@uipath/solution-tool 1.202.0 → 1.203.0-preview.160

package/dist/{packager-tool-w1dzcj31.js → packager-tool-cvfbzs9p.js}

@@ -1,7 +1,7 @@
 import {
   getStudioWebAuthWithOrganizationId,
   useStudioWebAuth
-} from "./packager-tool-pbmpgz04.js";
+} from "./packager-tool-1haahq17.js";
 import {
   activateDeploymentAsync,
   deployRunAsync,
@@ -11,11 +11,11 @@ import {
   listPackagesAsync,
   uninstallDeploymentAsync,
   upgradeDeploymentAsync
-} from "./packager-tool-mcpzmn0v.js";
+} from "./packager-tool-rc5pcf2n.js";
 import {
   SolutionInitError,
   solutionInitAsync
-} from "./packager-tool-pw7v82j2.js";
+} from "./packager-tool-vas0xg5h.js";
 import {
   GOVERNANCE_OPTION_INSTRUCTIONS,
   PackCommandService,
@@ -24,16 +24,22 @@ import {
   applyAuthConnection,
   checkSolutionPathAsync,
   createSolutionPackager,
-  ensurePackagerTools,
-  isUnpackableProjectTypeError,
   packSolutionAsync,
   readSolutionFileAsUint8Array,
   resolveSdkLogLevel,
   validateGovernanceOptions
-} from "./packager-tool-bme8epz8.js";
+} from "./packager-tool-n4nfqj99.js";
+import {
+  prepareSolutionResources
+} from "./packager-tool-7znqtw3f.js";
+import {
+  ensurePackagerTools,
+  isUnpackableProjectTypeError,
+  toolVerbForProjectType
+} from "./packager-tool-k4mskzww.js";
 import {
   publishSolutionAsync
-} from "./packager-tool-pyygbnp2.js";
+} from "./packager-tool-htag6yh5.js";
 import {
   Configuration,
   PipelinesApi,
@@ -41,7 +47,7 @@ import {
   feedScopeInitOverride,
   listSelectablePublishLocations,
   resolveFeedScope
-} from "./packager-tool-5518wy6n.js";
+} from "./packager-tool-cp07fhx3.js";
 import {
   Configuration as Configuration2,
   DeploymentActivationStatus,
@@ -59,7 +65,7 @@ import {
   overwriteSolution,
   searchPackageVersions,
   solutionExistsOnStudioWeb
-} from "./packager-tool-vfcht7hq.js";
+} from "./packager-tool-mj5p341c.js";
 import {
   Tokens,
   applyEntryPointEnhancementAsync,
@@ -71,25 +77,35 @@ import {
   findMatchingLocalResource,
   findProjectFile,
   findResourceByKeyInRcs,
+  hasAnyTemplateRow,
+  hasBareTemplateRow,
   isMissingProjectTypeError,
   isProjectManifestError,
   normalizeFolderPath,
+  normalizeResourceFileCasing,
   readProjectFile,
   readSolutionFile,
   resolveSolutionFilePath,
   resourceRefreshAsync,
+  resourceRemoteSyncAsync,
   restoreSolutionFile,
+  saveCasingNormalized,
   searchRcsResources,
-  syncAndLog,
   syncResourcesFromBindings,
   writeSolutionFile
-} from "./packager-tool-bt0z25tw.js";
+} from "./packager-tool-bkwnetqn.js";
 import {
   ToolResult
 } from "./packager-tool-nzghfa48.js";
 import {
   getSolutionAuthContext
-} from "./packager-tool-rbrcxjch.js";
+} from "./packager-tool-2syrt51a.js";
+import {
+  getLoginStatusAsync,
+  resolveSolutionDir,
+  toPortableRelativePath,
+  updateUipxSolutionId
+} from "./packager-tool-3jrq7smt.js";
 import {
   DEFAULT_PAGE_SIZE,
   Option,
@@ -97,13 +113,13 @@ import {
   Pagination,
   PollOutcome,
   RESULTS,
+  carriedErrorCode,
   carriedInstructions,
   catchError,
   createHiddenDeprecatedTenantOption,
   extractErrorDetails,
   extractErrorMessage,
   getFileSystem,
-  getLoginStatusAsync,
   isGuid,
   isPreviewBuild,
   logger,
@@ -115,14 +131,13 @@ import {
   processContext,
   registerPackageMetadataOptions,
   requireConfirmation,
+  resolveDeprecatedOptionAlias,
   resolveEnvReference,
-  resolveSolutionDir,
-  toPortableRelativePath,
   trackShipSucceeded,
   unsupportedSolutionProjectType,
-  updateUipxSolutionId,
+  warnDeprecatedOptionAlias,
   withCompleter
-} from "./packager-tool-fjjh5veg.js";
+} from "./packager-tool-0f0wt9vh.js";
 import {
   strFromU8,
   unzip,
@@ -134,8 +149,9 @@ import {
 // package.json
 var package_default = {
   name: "@uipath/solution-tool",
+  author: "UiPath",
   license: "SEE LICENSE IN LICENSE.txt",
-  version: "1.202.0",
+  version: "1.203.0-preview.160",
   description: "Create, pack, publish, and deploy UiPath Automation Solutions.",
   repository: {
     type: "git",
@@ -198,7 +214,7 @@ var package_default = {
     "@uipath/packager-tool-connector": "workspace:*",
     "@uipath/pipelines-sdk": "workspace:*",
     "@uipath/project-executor": "workspace:*",
-    "@uipath/resource-builder-sdk": "^2025.11.0-alpha4202-3459",
+    "@uipath/resource-builder-sdk": "2025.11.0-alpha5891-4020",
     "@uipath/resource-builder-tool": "2025.11.0-alpha4535-3530",
     "@uipath/solution-packager": "workspace:*",
     "@uipath/solution-sdk": "workspace:*",
@@ -1634,8 +1650,8 @@ async function writeMissingBriefingFilesAsync(solutionDir) {
   return written;
 }
 
-// src/services/archive-extract.ts
-function resolveZipEntryPath(fs, destinationDir, entryName) {
+// ../common/src/zip.ts
+function resolveZipEntryPath(fs, root, entryName) {
   if (entryName.includes("\x00")) {
     throw new Error(`Invalid zip entry path: ${entryName}`);
   }
@@ -1643,24 +1659,51 @@ function resolveZipEntryPath(fs, destinationDir, entryName) {
   if (normalizedEntry.startsWith("/")) {
     throw new Error(`Unsafe absolute zip entry path: ${entryName}`);
   }
-  const root = fs.path.resolve(destinationDir);
   const target = fs.path.resolve(root, normalizedEntry);
-  const relative = fs.path.relative(root, target);
-  if (relative.startsWith("..") || fs.path.isAbsolute(relative)) {
+  if (!isUnder(fs, root, target)) {
     throw new Error(`Unsafe zip entry path: ${entryName}`);
   }
   return target;
 }
+function isUnder(fs, root, path) {
+  const relative = fs.path.relative(root, path);
+  return relative === "" || !relative.startsWith("..") && !fs.path.isAbsolute(relative);
+}
+async function assertNoEscapeThroughSymlink(fs, lexicalRoot, realRoot, path, entryName) {
+  const resolved = await fs.realpath(path);
+  if (isUnder(fs, realRoot, resolved) || isUnder(fs, lexicalRoot, resolved)) {
+    return;
+  }
+  throw new Error(`Unsafe zip entry path (escapes via a symlink at the destination): ${entryName}`);
+}
+async function mkdirUnderRoot(fs, lexicalRoot, realRoot, dir, entryName) {
+  const relative = fs.path.relative(lexicalRoot, dir);
+  if (relative === "") {
+    return;
+  }
+  let current = lexicalRoot;
+  for (const segment of relative.split(/[\\/]/)) {
+    if (segment === "") {
+      continue;
+    }
+    current = fs.path.join(current, segment);
+    await fs.mkdir(current);
+    await assertNoEscapeThroughSymlink(fs, lexicalRoot, realRoot, current, entryName);
+  }
+}
 async function extractZipDataToDir(fs, zipData, destinationDir) {
   await fs.mkdir(destinationDir);
+  const lexicalRoot = fs.path.resolve(destinationDir);
+  const realRoot = await fs.realpath(lexicalRoot);
   const entries = unzipSync(zipData);
   for (const [entryName, content] of Object.entries(entries)) {
-    const target = resolveZipEntryPath(fs, destinationDir, entryName);
+    const target = resolveZipEntryPath(fs, lexicalRoot, entryName);
     if (entryName.endsWith("/")) {
-      await fs.mkdir(target);
+      await mkdirUnderRoot(fs, lexicalRoot, realRoot, target, entryName);
       continue;
     }
-    await fs.mkdir(fs.path.dirname(target));
+    await mkdirUnderRoot(fs, lexicalRoot, realRoot, fs.path.dirname(target), entryName);
+    await assertNoEscapeThroughSymlink(fs, lexicalRoot, realRoot, target, entryName);
     await fs.writeFile(target, content);
   }
 }
@@ -1672,6 +1715,8 @@ async function extractArchive(archivePath, destinationDir) {
   }
   await extractZipDataToDir(fs, data, destinationDir);
 }
+
+// src/services/archive-extract.ts
 var SOLUTION_STORAGE_ENTRY = "SolutionStorage.json";
 function isRootUipxEntry(name) {
   return !name.includes("/") && name.endsWith(".uipx");
@@ -1987,7 +2032,7 @@ var SOLUTION_PACK_EXAMPLES = [
   },
   {
     Description: "Analyze the RPA projects against the governance policy published in AutomationOps for the signed-in tenant. The value is the product whose policy is downloaded — pass StudioWeb for the default one.",
-    Command: "uip solution pack ./my-solution ./dist --version 1.2.0 --automation-ops-profile Development",
+    Command: "uip solution pack ./my-solution ./dist --version 1.2.0 --governance-product Development",
     Output: {
       Code: "SolutionPack",
       Data: {
@@ -1998,7 +2043,7 @@ var SOLUTION_PACK_EXAMPLES = [
   }
 ];
 var registerPackCommand = (program) => {
-  const command = program.command("pack").description("Pack a UiPath solution into a deployable .zip package. Accepts a solution directory (containing .uipx) or a .uis file. Output is used with 'solution publish' to upload to UiPath. Pass --dry-run to check that the solution packs without producing a package.").argument("<solutionPath>", "Path to a solution directory (containing .uipx) or a .uis file").argument("[output-path]", "Output directory where the packed solution will be saved. Required unless --dry-run is set.").option("-n, --name <name>", "Package name (default: solution folder name or .uis file name)").option("-v, --version <version>", "Package version (default: 1.0.0)", "1.0.0").option("--nuget-sources-config-path <path>", "Path to NuGet sources configuration file").option("--exclude-configured-sources", "Resolve project dependencies only from the tenant feeds and any --nuget-sources-config-path. Drops the built-in UiPath and nuget.org feeds, so a dependency that is not on those feeds fails to restore.").option("--feed-folder <name>", "Resolve project dependencies from this Orchestrator folder's library feed instead of every tenant feed. Accepts a folder name or fully qualified path.").option("--signing-certificate-path <path>", "Path to .pfx certificate file used to sign each packed project .nupkg").option("--signing-certificate-password <password>", "Certificate password. Use env.ENV_NAME to read from an environment variable.").option("--signing-timestamp-server <url>", "Timestamp server URL").option("--skip-analyze", "Skip the workflow analyzer for every RPA project in the solution. Compilation and validation still run.").addOption(new Option("--governance-file-path <path>", "Analyze every RPA project against this local governance policy file, instead of the analyzer rules shipped with the WorkflowCompiler.").conflicts("automationOpsProfile")).addOption(new Option("--automation-ops-profile <profile>", "Analyze every RPA project against the governance policy published in AutomationOps for the signed-in tenant. The value is the product whose policy is downloaded, e.g. StudioWeb, Development, Business. Mutually exclusive with --governance-file-path.").conflicts("governanceFilePath"));
+  const command = program.command("pack").description("Pack a UiPath solution into a deployable .zip package. Accepts a solution directory (containing .uipx) or a .uis file. Output is used with 'solution publish' to upload to UiPath. Pass --dry-run to check that the solution packs without producing a package.").argument("<solutionPath>", "Path to a solution directory (containing .uipx) or a .uis file").argument("[output-path]", "Output directory where the packed solution will be saved. Required unless --dry-run is set.").option("-n, --name <name>", "Package name (default: solution folder name or .uis file name)").option("-v, --version <version>", "Package version (default: 1.0.0)", "1.0.0").option("--nuget-sources-config-path <path>", "Path to NuGet sources configuration file").option("--exclude-configured-sources", "Resolve project dependencies only from the tenant feeds and any --nuget-sources-config-path. Drops the built-in UiPath and nuget.org feeds, so a dependency that is not on those feeds fails to restore.").option("--feed-folder <name>", "Resolve project dependencies from this Orchestrator folder's library feed instead of every tenant feed. Accepts a folder name or fully qualified path.").option("--signing-certificate-path <path>", "Path to .pfx certificate file used to sign each packed project .nupkg").option("--signing-certificate-password <password>", "Certificate password. Use env.ENV_NAME to read from an environment variable.").option("--signing-timestamp-server <url>", "Timestamp server URL").option("--skip-analyze", "Skip the workflow analyzer for every RPA project in the solution. Compilation and validation still run.").option("--governance-file-path <path>", "Analyze every RPA project against this local governance policy file, instead of the analyzer rules shipped with the WorkflowCompiler. When you are signed in the tenant is asked first — about StudioWeb unless --governance-product names another product — and this file is refused if the tenant publishes a policy of its own.").option("--governance-product <product>", "Analyze every RPA project against the governance policy published in AutomationOps for the signed-in tenant. The value is the product whose policy is downloaded, e.g. StudioWeb, Development, Business.").addOption(new Option("--automation-ops-profile <profile>").hideHelp());
   registerPackageMetadataOptions(command).option("--login-validity <minutes>", "Minimum minutes before token expiration to trigger a refresh (default: 10)", parseInt, 10).option("--dry-run", "Run the full pack pipeline against a temporary directory and discard the output. Catches pack-time failures; does not inspect the produced package contents.").examples(SOLUTION_PACK_EXAMPLES).trackedAction(processContext, async (solutionPath, outputPath, options) => {
     if (!options.dryRun && outputPath === undefined) {
       OutputFormatter.error({
@@ -2009,9 +2054,27 @@ var registerPackCommand = (program) => {
       processContext.exit(1);
       return;
     }
+    const product = resolveDeprecatedOptionAlias({
+      preferredValue: options.governanceProduct,
+      deprecatedValue: options.automationOpsProfile,
+      preferredFlag: "--governance-product",
+      deprecatedFlag: "--automation-ops-profile"
+    });
+    if (product.error) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: product.error.message,
+        Instructions: product.error.instructions
+      });
+      processContext.exit(1);
+      return;
+    }
+    if (product.usedDeprecated) {
+      warnDeprecatedOptionAlias("--automation-ops-profile", "--governance-product");
+    }
     const governanceError = validateGovernanceOptions({
       governanceFilePath: options.governanceFilePath,
-      automationOpsProfile: options.automationOpsProfile
+      governanceProduct: product.value
     });
     if (governanceError) {
       OutputFormatter.error({
@@ -2037,7 +2100,7 @@ var registerPackCommand = (program) => {
       signingTimestampServer: options.signingTimestampServer,
       skipAnalyze: options.skipAnalyze,
       governanceFilePath: options.governanceFilePath,
-      automationOpsProfile: options.automationOpsProfile,
+      governanceProduct: product.value,
       ...mapPackageMetadataOptions(options)
     };
     await service.execute(solutionPath, packOptions, processContext);
@@ -2454,22 +2517,6 @@ var registerPackagesCommand = (program) => {
 // src/commands/project-add.ts
 import { randomUUID } from "node:crypto";
 
-// src/services/appv2-manifest.ts
-var WEB_APP_MANIFEST = "webAppManifest.json";
-async function resolveAppV2SubType(projectDir) {
-  const fs = getFileSystem();
-  const manifestPath = fs.path.join(projectDir, WEB_APP_MANIFEST);
-  if (!await fs.exists(manifestPath))
-    return "Coded";
-  const [readError, raw] = await catchError(fs.readFile(manifestPath, "utf-8"));
-  if (readError || !raw)
-    return "Coded";
-  const [parseError, manifest] = catchError(() => JSON.parse(raw));
-  if (parseError)
-    return "Coded";
-  return manifest?.config?.isActionApp === true ? "CodedAction" : "Coded";
-}
-
 // src/commands/project-command-utils.ts
 function rejectUnsupportedProjectType(projectType, failureMessage) {
   const reason = unsupportedSolutionProjectType(projectType);
@@ -2490,6 +2537,17 @@ function projectManifestInstructions(fileName, readProjectError, verb) {
   }
   return `${readProjectError.message} If this is a coded app, scaffold it with 'uip codedapp init <project-path>' — that writes the project.uiproj this command registers — then run 'uip solution projects ${verb} <project-path>' again.`;
 }
+function resourcesPendingForProjectType(projectType) {
+  return !hasBareTemplateRow(projectType) && hasAnyTemplateRow(projectType);
+}
+function hostGeneratesResources(projectType) {
+  return hasBareTemplateRow(projectType);
+}
+function resourcesPendingWarning(projectType) {
+  const verb = toolVerbForProjectType(projectType);
+  const needs = verb ? `that needs the '${verb}' tool installed ('uip tools install ${verb}')` : "that needs the tool that owns this project type installed";
+  return `No solution resources were generated for this project yet. Run 'uip solution resources refresh' to create them — ${needs}. 'uip solution pack' and 'uip solution upload' do it too.`;
+}
 
 // src/commands/project-add.ts
 var PROJECT_ADD_EXAMPLES = [
@@ -2501,7 +2559,8 @@ var PROJECT_ADD_EXAMPLES = [
       Data: {
         Status: "Added successfully",
         Project: "my-project/project.uiproj",
-        Solution: "/workspace/my-solution/my-solution.uipx"
+        Solution: "/workspace/my-solution/my-solution.uipx",
+        ResourcesPending: false
       }
     }
   }
@@ -2625,8 +2684,8 @@ var registerProjectAddCommand = (project) => {
       processContext.exit(1);
       return;
     }
-    const projectSubType = parsedProject.projectType === "AppV2" ? await resolveAppV2SubType(resolvedProjectPath) : undefined;
-    const createError = await createProjectInSolutionBuilder(solutionDir, projectId, projectName, parsedProject.projectType, projectSubType);
+    const resourcesPending = resourcesPendingForProjectType(parsedProject.projectType);
+    const createError = hostGeneratesResources(parsedProject.projectType) ? await createProjectInSolutionBuilder(solutionDir, projectId, projectName, parsedProject.projectType) : null;
     if (createError) {
       const restoreError = await restoreSolutionFile(resolvedSolutionFile, originalSolutionContent);
       OutputFormatter.error({
@@ -2644,13 +2703,17 @@ Rollback failed: ${restoreError.message}` : createError.message
         logger.warn(warning);
       }
     }
+    if (resourcesPending) {
+      logger.warn(resourcesPendingWarning(parsedProject.projectType));
+    }
     OutputFormatter.success({
       Result: RESULTS.Success,
       Code: "ProjectAdd",
       Data: {
         Status: "Added successfully",
         Project: projectRelativePath,
-        Solution: resolvedSolutionFile
+        Solution: resolvedSolutionFile,
+        ResourcesPending: resourcesPending
       }
     });
   });
@@ -2667,7 +2730,8 @@ var PROJECT_IMPORT_EXAMPLES = [
       Data: {
         Status: "Imported successfully",
         Project: "external-project/project.uiproj",
-        Solution: "/workspace/my-solution/my-solution.uipx"
+        Solution: "/workspace/my-solution/my-solution.uipx",
+        ResourcesPending: false
       }
     }
   }
@@ -2811,8 +2875,8 @@ var registerProjectImportCommand = (project) => {
       await catchError(fs.rm(targetProjectPath));
       await catchError(fs.writeFile(resolvedSolutionFile, originalSolutionContent));
     };
-    const projectSubType = parsedProject.projectType === "AppV2" ? await resolveAppV2SubType(targetProjectPath) : undefined;
-    const createError = await createProjectInSolutionBuilder(solutionDir, projectId, projectName, parsedProject.projectType, projectSubType);
+    const resourcesPending = resourcesPendingForProjectType(parsedProject.projectType);
+    const createError = hostGeneratesResources(parsedProject.projectType) ? await createProjectInSolutionBuilder(solutionDir, projectId, projectName, parsedProject.projectType) : null;
     if (createError) {
       await rollback();
       OutputFormatter.error({
@@ -2827,13 +2891,17 @@ var registerProjectImportCommand = (project) => {
     for (const warning of syncResult.warnings) {
       logger.warn(warning);
     }
+    if (resourcesPending) {
+      logger.warn(resourcesPendingWarning(parsedProject.projectType));
+    }
     OutputFormatter.success({
       Result: RESULTS.Success,
       Code: "ProjectImport",
       Data: {
         Status: "Imported successfully",
         Project: projectRelativePath,
-        Solution: resolvedSolutionFile
+        Solution: resolvedSolutionFile,
+        ResourcesPending: resourcesPending
       }
     });
   });
@@ -3753,6 +3821,7 @@ var registerResourceAddCommand = (resource) => {
       processContext.exit(1);
       return;
     }
+    await normalizeResourceFileCasing(resolvedPath);
     const [builderError, builder] = await catchError(services.getSolutionBuilder(resolvedPath));
     if (builderError) {
       OutputFormatter.error({
@@ -3798,7 +3867,10 @@ var registerResourceAddCommand = (resource) => {
         Data: outcome.data
       });
     } finally {
-      const [disposeError] = await catchError(builder.disposeAsync());
+      const disposeError = await saveCasingNormalized(builder);
+      if (!disposeError) {
+        await normalizeResourceFileCasing(resolvedPath);
+      }
       if (disposeError) {
         OutputFormatter.error({
           Result: RESULTS.Failure,
@@ -4062,7 +4134,25 @@ function toResourceAddData(resource, folders, source, status) {
 }
 
 // src/commands/resource-edit.ts
-var GUID_REGEX2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var RESOURCE_KEY_REGEX = /^[A-Za-z0-9._:-]{1,256}$/;
+var REMOTE_FAILURE_MESSAGE = {
+  solution_not_found: "Failed to edit resource",
+  not_a_solution: "Failed to edit resource",
+  auth_failed: "Failed to authenticate",
+  resource_not_found: "Resource not found in solution",
+  no_remote_reference: "Resource has no cloud definition to sync from",
+  comparison_unavailable: "Could not read the cloud definition to compare against",
+  sync_failed: "Failed to sync resource from the cloud definition",
+  save_failed: "Resource edit completed but the solution could not be saved"
+};
+var REMOTE_FAILURE_CODE = {
+  solution_not_found: "not_found",
+  not_a_solution: "invalid_argument",
+  auth_failed: "authentication_required",
+  resource_not_found: "not_found",
+  no_remote_reference: "invalid_argument",
+  comparison_unavailable: "not_found"
+};
 var NOT_FOUND_PATTERN = /not found/i;
 var RESOURCE_EDIT_EXAMPLES = [
   {
@@ -4107,10 +4197,36 @@ var RESOURCE_EDIT_EXAMPLES = [
         apiVersion: "orchestrator.uipath.com/v1"
       }
     }
+  },
+  {
+    Description: "Show what the cloud definition would overwrite, without writing (no --force)",
+    Command: "uip solution resources edit 8f3a1b2c-... --source remote",
+    Output: {
+      Code: "ResourceRemoteDrift",
+      Data: {
+        Key: "8f3a1b2c-1234-4abc-9def-0123456789ab",
+        Changed: ["description", "fields"],
+        Applied: false,
+        Status: "2 properties differ from the cloud definition. Re-run with --force to overwrite the local values."
+      }
+    }
+  },
+  {
+    Description: "Pull the current cloud definition over the local one (overwrites local edits)",
+    Command: "uip solution resources edit 8f3a1b2c-... --source remote --force",
+    Output: {
+      Code: "ResourceEdited",
+      Data: {
+        Key: "8f3a1b2c-1234-4abc-9def-0123456789ab",
+        Changed: ["fields"],
+        Applied: true,
+        Status: "Overwrote 1 property with the cloud definition"
+      }
+    }
   }
 ];
 var registerResourceEditCommand = (resource) => {
-  resource.command("edit").description("Edit a resource's spec properties by key. Pass --patch with a JSON object " + "of property → value; the JSON is merged into the existing spec. Properties " + "the SDK metadata marks as reference/read-only/unknown are silently ignored. " + "Use 'uip solution resources get <key>' to inspect the current spec; the " + "get↔edit shapes match, so a round-trip is straightforward.").argument("<resource-key>", "Solution resource key (GUID)").option("--patch <json>", `JSON object of spec property → value (e.g. '{"retentionPeriod":14}'). Pass '-' to read the JSON from stdin.`).option("--solution-folder <path>", "Path to the solution root folder (defaults to current directory)").examples(RESOURCE_EDIT_EXAMPLES).trackedAction(processContext, async (resourceKey, options) => {
+  resource.command("edit").description("Edit a resource's spec properties by key. Pass --patch with a JSON object " + "of property → value; the JSON is merged into the existing spec. Properties " + "the SDK metadata marks as reference/read-only/unknown are silently ignored. " + "Use 'uip solution resources get <key>' to inspect the current spec; the " + "get↔edit shapes match, so a round-trip is straightforward. " + "Pass --source remote instead of --patch to take the values from the cloud " + "definition the resource was imported from — the only way to pick up a change " + "made in Orchestrator or Data Fabric after the import, since 'resources refresh' " + "never overwrites an imported resource.").argument("<resource-key>", "Solution resource key (a GUID, or a compound key such as MyFunction.api.MyFunction.1:1.0.0)").option("--patch <json>", `JSON object of spec property → value (e.g. '{"retentionPeriod":14}'). Pass '-' to read the JSON from stdin.`).option("--source <source>", "Where the new values come from: 'local' (default, use --patch) or 'remote' (the cloud definition this resource was imported from)", "local").option("--force", "With --source remote, write the cloud definition over the local one. Without it the command only reports what would change and writes nothing.").option("--login-validity <minutes>", "Minimum minutes before token expiration to trigger a refresh (default: 10). Only used by --source remote.", "10").option("--solution-folder <path>", "Path to the solution root folder (defaults to current directory)").examples(RESOURCE_EDIT_EXAMPLES).trackedAction(processContext, async (resourceKey, options) => {
     if (!resourceKey || resourceKey.trim().length === 0) {
       OutputFormatter.error({
         Result: RESULTS.Failure,
@@ -4120,15 +4236,53 @@ var registerResourceEditCommand = (resource) => {
       processContext.exit(1);
       return;
     }
-    if (!GUID_REGEX2.test(resourceKey)) {
+    if (!RESOURCE_KEY_REGEX.test(resourceKey)) {
       OutputFormatter.error({
         Result: RESULTS.Failure,
-        Message: "<resource-key> must be a GUID",
-        Instructions: "Resource keys are 8-4-4-4-12 hex GUIDs. Use 'uip solution resources list' to find a valid key."
+        Message: "<resource-key> contains unsupported characters",
+        Instructions: "Resource keys use letters, digits, and '. _ - :' only. Use 'uip solution resources list' to find a valid key."
       });
       processContext.exit(1);
       return;
     }
+    const source = (options.source ?? "local").toLowerCase();
+    if (source !== "local" && source !== "remote") {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: `Invalid --source value "${options.source}"`,
+        Instructions: "Use --source local (with --patch) or --source remote.",
+        ErrorCode: "invalid_argument",
+        Retry: "RetryWillNotFix"
+      });
+      processContext.exit(1);
+      return;
+    }
+    if (source === "local" && options.force === true) {
+      OutputFormatter.error({
+        Result: RESULTS.Failure,
+        Message: "--force only applies to --source remote",
+        Instructions: "Drop --force, or add --source remote to overwrite the local spec with the cloud definition.",
+        ErrorCode: "invalid_argument",
+        Retry: "RetryWillNotFix"
+      });
+      processContext.exit(1);
+      return;
+    }
+    if (source === "remote") {
+      if (options.patch !== undefined) {
+        OutputFormatter.error({
+          Result: RESULTS.Failure,
+          Message: "--patch cannot be combined with --source remote",
+          Instructions: "Drop --patch to take the values from the cloud definition, or drop --source remote to apply your own values.",
+          ErrorCode: "invalid_argument",
+          Retry: "RetryWillNotFix"
+        });
+        processContext.exit(1);
+        return;
+      }
+      await handleRemoteSourceAsync(resourceKey, options);
+      return;
+    }
     const [parseError, properties] = await catchError(buildProperties(options));
     if (parseError) {
       OutputFormatter.error({
@@ -4179,6 +4333,7 @@ var registerResourceEditCommand = (resource) => {
       processContext.exit(1);
       return;
     }
+    await normalizeResourceFileCasing(resolvedPath);
     const [builderError, builder] = await catchError(services.getSolutionBuilder(resolvedPath));
     if (builderError) {
       OutputFormatter.error({
@@ -4209,7 +4364,10 @@ var registerResourceEditCommand = (resource) => {
         Data: config
       });
     } finally {
-      const [disposeError] = await catchError(builder.disposeAsync());
+      const disposeError = await saveCasingNormalized(builder);
+      if (!disposeError) {
+        await normalizeResourceFileCasing(resolvedPath);
+      }
       if (disposeError) {
         OutputFormatter.error({
           Result: RESULTS.Failure,
@@ -4221,6 +4379,62 @@ var registerResourceEditCommand = (resource) => {
     }
   });
 };
+async function handleRemoteSourceAsync(resourceKey, options) {
+  const result = await resourceRemoteSyncAsync(options.solutionFolder ?? ".", resourceKey, {
+    force: options.force === true,
+    loginValidity: options.loginValidity ? parseInt(options.loginValidity, 10) : undefined
+  });
+  if (!result.ok) {
+    OutputFormatter.error({
+      Result: RESULTS.Failure,
+      Message: REMOTE_FAILURE_MESSAGE[result.reason],
+      Instructions: result.reason === "resource_not_found" ? `No resource with key ${resourceKey}. Use 'uip solution resources list' to see available keys.` : result.message,
+      ErrorCode: REMOTE_FAILURE_CODE[result.reason],
+      Retry: result.reason === "sync_failed" ? undefined : "RetryWillNotFix"
+    });
+    processContext.exit(1);
+    return;
+  }
+  const count = result.changed.length;
+  if (!result.applied) {
+    if (count === 0) {
+      OutputFormatter.success({
+        Result: RESULTS.Success,
+        Code: "ResourceRemoteDrift",
+        Data: {
+          Key: result.key,
+          Changed: [],
+          Applied: false,
+          Status: "Already matches the cloud definition — nothing to overwrite"
+        }
+      });
+      return;
+    }
+    OutputFormatter.error({
+      Result: RESULTS.Failure,
+      Message: `${count} ${count === 1 ? "property differs" : "properties differ"} from the cloud definition: ${result.changed.join(", ")}`,
+      Instructions: `Overwriting discards the local values of ${count === 1 ? "that property" : "those properties"}. Re-run with --force to apply: uip solution resources edit ${result.key} --source remote --force`,
+      ErrorCode: "invalid_argument",
+      Retry: "RetryWillNotFix"
+    });
+    processContext.exit(1);
+    return;
+  }
+  const skipped = result.skipped.length;
+  const base = count === 0 ? "Already matched the cloud definition — nothing changed" : `Overwrote ${count} ${count === 1 ? "property" : "properties"} with the cloud definition`;
+  OutputFormatter.success({
+    Result: RESULTS.Success,
+    Code: "ResourceEdited",
+    Data: {
+      Key: result.key,
+      Changed: result.changed,
+      Skipped: result.skipped,
+      Applied: true,
+      Status: skipped === 0 ? base : `${base}. ${skipped} ${skipped === 1 ? "property" : "properties"} could not be written and still differ (${result.skipped.join(", ")}) — the SDK does not let this resource kind set ${skipped === 1 ? "it" : "them"}.`,
+      Spec: result.spec
+    }
+  });
+}
 async function buildProperties(options) {
   if (options.patch === undefined) {
     return {};
@@ -4850,8 +5064,9 @@ var RESOURCE_REFRESH_EXAMPLES = [
         Imported: 1,
         Skipped: 5,
         Pruned: 0,
+        ReconciledSpecs: 1,
         Warnings: [],
-        Status: "Synced 3 resources (5 already in solution)"
+        Status: "Synced 3 resources (5 already in solution). Refresh never overwrites an imported resource — to pull a changed cloud definition, run 'uip solution resources edit <resource-key> --source remote'."
       }
     }
   }
@@ -4863,9 +5078,33 @@ var FAILURE_MESSAGE = {
   sync_failed: "Failed to refresh resources"
 };
 var registerResourceRefreshSubcommand = (resource) => {
-  resource.command("refresh").description("Re-scan all projects in the solution and sync resource declarations from their bindings_v2.json files. " + "Creates new resources for bindings not yet in the solution, imports from Orchestrator when a matching resource exists, " + "and removes duplicate copies of the solution's own projects that earlier runs imported from a deployed folder. " + "Run this after editing project bindings to update the solution resource inventory.").option("--solution-folder <path>", "Path to the solution root folder (defaults to current directory)").option("--login-validity <minutes>", "Minimum minutes before token expiration to trigger a refresh (default: 10)", "10").examples(RESOURCE_REFRESH_EXAMPLES).trackedAction(processContext, async (options) => {
+  resource.command("refresh").description("Re-scan all projects in the solution and sync each project's authored files into the solution resource JSONs. " + "Bindings: creates new resources for `bindings_v2.json` entries not yet in the solution, imports from Orchestrator when a matching resource exists, and removes duplicate copies of the solution's own projects that earlier runs imported from a deployed folder. " + "Project contributions: each project's owning tool reports what its authored files add to the solution resources, and refresh persists it onto the matching resource. " + "Run this after editing a project's bindings or any file the project's tool contributes from, to update the solution resource inventory. " + "Refresh is import-only for cloud resources: it never overwrites an imported resource, so local edits survive; a project's own artefact resources are rewritten from the project's files on every run. " + "To pull a cloud definition that changed after the import, use 'uip solution resources edit <resource-key> --source remote'.").option("--solution-folder <path>", "Path to the solution root folder (defaults to current directory)").option("--login-validity <minutes>", "Minimum minutes before token expiration to trigger a refresh (default: 10)", "10").examples(RESOURCE_REFRESH_EXAMPLES).trackedAction(processContext, async (options) => {
     const loginValidityMinutes = options.loginValidity ? parseInt(options.loginValidity, 10) : undefined;
-    const result = await resourceRefreshAsync(options.solutionFolder ?? ".", { loginValidity: loginValidityMinutes });
+    const solutionFolder = options.solutionFolder ?? ".";
+    const fs = getFileSystem();
+    let contributions;
+    const [
+      { ensurePackagerTools: ensurePackagerTools2 },
+      { projectSubTypesFrom },
+      {
+        applyProjectContributions,
+        collectProjectContributions,
+        contributionErrorMessages
+      }
+    ] = await Promise.all([
+      import("./packager-tool-resolver-fmjr60x8.js"),
+      import("./prepare-solution-resources-wds3r8bq.js"),
+      import("./project-contributions-cvttys34.js")
+    ]);
+    const resolveProjectSubTypesAsync = async () => {
+      await ensurePackagerTools2(solutionFolder, fs);
+      contributions = await collectProjectContributions(solutionFolder, fs);
+      return projectSubTypesFrom(contributions);
+    };
+    const result = await resourceRefreshAsync(solutionFolder, {
+      loginValidity: loginValidityMinutes,
+      resolveProjectSubTypesAsync
+    });
     if (!result.ok) {
       OutputFormatter.error({
         Result: RESULTS.Failure,
@@ -4876,6 +5115,26 @@ var registerResourceRefreshSubcommand = (resource) => {
       return;
     }
     const prunedNote = result.pruned > 0 ? `, ${result.pruned} duplicates removed` : "";
+    const skippedNote = result.skipped > 0 ? " Refresh never overwrites an imported resource — to pull a changed cloud definition, run 'uip solution resources edit <resource-key> --source remote'." : "";
+    let applied = { updated: 0, warnings: [] };
+    if (contributions) {
+      const [applyError, written] = await catchError(applyProjectContributions(solutionFolder, contributions, undefined, fs));
+      if (applyError) {
+        OutputFormatter.error({
+          Result: RESULTS.Failure,
+          Message: FAILURE_MESSAGE.sync_failed,
+          Instructions: `Bindings synced, but the project contributions could not be written to the solution resources: ${applyError.message}. Fix the reported problem, then re-run 'uip solution resources refresh'.`
+        });
+        processContext.exit(1);
+        return;
+      }
+      applied = written;
+    }
+    const warnings = [
+      ...result.warnings,
+      ...contributions ? contributionErrorMessages(contributions) : [],
+      ...applied.warnings
+    ];
     OutputFormatter.success({
       Result: RESULTS.Success,
       Code: "ResourceRefresh",
@@ -4884,15 +5143,16 @@ var registerResourceRefreshSubcommand = (resource) => {
         Imported: result.imported,
         Skipped: result.skipped,
         Pruned: result.pruned,
-        Warnings: result.warnings,
-        Status: `Synced ${result.created + result.imported} resources (${result.skipped} already in solution${prunedNote})`
+        ReconciledSpecs: applied.updated,
+        Warnings: warnings,
+        Status: `Synced ${result.created + result.imported} resources (${result.skipped} already in solution${prunedNote}).${skippedNote}`
       }
     });
   });
 };
 
 // src/commands/resource-remove.ts
-var GUID_REGEX3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var RESOURCE_KEY_REGEX2 = /^[A-Za-z0-9._:-]{1,256}$/;
 var RESOURCE_REMOVE_EXAMPLES = [
   {
     Description: "Remove a resource by its solution key",
@@ -4909,7 +5169,7 @@ var RESOURCE_REMOVE_EXAMPLES = [
   }
 ];
 var registerResourceRemoveCommand = (resource) => {
-  resource.command("remove").description("Remove a resource from the solution by its key. Use 'uip solution resources list' " + "or 'uip solution resources get' to discover the key first. " + "Purely local — no auth required, doesn't touch any bindings_v2.json.").argument("<resource-key>", "Solution resource key (GUID)").option("--solution-folder <path>", "Path to the solution root folder (defaults to current directory)").examples(RESOURCE_REMOVE_EXAMPLES).trackedAction(processContext, async (resourceKey, options) => {
+  resource.command("remove").description("Remove a resource from the solution by its key. Use 'uip solution resources list' " + "or 'uip solution resources get' to discover the key first. " + "Purely local — no auth required, doesn't touch any bindings_v2.json.").argument("<resource-key>", "Solution resource key (a GUID, or a compound key such as MyFunction.api.MyFunction.1:1.0.0)").option("--solution-folder <path>", "Path to the solution root folder (defaults to current directory)").examples(RESOURCE_REMOVE_EXAMPLES).trackedAction(processContext, async (resourceKey, options) => {
     if (!resourceKey || resourceKey.trim().length === 0) {
       OutputFormatter.error({
         Result: RESULTS.Failure,
@@ -4919,11 +5179,11 @@ var registerResourceRemoveCommand = (resource) => {
       processContext.exit(1);
       return;
     }
-    if (!GUID_REGEX3.test(resourceKey)) {
+    if (!RESOURCE_KEY_REGEX2.test(resourceKey)) {
       OutputFormatter.error({
         Result: RESULTS.Failure,
-        Message: "<resource-key> must be a GUID",
-        Instructions: "Resource keys are 8-4-4-4-12 hex GUIDs. Use 'uip solution resources list' to find a valid key."
+        Message: "<resource-key> contains unsupported characters",
+        Instructions: "Resource keys use letters, digits, and '. _ - :' only. Use 'uip solution resources list' to find a valid key."
       });
       processContext.exit(1);
       return;
@@ -4959,6 +5219,7 @@ var registerResourceRemoveCommand = (resource) => {
       processContext.exit(1);
       return;
     }
+    await normalizeResourceFileCasing(resolvedPath);
     const [builderError, builder] = await catchError(services.getSolutionBuilder(resolvedPath));
     if (builderError) {
       OutputFormatter.error({
@@ -5006,7 +5267,10 @@ var registerResourceRemoveCommand = (resource) => {
         Data: captured
       });
     } finally {
-      const [disposeError] = await catchError(builder.disposeAsync());
+      const disposeError = await saveCasingNormalized(builder);
+      if (!disposeError) {
+        await normalizeResourceFileCasing(resolvedPath);
+      }
       if (disposeError) {
         OutputFormatter.error({
           Result: RESULTS.Failure,
@@ -5895,7 +6159,22 @@ var registerUploadCommand = (program) => {
       uisPath = resolvedPath;
     } else if (isDirectory || isUipxFile) {
       const solutionDir = resolveSolutionDir(fs, resolvedPath);
-      await syncAndLog(solutionDir);
+      const [prepareError] = await catchError(prepareSolutionResources(solutionDir, fs, {
+        gate: true
+      }));
+      if (prepareError) {
+        const errorCode = carriedErrorCode(prepareError) ?? (isUnpackableProjectTypeError(prepareError) ? "invalid_argument" : undefined);
+        const contributionCode = prepareError.contributionCode;
+        OutputFormatter.error({
+          Result: RESULTS.Failure,
+          Message: prepareError.message,
+          ...errorCode ? { ErrorCode: errorCode } : {},
+          ...typeof contributionCode === "string" ? { Context: { errorCode: contributionCode } } : {},
+          Instructions: carriedInstructions(prepareError) ?? "Fix the reported problem in the project's files, then re-run the upload."
+        });
+        processContext.exit(1);
+        return;
+      }
       tempDir = await fs.getTempDir();
       const [bundleError, bundleResult] = await catchError(bundleSolution(fs, solutionDir, tempDir));
       if (bundleError) {
@@ -6048,27 +6327,17 @@ function httpStatusOf(error) {
   }
   return;
 }
-function probeAuthChallengeOf(error) {
-  if (error instanceof Error && "authChallenge" in error) {
-    const challenge = error.authChallenge;
-    if (challenge && typeof challenge === "object") {
-      return challenge;
-    }
-  }
-  return {};
-}
 function isSolutionNotFoundError(error) {
   return httpStatusOf(error) === 404;
 }
 async function buildProbeFailureOutput(probeError, solutionId, identity) {
   const status = httpStatusOf(probeError);
   const isAuthRefusal = status === 401 || status === 403;
-  const challenge = probeAuthChallengeOf(probeError);
   const message = isAuthRefusal ? probeError.message : await extractErrorMessage(probeError);
   const output = {
     Result: RESULTS.Failure,
     Message: `Failed to check whether solution ${solutionId} exists on Studio Web: ${message}`,
-    Instructions: isAuthRefusal ? probeAuthInstructions(solutionId, identity, challenge) : "Verify your login (uip login) and tenant access, then retry. If the problem persists, contact your UiPath administrator."
+    Instructions: isAuthRefusal ? probeAuthInstructions(solutionId, identity) : "Verify your login (uip login) and tenant access, then retry. If the problem persists, contact your UiPath administrator."
   };
   if (status !== undefined) {
     output.Context = {
@@ -6077,19 +6346,14 @@ async function buildProbeFailureOutput(probeError, solutionId, identity) {
       method: "GET"
     };
   }
-  if (status === 401 && identity?.type === "Application" && challenge.error !== "invalid_token") {
+  if (status === 401 && identity?.type === "Application") {
     output.ErrorCode = "permission_denied";
   }
   return output;
 }
-function probeAuthInstructions(solutionId, identity, challenge) {
-  const quoted = challenge.description ? ` ("${challenge.description}")` : "";
-  if (challenge.error === "invalid_token") {
-    return `Studio Web rejected the credential itself with the reason ` + `\`invalid_token\`${quoted} while checking whether solution ` + `${solutionId} exists. That is the platform refusing this token ` + `rather than the grants behind it, so unlike a grants refusal this ` + `one is worth a fresh 'uip login' — or, in a pipeline, a newly ` + `minted client-credentials token. Check too that the token was ` + `issued for the organization and tenant being called. Nothing was ` + `uploaded.`;
-  }
+function probeAuthInstructions(solutionId, identity) {
   const actor = identity?.type === "Application" ? `This session acts as external application ${identity.clientId ?? "(client id unknown)"}: it needs a Studio Web grant that can read a solution.` : identity?.type === "User" ? "This session acts as a user: check that your account has Studio Web access in this tenant." : "Check that this session may read a solution in Studio Web — an external application needs a StudioWebS2S grant, a user needs Studio Web access in the tenant.";
-  const reported = challenge.error === "insufficient_scope" ? `Studio Web reported \`insufficient_scope\`${quoted}, so the token is good and its grants are not. ` : "";
-  return `Studio Web refused the read, and the session is authenticated, so ` + `re-running 'uip login' mints the same token and fails the same way. ` + `${reported}${actor} Also confirm solution ${solutionId} lives in the organization ` + `and tenant this session logged into. Nothing was uploaded.`;
+  return `Studio Web refused the read, and the session is authenticated, so ` + `re-running 'uip login' mints the same token and fails the same way. ` + `${actor} Also confirm solution ${solutionId} lives in the organization ` + `and tenant this session logged into. Nothing was uploaded.`;
 }
 function outputError(message) {
   OutputFormatter.error({
@@ -6122,7 +6386,7 @@ var registerCommands = async (program) => {
   registerResourceCommand(program);
   registerDeleteCommand(program);
   if (isPreviewBuild()) {
-    const { registerListCommand } = await import("./list-8hvfmge6.js");
+    const { registerListCommand } = await import("./list-dadxggxt.js");
     registerListCommand(program);
   }
   registerFeedsCommand(program);
@@ -6130,4 +6394,4 @@ var registerCommands = async (program) => {
 
 export { metadata, registerCommands };
 
-//# debugId=599D94E97BDE9E5C64756E2164756E21
+//# debugId=5681A456DD88C8F164756E2164756E21