@uipath/auth 1.203.0-preview.235 → 1.203.0-preview.237

package/dist/index.browser.d.ts

@@ -4,7 +4,7 @@ export * from "./clientCredentials";
 export { type AuthFileConfig, InvalidBaseUrlError, setAuthFileConfig, } from "./config";
 export * from "./loginStatus";
 export * from "./logout";
-export { type IdentityType, parseAuthFlow, resolveSessionIdentity, type SessionIdentity, } from "./sessionIdentity";
+export { type IdentityType, parseAuthFlow, readTokenScopes, resolveSessionIdentity, type SessionIdentity, } from "./sessionIdentity";
 export { fetchTenantsAndOrganizations, type Tenant, type TenantsAndOrganizations, } from "./tenantSelection";
 export * from "./tokenRefresh";
 export { AUTH_FLOW_ENV_VAR, type AuthFlow, type BaseCredentials, } from "./types";

package/dist/index.browser.js

@@ -18575,6 +18575,12 @@ var resolveSessionIdentity = (accessToken, authFlow) => {
     identity.clientId = clientId;
   return identity;
 };
+var pickScopes = (claims) => {
+  const raw = claims?.scope;
+  const scopes = Array.isArray(raw) ? raw.filter((entry) => asString(entry) !== undefined) : typeof raw === "string" ? raw.split(/\s+/).filter(Boolean) : [];
+  return scopes.length > 0 ? scopes : undefined;
+};
+var readTokenScopes = (accessToken) => accessToken ? pickScopes(decodeClaims(accessToken)) : undefined;
 
 // src/envAuth.ts
 var ENV_AUTH_ENABLE_VAR = "UIPATH_CLI_ENABLE_ENV_AUTH";
@@ -19829,6 +19835,7 @@ export {
   normalizeAuthProfileName,
   parseAuthFlow,
   parseJWT,
+  readTokenScopes,
   refreshAccessToken,
   resolveAuthProfileDirPath,
   resolveAuthProfileFilePath,
@@ -19841,4 +19848,4 @@ export {
   setAuthFileConfig
 };
 
-//# debugId=BA72FB3851B49E2164756E2164756E21
+//# debugId=EFFF7E2FDCC23FB564756E2164756E21

package/dist/index.d.ts

@@ -12,7 +12,7 @@ export * from "./logout";
 export { clearRefreshBreaker, loadRefreshBreaker, type RefreshBreakerState, refreshTokenFingerprint, saveRefreshBreaker, } from "./refreshCircuitBreaker";
 export { type RobotClientModuleLoader, registerRobotClientLoader, } from "./robotClientFallback";
 export { INVALID_TENANT_CODE, InvalidTenantError, isTenantSelectionError, type SelectFromList, selectTenantWithDeps, TENANT_SELECTION_REQUIRED_CODE, TenantSelectionError, TenantSelectionRequiredError, } from "./selectTenant";
-export { type IdentityType, parseAuthFlow, resolveSessionIdentity, type SessionIdentity, } from "./sessionIdentity";
+export { type IdentityType, parseAuthFlow, readTokenScopes, resolveSessionIdentity, type SessionIdentity, } from "./sessionIdentity";
 export { fetchTenantsAndOrganizations, type Tenant, type TenantsAndOrganizations, } from "./tenantSelection";
 export * from "./tokenRefresh";
 export { AUTH_FLOW_ENV_VAR, type AuthFlow, type BaseCredentials, } from "./types";

package/dist/index.js

@@ -2238,6 +2238,12 @@ var resolveSessionIdentity = (accessToken, authFlow) => {
     identity.clientId = clientId;
   return identity;
 };
+var pickScopes = (claims) => {
+  const raw = claims?.scope;
+  const scopes = Array.isArray(raw) ? raw.filter((entry) => asString(entry) !== undefined) : typeof raw === "string" ? raw.split(/\s+/).filter(Boolean) : [];
+  return scopes.length > 0 ? scopes : undefined;
+};
+var readTokenScopes = (accessToken) => accessToken ? pickScopes(decodeClaims(accessToken)) : undefined;
 
 // src/envAuth.ts
 var ENV_AUTH_ENABLE_VAR = "UIPATH_CLI_ENABLE_ENV_AUTH";
@@ -3989,6 +3995,7 @@ export {
   parseAuthFlow,
   parseJWT,
   readAuthFromEnv,
+  readTokenScopes,
   refreshAccessToken,
   refreshTokenFingerprint,
   registerRobotClientLoader,
@@ -4005,4 +4012,4 @@ export {
   setAuthFileConfig
 };
 
-//# debugId=07EEA08E9106212A64756E2164756E21
+//# debugId=BAFB53C69B0A805564756E2164756E21

package/dist/sessionIdentity.d.ts

@@ -33,3 +33,15 @@ export declare const parseAuthFlow: (value: string | undefined) => AuthFlow | un
  * omit the fields than to guess at who is acting.
  */
 export declare const resolveSessionIdentity: (accessToken: string | undefined, authFlow?: AuthFlow) => SessionIdentity | undefined;
+/**
+ * Scopes carried by an access token, in the order Identity returned them.
+ *
+ * Deliberately independent of {@link resolveSessionIdentity}: a token can
+ * carry a `scope` claim while saying too little to name who is acting — no
+ * `sub_type`, no user claims, no known flow — and those are exactly the
+ * sessions that are hardest to diagnose.
+ *
+ * Read from an *unverified* claim (base64 decode, no signature check), for
+ * display only. Never branch on it for an authorization decision.
+ */
+export declare const readTokenScopes: (accessToken: string | undefined) => string[] | undefined;

package/package.json

@@ -2,7 +2,7 @@
     "name": "@uipath/auth",
     "author": "UiPath",
     "license": "SEE LICENSE IN LICENSE.txt",
-    "version": "1.203.0-preview.235",
+    "version": "1.203.0-preview.237",
     "repository": {
         "type": "git",
         "url": "https://github.com/UiPath/cli.git",
@@ -38,5 +38,5 @@
         "mihaigirleanu",
         "vlad-uipath"
     ],
-    "gitHead": "4788b04c17a4429e5a994af2c3eba3898d1c4b13"
+    "gitHead": "4ad3e17a66f2c7fb7fe1f0e3e04a5b6175a0a9a3"
 }