@uipath/skills 1.196.0 → 1.197.0

package/skills/uipath-governance/references/aops-policy/aops-policy-commands.md

@@ -150,19 +150,19 @@ List license types available to the organization. Required for tenant deployment
 uip gov aops-policy license-type list --output json
 ```
 
-**Output:** `Data` is an array. Each entry has `identifier` (GUID) and `name` (e.g. `Attended`, `Unattended`).
+**Output:** `Data` is an array. Each entry has `name` (e.g. `Attended`, `Unattended`), `label`, and `licenseTypeProducts[]` (the products the license includes). There is **no** GUID `identifier` field — the license type's `name` is its identifier.
 
 Sample rendering:
 
 ```text
 Available license types:
-  1. Attended        (identifier: a1b2c3d4-0000-0000-0000-0000000000A1)
-  2. Unattended      (identifier: a1b2c3d4-0000-0000-0000-0000000000A2)
+  1. Attended      (products: Assistant, Robot)
+  2. Unattended    (products: Robot)
 ```
 
-> **Two different identifiers — do not confuse them:**
-> - For `deployment tenant configure` entries, the JSON `licenseTypeIdentifier` field takes the license type's **`identifier` (GUID)** from `license-type list`.
-> - For `deployed-policy get` / `deployed-policy list`, the positional `<license-type>` argument takes the license type's **`name`** (e.g. `Attended`).
+> **The license-type `name` is the identifier in both places — neither takes a GUID:**
+> - For `deployment tenant configure` entries, the JSON `licenseTypeIdentifier` field takes the license type's **`name`** (e.g. `Attended`, `E2E`) from `license-type list`.
+> - For `deployed-policy get` / `deployed-policy list`, the positional `<license-type>` argument takes the same **`name`**.
 
 ---
 
@@ -231,10 +231,10 @@ The `--input` payload is an array of per-product assignments. Semantics are the
 |---------|------------|
 | `user`  | `[{ "productIdentifier": "<PRODUCT_NAME>", "policyIdentifier": "<POLICY_GUID>\|null" }, ...]` |
 | `group` | `[{ "productIdentifier": "<PRODUCT_NAME>", "policyIdentifier": "<POLICY_GUID>\|null" }, ...]` |
-| `tenant` | `[{ "productIdentifier": "<PRODUCT_NAME>", "licenseTypeIdentifier": "<LICENSE_TYPE_GUID>", "policyIdentifier": "<POLICY_GUID>\|null" }, ...]` |
+| `tenant` | `[{ "productIdentifier": "<PRODUCT_NAME>", "licenseTypeIdentifier": "<LICENSE_TYPE_NAME>", "policyIdentifier": "<POLICY_GUID>\|null" }, ...]` |
 
 - `productIdentifier` — product `name` (not label). See [product list](#uip-gov-aops-policy-product-list).
-- `licenseTypeIdentifier` (tenant only) — license type **`identifier` (GUID)** from `license-type list`, not the `name` and not the label. See [license-type list](#uip-gov-aops-policy-license-type-list).
+- `licenseTypeIdentifier` (tenant only) — license type **`name`** (e.g. `Attended`, `E2E`) from `license-type list`, not the label. The live CLI exposes no GUID for license types. See [license-type list](#uip-gov-aops-policy-license-type-list).
 - `policyIdentifier`:
   - a GUID → assign that policy for this product (and license type, for tenants)
   - `null` → **No Policy** (explicitly overrides any inherited policy)
@@ -257,7 +257,7 @@ Optional: `--limit <N>` (default 20), `--offset <N>` (zero-based page index, def
 **Output:** `Data` is `{ totalCount: <N>, result: [ ... ] }`. Iterate `Data.result[]`.
 - User entries: `identifier`, `name`, `email`, `source` (identity-provider source — e.g. `cloud`, `local`, `aad`), `lastModified`, `isActive`. This is **not** a full IdP roster; it includes only users the governance service has already seen.
 - Group entries: `identifier`, `name`, `source`, `lastModified`, `isActive`. Typically only groups that have at least one policy override are returned.
-- Tenant entries: `identifier`, `name`, `url`, `status`, and `tenantPolicies[]`. Each policy entry carries `productIdentifier`, `licenseTypeIdentifier` (GUID), and `policyIdentifier`.
+- Tenant entries: `identifier`, `name`, `url`, `status`, and `tenantPolicies[]`. Each policy entry carries `productIdentifier`, `licenseTypeIdentifier` (the license-type `name`, e.g. `E2E`, `NoLicense` — not a GUID), and `policyIdentifier`.
 
 ### deployment {user|group|tenant} get
 
@@ -451,7 +451,7 @@ All `uip` commands support:
 | `401 Unauthorized` | User token expired or missing | Run `uip login` (or re-export `UIP_S2S_TOKEN` for S2S modes) and retry |
 | `command not found: uip` | UiPath CLI not installed | `npm install -g @uipath/uipcli` |
 | `unknown productIdentifier` | Used the product label instead of the `name` | Re-fetch via [product list](#uip-gov-aops-policy-product-list) and pass the `name` field |
-| `unknown licenseTypeIdentifier` | Used the license type `name` or label instead of its `identifier` (GUID) in a tenant assignment | Re-fetch via [license-type list](#uip-gov-aops-policy-license-type-list) and copy the `identifier` field |
+| `unknown licenseTypeIdentifier` | Used the license type label instead of its `name` in a tenant assignment | Re-fetch via [license-type list](#uip-gov-aops-policy-license-type-list) and copy the `name` field |
 | `unknown policyIdentifier` (GUID) | Stale or wrong GUID | Re-run `list` and copy the `identifier` from the result |
 | `missing licenseTypeIdentifier in tenant entries` | Tenant assignment entry omitted `licenseTypeIdentifier` | Add it to every tenant-subject entry (required key) |
 | `deployed-policy list rejects --s2s-token` | `list` mode does not accept S2S tokens | Remove `--s2s-token`; re-run under `uip login` |

package/skills/uipath-governance/references/aops-policy/aops-policy-deploy-guide.md

@@ -23,12 +23,12 @@ Assign policies to a user, group, or tenant by writing a JSON assignment file an
 |---------|------------|
 | user   | `[{ "productIdentifier": "<PRODUCT_NAME>", "policyIdentifier": "<POLICY_GUID>\|null" }, ...]` |
 | group  | `[{ "productIdentifier": "<PRODUCT_NAME>", "policyIdentifier": "<POLICY_GUID>\|null" }, ...]` |
-| tenant | `[{ "productIdentifier": "<PRODUCT_NAME>", "licenseTypeIdentifier": "<LICENSE_TYPE_GUID>", "policyIdentifier": "<POLICY_GUID>\|null" }, ...]` |
+| tenant | `[{ "productIdentifier": "<PRODUCT_NAME>", "licenseTypeIdentifier": "<LICENSE_TYPE_NAME>", "policyIdentifier": "<POLICY_GUID>\|null" }, ...]` |
 
 Semantics:
 
 - `productIdentifier` — product `name` (not label). See [aops-policy-commands.md — product list](./aops-policy-commands.md#uip-gov-aops-policy-product-list).
-- `licenseTypeIdentifier` (tenant only) — license type **`identifier` (GUID)** from `license-type list`, not the `name` and not the label. See [aops-policy-commands.md — license-type list](./aops-policy-commands.md#uip-gov-aops-policy-license-type-list).
+- `licenseTypeIdentifier` (tenant only) — license type **`name`** (e.g. `Attended`, `E2E`) from `license-type list`, not the label. The live CLI exposes no GUID for license types — the `name` is the identifier. See [aops-policy-commands.md — license-type list](./aops-policy-commands.md#uip-gov-aops-policy-license-type-list).
 - `policyIdentifier`:
   - a policy GUID → assign that policy to this product (and license type, for tenants)
   - `null` → **No Policy** explicitly (overrides any inherited policy)
@@ -249,7 +249,7 @@ uip gov aops-policy deployment group get "$GROUP_ID" --output json
 
 Tenant deployments are keyed by `(product, license type)`. List license types via `uip gov aops-policy license-type list --output json` — see [aops-policy-commands.md — license-type list](./aops-policy-commands.md#uip-gov-aops-policy-license-type-list) for the full output shape and sample rendering.
 
-> **Use the license type's `identifier` (GUID) — not its `name`, not its label — as `licenseTypeIdentifier` in tenant assignment entries.** The `name` is only accepted by `deployed-policy get` / `deployed-policy list` as the positional `<license-type>` argument.
+> **Use the license type's `name` (e.g. `Attended`, `E2E`) — not its label — as `licenseTypeIdentifier` in tenant assignment entries.** `license-type list` exposes no GUID. The same `name` is also the positional `<license-type>` argument for `deployed-policy get` / `deployed-policy list`.
 
 ### Step 2 — Identify the tenant
 
@@ -273,13 +273,13 @@ Parse `Data.result[]` (output shape in [aops-policy-commands.md — deployment l
 ```bash
 cat > "$SESSION_DIR/tenant-policies.json" <<'EOF'
 [
-  { "productIdentifier": "AITrustLayer", "licenseTypeIdentifier": "<NOLICENSE_GUID>",    "policyIdentifier": "<POLICY_GUID>" },
-  { "productIdentifier": "Development",  "licenseTypeIdentifier": "<DEVELOPMENT_GUID>",  "policyIdentifier": null }
+  { "productIdentifier": "AITrustLayer", "licenseTypeIdentifier": "NoLicense",   "policyIdentifier": "<POLICY_GUID>" },
+  { "productIdentifier": "Development",  "licenseTypeIdentifier": "Development", "policyIdentifier": null }
 ]
 EOF
 ```
 
-> `licenseTypeIdentifier` is the GUID from `license-type list` (`Data[].identifier`), NOT the license-type `name`. Resolve each license type's GUID from Step 1 before writing the file.
+> `licenseTypeIdentifier` is the license-type `name` (`Data[].name`) from `license-type list`, NOT a GUID and NOT the label. The live CLI exposes no GUID for license types. Resolve each license type's `name` from Step 1 before writing the file.
 
 ### Step 5 — Final review before configure (single confirmation gate)
 
@@ -352,7 +352,7 @@ Confirmation prompt (verbatim): `Remove <PRODUCT_LABEL> assignment from <TENANT_
 |-------|-------|-----|
 | `401 Unauthorized` | User token expired or missing | `uip login` and retry — see [aops-policy-commands.md — Authentication](./aops-policy-commands.md#authentication) |
 | `unknown productIdentifier` | Used the product label instead of its `name` | Re-run `uip gov aops-policy product list --output json` and pass the `name` field |
-| `unknown licenseTypeIdentifier` | Used the license `name` or label instead of its `identifier` (GUID) | Re-run `uip gov aops-policy license-type list --output json` and copy the `identifier` field (GUID) |
+| `unknown licenseTypeIdentifier` | Used the license type's label instead of its `name` | Re-run `uip gov aops-policy license-type list --output json` and copy the `name` field |
 | `unknown policyIdentifier` (GUID) | Stale or wrong policy GUID | Re-run `uip gov aops-policy list --product-name "<PRODUCT_NAME>" --output json` and copy the `identifier` |
 | `missing licenseTypeIdentifier in tenant entries` | Tenant entry omitted `licenseTypeIdentifier` | Add it to every tenant-subject entry (required key) |
 | `configure rejects the JSON` | Any of the above + malformed array | Validate with `jq type` and `jq '.[0] | keys'` before resubmitting |

package/skills/uipath-governance/references/auth-context.md

@@ -0,0 +1,101 @@
+# Auth Context — `~/.uipath/.auth`
+
+Every capability in this skill reads tenant, org, and token identifiers from the `uip` CLI auth file. This is the canonical source — never decode JWTs or ask the user when the file is available.
+
+## File location
+
+- Linux / macOS: `~/.uipath/.auth`
+- Windows: `C:\Users\<user>\.uipath\.auth`
+
+## Format
+
+`KEY=VALUE` per line (env-style, **NOT** JSON). Written by `uip login`, kept current by the CLI.
+
+## Read recipe
+
+```bash
+AUTH_FILE="$HOME/.uipath/.auth"
+UIPATH_URL=$(grep               '^UIPATH_URL='                "$AUTH_FILE" | cut -d'=' -f2-)
+UIPATH_ORGANIZATION_NAME=$(grep '^UIPATH_ORGANIZATION_NAME='  "$AUTH_FILE" | cut -d'=' -f2-)
+UIPATH_ORGANIZATION_ID=$(grep   '^UIPATH_ORGANIZATION_ID='    "$AUTH_FILE" | cut -d'=' -f2-)
+UIPATH_TENANT_NAME=$(grep       '^UIPATH_TENANT_NAME='        "$AUTH_FILE" | cut -d'=' -f2-)
+UIPATH_TENANT_ID=$(grep         '^UIPATH_TENANT_ID='          "$AUTH_FILE" | cut -d'=' -f2-)
+UIPATH_ACCESS_TOKEN=$(grep      '^UIPATH_ACCESS_TOKEN='       "$AUTH_FILE" | cut -d'=' -f2-)
+```
+
+## Available fields
+
+| Key | Example | Used by |
+|---|---|---|
+| `UIPATH_URL` | `https://alpha.uipath.com` | principals-lookup (URL construction) |
+| `UIPATH_ORGANIZATION_NAME` | `procodeapps` | principals-lookup (URL path segment) |
+| `UIPATH_ORGANIZATION_ID` | `3aa10965-a82d-4d9e-8366-0eff8e87bf7a` | principals-lookup (Directory Search GUID) |
+| `UIPATH_TENANT_NAME` | `DefaultTenant` | display / audit records |
+| `UIPATH_TENANT_ID` | `edb2c1a2-246e-4cd3-a5f1-08aea1cbecec` | `deployment tenant configure/get` target, diagnosis tenant fetch |
+| `UIPATH_ACCESS_TOKEN` | `eyJ...` (JWT) | Raw API calls (principals lookup, until CLI wraps it) |
+| `UIPATH_REFRESH_TOKEN` | `...` | Do not use — CLI manages refresh |
+
+## Preflight check
+
+Before any capability runs, verify:
+
+1. `uip login status --output json` returns `Data.Status == "Logged in"`.
+2. `~/.uipath/.auth` exists and `UIPATH_TENANT_ID` is non-empty.
+
+If either fails, halt and ask the user to run `uip login` (or `uip login --authority https://alpha.uipath.com` for non-prod).
+
+## Tenant-intent validation (Apply / Advise / Diagnose)
+
+When the user's prompt names a specific tenant (e.g., *"on staging tenant"*, *"in production"*, *"apply to the prod tenant"*), compare their named tenant against `UIPATH_TENANT_NAME` and `UIPATH_URL` **before** taking any mutation action.
+
+Detection: match the named tenant against these substrings — `staging`, `prod`, `production`, `alpha`, `dev`, `development`, `sandbox`, `qa`, `test`, or any explicit tenant display name the user gives (e.g., *"MedCore-Prod"*).
+
+On mismatch, halt with:
+
+```
+⚠ Your prompt says 'staging tenant' but you are logged into 'DefaultTenant' on
+  https://cloud.uipath.com (organization: procodeapps).
+
+  To switch to the tenant you named:
+
+  If the tenant is in the same org — faster, no browser needed:
+    uip login tenant list --output json         # see available tenants
+    uip login tenant set <TENANT_NAME>          # switch to the right one
+
+  If you need a different org or authority:
+    uip login                                   # interactive (cloud.uipath.com)
+    uip login --authority https://alpha.uipath.com  # non-prod alpha
+
+  Or, if this IS the tenant you meant, reply 'yes, continue on <currentTenantName>'.
+```
+
+Accept a literal yes-with-tenant-name to proceed; anything else halts with no side effects. This prevents the most expensive category of mistakes — applying a pack or a policy update to the wrong tenant.
+
+**Diagnose and Check are read-only** and still perform this validation. Read-only operations against the wrong tenant waste time and pollute caches with mismatched state; better to catch it upfront.
+
+## Switching tenants
+
+When the user is logged in to the right **org** but needs a different **tenant** within that org:
+
+```bash
+# 1. List available tenants in the current org
+uip login tenant list --output json
+# → returns Data[].TenantName
+
+# 2. Switch to the target tenant (no browser auth needed)
+uip login tenant set <TENANT_NAME> --output json
+
+# 3. Verify
+uip login status --output json
+# → Data.Tenant should now show the new tenant
+```
+
+When the user needs a different **org** or **authority** (e.g. alpha vs cloud.uipath.com):
+
+```bash
+# Full re-login — browser OAuth flow
+uip login                                       # cloud.uipath.com (default)
+uip login --authority https://alpha.uipath.com  # non-prod alpha
+```
+
+**Show this to the user** when the mismatch block fires — the tenant set path is much faster than a full re-login when they're already in the right org.

package/skills/uipath-governance/references/cli-cheatsheet.md

@@ -0,0 +1,207 @@
+# CLI Cheat Sheet
+
+Every command accepts `--output json`. Parse the structured response:
+
+```json
+// Success
+{ "Result": "Success", "Code": "<OperationCode>", "Data": { ... } }
+
+// Failure — newer CLI: server-side validation message surfaces in Message
+{ "Result": "Failure", "Message": "...", "Instructions": "..." }
+```
+
+## Session + Auth Context
+
+```bash
+uip login status --output json                 # Data.Status == "Logged in"
+uip login                                      # interactive OAuth
+uip login --authority https://alpha.uipath.com # non-prod
+```
+
+See [auth-context.md](auth-context.md) for reading `~/.uipath/.auth` (the canonical source for `UIPATH_TENANT_ID`, `UIPATH_TENANT_NAME`, `UIPATH_ORGANIZATION_ID`, `UIPATH_ACCESS_TOKEN`).
+
+## Products
+
+```bash
+uip gov aops-policy product list --output json
+uip gov aops-policy product get <productIdentifier> --output json
+```
+
+## License Types
+
+```bash
+uip gov aops-policy license-type list --output json
+```
+
+Returns all license types (`Attended`, `Unattended`, `Development`, `StudioPro`, `StudioX`, `NoLicense`, …) with the products each license type covers. Needed to build `deployment * configure --input` JSON.
+
+## Templates (form-data blueprints + locale labels)
+
+```bash
+# Raw template (structure + i18n component tree)
+uip gov aops-policy template get <productIdentifier> --output json
+
+# FILLABLE blueprint — the object you edit and submit to policy create/update
+uip gov aops-policy template get <productIdentifier> \
+  --output-form-data ./form-data.json --output json
+
+# LOCALE-RESOLVED reference — field-by-field labels, descriptions, tooltips for the product
+uip gov aops-policy template get <productIdentifier> \
+  --output-template-locale-resource ./locale-resource.json --output json
+
+# Bulk — write all three JSON files per product under the output dir
+uip gov aops-policy template list --output-dir ./templates/ --output json
+```
+
+The locale-resource is the runtime equivalent of the static `property-labels.json` snapshot. Fetch it dynamically when labels matter and the snapshot is stale.
+
+## Policy CRUD
+
+```bash
+# CREATE — --input holds the bare formData object (CLI wraps in { data: … } internally)
+uip gov aops-policy create \
+  --name <policyName> \
+  --product-name <productIdentifier> \
+  --input <path> \
+  --description <text> --priority <n> --availability <n> \
+  --output json
+# Response: Data.identifier = the new policy GUID
+
+# LIST — --order-direction now maps correctly (was producing 400s before)
+uip gov aops-policy list [--product-name X] [--search Q] [--limit N] [--offset M] \
+  [--order-by <field>] [--order-direction asc|desc] --output json
+
+# GET — returns metadata + full form-data payload in one call
+# (CLI fetches policyGetPolicyById + policyGetFormDataByPolicyId in parallel and merges into Data.data)
+uip gov aops-policy get <policyIdentifier> --output json
+# Response shape: { Data: { name, identifier, description, priority, availability, product, data: {...} } }
+
+# UPDATE — ALL metadata flags required, see cli-known-issues.md #2
+uip gov aops-policy update \
+  --identifier <guid> \
+  --name <policyName> \
+  --product-name <productIdentifier> \
+  --description <text> --priority <n> --availability <n> \
+  --input <path> \
+  --output json
+
+# DELETE
+uip gov aops-policy delete <policyIdentifier> --output json
+```
+
+> **`policy get` is the single read path.** It combines `policyGetPolicyById` (metadata) with `policyGetFormDataByPolicyId` (values) into one response. The `data` field is always populated — no separate `form-data` command needed.
+
+### `--input` format
+
+Bare `formData` object, NOT wrapped in `{ "data": ... }`. The CLI adds the wrapper internally.
+
+## Deployment (tenant / group / user)
+
+> **All `deployment * configure` commands are FULL REPLACE.** The submitted array rewrites the target's assignment list. Always read current state first, merge new entries in, then configure. See [policy-assign.md](policy-assign.md) for the merge-first pattern.
+>
+> **Why this matters:** the previous `assign-tenant` / `assign-group` / `assign-user` commands had a "last deploy wins" bug — sequential single-policy calls each did a full-replace at the API. The new `configure` commands fix this by taking the full assignment list in one atomic call.
+
+### Tenant
+
+```bash
+# List tenants (paginated)
+uip gov aops-policy deployment tenant list [--product-name <p>] [--limit N --offset M] --output json
+
+# Get a specific tenant + all its assignments
+uip gov aops-policy deployment tenant get <tenantIdentifier> --output json
+
+# Configure — atomic: one call assigns ALL policies for a tenant
+uip gov aops-policy deployment tenant configure <tenantIdentifier> \
+  --tenant-name <name> \
+  --input <path-to-assignment-array.json> \
+  --output json
+
+# Remove a single assignment by (tenant, product, licenseType)
+uip gov aops-policy deployment tenant remove <tenantIdentifier> ...
+```
+
+`--input` JSON shape — pure array:
+```json
+[
+  { "productIdentifier": "AITrustLayer", "licenseTypeIdentifier": "NoLicense", "policyIdentifier": "<guid>" },
+  { "productIdentifier": "Robot",        "licenseTypeIdentifier": "Attended",  "policyIdentifier": "<guid>" },
+  { "productIdentifier": "Development",  "licenseTypeIdentifier": "Development","policyIdentifier": null    }
+]
+```
+- `policyIdentifier` = `null` → pin 'No Policy' (block inheritance).
+- Omit a `(product, licenseType)` slot → falls through to inheritance.
+
+### Group
+
+```bash
+uip gov aops-policy deployment group list --output json
+uip gov aops-policy deployment group get <groupIdentifier> --output json
+uip gov aops-policy deployment group configure <groupIdentifier> \
+  --group <name> [--source <local|aad|cloud>] --input <path> --output json
+uip gov aops-policy deployment group delete ...
+```
+
+### User
+
+```bash
+uip gov aops-policy deployment user list --output json
+uip gov aops-policy deployment user get <userIdentifier> --output json
+uip gov aops-policy deployment user configure <userIdentifier> \
+  --user <name> [--source <local|aad|cloud>] --input <path> --output json
+uip gov aops-policy deployment user delete ...
+```
+
+## Deployed Policy (effective-policy resolution)
+
+Resolves the policy actually enforced at request time through `USER → GROUP → TENANT → GLOBAL` inheritance. Args are **positional**.
+
+```bash
+# Caller's own effective policy — no extra flags (runs under the user token from `uip login`)
+uip gov aops-policy deployed-policy get <licenseType> <productName> <tenantIdentifier> --output json
+
+# List effective policies for a subject across products
+uip gov aops-policy deployed-policy list --tenant-identifier <tenantGuid> --output json
+```
+
+This skill uses only the default caller-own mode. The `--tenant-only` and `--user-id` modes require an S2S token and are intentionally out of scope — the authenticated admin typically has no user-level overrides, so the caller-own result matches tenant-scope semantics for the CHECK workflow.
+
+## Error codes we react to
+
+| HTTP | Meaning | Orchestrator response |
+|---|---|---|
+| `400` | Validation error. Newer CLI surfaces the real backend message via `extractErrorMessage`. | Halt. Read `Message` — usually names the offending field. |
+| `401 / 403` | Session expired or insufficient perms. | Halt. Ask user to `uip login`. |
+| `404` | Identifier not found. | Halt. Check IDs. (Missing `--input` paths now surface a clear filesystem error, not 404.) |
+| `409` | Duplicate policy name on create. | Halt. V1 = do NOT retry-as-update. (Critical Rule in SKILL.md) |
+| `500` | Often [missing metadata flags on update (known-issue #2)](cli-known-issues.md). | Halt. Re-read policy metadata, pass all flags. |
+| `503` with transient `Instructions` text (`template upgrade`, `connection timeout`, `backend temporarily unavailable`) | AOPS is migrating the policy's Form.io template or a dependency is flapping — typically tens of seconds to minutes. | Do NOT use the default 3s retry. Wait 30s before first retry, 60s before second. Or surface to user and offer `retry now` / `cancel`. Only halt after a third failure or if the `Instructions` text shifts to a non-transient error. See [policy-crud.md UPDATE error map](policy-crud.md#update-recipe). |
+| `5xx` other | Server-side. | Retry once after 3s. Halt on second failure. Surface `Instructions` verbatim. |
+
+All halts write a deploy record (Apply) or patch record (Diagnose).
+
+## Compliance Packs
+
+```bash
+# Catalog (read-only — no scope needed beyond login)
+uip gov compliance-packs catalog list --output json
+uip gov compliance-packs catalog get <packId> --output json
+
+# State (tenant-scoped; Policy:Read for coverage/get/list; Policy:Write for enable/disable)
+TENANT_ID=$(grep '^UIPATH_TENANT_ID=' ~/.uipath/.auth | cut -d'=' -f2-)
+ORG_ID=$(grep '^UIPATH_ORGANIZATION_ID=' ~/.uipath/.auth | cut -d'=' -f2-)
+
+# Tenant scope
+uip gov compliance-packs state coverage tenant $TENANT_ID <packId> --output json
+uip gov compliance-packs state enable  tenant $TENANT_ID <packId> --output json
+uip gov compliance-packs state disable tenant $TENANT_ID <packId> --output json
+uip gov compliance-packs state get    tenant $TENANT_ID <packId> --output json
+uip gov compliance-packs state list   tenant $TENANT_ID          --output json
+
+# Organization scope (all tenants)
+uip gov compliance-packs state coverage organization $ORG_ID <packId> --output json
+uip gov compliance-packs state enable  organization $ORG_ID <packId> --output json
+uip gov compliance-packs state list   organization $ORG_ID          --output json
+```
+
+`state coverage` does NOT require the pack to be enabled first — it reads live tenant state fresh every call.
+All state commands use positional args `<scopeLevel> <scopeTargetId>`. There is no `--tenant-id` flag.

package/skills/uipath-governance/references/compliance-pack/catalog/impl.md

@@ -0,0 +1,79 @@
+# Catalog — Pack Discovery and Detail
+
+**Preview gate:** Compliance Standards is a preview feature. Append the disclaimer to user-facing output; on any compliance-packs **403**, stop (org not enrolled). See [preview-gate.md](../preview-gate.md).
+
+## Discover available packs
+
+```bash
+uip gov compliance-packs catalog list --output json
+```
+
+Parse `Data.packs[]`. Present each pack:
+- `packName` / `packLongName`
+- `packVersion`
+- `summary.clauseCount`, `summary.controlCount`, `summary.deploymentPolicyCount`
+
+## Get full pack detail
+
+```bash
+# Create a unique session dir and persist the path to disk so it survives between tool calls.
+# Every downstream plugin reads this file to find the shared session dir.
+SESSION_TEMP=$(mktemp -d)
+echo "$SESSION_TEMP" > "$HOME/.uipath-compliance-current-session"
+uip gov compliance-packs catalog get <packId> --output json > "$SESSION_TEMP/catalog.json"
+```
+
+```powershell
+# Windows PowerShell — env vars don't persist between tool calls; write the path to a file instead.
+$tmpDir = Join-Path $env:TEMP ('compliance-' + [guid]::NewGuid().ToString('N').Substring(0,8))
+New-Item -ItemType Directory -Force $tmpDir | Out-Null
+$tmpDir | Set-Content "$env:TEMP\uipath-compliance-current-session.txt" -NoNewline
+uip gov compliance-packs catalog get <packId> --output json | Set-Content "$tmpDir\catalog.json"
+```
+
+Save to `$SESSION_TEMP/catalog.json` (Bash) or `$tmpDir\catalog.json` (Windows). This file feeds all downstream plugins. Always run this step **before** `state coverage`, `partial-apply`, or `query` — those plugins resolve the session dir from the sentinel file.
+
+Key fields in `Data`:
+
+CLI output is **PascalCase**. Field names below are exactly as returned by `catalog get`.
+
+| Field | Used by |
+|---|---|
+| `Data.PackId` | All state commands |
+| `Data.DeploymentPolicies[].ProductIdentifier` | Coverage + apply: which products are covered |
+| `Data.DeploymentPolicies[].ProductDisplayName` | User-facing product name |
+| `Data.Clauses[].ClauseId` | Partial apply: clause filtering |
+| `Data.Clauses[].ClauseName` | User-facing clause name |
+| `Data.Clauses[].EditorialPolicies[].ProductIdentifier` | Maps clause to product |
+| `Data.Clauses[].EditorialPolicies[].Controls[].DisplayName` | NLP matching + query display |
+| `Data.Clauses[].EditorialPolicies[].Controls[].Impact` | `"High"` / `"Medium"` / `"Low"` |
+| `Data.Clauses[].EditorialPolicies[].Controls[].RecommendedSetting` | What value will be configured |
+| `Data.Clauses[].EditorialPolicies[].Controls[].ConfigLocation` | Where to find it in the UI |
+| `Data.Clauses[].EditorialPolicies[].Contributions[].Key` | formData property key (dotted path) |
+| `Data.Clauses[].EditorialPolicies[].Contributions[].Required` | Operator → synthesize-formdata.mjs |
+
+## List currently configured standards
+
+```bash
+TENANT_ID=$(grep '^UIPATH_TENANT_ID=' ~/.uipath/.auth | cut -d'=' -f2-)
+uip gov compliance-packs state list tenant $TENANT_ID --output json
+```
+
+Parse `Data[]` — each entry has `packId`, `packVersion`, `active` (bool), `lastToggledAt`. Present active packs to the user:
+
+```
+Compliance standards configured on <tenantName>:
+
+  ISO 42001 (iso-42001-2023 v3.0.0) — Active since <lastToggledAt>
+
+No other compliance standards are currently active.
+```
+
+If the array is empty: "No compliance standards are currently configured on this tenant."
+
+## Pack ID lookup
+
+| User says | packId |
+|---|---|
+| "ISO 42001" / "ISO/IEC 42001" / "AI Management System" | `iso-42001-2023` |
+| Any other standard | ISO 42001 is the only available standard at this time. Inform the user and offer to proceed with ISO 42001. |

package/skills/uipath-governance/references/compliance-pack/coverage/impl.md

@@ -0,0 +1,141 @@
+# Coverage — Posture Analysis
+
+**Preview gate:** Compliance Standards is a preview feature. Append the disclaimer to user-facing output; on any compliance-packs **403**, stop (org not enrolled). See [preview-gate.md](../preview-gate.md).
+
+Compares the compliance standard's recommended settings against what is currently deployed on the tenant. Does NOT require the standard to be enabled first. Does NOT certify compliance — it identifies which settings from the standard are not yet configured.
+
+## Command
+
+**Pre-condition:** `$SESSION_TEMP/catalog.json` must exist — run `catalog get` first (see `catalog/impl.md`). Coverage joins with catalog data to display meaningful setting names.
+
+```bash
+# Read the session dir written by catalog get — never create a new one here.
+SESSION_TEMP=$(cat "$HOME/.uipath-compliance-current-session")
+TENANT_ID=$(grep '^UIPATH_TENANT_ID=' ~/.uipath/.auth | cut -d'=' -f2-)
+uip gov compliance-packs state coverage tenant $TENANT_ID <packId> --output json \
+  > "$SESSION_TEMP/coverage.json"
+```
+
+```powershell
+# Windows PowerShell
+$tmpDir = (Get-Content "$env:TEMP\uipath-compliance-current-session.txt" -Raw).Trim()
+$tenantId = (Select-String '^UIPATH_TENANT_ID=(.+)' "$env:USERPROFILE\.uipath\.auth").Matches[0].Groups[1].Value
+uip gov compliance-packs state coverage tenant $tenantId <packId> --output json |
+  Set-Content "$tmpDir\coverage.json"
+```
+
+## Parse the response
+
+CLI output is **PascalCase**. Field names below are exactly as returned by `state coverage`.
+
+`Data.DeploymentPolicies[].Status`:
+- `"new"` — this product's settings are not yet configured; `state enable` will configure them — display as **Not Applied** to the user
+- `"in-place"` — settings already deployed; no change needed — display as **Applied** to the user
+
+`Data.Clauses[].Status`:
+- `"needs-policies"` — at least one contributing policy is `"new"` — display as **Needs Manual Configuration** to the user
+- `"in-place"` — all contributing policies already deployed — display as **Applied** to the user
+
+`Data.Summary.NewCount` — if 0, all recommended settings are already configured.
+
+## Posture plan presentation
+
+Join coverage API data with catalog data to resolve setting names and clause names:
+- `coverage.Data.DeploymentPolicies[].Status` — `"new"` or `"in-place"` per product
+- `catalog.Data.Clauses[].EditorialPolicies[].ProductIdentifier` — maps settings to products
+- Setting is Applied (✓) if its product's `Status == "in-place"`
+- Setting is Not Applied (✗) if its product's `Status == "new"`
+
+Progress bar: `▓` per configured setting, `░` per gap, max 5 chars (e.g. 2/5 = `▓▓░░░`, 4/4 = `▓▓▓▓▓`).
+
+**Biggest risk area:** clause with most ✗ High-impact settings.
+**Quickest win:** clause with only 1-2 gap settings AND at least one is High impact.
+
+Terminology rules:
+- Use "settings" NOT "controls" in output
+- Use plain-English clause names (from `clauses[].clauseName`) in headlines; clause IDs (e.g. A.6.2.8) as secondary reference in DETAILS only
+- Use `controls[].displayName` as setting name, NOT product identifiers
+- **NEVER write raw API status strings** (`in-place`, `new`, `not-deployed`, `fully-deployed`, `needs-policies`) in user-facing display output (posture_plan.txt, chat responses, report summaries) — translate EVERY occurrence before writing
+  - `"in-place"` → **Applied** (or ✓)
+  - `"new"` → **Not Applied** (or ✗)
+- **`coverage.json` is an internal session file** — save it as the raw `--output json` CLI response. Raw API values (`"in-place"`, `"new"`) are CORRECT and expected in this file. Do NOT translate status values when writing coverage.json.
+- Never say "compliance gaps" — say "settings not yet configured"
+- Never claim the tenant IS compliant
+
+Render the following format:
+
+```
+ISO 42001 Posture — <tenantName>  ·  <date>
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+SUMMARY
+┌─────────────────────────┬──────────────────────────────────────┐
+│ Overall coverage        │ <inPlaceCount> / <totalCount> settings  (<pct>%)  │
+│ Clauses fully covered   │ <clausesInPlace> / <totalClauses>                │
+│ Clauses with gaps       │ <clausesWithGaps> / <totalClauses>               │
+├─────────────────────────┼──────────────────────────────────────┤
+│ 🔴 High impact gaps     │ <highGapCount> settings Not Applied  across <highClauseCount> clauses  │
+│ 🟡 Medium impact gaps   │ <medGapCount> settings Not Applied   across <medClauseCount> clauses   │
+│ 🟢 Low impact gaps      │ <lowGapCount> settings Not Applied   across <lowClauseCount> clauses   │
+├─────────────────────────┼──────────────────────────────────────┤
+│ Biggest risk area       │ <clauseName with most High-impact settings Not Applied>          │
+│ Quickest win            │ <clauseName with fewest gaps AND ≥1 High setting>│
+└─────────────────────────┴──────────────────────────────────────┘
+
+Fix all gaps with: 'Apply ISO 42001 settings'
+Fix priority gaps: 'Apply High impact ISO 42001 settings'
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+DETAILS
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+Needs Configuration  (<N> of <total>)
+
+  <clauseName>                                       <inPlace>/<total> <bar>
+  ┌───────────────────────────────────┬─────────────────────┬────────┐
+  │ Setting                           │ Recommendation      │ Impact │
+  ├───────────────────────────────────┼─────────────────────┼────────┤
+  │ ✗ <controlDisplayName>            │ <recommendedSetting>│ High   │
+  │ ✓ <controlDisplayName>            │ Applied             │ Medium │
+  └───────────────────────────────────┴─────────────────────┴────────┘
+
+  [repeat per clause with gaps]
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+Applied  (<N> of <total>)  ✓
+┌────────────────────────────────────────┬──────────┐
+│ Clause                                 │ Settings │
+├────────────────────────────────────────┼──────────┤
+│ <clauseName>                           │ X / X  ✓ │
+└────────────────────────────────────────┴──────────┘
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+Configure all <N> remaining settings? (y/n)
+Or ask: 'Just fix the High impact gaps'
+        'Apply only <specific area> settings'
+        'What does [clause name] require?'
+```
+
+## All settings applied
+
+If `summary.newCount == 0`:
+
+```
+All ISO 42001 recommended settings are Applied on <tenantName>.
+42 / 42 settings  ·  14 / 14 clauses fully covered ✓
+
+To remove them: 'Remove ISO 42001 settings'
+```
+
+Do NOT call `state enable` in this case.
+
+## Never cache
+
+Always run fresh before presenting a posture plan. Coverage reflects live tenant state.
+
+## Anti-patterns
+
+- **Writing raw API status strings in user-facing display output** — `in-place`, `new`, `not-deployed`, `fully-deployed`, `needs-policies` must NEVER appear in user-facing display output (posture_plan.txt, chat responses, report summaries). Translate every status before writing. `coverage.json` is an internal session file — raw API values are correct there.
+- **Partial translation** — translating the summary section but leaving raw values in the DETAILS or verification section. ALL sections must use the translated labels.
+- **Quoting API values for context** — avoid notes like "Status is still 'new'". Rephrase to "AI Trust Layer shows as Not Applied" instead.