@uipath/auth 1.200.0-preview.120 → 1.201.0-preview.121

package/dist/constants.d.ts

@@ -6,6 +6,7 @@ export declare const AUTH_FILENAME = ".auth";
 export declare const DEFAULT_BASE_URL = "https://cloud.uipath.com";
 /** Auth callback server timeout (5 minutes). */
 export declare const DEFAULT_AUTH_TIMEOUT_MS: number;
+export declare const AUTH_TIMEOUT_ERROR_CODE = "EAUTHTIMEOUT";
 export declare const AUTH_CANCELLED_ERROR_CODE = "EAUTHCANCELLED";
 /** Localhost OIDC redirect URI. */
 export declare const DEFAULT_REDIRECT_URI = "http://localhost:8104/oidc/login";

package/dist/index.browser.d.ts

@@ -4,6 +4,7 @@ export * from "./clientCredentials";
 export { type AuthFileConfig, InvalidBaseUrlError, setAuthFileConfig, } from "./config";
 export * from "./loginStatus";
 export * from "./logout";
+export { type IdentityType, parseAuthFlow, resolveSessionIdentity, type SessionIdentity, } from "./sessionIdentity";
 export { fetchTenantsAndOrganizations, type Tenant, type TenantsAndOrganizations, } from "./tenantSelection";
 export * from "./tokenRefresh";
 export { AUTH_FLOW_ENV_VAR, type AuthFlow, type BaseCredentials, } from "./types";

package/dist/index.browser.js

@@ -18452,6 +18452,67 @@ var getTokenExpiration = (accessToken) => {
   }
 };
 
+// src/sessionIdentity.ts
+var parseAuthFlow = (value) => value === "authorization_code" || value === "client_credentials" || value === "federated_credentials" ? value : undefined;
+var decodeClaims = (accessToken) => {
+  const [error, claims] = catchError(() => parseJWT(accessToken));
+  return error ? undefined : claims;
+};
+var asString = (value) => typeof value === "string" && value.length > 0 ? value : undefined;
+var resolveIdentityType = (claims, authFlow, email) => {
+  const subType = asString(claims?.sub_type);
+  if (subType) {
+    return subType.startsWith("service") ? "Application" : "User";
+  }
+  if (authFlow) {
+    return authFlow === "authorization_code" ? "User" : "Application";
+  }
+  if (email)
+    return "User";
+  if (asString(claims?.client_id) && !asString(claims?.sub)) {
+    return "Application";
+  }
+  return;
+};
+var looksLikeEmail = (value) => value?.includes("@") ?? false;
+var pickEmail = (claims) => {
+  for (const candidate of [claims?.email, claims?.preferred_username]) {
+    const value = asString(candidate);
+    if (looksLikeEmail(value))
+      return value;
+  }
+  return;
+};
+var pickName = (claims) => {
+  const username = asString(claims?.preferred_username);
+  return asString(claims?.name) ?? (looksLikeEmail(username) ? undefined : username);
+};
+var resolveSessionIdentity = (accessToken, authFlow) => {
+  const claims = accessToken ? decodeClaims(accessToken) : undefined;
+  const email = pickEmail(claims);
+  const type = resolveIdentityType(claims, authFlow, email);
+  if (!type)
+    return;
+  const identity = { type };
+  if (authFlow)
+    identity.authFlow = authFlow;
+  if (type === "User") {
+    const userId = asString(claims?.sub);
+    if (userId)
+      identity.userId = userId;
+    if (email)
+      identity.userEmail = email;
+    const name = pickName(claims);
+    if (name)
+      identity.userName = name;
+    return identity;
+  }
+  const clientId = asString(claims?.client_id);
+  if (clientId)
+    identity.clientId = clientId;
+  return identity;
+};
+
 // src/envAuth.ts
 var ENV_AUTH_ENABLE_VAR = "UIPATH_CLI_ENABLE_ENV_AUTH";
 var ENFORCE_ROBOT_AUTH_VAR = "UIPATH_CLI_ENFORCE_ROBOT_AUTH";
@@ -18501,6 +18562,7 @@ var readAuthFromEnv = () => {
   }
   const expiration = getTokenExpiration(accessToken);
   const loginStatus = expiration && expiration <= new Date ? "Expired" : "Logged in";
+  const identity = resolveSessionIdentity(accessToken);
   return {
     loginStatus,
     accessToken,
@@ -18510,7 +18572,8 @@ var readAuthFromEnv = () => {
     tenantName,
     tenantId,
     expiration,
-    source: "env" /* Env */
+    source: "env-vars" /* EnvironmentVariables */,
+    ...identity ? { identity } : {}
   };
 };
 
@@ -18763,6 +18826,9 @@ var refreshAccessToken = async ({
   return { accessToken: newAccessToken, refreshToken: newRefreshToken };
 };
 
+// src/types.ts
+var AUTH_FLOW_ENV_VAR = "UIPATH_AUTH_FLOW";
+
 // src/utils/envFile.ts
 import { getFileSystem as getFileSystem4 } from "@uipath/filesystem";
 var DEFAULT_AUTH_FILENAME = AUTH_FILENAME;
@@ -18925,12 +18991,12 @@ var saveEnvFileAsync = async ({
 };
 
 // src/loginStatus.ts
-var LoginStatusSource;
-((LoginStatusSource2) => {
-  LoginStatusSource2["File"] = "file";
-  LoginStatusSource2["Robot"] = "robot";
-  LoginStatusSource2["Env"] = "env";
-})(LoginStatusSource ||= {});
+var CredentialSource;
+((CredentialSource2) => {
+  CredentialSource2["SavedLogin"] = "saved-login";
+  CredentialSource2["Robot"] = "robot";
+  CredentialSource2["EnvironmentVariables"] = "env-vars";
+})(CredentialSource ||= {});
 var getLoginStatusAsync = async (options = {}) => {
   return getLoginStatusWithDeps(options);
 };
@@ -19136,7 +19202,8 @@ async function buildFileStatus(tokens, credentials, globalHint) {
     tenantName: credentials.UIPATH_TENANT_NAME,
     tenantId: credentials.UIPATH_TENANT_ID,
     expiration: tokens.expiration,
-    source: "file" /* File */,
+    source: "saved-login" /* SavedLogin */,
+    ...identityFields(tokens.accessToken, credentials),
     ...tokens.persistenceWarning ? { hint: tokens.persistenceWarning, persistenceFailed: true } : {},
     ...tokens.lockReleaseFailed ? { lockReleaseFailed: true } : {},
     ...tokens.tokenRefresh ? { tokenRefresh: tokens.tokenRefresh } : {}
@@ -19149,7 +19216,12 @@ async function buildFileStatus(tokens, credentials, globalHint) {
   }
   return result;
 }
+function identityFields(accessToken, credentials) {
+  const identity = resolveSessionIdentity(accessToken, parseAuthFlow(credentials[AUTH_FLOW_ENV_VAR]));
+  return identity ? { identity } : {};
+}
 function buildRobotStatus(robotCreds) {
+  const identity = resolveSessionIdentity(robotCreds.accessToken);
   return {
     loginStatus: "Logged in",
     accessToken: robotCreds.accessToken,
@@ -19160,7 +19232,8 @@ function buildRobotStatus(robotCreds) {
     tenantId: robotCreds.tenantId,
     issuer: robotCreds.issuer,
     expiration: getTokenExpiration(robotCreds.accessToken),
-    source: "robot" /* Robot */
+    source: "robot" /* Robot */,
+    ...identity ? { identity } : {}
   };
 }
 var isFileNotFoundError = (error) => {
@@ -19211,7 +19284,8 @@ async function circuitBreakerShortCircuit(ctx) {
       tenantName: credentials.UIPATH_TENANT_NAME,
       tenantId: credentials.UIPATH_TENANT_ID,
       expiration,
-      source: "file" /* File */
+      source: "saved-login" /* SavedLogin */,
+      ...identityFields(accessToken, credentials)
     } : {},
     hint: globalHint ?? (tokenIsDead ? deadHint : backoffHint),
     refreshCircuitOpen: true,
@@ -19233,7 +19307,8 @@ async function lockAcquireFailureStatus(ctx, error) {
       tenantName: ctx.credentials.UIPATH_TENANT_NAME,
       tenantId: ctx.credentials.UIPATH_TENANT_ID,
       expiration: ctx.expiration,
-      source: "file" /* File */,
+      source: "saved-login" /* SavedLogin */,
+      ...identityFields(ctx.accessToken, ctx.credentials),
       hint: globalHint,
       tokenRefresh: {
         attempted: false,
@@ -19604,6 +19679,16 @@ async function logout(options) {
   return logoutWithDeps(options);
 }
 // src/tenantSelection.ts
+var LOGIN_STATUS_HINT = "Run 'uip login status' to see the organization the CLI is signed in to.";
+var organizationHint = (organizationId) => `The request used '${organizationId}' as the organization. ${LOGIN_STATUS_HINT}`;
+var IDENTIFIER_STATUSES = new Set([400, 403, 404]);
+var describeNonJsonResponse = (organizationId, response, parseError) => {
+  if (response.redirected) {
+    return `Could not find organization '${organizationId}': the request was ` + `redirected to a sign-in page instead of the organization's tenant ` + `list. ${LOGIN_STATUS_HINT}`;
+  }
+  const contentType = response.headers.get("content-type") ?? "unknown";
+  return `The organization service returned a '${contentType}' response instead ` + `of JSON: ${parseError.message}. ${organizationHint(organizationId)}`;
+};
 var fetchTenantsAndOrganizations = async (baseUrl, accessToken, organizationId) => {
   const url = `${baseUrl}/${organizationId}/portal_/api/filtering/leftnav/tenantsAndOrganizationInfo`;
   const response = await fetch(url, {
@@ -19613,26 +19698,30 @@ var fetchTenantsAndOrganizations = async (baseUrl, accessToken, organizationId)
   });
   if (!response.ok) {
     if (response.status === 401) {
-      throw new Error("Unauthorized: Invalid or expired access token");
+      throw new Error(`Unauthorized: the access token was rejected, it was not ` + `issued for organization '${organizationId}', or ` + `'${organizationId}' was not accepted as an organization ` + `URL segment in this environment. ` + LOGIN_STATUS_HINT);
     }
     const errorText = await response.text();
-    throw new Error(`Failed to get tenants and organizations: ${response.status} ${errorText}`);
+    const message = `Failed to get tenants and organizations: ${response.status} ${errorText}`;
+    throw new Error(IDENTIFIER_STATUSES.has(response.status) ? `${message}. ${organizationHint(organizationId)}` : message);
+  }
+  const [parseError, data] = await catchError(response.json());
+  if (parseError) {
+    throw new Error(describeNonJsonResponse(organizationId, response, parseError));
   }
-  const data = await response.json();
   return data;
 };
-// src/types.ts
-var AUTH_FLOW_ENV_VAR = "UIPATH_AUTH_FLOW";
 export {
   setAuthFileConfig,
   setActiveAuthProfile,
   saveEnvFileAsync,
   runWithAuthProfile,
+  resolveSessionIdentity,
   resolveEnvFilePathAsync,
   resolveEnvFileLocationAsync,
   resolveAuthProfileFilePath,
   refreshAccessToken,
   parseJWT,
+  parseAuthFlow,
   normalizeAuthProfileName,
   logoutWithDeps,
   logout,
@@ -19650,14 +19739,14 @@ export {
   clientCredentialsLogin,
   clearActiveAuthProfile,
   TokenRefreshOAuthError,
-  LoginStatusSource,
   InvalidBaseUrlError,
   DEFAULT_ENV_FILENAME,
   DEFAULT_AUTH_PROFILE,
   DEFAULT_AUTH_FILENAME,
+  CredentialSource,
   ClientCredentialsAuthenticationError,
   AuthProfileValidationError,
   AUTH_FLOW_ENV_VAR
 };
 
-//# debugId=EAD5BC5B9162A5E464756E2164756E21
+//# debugId=7467DDE1FA7C205564756E2164756E21

package/dist/index.d.ts

@@ -2,7 +2,7 @@ export * from "./authContext";
 export * from "./authProfile";
 export * from "./clientCredentials";
 export { type AuthFileConfig, InvalidBaseUrlError, setAuthFileConfig, } from "./config";
-export { AUTH_CANCELLED_ERROR_CODE, DEFAULT_AUTH_TIMEOUT_MS, } from "./constants";
+export { AUTH_CANCELLED_ERROR_CODE, AUTH_TIMEOUT_ERROR_CODE, DEFAULT_AUTH_TIMEOUT_MS, } from "./constants";
 export { ENFORCE_ROBOT_AUTH_VAR, ENV_AUTH_ENABLE_VAR, ENV_AUTH_VARS, EnvAuthConfigError, isEnvAuthEnabled, isRobotAuthEnforced, readAuthFromEnv, } from "./envAuth";
 export { FederatedCredentialsAuthenticationError, federatedCredentialsLogin, JWT_BEARER_ASSERTION_TYPE, } from "./federatedCredentials";
 export * from "./interactive";
@@ -11,7 +11,7 @@ export * from "./logout";
 export { clearRefreshBreaker, loadRefreshBreaker, type RefreshBreakerState, refreshTokenFingerprint, saveRefreshBreaker, } from "./refreshCircuitBreaker";
 export { type RobotClientModuleLoader, registerRobotClientLoader, } from "./robotClientFallback";
 export { INVALID_TENANT_CODE, InvalidTenantError, isTenantSelectionError, type SelectFromList, selectTenantWithDeps, TENANT_SELECTION_REQUIRED_CODE, TenantSelectionError, TenantSelectionRequiredError, } from "./selectTenant";
-export { AUTH_TIMEOUT_ERROR_CODE } from "./server";
+export { type IdentityType, parseAuthFlow, resolveSessionIdentity, type SessionIdentity, } from "./sessionIdentity";
 export { fetchTenantsAndOrganizations, type Tenant, type TenantsAndOrganizations, } from "./tenantSelection";
 export * from "./tokenRefresh";
 export { AUTH_FLOW_ENV_VAR, type AuthFlow, type BaseCredentials, } from "./types";

package/dist/index.js

@@ -45,7 +45,7 @@ function settlePromiseLike(thenable) {
 }
 
 // src/constants.ts
-var UIPATH_HOME_DIR = ".uipath", AUTH_FILENAME = ".auth", DEFAULT_BASE_URL = "https://cloud.uipath.com", DEFAULT_AUTH_TIMEOUT_MS, AUTH_CANCELLED_ERROR_CODE = "EAUTHCANCELLED", DEFAULT_REDIRECT_URI = "http://localhost:8104/oidc/login";
+var UIPATH_HOME_DIR = ".uipath", AUTH_FILENAME = ".auth", DEFAULT_BASE_URL = "https://cloud.uipath.com", DEFAULT_AUTH_TIMEOUT_MS, AUTH_TIMEOUT_ERROR_CODE = "EAUTHTIMEOUT", AUTH_CANCELLED_ERROR_CODE = "EAUTHCANCELLED", DEFAULT_REDIRECT_URI = "http://localhost:8104/oidc/login";
 var init_constants = __esm(() => {
   DEFAULT_AUTH_TIMEOUT_MS = 5 * 60 * 1000;
 });
@@ -409,6 +409,12 @@ var init_is_in_ssh = __esm(() => {
 });
 
 // ../../node_modules/open/index.js
+var exports_open = {};
+__export(exports_open, {
+  openApp: () => openApp,
+  default: () => open_default,
+  apps: () => apps
+});
 import process8 from "node:process";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
@@ -642,6 +648,21 @@ var fallbackAttemptSymbol, __dirname2, localXdgOpenPath, platform, arch, tryEach
     ...options,
     target
   });
+}, openApp = (name, options) => {
+  if (typeof name !== "string" && !Array.isArray(name)) {
+    throw new TypeError("Expected a valid `name`");
+  }
+  const { arguments: appArguments = [] } = options ?? {};
+  if (appArguments !== undefined && appArguments !== null && !Array.isArray(appArguments)) {
+    throw new TypeError("Expected `appArguments` as Array type");
+  }
+  return baseOpen({
+    ...options,
+    app: {
+      name,
+      arguments: appArguments
+    }
+  });
 }, apps, open_default;
 var init_open = __esm(() => {
   init_wsl_utils();
@@ -721,7 +742,8 @@ class NodeFileSystem {
   };
   utils = {
     open: async (url) => {
-      await open_default(url);
+      const { default: open2 } = await Promise.resolve().then(() => (init_open(), exports_open));
+      await open2(url);
     }
   };
   async readFile(path3, options) {
@@ -916,9 +938,7 @@ class NodeFileSystem {
   }
 }
 var LOCK_HEARTBEAT_MS = 5000, LOCK_STALE_MS = 15000, LOCK_MAX_WAIT_MS = 20000, LOCK_MAX_HOLD_MS = 60000, LOCK_RETRY_MIN_MS = 100, LOCK_RETRY_JITTER_MS = 200;
-var init_node = __esm(() => {
-  init_open();
-});
+var init_node = () => {};
 // ../filesystem/src/index.ts
 var fsInstance, getFileSystem = () => fsInstance;
 var init_src = __esm(() => {
@@ -927,6 +947,101 @@ var init_src = __esm(() => {
   fsInstance = new NodeFileSystem;
 });
 
+// src/strategies/browser-strategy.ts
+var exports_browser_strategy = {};
+__export(exports_browser_strategy, {
+  BrowserAuthStrategy: () => BrowserAuthStrategy
+});
+
+class BrowserAuthStrategy {
+  async execute(url, _redirectUri, expectedState, opts) {
+    const global = getGlobalThis();
+    if (!global?.window) {
+      throw new Error("Browser environment required for authentication");
+    }
+    const screenWidth = global.window.screen?.width ?? 1024;
+    const screenHeight = global.window.screen?.height ?? 768;
+    const width = 600;
+    const height = 700;
+    const left = screenWidth / 2 - width / 2;
+    const top = screenHeight / 2 - height / 2;
+    if (!global.window.open) {
+      throw new Error("window.open is not available");
+    }
+    const popupResult = global.window.open(url, "uip_auth", `width=${width},height=${height},left=${left},top=${top},resizable=yes,scrollbars=yes,status=yes`);
+    const popup = popupResult;
+    if (!popup) {
+      throw new Error(`Authentication popup was blocked by your browser.
+
+` + `To continue:
+` + `1. Look for a popup blocker icon in your address bar
+` + `2. Allow popups for this site
+` + `3. Try logging in again
+
+` + "If using an ad blocker, you may need to temporarily disable it.");
+    }
+    return new Promise((resolve2, reject) => {
+      let timer;
+      const messageHandler = (event) => {
+        if (event.data?.type === "UIP_AUTH_CODE" && event.data.code) {
+          if (event.data.state !== expectedState) {
+            cleanup();
+            reject(new Error("OAuth state mismatch — the callback state does not match the expected value. " + "This may indicate a CSRF attack. Please try signing in again."));
+            popup.close();
+            return;
+          }
+          cleanup();
+          resolve2(event.data.code);
+          popup.close();
+        } else if (event.data?.type === "UIP_AUTH_ERROR") {
+          cleanup();
+          const errorMsg = event.data.error || "Authentication failed";
+          reject(new Error(`Authentication failed: ${errorMsg}
+
+` + "Please check your credentials and try again. " + "If the problem persists, verify your UiPath account is active."));
+          popup.close();
+        }
+      };
+      const cleanup = () => {
+        global.window?.removeEventListener?.("message", messageHandler);
+        opts?.signal?.removeEventListener("abort", onAbort);
+        if (timer)
+          clearInterval(timer);
+      };
+      const onAbort = () => {
+        cleanup();
+        const err = new Error(`Authentication was cancelled.
+
+` + "The sign-in was cancelled before completing the login process. " + "Please try again and complete the authentication flow.");
+        err.code = AUTH_CANCELLED_ERROR_CODE;
+        reject(err);
+        popup.close();
+      };
+      if (opts?.signal) {
+        if (opts.signal.aborted) {
+          onAbort();
+          return;
+        }
+        opts.signal.addEventListener("abort", onAbort, { once: true });
+      }
+      if (global.window?.addEventListener) {
+        global.window.addEventListener("message", messageHandler);
+      }
+      timer = setInterval(() => {
+        if (popup.closed) {
+          cleanup();
+          reject(new Error(`Authentication was cancelled.
+
+` + "The authentication popup was closed before completing the login process. " + "Please try again and complete the authentication flow."));
+        }
+      }, 1000);
+    });
+  }
+}
+var init_browser_strategy = __esm(() => {
+  init_constants();
+});
+
 // src/getBaseHtml.ts
 var escapeHtml = (value) => value.replace(/[&<>"']/g, (char) => {
   switch (char) {
@@ -1090,7 +1205,7 @@ var escapeHtml = (value) => value.replace(/[&<>"']/g, (char) => {
 };
 
 // src/server.ts
-var AUTH_TIMEOUT_ERROR_CODE = "EAUTHTIMEOUT", startServer = async ({
+var startServer = async ({
   redirectUri,
   timeoutMs = DEFAULT_AUTH_TIMEOUT_MS,
   onListening,
@@ -1209,101 +1324,6 @@ var init_server = __esm(() => {
   init_constants();
 });
 
-// src/strategies/browser-strategy.ts
-var exports_browser_strategy = {};
-__export(exports_browser_strategy, {
-  BrowserAuthStrategy: () => BrowserAuthStrategy
-});
-
-class BrowserAuthStrategy {
-  async execute(url, _redirectUri, expectedState, opts) {
-    const global = getGlobalThis();
-    if (!global?.window) {
-      throw new Error("Browser environment required for authentication");
-    }
-    const screenWidth = global.window.screen?.width ?? 1024;
-    const screenHeight = global.window.screen?.height ?? 768;
-    const width = 600;
-    const height = 700;
-    const left = screenWidth / 2 - width / 2;
-    const top = screenHeight / 2 - height / 2;
-    if (!global.window.open) {
-      throw new Error("window.open is not available");
-    }
-    const popupResult = global.window.open(url, "uip_auth", `width=${width},height=${height},left=${left},top=${top},resizable=yes,scrollbars=yes,status=yes`);
-    const popup = popupResult;
-    if (!popup) {
-      throw new Error(`Authentication popup was blocked by your browser.
-
-` + `To continue:
-` + `1. Look for a popup blocker icon in your address bar
-` + `2. Allow popups for this site
-` + `3. Try logging in again
-
-` + "If using an ad blocker, you may need to temporarily disable it.");
-    }
-    return new Promise((resolve2, reject) => {
-      let timer;
-      const messageHandler = (event) => {
-        if (event.data?.type === "UIP_AUTH_CODE" && event.data.code) {
-          if (event.data.state !== expectedState) {
-            cleanup();
-            reject(new Error("OAuth state mismatch — the callback state does not match the expected value. " + "This may indicate a CSRF attack. Please try signing in again."));
-            popup.close();
-            return;
-          }
-          cleanup();
-          resolve2(event.data.code);
-          popup.close();
-        } else if (event.data?.type === "UIP_AUTH_ERROR") {
-          cleanup();
-          const errorMsg = event.data.error || "Authentication failed";
-          reject(new Error(`Authentication failed: ${errorMsg}
-
-` + "Please check your credentials and try again. " + "If the problem persists, verify your UiPath account is active."));
-          popup.close();
-        }
-      };
-      const cleanup = () => {
-        global.window?.removeEventListener?.("message", messageHandler);
-        opts?.signal?.removeEventListener("abort", onAbort);
-        if (timer)
-          clearInterval(timer);
-      };
-      const onAbort = () => {
-        cleanup();
-        const err = new Error(`Authentication was cancelled.
-
-` + "The sign-in was cancelled before completing the login process. " + "Please try again and complete the authentication flow.");
-        err.code = AUTH_CANCELLED_ERROR_CODE;
-        reject(err);
-        popup.close();
-      };
-      if (opts?.signal) {
-        if (opts.signal.aborted) {
-          onAbort();
-          return;
-        }
-        opts.signal.addEventListener("abort", onAbort, { once: true });
-      }
-      if (global.window?.addEventListener) {
-        global.window.addEventListener("message", messageHandler);
-      }
-      timer = setInterval(() => {
-        if (popup.closed) {
-          cleanup();
-          reject(new Error(`Authentication was cancelled.
-
-` + "The authentication popup was closed before completing the login process. " + "Please try again and complete the authentication flow."));
-        }
-      }, 1000);
-    });
-  }
-}
-var init_browser_strategy = __esm(() => {
-  init_constants();
-});
-
 // src/strategies/node-strategy.ts
 var exports_node_strategy = {};
 __export(exports_node_strategy, {
@@ -2266,6 +2286,67 @@ var getTokenExpiration = (accessToken) => {
   }
 };
 
+// src/sessionIdentity.ts
+var parseAuthFlow = (value) => value === "authorization_code" || value === "client_credentials" || value === "federated_credentials" ? value : undefined;
+var decodeClaims = (accessToken) => {
+  const [error, claims] = catchError(() => parseJWT(accessToken));
+  return error ? undefined : claims;
+};
+var asString = (value) => typeof value === "string" && value.length > 0 ? value : undefined;
+var resolveIdentityType = (claims, authFlow, email) => {
+  const subType = asString(claims?.sub_type);
+  if (subType) {
+    return subType.startsWith("service") ? "Application" : "User";
+  }
+  if (authFlow) {
+    return authFlow === "authorization_code" ? "User" : "Application";
+  }
+  if (email)
+    return "User";
+  if (asString(claims?.client_id) && !asString(claims?.sub)) {
+    return "Application";
+  }
+  return;
+};
+var looksLikeEmail = (value) => value?.includes("@") ?? false;
+var pickEmail = (claims) => {
+  for (const candidate of [claims?.email, claims?.preferred_username]) {
+    const value = asString(candidate);
+    if (looksLikeEmail(value))
+      return value;
+  }
+  return;
+};
+var pickName = (claims) => {
+  const username = asString(claims?.preferred_username);
+  return asString(claims?.name) ?? (looksLikeEmail(username) ? undefined : username);
+};
+var resolveSessionIdentity = (accessToken, authFlow) => {
+  const claims = accessToken ? decodeClaims(accessToken) : undefined;
+  const email = pickEmail(claims);
+  const type = resolveIdentityType(claims, authFlow, email);
+  if (!type)
+    return;
+  const identity = { type };
+  if (authFlow)
+    identity.authFlow = authFlow;
+  if (type === "User") {
+    const userId = asString(claims?.sub);
+    if (userId)
+      identity.userId = userId;
+    if (email)
+      identity.userEmail = email;
+    const name = pickName(claims);
+    if (name)
+      identity.userName = name;
+    return identity;
+  }
+  const clientId = asString(claims?.client_id);
+  if (clientId)
+    identity.clientId = clientId;
+  return identity;
+};
+
 // src/envAuth.ts
 var ENV_AUTH_ENABLE_VAR = "UIPATH_CLI_ENABLE_ENV_AUTH";
 var ENFORCE_ROBOT_AUTH_VAR = "UIPATH_CLI_ENFORCE_ROBOT_AUTH";
@@ -2315,6 +2396,7 @@ var readAuthFromEnv = () => {
   }
   const expiration = getTokenExpiration(accessToken);
   const loginStatus = expiration && expiration <= new Date ? "Expired" : "Logged in";
+  const identity = resolveSessionIdentity(accessToken);
   return {
     loginStatus,
     accessToken,
@@ -2324,7 +2406,8 @@ var readAuthFromEnv = () => {
     tenantName,
     tenantId,
     expiration,
-    source: "env" /* Env */
+    source: "env-vars" /* EnvironmentVariables */,
+    ...identity ? { identity } : {}
   };
 };
 
@@ -2580,6 +2663,9 @@ var refreshAccessToken = async ({
   return { accessToken: newAccessToken, refreshToken: newRefreshToken };
 };
 
+// src/types.ts
+var AUTH_FLOW_ENV_VAR = "UIPATH_AUTH_FLOW";
+
 // src/utils/envFile.ts
 init_src();
 init_constants();
@@ -2743,12 +2829,12 @@ var saveEnvFileAsync = async ({
 };
 
 // src/loginStatus.ts
-var LoginStatusSource;
-((LoginStatusSource2) => {
-  LoginStatusSource2["File"] = "file";
-  LoginStatusSource2["Robot"] = "robot";
-  LoginStatusSource2["Env"] = "env";
-})(LoginStatusSource ||= {});
+var CredentialSource;
+((CredentialSource2) => {
+  CredentialSource2["SavedLogin"] = "saved-login";
+  CredentialSource2["Robot"] = "robot";
+  CredentialSource2["EnvironmentVariables"] = "env-vars";
+})(CredentialSource ||= {});
 var getLoginStatusAsync = async (options = {}) => {
   return getLoginStatusWithDeps(options);
 };
@@ -2954,7 +3040,8 @@ async function buildFileStatus(tokens, credentials, globalHint) {
     tenantName: credentials.UIPATH_TENANT_NAME,
     tenantId: credentials.UIPATH_TENANT_ID,
     expiration: tokens.expiration,
-    source: "file" /* File */,
+    source: "saved-login" /* SavedLogin */,
+    ...identityFields(tokens.accessToken, credentials),
     ...tokens.persistenceWarning ? { hint: tokens.persistenceWarning, persistenceFailed: true } : {},
     ...tokens.lockReleaseFailed ? { lockReleaseFailed: true } : {},
     ...tokens.tokenRefresh ? { tokenRefresh: tokens.tokenRefresh } : {}
@@ -2967,7 +3054,12 @@ async function buildFileStatus(tokens, credentials, globalHint) {
   }
   return result;
 }
+function identityFields(accessToken, credentials) {
+  const identity = resolveSessionIdentity(accessToken, parseAuthFlow(credentials[AUTH_FLOW_ENV_VAR]));
+  return identity ? { identity } : {};
+}
 function buildRobotStatus(robotCreds) {
+  const identity = resolveSessionIdentity(robotCreds.accessToken);
   return {
     loginStatus: "Logged in",
     accessToken: robotCreds.accessToken,
@@ -2978,7 +3070,8 @@ function buildRobotStatus(robotCreds) {
     tenantId: robotCreds.tenantId,
     issuer: robotCreds.issuer,
     expiration: getTokenExpiration(robotCreds.accessToken),
-    source: "robot" /* Robot */
+    source: "robot" /* Robot */,
+    ...identity ? { identity } : {}
   };
 }
 var isFileNotFoundError = (error) => {
@@ -3029,7 +3122,8 @@ async function circuitBreakerShortCircuit(ctx) {
       tenantName: credentials.UIPATH_TENANT_NAME,
       tenantId: credentials.UIPATH_TENANT_ID,
       expiration,
-      source: "file" /* File */
+      source: "saved-login" /* SavedLogin */,
+      ...identityFields(accessToken, credentials)
     } : {},
     hint: globalHint ?? (tokenIsDead ? deadHint : backoffHint),
     refreshCircuitOpen: true,
@@ -3051,7 +3145,8 @@ async function lockAcquireFailureStatus(ctx, error) {
       tenantName: ctx.credentials.UIPATH_TENANT_NAME,
       tenantId: ctx.credentials.UIPATH_TENANT_ID,
       expiration: ctx.expiration,
-      source: "file" /* File */,
+      source: "saved-login" /* SavedLogin */,
+      ...identityFields(ctx.accessToken, ctx.credentials),
       hint: globalHint,
       tokenRefresh: {
         attempted: false,
@@ -3452,6 +3547,16 @@ var federatedCredentialsLogin = async ({
 init_src();
 
 // src/tenantSelection.ts
+var LOGIN_STATUS_HINT = "Run 'uip login status' to see the organization the CLI is signed in to.";
+var organizationHint = (organizationId) => `The request used '${organizationId}' as the organization. ${LOGIN_STATUS_HINT}`;
+var IDENTIFIER_STATUSES = new Set([400, 403, 404]);
+var describeNonJsonResponse = (organizationId, response, parseError) => {
+  if (response.redirected) {
+    return `Could not find organization '${organizationId}': the request was ` + `redirected to a sign-in page instead of the organization's tenant ` + `list. ${LOGIN_STATUS_HINT}`;
+  }
+  const contentType = response.headers.get("content-type") ?? "unknown";
+  return `The organization service returned a '${contentType}' response instead ` + `of JSON: ${parseError.message}. ${organizationHint(organizationId)}`;
+};
 var fetchTenantsAndOrganizations = async (baseUrl, accessToken, organizationId) => {
   const url = `${baseUrl}/${organizationId}/portal_/api/filtering/leftnav/tenantsAndOrganizationInfo`;
   const response = await fetch(url, {
@@ -3461,12 +3566,16 @@ var fetchTenantsAndOrganizations = async (baseUrl, accessToken, organizationId)
   });
   if (!response.ok) {
     if (response.status === 401) {
-      throw new Error("Unauthorized: Invalid or expired access token");
+      throw new Error(`Unauthorized: the access token was rejected, it was not ` + `issued for organization '${organizationId}', or ` + `'${organizationId}' was not accepted as an organization ` + `URL segment in this environment. ` + LOGIN_STATUS_HINT);
     }
     const errorText = await response.text();
-    throw new Error(`Failed to get tenants and organizations: ${response.status} ${errorText}`);
+    const message = `Failed to get tenants and organizations: ${response.status} ${errorText}`;
+    throw new Error(IDENTIFIER_STATUSES.has(response.status) ? `${message}. ${organizationHint(organizationId)}` : message);
+  }
+  const [parseError, data] = await catchError(response.json());
+  if (parseError) {
+    throw new Error(describeNonJsonResponse(organizationId, response, parseError));
   }
-  const data = await response.json();
   return data;
 };
 
@@ -3545,9 +3654,6 @@ var selectTenantWithDeps = async (baseUrl, accessToken, organizationId, targetTe
   return [selectedTenant.name, selectedTenant.id, organization.name];
 };
 
-// src/types.ts
-var AUTH_FLOW_ENV_VAR = "UIPATH_AUTH_FLOW";
-
 // src/interactive.ts
 var interactiveLoginWithDeps = async (options, deps) => {
   const {
@@ -3771,7 +3877,6 @@ async function logout(options) {
 }
 
 // src/index.ts
-init_server();
 var authenticate = async ({
   baseUrl,
   clientId,
@@ -3854,6 +3959,7 @@ export {
   saveRefreshBreaker,
   saveEnvFileAsync,
   runWithAuthProfile,
+  resolveSessionIdentity,
   resolveEnvFilePathAsync,
   resolveEnvFileLocationAsync,
   resolveAuthProfileFilePath,
@@ -3862,6 +3968,7 @@ export {
   refreshAccessToken,
   readAuthFromEnv,
   parseJWT,
+  parseAuthFlow,
   normalizeAuthProfileName,
   logoutWithDeps,
   logout,
@@ -3891,7 +3998,6 @@ export {
   TenantSelectionRequiredError,
   TenantSelectionError,
   TENANT_SELECTION_REQUIRED_CODE,
-  LoginStatusSource,
   JWT_BEARER_ASSERTION_TYPE,
   InvalidTenantError,
   InvalidBaseUrlError,
@@ -3905,6 +4011,7 @@ export {
   DEFAULT_AUTH_TIMEOUT_MS,
   DEFAULT_AUTH_PROFILE,
   DEFAULT_AUTH_FILENAME,
+  CredentialSource,
   ClientCredentialsAuthenticationError,
   AuthProfileValidationError,
   AUTH_TIMEOUT_ERROR_CODE,
@@ -3912,4 +4019,4 @@ export {
   AUTH_CANCELLED_ERROR_CODE
 };
 
-//# debugId=B8729C58CA2817B364756E2164756E21
+//# debugId=C655D07F97343A8C64756E2164756E21

package/dist/loginStatus.d.ts

@@ -2,6 +2,7 @@ import { getFileSystem } from "@uipath/filesystem";
 import { resolveConfigAsync } from "./config";
 import { clearRefreshBreaker, loadRefreshBreaker, saveRefreshBreaker } from "./refreshCircuitBreaker";
 import { tryRobotClientFallback } from "./robotClientFallback";
+import { type SessionIdentity } from "./sessionIdentity";
 import { refreshAccessToken } from "./tokenRefresh";
 import { loadEnvFileAsync, resolveEnvFilePathAsync, saveEnvFileAsync } from "./utils/envFile";
 /**
@@ -10,10 +11,15 @@ import { loadEnvFileAsync, resolveEnvFilePathAsync, saveEnvFileAsync } from "./u
  * refresh was tried and could not complete with a usable token.
  */
 export type LoginStatusValue = "Logged in" | "Not logged in" | "Expired" | "Refresh Failed";
-export declare enum LoginStatusSource {
-    File = "file",
+/**
+ * Where the CLI read the credential from — not who is acting and not how they
+ * authenticated. See {@link SessionIdentity} for those; the three are
+ * independent (a `Robot` credential normally carries a `User` identity).
+ */
+export declare enum CredentialSource {
+    SavedLogin = "saved-login",
     Robot = "robot",
-    Env = "env"
+    EnvironmentVariables = "env-vars"
 }
 export interface TokenRefreshTelemetry {
     attempted: boolean;
@@ -38,7 +44,14 @@ export interface LoginStatus {
     issuer?: string;
     expiration?: Date;
     hint?: string;
-    source?: LoginStatusSource;
+    source?: CredentialSource;
+    /**
+     * Who the session acts as, read from the access token's claims. Present
+     * whenever a token is available to derive it from — including `"Expired"`,
+     * so the user can see whose session lapsed. Display only: the claims are
+     * not signature-verified.
+     */
+    identity?: SessionIdentity;
     /**
      * True when a refresh rotated successfully at the identity server but
      * persisting the new pair to disk failed. The returned `accessToken` is

package/dist/server.d.ts

@@ -1,4 +1,5 @@
-export declare const AUTH_TIMEOUT_ERROR_CODE = "EAUTHTIMEOUT";
+import { AUTH_TIMEOUT_ERROR_CODE } from "./constants";
+export { AUTH_TIMEOUT_ERROR_CODE };
 interface StartCallbackServerProps {
     redirectUri: URL;
     timeoutMs?: number;
@@ -12,4 +13,3 @@ interface StartCallbackServerProps {
     signal?: AbortSignal;
 }
 export declare const startServer: ({ redirectUri, timeoutMs, onListening, signal, }: StartCallbackServerProps) => Promise<URL>;
-export {};

package/dist/sessionIdentity.d.ts

@@ -0,0 +1,35 @@
+import type { AuthFlow } from "./types";
+/**
+ * Whether the session acts as a person or as an external application.
+ * Deliberately coarse — `authFlow` carries the precision.
+ */
+export type IdentityType = "User" | "Application";
+/**
+ * Who the current session acts as, as reported by the access token.
+ *
+ * Every field here is read from *unverified* token claims (base64 decode, no
+ * signature check) and exists to be shown to a human. Never branch on it for
+ * an authorization or trust decision.
+ */
+export interface SessionIdentity {
+    type: IdentityType;
+    /** Absent when the CLI did not run the flow itself (e.g. Robot-borrowed). */
+    authFlow?: AuthFlow;
+    /** User identities only — the token's `sub`. */
+    userId?: string;
+    userEmail?: string;
+    userName?: string;
+    /**
+     * Application identities only. User tokens also carry a `client_id` — the
+     * CLI's own — and surfacing that would read as if an app were acting.
+     */
+    clientId?: string;
+}
+/** Narrow an on-disk `UIPATH_AUTH_FLOW` value to a known flow. */
+export declare const parseAuthFlow: (value: string | undefined) => AuthFlow | undefined;
+/**
+ * Derive the acting identity from an access token and, when known, the flow
+ * that produced it. Returns undefined when neither says anything — better to
+ * omit the fields than to guess at who is acting.
+ */
+export declare const resolveSessionIdentity: (accessToken: string | undefined, authFlow?: AuthFlow) => SessionIdentity | undefined;

package/dist/tenantSelection.d.ts

@@ -12,6 +12,18 @@ export interface TenantsAndOrganizations {
     tenants: Tenant[];
     organization: Organization;
 }
-/** Fetch tenants and organizations from UiPath Cloud. */
+/**
+ * Fetch tenants and organizations from UiPath Cloud.
+ *
+ * @param organizationId - The organization segment of the portal URL. Pass the
+ * organization's name whenever it is known: the name is the segment that
+ * routes reliably, and it is never confused with the account GUID that
+ * licensing and analytics APIs take as `accountId`. The id works during login,
+ * where the token is always fresh — login has only the id at this point, the
+ * name is what this call returns — but it is not a like-for-like substitute
+ * later on: the portal has been seen answering `401` to the id (and to a
+ * case-variant of the name) on an aged-but-valid session that the exact name
+ * still resolves. So the id is a last-resort fallback, not an equal option.
+ */
 export declare const fetchTenantsAndOrganizations: (baseUrl: string, accessToken: string, organizationId: string) => Promise<TenantsAndOrganizations>;
 export {};

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@uipath/auth",
   "license": "MIT",
-  "version": "1.200.0-preview.120",
+  "version": "1.201.0-preview.121",
   "repository": {
     "type": "git",
     "url": "https://github.com/UiPath/cli.git",
@@ -37,5 +37,5 @@
     "mihaigirleanu",
     "vlad-uipath"
   ],
-  "gitHead": "173ad4b4930bd3e17a493b32e9f1c3c616ea1c10"
+  "gitHead": "c70ccfc0b12e637441d67df1d212b71d7784b5f8"
 }