 1,
+        VerticalsFunctionSlots: 0,
+        ExecutionOptions: "RunVerticals",
         LicenseKey: ""
       }
     }
@@ -6658,19 +6799,10 @@ var registerMachinesCommand = (program) => {
       Data: options.allFields ? resolved.machine : formatMachineDetail(resolved.machine)
     });
   });
-  machines.command("create").description("Create a new machine template (robot host definition). " + "Machines define where robots execute and how many license slots are allocated. " + "Use --serverless to create a serverless (cloud-hosted) machine. " + "Slot options control how many concurrent robot sessions of each type are allowed.").requiredOption("-n, --name <name>", "Machine name (must be unique within the tenant)").option("-d, --description <description>", "Machine description").option("--serverless", "Create a serverless (cloud-hosted) machine instead of a standard template").option("--unattended-slots <number>", "Number of unattended robot slots to allocate").option("--headless-slots <number>", "Number of headless robot slots to allocate").option("--non-production-slots <number>", "Number of non-production robot slots to allocate").option("--testing-slots <number>", "Number of test automation robot slots to allocate").addOption(createHiddenDeprecatedTenantOption("-t, --tenant <tenant-name>")).examples(MACHINES_CREATE_EXAMPLES).trackedAction(processContext, async (options) => {
-    const ctx = "Error creating machine";
-    const unattended = parseSlotOption(options.unattendedSlots, "--unattended-slots", ctx);
-    if (unattended === null)
-      return;
-    const headless = parseSlotOption(options.headlessSlots, "--headless-slots", ctx);
-    if (headless === null)
-      return;
-    const nonProduction = parseSlotOption(options.nonProductionSlots, "--non-production-slots", ctx);
-    if (nonProduction === null)
-      return;
-    const testing = parseSlotOption(options.testingSlots, "--testing-slots", ctx);
-    if (testing === null)
+  const createCommand = machines.command("create").description("Create a new machine template (robot host definition). " + "Machines define where robots execute and how many license slots are allocated. " + "Use --serverless to create a serverless (cloud-hosted) machine. " + "Slot options control how many concurrent robot sessions of each type are allowed.").requiredOption("-n, --name <name>", "Machine name (must be unique within the tenant)").option("-d, --description <description>", "Machine description").option("--serverless", "Create a serverless (cloud-hosted) machine instead of a standard template");
+  addSlotOptions(createCommand).addOption(createHiddenDeprecatedTenantOption("-t, --tenant <tenant-name>")).examples(MACHINES_CREATE_EXAMPLES).trackedAction(processContext, async (options) => {
+    const slots = parseMachineSlotOptions(options, "Error creating machine");
+    if (slots === null)
       return;
     const [apiError, api] = await catchError(createApiClient(MachinesApi, { tenant: options.tenant }));
     if (apiError) {
@@ -6678,6 +6810,7 @@ var registerMachinesCommand = (program) => {
       return;
     }
     const machineData = {
+      ...slots,
       name: options.name,
       type: "Template"
     };
@@ -6688,14 +6821,6 @@ var registerMachinesCommand = (program) => {
     if (options.description) {
       machineData.description = options.description;
     }
-    if (unattended !== undefined)
-      machineData.unattendedSlots = unattended;
-    if (headless !== undefined)
-      machineData.headlessSlots = headless;
-    if (nonProduction !== undefined)
-      machineData.nonProductionSlots = nonProduction;
-    if (testing !== undefined)
-      machineData.testAutomationSlots = testing;
     const [createError, result] = await catchError(api.machinesPost({
       body: machineData
     }));
@@ -6709,7 +6834,8 @@ var registerMachinesCommand = (program) => {
       Data: formatMachineDetail(result)
     });
   });
-  machines.command("update").alias("edit").description("Update machine properties (name, description, slot allocations). " + "Only the provided options are updated; omitted fields remain unchanged. " + "Use 'machines get' to see current values before updating.").argument("<machine-key>", "Machine key (GUID) — use 'machines list' to find").option("-n, --name <name>", "New machine name").option("-d, --description <description>", "New machine description").option("--unattended-slots <number>", "Number of unattended robot slots to allocate").option("--headless-slots <number>", "Number of headless robot slots to allocate").option("--non-production-slots <number>", "Number of non-production robot slots to allocate").option("--testing-slots <number>", "Number of test automation robot slots to allocate").addOption(createHiddenDeprecatedTenantOption("-t, --tenant <tenant-name>")).examples(MACHINES_EDIT_EXAMPLES).trackedAction(processContext, async (machineKey, options) => {
+  const updateCommand = machines.command("update").alias("edit").description("Update machine properties (name, description, slot allocations). " + "Only the provided options are updated; omitted fields remain unchanged. " + "Use 'machines get' to see current values before updating.").argument("<machine-key>", "Machine key (GUID) — use 'machines list' to find").option("-n, --name <name>", "New machine name").option("-d, --description <description>", "New machine description");
+  addSlotOptions(updateCommand).addOption(createHiddenDeprecatedTenantOption("-t, --tenant <tenant-name>")).examples(MACHINES_EDIT_EXAMPLES).trackedAction(processContext, async (machineKey, options) => {
     const resolved = await resolveMachineForCommand(machineKey, options.tenant, "Error updating machine");
     if (resolved === null)
       return;
@@ -6721,27 +6847,10 @@ var registerMachinesCommand = (program) => {
       updateData.name = options.name;
     if (options.description)
       updateData.description = options.description;
-    const ctx = "Error updating machine";
-    const unattended = parseSlotOption(options.unattendedSlots, "--unattended-slots", ctx);
-    if (unattended === null)
-      return;
-    const headless = parseSlotOption(options.headlessSlots, "--headless-slots", ctx);
-    if (headless === null)
-      return;
-    const nonProduction = parseSlotOption(options.nonProductionSlots, "--non-production-slots", ctx);
-    if (nonProduction === null)
-      return;
-    const testing = parseSlotOption(options.testingSlots, "--testing-slots", ctx);
-    if (testing === null)
-      return;
-    if (unattended !== undefined)
-      updateData.unattendedSlots = unattended;
-    if (headless !== undefined)
-      updateData.headlessSlots = headless;
-    if (nonProduction !== undefined)
-      updateData.nonProductionSlots = nonProduction;
-    if (testing !== undefined)
-      updateData.testAutomationSlots = testing;
+    const slots = parseMachineSlotOptions(options, "Error updating machine");
+    if (slots === null)
+      return;
+    Object.assign(updateData, slots);
     const [editError] = await catchError(api.machinesPatchById({
       key: resolved.id,
       body: updateData
@@ -7396,7 +7505,7 @@ var registerPackagesCommand = (program) => {
       processContext.exit(1);
       return;
     }
-    const { getFileSystem: getFileSystem2 } = await import("./index-r2vc4whd.js");
+    const { getFileSystem: getFileSystem2 } = await import("./index-rkqk9b39.js");
     const fs = getFileSystem2();
     const [readError, fileBuffer] = await catchError(fs.readFile(filePath));
     if (readError || fileBuffer === null) {
@@ -7566,7 +7675,7 @@ var registerPackagesCommand = (program) => {
       await reportFailure("Error downloading package", bufferError);
       return;
     }
-    const { getFileSystem: getFileSystem2 } = await import("./index-r2vc4whd.js");
+    const { getFileSystem: getFileSystem2 } = await import("./index-rkqk9b39.js");
     const fs = getFileSystem2();
     const buffer = new Uint8Array(arrayBuffer);
     const [writeError] = await catchError(fs.writeFile(options.destination, buffer));
@@ -11258,6 +11367,185 @@ var registerQueuesCommand = (program) => {
   });
 };
 
+// src/utils/role-permissions.ts
+var CATALOG_PAGE_SIZE = 1000;
+var MAX_SUGGESTIONS = 5;
+var ACTION_SUFFIX = /\.(View|Edit|Create|Delete)$/;
+var GROUP_HINTS = {
+  triggers: "Schedules",
+  folders: "Units",
+  actioncatalogs: "TaskCatalogs"
+};
+async function fetchPermissionCatalog(api) {
+  const catalog = [];
+  for (let skip = 0;; skip += CATALOG_PAGE_SIZE) {
+    const page = (await api.permissionsGet({
+      $top: CATALOG_PAGE_SIZE,
+      $skip: skip,
+      $orderby: "Name asc"
+    })).value ?? [];
+    catalog.push(...page);
+    if (page.length < CATALOG_PAGE_SIZE)
+      return catalog;
+  }
+}
+function planPermissionChanges(input) {
+  const catalogByName = byName(input.catalog);
+  const existingByName = byName(input.role.permissions ?? []);
+  const resolveIn = (...sources) => {
+    const canonical = new Map;
+    for (const name of sources.flatMap((s) => [...s.keys()])) {
+      canonical.set(name.toLowerCase(), name);
+    }
+    return (name) => sources.some((s) => s.has(name)) ? name : canonical.get(name.toLowerCase());
+  };
+  const resolveAdd = resolveIn(catalogByName);
+  const resolveRemove = resolveIn(existingByName, catalogByName);
+  const unknownNames = unique([
+    ...input.add.filter((n) => !resolveAdd(n)),
+    ...input.remove.filter((n) => !resolveRemove(n))
+  ]);
+  if (unknownNames.length > 0) {
+    const names = [
+      ...(catalogByName.size > 0 ? catalogByName : existingByName).keys()
+    ];
+    return {
+      kind: "unknown",
+      unknown: unknownNames.map((name) => ({
+        Name: name,
+        Suggestions: suggestPermissionNames(name, names)
+      })),
+      catalogEmpty: catalogByName.size === 0
+    };
+  }
+  const toAdd = new Set(input.add.map((n) => resolveAdd(n)));
+  const toRemove = new Set(input.remove.map((n) => resolveRemove(n)));
+  const conflicting = [...toAdd].filter((n) => toRemove.has(n));
+  if (conflicting.length > 0) {
+    return { kind: "conflicting", conflicting };
+  }
+  const rejected = rejectedForRoleType(input.role.type, toAdd, catalogByName);
+  if (rejected.length > 0) {
+    return {
+      kind: "wrong-scope",
+      roleType: input.role.type,
+      rejected
+    };
+  }
+  const permissions = [...existingByName.values()].map((p) => {
+    if (toAdd.has(p.name))
+      return { ...p, isGranted: true };
+    if (toRemove.has(p.name))
+      return { ...p, isGranted: false };
+    return p;
+  });
+  for (const name of toAdd) {
+    const template = catalogByName.get(name);
+    if (!existingByName.has(name) && template) {
+      permissions.push({ ...template, isGranted: true });
+    }
+  }
+  const wasGranted = (name) => existingByName.get(name)?.isGranted === true;
+  return {
+    kind: "ok",
+    permissions,
+    added: [...toAdd].filter((n) => !wasGranted(n)),
+    removed: [...toRemove].filter(wasGranted)
+  };
+}
+function rejectedForRoleType(roleType, names, catalogByName) {
+  if (roleType !== "Folder" && roleType !== "Tenant")
+    return [];
+  const rejected = [];
+  for (const name of names) {
+    const scope = catalogByName.get(name)?.scope;
+    if (!scope || !ACTION_SUFFIX.test(name))
+      continue;
+    const isFolderScope = scope === "Folder";
+    if (roleType === "Folder" !== isFolderScope) {
+      rejected.push({ Name: name, Scope: scope });
+    }
+  }
+  return rejected;
+}
+function suggestPermissionNames(input, names) {
+  const candidates = names.filter((n) => n.includes("."));
+  const lower = input.toLowerCase();
+  const dot = lower.indexOf(".");
+  const group = dot === -1 ? lower : lower.slice(0, dot);
+  const action = dot === -1 ? "" : lower.slice(dot + 1);
+  const suggestions = new Set;
+  const inGroup = (g) => candidates.filter((n) => n.toLowerCase().startsWith(`${g}.`));
+  const hinted = GROUP_HINTS[group]?.toLowerCase();
+  if (hinted) {
+    const exact = candidates.find((n) => n.toLowerCase() === `${hinted}.${action}`);
+    for (const n of exact ? [exact] : inGroup(hinted))
+      suggestions.add(n);
+  }
+  const maxEdits = Math.max(2, Math.floor(input.length / 4));
+  const nearMisses = candidates.map((n) => ({ n, d: editDistance(lower, n.toLowerCase()) })).filter(({ d }) => d <= maxEdits).sort((a, b) => a.d - b.d || a.n.localeCompare(b.n));
+  for (const { n } of nearMisses)
+    suggestions.add(n);
+  for (const n of inGroup(group))
+    suggestions.add(n);
+  return [...suggestions].slice(0, MAX_SUGGESTIONS);
+}
+function unknownPermissionsFailure(roleKey, unknown, catalogEmpty) {
+  const hints = unknown.filter((u) => u.Suggestions.length > 0).map((u) => `${u.Suggestions.join(", ")} (for ${u.Name})`);
+  const didYouMean = hints.length > 0 ? `Did you mean ${hints.join("; ")}? ` : "";
+  const empty = catalogEmpty ? "The permission catalog came back empty for this login, so no name could be checked. " : "";
+  return {
+    Result: RESULTS.Failure,
+    ErrorCode: "invalid_argument",
+    Message: `Not in this tenant's permission catalog: ${unknown.map((u) => u.Name).join(", ")}. The role was not changed.`,
+    Instructions: `${empty}${didYouMean}Run 'uip or roles permissions list --limit 1000' to see every permission name.`,
+    Retry: "RetryWillNotFix",
+    Data: { RoleKey: roleKey, UnknownPermissions: [...unknown] }
+  };
+}
+function rejectedPermissionsFailure(roleKey, roleType, rejected) {
+  const [held, other] = roleType === "Folder" ? ["tenant", "Tenant"] : ["folder", "Folder"];
+  return {
+    Result: RESULTS.Failure,
+    ErrorCode: "invalid_argument",
+    Message: `A ${roleType} role cannot hold ${held} permissions: ${rejected.map((r) => r.Name).join(", ")}. The role was not changed.`,
+    Instructions: `Drop them from --add-permissions, or grant them through a ${other} role ('uip or roles list' shows each role's Type).`,
+    Retry: "RetryWillNotFix",
+    Data: {
+      RoleKey: roleKey,
+      RoleType: roleType,
+      RejectedPermissions: [...rejected]
+    }
+  };
+}
+function conflictingPermissionsFailure(roleKey, conflicting) {
+  return {
+    Result: RESULTS.Failure,
+    ErrorCode: "invalid_argument",
+    Message: `Both added and removed: ${conflicting.join(", ")}. The role was not changed.`,
+    Instructions: "Pass each permission to only one of --add-permissions and --remove-permissions.",
+    Retry: "RetryWillNotFix",
+    Data: { RoleKey: roleKey, ConflictingPermissions: [...conflicting] }
+  };
+}
+function byName(permissions) {
+  return new Map(permissions.filter((p) => p.name != null).map((p) => [p.name, p]));
+}
+function unique(names) {
+  return [...new Set(names)];
+}
+function editDistance(a, b) {
+  let previous = Array.from({ length: b.length + 1 }, (_, j) => j);
+  for (let i = 1;i <= a.length; i++) {
+    const current = [i];
+    for (let j = 1;j <= b.length; j++) {
+      current[j] = Math.min(previous[j] + 1, current[j - 1] + 1, previous[j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1));
+    }
+    previous = current;
+  }
+  return previous[b.length];
+}
+
 // src/utils/role-resolver.ts
 async function resolveRoleGuid(roleKey) {
   const [apiError, api] = await catchError(createApiClient(RolesApi));
@@ -11305,6 +11593,9 @@ async function resolveUserGuid(userInput) {
 
 // src/commands/roles.ts
 var ROLE_TYPE_ALLOWLIST = ["Tenant", "Folder"];
+function splitPermissionNames(value) {
+  return value === undefined ? [] : value.split(",").map((p) => p.trim()).filter(Boolean);
+}
 function parseUserRolePrincipalType(value) {
   switch (value.toLowerCase()) {
     case "user":
@@ -11404,13 +11695,15 @@ var ROLES_CREATE_ROLE_EXAMPLES = [
 ];
 var ROLES_EDIT_ROLE_EXAMPLES = [
   {
-    Description: "Add permissions to a role",
-    Command: "uip or roles update a1b2c3d4-0000-0000-0000-000000000010 --add-permissions Assets.View,Jobs.View",
+    Description: "Add permissions to a tenant role",
+    Command: "uip or roles update a1b2c3d4-0000-0000-0000-000000000010 --add-permissions Users.View,Robots.View",
     Output: {
       Code: "RoleUpdated",
       Data: {
         Key: "a1b2c3d4-0000-0000-0000-000000000010",
-        Status: "Updated successfully"
+        Status: "Updated successfully",
+        AddedPermissions: ["Users.View", "Robots.View"],
+        RemovedPermissions: []
       }
     }
   }
@@ -11685,7 +11978,7 @@ var registerRolesCommand = (program) => {
       }
     });
   });
-  rolesCmd.command("update").alias("edit").description("Add or remove permissions on a role. " + "Reads current permissions, applies changes, and saves. " + "Use 'roles permissions list' to find valid permission names, 'roles get' to see current grants.").argument("<role-key>", "Role key (GUID) — use 'roles list' to find").option("--add-permissions <names>", "Comma-separated permission names to add to the role").option("--remove-permissions <names>", "Comma-separated permission names to remove from the role").addOption(createHiddenDeprecatedTenantOption("-t, --tenant <tenant-name>")).examples(ROLES_EDIT_ROLE_EXAMPLES).trackedAction(processContext, async (roleKey, options) => {
+  rolesCmd.command("update").alias("edit").description("Add or remove permissions on a role. " + "Reads current permissions, applies changes, and saves. " + "Names are checked against the tenant's permission catalog before saving: an unknown name, " + "or a permission whose scope does not fit the role (a tenant permission on a Folder role, a folder permission on a Tenant role), " + "is refused and nothing is saved. Reports the permissions it actually added and removed. " + "Use 'roles permissions list' to find valid permission names, 'roles get' to see current grants.").argument("<role-key>", "Role key (GUID) — use 'roles list' to find").option("--add-permissions <names>", "Comma-separated permission names to add to the role").option("--remove-permissions <names>", "Comma-separated permission names to remove from the role").addOption(createHiddenDeprecatedTenantOption("-t, --tenant <tenant-name>")).examples(ROLES_EDIT_ROLE_EXAMPLES).trackedAction(processContext, async (roleKey, options) => {
     if (!options.addPermissions && !options.removePermissions) {
       OutputFormatter.error({
         Result: RESULTS.Failure,
@@ -11715,38 +12008,32 @@ var registerRolesCommand = (program) => {
       await reportFailure("Error fetching current role data", getError);
       return;
     }
-    const toAdd = options.addPermissions ? new Set(options.addPermissions.split(",").map((p) => p.trim()).filter(Boolean)) : new Set;
-    const toRemove = options.removePermissions ? new Set(options.removePermissions.split(",").map((p) => p.trim()).filter(Boolean)) : new Set;
     const [permApiError, permApi] = await catchError(createApiClient(PermissionsApi, { tenant: options.tenant }));
     if (permApiError) {
       await reportFailure("Error fetching available permissions", permApiError);
       return;
     }
-    const [allPermsError, allPermsResult] = await catchError(permApi.permissionsGet({ $top: 1000 }));
-    if (allPermsError) {
-      await reportFailure("Error fetching available permissions", allPermsError);
+    const [catalogError, catalog] = await catchError(fetchPermissionCatalog(permApi));
+    if (catalogError) {
+      await reportFailure("Error fetching available permissions", catalogError);
       return;
     }
-    const availableByName = new Map((allPermsResult.value ?? []).filter((p) => p.name != null).map((p) => [p.name, p]));
-    const existingByName = new Map((current.permissions ?? []).filter((p) => p.name != null).map((p) => [p.name, p]));
-    const permissions = [...existingByName.values()].map((p) => {
-      if (p.name && toAdd.has(p.name)) {
-        return { ...p, isGranted: true };
-      }
-      if (p.name && toRemove.has(p.name)) {
-        return { ...p, isGranted: false };
-      }
-      return p;
+    const plan = planPermissionChanges({
+      role: current,
+      catalog,
+      add: splitPermissionNames(options.addPermissions),
+      remove: splitPermissionNames(options.removePermissions)
     });
-    for (const name of toAdd) {
-      if (!existingByName.has(name)) {
-        const template = availableByName.get(name);
-        if (template) {
-          permissions.push({ ...template, isGranted: true });
-        }
-      }
+    if (plan.kind !== "ok") {
+      OutputFormatter.error(plan.kind === "unknown" ? unknownPermissionsFailure(roleKey, plan.unknown, plan.catalogEmpty) : plan.kind === "conflicting" ? conflictingPermissionsFailure(roleKey, plan.conflicting) : rejectedPermissionsFailure(roleKey, plan.roleType, plan.rejected));
+      processContext.exit(1);
+      return;
     }
-    const body = { ...current, id: numericId, permissions };
+    const body = {
+      ...current,
+      id: numericId,
+      permissions: plan.permissions
+    };
     const [editError] = await catchError(api.rolesPutById({ key: numericId, body }));
     if (editError) {
       await reportFailure("Error updating role", editError);
@@ -11755,7 +12042,12 @@ var registerRolesCommand = (program) => {
     OutputFormatter.success({
       Result: RESULTS.Success,
       Code: "RoleUpdated",
-      Data: { Key: roleKey, Status: "Updated successfully" }
+      Data: {
+        Key: roleKey,
+        Status: "Updated successfully",
+        AddedPermissions: plan.added,
+        RemovedPermissions: plan.removed
+      }
     });
   });
   rolesCmd.command("delete").description("Delete a role by key (GUID). " + "Only non-static (user-created) roles can be deleted. " + "Built-in roles (IsStatic=true) cannot be removed. " + "Use 'roles list' to find role keys.").argument("<role-key>", "Role key (GUID) — use 'roles list' to find").addOption(createHiddenDeprecatedTenantOption("-t, --tenant <tenant-name>")).option("-y, --yes", "Confirm this irreversible operation (required; the CLI never prompts)").examples(ROLES_DELETE_ROLE_EXAMPLES).trackedAction(processContext, async (roleKey, options) => {
@@ -12219,6 +12511,8 @@ function formatMachineSessionRuntime(runtime) {
     MaintenanceMode: runtime.maintenanceMode || "",
     HostMachineName: runtime.hostMachineName || "",
     RuntimeType: runtime.runtimeType || "",
+    ProcessType: runtime.processType || "",
+    IsVertical: runtime.isVertical ?? false,
     MachineType: runtime.machineType || "",
     MachineScope: runtime.machineScope || "",
     Status: runtime.status || "",
@@ -12354,6 +12648,8 @@ var SESSIONS_LIST_UNATTENDED_EXAMPLES = [
           MaintenanceMode: "Default",
           HostMachineName: "prod-worker-01",
           RuntimeType: "Unattended",
+          ProcessType: "",
+          IsVertical: false,
           MachineType: "Standard",
           MachineScope: "Default",
           Status: "Available",
@@ -13209,13 +13505,14 @@ function resolveBoolOption(value, fallback) {
   return value !== undefined ? value : fallback;
 }
 var VALID_JOB_PRIORITIES = ["Low", "Normal", "High"];
-var VALID_RUNTIME_TYPES = [
+var VALID_API_RUNTIME_TYPES = [
   "Serverless",
   "Unattended",
   "Headless",
   "NonProduction",
   "AgentService"
 ];
+var VALID_RUNTIME_TYPES = [...VALID_API_RUNTIME_TYPES, "Local"];
 var VALID_HTTP_METHODS = ["Get", "Post", "Put", "Delete"];
 var VALID_CALLING_MODES = [
   "AsyncRequestReply",
@@ -13245,8 +13542,8 @@ function validateJobPriority(options) {
   options.jobPriority = result.value;
   return true;
 }
-function validateRuntimeType(options) {
-  const result = normalizeEnumOption(options.runtimeType, VALID_RUNTIME_TYPES, "--runtime-type");
+function validateRuntimeType(options, validRuntimeTypes = VALID_RUNTIME_TYPES) {
+  const result = normalizeEnumOption(options.runtimeType, validRuntimeTypes, "--runtime-type");
   if (!result.ok)
     return false;
   options.runtimeType = result.value;
@@ -13724,7 +14021,7 @@ var registerTriggersCommand = (program) => {
       });
     }
   });
-  triggers.command("create").description("Create a new trigger. --type selects trigger type: time (default), queue, or api. Requires --name, --release-key, --runtime-type. " + "Time triggers need --cron; queue triggers need --queue-key. " + "API triggers need --slug and --method. " + "Folder is inferred from --release-key; pass --folder-path or --folder-key when your identity only has a folder-level role (such as an external app), since it cannot look processes up tenant-wide. " + "Use 'processes list' to find the release key.").option("--type <type>", "Trigger type (time, queue, api)", "time").addOption(createHiddenDeprecatedTenantOption("-t, --tenant <tenant-name>")).requiredOption("--name <name>", "Trigger name").option("-d, --description <text>", "Trigger description").requiredOption("--release-key <key>", "Release key (GUID) of the process to trigger").option("--folder-path <path>", "Folder path of the process (e.g., 'Shared'). Optional — inferred from --release-key if not given").option("--folder-key <key>", "Folder key (GUID) of the process. Optional — inferred from --release-key if not given").option("--input-arguments <json>", `Input arguments as JSON string (e.g., '{"Arg1":"value"}')`).option("--calendar-key <key>", "Calendar key (GUID) for excluding non-working days. Use 'calendars list' to find keys.").option("--stop-strategy <strategy>", "How to stop running jobs: SoftStop or Kill").option("--kill-process-expression <expression>", "Cron expression for force-killing jobs (requires --stop-strategy Kill)").option("--cron <expression>", "Cron expression in Quartz 6-field format: 'sec min hour day month weekday' (e.g., '0 0 12 * * ?' for daily at noon). Note: standard Unix 5-field cron is not supported.").option("--time-zone <timezone>", "IANA time zone ID, e.g. 'UTC' or 'Europe/Bucharest' (applies to time-of-day fields)").option("--queue-key <key>", "Queue key (GUID) for queue trigger (queue only)").option("--items-threshold <number>", "Minimum queue items to trigger activation (queue only)", "1").option("--max-jobs <number>", "Maximum concurrent jobs for queue activation (queue only)", "1").option("--items-per-job <number>", "Target ratio of queue items per job (queue only)", "1").option("--activate-on-complete", "Re-trigger when a job completes (queue only)").option("--resume-on-same-context", "Resume suspended jobs on the same machine").option("--run-as-me", "Run job under the trigger creator's identity").option("--disabled", "Create the trigger in disabled state (default: enabled)").requiredOption("--runtime-type <type>", "Execution runtime (Serverless, Unattended, Headless, NonProduction, AgentService)").requiredOption("--job-priority <priority>", "Job execution priority (Low, Normal, High)", "Normal").option("--slug <slug>", "URL slug for API trigger (api only)").option("--method <method>", "HTTP method: Get, Post, Put, Delete (api only)").option("--calling-mode <mode>", "Calling mode: AsyncRequestReply, AsyncCallback, LongPolling, FireAndForget (api only)").option("--target <spec>", "Run target as 'machine=<guid>,user=<guid>,session=<int>' (any field optional). Repeat for multiple targets. Use 'machines list' and 'users list' to find keys.", (val, prev) => prev ? [...prev, val] : [val]).option("--mapping-mode <mode>", "Validation mode for --target: 'dynamic' (default) allows any combination of machine/user/session (session requires machine); 'strict' requires both machine and user on every target (use when the folder has 'Enable account-machine mappings' turned on).", "dynamic").examples(TRIGGERS_CREATE_EXAMPLES).trackedAction(processContext, async (options) => {
+  triggers.command("create").description("Create a new trigger. --type selects trigger type: time (default), queue, or api. Requires --name, --release-key, --runtime-type. " + "Time triggers need --cron; queue triggers need --queue-key. " + "API triggers need --slug and --method. " + "Folder is inferred from --release-key; pass --folder-path or --folder-key when your identity only has a folder-level role (such as an external app), since it cannot look processes up tenant-wide. " + "Use 'processes list' to find the release key.").option("--type <type>", "Trigger type (time, queue, api)", "time").addOption(createHiddenDeprecatedTenantOption("-t, --tenant <tenant-name>")).requiredOption("--name <name>", "Trigger name").option("-d, --description <text>", "Trigger description").requiredOption("--release-key <key>", "Release key (GUID) of the process to trigger").option("--folder-path <path>", "Folder path of the process (e.g., 'Shared'). Optional — inferred from --release-key if not given").option("--folder-key <key>", "Folder key (GUID) of the process. Optional — inferred from --release-key if not given").option("--input-arguments <json>", `Input arguments as JSON string (e.g., '{"Arg1":"value"}')`).option("--calendar-key <key>", "Calendar key (GUID) for excluding non-working days. Use 'calendars list' to find keys.").option("--stop-strategy <strategy>", "How to stop running jobs: SoftStop or Kill").option("--kill-process-expression <expression>", "Cron expression for force-killing jobs (requires --stop-strategy Kill)").option("--cron <expression>", "Cron expression in Quartz 6-field format: 'sec min hour day month weekday' (e.g., '0 0 12 * * ?' for daily at noon). Note: standard Unix 5-field cron is not supported.").option("--time-zone <timezone>", "IANA time zone ID, e.g. 'UTC' or 'Europe/Bucharest' (applies to time-of-day fields)").option("--queue-key <key>", "Queue key (GUID) for queue trigger (queue only)").option("--items-threshold <number>", "Minimum queue items to trigger activation (queue only)", "1").option("--max-jobs <number>", "Maximum concurrent jobs for queue activation (queue only)", "1").option("--items-per-job <number>", "Target ratio of queue items per job (queue only)", "1").option("--activate-on-complete", "Re-trigger when a job completes (queue only)").option("--resume-on-same-context", "Resume suspended jobs on the same machine").option("--run-as-me", "Run job under the trigger creator's identity").option("--disabled", "Create the trigger in disabled state (default: enabled)").requiredOption("--runtime-type <type>", "Execution runtime (Serverless, Unattended, Headless, NonProduction, AgentService, Local). Local runs Agent, Function and API workflow jobs on the folder machines' local slots; API triggers don't accept it").requiredOption("--job-priority <priority>", "Job execution priority (Low, Normal, High)", "Normal").option("--slug <slug>", "URL slug for API trigger (api only)").option("--method <method>", "HTTP method: Get, Post, Put, Delete (api only)").option("--calling-mode <mode>", "Calling mode: AsyncRequestReply, AsyncCallback, LongPolling, FireAndForget (api only)").option("--target <spec>", "Run target as 'machine=<guid>,user=<guid>,session=<int>' (any field optional). Repeat for multiple targets. Use 'machines list' and 'users list' to find keys.", (val, prev) => prev ? [...prev, val] : [val]).option("--mapping-mode <mode>", "Validation mode for --target: 'dynamic' (default) allows any combination of machine/user/session (session requires machine); 'strict' requires both machine and user on every target (use when the folder has 'Enable account-machine mappings' turned on).", "dynamic").examples(TRIGGERS_CREATE_EXAMPLES).trackedAction(processContext, async (options) => {
     const triggerType = validateTriggerType(options.type);
     if (!triggerType) {
       emitInvalidTypeError(options.type);
@@ -13738,7 +14035,7 @@ var registerTriggersCommand = (program) => {
       await createApiTrigger(options);
     }
   });
-  triggers.command("update").description("Update an existing trigger by key (GUID). --type defaults to time. Only provided fields are changed. " + "All types require --folder-path or --folder-key. " + "Use 'triggers list' to retrieve the key.").argument("<trigger-key>", "Trigger key (GUID). Use 'triggers list' to retrieve the key.").option("--type <type>", "Trigger type (time, queue, api)", "time").addOption(createHiddenDeprecatedTenantOption("-t, --tenant <tenant-name>")).option("--folder-path <path>", "Folder path (e.g., 'Shared')").option("--folder-key <key>", "Folder key (GUID)").option("--name <name>", "New trigger name").option("--release-key <key>", "Release key (GUID) of the process to schedule").option("--cron <expression>", "Cron expression for scheduling (time only)").option("--time-zone <timezone>", "IANA time zone ID, e.g. 'UTC' or 'Europe/Bucharest' (applies to time-of-day fields)").option("--queue-key <key>", "Queue key (GUID) for queue-based trigger (queue only)").option("--runtime-type <type>", "Execution runtime (Serverless, Unattended, Headless, NonProduction, AgentService)").option("--job-priority <priority>", "Job execution priority (Low, Normal, High)").option("--items-threshold <number>", "Minimum queue items to trigger (queue only)").option("--max-jobs <number>", "Maximum concurrent jobs for queue activation (queue only)").option("--items-per-job <number>", "Target ratio of queue items per job (queue only)").option("--activate-on-complete", "Re-trigger when a job completes (queue only)").option("--no-activate-on-complete", "Disable re-trigger on job completion (queue only)").option("--resume-on-same-context", "Resume suspended jobs on same machine").option("--no-resume-on-same-context", "Disable resume on same context").option("--run-as-me", "Run under trigger creator's identity").option("--no-run-as-me", "Disable run-as-me").option("--slug <slug>", "URL slug (api only)").option("--method <method>", "HTTP method: Get, Post, Put, Delete (api only)").option("--calling-mode <mode>", "Calling mode (api only)").option("--target <spec>", "Run target as 'machine=<guid>,user=<guid>,session=<int>' (any field optional). Repeat for multiple targets. Use 'machines list' and 'users list' to find keys.", (val, prev) => prev ? [...prev, val] : [val]).option("--mapping-mode <mode>", "Validation mode for --target: 'dynamic' (default) allows any combination of machine/user/session (session requires machine); 'strict' requires both machine and user on every target (use when the folder has 'Enable account-machine mappings' turned on).", "dynamic").option("--enabled", "Enable the trigger").option("--disabled", "Disable the trigger").examples(TRIGGERS_UPDATE_EXAMPLES).trackedAction(processContext, async (triggerKey, options) => {
+  triggers.command("update").description("Update an existing trigger by key (GUID). --type defaults to time. Only provided fields are changed. " + "All types require --folder-path or --folder-key. " + "Use 'triggers list' to retrieve the key.").argument("<trigger-key>", "Trigger key (GUID). Use 'triggers list' to retrieve the key.").option("--type <type>", "Trigger type (time, queue, api)", "time").addOption(createHiddenDeprecatedTenantOption("-t, --tenant <tenant-name>")).option("--folder-path <path>", "Folder path (e.g., 'Shared')").option("--folder-key <key>", "Folder key (GUID)").option("--name <name>", "New trigger name").option("--release-key <key>", "Release key (GUID) of the process to schedule").option("--cron <expression>", "Cron expression for scheduling (time only)").option("--time-zone <timezone>", "IANA time zone ID, e.g. 'UTC' or 'Europe/Bucharest' (applies to time-of-day fields)").option("--queue-key <key>", "Queue key (GUID) for queue-based trigger (queue only)").option("--runtime-type <type>", "Execution runtime (Serverless, Unattended, Headless, NonProduction, AgentService, Local). Local runs Agent, Function and API workflow jobs on the folder machines' local slots; API triggers don't accept it").option("--job-priority <priority>", "Job execution priority (Low, Normal, High)").option("--items-threshold <number>", "Minimum queue items to trigger (queue only)").option("--max-jobs <number>", "Maximum concurrent jobs for queue activation (queue only)").option("--items-per-job <number>", "Target ratio of queue items per job (queue only)").option("--activate-on-complete", "Re-trigger when a job completes (queue only)").option("--no-activate-on-complete", "Disable re-trigger on job completion (queue only)").option("--resume-on-same-context", "Resume suspended jobs on same machine").option("--no-resume-on-same-context", "Disable resume on same context").option("--run-as-me", "Run under trigger creator's identity").option("--no-run-as-me", "Disable run-as-me").option("--slug <slug>", "URL slug (api only)").option("--method <method>", "HTTP method: Get, Post, Put, Delete (api only)").option("--calling-mode <mode>", "Calling mode (api only)").option("--target <spec>", "Run target as 'machine=<guid>,user=<guid>,session=<int>' (any field optional). Repeat for multiple targets. Use 'machines list' and 'users list' to find keys.", (val, prev) => prev ? [...prev, val] : [val]).option("--mapping-mode <mode>", "Validation mode for --target: 'dynamic' (default) allows any combination of machine/user/session (session requires machine); 'strict' requires both machine and user on every target (use when the folder has 'Enable account-machine mappings' turned on).", "dynamic").option("--enabled", "Enable the trigger").option("--disabled", "Disable the trigger").examples(TRIGGERS_UPDATE_EXAMPLES).trackedAction(processContext, async (triggerKey, options) => {
     const triggerType = validateTriggerType(options.type);
     if (!triggerType) {
       emitInvalidTypeError(options.type);
@@ -13919,7 +14216,8 @@ async function createScheduleTrigger(options, isCronType) {
     "Unattended",
     "Headless",
     "NonProduction",
-    "AgentService"
+    "AgentService",
+    "Local"
   ];
   const matchedRuntimeType = validRuntimeTypes.find((v) => v.toLowerCase() === options.runtimeType?.toLowerCase());
   if (!matchedRuntimeType) {
@@ -14073,13 +14371,7 @@ async function createApiTrigger(options) {
   }
   options.method = matchedMethod;
   if (options.runtimeType) {
-    const validRuntimeTypes = [
-      "Serverless",
-      "Unattended",
-      "Headless",
-      "NonProduction",
-      "AgentService"
-    ];
+    const validRuntimeTypes = VALID_API_RUNTIME_TYPES;
     const matchedRuntimeType = validRuntimeTypes.find((v) => v.toLowerCase() === options.runtimeType?.toLowerCase());
     if (!matchedRuntimeType) {
       OutputFormatter.error({
@@ -14224,7 +14516,7 @@ async function updateScheduleTrigger(triggerKey, options, triggerType) {
 async function updateApiTrigger(triggerKey, options) {
   if (!validateMethod(options))
     return;
-  if (!validateRuntimeType(options))
+  if (!validateRuntimeType(options, VALID_API_RUNTIME_TYPES))
     return;
   if (!validateJobPriority(options))
     return;
@@ -15832,7 +16124,7 @@ var registerCommands = async (program) => {
   registerFoldersCommand(program);
   registerJobsCommand(program);
   if (isPreviewBuild()) {
-    const { registerKbCommand } = await import("./kb-zgjw0vpk.js");
+    const { registerKbCommand } = await import("./kb-rqv35wke.js");
     registerKbCommand(program);
   }
   registerLibrariesCommand(program);
@@ -15854,4 +16146,4 @@ var registerCommands = async (program) => {
 
 export { metadata, registerCommands };
 
-//# debugId=B0B77D77FA56613F64756E2164756E21
+//# debugId=1D581486482C102364756E2164756E21