@uipath/auth 1.199.0 → 1.201.0-preview.115

package/dist/loginStatus.d.ts

@@ -2,6 +2,7 @@ import { getFileSystem } from "@uipath/filesystem";
 import { resolveConfigAsync } from "./config";
 import { clearRefreshBreaker, loadRefreshBreaker, saveRefreshBreaker } from "./refreshCircuitBreaker";
 import { tryRobotClientFallback } from "./robotClientFallback";
+import { type SessionIdentity } from "./sessionIdentity";
 import { refreshAccessToken } from "./tokenRefresh";
 import { loadEnvFileAsync, resolveEnvFilePathAsync, saveEnvFileAsync } from "./utils/envFile";
 /**
@@ -10,10 +11,15 @@ import { loadEnvFileAsync, resolveEnvFilePathAsync, saveEnvFileAsync } from "./u
  * refresh was tried and could not complete with a usable token.
  */
 export type LoginStatusValue = "Logged in" | "Not logged in" | "Expired" | "Refresh Failed";
-export declare enum LoginStatusSource {
-    File = "file",
+/**
+ * Where the CLI read the credential from — not who is acting and not how they
+ * authenticated. See {@link SessionIdentity} for those; the three are
+ * independent (a `Robot` credential normally carries a `User` identity).
+ */
+export declare enum CredentialSource {
+    SavedLogin = "saved-login",
     Robot = "robot",
-    Env = "env"
+    EnvironmentVariables = "env-vars"
 }
 export interface TokenRefreshTelemetry {
     attempted: boolean;
@@ -38,7 +44,14 @@ export interface LoginStatus {
     issuer?: string;
     expiration?: Date;
     hint?: string;
-    source?: LoginStatusSource;
+    source?: CredentialSource;
+    /**
+     * Who the session acts as, read from the access token's claims. Present
+     * whenever a token is available to derive it from — including `"Expired"`,
+     * so the user can see whose session lapsed. Display only: the claims are
+     * not signature-verified.
+     */
+    identity?: SessionIdentity;
     /**
      * True when a refresh rotated successfully at the identity server but
      * persisting the new pair to disk failed. The returned `accessToken` is

package/dist/robotClientFallback.d.ts

@@ -1,7 +1,8 @@
 /**
  * Minimal structural view of `@uipath/robot-client` — covers only the two
- * methods we consume. Defined locally so that this file compiles even when
- * the package is absent (it is loaded via dynamic `import()` at runtime).
+ * methods we consume. Defined locally so this file compiles without the
+ * package present: auth never imports robot-client, it only shapes the value
+ * returned by the host-registered loader (see {@link registerRobotClientLoader}).
  */
 interface IInteractiveConnectFlow {
     IsEnabled(): Promise<boolean>;
@@ -42,6 +43,19 @@ export interface RobotClientFallbackOptions {
      */
     force?: boolean;
 }
+/** Host-provided loader for `@uipath/robot-client`. See {@link registerRobotClientLoader}. */
+export type RobotClientModuleLoader = () => Promise<unknown>;
+/**
+ * Register the host's loader for `@uipath/robot-client` (a private GitHub
+ * Package Registry package). The CLI host bundles robot-client once and calls
+ * this at startup with `() => import("@uipath/robot-client")`; auth's Robot
+ * credential fallback then loads the module through the host instead of every
+ * tool bundle inlining its own ~720KB copy. When no loader is registered (or it
+ * fails), the fallback resolves to `undefined` and callers degrade to the
+ * standard "Not logged in" path — the same behaviour as when the Robot service
+ * is absent.
+ */
+export declare const registerRobotClientLoader: (loader: RobotClientModuleLoader) => void;
 /**
  * Read credentials from the running UiPath Robot/Assistant via its local IPC.
  *
@@ -52,7 +66,8 @@ export interface RobotClientFallbackOptions {
  *     `options.force === true`
  *   - the process looks like a CI runner (`CI`/`GITHUB_ACTIONS` set) — unless
  *     `options.force === true`
- *   - `@uipath/robot-client` is not installed or fails to load
+ *   - no robot-client loader is registered (see `registerRobotClientLoader`),
+ *     or the registered loader fails
  *   - Robot is not running, or sign-in is disabled
  *   - an IPC call exceeds the timeout
  *   - the returned resource URL or access token is malformed/empty

package/dist/server.d.ts

@@ -1,4 +1,5 @@
-export declare const AUTH_TIMEOUT_ERROR_CODE = "EAUTHTIMEOUT";
+import { AUTH_TIMEOUT_ERROR_CODE } from "./constants";
+export { AUTH_TIMEOUT_ERROR_CODE };
 interface StartCallbackServerProps {
     redirectUri: URL;
     timeoutMs?: number;
@@ -12,4 +13,3 @@ interface StartCallbackServerProps {
     signal?: AbortSignal;
 }
 export declare const startServer: ({ redirectUri, timeoutMs, onListening, signal, }: StartCallbackServerProps) => Promise<URL>;
-export {};

package/dist/sessionIdentity.d.ts

@@ -0,0 +1,35 @@
+import type { AuthFlow } from "./types";
+/**
+ * Whether the session acts as a person or as an external application.
+ * Deliberately coarse — `authFlow` carries the precision.
+ */
+export type IdentityType = "User" | "Application";
+/**
+ * Who the current session acts as, as reported by the access token.
+ *
+ * Every field here is read from *unverified* token claims (base64 decode, no
+ * signature check) and exists to be shown to a human. Never branch on it for
+ * an authorization or trust decision.
+ */
+export interface SessionIdentity {
+    type: IdentityType;
+    /** Absent when the CLI did not run the flow itself (e.g. Robot-borrowed). */
+    authFlow?: AuthFlow;
+    /** User identities only — the token's `sub`. */
+    userId?: string;
+    userEmail?: string;
+    userName?: string;
+    /**
+     * Application identities only. User tokens also carry a `client_id` — the
+     * CLI's own — and surfacing that would read as if an app were acting.
+     */
+    clientId?: string;
+}
+/** Narrow an on-disk `UIPATH_AUTH_FLOW` value to a known flow. */
+export declare const parseAuthFlow: (value: string | undefined) => AuthFlow | undefined;
+/**
+ * Derive the acting identity from an access token and, when known, the flow
+ * that produced it. Returns undefined when neither says anything — better to
+ * omit the fields than to guess at who is acting.
+ */
+export declare const resolveSessionIdentity: (accessToken: string | undefined, authFlow?: AuthFlow) => SessionIdentity | undefined;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@uipath/auth",
   "license": "MIT",
-  "version": "1.199.0",
+  "version": "1.201.0-preview.115",
   "repository": {
     "type": "git",
     "url": "https://github.com/UiPath/cli.git",
@@ -37,5 +37,5 @@
     "mihaigirleanu",
     "vlad-uipath"
   ],
-  "gitHead": "723e6801b77b5926ba75e75b6a756cc38b1b7adc"
+  "gitHead": "f1086b73654d7728cb71f280588b3e0c77d535fc"
 }