@uipath/skills 1.199.0 → 1.200.0

package/skills/uipath-admin/references/audit-workflow-guide.md

@@ -86,6 +86,15 @@ For each `auditEvent` in `Data.auditEvents`, surface:
 
 If `Data.previous` is non-null, mention "older results available — extend the window with `--from-date <earlier>` to see more."
 
+### Step 5 — When nothing matches, say so
+
+**A "who did it" question with no matching event has exactly one correct answer: "no such event was found."** This is an audit trail — the answer is evidence, and naming the wrong person is worse than returning nothing.
+
+- Report the negative result plainly, state what you searched (scope, source/target/type, window), and offer the next step (widen the window, try the other scope, check whether the resource ever existed).
+- **Never** put forward an actor drawn from an adjacent event — a different resource, a different event type, or a broad `--search` hit — as if it answered the question. If a search for `Sales-Reports` returns nothing but a search for `Sales` returns 13 unrelated events, the answer is still "no `Sales-Reports` deletion found", and any actor named in those 13 events is **not** a candidate.
+- Do not keep broadening filters until something comes back and then present that as the culprit. Two or three well-targeted queries that come up empty are a complete, correct investigation — stop there and report it.
+- Only name an actor when the event you are citing actually matches the resource and the verb the user asked about; quote the `createdOn` and the identifying field from `eventDetails` so the user can verify the match themselves.
+
 ---
 
 ## Investigation 2 — "Show me logins for user X"

package/skills/uipath-agents/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: uipath-agents
-description: "End-to-end work with UiPath Agents of all types: build, integrate with UiPath Products (e.g., Orchestrator, Flow, Maestro), design with UiPath Tools (e.g., Agent Builder/Studio Web), deploy, and configure/validate. Covers Coded Agents (e.g., LangGraph, LlamaIndex, OpenAI Agents) and Low-Code Agents (`agent.json` / Agent Builder). For deterministic Python Coded Functions (`uip functions`, `uipath.json` functions map, no agent runtime/LLM)→uipath-functions."
+description: "End-to-end work with UiPath Agents of all types: build, integrate with UiPath Products (e.g., Orchestrator, Flow, Maestro), design with UiPath Tools (e.g., Agent Builder/Studio Web), deploy, and configure/validate. Covers Coded Agents (e.g., LangGraph, LlamaIndex, OpenAI Agents) and Low-Code Agents (`agent.json` / Agent Builder). For deterministic Python Coded Functions (`uip function`, `uipath.json` functions map, no agent runtime/LLM)→uipath-functions."
 when_to_use: "Must use when user mentions or implies any Agent lifecycle phase - e.g., auth, design, scaffold, Studio Web sync, flow integration, editing, pack/deploy/version bump, eval, debug, tracing, guardrails, memory spaces, bindings, attachments. Example requests: 'create/build a UiPath agent', 'build a low-code / Agent Builder agent', 'add agent memory spaces', 'build a coded / Python agent (LangGraph / LlamaIndex / OpenAI Agents)', 'scaffold an agent project', 'run / debug / evaluate / deploy my agent'."
 allowed-tools: Bash, Read, Write, Edit, Glob, Grep, AskUserQuestion, WebFetch
 user-invocable: true
@@ -20,7 +20,7 @@ user-invocable: true
 
 Determine the agent mode before proceeding:
 
-1. **First — confirm this is an agent, not a Coded Function.** If `uipath.json` declares a `functions` map (e.g. `"functions": {"main": "main.py:main"}`), the project is a **Python Coded Function**, not an agent. Stop here and use the [`uipath-functions`](/uipath:uipath-functions) skill instead. Functions are deterministic, do not reason via LLM, and have a distinct lifecycle (`uip functions new/init/pack/publish/run`).
+1. **First — confirm this is an agent, not a Coded Function.** If `uipath.json` declares a `functions` map (e.g. `"functions": {"main": "main.py:main"}`), the project is a **Python Coded Function**, not an agent. Stop here and use the [`uipath-functions`](/uipath:uipath-functions) skill instead. Functions are deterministic, do not reason via LLM, and have a distinct lifecycle (`uip function new/init/pack/publish/run`).
 2. **Check for existing agent project files** in the working directory:
    - `pyproject.toml` + `.py` files + a framework dep (`uipath-langchain`, `uipath-llamaindex`, or `uipath-openai-agents`) → **Coded**. The framework package already declares `uipath` as a dependency, so an explicit `uipath` entry is not required.
    - `agent.json` with `"type": "lowCode"` + `project.uiproj`, AND no `pyproject.toml` → **Low-code**

package/skills/uipath-agents/references/lowcode/capabilities/context/index.md

@@ -260,6 +260,13 @@ The upload response includes a `Data.DesignerUrl` — open it to verify the cont
 
 `contextType` and `retrievalMode` values MUST be lowercase — see [../../critical-rules/critical-rules.md](../../critical-rules/critical-rules.md) Anti-pattern 12.
 
+**Cap retrievals in the system prompt.** Wiring the index is not enough: "ground your answer in the retrieved guidance" with no call limit makes the agent re-query with new phrasings until the runtime terminates it — `AGENT_RUNTIME.TERMINATION_MAX_ITERATIONS` (in a flow: node Failed, incident `170002`). Raising `settings.maxIterations` only moves the failure — 5 dies at 5, 25 dies at 25. State a cap and a fallback:
+
+```text
+Call <toolName> at most <N> times (N ≤ 3 for a single decision). After the last call, stop retrieving and decide with the evidence you already have.
+If the retrieved content does not cover a detail, say so in <rationaleField>, lower <confidenceField>, and still return every outputSchema field. Never end a run without a determination.
+```
+
 ## References
 
 - [context.md](context.md) — capability overview and variant decision

package/skills/uipath-agents/references/lowcode/capabilities/integration-service/integration-service.md

@@ -252,11 +252,10 @@ Scaffold per [../../project-lifecycle.md § End-to-End Example](../../project-li
 ### Step 2 — Find the connector
 
 ```bash
-uip is connectors list --output json
-# Or filter: uip is connectors list --filter "slack" --output json
+uip is typecache packages --output json
 ```
 
-Note the connector `Key` (e.g., `uipath-salesforce-slack`).
+`uip is typecache packages` returns the connectors available to low-code agents — the curated set the Agent Builder UI shows, from the Studio typecache. Note the connector `Key` (e.g., `uipath-salesforce-slack`). It defaults to `--project-type Agent`; pass a different `--project-type` for other project types.
 
 ### Step 3 — Find a connection
 
@@ -271,10 +270,10 @@ This command also populates the local cache at `~/.uipath/cache/integrationservi
 ### Step 4 — Discover activities
 
 ```bash
-uip is activities list "<connector-key>" --output json
+uip is typecache activities "<connector-key>" --output json
 ```
 
-Present activities to the user. Note the chosen activity's `DisplayName`, `Description`, `ObjectName`, `MethodName`.
+`uip is typecache activities` calls the same Agent Builder typecache endpoints the frontend uses. It returns exactly the activities the UI shows for low-code agents — the curated subset from the Studio NuGet package for the connector. It defaults to `--project-type Agent`. Activities with an empty `objectName` (deprecated stubs) are filtered out. File operation and HTTP activities appear in the UI with a "Preview" chip but are fully selectable — they are included in the output. Connectors not in the typecache are absent from the UI and return empty here. Present the activities to the user and note the chosen activity's `DisplayName`, `Description`, `ObjectName`, `MethodName`.
 
 ### Step 5 — Get connector details (for iconUrl)
 
@@ -332,7 +331,7 @@ uip solution upload ./dist/<SOLUTION_NAME>.uis --output json
 
 See [../../critical-rules/critical-rules.md](../../critical-rules/critical-rules.md):
 - Critical Rules 11, 12 (folderPath / location)
-- Anti-pattern 13 (do NOT pass `--for-low-code-agents` — flag removed)
+- Critical Rule 13 (use `uip is typecache` for low-code IS discovery)
 
 IS-specific gotchas (each from a real Studio-Web silent-drop bug):
 - `enumValues` MUST be `[{name, value}]` objects, not bare strings.

package/skills/uipath-agents/references/lowcode/critical-rules/critical-rules.md

@@ -60,7 +60,7 @@ Some additional rules and anti-patterns may only be relevant for autonomous or c
 10. **Do not bump `storageVersion` manually** — breaks packager compatibility.
 11. **Do not call raw Automation.Solutions REST APIs** — always use `uip solution` commands.
 12. **Do not camelCase `contextType` or `retrievalMode` values** — write `"datafabricentityset"`, `"deeprag"`, `"batchtransform"` (all lowercase). `uip agent validate` accepts camelCase but Studio Web silently drops the resource from the agent UI on import.
-13. **Do not pass `--for-low-code-agents` to `uip is connectors list` or `uip is activities list`** — this flag has been removed. Run the commands without it and filter yourself if needed.
+13. **Discover low-code agent connectors and activities with `uip is typecache`, not `uip is connectors list` / `uip is activities list`.** Use `uip is typecache packages` for connectors and `uip is typecache activities "<connector-key>"` for activities. These call the same Agent Builder typecache endpoints the frontend uses, returning exactly what the UI shows — the curated subset from the connector's Studio NuGet package. They default to `--project-type Agent`. Activities with an empty `objectName` (deprecated stubs) are filtered out. File operation and HTTP activities are included — the UI shows them with a "Preview" chip but they are fully selectable. Connectors absent from the typecache return empty (they don't appear in the UI either). No `--agent-id` required — works for locally scaffolded agents that don't yet exist in the cloud. The general `uip is connectors list` / `uip is activities list` commands return the full Integration Service catalog, not the curated low-code set.
 14. **Do not omit discriminator fields in guardrails** — every action needs `$actionType` (not `type`), every validator parameter needs `$parameterType` and `id` (not `name`), every custom rule needs `$ruleType`, every field selector needs `$selectorType`. Missing any discriminator causes `uip agent validate` to fail.
 15. **Do not use lowercase scope values in guardrails** — use `"Agent"`, `"Llm"`, `"Tool"` (PascalCase), not `"agent"`, `"llm"`, `"tool"`.
 16. **Do not expect `uip solution resources refresh` to wire non-StorageBucket index data sources** — GoogleDrive/OneDrive/Dropbox/Confluence/Attachments indexes, `attachments` contexts, and `datafabricentityset` contexts are not auto-generated. Refresh warns + skips them; any solution-level files for these must be hand-authored. See [capabilities/context/index.md](../capabilities/context/index.md).

package/skills/uipath-agents/references/lowcode/evaluations/evaluation-sets.md

@@ -143,6 +143,11 @@ Use these to expand test coverage without writing every input by hand.
 }
 ```
 
+Schema notes:
+
+- Test-case array is `evaluations[]` — **not** `testCases[]`. Read the key from the file or `uip agent eval list --set "<eval_set_name>" --path <agent_dir> --output json`; don't guess.
+- Studio Web names eval set files `evaluation-set-<unix-ms>.json` (e.g. `evaluation-set-1778230599547.json`); CLI-created sets may use readable names (`evaluation-set-default.json`). `fileName` mirrors the actual filename — match sets by `name` or `id`, not filename pattern.
+
 The `source` field indicates how the test case was created. CLI-added test cases are always `"manual"` (verified). Other observed values from Studio Web include `"debugRun"`, `"runtimeRun"`, `"simulatedRun"`, and `"autopilotUserInitiated"` — treat the `source` field as an enum but do not set it manually; the CLI and Studio Web own this value.
 
 ## Anti-patterns

package/skills/uipath-agents/references/lowcode/project-lifecycle.md

@@ -372,7 +372,7 @@ uip solution upload . --output json
 **Orchestrator** (for production deployment — only when explicitly requested):
 ```bash
 uip solution pack . ./dist -v "1.0.0" --output json
-uip solution publish ./dist/<SOLUTION_NAME>.1.0.0.zip --output json
+uip solution publish ./dist/<SOLUTION_NAME>_1.0.0.zip --output json   # pack names the zip <name>_<version>.zip
 uip solution deploy run --name "<NAME>" --package-name "<SOLUTION_NAME>" --package-version "1.0.0" --output json
 ```
 
@@ -385,7 +385,7 @@ Solutions use semantic versioning: `MAJOR.MINOR.PATCH`
 uip solution pack ./MySolution ./output -v "1.2.0" --output json
 
 # Publish the versioned package to Orchestrator
-uip solution publish ./output/MySolution.1.2.0.zip --output json
+uip solution publish ./output/MySolution_1.2.0.zip --output json
 
 # Check published packages
 uip solution packages list --output json
@@ -405,7 +405,7 @@ To promote from dev to production:
 uip solution pack ./MySolution ./output -v "2.0.0" --output json
 
 # 2. Publish to Orchestrator
-uip solution publish ./output/MySolution.2.0.0.zip --output json
+uip solution publish ./output/MySolution_2.0.0.zip --output json
 
 # 3. Deploy to production folder
 uip solution deploy run \

package/skills/uipath-agents/references/lowcode/prompting/autonomous-agent-prompting-guide.md

@@ -16,9 +16,10 @@ Scope:
 - Out of scope: <what to refuse or escalate>
 
 Tools:
-- <toolName>: call when <explicit condition>. Do not call when <condition>.
+- <toolName>: call when <explicit condition>. Do not call when <condition>. Call at most <N> times (N ≤ 3 for a single decision).
 - <toolName>: ...
 Stop calling tools once <stop condition>; then produce the final answer.
+If a tool result does not cover a detail, say so in <rationaleField>, lower <confidenceField>, and still return every outputSchema field. Never end a run without a final answer.
 
 Output:
 - Return a result conforming to the output schema. <field>: <how to fill it>.
@@ -131,7 +132,7 @@ A robust agent is more than its prompt. Each field: default, and when to change.
 |-------|---------|-------------|
 | `outputSchema` | Scaffold gives a single `content` string | **Almost always** — define typed fields a downstream node can consume. Bare `content` forces brittle string-parsing. |
 | `settings.temperature` | `0` | Keep `0` for extraction/classification/judgment. Raise only when output *variation* is wanted (drafting, brainstorming). |
-| `settings.maxIterations` | `25` | Lower (≤5) for single-shot classification. Higher for multi-tool research loops. |
+| `settings.maxIterations` | `25` | `≤5` only if tool-less and single-shot. Kill switch, not a loop fix: without a per-tool cap the agent loops to the ceiling — observed dying at 5 and at 25 alike (`TERMINATION_MAX_ITERATIONS`). |
 | `settings.maxTokens` | Scaffold value | Set ≤ the model's `MaxTokens` cap — see [model-selection-guide.md](../model-selection-guide.md#1-discover-primary-path). |
 | `settings.model` | `gpt-5.4` | **Always override** — discover + select per [model-selection-guide.md](../model-selection-guide.md). |
 | `guardrails` | `[]` | Add input/output policy enforcement (PII, content, escalation). See [capabilities/guardrails/guardrails.md](../capabilities/guardrails/guardrails.md). |

package/skills/uipath-api-workflow/SKILL.md

@@ -236,7 +236,7 @@ uip solution pack . ./build --name MyApiSolution --version 1.0.0 --output json
 
 # 6. Publish
 uip login
-uip solution publish ./build/MyApiSolution.zip --tenant MyTenant --output json
+uip solution publish ./build/MyApiSolution_1.0.0.zip --tenant MyTenant --output json   # pack names the zip <name>_<version>.zip
 ```
 
 ## Reference Navigation
@@ -253,6 +253,7 @@ uip solution publish ./build/MyApiSolution.zip --tenant MyTenant --output json
 | [references/operating-published-workflows.md](references/operating-published-workflows.md) | **Operating + diagnosing a published workflow** — invoke via HTTP/schedule/event triggers, manage Integration Service connections (`uip is connections`), start/list/stop Orchestrator jobs (`uip or jobs`), read cloud-run logs/traces (`uip or jobs logs`, `uip traces spans get`). Delegates depth to `uipath-platform` / `uipath-troubleshoot` |
 | [references/troubleshooting.md](references/troubleshooting.md) | Failed runs, structure/expression/loop/nesting/response/validation pitfalls, packaging errors, publish errors, debugging strategy |
 
+
 ## Templates
 
 | File | Description |

package/skills/uipath-api-workflow/references/cli-reference.md

@@ -429,7 +429,7 @@ uip solution pack <solutionPath> <outputPath> \
 | Argument / Flag | Required | Description |
 |-----------------|----------|-------------|
 | `<solutionPath>` | yes | Path to solution folder or `.uis`/`.uipx` file. |
-| `<outputPath>` | yes | Output directory for the `.zip`. |
+| `<outputPath>` | yes | Output directory for the `.zip`. The file lands as `<outputPath>/<name>_<version>.zip` — underscore, not a dot. |
 | `-n, --name <name>` | no | Package name. Defaults to solution folder name. |
 | `-v, --version <version>` | no | Package version. Default `1.0.0`. |
 | `--login-validity <minutes>` | no | Min minutes before token refresh. Default `10`. |
@@ -507,8 +507,8 @@ uip solution pack . ./build \
   --version 1.0.0 \
   --output json
 
-# 6. Publish
-uip solution publish ./build/MyApiSolution.zip \
+# 6. Publish — pack names the zip <name>_<version>.zip
+uip solution publish ./build/MyApiSolution_1.0.0.zip \
   --tenant MyTenant \
   --output json
 ```

package/skills/uipath-coded-apps/SKILL.md

@@ -47,9 +47,10 @@ Build, debug, and deploy UiPath Coded Web Applications and Coded Action Apps usi
 13. **Inspect the DF schema before writing analytics, filters, or seeds.** Run `uip df entities get <ENTITY_ID> --output json` to inspect fields and types. At runtime, use `entities.getById(<id>)` from the app's authenticated session. DF doesn't behave like a typical RDBMS; see [sdk/data-fabric.md](references/sdk/data-fabric.md) "Anti-shapes & gotchas".
 14. **Every list call returns ONE page — even with no options. There is no "give me everything" path.** Applies to `getAll`, `getAllRecords`, `queryRecordsById`, `getFileMetaData`, etc. `getAll()` with no options does NOT return all rows; the SDK sends no `pageSize` and the **server** applies its own cap, wrapped in a misleadingly-named `NonPaginatedResponse`. To list every row from a source that may exceed the cap, you MUST loop the cursor: `while (page.hasNextPage) { page = await getAll({ cursor: page.nextCursor }) }` and accumulate `items`. Reading `result.items.length` after a single call is almost always a bug. See [sdk/pagination.md](references/sdk/pagination.md).
 15. **Tables of dynamic data must paginate, not dump all rows in one scroll.** Page size 25–50 with next/prev/page-number controls and a "Showing X–Y of Z" summary. Top-N + "see all" is acceptable for explicitly summary panels (e.g., "Top 10 oldest"). Infinite-scroll-of-N-rows is unusable for operational dashboards. Applies to any table backed by any service (DF entities, Tasks, Jobs, Conversations, Process Instances, etc.). See [patterns.md](references/patterns.md) "Tabular Data".
-16. **When adding any new SDK method call, verify the configured OAuth scope already includes the required scope** — both dashboards and web apps read the `scope` key from `uipath.json`. Write operations, action methods (`Jobs.stop`, `Tasks.complete`, `ProcessInstances.cancel`, etc.), or first use of a new service typically need broader scopes than read-only flows. Mismatched scopes fail silently with `401` / `403` on the first call. See [oauth-scopes.md](references/oauth-scopes.md) for the per-method scope table.
+16. **When adding any new SDK method call, verify the configured OAuth scope already includes the required scope** — both dashboards and web apps read the `scope` key from `uipath.json`. Write operations, action methods (`Jobs.stop`, `Tasks.complete`, `ProcessInstances.cancel`, etc.), or first use of a new service typically need broader scopes than read-only flows. Mismatched scopes fail silently with `401` / `403` on the first call. See [oauth-scopes.md](references/oauth-scopes.md) for scope bundles and the per-method lookup protocol (the per-method table ships inside the SDK package at `node_modules/@uipath/uipath-typescript/docs/oauth-scopes.md`).
 17. **Never call `sdk.initialize()` in an action app.** That is web-app-only — it starts a PKCE OAuth redirect. Action apps run in Action Center's iframe with a host-injected session: construct `new UiPath()` (no args) and use it directly. See [create-action-app.md](references/create-action-app.md) `src/uipath.ts`.
 18. **Never make the user type magic phrases.** Whenever you ask the user to pick between known options (app type, build/edit/deploy intent, OAuth setup, deploy pinning), present a **structured choice** via the host coding agent's native question tool (selectable options) when one exists. Mechanics: one option per choice with a short bold label + one-line description of what picking it does; put the recommended option **first** and suffix its label "(Recommended)"; keep to **at most 4 options** (reserve one slot for an escape option like *Make changes* / *Cancel* when applicable). If there are 5+ candidates, or the host agent has no question tool, render a plain numbered list instead and accept the number or the option label as the answer. A free-text reply must always remain valid (e.g. a plan-change request) and takes precedence over the options. **Exception — never put a question in the same response as a long output:** plan-approval gates are free-text by design (the plan ends with "confirm or tell me what to change"); structured questions fire only on later, short turns. See `references/dashboards/plugins/build/impl.md`.
+19. **Never guess SDK method signatures — read the installed types.** The authoritative reference for method names, parameters, return types, and usage examples is `node_modules/@uipath/uipath-typescript/dist/<subpath>/index.d.ts` (full JSDoc; matches the installed SDK version exactly). Before calling a service you have not used in this session, Read its `.d.ts`. If `node_modules` is absent, run the install step first — the app cannot build without it. The `references/sdk/*.md` files deliberately do NOT list signatures; they cover only scopes, calling conventions, and traps the types cannot express. See [references/sdk/imports.md](references/sdk/imports.md) for the missing-capability protocol. **Boundary: read the `.d.ts`, never the compiled bundle.** `dist/*.mjs` / `*.js` is minified implementation, not API — reading it dead-ends. A grep with no output **confirms absence**; treat a genuine gap as unsupported (use the documented alternative) rather than escalating the search into the bundle.
 
 ## Disambiguation — Apps vs Dashboards
 
@@ -168,7 +169,7 @@ To change any of these values, edit `uipath.json`.
 
 ## SDK Module Imports
 
-See [references/sdk/imports.md](references/sdk/imports.md) for the subpath ↔ class mapping, type import conventions, and anti-pattern examples. Core rules are listed under **Anti-patterns** below.
+See [references/sdk/imports.md](references/sdk/imports.md) for the lookup protocol (subpaths and classes are discovered from the installed package — `ls node_modules/@uipath/uipath-typescript/dist/`), type import conventions, and anti-pattern examples. Core rules are listed under **Anti-patterns** below.
 
 ## Key Concepts
 

package/skills/uipath-coded-apps/assets/templates/web-app-template.md

@@ -6,7 +6,7 @@ Ready-to-use boilerplate for a new UiPath Coded Web App (Vite + React + TypeScri
 
 Files are grouped below by path. When a file differs between the two paths, its variants appear as `Q6 = no (bare Tailwind)` / `Q6 = yes (apollo-wind)` subsections; a single block means the file is shared verbatim. The only real divergence is the component layer: Q6 = yes adds `@uipath/apollo-wind` components, Apollo design tokens, and a light/dark theme toggle; Q6 = no leaves bare Tailwind so you bring your own component library.
 
-The substitution table in [Step 4.5](../../references/create-web-app.md#45--write-project-files-from-templates) says which subsection to use per path.
+The substitution table in [Step 5.1](../../references/create-web-app.md#51--write-project-files-from-templates) says which subsection to use per path.
 
 ---
 

package/skills/uipath-coded-apps/references/create-web-app.md

@@ -2,32 +2,24 @@
 
 Scaffold a new UiPath Coded Web Application using Vite + React + TypeScript with the `@uipath/uipath-typescript` SDK.
 
+Order matters: the project is scaffolded and the SDK **installed before scopes are determined**, so the scope decision reads the per-method scope table shipped inside the installed package (version-exact) instead of relying on memorized tables.
+
 ## Pre-flight: Collect Required Information
 
 **CRITICAL: You do NOT know these values. You CANNOT infer or assume them. Ask the user and wait for their reply before writing any files.**
 
-### Step 1 — Determine required scopes first
-
-**Before asking the user any setup questions**, figure out what the app needs:
-
-1. From the user's **request**, identify which UiPath services the app will use (e.g., Entities, Tasks, Processes, Maestro, Conversational Agent, Buckets, etc.).
-2. Read [oauth-scopes.md](oauth-scopes.md) and collect the exact scopes required for every method those services expose.
-3. Compose the full deduplicated space-separated scopes string.
-
-You need these scopes **before** Step 2 so you can tell the user exactly what scopes to configure on their Client ID.
-
-### Step 2 — Ask the user for setup info
+### Step 1 — Ask the user for setup info
 
-Output the following text directly (replace `<scopes>` with the actual scopes from Step 1). **Do NOT call any tools yet — just output this text and wait for the user's reply.**
+Output the following text directly. **Do NOT call any tools yet — just output this text and wait for the user's reply.**
 
 ---
 
-Here's what your app needs:
-
-**OAuth scopes:** `<scopes>`
+Here's how OAuth will be set up:
 
 **Redirect URI:** `http://localhost:5173` (the local dev URL — stored as `redirectUri` in `uipath.json` and injected as the `uipath:redirect-uri` meta tag; the platform injects the production URI automatically at deploy)
 
+**OAuth scopes:** determined after the project is scaffolded — I'll read the exact per-method requirements from the installed SDK and configure them on the OAuth client in Step 4.
+
 Please answer these questions to continue:
 
 **1. App name** — lowercase kebab-case project folder name (e.g. `my-dashboard`)
@@ -41,9 +33,9 @@ Please answer these questions to continue:
 
 **4. Tenant name** — your UiPath tenant (often `DefaultTenant`)
 
-**5. Client ID** — do you have an existing OAuth External Application client ID with the scopes above?
-   - If yes, paste it
-   - If no, say **"create one"** and I'll create it via the `uip admin` CLI
+**5. Client ID** — do you have an existing OAuth External Application client ID you want to reuse?
+   - If yes, paste it — I'll tell you the exact scopes it needs (and can add missing ones via the `uip admin external-apps` CLI) once they're determined in Step 4
+   - If no, say **"create one"** and I'll set it up via the `uip admin external-apps` CLI with the right scopes
 
 **6. Default UI styling** — apply UiPath's Apollo Vertex design system (`@uipath/apollo-wind` components, semantic tokens, and a light/dark theme toggle out of the box)?
    - `yes` *(recommended)* — apollo-wind + `next-themes` on top of Tailwind: Apollo Vertex design system, light/dark theme toggle out of the box
@@ -53,37 +45,23 @@ Please answer these questions to continue:
 
 **Wait for the user's reply before proceeding.**
 
-### Step 2.5 — Create the External Application (only if user said "create one")
-
-Create it with the `uip admin external-apps` CLI — read [oauth-client-setup.md](oauth-client-setup.md) for prerequisites and full flags. Confirm `uip` is authenticated (`uip login status --output json`), then:
-
-```bash
-uip admin external-apps create "<app name>" \
-  --non-confidential \
-  --user-scope "<scopes from Step 1>" \
-  --redirect-uri "http://localhost:5173,http://localhost:5173/" \
-  --output json
-```
-
-Parse `id` from the response — that is the Client ID. If the CLI returns `403` (no admin permission) or can't authenticate, use the [Manual portal fallback](oauth-client-setup.md#manual-portal-fallback).
-
-### Step 3 — Resolve org name (if not provided)
+### Step 2 — Resolve org name (if not provided)
 
 If the user typed their org name, use it. If they said "find from browser", navigate to the UiPath cloud host for their environment and extract the org name from the URL path (first segment after the domain).
 
 ---
 
-## Step 4 — Scaffold the Project
+## Step 3 — Scaffold the Project
 
-Once you have all values (app name, org, tenant, client ID, environment, scopes), execute the steps below in order. All steps after Step 4.2 run from inside the new project directory.
+Once you have the answers (app name, environment, org, tenant, styling), execute the steps below in order. All steps after Step 3.2 run from inside the new project directory.
 
 > **Set `timeout: 300000`** (5 minutes) on every Bash call that runs `npm install` or `npm create vite` — these can take several minutes and the default 2-minute timeout is not enough.
 
-### 4.1 — Resolve the base URL
+### 3.1 — Resolve the base URL
 
-Map the `<environment>` answer from Step 2 to a base URL using the table in [SKILL.md](../SKILL.md) (Production → `https://api.uipath.com`, Staging → `https://staging.api.uipath.com`, Alpha → `https://alpha.api.uipath.com`). If the user gave a custom URL, use that verbatim. Store as `<base-url>`.
+Map the `<environment>` answer from Step 1 to a base URL using the table in [SKILL.md](../SKILL.md) (Production → `https://api.uipath.com`, Staging → `https://staging.api.uipath.com`, Alpha → `https://alpha.api.uipath.com`). If the user gave a custom URL, use that verbatim. Store as `<base-url>`.
 
-### 4.2 — Create the Vite project
+### 3.2 — Create the Vite project
 
 ```bash
 npx --yes create-vite@latest <app-name> --template react-ts
@@ -91,7 +69,7 @@ npx --yes create-vite@latest <app-name> --template react-ts
 
 Then `cd` into `<app-name>`. Every subsequent step runs from this directory.
 
-### 4.3 — Install dependencies
+### 3.3 — Install dependencies
 
 Run these as **separate commands** in order. The `--@uipath:registry` flag binds only to commands installing `@uipath/*` packages — do not apply it to the others, and do not run a bare `npm install` with the flag.
 
@@ -125,9 +103,9 @@ npm install -D tailwindcss@4 @tailwindcss/postcss postcss autoprefixer
 
 - **If `default styling = no`** — keep the SDK + Tailwind baseline above and bring your own component library. No extra dependencies needed.
 
-### 4.4 — Remove Vite defaults that will be overwritten
+### 3.4 — Remove Vite defaults that will be overwritten
 
-`npx create-vite` ships default versions of files we replace in Step 4.5. Delete them first so the Write tool can create them fresh — otherwise each Write requires a Read-first round-trip and produces a benign-but-noisy "Error writing file" message.
+`npx create-vite` ships default versions of files we replace in Step 5. Delete them first so the Write tool can create them fresh — otherwise each Write requires a Read-first round-trip and produces a benign-but-noisy "Error writing file" message.
 
 - **`default styling = yes`** — also overwrites `src/main.tsx` to wrap `<App>` in the theme provider:
 
@@ -141,7 +119,41 @@ npm install -D tailwindcss@4 @tailwindcss/postcss postcss autoprefixer
   rm vite.config.ts src/App.tsx src/index.css
   ```
 
-### 4.5 — Write project files from templates
+---
+
+## Step 4 — Determine Scopes & Configure the OAuth Client
+
+The SDK is now installed, so the version-exact scope reference is on disk.
+
+### 4.1 — Determine required scopes
+
+1. From the user's **request**, identify which UiPath services the app will use (e.g., Entities, Tasks, Processes, Maestro, Conversational Agent, Buckets, etc.).
+2. Start from the **Common Scope Bundles** table in [oauth-scopes.md](oauth-scopes.md) — bundles grant the service family, not just today's methods, so the app has headroom as it evolves.
+3. For services or methods outside the bundles — and to verify write/action methods — read the per-method table shipped in the package: `node_modules/@uipath/uipath-typescript/docs/oauth-scopes.md`. If the installed SDK predates that file, use the fallback in [oauth-scopes.md](oauth-scopes.md).
+4. If the app embeds a `@uipath/ui-widgets-*` component, add the widget scopes from [oauth-scopes.md](oauth-scopes.md) § Widgets.
+5. Compose the full deduplicated space-separated scopes string. Store as `<scopes>` — Step 5 writes it into `uipath.json`.
+
+### 4.2 — Create or verify the External Application
+
+**If the user said "create one":** create it with the `uip admin external-apps` CLI — read [oauth-client-setup.md](oauth-client-setup.md) for prerequisites and full flags. Confirm `uip` is authenticated (`uip login status --output json`), then:
+
+```bash
+uip admin external-apps create "<app name>" \
+  --non-confidential \
+  --user-scope "<scopes>" \
+  --redirect-uri "http://localhost:5173,http://localhost:5173/" \
+  --output json
+```
+
+Parse `id` from the response — that is the Client ID. If the CLI returns `403` (no admin permission) or can't authenticate, use the [Manual portal fallback](oauth-client-setup.md#manual-portal-fallback).
+
+**If the user pasted an existing Client ID:** show them `<scopes>` and ask whether the External Application already has all of them. If scopes are missing, offer to add them via the `add-scopes` operation in [oauth-client-setup.md](oauth-client-setup.md), or let the user update the app manually. A missing scope at the External Application means the token request is rejected entirely; a scope granted to the app but missing from `uipath.json` causes silent `401`/`403` on first call.
+
+---
+
+## Step 5 — Write Project Files
+
+### 5.1 — Write project files from templates
 
 All file content lives in [../assets/templates/web-app-template.md](../assets/templates/web-app-template.md). For each row below, copy the named section from that file verbatim into the path shown, applying the listed substitutions. Create `src/hooks/` first; the rest of the directories already exist from `create-vite`.
 
@@ -160,13 +172,13 @@ All file content lives in [../assets/templates/web-app-template.md](../assets/te
 
 > **No `tailwind.config.js` on either path** — Tailwind configuration lives directly in `src/index.css`. No `.env` file either — `uipath.json` (committed) is the single config source for the SDK.
 
-### 4.6 — `.gitignore`
+### 5.2 — `.gitignore`
 
 Neither path writes a `.env`, and `uipath.json` is committed (it holds the SDK config — a public OAuth client ID plus org/tenant/base-URL/redirect-URI, no secrets), so no `.gitignore` change is needed for OAuth config. The project `.uipath/` directory created by `codedapp` commands must stay gitignored — it is covered by `npx create-vite`'s default plus `uip codedapp`'s conventions. Verify with `cat .gitignore | grep -i uipath` and add `.uipath/` if missing.
 
-### 4.7 — Verify the scaffold
+### 5.3 — Verify the scaffold
 
-First, confirm all expected files for your Q6 branch exist. If any are missing, re-run the corresponding row from Step 4.5.
+First, confirm all expected files for your Q6 branch exist. If any are missing, re-run the corresponding row from Step 5.1.
 
 - **`default styling = yes`:** `vite.config.ts`, `uipath.json`, `postcss.config.js`, `src/index.css`, `src/hooks/useAuth.tsx`, `src/components/Theme.tsx`, `src/main.tsx`, `src/App.tsx`
 - **`default styling = no`:** `vite.config.ts`, `uipath.json`, `postcss.config.js`, `src/index.css`, `src/hooks/useAuth.tsx`, `src/App.tsx`
@@ -195,7 +207,7 @@ const { sdk } = useAuth();
 export const assets = new Assets(sdk);
 ```
 
-See the **SDK Module Imports** table in `SKILL.md` for all subpath imports. The `useAuth` hook implementation and the SDK methods it uses internally are documented in the `## src/hooks/useAuth.tsx` section of [../assets/templates/web-app-template.md](../assets/templates/web-app-template.md).
+Subpaths and classes are discovered from the installed package — see the lookup protocol in [sdk/imports.md](sdk/imports.md). The `useAuth` hook implementation and the SDK methods it uses internally are documented in the `## src/hooks/useAuth.tsx` section of [../assets/templates/web-app-template.md](../assets/templates/web-app-template.md).
 
 ---
 
@@ -211,9 +223,9 @@ const items = await assets.getAll({ folderId: 123 }); // replace 123 with your O
 const records = await entities.getAllRecords('<entity-id>'); // entity ID is a UUID — look it up via entities.getAll() or the Data Fabric portal (not the friendly name)
 ```
 
-See [oauth-scopes.md](oauth-scopes.md) for the full list of methods and their required scopes.
+Method signatures come from the installed types (`node_modules/@uipath/uipath-typescript/dist/<subpath>/index.d.ts`); per-method scopes from the shipped `node_modules/@uipath/uipath-typescript/docs/oauth-scopes.md` — see [oauth-scopes.md](oauth-scopes.md) for bundles and the lookup protocol.
 
-If the user wants a **Document Understanding validation UI** (review/correct extraction results), embed the Validation Station widget — see [widgets/validation-station.md](widgets/validation-station.md). Required scope: `OR.Buckets` (plus `OR.Tasks` if the widget completes an Action Center task on save). Add to the `scope` field in `uipath.json` during scaffold (Step 1).
+If the user wants a **Document Understanding validation UI** (review/correct extraction results), embed the Validation Station widget — see [widgets/validation-station.md](widgets/validation-station.md). Required scope: `OR.Buckets` (plus `OR.Tasks` if the widget completes an Action Center task on save). Add to the `scope` field in `uipath.json` during Step 4.
 
 When implementing specific SDK services, read the corresponding reference:
 

package/skills/uipath-coded-apps/references/dashboards/CAPABILITY.md

@@ -49,7 +49,7 @@ Fire all of these simultaneously. Use multiple tool calls in one response — do
 | `references/dashboards/aesthetic/layout-patterns.md` *(from skill root)* | Layout rules |
 | `references/dashboards/aesthetic/charting.md` *(from skill root)* | Chart-type selection, colour tokens, delta polarity |
 | `assets/scripts/dashboards/capability-registry.json` *(from skill root)* | Metric catalog (T1/T2 display hints) |
-| `references/sdk/agents.md` *(from skill root)* | Agents + Agent Memory (Insights RTM, SDK ≥ 1.4.1) — validate agent/memory metrics |
+| `references/sdk/agents.md` *(from skill root)* | Agents + Agent Memory (Insights RTM) — validate agent/memory metrics |
 | `references/sdk/orchestrator.md` *(from skill root)* | Jobs/Queues/Processes methods — validate job/process metrics |
 
 **Conditional reads (add to the same parallel message if the request mentions these):**
@@ -60,7 +60,7 @@ Fire all of these simultaneously. Use multiple tool calls in one response — do
 | cases, process instances, Maestro, SLA, top/slowest/failing processes or cases, element stats | `references/sdk/maestro.md` *(from skill root)* |
 | traces, spans, trace-level errors/latency/units | `references/sdk/traces.md` *(from skill root)* |
 | governance, policy, compliance, denials, blocked actions, allow/deny, enforcement | `references/sdk/governance.md` *(from skill root)* — Insights-API governance (`policy-denials`, `governance-verdicts`) |
-| **EXPLICIT runtime compliance / a standard or pack / ISO clause / "rule(s) violated"** (agent runs checked against standards) | `references/sdk/governance-traces.md` *(from skill root)* — gated, org-admin (`AgentTraces` governance decisions, SDK ≥ 1.5.1). Generic "governance/policy" stays on the row above |
+| **EXPLICIT runtime compliance / a standard or pack / ISO clause / "rule(s) violated"** (agent runs checked against standards) | `references/sdk/governance-traces.md` *(from skill root)* — gated, org-admin (`AgentTraces` governance decisions). Generic "governance/policy" stays on the row above |
 
 **1 blocking command (instant, local — routes build vs edit, so the plan needs it):**
 

package/skills/uipath-coded-apps/references/dashboards/plugins/build/impl.md

@@ -87,7 +87,7 @@ The plan message ends there — no OAuth talk in the plan, no tool calls in the
 > views) when the prompt signals runtime-governance intent — "governance/policy violation(s)", "compliance",
 > a standard/pack reference (`ISO 42001`, `A.8.4`, "standard", "pack"), or runtime-governance terms. Then read
 > `sdk/governance-traces.md` and build the modules on `AgentTraces.getGovernanceDecisions` /
-> `getGovernanceSummary` (SDK ≥ 1.5.1). NEVER add them to a plain agent-health/ops dashboard. They need an
+> `getGovernanceSummary`. NEVER add them to a plain agent-health/ops dashboard. They need an
 > **org-admin** caller — a 403 means the user's account lacks governance access (say so; the rest of the
 > dashboard still builds). Widgets honor the dashboard time range like any other metric.
 
@@ -275,7 +275,7 @@ If both fail: direct the user to `<CLOUD_URL>/<ORG>/portal_/adminui/#/externalAp
 
 **The build subagent (Phase 4) authors these modules and applies this check — it is NOT done in the main thread.** When the subagent writes each `metrics/<name>.ts` from the SDK references, it cross-checks every one against the **Example response** and **semantics notes** in the relevant `references/sdk/*.md` file (already loaded in the parallel blast). For each metric, confirm:
 
-1. **The field you filter or read on appears in the example response** — with the value you expect. Not just "the field exists in the type" (both `sourceType` and `packageType` exist) — the example shows the real *value*. **Appearing in the response does NOT make a field filterable**: mapped fields like `processName` are read-only and throw `Invalid OData query options` in a `$filter` (see `orchestrator.md § Filterable vs read-only Job fields`). Filter only on documented raw fields and match mapped fields client-side.
+1. **The field you filter or read on appears in the example response** — with the value you expect. Not just "the field exists in the type" (both `sourceType` and `packageType` exist) — the example shows the real *value*. SDK field names work in `$filter`/`orderby` (the SDK rewrites them to API names — see `orchestrator.md § OData filter field names`); `folderId` is header-scoped, never a `$filter` field, and there is no server-side name filter — match `processName` client-side.
 2. **No semantics note warns against your choice.** The references flag the traps types can't express.
 3. **Your return shape matches the example** — `.items` vs `.data` vs a top-level array, and the exact field names you map to `xKey`/`yKey`/columns.
 4. **Table column keys match the return shape.** For a `data-table`/`ranked-table`, every `columns`/`columnDefs` key must be a field your module actually returns per row — a key with no matching field renders an empty `—` column. Tables use `columns`/`columnDefs` (NOT `detailColumns`, which only feeds chart drill-down views); a T3 table with no columns is rejected by the build.

package/skills/uipath-coded-apps/references/dashboards/primitives/tier-resolution.md

@@ -106,19 +106,19 @@ The build type-checks all `metrics/*.ts` modules in isolation (Stage A) before g
 
 The registry entry describes the metric and expected SDK call. Use it as your guide, then write the correct `metrics/<name>.ts` module from the SDK documentation.
 
-| Metric name | What it shows | Registry template | SDK hint (≥ 1.4.1) |
+| Metric name | What it shows | Registry template | SDK hint |
 |-------------|--------------|-------------------|--------------------|
 | `active-agents-kpi` | Count of active agents | `kpi-card` | `Agents.getAll(start, end)` → `{ items }`; return `[{ count: items.length }]` |
-| `agent-consumption` | Agents ranked by AGU/PLTU | `ranked-table` | **(≥1.5.0)** `Agents.getTopConsumption(start, end, { limit: 10 })` → `{ agents: [{ agentName, consumedAGUQuantity, consumedPLTUQuantity }] }`; module returns `.agents` |
+| `agent-consumption` | Agents ranked by AGU/PLTU | `ranked-table` | `Agents.getTopConsumption(start, end, { limit: 10 })` → `{ agents: [{ agentName, consumedAGUQuantity, consumedPLTUQuantity }] }`; module returns `.agents` |
 | `agent-health` | Agents ranked by health score | `ranked-table` | `Agents.getAll(start, end, { orderBy: { column: AgentListSortColumn.HealthScore } })` → `{ items }` (healthScore 0–100, lastIncidentType) |
 | `agent-error-timeline` | Agent errors over time | `area-chart` | `Agents.getErrorsTimeline(start, end)` → BARE `[{ name, value, date }]`; module sums `value` per `date` |
 | `agent-latency-timeline` | P50/P95 latency over time | `multi-line-chart` | `Agents.getLatencyTimeline(start, end)` → BARE `[{ name:'P50'\|'P95', value (ms), date }]`; module pivots to `[{ date, P50, P95 }]` |
 | `agent-consumption-timeline` | AGU consumed over time | `area-chart` | `Agents.getConsumptionTimeline(start, end)` → BARE `[{ timeSlice, aguConsumption }]` (native shape) |
 | `agent-errors` | Error classes ranked | `ranked-table` | `Agents.getErrors(start, end, { orderBy: { column: AgentErrorSortColumn.ExecutionCount, desc: true } })` → `{ items }` |
-| `agents-by-errors` | Agents ranked by error count | `ranked-table` | **(≥1.5.0)** `Agents.getTopErrorCount(start, end, { limit: 10 })` → `{ data: [{ name, count }] }`; module returns `data.map(a => ({ name: a.name, value: a.count }))` |
-| `agent-incident-distribution` | Errors vs escalations vs policy | `donut-chart` | **(≥1.5.0)** `Agents.getIncidentDistribution(start, end)` → `{ errorCount, escalationCount, policyCount }`; module → 3 `[{ name, value }]` rows |
-| `agent-success-rate` | Job success rate + delta | `kpi-card` | **(≥1.5.0)** `Agents.getSummary(start, end, { lookbackPeriodAnalysis: true })`; return `[{ value: currentPeriodSummary.successRate, previous: lookbackPeriodSummary?.successRate }]` |
-| `agent-unit-consumption-summary` | Total AGU consumed + delta | `kpi-card` | **(≥1.5.0)** `Agents.getUnitConsumptionSummary(start, end, { lookbackPeriodAnalysis: true })`; sum `totalAgentUnitConsumption.{completeJobs,incompleteJobs}` for value + previous |
+| `agents-by-errors` | Agents ranked by error count | `ranked-table` | `Agents.getTopErrorCount(start, end, { limit: 10 })` → `{ data: [{ name, count }] }`; module returns `data.map(a => ({ name: a.name, value: a.count }))` |
+| `agent-incident-distribution` | Errors vs escalations vs policy | `donut-chart` | `Agents.getIncidentDistribution(start, end)` → `{ errorCount, escalationCount, policyCount }`; module → 3 `[{ name, value }]` rows |
+| `agent-success-rate` | Job success rate + delta | `kpi-card` | `Agents.getSummary(start, end, { lookbackPeriodAnalysis: true })`; return `[{ value: currentPeriodSummary.successRate, previous: lookbackPeriodSummary?.successRate }]` |
+| `agent-unit-consumption-summary` | Total AGU consumed + delta | `kpi-card` | `Agents.getUnitConsumptionSummary(start, end, { lookbackPeriodAnalysis: true })`; sum `totalAgentUnitConsumption.{completeJobs,incompleteJobs}` for value + previous |
 | `trace-error-timeline` | Trace errors over time | `area-chart` | `AgentTraces.getErrorsTimeline({ startTime, endTime })` → BARE `[{ name, value, date }]` (see `sdk/traces.md`) |
 | `trace-latency-timeline` | Trace latency over time | `area-chart` | `AgentTraces.getLatencyTimeline({ startTime, endTime })` → BARE `[{ name, value (s), date }]`; module averages per date |
 | `agent-unit-consumption` | AGU/PLTU per agent | `ranked-table` | `AgentTraces.getUnitConsumption({ startTime, endTime })` → BARE `[{ agentId, agentUnitsConsumed, platformUnitsConsumed }]` |
@@ -396,7 +396,7 @@ export const fetchDetail: MetricFn = async (sdk) => {
 A dedicated capability for **agent governance/compliance violations against standards** (catalog keys
 `agent-governance-violations`, `violations-by-standard`, `violations-by-rule`, `violations-by-hook`,
 `matched-rules-by-action`, `agents-by-violations`, `recent-violations`, `agent-compliance-report`,
-`rule-evaluations-by-outcome`, `rule-evaluations-by-hook`, `rule-compliance`). Backed by the SDK ≥ 1.5.1
+`rule-evaluations-by-outcome`, `rule-evaluations-by-hook`, `rule-compliance`). Backed by the SDK
 Insights endpoints `AgentTraces.getGovernanceDecisions` / `getGovernanceSummary` — full contract + module
 patterns in [`sdk/governance-traces.md`](../../sdk/governance-traces.md). **Org-admin required** (403 for
 other callers — surface it, EmptyState the widget, build the rest). Widgets honor the dashboard time range
@@ -429,11 +429,11 @@ EmptyState when the window has no governance data — un-instrumented agents mus
 
 ## T0 — Hard Refuse
 
-**Refuse ONLY the specific metric — not the whole dashboard.** Always offer an alternative.
+**Refuse ONLY the specific metric — not the whole dashboard.** Always offer an alternative. **"No direct endpoint" ≠ "impossible": if the alternative is a metric you can derive from a read method (e.g. a Jobs trend), BUILD that widget — do not drop it.** Only rows whose alternative is a genuinely *different* metric (cost, RAM, …) are true refusals.
 
 | User asks for | Why impossible | Suggest instead |
 |--------------|----------------|-----------------|
-| Agent **invocation-count** timeline (runs/calls per period) | SDK 1.5.0 has error/latency/consumption timelines but no invocation-count endpoint | `agent-consumption-timeline` (AGU over time), `agent-error-timeline`, or T3 Jobs trend with `ProcessType eq 'Agent'` |
+| Agent **invocation volume / count over time** (runs/calls per period) | SDK 1.5.0 has error/latency/consumption timelines but no invocation-count endpoint | **Not a refusal — BUILD it** as a T3 Jobs trend: `new Jobs(sdk).getAll({ filter: "ProcessType eq 'Agent'" })` bucketed by period. Agent job runs ARE agent invocations, so this answers the ask; do NOT omit the widget. (Use `agent-consumption-timeline`/`agent-error-timeline` only if the user specifically wants AGU/errors.) |
 | Agent cost in dollars | Platform tracks AGU/PLTU units, not currency | `agent-consumption` for per-agent unit totals |
 | CPU/RAM per agent | Not exposed by any API ("Agent Memory" = memory entries, not RAM) | `agent-health`; or `agent-memory-timeline` if they meant the Memory feature |
 | Who triggered a job | Job records have no end-user identity | `job-completion-trend` grouped by process; `policy-denials` includes `actorIdentityId` for governance events |
@@ -448,10 +448,10 @@ Full method signatures, response types, and field names live in `references/sdk/
 
 | Domain | Reference file | Key service classes |
 |--------|---------------|---------------------|
-| Agents + Agent Memory (Insights RTM, ≥ 1.4.1) | `sdk/agents.md` *(from skill root)* | `Agents`, `AgentMemory` |
-| Agent Traces (Insights RTM, ≥ 1.4.1) | `sdk/traces.md` *(from skill root)* | `AgentTraces` |
-| Governance (Insights RTM, ≥ 1.4.1) | `sdk/governance.md` *(from skill root)* | `Governance` |
-| Agent runtime-governance decisions (GATED, org-admin, ≥ 1.5.1) | `sdk/governance-traces.md` *(from skill root)* | `AgentTraces.getGovernanceDecisions` / `getGovernanceSummary` |
+| Agents + Agent Memory (Insights RTM) | `sdk/agents.md` *(from skill root)* | `Agents`, `AgentMemory` |
+| Agent Traces (Insights RTM) | `sdk/traces.md` *(from skill root)* | `AgentTraces` |
+| Governance (Insights RTM) | `sdk/governance.md` *(from skill root)* | `Governance` |
+| Agent runtime-governance decisions (GATED, org-admin) | `sdk/governance-traces.md` *(from skill root)* | `AgentTraces.getGovernanceDecisions` / `getGovernanceSummary` |
 | Jobs, Queues, Processes, Assets | `sdk/orchestrator.md` *(from skill root)* | `Jobs`, `Queues`, `Processes`, `Assets` |
 | Tasks | `sdk/action-center.md` *(from skill root)* | `Tasks` |
 | Cases, Process Instances, Maestro Insights/SLA | `sdk/maestro.md` *(from skill root)* | `Cases`, `CaseInstances`, `MaestroProcesses` |
@@ -461,14 +461,14 @@ Full method signatures, response types, and field names live in `references/sdk/
 
 **Calling conventions — don't mix them up:**
 - `Agents.getAll / getErrors / getErrorsTimeline / getConsumptionTimeline / getLatencyTimeline(startTime, endTime, options?)` — positional `Date` args. `getAll`/`getErrors` return rows on `.items`; the three timeline methods return a **bare array**
-- **(≥1.5.0)** `Agents.getSummary / getTopErrorCount / getTopConsumption / getIncidentDistribution / getUnitConsumptionSummary(startTime, endTime, options?)` — positional `Date` args; see `sdk/agents.md § Insights aggregates`. `getSummary` / `getUnitConsumptionSummary` accept `{ lookbackPeriodAnalysis: true }` to return the prior window for a delta in ONE call
+- `Agents.getSummary / getTopErrorCount / getTopConsumption / getIncidentDistribution / getUnitConsumptionSummary(startTime, endTime, options?)` — positional `Date` args; see `sdk/agents.md § Insights aggregates`. `getSummary` / `getUnitConsumptionSummary` accept `{ lookbackPeriodAnalysis: true }` to return the prior window for a delta in ONE call
 - `AgentTraces.getErrorsTimeline / getLatencyTimeline / getUnitConsumption({ startTime?, endTime?, … })` — ONE options object, dates inside, returns a **bare array** (see `sdk/traces.md`)
 - `AgentMemory.getTimeline({ startTime?, endTime?, … })` — ONE options object, dates inside, returns a **bare array**
 - `Governance.getPolicyTraces(startTime, options?)` — required positional `startTime`, rest in options, rows on `.items`; `getOperationSummary` returns a **single object** (wrap into rows in the module)
-- **(≥1.5.1)** `AgentTraces.getGovernanceDecisions(startTime, options?)` — required positional `startTime`, rows on `.items`, paginated; `AgentTraces.getGovernanceSummary(startTime, options?)` — returns a **single object** (`byAction`/`byMode` empty unless `sections` opts in). Both org-admin (see `sdk/governance-traces.md`)
+- `AgentTraces.getGovernanceDecisions(startTime, options?)` — required positional `startTime`, rows on `.items`, paginated; `AgentTraces.getGovernanceSummary(startTime, options?)` — returns a **single object** (`byAction`/`byMode` empty unless `sections` opts in). Both org-admin (see `sdk/governance-traces.md`)
 - `Cases` / `MaestroProcesses.getTopRunCount / getTopFaultedCount / getTopExecutionDuration / getTopElementFailedCount / getInstanceStatusTimeline(start, end, options?)` — positional `Date`s, **bare array**; `getElementStats(processKey, packageId, start, end, version)` all positional, bare array (see `sdk/maestro.md`)
 - `CaseInstances.getSlaSummary({ startTimeUtc?, endTimeUtc?, … })` — options object, rows on `.items`; `getStagesSlaSummary(options?)` — **bare array**. SLA methods need `PIMS` on top of the Insights scopes
 
 **Non-Insights services:** access items via `result?.items ?? result?.value ?? []`
 
-**OData filters (≥1.5.0):** `filter` / `orderby` / `select` / `expand` now accept **SDK field names** (the camelCase TS property names, e.g. `processType`, `state`) in addition to the wire/API names (`ProcessType`, `State`). Existing wire-name filters like `"ProcessType eq 'Agent'"` / `"State eq 'Faulted'"` still work — no migration needed; prefer whichever reads clearer.
+**OData filters:** `filter` / `orderby` / `select` / `expand` now accept **SDK field names** (the camelCase TS property names, e.g. `processType`, `state`) in addition to the wire/API names (`ProcessType`, `State`). Existing wire-name filters like `"ProcessType eq 'Agent'"` / `"State eq 'Faulted'"` still work — no migration needed; prefer whichever reads clearer.