v1.11.6

Changed

Assets

• Set-OrchCredentialAsset now warns instead of silently skipping when a new credential
  asset is requested without a password — a credential asset cannot exist without a secret
  (a password, or an ExternalName that references a credential store), so a create request
  that supplies neither used to be dropped with no output at all. It now emits a warning
  (Skipped '<name>': creating a new credential asset requires a password.) and skips the row,
  which also surfaces a mistyped or since-deleted asset name in a bulk-update CSV — those fall
  through to the create path with the password column masked (empty). Updating an existing
  credential is unchanged: omitting the password preserves the stored one, and changing the
  username without a password is still rejected server-side (errorCode 1500).

Fixed

Assets

• Per-user asset values now honor folder access through directory groups / tenant roles.
  Set-OrchAsset, Set-OrchCredentialAsset, Set-OrchSecretAsset and Copy-OrchAsset used to
  require the -UserName account to be directly assigned to the target folder — rejecting
  -UserName as "not assigned" (or dropping the copied per-user value) whenever the account only
  reached the folder through an assigned DirectoryGroup or a tenant role. The client-side
  folder-scope preflight has been removed: the cmdlets now resolve -UserName against the tenant
  user list and let Orchestrator decide. Direct PUT probes against cloud Orchestrator and on-prem
  22.10.1 confirmed the server accepts a per-user value for any existing tenant user regardless of
  direct folder assignment, and rejects a genuinely-invalid user atomically (HTTP 400) without the
  silent value-drop / Global-Value wipe the preflight was originally built to avoid. A directory
  user who is not yet a tenant user still has no per-user identity to reference; add them to the
  destination first with Add-OrchFolderUser / Copy-OrchFolderUser (as you would copy a package
  before a process), then re-run the asset set/copy.

v1.11.5

Fixed

Provider

• Subfolders under a personal workspace are visible again — dir / cd / Get-Item /
  wildcard resolution / Remove-Item now see the folders a solution deploy creates inside a
  personal workspace (FolderType Solution). Orchestrator changed this server-side: these
  subfolders used to arrive through /odata/Folders tagged FeedType PersonalWorkspace (their
  -Recurse ordering was fixed back in 0.9.12.2), but the endpoint no longer returns them at all —
  $filter=ParentId eq <pwId> comes back empty and /odata/Folders(<subfolderId>) 404s — so the
  whole subtree had become invisible. The folder catalog now also grafts these in from
  /api/Folders/GetAllForCurrentUser. Confidential-app connections skip the extra call (the
  endpoint returns an empty list for them anyway), and older Orchestrator versions that predate it
  degrade gracefully. Note: this restores visibility; deleting a Solution folder may still be
  refused server-side depending on the solution's lifecycle.
• All personal-workspace subfolders are fetched, not just the first page —
  /api/Folders/GetAllForCurrentUser (the source of the personal-workspace subtree) is a paged
  endpoint whose take is capped at 1000; the folder catalog issued a single un-paged request, so
  a tenant with more folders than one page would have silently dropped the tail (and any personal-
  workspace subfolders in it). It now pages on skip until the response's Count total is reached.
• -Recurse lists a personal workspace's subfolders right after the workspace, not scattered
  among regular folders — the grafted subfolders used to sort alphabetically by name in among
  every other folder's subtree instead of following their personal-workspace root. Both folder
  orderings now group personal-workspace subtrees with their root: dir -Recurse places them
  right after the root-level listing, and the folder walk behind the -Recurse entity cmdlets
  (Get-OrchAsset -Recurse, Get-OrchCredentialAsset, Get-OrchProcess, … — everything that
  uses EnumFolders) groups each workspace's subtree immediately after it, so e.g. a workspace
  subfolder's assets now list right after the workspace's own. Matches the non-recurse view and
  the Orchestrator web UI.

Platform Management

• Get-PmGroupLicense -ExpandAllocation no longer truncates a group's members at 50 — the
  Automation Cloud license allocations endpoint began capping each page at 50 regardless of the
  requested page size, so a group with more than 50 licensed members silently returned only the
  first 50 (a group with 50 or fewer was unaffected, which is why the truncation looked
  intermittent). The cmdlet now keeps paging on skip until the server returns an empty page.
  Verified live on Automation Cloud — the endpoint honors skip and reports totalCount.
• The Automation-Cloud-only licensing cmdlets now fail with a clear message on on-prem
  Orchestrator — Get-PmGroupLicense / Get-PmUserLicense / Get-PmLicense /
  Get-PmLicenseAllocation / Get-PmLicenseContract / Get-PmLicenseInventory call license
  endpoints that exist only on Automation Cloud. On-prem Orchestrator answers the unknown route
  with its SPA index.html (HTTP 200), which the cmdlets used to deserialize as JSON and surface
  as a cryptic '<' is an invalid start of a value. They now report that the operation is
  available only on Automation Cloud.

v1.11.4

Added

Cmdlets

• New-OrchUserMappingCsv now also enumerates robot accounts (Type DirectoryRobot), not just
  directory users — robot accounts own most per-user asset values in practice, and their names
  routinely differ between tenants, so leaving them out meant discovering the missing rows one drop
  warning at a time. Robot rows resolve against the destination tenant user list (the directory
  search may not return robot accounts; the tenant list is also what the copy matches per-user
  values against): same-named robots auto-fill, renamed ones are left empty to map by hand, and
  the row can simply be deleted when that robot's values are not needed. Robot rows carry "robot"
  in the SourceSource column. Test-OrchUserMappingCsv now checks tenant-user reachability first
  for every row — which both validates robot rows correctly and makes the check order match what
  the copy actually does.

Fixed

Cmdlets

• Folder-assignment checks and listings now read the union of GetUsersForFolder's
  includeInherited=true and false forms instead of trusting the true form to be a superset.
  In one customer Automation Cloud environment the true form omitted a directly-assigned robot
  account that the false form returned, so the asset copy dropped that robot's per-user values as
  "not assigned" (skipping per-user-only assets entirely), Set-OrchAsset / Set-OrchCredentialAsset
  / Set-OrchSecretAsset -UserName would have refused it, name completion (including
  New/Update-OrchTrigger -MachineRobots) missed it, and Get-OrchFolderUser -IncludeInherited
  paradoxically hid an assignment the no-switch form showed. The asymmetry is environment-dependent
  (it does not reproduce everywhere), but the union is correct by construction either way:
  -IncludeInherited now means "inherited in addition to direct" rather than "whatever the server's
  true form returns". Workaround on older versions: assign the account to a parent folder (the
  inherited entry is visible to the true form).

• User mapping CSV lookups are no longer case-sensitive on SourceUserName — every other
  UserName comparison in the pipeline ignores case, so a hand-typed row whose casing differed from
  the tenant's spelling silently failed to map.

• The "not assigned" drop warning's Copy-OrchFolderUser example now uses the source user name
  in -UserName — it previously showed the CSV-mapped destination name, which filters the source
  folder and would have matched nothing; when a mapping renamed the user the example now also
  points at passing the same -UserMappingCsv.

Changed

Cmdlets

• Test-OrchUserMappingCsv shows a per-entry progress bar — rows whose source user needs the
  folder-by-folder fallback scan, or whose destination hits the directory search, can take a while
  on large CSVs.

• Test-OrchUserMappingCsv aggregates its "not yet a tenant user" findings into one warning and a
  separate Pending count instead of warning per row — on a fresh cross-org destination nearly every
  directory-user row is in that state until folder users are copied (assignment creates the tenant user
  automatically), so per-row warnings drowned the report in expected noise. When only Pending entries
  remain, the closing verdict now says to copy folder users before assets instead of flagging the CSV.

• Cmdlets that need an endpoint the connected Orchestrator predates now say so. Get-OrchLibrary /
  Get-OrchLibraryVersion with -HostFeed on Orchestrator below API v17 (the library-feeds endpoint is
  absent through 23.4 and present from 25.10, measured) and Get-OrchProductVersion below API v12
  (/api/Status/Version is absent on 20.10.16) used to surface a bare Not Found; both now report
  "Orchestrator API Version N does not support this operation." Get-OrchPSDrive is unchanged — it
  already tolerated the failure and leaves the ProductVersion column blank.

Diagnostics & robustness

• Every Orchestrator-version gate now carries live measurements. The remaining "does this work on
  v12 / v14 / v15?" TODO comments were replaced with evidence measured against 20.10.16, 21.10.4,
  22.4.4, 22.10.0, 23.4.0, and 25.10.2 (plus Automation Cloud), and the API-trigger copy gate was
  aligned with the cache floor it already deferred to. No behavior changes beyond the error messages
  above.

v1.11.3

Added

Cmdlets

• Test-OrchUserMappingCsv now also verifies each DestinationUserName is reachable as a destination
  tenant user, not just resolvable in the destination directory. The copy cmdlets re-home per-user
  asset values against the destination tenant user list, so a mapping that only resolved at directory
  level validated clean and then dropped every per-user value at copy time. Such entries now warn up
  front, with a pointer at copying folder users (which auto-assigns directory users) before assets.

Provider

• Asset copies now end with a one-line drop summary — the total number of dropped per-user values
  and the distinct users / machines that failed to resolve — so the unresolved owners are listed even
  after the per-value warnings hit the throttle. The repeated "does not have user with Name" warning
  (destination tenant lacks the user entirely) is now throttled through the same budget as the
  "not assigned" one, and its users are included in the summary.

v1.11.2

Fixed

Cmdlets

• Add-OrchUser batch import no longer applies the last CSV row's UpdatePolicyType/UpdatePolicyVersion
  and ES_* execution settings to every user. Rows with different values collapsed to the final row's
  settings (or to none, when the final row left them blank); they now post per row, like the other
  per-row fields.

• Set-OrchAsset with a mix of existing and new names now creates the new assets. Once any -Name
  matched an existing asset, every name took the update branch — Set-OrchAsset Text Existing,BrandNew -Value x updated Existing and silently never created BrandNew.

• New-OrchTrigger / Update-OrchTrigger -MachineRobots now writes the robot relation the trigger
  screen displays. The server persists that relation from the ExecutorRobots array the web dialog
  always sends alongside the pairs; without it the assignment saved but read back with an empty Account /
  RobotUserName null (observed on 22.10). The array is now derived from the pairs automatically unless
  -ExecutorRobots is given explicitly. Below API v12 the pairs are stripped (the DTO has no
  MachineRobots member there) and the derived ExecutorRobots carries the whole assignment;
  -ExecutorRobots alone on API v12+ now warns about the likely mix-up.

• Get-OrchFolderUser -ExportCsv's Domain column now round-trips into Add-OrchFolderUser.
  -Domain did not bind from the pipeline, so re-imports silently posted the autogen default for
  every row; it now binds per row, like Add-OrchUser -Domain.

Provider

• Remove-Item on an Orchestrator folder it cannot resolve now reports ObjectNotFound instead of
  silently succeeding, and resolves the path literally like every other single-item operation — a
  leftover leaf-only wildcard unescape turned deleting a folder whose name contains a literal
  backtick-escaped wildcard into a silent no-op.

• DU/TM drives no longer accept nested garbage paths (Test-Path Du1:\NoSuchThing\RealProject
  returned true because only the last segment was matched) and tolerate a null PSDriveInfo by
  resolving the drive from the path. Their 2-arg GetChildItems (and the Orchestrator provider's) now
  delegates plain -Recurse as unlimited depth instead of 0 (unreachable via the current engine).

Diagnostics & robustness

• Connection failures now carry the underlying socket/TLS error in the message and inner exception —
  an untrusted certificate no longer surfaces as a bare "Could not connect … on any of N address(es)".

• Import-OrchConfig reports a clear error for a config file without a "PSDrives" array instead of
  a raw NullReferenceException; the DU/TM drive bootstrap likewise mounts nothing instead of failing.

• -UseInPrivate sign-ins no longer accumulate throwaway Edge profiles in %TEMP% — each launch
  sweeps the profiles earlier sign-ins left behind (recent or in-use ones are skipped).

• Directory-object completion tooltips fall back to the identifier again when the identity name is
  null (an operator-precedence slip made the fallback unreachable).

Authentication

• On-prem user/password drives now populate AccessToken / Claims / IsAuthenticated. The flow
  never stored the token in the auth manager, so Get-OrchPSDrive showed empty diagnostics for a
  successfully signed-in drive.

• A failed on-prem user/password sign-in now reports the server's actual error
  (Authentication failed: <status> — <server message>) instead of the generic empty-token message — or
  a raw JSON parse error on a proxy's HTML page. The response body is still never dumped.

v1.11.1

Added

Cmdlets

• Add-OrchUser gains a -Domain parameter, mirroring Add-OrchFolderUser -Domain: on an
  EntraID-federated OnPrem organization where the web UI exposes a concrete domain (e.g. frc / root)
  instead of autogen, pass it here so the directory lookup and the posted user both use it. It stays
  opt-in — omit it and the historical autogen default applies (Automation Cloud / non-federated OnPrem).

• -Domain now has argument completion on Add-OrchUser and Add-OrchFolderUser. Candidates come
  from /api/DirectoryService/GetDomains with the default domain offered first. Non-federated tenants and
  Automation Cloud return no domains, so the completer is silently empty there and autogen continues to
  apply.

• Get-OrchUser, Get-OrchUserDetail and Get-OrchFolderUser -ExportCsv now include a Domain
  column (after Type). It round-trips back into Add-OrchUser -Domain / Add-OrchFolderUser -Domain
  on Import-Csv | Add-Orch…. The value is the user's directory domain where the server reports one (the
  partition domain on federated OnPrem) and is empty on non-federated tenants / Automation Cloud.

Fixed

Cmdlets

• Get-OrchProcess no longer fails with "OData query options are invalid" on API v20+
  Orchestrator. The /odata/Releases list unconditionally requested $expand=Environment, but the
  Environment navigation (along with EnvironmentName / EnvironmentId) was removed from ReleaseDto
  in API v20 — so newer builds (confirmed on staging 26.3.0-s197) rejected the query with a 400
  ("Could not find a property named 'Environment' on type ...ReleaseDto"). The expand now includes
  Environment only below v20, where classic-folder deployments may still populate it; an unknown API
  version keeps it, preserving legacy behavior. Nothing consumed the nested Environment object, and
  EnvironmentName (used by Compare-OrchProcess) is a flat field returned independently of the expand.

• Get-OrchPSDrive now fills ProductVersion for already-connected drives without -Force. The
  column added in 1.11.0 only populated under -Force (or after Get-OrchProductVersion), so a drive
  that was already signed in still showed it blank. A plain Get-OrchPSDrive now fetches
  /api/Status/Version for drives that are already authenticated (one cheap call on the existing token);
  cold drives are still left untouched, so listing every drive never triggers an interactive sign-in.

• A malformed -MachineRobots JSON value now fails with a clear, actionable error and skips the
  trigger instead of being reported under a generic "deserialize" message and then still issuing the
  update. The error names the offending value and the expected shape
  ('[{"UserName":"<account>","MachineName":"<machine>"}]'); the trigger is left untouched. Applies to
  New-OrchTrigger, Update-OrchTrigger, New-OrchApiTrigger and Update-OrchApiTrigger.

v1.11.0

Added

Cmdlets

• Get-OrchPSDrive now shows a ProductVersion column (between Root and ApiVer) with the
  Orchestrator product version reported by /api/Status/Version, also exposed as the ProductVersion
  property on the output object. It is a passive, cached read: a plain Get-OrchPSDrive that lists
  every drive never triggers a network call or an interactive sign-in, so the value appears only once it
  has been fetched — by Get-OrchProductVersion or by Get-OrchPSDrive -Force (which now warms the
  cache). Drives whose version has not been fetched show an empty value.

Changed

Cmdlets

• BREAKING — Import-OrchConfig now always re-reads the configuration file and re-mounts the drives,
  and the -Force switch has been removed. Previously the cmdlet silently did nothing when the file
  was unchanged since the last mount, which was confusing — running Import-OrchConfig and seeing
  nothing happen — and the work saved is negligible. Re-mounting clears each drive's cached sign-in, so
  the next use of a drive re-authenticates; that is intentional, and is how you pick up a fresh
  directory sign-in after signing in to the organization URL in the browser. Scripts that passed
  Import-OrchConfig -Force should drop the switch.

• The local-user advisory shown for an Entra-ID-integrated organization was reworded to match the
  Orchestrator web banner: it now names the organization-specific sign-in URL and the
  sign-out → org-URL → Import-OrchConfig recovery steps.

Fixed

Cmdlets

• The Entra-ID local-user advisory is now actually displayed. It was detected correctly, but a gate
  latched shut before the advisory could be shown: a probe taken before the token / partition id / auth
  setting were available, or an unrelated advisory (e.g. the IgnoreSslErrors notice) draining first,
  would permanently suppress it for the rest of the session. The gate now latches only on a conclusive
  outcome and is re-armed on Switch-OrchCurrentUser.

v1.10.0

Added

Cmdlets

• Copy-OrchBucketItem — copy the files inside storage buckets directly from one folder, drive, or
  tenant to another. The bucket-file counterpart of Copy-OrchQueueItem: a folder copy
  (Copy-Item -Recurse) and Copy-OrchBucket reproduce only the bucket definition, while this
  carries the contents. Each file is streamed from the source's pre-signed read URI straight into the
  destination's pre-signed write URI with no local staging — the read runs through the source
  drive's connection and the write through the destination's, so each side's proxy/SSL applies. (The
  Export-OrchBucketItem → disk → Import-OrchBucketItem round-trip remains the right tool when you
  need the files on local disk for backup, inspection, or editing.) -Name, -FullPath and
  -Destination are mandatory and positional (matching the Export-OrchBucketItem argument order);
  there is no silent "copy everything" default, so pass * to mean all buckets or all files.
  -DestinationBucket retargets a single source bucket to a differently-named destination bucket and
  tab-completes against the destination folder's buckets. Copying a bucket onto itself is a no-op (it
  warns), while a same-folder copy to a different bucket is allowed; a copy is also skipped per file
  when the source and destination resolve to the same physical storage object (e.g. two Orchestrator
  buckets — even in different tenants — backed by the same external S3/Azure bucket), so a file is
  never streamed onto itself. The source content-type is preserved. The successfully-copied source files are emitted, so
  Copy-OrchBucketItem … | Remove-OrchBucketItem performs a transaction-safe copy-then-delete move.

• The bucket-item cmdlets compose via the pipeline. Get-OrchBucketItem, Export-OrchBucketItem,
  Copy-OrchBucketItem, and Remove-OrchBucketItem now alias -Name as -Bucket, so a piped
  bucket-file object binds the bucket/folder/file by property name. This makes Get-OrchBucketItem a
  filterable file-selector front end: select with the full power of Where-Object (by size,
  content-type, date, … — beyond what a -FullPath wildcard can express) and pipe the exact set into
  Export- (download), Copy- (copy), or Remove-OrchBucketItem (delete). For example,
  Get-OrchBucketItem docs * | Where-Object ContentType -eq 'application/pdf' | Export-OrchBucketItem -Destination C:\pdfs.

Changed

Cmdlets

• BREAKING: Remove-OrchBucketItem now requires -Name and -FullPath. Both were previously
  optional, so a bare Remove-OrchBucketItem -Recurse — or Remove-OrchBucketItem MyBucket without
  -FullPath — would delete files by omission, in the worst case every file in every bucket. They are
  now mandatory, aligning the cmdlet with the rest of the Remove-Orch* family (which all require a
  mandatory -Name) and closing that footgun. To delete all files in a bucket, pass * explicitly:
  Remove-OrchBucketItem MyBucket *.

Fixed

Cmdlets

• Import-OrchBucketItem now sets a correct content-type for many more file extensions. A range of
  common formats were missing from the extension → MIME-type table, so they were uploaded as
  application/octet-stream. Added mappings for text/config/code (.md, .markdown, .yaml/.yml,
  .log, .tsv, .ini, .conf, .properties, .toml, .sql, .mjs, .xaml), modern images
  (.avif, .heic/.heif, .jfif), audio/video (.m4a, .aac, .ogg, .opus, .wma, .webm,
  .mkv, .m4v, .mpeg/.mpg, .3gp), archives (.tgz, .bz2, .xz), OpenDocument/EPUB
  (.odt, .ods, .odp, .epub), and fonts (.woff, .woff2, .ttf, .otf, .eot). .js was also
  updated from the deprecated application/javascript to text/javascript (RFC 9239), matching .mjs.
  Files whose extension is still unknown remain application/octet-stream, and Copy-OrchBucketItem
  continues to preserve the source's content-type.

• A transient server error no longer wedges the cache for the rest of the session. HTTP 500
  and 502 responses were treated as deterministic and cached per slot, so after a single transient
  blip every later call for that entity — including tab-completion — re-threw the cached error without
  retrying, until Clear-OrchCache / Import-OrchConfig. They are now cached only briefly (a
  2-minute TTL) and then expire, so the slot self-heals once the server recovers: tab-completion
  stays fast during the outage but recovers on its own afterward. Genuinely deterministic statuses
  (400/403/404/410/501) still cache until explicitly cleared, and statuses the retry layer already
  treats as transient (429/503/504) are still never cached — keeping the cache and retry layers
  consistent about what "transient" means.

v1.9.7

Added

Cmdlets

• Progress bars across the module, now naming the item currently being processed. The name was
  previously left off because showing wide characters (Japanese/Chinese/Korean/emoji) in a progress
  bar breaks its rendering (PowerShell issue #21293); this release works around that by replacing
  each run of wide characters with [N] (N = hidden character count), keeping the narrow/ASCII parts
  of a name visible (e.g. Invoice請求Folder → Invoice[2]Folder), so the bars can finally be
  informative. Read cmdlets that fan out over folders/drives (e.g. Get-OrchAsset, Get-OrchQueue,
  Get-OrchProcess, the Get-Orch*Version / *Item pairs, the Du/Df/Tm getters) show a real
  percentage as their parallel fetches complete; mutation cmdlets (Set/Remove/Add/Update/
  New across assets, queues, triggers, users, folder users/machines, licenses, …) show per-item
  progress as they write. A version gate restores full names once the upstream fix (PR #26185) ships.

Changed

Cmdlets

• Get-OrchProcess (list-only path) fetches each folder's processes in parallel (cap=4) via
  OrchThreadPool.RunForEach, instead of one folder at a time, matching the other folder-scoped Get
  cmdlets.
• The two-phase Get cmdlets now show a real percentage. Get-OrchPackageVersion,
  Get-OrchLibraryVersion, Get-OrchTestDataQueueItem, Get-OrchUserDetail,
  Get-Orch{Asset,Bucket,Queue}Link, Get-PmGroupLicense, and Get-PmGroupMember run their two
  phases sequentially (list parents, then fetch children) so each phase's bar has a known
  denominator. Get-OrchUserDetail's bar in particular changes from a running index with no total to
  a real percentage. Trade-off: output no longer streams during the listing phase — negligible for
  the common single/few-folder case, a slightly later first object under a large -Recurse.

Internal

• Added ProgressExtensions.WithProgressBar<T>() — an enumerable wrapper mirroring WithCancellation
  — for single-threaded loops, and OrchThreadPoolImpl.GetResultWithProgress() for parallel
  RunForEach loops (fills the bar with the true completed-count, names the item being awaited).
• Removed ChainedThreadPool / OrchThreadPool.RunForEachChained (~200 lines of streaming
  producer/queue/dual-phase-semaphore code): every two-phase cmdlet now uses two sequential
  RunForEach passes, leaving a single parallel primitive.

v1.9.6

Added

Cmdlets

• Get-OrchQueueItem -Id — fetch specific queue items by id. Accepts multiple comma-separated
  values, emitted as a single OData Id in (...) filter (one server round trip, with the same
  $expand'd shape and Path / PathName / Name enrichment as every other filter). Tab completion on
  -Id suggests ids already loaded in the cache for the targeted queue(s) and excludes ids already
  typed on the same -Id list. Live-verified on Automation Cloud v20.

Changed

Provider

• Copy-OrchAsset per-user-value drop warnings are now actionable, and -WhatIf previews them.
  When a per-user asset value's user or machine isn't assigned to the destination folder, that value
  is dropped (the server would otherwise silently discard it, and could wipe the asset's global value).
  The warning now states the value is dropped and shows a copy-paste-ready remediation —
  Copy-OrchFolderUser -Path <src> -UserName <user> -Destination <dst> (or Copy-OrchFolderMachine
  for machines), with paths / names single-quote escaped. -WhatIf emits the same warnings without
  copying, so the loss is visible before committing. To avoid flooding when many values drop, after
  the 5th drop in one copy a single bulk hint
  (Copy-OrchFolderUser -Path <src> * -Destination <dst>) is emitted and the rest are suppressed.
  Scoped to direct Copy-OrchAsset; Copy-Item -Recurse also copies folder users / machines, so
  nothing is dropped there. Live-verified on Automation Cloud v20.

Fixed

Cmdlets

• Update-OrchQueue (and any queue edit) failed on Orchestrator v11–v13. When a field absent
  from the older QueueDefinitionDto (Tags, Encrypted, IsProcessInCurrentFolder,
  FoldersCount) reached the request, the server rejected the whole call with
  "queueDefinitionDto must not be null" (HTTP 400). These < v14 fields are now stripped for the
  Edit / Put paths as well as Create (in the shared StripQueueFieldsForApiVersion), so queue
  edits survive on v11–v13. Live-reproduced and fixed on 21.10.4 (API v13). (Long-standing — the
  strip previously covered only the create path.)
• Get-OrchBucketLink could return stale folder-sharing after a folder move / cache clear.
  ClearFolderCache dropped the folder's AssetLinks and QueueLinks entries but not
  BucketLinks — all three are the same id-keyed tenant cache and none are auto-cleared per folder,
  so a stale BucketLinks entry survived e.g. Move-Item. ClearFolderCache now drops
  BucketLinks for the folder too, symmetric with assets and queues. (Long-standing.)

Internal

• Consolidated queue retention defaulting into OrchAPISession.CreateQueue (kept the Cloud None→Delete guard).
• Queue-item by-id now goes through the QueueItems cache as an Id in (...) filter; removed the GetQueueItemById endpoint.
• Removed a duplicate SearchPmDirectoryCache clear in ClearTenantCache; folded the trigger executor-robot fetch into TriggersDetailed (removed the GetTrigger shim).
• Moved the provider's Invoke-Item handler to InvokeItem.cs; simplified ConsoleCancelHandler.
• CopyAssets refactor: the real copy and -WhatIf preview share one drop path, throttled by DropWarningBudget.