@uipath/skills 1.196.0 → 1.197.0

package/skills/{uipath-data-fabric/references → uipath-platform/references/data-fabric}/records-query.md

@@ -10,19 +10,33 @@ uip df records list <entity-id> --limit 50 --output json
 uip df records list <entity-id> --limit 50 --cursor <NextCursor> --output json
 ```
 
-Response: `{ TotalCount, Records, HasNextPage, NextCursor?, CurrentPage?, TotalPages? }`
+Response wrapper: `{ Result, Code: "RecordList" | "RecordQuery", Data: { Items, TotalCount, HasNextPage, NextCursor, CurrentPage, TotalPages, SupportsPageJump } }`.
 
-- Use `HasNextPage` to check if more records exist
-- Pass the `NextCursor` string value to `--cursor` to fetch the next page
+- **Records live in `Data.Items`** (array). Not `Data.Records` — the older docs used that name; the actual key the CLI emits is `Items`.
+- **`Data.NextCursor` is an object `{ "Value": "<base64-string>" }`, not a flat string.** Pass `Data.NextCursor.Value` to `--cursor` on the next call (unwrap one level). Passing the whole `NextCursor` object errors out.
+- Use `Data.HasNextPage` to check if more records exist. Stop when it's `false`.
 
 ## Pagination
 
 Offset-based under the hood. Available on both `records list` and `records query`:
 
 - `-l, --limit <number>` — page size, default `50`, min `1`. Keep constant across a sweep (changing it re-slices the offset and can skip/duplicate records).
-- `--cursor <NextCursor>` — opaque string from previous response. Pass verbatim; never hand-craft.
+- `--cursor <NextCursor.Value>` — the inner `Value` string from the previous response's `Data.NextCursor` object. Pass verbatim; never hand-craft. Do **not** pass the wrapper object.
 - `-o, --offset <number>` — non-negative record index. Rounded down to the nearest page boundary (`jumpToPage = floor(offset / limit) + 1`). **Mutually exclusive with `--cursor`** — passing both errors with *"--offset and --cursor are mutually exclusive"*.
-- Stop when `HasNextPage: false`. `CurrentPage` / `TotalPages` are informational.
+- Stop when `HasNextPage: false`. `CurrentPage` / `TotalPages` / `SupportsPageJump` are informational.
+
+## Folder scope (`--folder-key`)
+
+`records list`, `records get`, `records insert`, `records update`, `records delete`, `records query`, and `records import` all accept `--folder-key <GUID>` (CLI ≥ `1.197.0`). Required when the parent entity is folder-scoped; recommended on every destructive op. Look up the parent's folder key from `entities list --include-folders --output json` (`FolderId` per row).
+
+```bash
+uip df records list  <entity-id> --folder-key <folder-guid> --output json
+uip df records query <entity-id> --folder-key <folder-guid> \
+  --body '{"filterGroup":{"logicalOperator":0,"queryFilters":[{"fieldName":"Status","operator":"=","value":"active"}]}}' \
+  --output json
+```
+
+`--folder-key` is forwarded as `X-UIPATH-FolderKey` and threaded through to the SDK — for tenant-scoped entities it's harmless (server resolves by UUID), so passing it defensively never breaks reads.
 
 ```bash
 # Sequential sweep
@@ -49,7 +63,7 @@ Pagination uses the same `--limit` / `--cursor` / `--offset` flags as `records l
 
 The `filterGroup` shape, operators, response, and per-type support are in [`filter-platform-contract.md`](filter-platform-contract.md). Beyond the filter, the query body accepts:
 
-- `"selectedFields": ["F1","F2"]` — projection. Default is all fields (SKILL.md Rule 16).
+- `"selectedFields": ["F1","F2"]` — projection. Default is all fields (data-fabric.md Rule 16).
 - `"sortOptions": [{ "fieldName": "Score", "isDescending": true }]` — server-side sort.
 
 ### Verifying a filter applied
@@ -137,7 +151,7 @@ uip df records query <entity-id> \
   --output json
 ```
 
-Response: `Data.Records` is a single row — `[{ "total": 250 }]`.
+Response: `Data.Items` is a one-row array — e.g. `[{ "Total": 250 }]`. The server **PascalCases your alias** in the response (`alias: "total"` → key `"Total"`). Read by the PascalCase key when parsing.
 
 ```bash
 # Count per group (one result row per distinct value)
@@ -146,7 +160,7 @@ uip df records query <entity-id> \
   --output json
 ```
 
-Response: one row per group, each with the group fields + every aggregate alias — `[{ "Status": "Open", "total": 12 }, { "Status": "Closed", "total": 5 }]`.
+Response: `Data.Items` — one row per group, each with the group fields + every aggregate alias (PascalCased) — e.g. `[{ "Status": "Open", "Total": 12 }, { "Status": "Closed", "Total": 5 }]`.
 
 ### Functions
 
@@ -209,6 +223,7 @@ Batch insert response: `{ Code: "RecordsBatchInserted", Data: { SuccessCount, Fa
 | `CHOICE_SET_SINGLE` | Integer `NumberId` | `choice-sets list-values <choice-set-id>` |
 | `CHOICE_SET_MULTIPLE` | Integer `NumberId` array | `choice-sets list-values <choice-set-id>` |
 | `RELATIONSHIP` | Target record's UUID `Id` (always — the binding `referenceFieldId` controls the join, not the stored value) | `records query <target-entity-id>` on the unique field |
+| `FILE` | **Not writable through `records insert` / `records update`** — see below | `files upload` |
 
 ```bash
 uip df records insert <entity-id> \
@@ -217,6 +232,22 @@ uip df records insert <entity-id> \
 
 Display labels, choice-value UUIDs, and non-UUID relationship values are rejected — resolve first. Reads echo the same shape.
 
+### FILE fields — never write through insert/update
+
+**Anti-pattern.** Never include a FILE-typed key in `records insert` or `records update` payload (data-fabric.md Rule 6). Expected behavior: the platform silently strips FILE values — paths, base64 blobs, filenames, UUIDs, and `null` — and returns `Result: Success` with the FILE column unchanged. Do not interpret Success as "the file changed." `records update receipt:null` does **not** clear. `records update receipt:"<uuid>"` does **not** swap. To attach, replace, or clear a file, use the `files` verbs documented in [`file-attachments.md`](file-attachments.md). Required write path:
+
+```bash
+# 1. Insert the row WITHOUT the FILE column
+uip df records insert <entity-id> --body '{"title":"Q1 report"}' --output json
+#    → Data.Id is the new record's UUID
+
+# 2. Attach the file to the FILE field on that record
+uip df files upload <entity-id> <record-id> <file-field-name> \
+  --file /local/path/report.pdf --output json
+```
+
+`files upload` is both attach and replace — call it directly against the record/field whether the field is currently empty or already has a file (no need to `files delete` first). `files delete` clears the field, `files download` retrieves the binary. CSV `records import` drops `FILE` columns too — see Rule 20. Full file-attachment surface in [`file-attachments.md`](file-attachments.md).
+
 ## Update Records
 
 The CLI routes by body shape: a JSON object (or 1-element array) calls the single-record endpoint; a JSON array with 2+ elements calls the batch endpoint. Both require `Id` in the body.
@@ -239,8 +270,13 @@ Batch update response: `{ Code: "RecordsBatchUpdated", Data: { SuccessCount, Fai
 
 ## Delete Records
 
+Irreversible — `--yes` and `--reason` are required (server-gated, same as `entities delete` / `choice-sets delete`). Pass each record ID as a **separate positional argument**; do not space-join them inside one quoted string (the CLI then tries to parse the whole string as a single GUID and errors with *"Error converting value '… …' to type 'System.Guid'"*).
+
 ```bash
-uip df records delete <entity-id> <id1> <id2> <id3> --output json
+uip df records delete <entity-id> <id1> <id2> <id3> \
+  [--folder-key <…>] \
+  --yes --reason "<why>" \
+  --output json
 ```
 
-Response: `{ Code: "RecordsDeleted", Data: { SuccessCount, FailureCount, SuccessRecords, FailureRecords } }`
+Response: `{ Code: "RecordsDeleted", Data: { SuccessCount, FailureCount, SuccessRecords, FailureRecords, Reason } }` — `Reason` echoes the `--reason` value for audit logging.

package/skills/uipath-platform/references/integration-service/http-request.md

@@ -34,6 +34,18 @@ uip is connections base-url "<connection-id>" --output json
 - `url` is the **fully qualified URL**.
 - No connection is bound - you supply everything needed to make the call: URL, headers (including auth if needed), query params, and body.
 
+## Step 0: Ground Against the Vendor's API Docs (registry) — connector mode only
+
+> **Connector mode only.** This grounding step applies when `authentication: "connector"` (a connector exists and the `url` is **relative** to its vendor base URL). Manual mode targets an arbitrary REST API with a full URL and has no connector to look up — skip this step for manual mode.
+
+**Before composing any `url` / `query` / `body`, ground the endpoint against the vendor's documentation.** Skipping this is the most common cause of a wrong-but-plausible endpoint that still "completes" at runtime (many vendors return HTTP 200 with an error body for an unknown path — e.g. Slack `{"ok":false,"error":"unknown_method"}` — so a bad path does not fault).
+
+1. Look the target connector up in [`vendor-docs-registry.json`](vendor-docs-registry.json) (same directory). Match by `connectorKey`.
+2. **If listed:** read its `docsUrl` (authoritative API reference) and `notes` (vendor-specific conventions: endpoint shape, custom-field keys, query quirks). Honor the `notes` verbatim, then confirm the exact path with the `http-request` probe below (the live call is the final authority — the registry only grounds the baseline).
+3. **If NOT listed:** this registry-grounding step does not apply. Proceed with the normal authoring flow — resolve the endpoint and any missing values via the `http-request` probe below, as you would otherwise.
+
+> **Pass endpoint paths verbatim — do NOT "REST-ify" them.** Many vendor APIs name operations with **literal dots**, where the whole dotted token is a single path segment: Slack`chat.postMessage`, `conversations.replies`. The dot is **not** a namespace separator — never rewrite `chat.postMessage` as `/chat/postMessage`. Copy the method exactly as the docs/registry show it (`"url": "/chat.postMessage"`).
+
 ## Authoring Helper: `http-request` command
 
 Authoring a Managed HTTP Request payload requires concrete vendor values - IDs, field names, endpoint paths. Use `http-request` command to call any vendor API directly through the connection - same auth, same base URL the Managed HTTP Request will use at runtime.
@@ -116,4 +128,6 @@ All steps 1-2 are GETs because we are in the authoring phase. The POST to `/issu
 2. **Do NOT use an absolute URL in connector-mode `url`.** Wrong: `"url": "https://example.atlassian.net/rest/api/2/project"`. Right: `"url": "/project"`.
 3. **Do NOT issue writes via CLI during authoring.** See "Read-Only During Authoring" above.
 4. **Do NOT guess the base URL.** Use `uip is connections base-url <connection-id>`.
-5. **In connector mode, request and response bodies are `application/json` only.** No other content type is supported; do NOT set `Content-Type` to anything else. Same rule applies to the `http-request` helper command body (it runs through a connection). Manual mode has no such limit — you supply your own `Content-Type` and body.
+5. **(Connector mode) Ground the endpoint before authoring.** Look the vendor up in [`vendor-docs-registry.json`](vendor-docs-registry.json), read its `docsUrl` + `notes`, and confirm the path with the `http-request` probe. See [Step 0](#step-0-ground-against-the-vendors-api-docs-registry--connector-mode-only).
+6. **(Connector mode) Pass endpoint paths verbatim.** 
+7. **In connector mode, request and response bodies are `application/json` only.** No other content type is supported; do NOT set `Content-Type` to anything else. Same rule applies to the `http-request` helper command body (it runs through a connection). Manual mode has no such limit — you supply your own `Content-Type` and body.

package/skills/uipath-platform/references/integration-service/vendor-docs-registry.json

@@ -0,0 +1,173 @@
+{
+  "_comment": "Maps a vendor to its connector-key and the authoritative API docs URL used for baseline grounding. The live http-request call is the final authority. Add entries as new vendors are supported. 'dynamic' flags objects that can carry tenant-specific custom fields. Population basis: Tier 1 connectors per INSCE 'Connector tiering definitions' (third-party, GA only; excludes UiPath-internal, generic-protocol, FPS/not-yet-GA, and SDK-only connectors with no HTTP API).",
+  "vendors": {
+    "slack": {
+      "connectorKey": "uipath-salesforce-slack",
+      "docsUrl": "https://docs.slack.dev/reference/methods",
+      "dynamic": false,
+      "notes": "Method-per-operation (e.g. chat.postMessage). Static schema; same for every workspace."
+    },
+    "salesforce": {
+      "connectorKey": "uipath-salesforce-sfdc",
+      "docsUrl": "https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/",
+      "dynamic": true,
+      "notes": "Per-org custom fields end in __c. Lookups via SOQL query with literal spaces."
+    },
+    "jira": {
+      "connectorKey": "uipath-atlassian-jira",
+      "docsUrl": "https://developer.atlassian.com/cloud/jira/platform/rest/v2/intro/",
+      "dynamic": true,
+      "notes": "Custom fields keyed customfield_*. Field set depends on project + issue type (parent fields)."
+    },
+    "servicenow": {
+      "connectorKey": "uipath-servicenow-servicenow",
+      "docsUrl": "https://developer.servicenow.com/dev.do#!/reference/api/australia/rest/c_TableAPI",
+      "dynamic": true,
+      "notes": "Base URL already includes /api/now; Table API is versioned: /v1/table/<table>. Custom columns prefixed u_. WARNING: connector mangles = and ^ in sysparm_query (literal AND %-encoded) -> use =/^-free operators (STARTSWITH/LIKE) and refine client-side; verify the filter applied via row count. sysparm_fields/sysparm_limit honored."
+    },
+    "mailchimp": {
+      "connectorKey": "uipath-mailchimp-mailchimp",
+      "docsUrl": "https://mailchimp.com/developer/marketing/api/",
+      "dynamic": true,
+      "notes": "Audience (list) merge fields are per-list, keyed by tag (FNAME, LNAME, plus custom). CASCADING: the add/update-member body field set depends on list_id (a PATH param) -> author as a discovery resource (scopeFields:[list_id], path /lists/{list_id}/merge-fields?count=1000, fieldsAt:merge_fields). Discovered values go under merge_fields.<TAG>; static fields are email_address/status/email_type/vip/language)."
+    },
+    "outlook": {
+      "connectorKey": "uipath-microsoft-outlook365",
+      "docsUrl": "https://learn.microsoft.com/en-us/graph/api/overview?view=graph-rest-1.0",
+      "dynamic": true,
+      "notes": "Microsoft Graph. Base https://graph.microsoft.com/v1.0; mail under /me/messages, /users/{id}/messages; calendar under /me/events. OData $filter/$select/$top/$orderby. Pagination via @odata.nextLink (follow as-is). Custom mail props via singleValueExtendedProperties/openExtensionProperties (per-tenant). immutableId vs default id quirk on messages."
+    },
+    "onedrive": {
+      "connectorKey": "uipath-microsoft-onedrive",
+      "docsUrl": "https://learn.microsoft.com/en-us/graph/api/overview?view=graph-rest-1.0",
+      "dynamic": true,
+      "notes": "Microsoft Graph (OneDrive & SharePoint). Base /v1.0. Files under /me/drive, /drives/{id}/items, /sites/{id}/drive. SharePoint list custom columns surface as listItem fields (per-list, tenant-specific). @odata.nextLink pagination, OData $filter/$expand. Path addressing /items/root:/path/to/file: vs item-id. delta query for change tracking."
+    },
+    "gmail": {
+      "connectorKey": "uipath-google-gmail",
+      "docsUrl": "https://developers.google.com/workspace/gmail/api/reference/rest",
+      "dynamic": false,
+      "notes": "Base https://gmail.googleapis.com/gmail/v1/users/{userId}/... ; use 'me' for userId. Fixed schema. Pagination via pageToken/nextPageToken. messages.list filters via q= Gmail search syntax (from:, subject:, is:unread, after:). Message bodies base64url-encoded in payload.parts. Raw uploads at /upload/gmail/v1/. batchModify/batchDelete take ID arrays."
+    },
+    "googledrive": {
+      "connectorKey": "uipath-google-drive",
+      "docsUrl": "https://developers.google.com/workspace/drive/api/guides/about-sdk?hl=en",
+      "dynamic": false,
+      "notes": "Base https://www.googleapis.com/drive/v3/; uploads at /upload/drive/v3/files (uploadType=media|multipart|resumable). Fixed schema. files.list pagination via pageToken/nextPageToken; filter via q= search syntax (mimeType=, name contains, 'PARENT_ID' in parents, trashed=false). Default fields sparse -> pass fields= to expand. Shared Drives need supportsAllDrives=true. Export Google-native docs via files/{id}/export."
+    },
+    "googlesheets": {
+      "connectorKey": "uipath-google-sheets",
+      "docsUrl": "https://developers.google.com/workspace/sheets/api/reference/rest?hl=en",
+      "dynamic": true,
+      "notes": "Base https://sheets.googleapis.com/v4/spreadsheets/{spreadsheetId}. Ranges use A1 notation in path, URL-encode (e.g. Sheet1!A1:C10). values.get/update/append; valueInputOption=RAW|USER_ENTERED required on writes. Multi-range via values:batchGet?ranges=...&ranges=...; structural edits via :batchUpdate. Cell contents are arbitrary user data -> no fixed column schema."
+    },
+    "teams": {
+      "connectorKey": "uipath-microsoft-teams",
+      "docsUrl": "https://learn.microsoft.com/en-us/graph/api/resources/teams-api-overview?view=graph-rest-1.0",
+      "dynamic": false,
+      "notes": "Microsoft Graph. Base /v1.0. /teams/{id}/channels/{id}/messages, /chats/{id}/messages. @odata.nextLink pagination; many message/list endpoints reject arbitrary $filter (limited OData support). Fixed schema; no tenant custom fields on core objects."
+    },
+    "openai": {
+      "connectorKey": "uipath-openai-openai",
+      "docsUrl": "https://platform.openai.com/docs/api-reference",
+      "dynamic": false,
+      "notes": "Fixed host https://api.openai.com/v1. POST /v1/chat/completions. Auth: Authorization: Bearer <API_KEY>. Static schema same for all callers; model selected via body \"model\". Streaming via SSE (\"stream\": true). Newer Responses API exists but chat/completions is canonical."
+    },
+    "dynamicscrm": {
+      "connectorKey": "uipath-microsoft-dynamicscrm",
+      "docsUrl": "https://learn.microsoft.com/en-us/power-apps/developer/data-platform/webapi/reference/about?view=dataverse-latest",
+      "dynamic": true,
+      "notes": "Dataverse Web API, OData v4. Base path /api/data/v9.2/. Tenant-specific custom entities + custom columns; custom logical names carry publisher prefix (new_, cr123_), entity set pluralized in URL. $filter/$select/$expand. No $skip -> page via Prefer: odata.maxpagesize header + @odata.nextLink/$skiptoken; default cap 5000 rows. Lookups set via @odata.bind. Auth: Azure AD OAuth2, resource = org URL."
+    },
+    "datadog": {
+      "connectorKey": "uipath-datadog-datadog",
+      "docsUrl": "https://docs.datadoghq.com/api/latest/",
+      "dynamic": false,
+      "notes": "Site-specific host: api.datadoghq.com (US1), api.us3/us5.datadoghq.com, api.datadoghq.eu (EU1), api.ap1/ap2.datadoghq.com, api.ddog-gov.com. Wrong site 403s. Auth headers: DD-API-KEY (all), DD-APPLICATION-KEY (most read/scoped endpoints). Versioned paths /api/v1 and /api/v2 coexist. Pagination via page[cursor]/cursor params on v2."
+    },
+    "netsuite": {
+      "connectorKey": "uipath-oracle-netsuite",
+      "docsUrl": "https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/book_1559132836.html",
+      "dynamic": true,
+      "notes": "SuiteTalk REST. Base https://<ACCOUNT_ID>.suitetalk.api.netsuite.com/services/rest. Records at /record/v1/<recordType>; SuiteQL at /query/v1/suiteql (POST, body {\"q\":...}, set Prefer: transient). Per-account custom fields prefixed custentity_/custbody_; custom record types custrecord_/customrecord_. Pagination limit/offset query params (max 1000/page), next via links. Auth: OAuth2 or token-based (TBA). Record schemas at system.netsuite.com REST_API_Browser."
+    },
+    "snowflake": {
+      "connectorKey": "uipath-snowflake-snowflake",
+      "docsUrl": "https://docs.snowflake.com/en/developer-guide/sql-api/reference",
+      "dynamic": true,
+      "notes": "Account-specific host https://<account_identifier>.snowflakecomputing.com/api/v2. POST /statements to run SQL; returns 202 + statementHandle if not finished -> poll GET /statements/{handle} until 200; cancel via POST /statements/{handle}/cancel. Async via ?async=true. Auth: Bearer JWT(key-pair)/OAuth. Large results partitioned. Tables/columns are tenant-defined -> schema not inferable from docs."
+    },
+    "github": {
+      "connectorKey": "uipath-microsoft-github",
+      "docsUrl": "https://docs.github.com/en/rest",
+      "dynamic": false,
+      "notes": "Base https://api.github.com. Set Accept: application/vnd.github+json and X-GitHub-Api-Version (default 2022-11-28). Pagination via Link header (rel=next/last) + per_page/page query params, NOT OData. No $filter; resource-specific query params. Fixed schema."
+    },
+    "workday": {
+      "connectorKey": "uipath-workday-workday",
+      "docsUrl": "https://community.workday.com/sites/default/files/file-hosting/restapi/",
+      "dynamic": true,
+      "notes": "Tenant-specific base host: https://{host}.workday.com/ccx/api/{service}/{version}/{tenant}/{endpoint} (e.g. .../api/wql/v1/{tenant}/data). Per-service versioning (workers v6, common v1, wql v1). WQL endpoint runs read-only queries; RaaS exposes custom reports. Pagination: limit (max 100) + offset. Auth: OAuth2 bearer, API client scoped per service. Custom fields/objects + report data sources are tenant-defined -> discover via tenant API explorer, not generic docs."
+    },
+    "azure": {
+      "connectorKey": "uipath-microsoft-azure",
+      "docsUrl": "https://learn.microsoft.com/en-us/rest/api/resources/",
+      "dynamic": false,
+      "notes": "Azure Resource Manager REST. Base host https://management.azure.com. Every request requires ?api-version=YYYY-MM-DD (per-resource-provider; omitting it 400s). Auth: Bearer OAuth2 (AAD, scope https://management.azure.com/.default). Paginate via nextLink in response body. Fixed schema per resource provider."
+    },
+    "azuread": {
+      "connectorKey": "uipath-microsoft-azureactivedirectory",
+      "docsUrl": "https://learn.microsoft.com/en-us/graph/api/overview?view=graph-rest-1.0",
+      "dynamic": true,
+      "notes": "Microsoft Graph. Base https://graph.microsoft.com/v1.0 (use v1.0, not beta, for prod). Auth: Bearer OAuth2 (scope https://graph.microsoft.com/.default). Paginate via @odata.nextLink. Directory extension attributes + open/schema extensions are tenant-specific custom fields not in docs; query with $select. Advanced filters need ConsistencyLevel:eventual header + $count."
+    },
+    "aws": {
+      "connectorKey": "uipath-amazon-webservices",
+      "docsUrl": "https://docs.aws.amazon.com/",
+      "dynamic": false,
+      "notes": "No single REST API; per-service endpoints host https://<service>.<region>.amazonaws.com (e.g. ec2.us-east-1.amazonaws.com). All requests require SigV4 signing (canonical request + Authorization header scoped to service+region+date; clock skew >5min rejected). Many services are query/JSON-RPC, not pure REST. Pagination via NextToken/marker per service. SigV4 ref: https://docs.aws.amazon.com/general/latest/gr/signature-version-4.html"
+    },
+    "box": {
+      "connectorKey": "uipath-box-box",
+      "docsUrl": "https://developer.box.com/reference/",
+      "dynamic": true,
+      "notes": "Box Content API. Base https://api.box.com/2.0; uploads use https://upload.box.com/api/2.0. Marker-based pagination: marker + limit query params, next_marker in response (null = done); some endpoints offset-based, force marker with usemarker=true. Custom fields live in tenant-defined metadata templates (scope enterprise_<id>, templateKey); query via POST /metadata_queries/execute_read. Auth: OAuth2."
+    },
+    "sapodata": {
+      "connectorKey": "uipath-sap-odata",
+      "docsUrl": "https://api.sap.com/content-type/API/apis/ODATA",
+      "dynamic": true,
+      "notes": "SAP S/4HANA + C4C OData v2 (not v4). Service path /sap/opc/odata/sap/<SERVICE>/ varies by tenant-activated service. Tenant custom OData services + Z-fields/custom entities not in standard docs. $filter (OData v2 operators eq/ne/gt/substringof), $select/$expand/$orderby; pagination $top/$skip + $inlinecount=allpages or __next link. CSRF: GET with X-CSRF-Token: Fetch before writes. Auth: Basic or OAuth2."
+    },
+    "vertex": {
+      "connectorKey": "uipath-google-vertex",
+      "docsUrl": "https://cloud.google.com/vertex-ai/docs/reference/rest",
+      "dynamic": false,
+      "notes": "Regional host {LOCATION}-aiplatform.googleapis.com (e.g. us-central1-); 'global' uses aiplatform.googleapis.com. Versions v1 (stable) / v1beta1. Generative: POST projects/{p}/locations/{l}/publishers/google/models/{model}:generateContent (streamGenerateContent for streaming). Custom endpoints: endpoints/{id}:predict. countTokens/computeTokens separate. Body schema fixed per model."
+    },
+    "agentforce": {
+      "connectorKey": "uipath-salesforce-agent",
+      "docsUrl": "https://developer.salesforce.com/docs/ai/agentforce/references/agent-api",
+      "dynamic": true,
+      "notes": "Host https://api.salesforce.com (gov: api.gov.salesforce.com). Flow: start session (needs per-org AGENT_ID), POST message to session, end session. Auth: OAuth client-credentials via external client app (consumer key/secret + my-domain) -> Bearer token. AGENT_ID and Flows are per-org -> not knowable from docs."
+    },
+    "databricks": {
+      "connectorKey": "uipath-databricks-databricks",
+      "docsUrl": "https://docs.databricks.com/api/workspace/servingendpoints/query",
+      "dynamic": true,
+      "notes": "Workspace-specific host https://<workspace-host>/serving-endpoints/{name}/invocations (POST). Endpoint {name} (agent/model) is workspace-defined -> not knowable from docs. Auth: Bearer PAT/OAuth. Body shape depends on endpoint type: chat/completions/embeddings for foundation/external models (extra_params), dataframe_records/dataframe_split for custom models."
+    },
+    "snowflakecortex": {
+      "connectorKey": "uipath-snowflake-cortex",
+      "docsUrl": "https://docs.snowflake.com/en/user-guide/snowflake-cortex/cortex-rest-api",
+      "dynamic": true,
+      "notes": "Account-specific host https://<account_identifier>.snowflakecomputing.com/api/v2/cortex. OpenAI-compatible POST /v1/chat/completions (also Anthropic-style /v1/messages). Auth: Bearer JWT/OAuth/PAT. Streaming via SSE (\"stream\": true). Model availability region-gated; host is per-account."
+    },
+    "powerautomate": {
+      "connectorKey": "uipath-microsoft-powerautomate",
+      "docsUrl": "https://learn.microsoft.com/en-us/rest/api/power-platform/",
+      "dynamic": false,
+      "notes": "Power Platform API. Base https://api.powerplatform.com/{namespace}/{resource}; mandatory api-version query param (e.g. 2024-10-01). Environment-scoped resources need environmentId in path; tenant inferred from bearer token. Flows stored in Dataverse (Workflow table) -> alt access via Dataverse Web API."
+    }
+  }
+}

package/skills/uipath-platform/references/uip-commands.md

@@ -5,6 +5,7 @@
 **Global flags:**
 - `--output json` — always use when calling programmatically
 - `--output-filter <expr>` — JMESPath filter for JSON output
+- `--profile <name>` — use a named auth profile from `~/.uipath/profiles/<name>/.auth`; `default` keeps the built-in unprofiled login
 - `--tenant <name>` — tenant override (defaults to authenticated tenant)
 - `--verbose` — enable debug logging
 
@@ -24,10 +25,18 @@
 |---|---|
 | `uip login` | Authenticate with UiPath Cloud |
 | `uip login status` | Show current login status |
+| `uip login which` | Show which `.auth` file backs the current login |
 | `uip login tenant list` | List available tenants |
 | `uip login tenant set <name>` | Set active tenant |
 | `uip logout` | End session and clear tokens |
 
+Named profiles:
+- Use `uip login --profile dev`, then pass `--profile dev` on each command that should use that login.
+- Profile credentials live at `~/.uipath/profiles/dev/.auth`; the built-in default stays at `~/.uipath/.auth`.
+- Missing profiles do not fall back to the default login or Robot credentials.
+- Valid profile names use letters, numbers, `.`, `_`, and `-`; `default` is reserved for the built-in login.
+- Do not combine `--profile <name>` with auth-command `--file <folder>`.
+
 ---
 
 ## Orchestrator (`uip or`)
@@ -73,7 +82,7 @@ Manage assets, queues, triggers, buckets, libraries, and webhooks — a subset o
 
 ## Solution (`uip solution`)
 
-`uip solution` (init/new, project add|remove|import, resource list|refresh|get|add|remove|edit, pack, publish, deploy run|status|list|activate|uninstall, deploy config get|set|link|unlink, upload, download, packages list|delete|download) is owned by [`uipath-solution`](/uipath:uipath-solution). Load that skill for any `.uipx` lifecycle work.
+`uip solution` (init/new, project add|remove|import, resource list|refresh|get|add|remove|edit, restore, pack, publish, deploy run|status|list|activate|uninstall, deploy config get|set|link|unlink, upload, download, packages list|delete|download) is owned by [`uipath-solution`](/uipath:uipath-solution). Load that skill for any `.uipx` lifecycle work.
 
 ---
 
@@ -98,7 +107,7 @@ LLM execution trace observability and feedback annotation. See [traces/traces.md
 
 | Command | Description |
 |---|---|
-| `uip traces spans get [trace-id]` | Get spans by trace ID or `--job-key` |
+| `uip traces spans get <trace-id>` | Get spans by trace ID or `--job-key` |
 | `uip traces feedback create` | Add positive/negative feedback to a trace |
 | `uip traces feedback get <id>` | Fetch one feedback record |
 | `uip traces feedback list` | List feedback for a trace |
@@ -113,8 +122,7 @@ LLM execution trace observability and feedback annotation. See [traces/traces.md
 | Group | Command | Description |
 |---|---|---|
 | **Integration Service** | `uip is --help` | See [`uipath-integration-service`](integration-service/integration-service.md) |
-| **Traces** | `uip traces spans get [trace-id]` | LLM execution trace observability (`--job-key` to scope) |
-| **Test Manager** | `uip tm --help` | Test projects, sets, cases, executions |
+| **Traces** | `uip traces spans get <trace-id>` | LLM execution trace observability (`--job-key` to scope) |
 | **RPA** | `uip rpa --help` | RPA workflow management |
 | **MCP** | `uip mcp serve` | Start Model Context Protocol server |
 | **Coded Agents** | `uip codedagent --help` | Python agent development |

package/skills/uipath-review/SKILL.md

@@ -32,6 +32,7 @@ Review UiPath solutions and individual artifacts for structural validity, qualit
 10. **Rule findings are authoritative as emitted.** Carry review-CLI findings (`Data.Issues[]`) into the report verbatim — `RuleId`, `Severity`, `Description`, `File`, `SuggestedFix` unchanged. For the judgment catalog, use its `rule_id`, `severity`, `trigger`, and `suggested_fix` verbatim. Map severity to the report's bands: `error` → Critical, `warning` → Warning, `info` → Info. `judgment` severity rows default to Warning; the agent may escalate or de-escalate with reasoning logged in the finding's `description`. Do not re-rank otherwise.
 11. **Report rules that could not be applied** (missing tooling, missing file, review CLI unavailable, `status: deferred`) in a dedicated "Rules Skipped" subsection of the report — never silently skip.
 12. **Never invent `rule_id` values.** Every `rule_id` cited in the report MUST appear verbatim in EITHER a loaded judgment-catalog file (`references/agents/agents-*-rules.md`) OR the `uip agent review` / `uip codedagent review` JSON output. `rule_id` is a stable contract identifier — consumers grep for it, dashboards aggregate by it, audits trace it. An invented identifier looks authoritative but cannot be looked up, doesn't aggregate, and produces a different name for the same observation on the next run. If you observe a real issue covered by neither source, the finding is still valid — report it as a normal Critical / Warning / Info finding **without** a `rule_id` (no `` `RULE_ID` `` backtick token in the line). **Before emitting the report, scan every cited `rule_id` and confirm it appears verbatim in a loaded catalog file or the review-CLI output; demote any that don't to `rule_id`-less findings.**
+13. **Grade every agent project by the rubric — derived, never asserted.** For **agent projects** (phase 1), produce a letter grade (`A`/`B`/`C`/`D`/`F`, no `+`/`-`) per agent and overall, computed in Step 4.5 as `min(G_det, G_jud)`. **G_det is read from the review CLI's `Data.Grade` (Step 2.5a) — do not recompute it from finding counts.** G_jud you compute from judgment (architecture scores + Step 2.5b + Step 3). CLI findings already shaped `Data.Grade`; only judgment findings feed G_jud, so each finding lands in exactly one sub-grade. Show the binding constraint for every grade; a grade with no shown derivation is invalid. A security or data-integrity judgment Critical forces **F** regardless of design quality (hard gate, not a blend). The skill grade is always ≤ `Data.Grade` (min only lowers) — report both, never overwrite the CLI grade. Do **not** grade non-agent projects (RPA, flows, coded apps) — that rubric is a future phase. See [references/agents/agent-grading-rubric.md](references/agents/agent-grading-rubric.md).
 
 ## Review Workflow
 
@@ -248,6 +249,8 @@ Run the review command for the agent type, once, capturing JSON:
 
 The CLI runs every deterministic static check — structural/schema, placeholder cross-refs, eval counts/diversity, secret & import regex, framework symbol existence, eval-run analysis, packaging/git hygiene — and returns them in rule format. Parse `Data.Issues[]`; each issue is `{RuleId, Category, Severity, Description, File, SuggestedFix}`. Carry each into the report **verbatim** — do not re-derive, rename, or re-rank. These rule IDs are authoritative as emitted by the CLI; they are **not** listed in the skill catalog.
 
+> **Guardrail configuration is CLI-only — never eyeball it.** Whether a guardrail is well-formed (real validator, allowed scope, required/typed/legal parameters, valid custom-rule shape) is decided **only** by `uip agent review` — the `GUARDRAIL_*` and `GUARDRAIL_CUSTOM_*` rule IDs come from this command, never from reading `agent.json` by eye and never from the judgment catalog. So whenever the task involves checking / validating / diagnosing / fixing a guardrail, running the review CLI in this step is **mandatory** (use `--checks guardrails` if you only need the guardrail pass), and every `GUARDRAIL_*` finding it returns **must** appear verbatim in the report's Rule Findings — do not replace it with a hand-written description of the problem. (The judgment catalog's `LC_GUARDRAIL_*` rules are the complement: they audit only guardrails the CLI found format-valid and recommend missing ones at Info — see Step 2.5b and [`references/agents/guardrails/guardrails-review.md`](references/agents/guardrails/guardrails-review.md).)
+
 #### 2.5b — Apply the judgment catalog (reasoning the CLI cannot do)
 
 1. **Identify which catalog files apply** for the current project type:
@@ -263,10 +266,11 @@ The CLI runs every deterministic static check — structural/schema, placeholder
 | `.uipath/` or `app.config.json` | Coded App | *(phase 2)* |
 
 2. **Read each catalog file in full.** Every rule is judgment-form.
-3. **Apply each rule's `detection_method`:** read the named source material (system prompt, tool descriptions, eval datapoints, schemas) and reason about it. Emit a finding when the criteria hold; log the reasoning in the finding's `description`.
-4. **Track skipped rules** with their reason (`status: deferred`, missing optional file, review CLI unavailable). Never silently skip.
-5. **Verify rule_id provenance.** Before merging, confirm each cited `rule_id` appears **verbatim** in EITHER a loaded catalog file OR the `uip agent review` / `uip codedagent review` JSON output. Any finding whose `rule_id` matches neither is **demoted** to a `rule_id`-less Critical / Warning / Info finding (the observation stays; the false citation goes). This enforces Critical Rule 12.
-6. **Merge findings into the Step 5 report** under the "Rule Findings" subsection. Use the canonical line format:
+3. **Guardrails (low-code) — apply the structured guardrail workflow.** When `agent.json` has a non-empty `guardrails[]` or the agent matches a guardrail use case, apply [`references/agents/guardrails/guardrails-review.md`](references/agents/guardrails/guardrails-review.md) (Step 0 fetch of the live `uip agent guardrails catalog` + `list`, 30-min cache → **Audit Mode** for existing guardrails + **Recommend Mode** for missing ones). It emits `LC_GUARDRAIL_ACTION_INEFFECTIVE` / `LC_GUARDRAIL_MISAPPLIED` (defects, `judgment` band) and `LC_GUARDRAIL_RECOMMENDED` (Info, one finding per missing guardrail with the validator / scope / action and the block-escalate-vs-log signal in the message). If the guardrail catalog is unavailable, record the Audit-Mode rules under "Rules Skipped" and keep Recommend Mode's `agent.json`-only detection.
+4. **Apply each rule's `detection_method`:** read the named source material (system prompt, tool descriptions, eval datapoints, schemas) and reason about it. Emit a finding when the criteria hold; log the reasoning in the finding's `description`.
+5. **Track skipped rules** with their reason (`status: deferred`, missing optional file, review CLI unavailable). Never silently skip.
+6. **Verify rule_id provenance.** Before merging, confirm each cited `rule_id` appears **verbatim** in EITHER a loaded catalog file OR the `uip agent review` / `uip codedagent review` JSON output. Any finding whose `rule_id` matches neither is **demoted** to a `rule_id`-less Critical / Warning / Info finding (the observation stays; the false citation goes). This enforces Critical Rule 12.
+7. **Merge findings into the Step 5 report** under the "Rule Findings" subsection. Use the canonical line format:
 
    ```
    [<prefix><n>] `<rule_id>` — <file> — <description>. Fix: <suggested_fix>.
@@ -444,6 +448,27 @@ Read [references/review-workflow-guide.md](references/review-workflow-guide.md)
 
 Read [references/architecture-assessment-guide.md](references/architecture-assessment-guide.md) for the architecture-level evaluation framework — process suitability, complexity classification, environment separation, and architecture principles scoring.
 
+### Step 4.5 — Compute the Agent Letter Grade (A–F)
+
+**Agent projects only** (phase 1) — matching the Step 2.5 judgment catalog, which is agent-only today. Grade every **agent** project, and (for a multi-agent solution) the agent set overall, on an A–F scale. Non-agent projects are **not** graded yet (RPA, flows, coded apps are future phases) — report their findings without a grade. The grade is **derived** — never a fresh judgment. Take the worse of two sub-grades: G_det is **read from the review CLI**, G_jud you compute from judgment:
+
+```
+Final grade = min(G_det, G_jud)        where G_det = <review CLI>.Data.Grade
+```
+
+- **G_det (deterministic)** — **read it from the review CLI; do not recompute.** `uip agent review` / `uip codedagent review` (Step 2.5a) returns `Data.Grade` — that letter **is** G_det. (`Data.Issues[]` are still reported verbatim, but the grade comes from `Data.Grade`, not from tallying them.)
+- **G_jud (non-deterministic)** — the only sub-grade you compute: the architecture-principle scores (1–5) in [architecture-assessment-guide.md §4](references/architecture-assessment-guide.md) + judgment-catalog (2.5b) + manual agent-checklist (Step 3) findings.
+
+CLI findings already shaped `Data.Grade` (G_det); only **judgment** findings feed G_jud — so each finding lands in exactly one sub-grade.
+
+**G_jud band** — average the applicable architecture-principle scores (Scalability is usually N/A for a single agent — exclude it and any other that does not apply, state which): `4.5–5.0`→A, `3.5–4.49`→B, `2.5–3.49`→C, `1.5–2.49`→D, `1.0–1.49`→F. Then cap: any unmitigated judgment Critical → at most D; security/data-integrity judgment Critical → F.
+
+**Overall Agent Grade:** single agent → its grade. Multiple agents → the **worst** per-agent grade. Never average grades.
+
+Report the **binding constraint** in one line (e.g. "B — gated by G_det = CLI Data.Grade B; design strong (G_jud A)"). Since the skill grade is `min(Data.Grade, G_jud)`, it is always ≤ `Data.Grade` — report both; never overwrite the CLI grade.
+
+Full rubric, agent-principle scoring, edge cases (no-PDD / CLI-unavailable / no-eval-set), CLI-grade alignment, and worked examples: [references/agents/agent-grading-rubric.md](references/agents/agent-grading-rubric.md).
+
 ### Step 5 — Produce the Review Report
 
 Output a structured report in chat (do NOT create a file):
@@ -472,6 +497,7 @@ Output a structured report in chat (do NOT create a file):
 
 ### Summary
 - **Overall Quality:** Good / Needs Improvement / Critical Issues
+- **Agent Grade:** <A–F> — <verdict label> (<binding constraint, e.g. "B — gated by G_det: 3 Warnings; design strong (G_jud A, arch avg 4.5)">) — *agent projects only; omit this line if the review has no agent projects*
 - **Business Value:** <1-2 sentence description of what this automation does>
 - **Review Scope:** Single project / Solution (N projects) / Multi-project repo (N executables + M libraries)
 - **Project Types Found:** <list with type and language, e.g., "RPA (XAML, VisualBasic)", "Agent (Coded, Python)">
@@ -531,11 +557,14 @@ Output a structured report in chat (do NOT create a file):
 1. [I-001] <concise title> — `<project/file>` — <what to improve>
 
 ### Per-Project Summary
-| Project | Type | Language | Size | Validation | Quality | Key Findings |
-|---|---|---|---|---|---|---|
-| ProjectA | RPA (Coded) | CSharp | 42 methods, 1,300 statements | 1 error, 2 warnings | Needs Work | V-E-001, W-001 |
-| ProjectB | Flow | — | 18 nodes, 3 gateways, depth 5 | Pass | Good | I-001 |
-| ProjectC | RPA (XAML) | VisualBasic | 84 activities, 50 vars, depth 12 | Via uipath-rpa (Legacy mode) | Needs Improvement | C-002, W-003 |
+| Project | Type | Language | Size | Validation | Quality | Grade | Key Findings |
+|---|---|---|---|---|---|---|---|
+| ClassifierAgent | Agent (Coded) | Python | 14 functions, 220 statements | Pass | Good | B | W-D-002 |
+| ProjectA | RPA (Coded) | CSharp | 42 methods, 1,300 statements | 1 error, 2 warnings | Needs Improvement | — | V-E-001, W-001 |
+| ProjectB | Flow | — | 18 nodes, 3 gateways, depth 5 | Pass | Good | — | I-001 |
+| ProjectC | RPA (XAML) | VisualBasic | 84 activities, 50 vars, depth 12 | Via uipath-rpa (Legacy mode) | Needs Improvement | — | C-002, W-003 |
+
+> The **Grade** column is the per-agent `min(G_det, G_jud)` from Step 4.5 — **agent projects only** (`—` for other types, phase 1). Append the review CLI's `Data.Grade` when it differs, e.g. `B (CLI: A)`. The **Quality** column (Good / Needs Improvement / Critical Issues) applies to every project type.
 
 ### Recommended Next Steps
 
@@ -559,19 +588,31 @@ Route each fix to the appropriate skill:
 ```
 
 **Finding severity labels (never "Mismatch"/"Aligned"):**
-- Overall Quality: `Good` / `Needs Improvement` / `Critical Issues`
+- Overall Quality: `Good` / `Needs Improvement` / `Critical Issues` (all project types)
+- Agent Grade: `A` / `B` / `C` / `D` / `F` (no `+`/`-`) — agent projects only; see Step 4.5 and [agent-grading-rubric.md](references/agents/agent-grading-rubric.md)
 - Transaction Shape: `one-to-one` / `one-to-many` / `unclear`
 - Findings: `Critical` / `Warning` / `Info`
 
-**Quality determination thresholds:**
-- **Good** — 0 Critical, 0-3 Warnings
+**Overall Quality thresholds** (all project types):
+- **Good** — 0 Critical, 0–3 Warnings
 - **Needs Improvement** — 0 Critical, 4+ Warnings OR 1 Critical with clear fix
 - **Critical Issues** — 2+ Critical OR 1 Critical with security/data-integrity implications
 
+**Agent Grade → verdict label** (agent projects only; the line reads "B — Good"):
+
+| Grade | Verdict label |
+|---|---|
+| **A** / **B** | Good |
+| **C** / **D** | Needs Improvement |
+| **F** | Critical Issues |
+
+This maps the letter to the verdict word only. The agent grade is `min(G_det, G_jud)` from Step 4.5, where **G_det is the review CLI's `Data.Grade`** and the G_jud band lives in Step 4.5 — do not restate either here.
+
 ## Task Navigation
 
 | I need to... | Read this |
 |---|---|
+| Compute the A–F letter grade for an agent (Step 4.5) | [agent-grading-rubric.md](references/agents/agent-grading-rubric.md) |
 | Understand the rule row schema | [rule-format.md](references/rule-format.md) |
 | Run the review CLI + judgment catalog (Step 2.5) | [rule-catalog-workflow.md](references/rule-catalog-workflow.md) |
 | Apply common rules for agents (both formats) | [agents-common-rules.md](references/agents/agents-common-rules.md) |

package/skills/uipath-review/references/agents/agent-common-issues.md

@@ -118,7 +118,7 @@ from uipath.platform.common import CreateTask, WaitTask  # Correct HITL imports
 
 ### Missing Guardrails
 
-> *Rule catalog: `LC_GUARDRAIL_PII_MISSING`, `LC_GUARDRAIL_INJECTION_MISSING`, `LOWCODE_TOOL_GUARDRAIL_FIELD_MISSING`, `LOWCODE_GUARDRAIL_TOOL_REF_NONEXISTENT` cover this at Step 2.5.*
+> *Rule catalog: `LC_GUARDRAIL_RECOMMENDED` (one finding per missing guardrail, with the validator type, recommended scope, and action in the message), `LOWCODE_TOOL_GUARDRAIL_FIELD_MISSING`, `LOWCODE_GUARDRAIL_TOOL_REF_NONEXISTENT` cover this at Step 2.5. See [guardrails/guardrails-review.md](guardrails/guardrails-review.md).*
 
 **Symptom:** User-facing agent with no input validation, PII detection, or prompt injection defense.