@uipath/solution-tool 1.204.0-preview.255 → 1.205.0-preview.256

package/dist/{packager-tool-px1j9kre.js → packager-tool-3bwnkjdq.js}

@@ -1,9 +1,9 @@
 import {
   catchError
-} from "./packager-tool-kswwd3hp.js";
+} from "./packager-tool-6ybywxxn.js";
 import {
   getFileSystem
-} from "./packager-tool-zf3929se.js";
+} from "./packager-tool-v1f5e8t9.js";
 
 // src/services/solution-init-service.ts
 var AGENTS_FILENAME = "AGENTS.md";

package/dist/{packager-tool-gb35b4qs.js → packager-tool-43ahv5mn.js}

@@ -1,6 +1,6 @@
 import {
   getFileSystem
-} from "./packager-tool-zf3929se.js";
+} from "./packager-tool-v1f5e8t9.js";
 import {
   __require
 } from "./packager-tool-1de529jm.js";
@@ -131,6 +131,16 @@ var resolveIdentityType = (claims, authFlow, email) => {
   }
   return;
 };
+var resolveApplicationSubtype = (claims, authFlow) => {
+  switch (asString(claims?.sub_type)) {
+    case "service.external":
+      return "External";
+    case "service.internal":
+      return "Internal";
+    default:
+      return authFlow === "client_credentials" || authFlow === "federated_credentials" ? "External" : undefined;
+  }
+};
 var looksLikeEmail = (value) => value?.includes("@") ?? false;
 var pickEmail = (claims) => {
   for (const candidate of [claims?.email, claims?.preferred_username]) {
@@ -172,6 +182,12 @@ var resolveSessionIdentity = (accessToken, authFlow) => {
   const clientId = asString(claims?.client_id);
   if (clientId)
     identity.clientId = clientId;
+  const subType = asString(claims?.sub_type);
+  if (subType)
+    identity.subType = subType;
+  const applicationSubtype = resolveApplicationSubtype(claims, authFlow);
+  if (applicationSubtype)
+    identity.applicationSubtype = applicationSubtype;
   return identity;
 };
 var readTokenScopes = (accessToken) => accessToken ? pickScopes(decodeClaims(accessToken)) : undefined;
@@ -182,11 +198,79 @@ var AUTH_FILENAME = ".auth";
 var DEFAULT_BASE_URL = "https://cloud.uipath.com";
 var DEFAULT_AUTH_TIMEOUT_MS = 5 * 60 * 1000;
 
+// ../auth/src/authProfile.ts
+var DEFAULT_AUTH_PROFILE = "default";
+var PROFILE_DIR = "profiles";
+var PROFILE_NAME_RE = /^[A-Za-z0-9._-]+$/;
+var ACTIVE_AUTH_PROFILE_KEY = Symbol.for("@uipath/auth/ActiveAuthProfile");
+var AUTH_PROFILE_STORAGE_KEY = Symbol.for("@uipath/auth/ProfileStorage");
+var globalSlot = globalThis;
+function isAuthProfileStorage(value) {
+  return value !== null && typeof value === "object" && "getStore" in value && "run" in value;
+}
+function createProfileStorage() {
+  const [error, mod] = catchError(() => __require("node:async_hooks"));
+  if (error || typeof mod?.AsyncLocalStorage !== "function") {
+    return {
+      getStore: () => {
+        return;
+      },
+      run: (_store, fn) => fn()
+    };
+  }
+  return new mod.AsyncLocalStorage;
+}
+function getProfileStorage() {
+  const existing = globalSlot[AUTH_PROFILE_STORAGE_KEY];
+  if (isAuthProfileStorage(existing)) {
+    return existing;
+  }
+  const storage = createProfileStorage();
+  globalSlot[AUTH_PROFILE_STORAGE_KEY] = storage;
+  return storage;
+}
+var profileStorage = getProfileStorage();
+
+class AuthProfileValidationError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AuthProfileValidationError";
+  }
+}
+function normalizeAuthProfileName(profile) {
+  if (profile === undefined || profile === DEFAULT_AUTH_PROFILE) {
+    return;
+  }
+  if (profile.length === 0 || profile === "." || profile === ".." || !PROFILE_NAME_RE.test(profile)) {
+    throw new AuthProfileValidationError(`Invalid profile name "${profile}". Profile names may contain only letters, numbers, '.', '_', and '-'.`);
+  }
+  return profile;
+}
+function getActiveAuthProfile() {
+  const scopedState = profileStorage.getStore();
+  if (scopedState !== undefined) {
+    return scopedState.profile;
+  }
+  return globalSlot[ACTIVE_AUTH_PROFILE_KEY]?.profile;
+}
+function resolveAuthProfileFilePath(profile) {
+  const normalized = normalizeAuthProfileName(profile);
+  if (normalized === undefined) {
+    throw new AuthProfileValidationError(`"${DEFAULT_AUTH_PROFILE}" is the built-in profile and does not have a profile file path.`);
+  }
+  const fs = getFileSystem();
+  return fs.path.join(fs.env.homedir(), UIPATH_HOME_DIR, PROFILE_DIR, normalized, AUTH_FILENAME);
+}
+function getActiveAuthProfileFilePath() {
+  const profile = getActiveAuthProfile();
+  return profile ? resolveAuthProfileFilePath(profile) : undefined;
+}
+
 // ../auth/src/config.ts
 var DEFAULT_CLIENT_ID = "36dea5b8-e8bb-423d-8e7b-c808df8f1c00";
 var AUTH_FILE_CONFIG_KEY = Symbol.for("@uipath/auth/AuthFileConfig");
-var globalSlot = globalThis;
-var getAuthFileConfig = () => globalSlot[AUTH_FILE_CONFIG_KEY] ?? {};
+var globalSlot2 = globalThis;
+var getAuthFileConfig = () => globalSlot2[AUTH_FILE_CONFIG_KEY] ?? {};
 
 class InvalidBaseUrlError extends Error {
   url;
@@ -257,22 +341,12 @@ var resolveConfigAsync = async ({
     baseUrl = DEFAULT_BASE_URL;
   }
   baseUrl = normalizeAndValidateBaseUrl(baseUrl);
-  let clientId = customClientId;
-  if (!clientId && fileAuth.clientId) {
-    clientId = fileAuth.clientId;
-  }
-  if (!clientId) {
-    clientId = DEFAULT_CLIENT_ID;
-  }
-  let clientSecret = customClientSecret;
-  if (!clientSecret && fileAuth.clientSecret) {
-    clientSecret = fileAuth.clientSecret;
-  }
-  const isExternalAppAuth = clientId !== DEFAULT_CLIENT_ID && (Boolean(clientSecret) || Boolean(customClientAssertion));
+  const clientId = customClientId || DEFAULT_CLIENT_ID;
+  const isExternalAppAuth = clientId !== DEFAULT_CLIENT_ID && (Boolean(customClientSecret) || Boolean(customClientAssertion));
   const scopes = resolveScopes(isExternalAppAuth, customScopes, fileAuth.scopes);
   return {
     clientId,
-    clientSecret,
+    clientSecret: customClientSecret,
     scopes,
     baseUrl,
     authorizationEndpoint: `${baseUrl}/identity_/connect/authorize`,
@@ -280,74 +354,6 @@ var resolveConfigAsync = async ({
   };
 };
 
-// ../auth/src/authProfile.ts
-var DEFAULT_AUTH_PROFILE = "default";
-var PROFILE_DIR = "profiles";
-var PROFILE_NAME_RE = /^[A-Za-z0-9._-]+$/;
-var ACTIVE_AUTH_PROFILE_KEY = Symbol.for("@uipath/auth/ActiveAuthProfile");
-var AUTH_PROFILE_STORAGE_KEY = Symbol.for("@uipath/auth/ProfileStorage");
-var globalSlot2 = globalThis;
-function isAuthProfileStorage(value) {
-  return value !== null && typeof value === "object" && "getStore" in value && "run" in value;
-}
-function createProfileStorage() {
-  const [error, mod] = catchError(() => __require("node:async_hooks"));
-  if (error || typeof mod?.AsyncLocalStorage !== "function") {
-    return {
-      getStore: () => {
-        return;
-      },
-      run: (_store, fn) => fn()
-    };
-  }
-  return new mod.AsyncLocalStorage;
-}
-function getProfileStorage() {
-  const existing = globalSlot2[AUTH_PROFILE_STORAGE_KEY];
-  if (isAuthProfileStorage(existing)) {
-    return existing;
-  }
-  const storage = createProfileStorage();
-  globalSlot2[AUTH_PROFILE_STORAGE_KEY] = storage;
-  return storage;
-}
-var profileStorage = getProfileStorage();
-
-class AuthProfileValidationError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "AuthProfileValidationError";
-  }
-}
-function normalizeAuthProfileName(profile) {
-  if (profile === undefined || profile === DEFAULT_AUTH_PROFILE) {
-    return;
-  }
-  if (profile.length === 0 || profile === "." || profile === ".." || !PROFILE_NAME_RE.test(profile)) {
-    throw new AuthProfileValidationError(`Invalid profile name "${profile}". Profile names may contain only letters, numbers, '.', '_', and '-'.`);
-  }
-  return profile;
-}
-function getActiveAuthProfile() {
-  const scopedState = profileStorage.getStore();
-  if (scopedState !== undefined) {
-    return scopedState.profile;
-  }
-  return globalSlot2[ACTIVE_AUTH_PROFILE_KEY]?.profile;
-}
-function resolveAuthProfileFilePath(profile) {
-  const normalized = normalizeAuthProfileName(profile);
-  if (normalized === undefined) {
-    throw new AuthProfileValidationError(`"${DEFAULT_AUTH_PROFILE}" is the built-in profile and does not have a profile file path.`);
-  }
-  const fs = getFileSystem();
-  return fs.path.join(fs.env.homedir(), UIPATH_HOME_DIR, PROFILE_DIR, normalized, AUTH_FILENAME);
-}
-function getActiveAuthProfileFilePath() {
-  const profile = getActiveAuthProfile();
-  return profile ? resolveAuthProfileFilePath(profile) : undefined;
-}
-
 // ../auth/src/envAuth.ts
 var ENV_AUTH_ENABLE_VAR = "UIPATH_CLI_ENABLE_ENV_AUTH";
 var ENFORCE_ROBOT_AUTH_VAR = "UIPATH_CLI_ENFORCE_ROBOT_AUTH";
@@ -636,6 +642,40 @@ var tryRobotClientFallback = async (options = {}) => {
   }
 };
 
+// ../auth/src/tenantSelection.ts
+var LOGIN_STATUS_HINT = "Run 'uip login status' to see the organization the CLI is signed in to.";
+var organizationHint = (organizationId) => `The request used '${organizationId}' as the organization. ${LOGIN_STATUS_HINT}`;
+var IDENTIFIER_STATUSES = new Set([400, 403, 404]);
+var describeNonJsonResponse = (organizationId, response, parseError) => {
+  if (response.redirected) {
+    return `Could not find organization '${organizationId}': the request was ` + `redirected to a sign-in page instead of the organization's tenant ` + `list. ${LOGIN_STATUS_HINT}`;
+  }
+  const contentType = response.headers.get("content-type") ?? "unknown";
+  return `The organization service returned a '${contentType}' response instead ` + `of JSON: ${parseError.message}. ${organizationHint(organizationId)}`;
+};
+var fetchTenantsAndOrganizations = async (baseUrl, accessToken, organizationId, signal) => {
+  const url = `${baseUrl}/${organizationId}/portal_/api/filtering/leftnav/tenantsAndOrganizationInfo`;
+  const response = await fetch(url, {
+    headers: {
+      Authorization: `Bearer ${accessToken}`
+    },
+    ...signal ? { signal } : {}
+  });
+  if (!response.ok) {
+    if (response.status === 401) {
+      throw new Error(`Unauthorized: the access token was rejected, it was not ` + `issued for organization '${organizationId}', or ` + `'${organizationId}' was not accepted as an organization ` + `URL segment in this environment. ` + LOGIN_STATUS_HINT);
+    }
+    const errorText = await response.text();
+    const message = `Failed to get tenants and organizations: ${response.status} ${errorText}`;
+    throw new Error(IDENTIFIER_STATUSES.has(response.status) ? `${message}. ${organizationHint(organizationId)}` : message);
+  }
+  const [parseError, data] = await catchError(response.json());
+  if (parseError) {
+    throw new Error(describeNonJsonResponse(organizationId, response, parseError));
+  }
+  return data;
+};
+
 // ../auth/src/tokenRefresh.ts
 var TOKEN_REFRESH_REAUTHENTICATE_MESSAGE = "Token refresh failed. Run 'uip login' to re-authenticate.";
 
@@ -848,6 +888,8 @@ var saveEnvFileAsync = async ({
 };
 
 // ../auth/src/loginStatus.ts
+var defaultRobotTenantIdCache = new Map;
+var ROBOT_TENANT_LOOKUP_TIMEOUT_MS = 5000;
 var getLoginStatusAsync = async (options = {}) => {
   return getLoginStatusWithDeps(options);
 };
@@ -860,12 +902,20 @@ var getLoginStatusWithDeps = async (options = {}, deps = {}) => {
     refreshToken: refreshTokenFn = refreshAccessToken,
     resolveConfig = resolveConfigAsync,
     robotFallback = tryRobotClientFallback,
+    fetchTenantsAndOrgs = fetchTenantsAndOrganizations,
+    robotTenantIdCache = defaultRobotTenantIdCache,
+    robotTenantLookupTimeoutMs = ROBOT_TENANT_LOOKUP_TIMEOUT_MS,
     loadBreaker = loadRefreshBreaker,
     saveBreaker = saveRefreshBreaker,
     clearBreaker = clearRefreshBreaker
   } = deps;
+  const robotDeps = {
+    fetchTenantsAndOrgs,
+    cache: robotTenantIdCache,
+    lookupTimeoutMs: robotTenantLookupTimeoutMs
+  };
   if (isRobotAuthEnforced()) {
-    return resolveRobotEnforcedStatus(robotFallback);
+    return resolveRobotEnforcedStatus(robotFallback, robotDeps);
   }
   if (isEnvAuthEnabled()) {
     return readAuthFromEnv();
@@ -883,7 +933,7 @@ var getLoginStatusWithDeps = async (options = {}, deps = {}) => {
         hint: `No credentials found for profile "${activeProfile}". Run 'uip login --profile ${activeProfile}' to authenticate this profile.`
       };
     }
-    return resolveBorrowedRobotStatus(robotFallback);
+    return resolveBorrowedRobotStatus(robotFallback, robotDeps);
   }
   const loaded = await loadFileCredentials(loadEnvFile, absolutePath);
   if ("status" in loaded) {
@@ -925,7 +975,7 @@ var getLoginStatusWithDeps = async (options = {}, deps = {}) => {
   }
   return buildFileStatus(tokens, credentials, globalHint);
 };
-async function resolveRobotEnforcedStatus(robotFallback) {
+async function resolveRobotEnforcedStatus(robotFallback, deps) {
   if (isEnvAuthEnabled()) {
     throw new EnvAuthConfigError(`${ENV_AUTH_ENABLE_VAR}=true and ${ENFORCE_ROBOT_AUTH_VAR}=true ` + `are mutually exclusive. Unset one of them and re-run.`);
   }
@@ -936,11 +986,11 @@ async function resolveRobotEnforcedStatus(robotFallback) {
       hint: `${ENFORCE_ROBOT_AUTH_VAR}=true but the UiPath Robot ` + `session is unavailable. Start and sign in to the Assistant, ` + `or unset ${ENFORCE_ROBOT_AUTH_VAR} to fall back to file or ` + `env-var authentication.`
     };
   }
-  return buildRobotStatus(robotCreds);
+  return buildRobotStatus(robotCreds, deps);
 }
-async function resolveBorrowedRobotStatus(robotFallback) {
+async function resolveBorrowedRobotStatus(robotFallback, deps) {
   const robotCreds = await robotFallback();
-  return robotCreds ? buildRobotStatus(robotCreds) : { loginStatus: "Not logged in" };
+  return robotCreds ? buildRobotStatus(robotCreds, deps) : { loginStatus: "Not logged in" };
 }
 async function loadFileCredentials(loadEnvFile, absolutePath) {
   let credentials;
@@ -1075,9 +1125,10 @@ function identityFields(accessToken, credentials) {
     ...scopes ? { scopes } : {}
   };
 }
-function buildRobotStatus(robotCreds) {
+async function buildRobotStatus(robotCreds, deps) {
   const identity = resolveSessionIdentity(robotCreds.accessToken);
   const scopes = readTokenScopes(robotCreds.accessToken);
+  const tenant = robotCreds.tenantId ? { tenantId: robotCreds.tenantId } : await resolveRobotTenantId(robotCreds, deps);
   return {
     loginStatus: "Logged in",
     accessToken: robotCreds.accessToken,
@@ -1085,14 +1136,62 @@ function buildRobotStatus(robotCreds) {
     organizationName: robotCreds.organizationName,
     organizationId: robotCreds.organizationId,
     tenantName: robotCreds.tenantName,
-    tenantId: robotCreds.tenantId,
+    tenantId: tenant.tenantId,
     issuer: robotCreds.issuer,
     expiration: getTokenExpiration(robotCreds.accessToken),
     source: "robot" /* Robot */,
+    ...tenant.hint ? { hint: tenant.hint } : {},
     ...identity ? { identity } : {},
     ...scopes ? { scopes } : {}
   };
 }
+async function resolveRobotTenantId(robotCreds, deps) {
+  const { baseUrl, accessToken, tenantName } = robotCreds;
+  const organization = robotCreds.organizationName ?? robotCreds.organizationId;
+  if (!tenantName || !organization) {
+    return {};
+  }
+  const key = `${baseUrl}|${organization}|${tenantName}|${accessToken}`;
+  let pending = deps.cache.get(key);
+  if (!pending) {
+    pending = catchError(lookupRobotTenantId({ baseUrl, accessToken, organization, tenantName }, deps)).then(([error, resolution]) => {
+      const settled = error ? { hint: tenantLookupFailureHint(tenantName, error.message) } : resolution;
+      if (!settled.tenantId) {
+        deps.cache.delete(key);
+      }
+      return settled;
+    });
+    deps.cache.set(key, pending);
+  }
+  return pending;
+}
+async function lookupRobotTenantId(target, deps) {
+  const { baseUrl, accessToken, organization, tenantName } = target;
+  const [error, data] = await catchError(deps.fetchTenantsAndOrgs(baseUrl, accessToken, organization, AbortSignal.timeout(deps.lookupTimeoutMs)));
+  if (error) {
+    const reason = error.name === "TimeoutError" ? `the tenant list did not answer within ${deps.lookupTimeoutMs} ms.` : error.message;
+    return { hint: tenantLookupFailureHint(tenantName, reason) };
+  }
+  const rows = data?.tenants;
+  const tenants = Array.isArray(rows) ? rows.filter((tenant) => typeof tenant?.id === "string" && typeof tenant?.name === "string") : [];
+  const wantedName = decodePathSegment(tenantName);
+  const wanted = wantedName.toLowerCase();
+  const match = tenants.find((tenant) => tenant.name === wantedName) ?? tenants.find((tenant) => tenant.name.toLowerCase() === wanted);
+  if (!match) {
+    const names = tenants.map((tenant) => tenant.name).join(", ");
+    return {
+      hint: `The Robot session targets tenant '${tenantName}', but ` + `organization '${organization}' lists no tenant of that name` + `${names ? ` (available: ${names})` : ""}. Commands that need ` + `the tenant id will fail until it can be resolved.`
+    };
+  }
+  return { tenantId: match.id };
+}
+function tenantLookupFailureHint(tenantName, reason) {
+  return `Could not resolve the id of tenant '${tenantName}' from the ` + `Robot session: ${reason} Commands that need the tenant id will ` + `fail until it can be resolved.`;
+}
+function decodePathSegment(segment) {
+  const [error, decoded] = catchError(() => decodeURIComponent(segment));
+  return error ? segment : decoded;
+}
 var isFileNotFoundError = (error) => {
   if (!(error instanceof Object))
     return false;
@@ -1361,9 +1460,6 @@ var getAuthContext = async (options = {}) => {
     identity: status.identity
   };
 };
-// ../auth/src/tenantSelection.ts
-var IDENTIFIER_STATUSES = new Set([400, 403, 404]);
-
 // ../auth/src/selectTenant.ts
 var TENANT_SELECTION_REQUIRED_CODE = "TENANT_SELECTION_REQUIRED";
 var INVALID_TENANT_CODE = "INVALID_TENANT";
@@ -1373,4 +1469,4 @@ var TENANT_SELECTION_CODES = new Set([
 ]);
 export { resolveSessionIdentity, getLoginStatusAsync, getAuthContext };
 
-//# debugId=EF43D376A9ABA26B64756E2164756E21
+//# debugId=B7D33D7D0BE1555264756E2164756E21

package/dist/{packager-tool-9ha2z8h5.js → packager-tool-47by487p.js}

@@ -1,11 +1,13 @@
 import {
   describeFeedResolutionFailureAsync,
   resolveFeedScope
-} from "./packager-tool-tgw5x6vx.js";
+} from "./packager-tool-rvt68c1t.js";
+import {
+  RESULTS
+} from "./packager-tool-tx834spe.js";
 import {
-  RESULTS,
   catchError
-} from "./packager-tool-kswwd3hp.js";
+} from "./packager-tool-6ybywxxn.js";
 
 // src/services/feed-scope-failure.ts
 async function resolveFeedScopeOrFailureAsync(options, session) {
@@ -34,4 +36,4 @@ async function resolveFeedScopeOrFailureAsync(options, session) {
 
 export { resolveFeedScopeOrFailureAsync };
 
-//# debugId=FB7C38D653C6A22164756E2164756E21
+//# debugId=4BDA905396BEA1E364756E2164756E21

package/dist/packager-tool-47wzvqw0.js

@@ -0,0 +1,86 @@
+import {
+  catchError
+} from "./packager-tool-6ybywxxn.js";
+
+// src/services/governance-options.ts
+var GOVERNANCE_OPTION_INSTRUCTIONS = "Pass a value for that option — a policy file path for --governance-file-path, " + "or a product such as StudioWeb for --governance-product — or drop the flag " + "to analyze with the rules shipped with the WorkflowCompiler.";
+function validateGovernanceOptions(options) {
+  if (options.governanceFilePath?.trim() === "") {
+    return "--governance-file-path was given an empty value.";
+  }
+  if (options.governanceProduct !== undefined && options.automationOpsProfile !== undefined) {
+    return "governanceProduct and automationOpsProfile are aliases. Set only governanceProduct.";
+  }
+  if (options.automationOpsProfile?.trim() === "") {
+    return "--governance-product was given an empty value.";
+  }
+  if (options.governanceProduct?.trim() === "") {
+    return "--governance-product was given an empty value.";
+  }
+  return null;
+}
+var AUTOMATION_OPS_RULES_KEY = "embedded-rules-config-rules";
+function detectGovernanceFileType(source) {
+  const [parseError, parsed] = catchError(() => JSON.parse(source));
+  if (parseError) {
+    return { kind: "unparseable" };
+  }
+  if (typeof parsed !== "object" || parsed === null) {
+    return { kind: "unparseable" };
+  }
+  if (Array.isArray(parsed)) {
+    return { kind: "detected", fileType: "Studio" /* Studio */ };
+  }
+  const root = parsed;
+  const nested = root.data;
+  if (typeof nested === "object" && nested !== null && AUTOMATION_OPS_RULES_KEY in nested) {
+    return {
+      kind: "detected",
+      fileType: "AutomationOps" /* AutomationOps */
+    };
+  }
+  if (AUTOMATION_OPS_RULES_KEY in root) {
+    return { kind: "unwrapped-automation-ops" };
+  }
+  return { kind: "detected", fileType: "Studio" /* Studio */ };
+}
+function governanceFileUnreadableMessage(path) {
+  return `--governance-file-path could not read the governance policy file: ${path}`;
+}
+function governanceFileUnwrappedMessage(path) {
+  return "--governance-file-path was given the inner policy of an AutomationOps " + `export rather than the exported file: ${path}`;
+}
+function governanceFileUnparseableMessage(path) {
+  return `--governance-file-path is not a JSON governance policy file: ${path}`;
+}
+var GOVERNANCE_FILE_UNUSABLE_INSTRUCTIONS = "Pass a policy exported from AutomationOps, or a Studio rules-configuration file. " + "Check the path is correct and the file is readable JSON.";
+async function resolveGovernanceFileTypeAsync(fs, governanceFilePath) {
+  const [readError, source] = await catchError(fs.readFile(governanceFilePath, "utf-8"));
+  if (readError || typeof source !== "string") {
+    return {
+      ok: false,
+      message: governanceFileUnreadableMessage(governanceFilePath),
+      instructions: GOVERNANCE_FILE_UNUSABLE_INSTRUCTIONS
+    };
+  }
+  const detection = detectGovernanceFileType(source);
+  if (detection.kind === "unparseable") {
+    return {
+      ok: false,
+      message: governanceFileUnparseableMessage(governanceFilePath),
+      instructions: GOVERNANCE_FILE_UNUSABLE_INSTRUCTIONS
+    };
+  }
+  if (detection.kind === "unwrapped-automation-ops") {
+    return {
+      ok: false,
+      message: governanceFileUnwrappedMessage(governanceFilePath),
+      instructions: "Export the policy from AutomationOps and pass that file as-is — " + "the analyzer reads the whole export, including the fields around " + "'data'. Re-wrap the policy under a 'data' key if you only kept its body."
+    };
+  }
+  return { ok: true, fileType: detection.fileType };
+}
+
+export { GOVERNANCE_OPTION_INSTRUCTIONS, validateGovernanceOptions, detectGovernanceFileType, governanceFileUnreadableMessage, governanceFileUnwrappedMessage, governanceFileUnparseableMessage, GOVERNANCE_FILE_UNUSABLE_INSTRUCTIONS, resolveGovernanceFileTypeAsync };
+
+//# debugId=4D8C0578B7C33E4864756E2164756E21

package/dist/{packager-tool-zns6n8zp.js → packager-tool-5ddtwzva.js}

@@ -9,7 +9,7 @@ import {
   ensureProjectId,
   toolsFactoryRepository,
   writeOrBackfillOperateProjectId
-} from "./packager-tool-fv7xyzg2.js";
+} from "./packager-tool-pbmqk39a.js";
 
 // ../packager/packager-tool-connector/src/connector-tool.ts
 class ConnectorTool extends ProjectTool {