@uipath/auth 1.201.0-preview.132 → 1.202.0-preview.134

package/dist/constants.d.ts

@@ -8,5 +8,6 @@ export declare const DEFAULT_BASE_URL = "https://cloud.uipath.com";
 export declare const DEFAULT_AUTH_TIMEOUT_MS: number;
 export declare const AUTH_TIMEOUT_ERROR_CODE = "EAUTHTIMEOUT";
 export declare const AUTH_CANCELLED_ERROR_CODE = "EAUTHCANCELLED";
+export declare const AUTH_RECLAIMED_ERROR_CODE = "EAUTHRECLAIMED";
 /** Localhost OIDC redirect URI. */
 export declare const DEFAULT_REDIRECT_URI = "http://localhost:8104/oidc/login";

package/dist/envAuth.d.ts

@@ -69,7 +69,13 @@ export declare const isRobotAuthEnforced: () => boolean;
  * is no refresh token in the env-var contract and the CLI has no way
  * to update a secret it did not mint.
  *
- * baseUrl is derived from the token's `iss` claim so the env-var set
- * can stay aligned with the GH #1034 spec (five vars, no URL).
+ * For a JWT, baseUrl is derived from the token's `iss` claim, keeping
+ * the env-var set aligned with the GH #1034 spec (five vars, no URL).
+ * For an opaque token — e.g. a Personal Access Token / reference token,
+ * which UiPath resource APIs accept directly as a bearer credential and
+ * resolve entirely server-side — there is no claim to read the URL from,
+ * so {@link OPAQUE_TOKEN_BASE_URL_VAR} is required instead, and the
+ * returned status carries no `expiration` or `identity` (both would
+ * require decoding claims the token doesn't have).
  */
 export declare const readAuthFromEnv: () => LoginStatus;

package/dist/getBaseHtml.d.ts

@@ -3,5 +3,13 @@ interface GetBaseHtmlProps {
     message: string;
     type: "success" | "error";
 }
+/**
+ * Suffix of the `<title>` of every page this server serves. Doubles as the
+ * fingerprint the EADDRINUSE reclaim probe (server.ts) uses to recognize a
+ * stale `uip login` callback listener, so treat it as a wire format: stale
+ * listeners from older builds are recognized only while the rendered title
+ * keeps ending in " - UiPath CLI" (unchanged since #59).
+ */
+export declare const CALLBACK_PAGE_TITLE_SUFFIX = " - UiPath CLI";
 export declare const getBaseHtml: ({ title, message, type }: GetBaseHtmlProps) => string;
 export {};

package/dist/index.browser.js

@@ -48,20 +48,20 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
 // node:buffer
 var exports_buffer = {};
 __export(exports_buffer, {
-  transcode: () => transcode,
-  resolveObjectURL: () => resolveObjectURL,
-  kStringMaxLength: () => kStringMaxLength,
-  kMaxLength: () => kMaxLength,
-  isUtf8: () => isUtf8,
-  isAscii: () => isAscii,
-  default: () => buffer_default,
-  constants: () => constants,
-  btoa: () => btoa,
-  atob: () => atob2,
-  INSPECT_MAX_BYTES: () => INSPECT_MAX_BYTES,
-  File: () => File,
+  Blob: () => Blob,
   Buffer: () => Buffer2,
-  Blob: () => Blob
+  File: () => File,
+  INSPECT_MAX_BYTES: () => INSPECT_MAX_BYTES,
+  atob: () => atob2,
+  btoa: () => btoa,
+  constants: () => constants,
+  default: () => buffer_default,
+  isAscii: () => isAscii,
+  isUtf8: () => isUtf8,
+  kMaxLength: () => kMaxLength,
+  kStringMaxLength: () => kStringMaxLength,
+  resolveObjectURL: () => resolveObjectURL,
+  transcode: () => transcode
 });
 function getLens(b64) {
   var len2 = b64.length;
@@ -1384,35 +1384,35 @@ var init_buffer = __esm(() => {
 // node:util
 var exports_util = {};
 __export(exports_util, {
-  types: () => types,
-  promisify: () => promisify,
-  log: () => log,
-  isUndefined: () => isUndefined,
-  isSymbol: () => isSymbol,
-  isString: () => isString,
-  isRegExp: () => isRegExp,
-  isPrimitive: () => isPrimitive,
-  isObject: () => isObject,
-  isNumber: () => isNumber,
-  isNullOrUndefined: () => isNullOrUndefined,
-  isNull: () => isNull,
-  isFunction: () => isFunction,
-  isError: () => isError,
-  isDate: () => isDate,
-  isBuffer: () => isBuffer,
-  isBoolean: () => isBoolean,
-  isArray: () => isArray,
-  inspect: () => inspect,
-  inherits: () => inherits,
-  format: () => format,
-  deprecate: () => deprecate,
-  default: () => util_default,
-  debuglog: () => debuglog,
-  callbackifyOnRejected: () => callbackifyOnRejected,
-  callbackify: () => callbackify,
-  _extend: () => _extend,
+  TextDecoder: () => TextDecoder,
   TextEncoder: () => TextEncoder2,
-  TextDecoder: () => TextDecoder
+  _extend: () => _extend,
+  callbackify: () => callbackify,
+  callbackifyOnRejected: () => callbackifyOnRejected,
+  debuglog: () => debuglog,
+  default: () => util_default,
+  deprecate: () => deprecate,
+  format: () => format,
+  inherits: () => inherits,
+  inspect: () => inspect,
+  isArray: () => isArray,
+  isBoolean: () => isBoolean,
+  isBuffer: () => isBuffer,
+  isDate: () => isDate,
+  isError: () => isError,
+  isFunction: () => isFunction,
+  isNull: () => isNull,
+  isNullOrUndefined: () => isNullOrUndefined,
+  isNumber: () => isNumber,
+  isObject: () => isObject,
+  isPrimitive: () => isPrimitive,
+  isRegExp: () => isRegExp,
+  isString: () => isString,
+  isSymbol: () => isSymbol,
+  isUndefined: () => isUndefined,
+  log: () => log,
+  promisify: () => promisify,
+  types: () => types
 });
 function format(f, ...args) {
   if (!isString(f)) {
@@ -1794,16 +1794,16 @@ var init_util = __esm(() => {
 // node:events
 var exports_events = {};
 __export(exports_events, {
-  setMaxListeners: () => setMaxListeners2,
-  once: () => once2,
-  listenerCount: () => listenerCount2,
-  init: () => EventEmitter,
-  getMaxListeners: () => getMaxListeners2,
-  getEventListeners: () => getEventListeners,
-  default: () => events_default,
-  captureRejectionSymbol: () => captureRejectionSymbol,
+  EventEmitter: () => EventEmitter,
   addAbortListener: () => addAbortListener,
-  EventEmitter: () => EventEmitter
+  captureRejectionSymbol: () => captureRejectionSymbol,
+  default: () => events_default,
+  getEventListeners: () => getEventListeners,
+  getMaxListeners: () => getMaxListeners2,
+  init: () => EventEmitter,
+  listenerCount: () => listenerCount2,
+  once: () => once2,
+  setMaxListeners: () => setMaxListeners2
 });
 function emitError(emitter, args) {
   var { _events: events } = emitter;
@@ -2165,7 +2165,7 @@ var init_events = __esm(() => {
 });
 
 // node:stream
-var require_stream = __commonJS((exports, module) => {
+var require_stream = __commonJS(function(exports, module) {
   var __commonJS2 = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
   var require_primordials = __commonJS2((exports2, module2) => {
 
@@ -6089,51 +6089,51 @@ var require_stream = __commonJS((exports, module) => {
 // node:crypto
 var exports_crypto = {};
 __export(exports_crypto, {
-  webcrypto: () => webcrypto,
-  rng: () => rng2,
-  randomUUID: () => randomUUID,
-  randomFillSync: () => randomFillSync2,
-  randomFill: () => randomFill2,
-  randomBytes: () => randomBytes2,
-  publicEncrypt: () => publicEncrypt2,
-  publicDecrypt: () => publicDecrypt2,
-  pseudoRandomBytes: () => pseudoRandomBytes2,
-  prng: () => prng2,
-  privateEncrypt: () => privateEncrypt2,
-  privateDecrypt: () => privateDecrypt2,
-  pbkdf2Sync: () => pbkdf2Sync2,
-  pbkdf2: () => pbkdf22,
-  listCiphers: () => listCiphers2,
-  getRandomValues: () => getRandomValues,
-  getHashes: () => getHashes2,
-  getDiffieHellman: () => getDiffieHellman2,
-  getCurves: () => getCurves,
-  getCiphers: () => getCiphers2,
-  default: () => crypto_default,
-  createVerify: () => createVerify2,
-  createSign: () => createSign2,
-  createHmac: () => createHmac2,
-  createHash: () => createHash2,
-  createECDH: () => createECDH2,
-  createDiffieHellmanGroup: () => createDiffieHellmanGroup2,
-  createDiffieHellman: () => createDiffieHellman2,
-  createDecipheriv: () => createDecipheriv2,
-  createDecipher: () => createDecipher2,
-  createCredentials: () => createCredentials2,
-  createCipheriv: () => createCipheriv2,
-  createCipher: () => createCipher2,
-  constants: () => constants2,
-  Verify: () => Verify2,
-  Sign: () => Sign2,
-  Hmac: () => Hmac2,
-  Hash: () => Hash2,
-  DiffieHellmanGroup: () => DiffieHellmanGroup2,
-  DiffieHellman: () => DiffieHellman2,
-  Decipheriv: () => Decipheriv2,
-  Decipher: () => Decipher2,
-  DEFAULT_ENCODING: () => DEFAULT_ENCODING,
+  Cipher: () => Cipher2,
   Cipheriv: () => Cipheriv2,
-  Cipher: () => Cipher2
+  DEFAULT_ENCODING: () => DEFAULT_ENCODING,
+  Decipher: () => Decipher2,
+  Decipheriv: () => Decipheriv2,
+  DiffieHellman: () => DiffieHellman2,
+  DiffieHellmanGroup: () => DiffieHellmanGroup2,
+  Hash: () => Hash2,
+  Hmac: () => Hmac2,
+  Sign: () => Sign2,
+  Verify: () => Verify2,
+  constants: () => constants2,
+  createCipher: () => createCipher2,
+  createCipheriv: () => createCipheriv2,
+  createCredentials: () => createCredentials2,
+  createDecipher: () => createDecipher2,
+  createDecipheriv: () => createDecipheriv2,
+  createDiffieHellman: () => createDiffieHellman2,
+  createDiffieHellmanGroup: () => createDiffieHellmanGroup2,
+  createECDH: () => createECDH2,
+  createHash: () => createHash2,
+  createHmac: () => createHmac2,
+  createSign: () => createSign2,
+  createVerify: () => createVerify2,
+  default: () => crypto_default,
+  getCiphers: () => getCiphers2,
+  getCurves: () => getCurves,
+  getDiffieHellman: () => getDiffieHellman2,
+  getHashes: () => getHashes2,
+  getRandomValues: () => getRandomValues,
+  listCiphers: () => listCiphers2,
+  pbkdf2: () => pbkdf22,
+  pbkdf2Sync: () => pbkdf2Sync2,
+  privateDecrypt: () => privateDecrypt2,
+  privateEncrypt: () => privateEncrypt2,
+  prng: () => prng2,
+  pseudoRandomBytes: () => pseudoRandomBytes2,
+  publicDecrypt: () => publicDecrypt2,
+  publicEncrypt: () => publicEncrypt2,
+  randomBytes: () => randomBytes2,
+  randomFill: () => randomFill2,
+  randomFillSync: () => randomFillSync2,
+  randomUUID: () => randomUUID,
+  rng: () => rng2,
+  webcrypto: () => webcrypto
 });
 function __accessProp2(key) {
   return this[key];
@@ -18294,7 +18294,7 @@ class InvalidBaseUrlError extends Error {
     super(`Invalid base URL: "${url}"
 ` + `Reason: ${reason}
 
-` + `Expected format: an https:// URL, e.g. https://cloud.uipath.com (commercial), https://govcloud.uipath.us (Public Sector), or your Automation Suite host (https://<your-host>).
+` + `Expected format: an https:// URL (or bare host — https:// is assumed), e.g. https://cloud.uipath.com (commercial), https://govcloud.uipath.us (Public Sector), or your Automation Suite host (https://<your-host>).
 ` + `You can specify the URL via:
 ` + `  • --authority flag
 ` + `  • UIPATH_URL environment variable
@@ -18315,10 +18315,16 @@ var normalizeAndValidateBaseUrl = (rawUrl) => {
   while (baseUrl.endsWith("/")) {
     baseUrl = baseUrl.slice(0, -1);
   }
+  const hasScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(baseUrl);
+  const [hostCandidate] = baseUrl.split(/[/?#]/, 1);
+  if (!hasScheme && hostCandidate.includes(".")) {
+    baseUrl = `https://${baseUrl}`;
+  }
   const resolvedBaseUrl = baseUrl;
   const [urlError, url] = catchError(() => new URL(resolvedBaseUrl));
   if (urlError) {
-    throw new InvalidBaseUrlError(baseUrl, `Malformed URL. ${urlError instanceof Error ? urlError.message : "Unknown error"}`);
+    const shapeHint = !hasScheme && !hostCandidate.includes(".") ? ` "${rawUrl.trim()}" is not a URL or a host name. Pass the full authority URL — https://<host>, or just <host> (https:// is assumed).` : ` ${urlError instanceof Error ? urlError.message : "Unknown error"}`;
+    throw new InvalidBaseUrlError(baseUrl, `Malformed URL.${shapeHint}`);
   }
   if (url.protocol !== "https:") {
     throw new InvalidBaseUrlError(baseUrl, `Authority must use https:// scheme, got ${url.protocol}//. OIDC token exchange requires TLS end-to-end.`);
@@ -18539,6 +18545,17 @@ var requireEnv = (name) => {
   }
   return value;
 };
+var OPAQUE_TOKEN_BASE_URL_VAR = "UIPATH_URL";
+var resolveBaseUrl = (rawUrl, failureContext) => {
+  const [baseUrlError, baseUrl] = catchError(() => normalizeAndValidateBaseUrl(rawUrl));
+  if (baseUrlError) {
+    if (baseUrlError instanceof InvalidBaseUrlError) {
+      throw baseUrlError;
+    }
+    throw new EnvAuthConfigError(`${failureContext}: ` + `${baseUrlError instanceof Error ? baseUrlError.message : String(baseUrlError)}`);
+  }
+  return baseUrl;
+};
 var readAuthFromEnv = () => {
   const accessToken = requireEnv(ENV_AUTH_VARS.token);
   const organizationName = requireEnv(ENV_AUTH_VARS.organizationName);
@@ -18547,19 +18564,29 @@ var readAuthFromEnv = () => {
   const tenantId = requireEnv(ENV_AUTH_VARS.tenantId);
   const [parseError, payload] = catchError(() => parseJWT(accessToken));
   if (parseError) {
-    throw new EnvAuthConfigError(`${ENV_AUTH_VARS.token} is not a valid JWT: ` + `${parseError instanceof Error ? parseError.message : String(parseError)}`);
+    const parseErrorMessage = parseError instanceof Error ? parseError.message : String(parseError);
+    const rawUrl = process.env[OPAQUE_TOKEN_BASE_URL_VAR];
+    if (!rawUrl) {
+      throw new EnvAuthConfigError(`${ENV_AUTH_VARS.token} is not a JWT (treating it as an opaque token, ` + `e.g. a Personal Access Token). Set ${OPAQUE_TOKEN_BASE_URL_VAR} to the ` + `UiPath base URL if this is a PAT, or fix the token if it was meant to ` + `be a JWT (parse error: ${parseErrorMessage}).`);
+    }
+    const baseUrl2 = resolveBaseUrl(rawUrl, `Failed to validate ${OPAQUE_TOKEN_BASE_URL_VAR}`);
+    return {
+      loginStatus: "Logged in",
+      accessToken,
+      baseUrl: baseUrl2,
+      organizationName,
+      organizationId,
+      tenantName,
+      tenantId,
+      source: "env-vars" /* EnvironmentVariables */,
+      hint: "Token is opaque (not a JWT) - expiration and identity cannot be " + "determined locally. Commands will fail with 401 once it is revoked or " + `expired. If this was meant to be a JWT instead of a PAT, note: ${parseErrorMessage}`
+    };
   }
   const iss = payload.iss;
   if (typeof iss !== "string" || iss.length === 0) {
     throw new EnvAuthConfigError(`${ENV_AUTH_VARS.token} has no 'iss' claim; cannot determine ` + `the UiPath server. Ensure the token was issued by a UiPath identity server.`);
   }
-  const [baseUrlError, baseUrl] = catchError(() => normalizeAndValidateBaseUrl(iss));
-  if (baseUrlError) {
-    if (baseUrlError instanceof InvalidBaseUrlError) {
-      throw baseUrlError;
-    }
-    throw new EnvAuthConfigError(`Failed to derive server URL from token 'iss' claim: ` + `${baseUrlError instanceof Error ? baseUrlError.message : String(baseUrlError)}`);
-  }
+  const baseUrl = resolveBaseUrl(iss, "Failed to derive server URL from token 'iss' claim");
   const expiration = getTokenExpiration(accessToken);
   const loginStatus = expiration && expiration <= new Date ? "Expired" : "Logged in";
   const identity = resolveSessionIdentity(accessToken);
@@ -19711,42 +19738,42 @@ var fetchTenantsAndOrganizations = async (baseUrl, accessToken, organizationId)
   return data;
 };
 export {
-  setAuthFileConfig,
-  setActiveAuthProfile,
-  saveEnvFileAsync,
-  runWithAuthProfile,
-  resolveSessionIdentity,
-  resolveEnvFilePathAsync,
-  resolveEnvFileLocationAsync,
-  resolveAuthProfileFilePath,
-  refreshAccessToken,
-  parseJWT,
-  parseAuthFlow,
-  normalizeAuthProfileName,
-  logoutWithDeps,
-  logout,
-  loadEnvFileAsync,
-  isTokenRefreshOAuthFailure,
-  isNode,
-  isBrowser,
-  getLoginStatusWithDeps,
-  getLoginStatusAsync,
-  getAuthEnv,
-  getAuthContext,
-  getActiveAuthProfileFilePath,
-  getActiveAuthProfile,
-  fetchTenantsAndOrganizations,
-  clientCredentialsLogin,
-  clearActiveAuthProfile,
-  TokenRefreshOAuthError,
-  InvalidBaseUrlError,
-  DEFAULT_ENV_FILENAME,
-  DEFAULT_AUTH_PROFILE,
-  DEFAULT_AUTH_FILENAME,
-  CredentialSource,
-  ClientCredentialsAuthenticationError,
+  AUTH_FLOW_ENV_VAR,
   AuthProfileValidationError,
-  AUTH_FLOW_ENV_VAR
+  ClientCredentialsAuthenticationError,
+  CredentialSource,
+  DEFAULT_AUTH_FILENAME,
+  DEFAULT_AUTH_PROFILE,
+  DEFAULT_ENV_FILENAME,
+  InvalidBaseUrlError,
+  TokenRefreshOAuthError,
+  clearActiveAuthProfile,
+  clientCredentialsLogin,
+  fetchTenantsAndOrganizations,
+  getActiveAuthProfile,
+  getActiveAuthProfileFilePath,
+  getAuthContext,
+  getAuthEnv,
+  getLoginStatusAsync,
+  getLoginStatusWithDeps,
+  isBrowser,
+  isNode,
+  isTokenRefreshOAuthFailure,
+  loadEnvFileAsync,
+  logout,
+  logoutWithDeps,
+  normalizeAuthProfileName,
+  parseAuthFlow,
+  parseJWT,
+  refreshAccessToken,
+  resolveAuthProfileFilePath,
+  resolveEnvFileLocationAsync,
+  resolveEnvFilePathAsync,
+  resolveSessionIdentity,
+  runWithAuthProfile,
+  saveEnvFileAsync,
+  setActiveAuthProfile,
+  setAuthFileConfig
 };
 
-//# debugId=7467DDE1FA7C205564756E2164756E21
+//# debugId=2C66658C2F43E99364756E2164756E21

package/dist/index.d.ts

@@ -2,7 +2,7 @@ export * from "./authContext";
 export * from "./authProfile";
 export * from "./clientCredentials";
 export { type AuthFileConfig, InvalidBaseUrlError, setAuthFileConfig, } from "./config";
-export { AUTH_CANCELLED_ERROR_CODE, AUTH_TIMEOUT_ERROR_CODE, DEFAULT_AUTH_TIMEOUT_MS, } from "./constants";
+export { AUTH_CANCELLED_ERROR_CODE, AUTH_RECLAIMED_ERROR_CODE, AUTH_TIMEOUT_ERROR_CODE, DEFAULT_AUTH_TIMEOUT_MS, } from "./constants";
 export { ENFORCE_ROBOT_AUTH_VAR, ENV_AUTH_ENABLE_VAR, ENV_AUTH_VARS, EnvAuthConfigError, isEnvAuthEnabled, isRobotAuthEnforced, readAuthFromEnv, } from "./envAuth";
 export { FederatedCredentialsAuthenticationError, federatedCredentialsLogin, JWT_BEARER_ASSERTION_TYPE, } from "./federatedCredentials";
 export * from "./interactive";
@@ -38,8 +38,15 @@ interface AuthenticateOptions {
     /** Cancels a stuck browser login: closes the local callback server and
      *  rejects with `AUTH_CANCELLED_ERROR_CODE`. Node (local-server) path only. */
     signal?: AbortSignal;
+    /** Invoked once when a stale `uip login` callback listener was holding
+     *  the local port and was released so this login could bind it
+     *  (EADDRINUSE reclaim; Node path only). `pid` names the evicted
+     *  listener when known. */
+    onPortReclaimed?: (details: {
+        pid?: number;
+    }) => void;
 }
-export declare const authenticate: ({ baseUrl, clientId, clientSecret, redirectUri, scope, organization, timeoutMs, noBrowser, onAuthUrl, signal, }: AuthenticateOptions) => Promise<{
+export declare const authenticate: ({ baseUrl, clientId, clientSecret, redirectUri, scope, organization, timeoutMs, noBrowser, onAuthUrl, signal, onPortReclaimed, }: AuthenticateOptions) => Promise<{
     accessToken: string;
     refreshToken: string;
 }>;

package/dist/index.js

@@ -45,7 +45,7 @@ function settlePromiseLike(thenable) {
 }
 
 // src/constants.ts
-var UIPATH_HOME_DIR = ".uipath", AUTH_FILENAME = ".auth", DEFAULT_BASE_URL = "https://cloud.uipath.com", DEFAULT_AUTH_TIMEOUT_MS, AUTH_TIMEOUT_ERROR_CODE = "EAUTHTIMEOUT", AUTH_CANCELLED_ERROR_CODE = "EAUTHCANCELLED", DEFAULT_REDIRECT_URI = "http://localhost:8104/oidc/login";
+var UIPATH_HOME_DIR = ".uipath", AUTH_FILENAME = ".auth", DEFAULT_BASE_URL = "https://cloud.uipath.com", DEFAULT_AUTH_TIMEOUT_MS, AUTH_TIMEOUT_ERROR_CODE = "EAUTHTIMEOUT", AUTH_CANCELLED_ERROR_CODE = "EAUTHCANCELLED", AUTH_RECLAIMED_ERROR_CODE = "EAUTHRECLAIMED", DEFAULT_REDIRECT_URI = "http://localhost:8104/oidc/login";
 var init_constants = __esm(() => {
   DEFAULT_AUTH_TIMEOUT_MS = 5 * 60 * 1000;
 });
@@ -411,9 +411,9 @@ var init_is_in_ssh = __esm(() => {
 // ../../node_modules/open/index.js
 var exports_open = {};
 __export(exports_open, {
-  openApp: () => openApp,
+  apps: () => apps,
   default: () => open_default,
-  apps: () => apps
+  openApp: () => openApp
 });
 import process8 from "node:process";
 import path from "node:path";
@@ -1043,7 +1043,7 @@ var init_browser_strategy = __esm(() => {
 });
 
 // src/getBaseHtml.ts
-var escapeHtml = (value) => value.replace(/[&<>"']/g, (char) => {
+var CALLBACK_PAGE_TITLE_SUFFIX = " - UiPath CLI", escapeHtml = (value) => value.replace(/[&<>"']/g, (char) => {
   switch (char) {
     case "&":
       return "&amp;";
@@ -1069,7 +1069,7 @@ var escapeHtml = (value) => value.replace(/[&<>"']/g, (char) => {
 <head>
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>${safeTitle} - UiPath CLI</title>
+    <title>${safeTitle}${CALLBACK_PAGE_TITLE_SUFFIX}</title>
     <link rel="preconnect" href="https://fonts.googleapis.com">
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
     <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400&family=Poppins:wght@600&display=swap" rel="stylesheet">
@@ -1205,11 +1205,52 @@ var escapeHtml = (value) => value.replace(/[&<>"']/g, (char) => {
 };
 
 // src/server.ts
-var startServer = async ({
+var RECLAIM_PROBE_PATH = "/uip-reclaim-probe", RECLAIM_LISTENER_PID_HEADER = "x-uipath-cli-login-pid", RECLAIM_PROBER_PID_HEADER = "x-uipath-cli-prober-pid", RECLAIM_MARKER, RECLAIM_PROBE_TIMEOUT_MS = 1000, RECLAIM_REBIND_DELAY_MS = 150, RECLAIM_PROBE_READ_LIMIT, probeStaleCallbackListener = (http, host, port) => new Promise((resolve2) => {
+  let sawResponse = false;
+  let listenerPid;
+  let deadline;
+  const settle = (verdict) => {
+    clearTimeout(deadline);
+    resolve2({ verdict, pid: listenerPid });
+  };
+  const req = http.get({
+    host,
+    port,
+    path: RECLAIM_PROBE_PATH,
+    timeout: RECLAIM_PROBE_TIMEOUT_MS,
+    headers: { [RECLAIM_PROBER_PID_HEADER]: String(process.pid) }
+  }, (res) => {
+    sawResponse = true;
+    const rawPid = res.headers[RECLAIM_LISTENER_PID_HEADER];
+    if (typeof rawPid === "string" && /^\d+$/.test(rawPid)) {
+      listenerPid = Number.parseInt(rawPid, 10);
+    }
+    res.on("error", () => {});
+    let body = "";
+    res.setEncoding("utf8");
+    const classify = () => settle(body.includes(RECLAIM_MARKER) ? "reclaimed" : "foreign");
+    res.on("data", (chunk) => {
+      body += chunk;
+      if (body.length >= RECLAIM_PROBE_READ_LIMIT) {
+        classify();
+        req.destroy();
+      }
+    });
+    res.on("end", classify);
+  });
+  const giveUp = () => {
+    settle("foreign");
+    req.destroy();
+  };
+  req.on("timeout", giveUp);
+  deadline = setTimeout(giveUp, RECLAIM_PROBE_TIMEOUT_MS);
+  req.on("error", () => settle(sawResponse ? "foreign" : "gone"));
+}), startServer = async ({
   redirectUri,
   timeoutMs = DEFAULT_AUTH_TIMEOUT_MS,
   onListening,
-  signal
+  signal,
+  onPortReclaimed
 }) => {
   let http;
   try {
@@ -1234,6 +1275,25 @@ var startServer = async ({
         return;
       }
       const url = new URL(req.url, redirectUri);
+      if (url.pathname === RECLAIM_PROBE_PATH) {
+        const proberPidRaw = req.headers[RECLAIM_PROBER_PID_HEADER];
+        const proberPid = typeof proberPidRaw === "string" && /^\d+$/.test(proberPidRaw) ? ` (PID ${proberPidRaw})` : "";
+        res.writeHead(200, {
+          "Content-Type": "text/html; charset=utf-8",
+          Connection: "close",
+          [RECLAIM_LISTENER_PID_HEADER]: String(process.pid)
+        });
+        res.end(getBaseHtml({
+          title: "Login superseded",
+          message: "This sign-in was taken over by a newer 'uip login' on this machine.",
+          type: "error"
+        }));
+        server.close();
+        const err = new Error(`Another 'uip login'${proberPid} on this machine took over the callback port; this login was cancelled.`);
+        err.code = AUTH_RECLAIMED_ERROR_CODE;
+        reject(err);
+        return;
+      }
       const error = url.searchParams.get("error");
       if (error) {
         res.writeHead(400, {
@@ -1278,7 +1338,9 @@ var startServer = async ({
       return;
     });
     let timeoutHandle;
+    let settled = false;
     const onAbort = () => {
+      settled = true;
       clearTimeout(timeoutHandle);
       server.close();
       const err = new Error("Authentication cancelled");
@@ -1293,6 +1355,7 @@ var startServer = async ({
       signal.addEventListener("abort", onAbort, { once: true });
     }
     timeoutHandle = setTimeout(() => {
+      settled = true;
       server.close();
       signal?.removeEventListener("abort", onAbort);
       const err = new Error("Authentication timeout");
@@ -1300,20 +1363,62 @@ var startServer = async ({
       reject(err);
     }, timeoutMs);
     const bindHost = redirectUri.hostname === "localhost" ? "127.0.0.1" : redirectUri.hostname;
-    server.on("error", (err) => {
+    const fail = (err) => {
+      settled = true;
       clearTimeout(timeoutHandle);
       signal?.removeEventListener("abort", onAbort);
       reject(err);
+    };
+    let reclaimAttempted = false;
+    let reclaimed = false;
+    let reclaimedPid;
+    let rebindAttemptsLeft = 0;
+    server.on("listening", () => {
+      Promise.resolve().then(() => {
+        if (reclaimed)
+          onPortReclaimed?.({ pid: reclaimedPid });
+      }).then(() => onListening?.()).catch((err) => {
+        settled = true;
+        server.close();
+        clearTimeout(timeoutHandle);
+        reject(err);
+      });
     });
-    server.listen(Number(redirectUri.port), bindHost, () => {
-      if (onListening) {
-        Promise.resolve(onListening()).catch((err) => {
-          server.close();
-          clearTimeout(timeoutHandle);
-          reject(err);
-        });
+    const listen = () => {
+      if (settled)
+        return;
+      server.listen(Number(redirectUri.port), bindHost);
+    };
+    server.on("error", (err) => {
+      if (settled)
+        return;
+      const code = err.code;
+      if (code === "EADDRINUSE") {
+        if (!reclaimAttempted) {
+          reclaimAttempted = true;
+          probeStaleCallbackListener(http, bindHost, Number(redirectUri.port)).then(({ verdict, pid }) => {
+            if (settled)
+              return;
+            if (verdict === "foreign") {
+              fail(err);
+              return;
+            }
+            reclaimed = verdict === "reclaimed";
+            reclaimedPid = pid;
+            rebindAttemptsLeft = 3;
+            setTimeout(listen, RECLAIM_REBIND_DELAY_MS);
+          });
+          return;
+        }
+        if (rebindAttemptsLeft > 0) {
+          rebindAttemptsLeft -= 1;
+          setTimeout(listen, RECLAIM_REBIND_DELAY_MS);
+          return;
+        }
       }
+      fail(err);
     });
+    listen();
     server.on("close", () => {
       clearTimeout(timeoutHandle);
       signal?.removeEventListener("abort", onAbort);
@@ -1322,6 +1427,8 @@ var startServer = async ({
 };
 var init_server = __esm(() => {
   init_constants();
+  RECLAIM_MARKER = `${CALLBACK_PAGE_TITLE_SUFFIX}</title>`;
+  RECLAIM_PROBE_READ_LIMIT = 16 * 1024;
 });
 
 // src/strategies/node-strategy.ts
@@ -1337,6 +1444,7 @@ class NodeAuthStrategy {
       redirectUri,
       timeoutMs: opts?.timeoutMs,
       signal: opts?.signal,
+      onPortReclaimed: opts?.onPortReclaimed,
       onListening: async () => {
         let safeUrl = "";
         for (const ch of url) {
@@ -1401,7 +1509,7 @@ class InvalidBaseUrlError extends Error {
     super(`Invalid base URL: "${url}"
 ` + `Reason: ${reason}
 
-` + `Expected format: an https:// URL, e.g. https://cloud.uipath.com (commercial), https://govcloud.uipath.us (Public Sector), or your Automation Suite host (https://<your-host>).
+` + `Expected format: an https:// URL (or bare host — https:// is assumed), e.g. https://cloud.uipath.com (commercial), https://govcloud.uipath.us (Public Sector), or your Automation Suite host (https://<your-host>).
 ` + `You can specify the URL via:
 ` + `  • --authority flag
 ` + `  • UIPATH_URL environment variable
@@ -1422,10 +1530,16 @@ var normalizeAndValidateBaseUrl = (rawUrl) => {
   while (baseUrl.endsWith("/")) {
     baseUrl = baseUrl.slice(0, -1);
   }
+  const hasScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(baseUrl);
+  const [hostCandidate] = baseUrl.split(/[/?#]/, 1);
+  if (!hasScheme && hostCandidate.includes(".")) {
+    baseUrl = `https://${baseUrl}`;
+  }
   const resolvedBaseUrl = baseUrl;
   const [urlError, url] = catchError(() => new URL(resolvedBaseUrl));
   if (urlError) {
-    throw new InvalidBaseUrlError(baseUrl, `Malformed URL. ${urlError instanceof Error ? urlError.message : "Unknown error"}`);
+    const shapeHint = !hasScheme && !hostCandidate.includes(".") ? ` "${rawUrl.trim()}" is not a URL or a host name. Pass the full authority URL — https://<host>, or just <host> (https:// is assumed).` : ` ${urlError instanceof Error ? urlError.message : "Unknown error"}`;
+    throw new InvalidBaseUrlError(baseUrl, `Malformed URL.${shapeHint}`);
   }
   if (url.protocol !== "https:") {
     throw new InvalidBaseUrlError(baseUrl, `Authority must use https:// scheme, got ${url.protocol}//. OIDC token exchange requires TLS end-to-end.`);
@@ -1562,17 +1676,6 @@ function b64u(input) {
   }
   return encodeBase64Url(input);
 }
-
-class UnsupportedOperationError extends Error {
-  code;
-  constructor(message, options) {
-    super(message, options);
-    this.name = this.constructor.name;
-    this.code = UNSUPPORTED_OPERATION;
-    Error.captureStackTrace?.(this, this.constructor);
-  }
-}
-
 class OperationProcessingError extends Error {
   code;
   constructor(message, options) {
@@ -1587,60 +1690,6 @@ class OperationProcessingError extends Error {
 function OPE(message, code, cause) {
   return new OperationProcessingError(message, { code, cause });
 }
-async function calculateJwkThumbprint(jwk) {
-  let components;
-  switch (jwk.kty) {
-    case "EC":
-      components = {
-        crv: jwk.crv,
-        kty: jwk.kty,
-        x: jwk.x,
-        y: jwk.y
-      };
-      break;
-    case "OKP":
-      components = {
-        crv: jwk.crv,
-        kty: jwk.kty,
-        x: jwk.x
-      };
-      break;
-    case "AKP":
-      components = {
-        alg: jwk.alg,
-        kty: jwk.kty,
-        pub: jwk.pub
-      };
-      break;
-    case "RSA":
-      components = {
-        e: jwk.e,
-        kty: jwk.kty,
-        n: jwk.n
-      };
-      break;
-    default:
-      throw new UnsupportedOperationError("unsupported JWK key type", { cause: jwk });
-  }
-  return b64u(await crypto.subtle.digest("SHA-256", buf(JSON.stringify(components))));
-}
-function assertCryptoKey(key, it) {
-  if (!(key instanceof CryptoKey)) {
-    throw CodedTypeError(`${it} must be a CryptoKey`, ERR_INVALID_ARG_TYPE);
-  }
-}
-function assertPrivateKey(key, it) {
-  assertCryptoKey(key, it);
-  if (key.type !== "private") {
-    throw CodedTypeError(`${it} must be a private CryptoKey`, ERR_INVALID_ARG_VALUE);
-  }
-}
-function assertPublicKey(key, it) {
-  assertCryptoKey(key, it);
-  if (key.type !== "public") {
-    throw CodedTypeError(`${it} must be a public CryptoKey`, ERR_INVALID_ARG_VALUE);
-  }
-}
 function assertString(input, it, code, cause) {
   try {
     if (typeof input !== "string") {
@@ -1669,72 +1718,6 @@ async function calculatePKCECodeChallenge(codeVerifier) {
   assertString(codeVerifier, "codeVerifier");
   return b64u(await crypto.subtle.digest("SHA-256", buf(codeVerifier)));
 }
-function psAlg(key) {
-  switch (key.algorithm.hash.name) {
-    case "SHA-256":
-      return "PS256";
-    case "SHA-384":
-      return "PS384";
-    case "SHA-512":
-      return "PS512";
-    default:
-      throw new UnsupportedOperationError("unsupported RsaHashedKeyAlgorithm hash name", {
-        cause: key
-      });
-  }
-}
-function rsAlg(key) {
-  switch (key.algorithm.hash.name) {
-    case "SHA-256":
-      return "RS256";
-    case "SHA-384":
-      return "RS384";
-    case "SHA-512":
-      return "RS512";
-    default:
-      throw new UnsupportedOperationError("unsupported RsaHashedKeyAlgorithm hash name", {
-        cause: key
-      });
-  }
-}
-function esAlg(key) {
-  switch (key.algorithm.namedCurve) {
-    case "P-256":
-      return "ES256";
-    case "P-384":
-      return "ES384";
-    case "P-521":
-      return "ES512";
-    default:
-      throw new UnsupportedOperationError("unsupported EcKeyAlgorithm namedCurve", { cause: key });
-  }
-}
-function keyToJws(key) {
-  switch (key.algorithm.name) {
-    case "RSA-PSS":
-      return psAlg(key);
-    case "RSASSA-PKCS1-v1_5":
-      return rsAlg(key);
-    case "ECDSA":
-      return esAlg(key);
-    case "Ed25519":
-    case "ML-DSA-44":
-    case "ML-DSA-65":
-    case "ML-DSA-87":
-      return key.algorithm.name;
-    case "EdDSA":
-      return "Ed25519";
-    default:
-      throw new UnsupportedOperationError("unsupported CryptoKey algorithm name", { cause: key });
-  }
-}
-function getClockSkew(client) {
-  const skew = client?.[clockSkew];
-  return typeof skew === "number" && Number.isFinite(skew) ? skew : 0;
-}
-function epochTime() {
-  return Math.floor(Date.now() / 1000);
-}
 function ClientSecretPost(clientSecret) {
   assertString(clientSecret, '"clientSecret"');
   return (_as, client, body, _headers) => {
@@ -1747,27 +1730,6 @@ function None() {
     body.set("client_id", client.client_id);
   };
 }
-async function signJwt(header, payload, key) {
-  if (!key.usages.includes("sign")) {
-    throw CodedTypeError('CryptoKey instances used for signing assertions must include "sign" in their "usages"', ERR_INVALID_ARG_VALUE);
-  }
-  const input = `${b64u(buf(JSON.stringify(header)))}.${b64u(buf(JSON.stringify(payload)))}`;
-  const signature = b64u(await crypto.subtle.sign(keyToSubtle(key), key, buf(input)));
-  return `${input}.${signature}`;
-}
-var jwkCache;
-async function getSetPublicJwkCache(key, alg) {
-  const { kty, e, n, x, y, crv, pub } = await crypto.subtle.exportKey("jwk", key);
-  const jwk = { kty, e, n, x, y, crv, pub };
-  if (kty === "AKP")
-    jwk.alg = alg;
-  jwkCache.set(key, jwk);
-  return jwk;
-}
-async function publicJwk(key, alg) {
-  jwkCache ||= new WeakMap;
-  return jwkCache.get(key) || getSetPublicJwkCache(key, alg);
-}
 var URLParse = URL.parse ? (url, base) => URL.parse(url, base) : (url, base) => {
   try {
     return new URL(url, base);
@@ -1775,79 +1737,6 @@ var URLParse = URL.parse ? (url, base) => URL.parse(url, base) : (url, base) =>
     return null;
   }
 };
-class DPoPHandler {
-  #header;
-  #privateKey;
-  #publicKey;
-  #clockSkew;
-  #modifyAssertion;
-  #map;
-  #jkt;
-  constructor(client, keyPair, options) {
-    assertPrivateKey(keyPair?.privateKey, '"DPoP.privateKey"');
-    assertPublicKey(keyPair?.publicKey, '"DPoP.publicKey"');
-    if (!keyPair.publicKey.extractable) {
-      throw CodedTypeError('"DPoP.publicKey.extractable" must be true', ERR_INVALID_ARG_VALUE);
-    }
-    this.#modifyAssertion = options?.[modifyAssertion];
-    this.#clockSkew = getClockSkew(client);
-    this.#privateKey = keyPair.privateKey;
-    this.#publicKey = keyPair.publicKey;
-    branded.add(this);
-  }
-  #get(key) {
-    this.#map ||= new Map;
-    let item = this.#map.get(key);
-    if (item) {
-      this.#map.delete(key);
-      this.#map.set(key, item);
-    }
-    return item;
-  }
-  #set(key, val) {
-    this.#map ||= new Map;
-    this.#map.delete(key);
-    if (this.#map.size === 100) {
-      this.#map.delete(this.#map.keys().next().value);
-    }
-    this.#map.set(key, val);
-  }
-  async calculateThumbprint() {
-    if (!this.#jkt) {
-      const jwk = await crypto.subtle.exportKey("jwk", this.#publicKey);
-      this.#jkt ||= await calculateJwkThumbprint(jwk);
-    }
-    return this.#jkt;
-  }
-  async addProof(url, headers, htm, accessToken) {
-    const alg = keyToJws(this.#privateKey);
-    this.#header ||= {
-      alg,
-      typ: "dpop+jwt",
-      jwk: await publicJwk(this.#publicKey, alg)
-    };
-    const nonce = this.#get(url.origin);
-    const now = epochTime() + this.#clockSkew;
-    const payload = {
-      iat: now,
-      jti: randomBytes(),
-      htm,
-      nonce,
-      htu: `${url.origin}${url.pathname}`,
-      ath: accessToken ? b64u(await crypto.subtle.digest("SHA-256", buf(accessToken))) : undefined
-    };
-    this.#modifyAssertion?.(this.#header, payload);
-    headers.set("dpop", await signJwt(this.#header, payload, this.#privateKey));
-  }
-  cacheNonce(response, url) {
-    try {
-      const nonce = response.headers.get("dpop-nonce");
-      if (nonce) {
-        this.#set(url.origin, nonce);
-      }
-    } catch {}
-  }
-}
 var tokenMatch = "[a-zA-Z0-9!#$%&\\'\\*\\+\\-\\.\\^_`\\|~]+";
 var token68Match = "[a-zA-Z0-9\\-\\._\\~\\+\\/]+={0,2}";
 var quotedMatch = '"((?:[^"\\\\]|\\\\[\\s\\S])*)"';
@@ -1864,60 +1753,6 @@ var branded = new WeakSet;
 var nopkce = Symbol();
 var expectNoNonce = Symbol();
 var skipAuthTimeCheck = Symbol();
-var UNSUPPORTED_OPERATION = "OAUTH_UNSUPPORTED_OPERATION";
-function checkRsaKeyAlgorithm(key) {
-  const { algorithm } = key;
-  if (typeof algorithm.modulusLength !== "number" || algorithm.modulusLength < 2048) {
-    throw new UnsupportedOperationError(`unsupported ${algorithm.name} modulusLength`, {
-      cause: key
-    });
-  }
-}
-function ecdsaHashName(key) {
-  const { algorithm } = key;
-  switch (algorithm.namedCurve) {
-    case "P-256":
-      return "SHA-256";
-    case "P-384":
-      return "SHA-384";
-    case "P-521":
-      return "SHA-512";
-    default:
-      throw new UnsupportedOperationError("unsupported ECDSA namedCurve", { cause: key });
-  }
-}
-function keyToSubtle(key) {
-  switch (key.algorithm.name) {
-    case "ECDSA":
-      return {
-        name: key.algorithm.name,
-        hash: ecdsaHashName(key)
-      };
-    case "RSA-PSS": {
-      checkRsaKeyAlgorithm(key);
-      switch (key.algorithm.hash.name) {
-        case "SHA-256":
-        case "SHA-384":
-        case "SHA-512":
-          return {
-            name: key.algorithm.name,
-            saltLength: parseInt(key.algorithm.hash.name.slice(-3), 10) >> 3
-          };
-        default:
-          throw new UnsupportedOperationError("unsupported RSA-PSS hash name", { cause: key });
-      }
-    }
-    case "RSASSA-PKCS1-v1_5":
-      checkRsaKeyAlgorithm(key);
-      return key.algorithm.name;
-    case "ML-DSA-44":
-    case "ML-DSA-65":
-    case "ML-DSA-87":
-    case "Ed25519":
-      return key.algorithm.name;
-  }
-  throw new UnsupportedOperationError("unsupported CryptoKey algorithm name", { cause: key });
-}
 var skipStateCheck = Symbol();
 var expectNoState = Symbol();
 var _nodiscoverycheck = Symbol();
@@ -2373,6 +2208,17 @@ var requireEnv = (name) => {
   }
   return value;
 };
+var OPAQUE_TOKEN_BASE_URL_VAR = "UIPATH_URL";
+var resolveBaseUrl = (rawUrl, failureContext) => {
+  const [baseUrlError, baseUrl] = catchError(() => normalizeAndValidateBaseUrl(rawUrl));
+  if (baseUrlError) {
+    if (baseUrlError instanceof InvalidBaseUrlError) {
+      throw baseUrlError;
+    }
+    throw new EnvAuthConfigError(`${failureContext}: ` + `${baseUrlError instanceof Error ? baseUrlError.message : String(baseUrlError)}`);
+  }
+  return baseUrl;
+};
 var readAuthFromEnv = () => {
   const accessToken = requireEnv(ENV_AUTH_VARS.token);
   const organizationName = requireEnv(ENV_AUTH_VARS.organizationName);
@@ -2381,19 +2227,29 @@ var readAuthFromEnv = () => {
   const tenantId = requireEnv(ENV_AUTH_VARS.tenantId);
   const [parseError, payload] = catchError(() => parseJWT(accessToken));
   if (parseError) {
-    throw new EnvAuthConfigError(`${ENV_AUTH_VARS.token} is not a valid JWT: ` + `${parseError instanceof Error ? parseError.message : String(parseError)}`);
+    const parseErrorMessage = parseError instanceof Error ? parseError.message : String(parseError);
+    const rawUrl = process.env[OPAQUE_TOKEN_BASE_URL_VAR];
+    if (!rawUrl) {
+      throw new EnvAuthConfigError(`${ENV_AUTH_VARS.token} is not a JWT (treating it as an opaque token, ` + `e.g. a Personal Access Token). Set ${OPAQUE_TOKEN_BASE_URL_VAR} to the ` + `UiPath base URL if this is a PAT, or fix the token if it was meant to ` + `be a JWT (parse error: ${parseErrorMessage}).`);
+    }
+    const baseUrl2 = resolveBaseUrl(rawUrl, `Failed to validate ${OPAQUE_TOKEN_BASE_URL_VAR}`);
+    return {
+      loginStatus: "Logged in",
+      accessToken,
+      baseUrl: baseUrl2,
+      organizationName,
+      organizationId,
+      tenantName,
+      tenantId,
+      source: "env-vars" /* EnvironmentVariables */,
+      hint: "Token is opaque (not a JWT) - expiration and identity cannot be " + "determined locally. Commands will fail with 401 once it is revoked or " + `expired. If this was meant to be a JWT instead of a PAT, note: ${parseErrorMessage}`
+    };
   }
   const iss = payload.iss;
   if (typeof iss !== "string" || iss.length === 0) {
     throw new EnvAuthConfigError(`${ENV_AUTH_VARS.token} has no 'iss' claim; cannot determine ` + `the UiPath server. Ensure the token was issued by a UiPath identity server.`);
   }
-  const [baseUrlError, baseUrl] = catchError(() => normalizeAndValidateBaseUrl(iss));
-  if (baseUrlError) {
-    if (baseUrlError instanceof InvalidBaseUrlError) {
-      throw baseUrlError;
-    }
-    throw new EnvAuthConfigError(`Failed to derive server URL from token 'iss' claim: ` + `${baseUrlError instanceof Error ? baseUrlError.message : String(baseUrlError)}`);
-  }
+  const baseUrl = resolveBaseUrl(iss, "Failed to derive server URL from token 'iss' claim");
   const expiration = getTokenExpiration(accessToken);
   const loginStatus = expiration && expiration <= new Date ? "Expired" : "Logged in";
   const identity = resolveSessionIdentity(accessToken);
@@ -3545,6 +3401,7 @@ var federatedCredentialsLogin = async ({
 };
 // src/interactive.ts
 init_src();
+init_constants();
 
 // src/tenantSelection.ts
 var LOGIN_STATUS_HINT = "Run 'uip login status' to see the organization the CLI is signed in to.";
@@ -3732,7 +3589,11 @@ var interactiveLoginWithDeps = async (options, deps) => {
       timeoutMs,
       noBrowser,
       signal,
-      onAuthUrl: noBrowser ? (url) => deliverAuthUrl(url) : undefined
+      onAuthUrl: noBrowser ? (url) => deliverAuthUrl(url) : undefined,
+      onPortReclaimed: ({ pid }) => emit({
+        type: "port-reclaimed",
+        message: `A previous 'uip login'${pid === undefined ? "" : ` (PID ${pid})`} was still holding the callback port ` + `(${new URL(DEFAULT_REDIRECT_URI).port}) and was released; continuing with this login.`
+      })
     });
     return {
       UIPATH_ACCESS_TOKEN: authTokens.accessToken,
@@ -3887,7 +3748,8 @@ var authenticate = async ({
   timeoutMs,
   noBrowser,
   onAuthUrl,
-  signal
+  signal,
+  onPortReclaimed
 }) => {
   const config = await resolveConfigAsync({
     customAuthority: baseUrl,
@@ -3941,7 +3803,8 @@ var authenticate = async ({
     timeoutMs,
     noBrowser,
     onAuthUrl,
-    signal
+    signal,
+    onPortReclaimed
   });
   return await exchangeCodeForTokens({
     code,
@@ -3953,70 +3816,71 @@ var authenticate = async ({
   });
 };
 export {
-  setAuthFileConfig,
-  setActiveAuthProfile,
-  selectTenantWithDeps,
-  saveRefreshBreaker,
-  saveEnvFileAsync,
-  runWithAuthProfile,
-  resolveSessionIdentity,
-  resolveEnvFilePathAsync,
-  resolveEnvFileLocationAsync,
-  resolveAuthProfileFilePath,
-  registerRobotClientLoader,
-  refreshTokenFingerprint,
-  refreshAccessToken,
-  readAuthFromEnv,
-  parseJWT,
-  parseAuthFlow,
-  normalizeAuthProfileName,
-  logoutWithDeps,
-  logout,
-  loadRefreshBreaker,
-  loadEnvFileAsync,
-  isTokenRefreshOAuthFailure,
-  isTenantSelectionError,
-  isRobotAuthEnforced,
-  isNode,
-  isEnvAuthEnabled,
-  isBrowser,
-  interactiveLoginWithDeps,
-  interactiveLogin,
-  getLoginStatusWithDeps,
-  getLoginStatusAsync,
-  getAuthEnv,
-  getAuthContext,
-  getActiveAuthProfileFilePath,
-  getActiveAuthProfile,
-  fetchTenantsAndOrganizations,
-  federatedCredentialsLogin,
-  clientCredentialsLogin,
-  clearRefreshBreaker,
-  clearActiveAuthProfile,
-  authenticate,
-  TokenRefreshOAuthError,
-  TenantSelectionRequiredError,
-  TenantSelectionError,
-  TENANT_SELECTION_REQUIRED_CODE,
-  JWT_BEARER_ASSERTION_TYPE,
-  InvalidTenantError,
-  InvalidBaseUrlError,
-  INVALID_TENANT_CODE,
-  FederatedCredentialsAuthenticationError,
-  EnvAuthConfigError,
-  ENV_AUTH_VARS,
-  ENV_AUTH_ENABLE_VAR,
-  ENFORCE_ROBOT_AUTH_VAR,
-  DEFAULT_ENV_FILENAME,
-  DEFAULT_AUTH_TIMEOUT_MS,
-  DEFAULT_AUTH_PROFILE,
-  DEFAULT_AUTH_FILENAME,
-  CredentialSource,
-  ClientCredentialsAuthenticationError,
-  AuthProfileValidationError,
-  AUTH_TIMEOUT_ERROR_CODE,
+  AUTH_CANCELLED_ERROR_CODE,
   AUTH_FLOW_ENV_VAR,
-  AUTH_CANCELLED_ERROR_CODE
+  AUTH_RECLAIMED_ERROR_CODE,
+  AUTH_TIMEOUT_ERROR_CODE,
+  AuthProfileValidationError,
+  ClientCredentialsAuthenticationError,
+  CredentialSource,
+  DEFAULT_AUTH_FILENAME,
+  DEFAULT_AUTH_PROFILE,
+  DEFAULT_AUTH_TIMEOUT_MS,
+  DEFAULT_ENV_FILENAME,
+  ENFORCE_ROBOT_AUTH_VAR,
+  ENV_AUTH_ENABLE_VAR,
+  ENV_AUTH_VARS,
+  EnvAuthConfigError,
+  FederatedCredentialsAuthenticationError,
+  INVALID_TENANT_CODE,
+  InvalidBaseUrlError,
+  InvalidTenantError,
+  JWT_BEARER_ASSERTION_TYPE,
+  TENANT_SELECTION_REQUIRED_CODE,
+  TenantSelectionError,
+  TenantSelectionRequiredError,
+  TokenRefreshOAuthError,
+  authenticate,
+  clearActiveAuthProfile,
+  clearRefreshBreaker,
+  clientCredentialsLogin,
+  federatedCredentialsLogin,
+  fetchTenantsAndOrganizations,
+  getActiveAuthProfile,
+  getActiveAuthProfileFilePath,
+  getAuthContext,
+  getAuthEnv,
+  getLoginStatusAsync,
+  getLoginStatusWithDeps,
+  interactiveLogin,
+  interactiveLoginWithDeps,
+  isBrowser,
+  isEnvAuthEnabled,
+  isNode,
+  isRobotAuthEnforced,
+  isTenantSelectionError,
+  isTokenRefreshOAuthFailure,
+  loadEnvFileAsync,
+  loadRefreshBreaker,
+  logout,
+  logoutWithDeps,
+  normalizeAuthProfileName,
+  parseAuthFlow,
+  parseJWT,
+  readAuthFromEnv,
+  refreshAccessToken,
+  refreshTokenFingerprint,
+  registerRobotClientLoader,
+  resolveAuthProfileFilePath,
+  resolveEnvFileLocationAsync,
+  resolveEnvFilePathAsync,
+  resolveSessionIdentity,
+  runWithAuthProfile,
+  saveEnvFileAsync,
+  saveRefreshBreaker,
+  selectTenantWithDeps,
+  setActiveAuthProfile,
+  setAuthFileConfig
 };
 
-//# debugId=C655D07F97343A8C64756E2164756E21
+//# debugId=8ECD0F0A4A5E19F264756E2164756E21

package/dist/interactive.d.ts

@@ -28,6 +28,9 @@ export type InteractiveLoginEvent = {
 } | {
     type: "auth-url";
     url: string;
+} | {
+    type: "port-reclaimed";
+    message: string;
 };
 interface InteractiveLoginOptions {
     envFilePath?: string;

package/dist/server.d.ts

@@ -11,5 +11,15 @@ interface StartCallbackServerProps {
      * extension) cancel a stuck login without waiting out `timeoutMs`.
      */
     signal?: AbortSignal;
+    /**
+     * Invoked once when a failed bind was recovered by releasing a stale
+     * `uip login` callback listener that was still holding the port (see the
+     * EADDRINUSE reclaim in this module). Fires right before `onListening`,
+     * so hosts can tell the user what happened alongside the auth URL.
+     * `pid` names the evicted listener when it was new enough to report one.
+     */
+    onPortReclaimed?: (details: {
+        pid?: number;
+    }) => void;
 }
-export declare const startServer: ({ redirectUri, timeoutMs, onListening, signal, }: StartCallbackServerProps) => Promise<URL>;
+export declare const startServer: ({ redirectUri, timeoutMs, onListening, signal, onPortReclaimed, }: StartCallbackServerProps) => Promise<URL>;

package/dist/strategies/auth-strategy.d.ts

@@ -19,6 +19,15 @@ export interface AuthExecuteOptions {
      * rejects. No effect once the flow has already completed.
      */
     signal?: AbortSignal;
+    /**
+     * Invoked once when a stale `uip login` callback listener was holding the
+     * local port and was released so this login could bind it (Node strategy
+     * only — the browser strategy has no local server). Fires before
+     * `onAuthUrl`. `pid` names the evicted listener when known.
+     */
+    onPortReclaimed?: (details: {
+        pid?: number;
+    }) => void;
 }
 export interface IAuthStrategy {
     execute(url: string, redirectUri: URL, expectedState: string, opts?: AuthExecuteOptions): Promise<string>;

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@uipath/auth",
     "license": "MIT",
-    "version": "1.201.0-preview.132",
+    "version": "1.202.0-preview.134",
     "repository": {
         "type": "git",
         "url": "https://github.com/UiPath/cli.git",
@@ -37,5 +37,5 @@
         "mihaigirleanu",
         "vlad-uipath"
     ],
-    "gitHead": "37388a48f899d8f3e7d590f050c5f00485594638"
+    "gitHead": "a335728adbdb02f28308e4f55d8936d0b150444b"
 }