@uipath/cli 1.202.1 → 1.203.0-preview.180

package/README.md

@@ -208,11 +208,12 @@ following variables:
 
 | Variable | Description |
 | --- | --- |
-| `UIPATH_CLI_AUTH_TOKEN` | Access token (JWT). The server URL is derived from its `iss` claim. |
+| `UIPATH_CLI_AUTH_TOKEN` | Access token — a JWT, or an opaque Personal Access Token (see below) |
 | `UIPATH_CLI_ORGANIZATION_NAME` | Organization slug |
 | `UIPATH_CLI_ORGANIZATION_ID` | Organization UUID |
 | `UIPATH_CLI_TENANT_NAME` | Tenant slug |
 | `UIPATH_CLI_TENANT_ID` | Tenant UUID |
+| `UIPATH_URL` | Base URL, e.g. `https://cloud.uipath.com`. Ignored for a JWT; **required** for a PAT |
 
 **Example (GitHub Actions):**
 ```yaml
@@ -230,16 +231,111 @@ env:
   its freshness. There is no refresh flow: if the token is expired,
   `uip login status` reports `Expired` and commands fail until the
   env var is rotated.
-- The server URL is **not** a separate env var — it is derived from the
-  token's `iss` claim, which is the authoritative source for the
-  identity server that minted the token. This prevents mis-routing
-  when a user sets `UIPATH_URL` inconsistently with the token.
+- For a **JWT**, the server URL is derived from the token's `iss` claim,
+  which is the authoritative source for the identity server that minted
+  it, and `UIPATH_URL` is ignored. This prevents mis-routing when a user
+  sets `UIPATH_URL` inconsistently with the token. For an **opaque token**
+  such as a PAT there is no claim to read, so `UIPATH_URL` is required.
 - When `UIPATH_CLI_ENABLE_ENV_AUTH` is unset (or any value other than
   the literal string `true`), the file-based auth flow is used — no
   behavior change for existing users.
 - Missing or empty required variables produce a clear error naming the
   offending variable rather than a generic "not authenticated".
 
+#### Personal Access Tokens (PAT)
+
+A UiPath Personal Access Token is an opaque "reference token" tied to
+your user account. UiPath services accept it directly as a bearer
+credential, so the CLI performs no token exchange with it.
+
+There is no interactive PAT login — `uip login` never prompts for or
+accepts a PAT. Environment-variable auth (above) is the only way to use
+one.
+
+**Version requirement.** Authenticating with a PAT needs `uip`
+**1.202.0 or later**. Earlier versions accept only a JWT in
+`UIPATH_CLI_AUTH_TOKEN` and fail on an opaque token. The
+`uip admin pat` management commands are older and work in 1.201.0 too —
+you can mint a token there, you just cannot log in with it.
+
+Reach for a PAT when a command needs a **user** identity. Commands that
+resolve through the Resource Catalog, such as
+`uip solution resources refresh`, depend on your folder roles, which an
+External Application does not have — a client ID and secret fail there
+even with the right scopes. For ordinary deploy and run work
+(`uip solution publish`, `uip or jobs start`, assets, queues) prefer an
+External Application with `uip login --client-id ... --client-secret ...`.
+
+**Create a token:**
+```bash
+# Browse the scopes you can ask for
+uip admin scopes list --output table
+
+# Scopes are comma-separated in a single argument;
+# --expiration must be YYYY-MM-DD
+uip admin pat create \
+  --description "CI deploy" \
+  --expiration 2027-03-31 \
+  --scope OR.Execution,OR.Jobs,OR.Assets
+```
+
+The response carries the token once and it is never retrievable again:
+
+```json
+{
+  "Result": "Success",
+  "Code": "PatCreated",
+  "Data": {
+    "Token": "<the token string>",
+    "Warning": "Save this token now. It will not be shown again."
+  }
+}
+```
+
+Manage the rest of its life with `uip admin pat list`,
+`uip admin pat revoke <id>` and
+`uip admin pat regenerate <id> --expiration <date>`.
+
+**Use a token:**
+```bash
+export UIPATH_CLI_ENABLE_ENV_AUTH=true
+export UIPATH_CLI_AUTH_TOKEN="<your-pat>"
+export UIPATH_URL="https://cloud.uipath.com"
+export UIPATH_CLI_ORGANIZATION_NAME=contoso
+export UIPATH_CLI_ORGANIZATION_ID=11111111-1111-1111-1111-111111111111
+export UIPATH_CLI_TENANT_NAME=Default
+export UIPATH_CLI_TENANT_ID=22222222-2222-2222-2222-222222222222
+
+uip or assets list
+```
+
+No `uip login` step is needed. To find the two UUIDs, log in
+interactively once and read them from `uip login status --output json`.
+
+**Notes:**
+- `UIPATH_URL` is required here. A PAT carries no readable claims, so the
+  CLI cannot work out which server to call; omitting it fails with an
+  error naming the variable.
+- **No expiry warning.** Because the token is opaque,
+  `uip login status` reports `Logged in` with no expiration date and no
+  identity fields, plus a hint saying so. Once the token expires or is
+  revoked, commands fail with `401` and nothing warns you first — track
+  the expiry date yourself.
+- **No refresh.** An expired token stays expired until you replace the
+  variable.
+- `uip login tenant set` is refused while the gate is on. Change
+  `UIPATH_CLI_TENANT_NAME` / `UIPATH_CLI_TENANT_ID` instead.
+- In a pipeline that also logs in with client credentials, set the gate
+  **per step**, not globally: wherever `UIPATH_CLI_ENABLE_ENV_AUTH=true`
+  is set the CLI skips `.uipath/.auth`, which would take those other
+  steps off the session they just created.
+- `uip login which` prints which auth source is in effect and which of
+  the five `UIPATH_CLI_*` variables are still missing — by name, never by
+  value, so it is safe to leave in a build log. It does not track
+  `UIPATH_URL`, so it reports `AllVarsPresent: true` even when a PAT is
+  missing its base URL; that surfaces on the first real command as a
+  `ConfigError` naming `UIPATH_URL`.
+
 #### Robot-credentials-only authentication (Studio Desktop)
 
 For consumers that spawn `uip` from a process whose user is already

package/dist/THIRD-PARTY-NOTICES.md

@@ -5,7 +5,7 @@ compiled into its `dist/` output rather than installed alongside it.
 Their licences and copyright notices are reproduced here in full, as
 those licences require.
 
-117 bundled dependencies:
+120 bundled dependencies:
 
 - @azure/abort-controller@2.2.0 — MIT
 - @azure/core-rest-pipeline@1.16.3 — MIT
@@ -26,6 +26,7 @@ those licences require.
 - @inquirer/core@11.2.1 — MIT
 - @inquirer/figures@2.0.7 — MIT
 - @inquirer/input@5.1.2 — MIT
+- @inquirer/prompts@8.5.2 — MIT
 - @inquirer/select@5.2.1 — MIT
 - @microsoft/applicationinsights-web-snippet@1.0.1 — MIT
 - @modelcontextprotocol/sdk@1.29.0 — MIT
@@ -39,6 +40,8 @@ those licences require.
 - @opentelemetry/semantic-conventions@1.28.0 — Apache-2.0
 - @opentelemetry/semantic-conventions@1.28.0 — Apache-2.0
 - @typespec/ts-http-runtime@0.3.7 — MIT
+- @uipath/coreipc@2.5.1-20260324-07 — MIT
+- @uipath/robot-client@26.0.193-alpha22964 — MIT
 - agent-base@7.1.4 — MIT
 - agent-base@7.1.4 — MIT
 - ajv@8.20.0 — MIT
@@ -710,6 +713,40 @@ OTHER DEALINGS IN THE SOFTWARE.
 
 ---
 
+## @inquirer/prompts@8.5.2
+
+Inlined by a bundled dependency rather than resolved directly,
+so it does not appear in this package's source maps.
+
+SPDX: MIT
+
+```
+Copyright (c) 2025 Simon Boudrias
+
+Permission is hereby granted, free of charge, to any person
+obtaining a copy of this software and associated documentation
+files (the "Software"), to deal in the Software without
+restriction, including without limitation the rights to use,
+copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the
+Software is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
+OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+OTHER DEALINGS IN THE SOFTWARE.
+```
+
+---
+
 ## @inquirer/select@5.2.1
 
 SPDX: MIT
@@ -2721,6 +2758,26 @@ SOFTWARE.
 
 ---
 
+## @uipath/coreipc@2.5.1-20260324-07
+
+SPDX: MIT
+
+The upstream package ships no licence file here; `MIT` is the
+licence it is distributed under. The canonical text of that licence
+applies, with copyright held by the package's authors.
+
+---
+
+## @uipath/robot-client@26.0.193-alpha22964
+
+SPDX: MIT
+
+The upstream package ships no licence file here; `MIT` is the
+licence it is distributed under. The canonical text of that licence
+applies, with copyright held by the package's authors.
+
+---
+
 ## agent-base@7.1.4
 
 SPDX: MIT
@@ -3226,9 +3283,9 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 
 SPDX: MIT
 
-The upstream package ships no licence file; `MIT` is the
-licence declared in its `package.json`. The canonical text of that
-licence applies, with copyright held by the package's authors.
+The upstream package ships no licence file here; `MIT` is the
+licence it is distributed under. The canonical text of that licence
+applies, with copyright held by the package's authors.
 
 ---
 
@@ -3296,9 +3353,9 @@ SOFTWARE.
 
 SPDX: BSD-2-Clause
 
-The upstream package ships no licence file; `BSD-2-Clause` is the
-licence declared in its `package.json`. The canonical text of that
-licence applies, with copyright held by the package's authors.
+The upstream package ships no licence file here; `BSD-2-Clause` is the
+licence it is distributed under. The canonical text of that licence
+applies, with copyright held by the package's authors.
 
 ---
 

package/dist/{cli-p61a1vc8.js → cli-w7vb50ez.js}

@@ -1,9 +1,9 @@
 import {
   runNode
-} from "./index-9d17sa6t.js";
-import"./index-v5cj0bhj.js";
-import"./index-vmj27s6h.js";
-import"./index-tqczrxct.js";
+} from "./index-szrenqr6.js";
+import"./index-vmn69waj.js";
+import"./index-mtdmza3c.js";
+import"./index-7pvwjzsq.js";
 import"./index-g8ck9tv6.js";
 import"./index-hrt7fpkk.js";
 import"./index-d3w0wn6k.js";