@uipath/auth 1.204.0-preview.255 → 1.205.0-preview.256

package/README.md

@@ -16,7 +16,7 @@ npm install @uipath/auth
 
 ### Log in and save credentials
 
-`interactiveLogin` runs the whole login and writes the result to a credentials file. The flow is chosen by the options: the browser (authorization code + PKCE) by default, client credentials when a client secret is set, federated login when `clientAssertion` is set. The client secret can come from the `clientSecret` option or from a `clientSecret` pushed with `setAuthFileConfig` (the CLI pushes `auth.clientSecret` from `.uipath/config.json`), so with that set, a call with no `clientSecret` uses client credentials, not the browser.
+`interactiveLogin` runs the whole login and writes the result to a credentials file. The flow is chosen by the options: the browser (authorization code + PKCE) by default, client credentials when a client secret is set, federated login when `clientAssertion` is set.
 
 ```ts
 import { interactiveLogin } from "@uipath/auth";

package/dist/config.d.ts

@@ -6,8 +6,6 @@
  * slot is keyed by `Symbol.for()` on `globalThis`.
  */
 export interface AuthFileConfig {
-    clientId?: string;
-    clientSecret?: string;
     authority?: string;
     scopes?: string[];
 }

package/dist/index.browser.d.ts

@@ -4,7 +4,7 @@ export * from "./clientCredentials";
 export { type AuthFileConfig, InvalidBaseUrlError, setAuthFileConfig, } from "./config";
 export * from "./loginStatus";
 export * from "./logout";
-export { type IdentityType, parseAuthFlow, readTokenScopes, resolveSessionIdentity, type SessionIdentity, } from "./sessionIdentity";
+export { type ApplicationSubtype, type IdentityType, parseAuthFlow, readTokenScopes, resolveSessionIdentity, type SessionIdentity, } from "./sessionIdentity";
 export { fetchTenantsAndOrganizations, type Tenant, type TenantsAndOrganizations, } from "./tenantSelection";
 export * from "./tokenRefresh";
 export { AUTH_FLOW_ENV_VAR, type AuthFlow, type BaseCredentials, } from "./types";

package/dist/index.browser.js

@@ -2769,7 +2769,7 @@ var require_stream = __commonJS(function(exports, module) {
     Object.defineProperty(exports2, "__esModule", { value: true });
     var eventTargetShim = require_event_target_shim();
 
-    class AbortSignal extends eventTargetShim.EventTarget {
+    class AbortSignal2 extends eventTargetShim.EventTarget {
       constructor() {
         super();
         throw TypeError("AbortSignal cannot be constructed directly");
@@ -2781,9 +2781,9 @@ var require_stream = __commonJS(function(exports, module) {
         return aborted;
       }
     }
-    eventTargetShim.defineEventAttribute(AbortSignal.prototype, "abort");
+    eventTargetShim.defineEventAttribute(AbortSignal2.prototype, "abort");
     function createAbortSignal() {
-      let signal = Object.create(AbortSignal.prototype);
+      let signal = Object.create(AbortSignal2.prototype);
       return eventTargetShim.EventTarget.call(signal), abortedFlags.set(signal, false), signal;
     }
     function abortSignal(signal) {
@@ -2792,9 +2792,9 @@ var require_stream = __commonJS(function(exports, module) {
       abortedFlags.set(signal, true), signal.dispatchEvent({ type: "abort" });
     }
     var abortedFlags = new WeakMap;
-    Object.defineProperties(AbortSignal.prototype, { aborted: { enumerable: true } });
+    Object.defineProperties(AbortSignal2.prototype, { aborted: { enumerable: true } });
     if (typeof Symbol === "function" && typeof Symbol.toStringTag === "symbol")
-      Object.defineProperty(AbortSignal.prototype, Symbol.toStringTag, { configurable: true, value: "AbortSignal" });
+      Object.defineProperty(AbortSignal2.prototype, Symbol.toStringTag, { configurable: true, value: "AbortSignal" });
 
     class AbortController {
       constructor() {
@@ -2818,14 +2818,14 @@ var require_stream = __commonJS(function(exports, module) {
     if (typeof Symbol === "function" && typeof Symbol.toStringTag === "symbol")
       Object.defineProperty(AbortController.prototype, Symbol.toStringTag, { configurable: true, value: "AbortController" });
     exports2.AbortController = AbortController;
-    exports2.AbortSignal = AbortSignal;
+    exports2.AbortSignal = AbortSignal2;
     exports2.default = AbortController;
     module2.exports = AbortController;
     module2.exports.AbortController = module2.exports.default = AbortController;
-    module2.exports.AbortSignal = AbortSignal;
+    module2.exports.AbortSignal = AbortSignal2;
   });
   var require_util = __commonJS2((exports2, module2) => {
-    var bufferModule = (init_buffer(), __toCommonJS(exports_buffer)), { format: format2, inspect: inspect2 } = require_inspect(), { codes: { ERR_INVALID_ARG_TYPE: ERR_INVALID_ARG_TYPE3 } } = require_errors(), { kResistStopPropagation, AggregateError: AggregateError2, SymbolDispose } = require_primordials(), AbortSignal = globalThis.AbortSignal || require_abort_controller().AbortSignal, AbortController = globalThis.AbortController || require_abort_controller().AbortController, AsyncFunction = Object.getPrototypeOf(async function() {}).constructor, Blob2 = globalThis.Blob || bufferModule.Blob, isBlob = typeof Blob2 < "u" ? function(b) {
+    var bufferModule = (init_buffer(), __toCommonJS(exports_buffer)), { format: format2, inspect: inspect2 } = require_inspect(), { codes: { ERR_INVALID_ARG_TYPE: ERR_INVALID_ARG_TYPE3 } } = require_errors(), { kResistStopPropagation, AggregateError: AggregateError2, SymbolDispose } = require_primordials(), AbortSignal2 = globalThis.AbortSignal || require_abort_controller().AbortSignal, AbortController = globalThis.AbortController || require_abort_controller().AbortController, AsyncFunction = Object.getPrototypeOf(async function() {}).constructor, Blob2 = globalThis.Blob || bufferModule.Blob, isBlob = typeof Blob2 < "u" ? function(b) {
       return b instanceof Blob2;
     } : function(b) {
       return false;
@@ -2879,7 +2879,7 @@ var require_stream = __commonJS(function(exports, module) {
         var _removeEventListener;
         (_removeEventListener = removeEventListener) === null || _removeEventListener === undefined || _removeEventListener();
       } };
-    }, AbortSignalAny: AbortSignal.any || function(signals) {
+    }, AbortSignalAny: AbortSignal2.any || function(signals) {
       if (signals.length === 1)
         return signals[0];
       let ac = new AbortController, abort = () => ac.abort();
@@ -18413,22 +18413,12 @@ var resolveConfigAsync = async ({
     baseUrl = DEFAULT_BASE_URL;
   }
   baseUrl = normalizeAndValidateBaseUrl(baseUrl);
-  let clientId = customClientId;
-  if (!clientId && fileAuth.clientId) {
-    clientId = fileAuth.clientId;
-  }
-  if (!clientId) {
-    clientId = DEFAULT_CLIENT_ID;
-  }
-  let clientSecret = customClientSecret;
-  if (!clientSecret && fileAuth.clientSecret) {
-    clientSecret = fileAuth.clientSecret;
-  }
-  const isExternalAppAuth = clientId !== DEFAULT_CLIENT_ID && (Boolean(clientSecret) || Boolean(customClientAssertion));
+  const clientId = customClientId || DEFAULT_CLIENT_ID;
+  const isExternalAppAuth = clientId !== DEFAULT_CLIENT_ID && (Boolean(customClientSecret) || Boolean(customClientAssertion));
   const scopes = resolveScopes(isExternalAppAuth, customScopes, fileAuth.scopes);
   return {
     clientId,
-    clientSecret,
+    clientSecret: customClientSecret,
     scopes,
     baseUrl,
     authorizationEndpoint: `${baseUrl}/identity_/connect/authorize`,
@@ -18537,6 +18527,16 @@ var resolveIdentityType = (claims, authFlow, email) => {
   }
   return;
 };
+var resolveApplicationSubtype = (claims, authFlow) => {
+  switch (asString(claims?.sub_type)) {
+    case "service.external":
+      return "External";
+    case "service.internal":
+      return "Internal";
+    default:
+      return authFlow === "client_credentials" || authFlow === "federated_credentials" ? "External" : undefined;
+  }
+};
 var looksLikeEmail = (value) => value?.includes("@") ?? false;
 var pickEmail = (claims) => {
   for (const candidate of [claims?.email, claims?.preferred_username]) {
@@ -18578,6 +18578,12 @@ var resolveSessionIdentity = (accessToken, authFlow) => {
   const clientId = asString(claims?.client_id);
   if (clientId)
     identity.clientId = clientId;
+  const subType = asString(claims?.sub_type);
+  if (subType)
+    identity.subType = subType;
+  const applicationSubtype = resolveApplicationSubtype(claims, authFlow);
+  if (applicationSubtype)
+    identity.applicationSubtype = applicationSubtype;
   return identity;
 };
 var readTokenScopes = (accessToken) => accessToken ? pickScopes(decodeClaims(accessToken)) : undefined;
@@ -18872,6 +18878,40 @@ var tryRobotClientFallback = async (options = {}) => {
   }
 };
 
+// src/tenantSelection.ts
+var LOGIN_STATUS_HINT = "Run 'uip login status' to see the organization the CLI is signed in to.";
+var organizationHint = (organizationId) => `The request used '${organizationId}' as the organization. ${LOGIN_STATUS_HINT}`;
+var IDENTIFIER_STATUSES = new Set([400, 403, 404]);
+var describeNonJsonResponse = (organizationId, response, parseError) => {
+  if (response.redirected) {
+    return `Could not find organization '${organizationId}': the request was ` + `redirected to a sign-in page instead of the organization's tenant ` + `list. ${LOGIN_STATUS_HINT}`;
+  }
+  const contentType = response.headers.get("content-type") ?? "unknown";
+  return `The organization service returned a '${contentType}' response instead ` + `of JSON: ${parseError.message}. ${organizationHint(organizationId)}`;
+};
+var fetchTenantsAndOrganizations = async (baseUrl, accessToken, organizationId, signal) => {
+  const url = `${baseUrl}/${organizationId}/portal_/api/filtering/leftnav/tenantsAndOrganizationInfo`;
+  const response = await fetch(url, {
+    headers: {
+      Authorization: `Bearer ${accessToken}`
+    },
+    ...signal ? { signal } : {}
+  });
+  if (!response.ok) {
+    if (response.status === 401) {
+      throw new Error(`Unauthorized: the access token was rejected, it was not ` + `issued for organization '${organizationId}', or ` + `'${organizationId}' was not accepted as an organization ` + `URL segment in this environment. ` + LOGIN_STATUS_HINT);
+    }
+    const errorText = await response.text();
+    const message = `Failed to get tenants and organizations: ${response.status} ${errorText}`;
+    throw new Error(IDENTIFIER_STATUSES.has(response.status) ? `${message}. ${organizationHint(organizationId)}` : message);
+  }
+  const [parseError, data] = await catchError(response.json());
+  if (parseError) {
+    throw new Error(describeNonJsonResponse(organizationId, response, parseError));
+  }
+  return data;
+};
+
 // src/tokenRefresh.ts
 var TOKEN_REFRESH_REAUTHENTICATE_MESSAGE = "Token refresh failed. Run 'uip login' to re-authenticate.";
 
@@ -19092,6 +19132,8 @@ var CredentialSource;
   CredentialSource2["Robot"] = "robot";
   CredentialSource2["EnvironmentVariables"] = "env-vars";
 })(CredentialSource ||= {});
+var defaultRobotTenantIdCache = new Map;
+var ROBOT_TENANT_LOOKUP_TIMEOUT_MS = 5000;
 var getLoginStatusAsync = async (options = {}) => {
   return getLoginStatusWithDeps(options);
 };
@@ -19104,12 +19146,20 @@ var getLoginStatusWithDeps = async (options = {}, deps = {}) => {
     refreshToken: refreshTokenFn = refreshAccessToken,
     resolveConfig = resolveConfigAsync,
     robotFallback = tryRobotClientFallback,
+    fetchTenantsAndOrgs = fetchTenantsAndOrganizations,
+    robotTenantIdCache = defaultRobotTenantIdCache,
+    robotTenantLookupTimeoutMs = ROBOT_TENANT_LOOKUP_TIMEOUT_MS,
     loadBreaker = loadRefreshBreaker,
     saveBreaker = saveRefreshBreaker,
     clearBreaker = clearRefreshBreaker
   } = deps;
+  const robotDeps = {
+    fetchTenantsAndOrgs,
+    cache: robotTenantIdCache,
+    lookupTimeoutMs: robotTenantLookupTimeoutMs
+  };
   if (isRobotAuthEnforced()) {
-    return resolveRobotEnforcedStatus(robotFallback);
+    return resolveRobotEnforcedStatus(robotFallback, robotDeps);
   }
   if (isEnvAuthEnabled()) {
     return readAuthFromEnv();
@@ -19127,7 +19177,7 @@ var getLoginStatusWithDeps = async (options = {}, deps = {}) => {
         hint: `No credentials found for profile "${activeProfile}". Run 'uip login --profile ${activeProfile}' to authenticate this profile.`
       };
     }
-    return resolveBorrowedRobotStatus(robotFallback);
+    return resolveBorrowedRobotStatus(robotFallback, robotDeps);
   }
   const loaded = await loadFileCredentials(loadEnvFile, absolutePath);
   if ("status" in loaded) {
@@ -19169,7 +19219,7 @@ var getLoginStatusWithDeps = async (options = {}, deps = {}) => {
   }
   return buildFileStatus(tokens, credentials, globalHint);
 };
-async function resolveRobotEnforcedStatus(robotFallback) {
+async function resolveRobotEnforcedStatus(robotFallback, deps) {
   if (isEnvAuthEnabled()) {
     throw new EnvAuthConfigError(`${ENV_AUTH_ENABLE_VAR}=true and ${ENFORCE_ROBOT_AUTH_VAR}=true ` + `are mutually exclusive. Unset one of them and re-run.`);
   }
@@ -19180,11 +19230,11 @@ async function resolveRobotEnforcedStatus(robotFallback) {
       hint: `${ENFORCE_ROBOT_AUTH_VAR}=true but the UiPath Robot ` + `session is unavailable. Start and sign in to the Assistant, ` + `or unset ${ENFORCE_ROBOT_AUTH_VAR} to fall back to file or ` + `env-var authentication.`
     };
   }
-  return buildRobotStatus(robotCreds);
+  return buildRobotStatus(robotCreds, deps);
 }
-async function resolveBorrowedRobotStatus(robotFallback) {
+async function resolveBorrowedRobotStatus(robotFallback, deps) {
   const robotCreds = await robotFallback();
-  return robotCreds ? buildRobotStatus(robotCreds) : { loginStatus: "Not logged in" };
+  return robotCreds ? buildRobotStatus(robotCreds, deps) : { loginStatus: "Not logged in" };
 }
 async function loadFileCredentials(loadEnvFile, absolutePath) {
   let credentials;
@@ -19319,9 +19369,10 @@ function identityFields(accessToken, credentials) {
     ...scopes ? { scopes } : {}
   };
 }
-function buildRobotStatus(robotCreds) {
+async function buildRobotStatus(robotCreds, deps) {
   const identity = resolveSessionIdentity(robotCreds.accessToken);
   const scopes = readTokenScopes(robotCreds.accessToken);
+  const tenant = robotCreds.tenantId ? { tenantId: robotCreds.tenantId } : await resolveRobotTenantId(robotCreds, deps);
   return {
     loginStatus: "Logged in",
     accessToken: robotCreds.accessToken,
@@ -19329,14 +19380,62 @@ function buildRobotStatus(robotCreds) {
     organizationName: robotCreds.organizationName,
     organizationId: robotCreds.organizationId,
     tenantName: robotCreds.tenantName,
-    tenantId: robotCreds.tenantId,
+    tenantId: tenant.tenantId,
     issuer: robotCreds.issuer,
     expiration: getTokenExpiration(robotCreds.accessToken),
     source: "robot" /* Robot */,
+    ...tenant.hint ? { hint: tenant.hint } : {},
     ...identity ? { identity } : {},
     ...scopes ? { scopes } : {}
   };
 }
+async function resolveRobotTenantId(robotCreds, deps) {
+  const { baseUrl, accessToken, tenantName } = robotCreds;
+  const organization = robotCreds.organizationName ?? robotCreds.organizationId;
+  if (!tenantName || !organization) {
+    return {};
+  }
+  const key = `${baseUrl}|${organization}|${tenantName}|${accessToken}`;
+  let pending = deps.cache.get(key);
+  if (!pending) {
+    pending = catchError(lookupRobotTenantId({ baseUrl, accessToken, organization, tenantName }, deps)).then(([error, resolution]) => {
+      const settled = error ? { hint: tenantLookupFailureHint(tenantName, error.message) } : resolution;
+      if (!settled.tenantId) {
+        deps.cache.delete(key);
+      }
+      return settled;
+    });
+    deps.cache.set(key, pending);
+  }
+  return pending;
+}
+async function lookupRobotTenantId(target, deps) {
+  const { baseUrl, accessToken, organization, tenantName } = target;
+  const [error, data] = await catchError(deps.fetchTenantsAndOrgs(baseUrl, accessToken, organization, AbortSignal.timeout(deps.lookupTimeoutMs)));
+  if (error) {
+    const reason = error.name === "TimeoutError" ? `the tenant list did not answer within ${deps.lookupTimeoutMs} ms.` : error.message;
+    return { hint: tenantLookupFailureHint(tenantName, reason) };
+  }
+  const rows = data?.tenants;
+  const tenants = Array.isArray(rows) ? rows.filter((tenant) => typeof tenant?.id === "string" && typeof tenant?.name === "string") : [];
+  const wantedName = decodePathSegment(tenantName);
+  const wanted = wantedName.toLowerCase();
+  const match = tenants.find((tenant) => tenant.name === wantedName) ?? tenants.find((tenant) => tenant.name.toLowerCase() === wanted);
+  if (!match) {
+    const names = tenants.map((tenant) => tenant.name).join(", ");
+    return {
+      hint: `The Robot session targets tenant '${tenantName}', but ` + `organization '${organization}' lists no tenant of that name` + `${names ? ` (available: ${names})` : ""}. Commands that need ` + `the tenant id will fail until it can be resolved.`
+    };
+  }
+  return { tenantId: match.id };
+}
+function tenantLookupFailureHint(tenantName, reason) {
+  return `Could not resolve the id of tenant '${tenantName}' from the ` + `Robot session: ${reason} Commands that need the tenant id will ` + `fail until it can be resolved.`;
+}
+function decodePathSegment(segment) {
+  const [error, decoded] = catchError(() => decodeURIComponent(segment));
+  return error ? segment : decoded;
+}
 var isFileNotFoundError = (error) => {
   if (!(error instanceof Object))
     return false;
@@ -19780,38 +19879,6 @@ async function logoutWithDeps(options, deps = {}) {
 async function logout(options) {
   return logoutWithDeps(options);
 }
-// src/tenantSelection.ts
-var LOGIN_STATUS_HINT = "Run 'uip login status' to see the organization the CLI is signed in to.";
-var organizationHint = (organizationId) => `The request used '${organizationId}' as the organization. ${LOGIN_STATUS_HINT}`;
-var IDENTIFIER_STATUSES = new Set([400, 403, 404]);
-var describeNonJsonResponse = (organizationId, response, parseError) => {
-  if (response.redirected) {
-    return `Could not find organization '${organizationId}': the request was ` + `redirected to a sign-in page instead of the organization's tenant ` + `list. ${LOGIN_STATUS_HINT}`;
-  }
-  const contentType = response.headers.get("content-type") ?? "unknown";
-  return `The organization service returned a '${contentType}' response instead ` + `of JSON: ${parseError.message}. ${organizationHint(organizationId)}`;
-};
-var fetchTenantsAndOrganizations = async (baseUrl, accessToken, organizationId) => {
-  const url = `${baseUrl}/${organizationId}/portal_/api/filtering/leftnav/tenantsAndOrganizationInfo`;
-  const response = await fetch(url, {
-    headers: {
-      Authorization: `Bearer ${accessToken}`
-    }
-  });
-  if (!response.ok) {
-    if (response.status === 401) {
-      throw new Error(`Unauthorized: the access token was rejected, it was not ` + `issued for organization '${organizationId}', or ` + `'${organizationId}' was not accepted as an organization ` + `URL segment in this environment. ` + LOGIN_STATUS_HINT);
-    }
-    const errorText = await response.text();
-    const message = `Failed to get tenants and organizations: ${response.status} ${errorText}`;
-    throw new Error(IDENTIFIER_STATUSES.has(response.status) ? `${message}. ${organizationHint(organizationId)}` : message);
-  }
-  const [parseError, data] = await catchError(response.json());
-  if (parseError) {
-    throw new Error(describeNonJsonResponse(organizationId, response, parseError));
-  }
-  return data;
-};
 export {
   AUTH_FLOW_ENV_VAR,
   AuthProfileValidationError,
@@ -19857,4 +19924,4 @@ export {
   setAuthFileConfig
 };
 
-//# debugId=444F587B7EE9CE7764756E2164756E21
+//# debugId=0E042F445778F04E64756E2164756E21

package/dist/index.d.ts

@@ -12,7 +12,7 @@ export * from "./logout";
 export { clearRefreshBreaker, loadRefreshBreaker, type RefreshBreakerState, refreshTokenFingerprint, saveRefreshBreaker, } from "./refreshCircuitBreaker";
 export { type RobotClientModuleLoader, registerRobotClientLoader, } from "./robotClientFallback";
 export { INVALID_TENANT_CODE, InvalidTenantError, isTenantSelectionError, type SelectFromList, selectTenantWithDeps, TENANT_SELECTION_REQUIRED_CODE, TenantSelectionError, TenantSelectionRequiredError, } from "./selectTenant";
-export { type IdentityType, parseAuthFlow, readTokenScopes, resolveSessionIdentity, type SessionIdentity, } from "./sessionIdentity";
+export { type ApplicationSubtype, type IdentityType, parseAuthFlow, readTokenScopes, resolveSessionIdentity, type SessionIdentity, } from "./sessionIdentity";
 export { fetchTenantsAndOrganizations, type Tenant, type TenantsAndOrganizations, } from "./tenantSelection";
 export * from "./tokenRefresh";
 export { AUTH_FLOW_ENV_VAR, type AuthFlow, type BaseCredentials, } from "./types";

package/dist/index.js

@@ -892,6 +892,16 @@ class NodeFileSystem {
   async rename(oldPath, newPath) {
     await fs6.rename(oldPath, newPath);
   }
+  async isSymbolicLink(filePath) {
+    try {
+      return (await fs6.lstat(filePath)).isSymbolicLink();
+    } catch (error) {
+      if (this.isEnoent(error) || this.hasErrnoCode(error, "ENOTDIR")) {
+        return false;
+      }
+      throw error;
+    }
+  }
   async realpath(filePath) {
     try {
       return await fs6.realpath(filePath);
@@ -1571,22 +1581,12 @@ var resolveConfigAsync = async ({
     baseUrl = DEFAULT_BASE_URL;
   }
   baseUrl = normalizeAndValidateBaseUrl(baseUrl);
-  let clientId = customClientId;
-  if (!clientId && fileAuth.clientId) {
-    clientId = fileAuth.clientId;
-  }
-  if (!clientId) {
-    clientId = DEFAULT_CLIENT_ID;
-  }
-  let clientSecret = customClientSecret;
-  if (!clientSecret && fileAuth.clientSecret) {
-    clientSecret = fileAuth.clientSecret;
-  }
-  const isExternalAppAuth = clientId !== DEFAULT_CLIENT_ID && (Boolean(clientSecret) || Boolean(customClientAssertion));
+  const clientId = customClientId || DEFAULT_CLIENT_ID;
+  const isExternalAppAuth = clientId !== DEFAULT_CLIENT_ID && (Boolean(customClientSecret) || Boolean(customClientAssertion));
   const scopes = resolveScopes(isExternalAppAuth, customScopes, fileAuth.scopes);
   return {
     clientId,
-    clientSecret,
+    clientSecret: customClientSecret,
     scopes,
     baseUrl,
     authorizationEndpoint: `${baseUrl}/identity_/connect/authorize`,
@@ -2200,6 +2200,16 @@ var resolveIdentityType = (claims, authFlow, email) => {
   }
   return;
 };
+var resolveApplicationSubtype = (claims, authFlow) => {
+  switch (asString(claims?.sub_type)) {
+    case "service.external":
+      return "External";
+    case "service.internal":
+      return "Internal";
+    default:
+      return authFlow === "client_credentials" || authFlow === "federated_credentials" ? "External" : undefined;
+  }
+};
 var looksLikeEmail = (value) => value?.includes("@") ?? false;
 var pickEmail = (claims) => {
   for (const candidate of [claims?.email, claims?.preferred_username]) {
@@ -2241,6 +2251,12 @@ var resolveSessionIdentity = (accessToken, authFlow) => {
   const clientId = asString(claims?.client_id);
   if (clientId)
     identity.clientId = clientId;
+  const subType = asString(claims?.sub_type);
+  if (subType)
+    identity.subType = subType;
+  const applicationSubtype = resolveApplicationSubtype(claims, authFlow);
+  if (applicationSubtype)
+    identity.applicationSubtype = applicationSubtype;
   return identity;
 };
 var readTokenScopes = (accessToken) => accessToken ? pickScopes(decodeClaims(accessToken)) : undefined;
@@ -2538,6 +2554,40 @@ var tryRobotClientFallback = async (options = {}) => {
   }
 };
 
+// src/tenantSelection.ts
+var LOGIN_STATUS_HINT = "Run 'uip login status' to see the organization the CLI is signed in to.";
+var organizationHint = (organizationId) => `The request used '${organizationId}' as the organization. ${LOGIN_STATUS_HINT}`;
+var IDENTIFIER_STATUSES = new Set([400, 403, 404]);
+var describeNonJsonResponse = (organizationId, response, parseError) => {
+  if (response.redirected) {
+    return `Could not find organization '${organizationId}': the request was ` + `redirected to a sign-in page instead of the organization's tenant ` + `list. ${LOGIN_STATUS_HINT}`;
+  }
+  const contentType = response.headers.get("content-type") ?? "unknown";
+  return `The organization service returned a '${contentType}' response instead ` + `of JSON: ${parseError.message}. ${organizationHint(organizationId)}`;
+};
+var fetchTenantsAndOrganizations = async (baseUrl, accessToken, organizationId, signal) => {
+  const url = `${baseUrl}/${organizationId}/portal_/api/filtering/leftnav/tenantsAndOrganizationInfo`;
+  const response = await fetch(url, {
+    headers: {
+      Authorization: `Bearer ${accessToken}`
+    },
+    ...signal ? { signal } : {}
+  });
+  if (!response.ok) {
+    if (response.status === 401) {
+      throw new Error(`Unauthorized: the access token was rejected, it was not ` + `issued for organization '${organizationId}', or ` + `'${organizationId}' was not accepted as an organization ` + `URL segment in this environment. ` + LOGIN_STATUS_HINT);
+    }
+    const errorText = await response.text();
+    const message = `Failed to get tenants and organizations: ${response.status} ${errorText}`;
+    throw new Error(IDENTIFIER_STATUSES.has(response.status) ? `${message}. ${organizationHint(organizationId)}` : message);
+  }
+  const [parseError, data] = await catchError(response.json());
+  if (parseError) {
+    throw new Error(describeNonJsonResponse(organizationId, response, parseError));
+  }
+  return data;
+};
+
 // src/tokenRefresh.ts
 var TOKEN_REFRESH_REAUTHENTICATE_MESSAGE = "Token refresh failed. Run 'uip login' to re-authenticate.";
 
@@ -2759,6 +2809,8 @@ var CredentialSource;
   CredentialSource2["Robot"] = "robot";
   CredentialSource2["EnvironmentVariables"] = "env-vars";
 })(CredentialSource ||= {});
+var defaultRobotTenantIdCache = new Map;
+var ROBOT_TENANT_LOOKUP_TIMEOUT_MS = 5000;
 var getLoginStatusAsync = async (options = {}) => {
   return getLoginStatusWithDeps(options);
 };
@@ -2771,12 +2823,20 @@ var getLoginStatusWithDeps = async (options = {}, deps = {}) => {
     refreshToken: refreshTokenFn = refreshAccessToken,
     resolveConfig = resolveConfigAsync,
     robotFallback = tryRobotClientFallback,
+    fetchTenantsAndOrgs = fetchTenantsAndOrganizations,
+    robotTenantIdCache = defaultRobotTenantIdCache,
+    robotTenantLookupTimeoutMs = ROBOT_TENANT_LOOKUP_TIMEOUT_MS,
     loadBreaker = loadRefreshBreaker,
     saveBreaker = saveRefreshBreaker,
     clearBreaker = clearRefreshBreaker
   } = deps;
+  const robotDeps = {
+    fetchTenantsAndOrgs,
+    cache: robotTenantIdCache,
+    lookupTimeoutMs: robotTenantLookupTimeoutMs
+  };
   if (isRobotAuthEnforced()) {
-    return resolveRobotEnforcedStatus(robotFallback);
+    return resolveRobotEnforcedStatus(robotFallback, robotDeps);
   }
   if (isEnvAuthEnabled()) {
     return readAuthFromEnv();
@@ -2794,7 +2854,7 @@ var getLoginStatusWithDeps = async (options = {}, deps = {}) => {
         hint: `No credentials found for profile "${activeProfile}". Run 'uip login --profile ${activeProfile}' to authenticate this profile.`
       };
     }
-    return resolveBorrowedRobotStatus(robotFallback);
+    return resolveBorrowedRobotStatus(robotFallback, robotDeps);
   }
   const loaded = await loadFileCredentials(loadEnvFile, absolutePath);
   if ("status" in loaded) {
@@ -2836,7 +2896,7 @@ var getLoginStatusWithDeps = async (options = {}, deps = {}) => {
   }
   return buildFileStatus(tokens, credentials, globalHint);
 };
-async function resolveRobotEnforcedStatus(robotFallback) {
+async function resolveRobotEnforcedStatus(robotFallback, deps) {
   if (isEnvAuthEnabled()) {
     throw new EnvAuthConfigError(`${ENV_AUTH_ENABLE_VAR}=true and ${ENFORCE_ROBOT_AUTH_VAR}=true ` + `are mutually exclusive. Unset one of them and re-run.`);
   }
@@ -2847,11 +2907,11 @@ async function resolveRobotEnforcedStatus(robotFallback) {
       hint: `${ENFORCE_ROBOT_AUTH_VAR}=true but the UiPath Robot ` + `session is unavailable. Start and sign in to the Assistant, ` + `or unset ${ENFORCE_ROBOT_AUTH_VAR} to fall back to file or ` + `env-var authentication.`
     };
   }
-  return buildRobotStatus(robotCreds);
+  return buildRobotStatus(robotCreds, deps);
 }
-async function resolveBorrowedRobotStatus(robotFallback) {
+async function resolveBorrowedRobotStatus(robotFallback, deps) {
   const robotCreds = await robotFallback();
-  return robotCreds ? buildRobotStatus(robotCreds) : { loginStatus: "Not logged in" };
+  return robotCreds ? buildRobotStatus(robotCreds, deps) : { loginStatus: "Not logged in" };
 }
 async function loadFileCredentials(loadEnvFile, absolutePath) {
   let credentials;
@@ -2986,9 +3046,10 @@ function identityFields(accessToken, credentials) {
     ...scopes ? { scopes } : {}
   };
 }
-function buildRobotStatus(robotCreds) {
+async function buildRobotStatus(robotCreds, deps) {
   const identity = resolveSessionIdentity(robotCreds.accessToken);
   const scopes = readTokenScopes(robotCreds.accessToken);
+  const tenant = robotCreds.tenantId ? { tenantId: robotCreds.tenantId } : await resolveRobotTenantId(robotCreds, deps);
   return {
     loginStatus: "Logged in",
     accessToken: robotCreds.accessToken,
@@ -2996,14 +3057,62 @@ function buildRobotStatus(robotCreds) {
     organizationName: robotCreds.organizationName,
     organizationId: robotCreds.organizationId,
     tenantName: robotCreds.tenantName,
-    tenantId: robotCreds.tenantId,
+    tenantId: tenant.tenantId,
     issuer: robotCreds.issuer,
     expiration: getTokenExpiration(robotCreds.accessToken),
     source: "robot" /* Robot */,
+    ...tenant.hint ? { hint: tenant.hint } : {},
     ...identity ? { identity } : {},
     ...scopes ? { scopes } : {}
   };
 }
+async function resolveRobotTenantId(robotCreds, deps) {
+  const { baseUrl, accessToken, tenantName } = robotCreds;
+  const organization = robotCreds.organizationName ?? robotCreds.organizationId;
+  if (!tenantName || !organization) {
+    return {};
+  }
+  const key = `${baseUrl}|${organization}|${tenantName}|${accessToken}`;
+  let pending = deps.cache.get(key);
+  if (!pending) {
+    pending = catchError(lookupRobotTenantId({ baseUrl, accessToken, organization, tenantName }, deps)).then(([error, resolution]) => {
+      const settled = error ? { hint: tenantLookupFailureHint(tenantName, error.message) } : resolution;
+      if (!settled.tenantId) {
+        deps.cache.delete(key);
+      }
+      return settled;
+    });
+    deps.cache.set(key, pending);
+  }
+  return pending;
+}
+async function lookupRobotTenantId(target, deps) {
+  const { baseUrl, accessToken, organization, tenantName } = target;
+  const [error, data] = await catchError(deps.fetchTenantsAndOrgs(baseUrl, accessToken, organization, AbortSignal.timeout(deps.lookupTimeoutMs)));
+  if (error) {
+    const reason = error.name === "TimeoutError" ? `the tenant list did not answer within ${deps.lookupTimeoutMs} ms.` : error.message;
+    return { hint: tenantLookupFailureHint(tenantName, reason) };
+  }
+  const rows = data?.tenants;
+  const tenants = Array.isArray(rows) ? rows.filter((tenant) => typeof tenant?.id === "string" && typeof tenant?.name === "string") : [];
+  const wantedName = decodePathSegment(tenantName);
+  const wanted = wantedName.toLowerCase();
+  const match = tenants.find((tenant) => tenant.name === wantedName) ?? tenants.find((tenant) => tenant.name.toLowerCase() === wanted);
+  if (!match) {
+    const names = tenants.map((tenant) => tenant.name).join(", ");
+    return {
+      hint: `The Robot session targets tenant '${tenantName}', but ` + `organization '${organization}' lists no tenant of that name` + `${names ? ` (available: ${names})` : ""}. Commands that need ` + `the tenant id will fail until it can be resolved.`
+    };
+  }
+  return { tenantId: match.id };
+}
+function tenantLookupFailureHint(tenantName, reason) {
+  return `Could not resolve the id of tenant '${tenantName}' from the ` + `Robot session: ${reason} Commands that need the tenant id will ` + `fail until it can be resolved.`;
+}
+function decodePathSegment(segment) {
+  const [error, decoded] = catchError(() => decodeURIComponent(segment));
+  return error ? segment : decoded;
+}
 var isFileNotFoundError = (error) => {
   if (!(error instanceof Object))
     return false;
@@ -3534,39 +3643,6 @@ var federatedCredentialsLogin = async ({
 init_src();
 init_constants();
 
-// src/tenantSelection.ts
-var LOGIN_STATUS_HINT = "Run 'uip login status' to see the organization the CLI is signed in to.";
-var organizationHint = (organizationId) => `The request used '${organizationId}' as the organization. ${LOGIN_STATUS_HINT}`;
-var IDENTIFIER_STATUSES = new Set([400, 403, 404]);
-var describeNonJsonResponse = (organizationId, response, parseError) => {
-  if (response.redirected) {
-    return `Could not find organization '${organizationId}': the request was ` + `redirected to a sign-in page instead of the organization's tenant ` + `list. ${LOGIN_STATUS_HINT}`;
-  }
-  const contentType = response.headers.get("content-type") ?? "unknown";
-  return `The organization service returned a '${contentType}' response instead ` + `of JSON: ${parseError.message}. ${organizationHint(organizationId)}`;
-};
-var fetchTenantsAndOrganizations = async (baseUrl, accessToken, organizationId) => {
-  const url = `${baseUrl}/${organizationId}/portal_/api/filtering/leftnav/tenantsAndOrganizationInfo`;
-  const response = await fetch(url, {
-    headers: {
-      Authorization: `Bearer ${accessToken}`
-    }
-  });
-  if (!response.ok) {
-    if (response.status === 401) {
-      throw new Error(`Unauthorized: the access token was rejected, it was not ` + `issued for organization '${organizationId}', or ` + `'${organizationId}' was not accepted as an organization ` + `URL segment in this environment. ` + LOGIN_STATUS_HINT);
-    }
-    const errorText = await response.text();
-    const message = `Failed to get tenants and organizations: ${response.status} ${errorText}`;
-    throw new Error(IDENTIFIER_STATUSES.has(response.status) ? `${message}. ${organizationHint(organizationId)}` : message);
-  }
-  const [parseError, data] = await catchError(response.json());
-  if (parseError) {
-    throw new Error(describeNonJsonResponse(organizationId, response, parseError));
-  }
-  return data;
-};
-
 // src/selectTenant.ts
 var TENANT_SELECTION_REQUIRED_CODE = "TENANT_SELECTION_REQUIRED";
 var INVALID_TENANT_CODE = "INVALID_TENANT";
@@ -4021,4 +4097,4 @@ export {
   setAuthFileConfig
 };
 
-//# debugId=4C387A5C17766AD564756E2164756E21
+//# debugId=3C4FEB497AB4F8C264756E2164756E21

package/dist/loginStatus.d.ts

@@ -3,6 +3,7 @@ import { resolveConfigAsync } from "./config";
 import { clearRefreshBreaker, loadRefreshBreaker, saveRefreshBreaker } from "./refreshCircuitBreaker";
 import { tryRobotClientFallback } from "./robotClientFallback";
 import { type SessionIdentity } from "./sessionIdentity";
+import { fetchTenantsAndOrganizations } from "./tenantSelection";
 import { refreshAccessToken } from "./tokenRefresh";
 import { loadEnvFileAsync, resolveEnvFilePathAsync, saveEnvFileAsync } from "./utils/envFile";
 /**
@@ -92,10 +93,25 @@ export interface LoginStatusDependencies {
     refreshToken?: typeof refreshAccessToken;
     resolveConfig?: typeof resolveConfigAsync;
     robotFallback?: typeof tryRobotClientFallback;
+    /**
+     * Portal lookup that turns the tenant named in the Robot's Orchestrator
+     * URL into the tenant id — see {@link resolveRobotTenantId}.
+     */
+    fetchTenantsAndOrgs?: typeof fetchTenantsAndOrganizations;
+    /** Memo for {@link resolveRobotTenantId}; tests pass a fresh one. */
+    robotTenantIdCache?: RobotTenantIdCache;
+    /** Timeout for that lookup; tests pass a short one. */
+    robotTenantLookupTimeoutMs?: number;
     loadBreaker?: typeof loadRefreshBreaker;
     saveBreaker?: typeof saveRefreshBreaker;
     clearBreaker?: typeof clearRefreshBreaker;
 }
+/** What the tenant lookup settled to; `hint` explains a missing `tenantId`. */
+interface RobotTenantResolution {
+    tenantId?: string;
+    hint?: string;
+}
+type RobotTenantIdCache = Map<string, Promise<RobotTenantResolution>>;
 /**
  * Get the current login status by reading credentials from the credentials file
  * @param envFilePath - Path to the credentials file (defaults to ".uipath/.auth")
@@ -107,3 +123,4 @@ export declare const getLoginStatusAsync: (options?: GetLoginStatusOptions) => P
  * Get the current login status by reading credentials from the credentials file (with DI for testing)
  */
 export declare const getLoginStatusWithDeps: (options?: GetLoginStatusOptions, deps?: LoginStatusDependencies) => Promise<LoginStatus>;
+export {};

package/dist/sessionIdentity.d.ts

@@ -4,6 +4,8 @@ import type { AuthFlow } from "./types";
  * Deliberately coarse — `authFlow` carries the precision.
  */
 export type IdentityType = "User" | "Application";
+/** The token subtype when Identity explicitly identifies an application. */
+export type ApplicationSubtype = "External" | "Internal";
 /**
  * Who the current session acts as, as reported by the access token.
  *
@@ -24,6 +26,17 @@ export interface SessionIdentity {
      * CLI's own — and surfacing that would read as if an app were acting.
      */
     clientId?: string;
+    /**
+     * The token's own `sub_type` claim, when it carries one. {@link type} is
+     * deliberately coarse — `service.internal` (S2S) and `service.external`
+     * (an external application) are both "Application" — and a caller that
+     * has to tell those two apart has nothing else to read. Unverified like
+     * every other field here, so it decides display and convenience, never
+     * access.
+     */
+    subType?: string;
+    /** Application identities only, when the token states its service subtype. */
+    applicationSubtype?: ApplicationSubtype;
 }
 /** Narrow an on-disk `UIPATH_AUTH_FLOW` value to a known flow. */
 export declare const parseAuthFlow: (value: string | undefined) => AuthFlow | undefined;

package/dist/tenantSelection.d.ts

@@ -24,6 +24,10 @@ export interface TenantsAndOrganizations {
  * later on: the portal has been seen answering `401` to the id (and to a
  * case-variant of the name) on an aged-but-valid session that the exact name
  * still resolves. So the id is a last-resort fallback, not an equal option.
+ *
+ * @param signal - Optional abort signal. Interactive login passes none; the
+ * Robot status path passes a timeout so a hung portal cannot hang every
+ * command.
  */
-export declare const fetchTenantsAndOrganizations: (baseUrl: string, accessToken: string, organizationId: string) => Promise<TenantsAndOrganizations>;
+export declare const fetchTenantsAndOrganizations: (baseUrl: string, accessToken: string, organizationId: string, signal?: AbortSignal) => Promise<TenantsAndOrganizations>;
 export {};

package/package.json

@@ -2,7 +2,7 @@
     "name": "@uipath/auth",
     "author": "UiPath",
     "license": "SEE LICENSE IN LICENSE.txt",
-    "version": "1.204.0-preview.255",
+    "version": "1.205.0-preview.256",
     "repository": {
         "type": "git",
         "url": "https://github.com/UiPath/cli.git",
@@ -38,5 +38,5 @@
         "mihaigirleanu",
         "vlad-uipath"
     ],
-    "gitHead": "699c58dabb59414557755a8933bcbe40aa420df3"
+    "gitHead": "63740c6cbb7ff282fa9118cc16a148eb030b245f"
 }