@uipath/skills 1.196.0 → 1.197.0

package/skills/uipath-connector-builder/references/standard-resources.md

@@ -0,0 +1,111 @@
+# Standard Resource Reference
+
+StandardResource (SR) files live in `app/element/standard-resources/*.json` (one per
+object). They define the schema, display metadata, and per-method config. element.json
+says HOW to call the API; the SR says WHAT the data looks like.
+
+Author SR files with the `activity` verbs — `activity create` (whole resource: SR file +
+one element.json entry per method), `activity field create`, `activity method set`,
+`activity param create`. Never hand-edit an SR for things a verb can do; reserve raw
+`state patch` for fields no flag exposes (see [element-json.md](element-json.md)
+§state-patch). Command map + workflows live in SKILL.md — don't re-derive them here.
+
+## Link to element.json
+`standardResourceName` on the element.json resource entry is canonical (`"accounts"` →
+`accounts.json`). The SR filename is independent of the path. element.json is the source
+of truth; on every write the SR's contract params auto-reconcile to it. System resources
+have NO SR file and no `standardResourceName` (see [system-resources.md](system-resources.md)).
+
+The SR's `metadata.method.<VERB>.{reference ?? path}` MUST resolve to the element.json
+resource `path` — the IS slug `/<object>`, NOT the vendor path — or the method won't
+attach and won't show under the object in Studio. `validate` warns "SR linkage broken"
+when nothing resolves.
+
+## Top-Level Fields
+`name` (matches filename), `path`, `displayName` (also the Studio activity name),
+`elementKey`, `type`/`subType` (`"standard"`), `custom` (`"no"`/`"yes"` — string),
+`isPriority`, `isHidden`, `executionType` (`sync`/`async`/`hybrid`),
+`metadata` (object), `fields` (object — **TOP-LEVEL**, not inside metadata).
+
+## metadata.method — per-method config
+Keys are method names: `GET`, `GETBYID`, `POST`, `PATCH`, `PUT`, `DELETE`. Only methods
+defined here appear in the CRUD dropdown. Set/replace one with `activity method set
+--resource <name> --method <VERB>`. Each entry:
+
+| Property | Description |
+|----------|-------------|
+| `method` | Same as the key. |
+| `operation` | List / Retrieve / Create / Update / Delete (`--operation`). |
+| `operationId` | Unique op id (`--operation-id`). |
+| `description` | Method description. |
+| `hasCEQL` | Supports CEQL filtering (`--has-ceql`; typically true for GET). |
+| `isHidden` | Hide this method from the dropdown (`--hidden`). |
+| `responseDisplayName` / `responseDescription` | Response var name/desc in Studio. |
+| `parameters` | Same schema as element.json resource params. element.json is the source of truth for contract fields; SR-only UI fields are preserved. Runtime-only types (`value`, `body`) are excluded from the SR side. |
+| `curated` | If present, this method becomes a standalone curated Studio activity. **Auto-added by default** by `activity create` (pass `--no-curate` to skip). |
+
+Curated block: `{ "name", "displayName", "description", "isHidden" }`. A curated
+activity's fields also need field-level `requestCurated`/`responseCurated` visibility —
+see **fields** below.
+
+### by-id methods (GETBYID / PATCH / PUT / DELETE)
+`activity create` auto-adds the `/{primaryKey}` path param for by-id methods, so a
+GETBYID method's path becomes `/<object>/{id}` without extra flags. The suffix is added
+ALWAYS for `GETBYID`, and for `PATCH`/`PUT`/`DELETE` only when the activity is CRUD (it also
+defines `GET`/`GETBYID`); a write-only activity keeps its base path. A per-method
+`--method-vendor-path GETBYID=/foo` override that lacks `{id}` STILL works — the id param
+is derived from the canonical resource path. Only model GETBYID for TRUE by-id endpoints,
+not a search/list-by-filter endpoint.
+
+## metadata.events
+`{ "eventMode": ["polling"] }` — `trigger create` sets this. Full `eventMode` value set:
+[events.md](events.md) §"SR-level event metadata".
+
+## fields — definitions (top-level object)
+Each key = field name and MUST equal `field.name`. Add/update with `activity field
+create --resource <name> --name <field> [--type <t>]`. Re-running MERGES: top-level keys
+you pass win, unspecified keys are kept, and per-method visibility is deep-merged.
+`--type` is required only for a NEW field, optional on a merge.
+
+Core: `name`, `type` (string/integer/number/boolean/date/date-time/object/array),
+`displayName`, `nativeType`, `format`, `description`, `sampleValue`, `primaryKey`
+(`--primary-key`), `sortOrder` (`--sort-order`), `enum` (`--enum '[{"value":"active"}]'`),
+`mask` (`--mask`), `custom`. **`enum` MUST be the object form `[{"value":"x"}]`** — the server
+SR marshaller rejects a bare string array `["x"]` at PUBLISH time even though `validate` passes.
+The CLI auto-normalizes a bare `--enum '["a","b"]'` to the object form, but hand-edited SR/`state
+patch` enums must use `[{"value":…}]`.
+
+**Method visibility** (`field.method` object) controls request/response per method:
+```json
+"method": {
+  "GET":  {"name": "GET",  "response": true},
+  "POST": {"name": "POST", "request": true, "response": true, "required": true}
+}
+```
+Set it with the visibility flags. `--method` is REPEATABLE and the flags
+(`--request`/`--response`/`--required`/`--request-curated`/`--response-curated`) apply to
+EVERY listed method: `--method GET --method POST --response` makes the field a response on
+both. Properties: `response`, `request`, `required`, `requestCurated`, `responseCurated`,
+`designOverrides`. `requestCurated`/`responseCurated` gate a field's visibility INSIDE a
+curated activity (plain `request`/`response` is not enough); auto-curation sets them from
+the field's request/response side.
+
+**Searchable**: `searchable` (`--searchable`), `searchableOperators`
+(`--searchable-operators '=,!=,like,>,<,>=,<=,in'`), `searchableNames`.
+
+**design** object (`--design-position primary|secondary|none`, `--component`, `--hidden`):
+`position`, `component` (FolderPicker, Button, Connectors, Resources, Fields, Processes,
+Queues), `hidden` (what `--hidden` writes — the field-level key is `design.hidden`, NOT
+`isHidden`), `loadByDefault`, `isMultiSelect`, `enableUserOverride`, `dictionaryWidget`,
+`solutionResourceKind`, `fieldActions` (cascading show/hide based on another field's value).
+
+**reference** object (lookup dropdown): `{ "lookupNames": ["name"], "lookupValue": "id",
+"path": "/accounts" }` — set via `state patch` (no field flag).
+
+## Rules
+1. Field dict key MUST equal `field.name`. 2. `fields` is top-level. 3. Only methods in
+   `metadata.method` appear in dropdowns. 4. Primary-key field needs `"primaryKey": true`.
+5. SR linkage (above) must resolve to the IS slug `/<object>`, not the vendor path.
+
+## See also
+- [element-json.md](element-json.md), [events.md](events.md), [system-resources.md](system-resources.md)

package/skills/uipath-connector-builder/references/system-resources.md

@@ -0,0 +1,85 @@
+# System Resources Reference
+
+System resources are `element.json → resources[]` entries with NO SR file and no
+`standardResourceName`. They never appear as CRUD/curated activities — they exist for
+connector lifecycle, auth flow, or runtime overrides.
+
+Create them with `auth system create --type <TYPE>`; list them with `auth system list`
+(command map in SKILL.md). Flag semantics specific to this verb: `--method <verb>` falls back to
+the type's `defaultMethod` (`GET` for `provisionAuthValidation`), then to `POST` for other
+method-requiring types — types that don't require a method (`onProvision`/`onDelete`/`onRefresh`)
+get NO method unless you pass `--method`. `--next-resource <selector>` chains a follow-up (e.g.
+`GET:/organization`); `--path <path>` must equal the type's override path when it declares one
+(see table). Use `activity create` for a NORMAL API endpoint.
+
+```bash
+uip is connectors builder auth system create --type provisionAuthValidation --vendor-path /me
+```
+
+## provisionAuthValidation — verify creds at connection time
+Runs one test API call at connection creation; a failure rejects the connection
+immediately. Override path `/auth_validation`, `vendorPath` a cheap authenticated
+read-only endpoint (`/me`, `/users/me`, `/account`, smallest list endpoint), `method`
+GET (the probe must be read-only and must not change vendor data).
+```json
+{"type": "provisionAuthValidation", "path": "/auth_validation", "vendorPath": "/me", "method": "GET", "vendorMethod": "GET"}
+```
+`validate` surfaces a WARNING (never a hard error) when it's missing and any auth type is set —
+labeled `required` for non-OAuth/JWT types (any whose name doesn't start with `oauth`/`jwt`:
+`basic`, `custom`, `customApiKey`, `personalAccessToken`, `awsv4`, `googleServiceAccount`,
+`rsaCertificate` — they have no token exchange to catch bad creds), and `recommended` (still
+surfaced) for OAuth/JWT-only connectors. `auth set` seeds it when `--validation-vendor-path` is
+given (`--validation-method` defaults to GET).
+
+**If the validation endpoint needs a constant query param** (e.g. Azure Form Recognizer's
+`/info?api-version=2023-07-31`): don't bake it into `vendorPath` — add it as a `value` param
+(rationale: [element-json.md](element-json.md) → "Static / constant query parameters").
+`auth set --validation-vendor-path '/info?api-version=2023-07-31'` extracts it for you; the
+resulting resource is:
+```json
+{"type": "provisionAuthValidation", "path": "/auth_validation", "vendorPath": "/info", "method": "GET", "vendorMethod": "GET",
+ "parameters": [{"name": "2023-07-31", "vendorName": "api-version", "type": "value", "vendorType": "query"}]}
+```
+
+## Override-path table
+`vendorPath / method` = the type's declared `requiresVendorPath` / `requiresMethod` expectation
+(`RESOURCE_TYPE_INFO`) — provide both for any `yes`. NOTE: `auth system create` does NOT
+hard-reject a missing one — `vendorPath` defaults to `/<name>` and `method` falls back per the
+rule above; the only hard error is a `--path` that conflicts with the type's override path. All
+13 system types:
+
+| Type | Override path | vendorPath / method expected? |
+|------|---------------|------------------------------|
+| `onProvision` | (custom) | no / no |
+| `onDelete` | (custom) | no / no |
+| `onRefresh` | `/on-refresh` | no / no |
+| `provisionAuthValidation` | `/auth_validation` | yes / yes (method defaults GET) |
+| `oauthOnAuthroizeUrl` | `/auth/authorize` | no / yes |
+| `oauthOnTokenExchange` | `/oauthOnTokenExchange` | yes / yes |
+| `oauthOnTokenRefresh` | `/oauthOnTokenRefresh` | yes / yes |
+| `oauthOnTokenRevoke` | (custom) | yes / yes |
+| `oauth1OnTokenRequest` | (custom) | yes / yes |
+| `oauth2ClientCredentials` | (custom) | yes / yes |
+| `onProvisionWebhook` | (custom) | yes / yes |
+| `onDeleteWebhook` | (custom) | yes / yes |
+| `onProvisionCacheVendorDataAsync` | (custom) | yes / yes |
+
+- **onProvision**: setup work at creation (fetch metadata, validate permissions, chain
+  calls via `--next-resource`). **onDelete**: teardown (revoke tokens, deregister).
+- **oauthOnTokenRefresh**: replaces default OAuth2 refresh for non-standard request
+  shapes; `auth set` auto-creates it for refresh-token OAuth types (not client creds).
+- **oauthOnTokenExchange**: replaces default code→token exchange.
+  **oauthOnTokenRevoke**: custom revoke handler called on disconnect.
+- **oauthOnAuthroizeUrl** (historical typo, keep it): dynamic authorize URL via a
+  preRequest hook (tenant/region/verifier in the URL).
+- **oauth1OnTokenRequest**: OAuth 1.0 token-request handler.
+  **oauth2ClientCredentials**: custom client-credentials grant handler.
+- **onProvisionWebhook / onDeleteWebhook**: register/deregister vendor webhooks.
+  **onProvisionCacheVendorDataAsync**: async cache of vendor data at provisioning.
+
+For fixed-path types the `path` MUST match exactly — that is how Udon swaps the built-in
+default for your custom one. Pass it via `--path`; `auth system create` validates it
+against the type's declared override path.
+
+## See also
+- [element-json.md](element-json.md), [configuration.md](configuration.md), [events.md](events.md)

package/skills/uipath-feedback/SKILL.md

@@ -39,20 +39,35 @@ uip --version 2>&1
 
 Gather all context automatically. Run these substeps silently.
 
-#### 2a. Detect skill context
+#### 2a. Detect the area
 
-Check the current working directory. Stop at first match:
+The **area** (which product) becomes the title tag and a Jira label for filtering. Identify it from the last `uip <verb>` the user ran in this conversation. If no `uip` command is identifiable, fall back to the working directory, then to conversation context. Map command/signal → area:
 
-| Check | Skill context |
+| Last command / signal | Area |
 |---|---|
-| `*.flow` file exists | **Flow** |
-| `pyproject.toml` with `uipath` dependency | **Agents** |
-| `project.json` + `*.cs` and/or `*.xaml` files | **RPA** |
-| `package.json` + `.uipath/` directory | **Apps** |
-| None of the above | **Platform** |
+| `uip rpa …`, or `project.json` + `*.cs`/`*.xaml` | `RPA` |
+| `uip maestro flow …`, or `*.flow` file | `Flow` |
+| `uip maestro bpmn …`, or `*.bpmn` file | `BPMN` |
+| `uip maestro case …`, or `caseplan.json` | `Case` |
+| `uip <agent…>`, or `pyproject.toml` with `uipath` / `agent.json` | `Agents` |
+| `uip codedapp …`, or `app.config.json` / `action-schema.json` | `CodedApps` |
+| `uip api-workflow …` | `ApiWorkflow` |
+| `uip df …` | `DataFabric` |
+| `uip solution …`, or `*.uipx` | `Solution` |
+| `uip tm …` (Test Manager) | `Test` |
+| `uip tasks …` | `Tasks` |
+| `uip admin …` | `Admin` |
+| `uip gov …` | `Governance` |
+| anything else (`uip login`, generic Orchestrator / Integration Service / platform) | `Platform` |
 
 If ambiguous, infer from the conversation. Do NOT ask the user -- pick the best match.
 
+**Optional CLI vs Skill marker.** Only when it is *clearly* one or the other, add a second tag so triagers can route the report:
+- `CLI` -- a `uip` command crashed, returned wrong output, or lacked a verb/flag.
+- `Skill` -- you followed this skill's instructions and they were wrong, misleading, or missing.
+
+Omit it when the cause is mixed or unclear -- don't force a guess.
+
 #### 2b. Capture environment
 
 ```bash
@@ -67,13 +82,13 @@ From tools list, extract tool `name` and `version` from each row.
 
 #### 2c. Capture skill-specific troubleshooting
 
-| Skill context | What to capture | Limits |
+| Area | What to capture | Limits |
 |---|---|---|
 | **Flow** | `uip maestro flow validate <file> --output json`, `.flow` file content, directory listing | `.flow`: first 150 lines; directory: max 30 entries |
 | **RPA** (`.cs` or `.xaml`) | `project.json` dependencies, `uip rpa validate --output json`, list of workflow files (`.cs` and/or `.xaml`) | File list: max 20 files; `project.json`: dependencies section only; failing workflow: first 150 lines |
 | **Agents** | `pyproject.toml`, `bindings.json` (redact connection values), directory listing | `bindings.json`: redact all values; directory: max 30 entries |
-| **Apps** | `package.json` (name, version, dependencies only), `.uipath/` listing | `package.json`: name + version + dependencies only |
-| **Platform** | `uip login status --output json` output only | Strip tokens from output |
+| **CodedApps** | `package.json` (name, version, dependencies only), `.uipath/` listing | `package.json`: name + version + dependencies only |
+| **Other** (Platform, Solution, Admin, …) | `uip login status --output json` output only | Strip tokens from output |
 
 #### 2d. Capture the failing command
 
@@ -148,19 +163,16 @@ Otherwise, skip directly to Step 3.
 #### Title format
 
 ```
-[Product] short description
+[<Area>] short description
 ```
 
-Product names:
+- `<Area>` -- the area tag from Step 2a: `RPA`, `Flow`, `BPMN`, `Case`, `Agents`, `CodedApps`, `ApiWorkflow`, `DataFabric`, `Solution`, `Platform`, `Tasks`, `Test`, `Admin`, `Governance`.
+- Optionally add a `[CLI]` or `[Skill]` tag after the area **only when it is clearly one or the other** (Step 2a): `[<Area>] [CLI] …` or `[<Area>] [Skill] …`.
+- Do NOT put the type (Bug/Improvement) in the title -- that is the issuetype, set via `--type`.
 
-| Skill context | Title prefix |
-|---|---|
-| Flow | `[Flow]` |
-| RPA | `[RPA]` |
-| Agents | `[Agents]` |
-| Apps | `[Apps]` |
-| Platform | `[Platform]` |
-| Interact | `[Interact]` |
+Examples: `[RPA] uip rpa run fails when project.json has no dependencies` · `[Flow] [Skill] Flow skill should list IxP models before adding an extraction node`
+
+The CLI derives Jira labels from these leading `[Tag]` segments of the title, so the same tags are both visible in the title and filterable as labels -- no extra flags.
 
 #### Description body
 
@@ -179,7 +191,7 @@ Build the `--description` content:
 {The actual error message or validation output -- if available, otherwise omit this section}
 
 ## Environment
-- Skill context: {detected skill name}
+- Area: {area}
 - uip version: {version}
 - CLI tools: {name version, name version, ...}
 - OS: {os info}
@@ -206,7 +218,7 @@ Build the `--description` content:
 4. Use `-` for unordered bullet points.
 5. For numbered items within a section body, use `1.`, `2.`, etc. on their own lines. Do not escape the dots.
 6. Do NOT escape markdown characters. No `\*`, `\#`, `\-`, `\.`. Write `**bold**`, not `\*\*bold\*\*`.
-7. The description MUST be plain markdown. No Jira wiki markup, no HTML, no ADF.
+7. The description MUST be plain markdown. No Jira wiki markup, no HTML, no ADF — the CLI converts this markdown to the tracker's native format (Jira wiki markup) on send, so it renders cleanly.
 8. Do NOT include the user's email in the description body. Pass it only via the `--email` flag.
 
 #### Example of a well-formatted description
@@ -225,7 +237,7 @@ When running `uip maestro flow validate` on a flow with nested loops, the CLI re
 ExpressionError: Invalid expression at unknown location — currentItem is not defined
 
 ## Environment
-- Skill context: Flow
+- Area: Flow
 - uip version: 0.1.20
 - CLI tools: docsai-tool 0.1.12
 - OS: Windows 11 Enterprise 10.0.26100
@@ -254,11 +266,11 @@ Write sanitized copies of relevant project files to a temp directory:
 mkdir -p "${TMPDIR:-${TMP:-/tmp}}/uip-feedback-attachments"
 ```
 
-Copy and sanitize files based on skill context:
+Copy and sanitize files based on the detected area:
 - Flow: the `.flow` file
 - RPA: `project.json`, the failing workflow file (`.cs` or `.xaml`)
 - Agents: `pyproject.toml`, `bindings.json` (redacted)
-- Apps: `package.json`
+- CodedApps: `package.json`
 
 Max 10 files, max 10MB each. Skip files that exceed limits.
 
@@ -269,14 +281,14 @@ Display to the user:
 ```
 **Type:** bug
 **Priority:** normal
-**Title:** [Flow] Expression error in nested loop currentItem
+**Title:** [Flow] [CLI] Expression error in nested loop currentItem
 **Description:** (first 3 lines...)
 **Attachments:** MyFlow.flow, project.json
 
 Send this to UiPath? (yes/no)
 ```
 
-The user can adjust type, priority, or title before confirming. **Never send without explicit "yes".**
+The user can adjust type, priority, or title (the title carries the area / optional CLI-or-Skill tag) before confirming. **Never send without explicit "yes".**
 
 ### Step 4 -- Send feedback
 
@@ -293,7 +305,9 @@ FEEDBACK_EOF
   --output json
 ```
 
-If an email is available from `uip login status`, include `--email "<EMAIL>"`.
+The title's leading `[Tag]` segments (the area, plus an optional `[CLI]`/`[Skill]` marker) become Jira labels automatically -- no extra flags.
+
+If an email is available from `uip login status`, include `--email "<EMAIL>"`. The CLI places it in the issue's Environment field, never in the description body.
 
 Parse the JSON output. On success, show the user a confirmation with any reference ID returned.
 

package/skills/{uipath-agents/references/coded/frameworks/coded-functions.md → uipath-functions/SKILL.md}

@@ -1,3 +1,9 @@
+---
+name: uipath-functions
+description: "UiPath Coded Functions — deterministic Python units built via `uip functions` (new/init/run/pack/publish); the `functions` map in `uipath.json`, `entry-points.json`, Pydantic Input/Output. Rule-based logic, data transforms, ERP/Integration Service connector calls — no LLM reasoning or agent loop. For LLM/agentic projects (LangGraph, LlamaIndex, OpenAI Agents, `agent.json`)→uipath-agents."
+allowed-tools: Bash, Read, Write, Edit, Glob, Grep, AskUserQuestion
+---
+
 # UiPath Python Coded Functions
 
 ## What Python Coded Functions Are
@@ -68,18 +74,15 @@ uip functions new <name> --language js       # JavaScript Function (JS/TS, no jo
 
 ### Step 2: Define Function Schema
 
-Schemas are Python `@dataclass` types (not Pydantic BaseModel):
+Use typed I/O. The SDK accepts pydantic `BaseModel`, `pydantic.dataclasses.dataclass`, a stdlib `@dataclass`, or a thin class with typed annotations. The shipped samples favor **pydantic** (`BaseModel` in csv-processor, `pydantic.dataclasses.dataclass` in calculator/greeter):
 
 ```python
-from dataclasses import dataclass, field
-from typing import Any
+from pydantic import BaseModel
 
-@dataclass
-class Input:
+class Input(BaseModel):
     document_id: str = ""
 
-@dataclass
-class Output:
+class Output(BaseModel):
     vendor_name: str = ""
     total_amount: float = 0.0
     error_type: str = ""     # populated on failure, empty on success
@@ -95,16 +98,14 @@ class Output:
 ```python
 from __future__ import annotations
 
-from dataclasses import dataclass
-from uipath.core.tracing import traced
+from pydantic import BaseModel
+from uipath.tracing import traced
 from uipath.platform import UiPath
 
-@dataclass
-class Input:
+class Input(BaseModel):
     document_id: str = ""
 
-@dataclass
-class Output:
+class Output(BaseModel):
     result: str = ""
     error_type: str = ""
     error_message: str = ""
@@ -132,8 +133,8 @@ def my_function(input: Input) -> Output:
 ```
 
 Key rules:
-- **`@dataclass`** for Input/Output — not `BaseModel`
-- **Sync function** — `def`, not `async def`; the function name is arbitrary
+- **Typed I/O** — pydantic `BaseModel`, `pydantic.dataclasses.dataclass`, stdlib `@dataclass`, or a thin class with typed annotations; samples favor pydantic
+- **`def` or `async def`** — both supported (csv-processor uses `async def main`); the function name is arbitrary
 - **Lazy SDK init** — instantiate `UiPath()` inside a getter, never at module level
 - **Errors returned, not raised** — populate `error_type`/`error_message` output fields and return; never let exceptions bubble out of the entrypoint
 - **`@traced(name=..., run_type="uipath")`** — apply to the entrypoint and any sub-functions you want visible in LLM Ops Traces
@@ -151,26 +152,24 @@ Key rules:
 
 The key is the entrypoint name — it can be any string and marks this as the callable entrypoint. The value is `"<file>:<function_name>"`. Both the key and the function name are arbitrary.
 
-### Step 5: Mark project type in `pyproject.toml`
+**This `functions` map is what identifies the project as a Coded Function** — the runtime's `determine_project_type()` reads the entrypoint type from `uipath.json`.
+
+### Step 5: Declare dependencies in `pyproject.toml`
 
 ```toml
 [project]
 name = "my-function"
 version = "0.1.0"
 description = "..."
-authors = [{ name = "..." }]
 requires-python = ">=3.11"
 dependencies = [
-    "uipath>=2.10",
+    "uipath",
     "httpx>=0.28",          # if making HTTP calls
     "pydantic-settings>=2", # if using Settings for env/asset config
 ]
-
-[tool.uipath]
-type = "function"           # required — identifies this as a Python Coded Function
 ```
 
-**`[tool.uipath] type = "function"` is required.** Without it the project is treated as a coded agent. No `[build-system]` section.
+No `[build-system]` section. The project is identified as a Coded Function by the `functions` map in `uipath.json` (Step 4).
 
 ### Step 6: Generate Entry Points
 
@@ -215,6 +214,20 @@ result = sdk().connections.invoke_activity(
 )
 ```
 
+### File attachment inputs
+
+To accept a runtime file, type an `Input` field as `Attachment` (pydantic model, not a dataclass):
+
+```python
+from pydantic import BaseModel
+from uipath.platform.attachments import Attachment
+
+class Input(BaseModel):
+    attachment: Attachment
+```
+
+`uip functions init` recognizes the `Attachment` type and emits `x-uipath-resource-kind: JobAttachment` in `entry-points.json` — the schema Studio Web and Orchestrator read to render a file picker for that field. Access fields snake_case: `attachment.full_name`, `attachment.content`.
+
 ### Step 8: Pack and Publish
 
 ```bash
@@ -232,7 +245,7 @@ uip functions push
 ## Important Notes
 
 - `UiPath()` must never be instantiated at module level — always inside a function body
-- `[tool.uipath] type = "function"` in `pyproject.toml` is required
+- The `functions` map in `uipath.json` marks the project as a Coded Function (`determine_project_type()` reads the entrypoint type from `uipath.json`)
 - `uip functions init` must run before `pack` or `push` — it generates `entry-points.json`
 - Python Functions have full job semantics: Orchestrator job ID, audit trail, retry, scheduling
 - JS Functions have no job semantics and cannot be started as Orchestrator jobs — use Python when the caller is Maestro, a Flow, or an agent

package/skills/uipath-governance/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: uipath-governance
-description: "UiPath governance via `uip gov` — author and deploy policies on two layers. AOps product policies (`uip gov aops-policy`): block/restrict/enforce features in Studio, StudioX, Assistant, Robot, AI Trust Layer, Agent Builder; deploy to user/group/tenant. Access ToolUsePolicy (`uip gov access-policy`): allow/deny when one workflow invokes another as a tool (Agent→Agent/Maestro/Flow/RPA/API/Case), gated by tag, caller, or actor (User/Group). Skill classifies product-layer vs resource/tool-use intent before authoring. For platform ops→uipath-platform."
+description: "UiPath governance via `uip gov` — author, deploy, and diagnose policies on three layers. AOps product policies (`uip gov aops-policy`): block/restrict/enforce features in Studio, StudioX, Assistant, Robot, AI Trust Layer, Agent Builder; deploy to user/group/tenant. Access ToolUsePolicy (`uip gov access-policy`): allow/deny when one workflow invokes another as a tool (Agent→Agent/Maestro/Flow/RPA/API/Case), gated by tag, caller, or actor (User/Group). Compliance Standards (ISO 42001): check posture and configure recommended settings across products in one operation. Operate: deploy/undeploy, query effective deployed policy. Diagnose: policy not taking effect, deployment precedence (user>group>tenant), blocked tool invocations. For platform ops→uipath-platform."
 allowed-tools: Bash, Read, Write, Edit, Grep, Glob
 ---
 
@@ -25,6 +25,20 @@ Activate on **any** governance / policy / rule intent — even when the user did
 - `allow only / permit only / limit to / restrict to` X
 - `who can / which … can / on behalf of` — actor- or identity-shaped governance
 - `compliance / posture / audit` framing on top of policies
+- `.uipolicy` file path, `compliance standard`, `apply standard`
+- Standard names: `ISO 42001`
+- `check compliance`, `compliance posture`, `posture against`, `drift check`
+- `is my tenant compliant`, `am I compliant with`
+- `organization-wide`, `all tenants`, `entire org`, `across all tenants` — org-scope full apply
+
+### Troubleshoot
+
+- Investigate why a governance policy isn't taking effect
+- Debug deployment precedence (user > group > tenant override)
+- Evaluate access-policy rules against test scenarios (`access-policy evaluate`)
+- Troubleshoot blocked tool/workflow invocations
+- Audit which policies are deployed and to whom
+- Identify license-type / product mismatch causing silent no-ops
 
 **Sibling redirects:**
 - Platform ops (auth, Orchestrator resources, packaging, deploy) → `uipath-platform`
@@ -36,21 +50,26 @@ Activate on **any** governance / policy / rule intent — even when the user did
 2. **Classification lives at the top.** Mechanic libraries assume the branch is chosen. Do not let those flows ask "did you mean the other branch?" — that question belongs here.
 3. **One branch per mutation.** A single user request produces a policy on one branch only. If the user wants both, run two sequential flows with two confirmation gates.
 4. **Each mechanic owns its own Critical Rules.** Once routed, follow the branch's rules — do not relax them from this top level.
-5. **Always `uip login` before any `uip gov …` command.** `evaluate` (Access) additionally requires tenant-scoped login — see [`access-policy-overview-guide.md` § Critical Rules](./references/access-policy/access-policy-overview-guide.md#critical-rules).
-6. **Never fabricate UUIDs.** Resolve every named user / group / process / agent / flow / robot / tenant via the relevant branch's lookups.
+5. **Never apply compliance settings without posture analysis + user confirmation.** Run posture analysis first, show the plan (summary + detail), require `y` before any settings are configured.
+6. **Always show a receipt after any apply.** Present the post-apply report (settings configured, manual steps needed, Applied by / date) so the user has a record. No local file write is needed — the CLI and UiPath platform are the source of truth.
+7. **Compliance Standards is a preview feature — gate every compliance-pack flow.** Append the preview disclaimer to user-facing compliance-standard responses, and on any `uip gov compliance-packs …` call returning **HTTP 403 / Forbidden**, stop immediately (do not retry, run no further compliance commands) and tell the user the feature requires enrolling in the preview program. Exact wording + placement in [`references/compliance-pack/preview-gate.md`](./references/compliance-pack/preview-gate.md). A **403** is preview-not-enabled; a **401** is a normal login failure — do NOT conflate them.
+8. **Always `uip login` before any `uip gov …` command.** `evaluate` (Access) additionally requires tenant-scoped login — see [`access-policy-overview-guide.md` § Critical Rules](./references/access-policy/access-policy-overview-guide.md#critical-rules).
+9. **Never fabricate UUIDs.** Resolve every named user / group / process / agent / flow / robot / tenant via the relevant branch's lookups.
 
 ## Workflow
 
-1. **Classify the intent.** Read [`references/disambiguation-guide.md`](./references/disambiguation-guide.md) — it lists the strong signals for each branch, the phrase patterns that need disambiguation, and the canonical worked example. If a strong signal matches, route silently. If the phrasing is ambiguous (matches both branches), ask the [disambiguation question](#disambiguation-question) and wait for a digit reply. If the user replies with anything other than `1` or `2`, treat it as a re-statement of intent and re-classify. **Do not run any CLI command before classification is settled** — the disambiguation question itself does not need `uip`, and an unrelated request (platform ops, agent authoring) must redirect to a sibling skill before any setup happens here.
-2. **Verify `uip` and login** *(only after classification routes to a governance branch).*
+1. **Classify the intent silently — never announce routing to the user.** Internal flow labels (AOps / Access / Compliance standard) are implementation details; the user sees only the outcome. Read [`references/disambiguation-guide.md`](./references/disambiguation-guide.md) — it lists the strong signals for each flow, the phrase patterns that need disambiguation, and the canonical worked example. If a strong signal matches, route silently. If the phrasing is ambiguous (matches AOps or Access), ask the [disambiguation question](#disambiguation-question) and wait for a digit reply. If the user replies with anything other than `1` or `2`, treat it as a re-statement of intent and re-classify. **Do not run any CLI command before classification is settled** — the disambiguation question itself does not need `uip`, and an unrelated request (platform ops, agent authoring) must redirect to a sibling skill before any setup happens here. If the request contains a standard name (`ISO 42001`), `apply standard`, `compliance posture`, `drift check`, `am I compliant`, `is my tenant compliant`, `what packs are available`, `what packs are configured`, `which standards are enabled`, `organization-wide`, or `disable standard` → route silently to the appropriate compliance standard plugin. Read `partial-apply/planning.md` for scoped requests; `coverage/impl.md` for posture checks; `catalog/impl.md` for discovery; `query/impl.md` for information queries; `full-apply/impl.md` after confirming the posture plan; `disable/impl.md` for removal; `catalog/impl.md` + `state list` for listing currently configured packs.
+2. **Verify `uip` and login** *(only after classification routes to a governance flow).*
    ```bash
    which uip && uip --version
    uip login status --output json
    ```
-   If not installed: `npm install -g @uipath/uipcli`. If not logged in: `uip login` (`--authority <URL>` for non-prod). For Access `evaluate`, login MUST be tenant-scoped.
+   If not installed: `npm install -g @uipath/cli`. If not logged in: `uip login` (`--authority <URL>` for non-prod). For Access `evaluate`, login MUST be tenant-scoped.
+   If logged in to the **wrong tenant** within the same org — use the fast path: `uip login tenant list --output json` then `uip login tenant set <NAME>`. Full re-login only needed for a different org or authority. See [`references/auth-context.md`](./references/auth-context.md) § Switching tenants.
 3. **Route to the chosen mechanic** and follow its flow end-to-end.
-   - Branch A → [`references/aops-policy/aops-policy-overview-guide.md`](./references/aops-policy/aops-policy-overview-guide.md)
-   - Branch B → [`references/access-policy/access-policy-overview-guide.md`](./references/access-policy/access-policy-overview-guide.md)
+   - AOps product policy → [`references/aops-policy/aops-policy-overview-guide.md`](./references/aops-policy/aops-policy-overview-guide.md)
+   - Access ToolUsePolicy → [`references/access-policy/access-policy-overview-guide.md`](./references/access-policy/access-policy-overview-guide.md)
+   - Compliance standard → use plugin routing from step 1 above (catalog / coverage / full-apply / partial-apply / disable / query)
 
 ## Disambiguation Question
 
@@ -79,6 +98,17 @@ The canonical ambiguous prompt is *"Block ChatGPT for my finance team using Stud
 | **Look up CLI flags / output shapes** (AOps) | [`references/aops-policy/aops-policy-commands.md`](./references/aops-policy/aops-policy-commands.md) |
 | **Look up CLI flags / output shapes** (Access) | [`references/access-policy/access-policy-commands.md`](./references/access-policy/access-policy-commands.md) |
 | **Resolve a name to a UUID for Access** | [`references/access-policy/resource-lookup-guide.md`](./references/access-policy/resource-lookup-guide.md) |
+| **Diagnose a governance failure (capability index)** | [`references/diagnose/CAPABILITY.md`](./references/diagnose/CAPABILITY.md) |
+| **Recognize a known governance failure pattern** | [`references/diagnose/references/failure-modes.md`](./references/diagnose/references/failure-modes.md) |
+| **Walk the diagnostic priority ladder** | [`references/diagnose/references/troubleshooting-guide.md`](./references/diagnose/references/troubleshooting-guide.md) |
+| **Discover available compliance standards** | [`references/compliance-pack/catalog/impl.md`](./references/compliance-pack/catalog/impl.md) |
+| **List which compliance standards are currently configured** | [`references/compliance-pack/catalog/impl.md`](./references/compliance-pack/catalog/impl.md) — use `state list tenant <id>` |
+| **Posture analysis** — what settings are configured vs recommended | [`references/compliance-pack/coverage/impl.md`](./references/compliance-pack/coverage/impl.md) |
+| **Apply full compliance pack** | Run coverage first, then [`references/compliance-pack/full-apply/impl.md`](./references/compliance-pack/full-apply/impl.md) |
+| **Apply specific controls / clauses** | [`references/compliance-pack/partial-apply/planning.md`](./references/compliance-pack/partial-apply/planning.md) |
+| **Remove compliance standard settings** | [`references/compliance-pack/disable/impl.md`](./references/compliance-pack/disable/impl.md) |
+| **Query — what does a clause / control recommend?** | [`references/compliance-pack/query/impl.md`](./references/compliance-pack/query/impl.md) |
+| **Preview disclaimer + 403 opt-in gate (all compliance flows)** | [`references/compliance-pack/preview-gate.md`](./references/compliance-pack/preview-gate.md) |
 
 ## Anti-patterns
 
@@ -87,3 +117,14 @@ The canonical ambiguous prompt is *"Block ChatGPT for my finance team using Stud
 - Do NOT merge AOps and Access intent into one policy. Different artifacts, different CLIs, different schemas.
 - Do NOT activate this skill for platform ops. Route to `uipath-platform`.
 - Do NOT propose skill edits when intent doesn't map to either branch. Ask the user to clarify.
+- Do NOT use `deployed-policy list` for gap detection — it returns all rules in priority order, not the merged effective value. Use `deployed-policy get <licenseType> <productName> <tenantId>` to get the single effective merged policy.
+- Do NOT skip the post-apply report even if apply partially fails — show what succeeded and what needs manual attention.
+- For compliance pack posture analysis, use `uip gov compliance-packs state coverage` — do NOT use `aops-policy deployed-policy` commands; those are for AOps policy debugging (Branch A), not compliance pack flows.
+- For full pack configuration, use `state enable` — do NOT manually call `aops-policy create` for each product; that path is only for partial/scoped configuration.
+- For partial/scoped configuration (specific clauses, products, or areas only), use `synthesize-formdata.mjs` + `aops-policy create` — do NOT call `state enable`; `state enable` applies the FULL standard and cannot be scoped to specific clauses or products.
+- For org-wide apply, do NOT call `state enable organization` — the backend does not implement org-scope enable. Instead: list tenants with `uip login tenant list`, then call `state enable tenant <id>` for each tenant individually. See [`references/compliance-pack/full-apply/impl.md`](./references/compliance-pack/full-apply/impl.md) § Org-scope deployment.
+- NEVER claim a tenant is "compliant" with a standard — only that recommended settings are configured. Compliance status is determined by the customer's auditor.
+- Do NOT surface policy names, product identifiers (AITrustLayer, Robot, Development), or clause IDs (A.6.2.8) as the main response unit — lead with plain-English control names and clause descriptions. Policy is an internal implementation detail. Clause IDs appear only as secondary reference in parentheses.
+- Do NOT use the word "controls" in user-facing output — use "settings". The UiPath UI uses "settings" for what the standard recommends be configured.
+- Do NOT narrate internal steps to the user. Never say "I ran…", "The CLI returned…", "Calling the governance CLI…", or "The API responded with…". Run commands silently and present only the interpreted result using the output templates in the reference docs. Raw JSON, UUIDs, error stacks, and CLI output are never shown — summarise errors in plain English.
+- Do NOT dump raw command output. Parse every CLI response and render it as a formatted table or plain-English summary. The user sees the outcome, never the mechanism.