@uipath/codedapp-tool 1.201.0-preview.133 → 1.202.0-preview.134

package/dist/{tool-wckvcay0.js → packager-tool-1yh8g550.js}

@@ -19,12 +19,14 @@ var __toESM = (mod, isNodeMode, target) => {
   }
   target = mod != null ? __create(__getProtoOf(mod)) : {};
   const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
-  for (let key of __getOwnPropNames(mod))
-    if (!__hasOwnProp.call(to, key))
-      __defProp(to, key, {
-        get: __accessProp.bind(mod, key),
-        enumerable: true
-      });
+  if (mod && typeof mod === "object" || typeof mod === "function") {
+    for (let key of __getOwnPropNames(mod))
+      if (!__hasOwnProp.call(to, key))
+        __defProp(to, key, {
+          get: __accessProp.bind(mod, key),
+          enumerable: true
+        });
+  }
   if (canCache)
     cache.set(mod, to);
   return to;
@@ -47,4 +49,4 @@ var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 export { __toESM, __commonJS, __export, __require };
 
-//# debugId=42F86BC5AE2E70AC64756E2164756E21
+//# debugId=7B09EB233830E89F64756E2164756E21

package/dist/{tool-yadq0xpc.js → packager-tool-8hncwr6a.js}

@@ -1,20 +1,20 @@
-import {
-  getGlobalThis,
-  isBrowser
-} from "./tool-0gctz400.js";
 import {
   catchError,
   getFileSystem
-} from "./tool-4pvh3k50.js";
+} from "./packager-tool-qyctya2j.js";
+import {
+  getGlobalThis,
+  isBrowser
+} from "./packager-tool-0gctz400.js";
 import {
   AUTH_FILENAME,
   DEFAULT_BASE_URL,
   DEFAULT_REDIRECT_URI,
   UIPATH_HOME_DIR
-} from "./tool-q42rrs00.js";
+} from "./packager-tool-yc4kw997.js";
 import {
   __require
-} from "./tool-wckvcay0.js";
+} from "./packager-tool-1yh8g550.js";
 
 // ../auth/src/config.ts
 var DEFAULT_CLIENT_ID = "36dea5b8-e8bb-423d-8e7b-c808df8f1c00";
@@ -32,7 +32,7 @@ class InvalidBaseUrlError extends Error {
     super(`Invalid base URL: "${url}"
 ` + `Reason: ${reason}
 
-` + `Expected format: an https:// URL, e.g. https://cloud.uipath.com (commercial), https://govcloud.uipath.us (Public Sector), or your Automation Suite host (https://<your-host>).
+` + `Expected format: an https:// URL (or bare host — https:// is assumed), e.g. https://cloud.uipath.com (commercial), https://govcloud.uipath.us (Public Sector), or your Automation Suite host (https://<your-host>).
 ` + `You can specify the URL via:
 ` + `  • --authority flag
 ` + `  • UIPATH_URL environment variable
@@ -53,10 +53,16 @@ var normalizeAndValidateBaseUrl = (rawUrl) => {
   while (baseUrl.endsWith("/")) {
     baseUrl = baseUrl.slice(0, -1);
   }
+  const hasScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(baseUrl);
+  const [hostCandidate] = baseUrl.split(/[/?#]/, 1);
+  if (!hasScheme && hostCandidate.includes(".")) {
+    baseUrl = `https://${baseUrl}`;
+  }
   const resolvedBaseUrl = baseUrl;
   const [urlError, url] = catchError(() => new URL(resolvedBaseUrl));
   if (urlError) {
-    throw new InvalidBaseUrlError(baseUrl, `Malformed URL. ${urlError instanceof Error ? urlError.message : "Unknown error"}`);
+    const shapeHint = !hasScheme && !hostCandidate.includes(".") ? ` "${rawUrl.trim()}" is not a URL or a host name. Pass the full authority URL — https://<host>, or just <host> (https:// is assumed).` : ` ${urlError instanceof Error ? urlError.message : "Unknown error"}`;
+    throw new InvalidBaseUrlError(baseUrl, `Malformed URL.${shapeHint}`);
   }
   if (url.protocol !== "https:") {
     throw new InvalidBaseUrlError(baseUrl, `Authority must use https:// scheme, got ${url.protocol}//. OIDC token exchange requires TLS end-to-end.`);
@@ -190,17 +196,6 @@ function b64u(input) {
   }
   return encodeBase64Url(input);
 }
-
-class UnsupportedOperationError extends Error {
-  code;
-  constructor(message, options) {
-    super(message, options);
-    this.name = this.constructor.name;
-    this.code = UNSUPPORTED_OPERATION;
-    Error.captureStackTrace?.(this, this.constructor);
-  }
-}
-
 class OperationProcessingError extends Error {
   code;
   constructor(message, options) {
@@ -215,60 +210,6 @@ class OperationProcessingError extends Error {
 function OPE(message, code, cause) {
   return new OperationProcessingError(message, { code, cause });
 }
-async function calculateJwkThumbprint(jwk) {
-  let components;
-  switch (jwk.kty) {
-    case "EC":
-      components = {
-        crv: jwk.crv,
-        kty: jwk.kty,
-        x: jwk.x,
-        y: jwk.y
-      };
-      break;
-    case "OKP":
-      components = {
-        crv: jwk.crv,
-        kty: jwk.kty,
-        x: jwk.x
-      };
-      break;
-    case "AKP":
-      components = {
-        alg: jwk.alg,
-        kty: jwk.kty,
-        pub: jwk.pub
-      };
-      break;
-    case "RSA":
-      components = {
-        e: jwk.e,
-        kty: jwk.kty,
-        n: jwk.n
-      };
-      break;
-    default:
-      throw new UnsupportedOperationError("unsupported JWK key type", { cause: jwk });
-  }
-  return b64u(await crypto.subtle.digest("SHA-256", buf(JSON.stringify(components))));
-}
-function assertCryptoKey(key, it) {
-  if (!(key instanceof CryptoKey)) {
-    throw CodedTypeError(`${it} must be a CryptoKey`, ERR_INVALID_ARG_TYPE);
-  }
-}
-function assertPrivateKey(key, it) {
-  assertCryptoKey(key, it);
-  if (key.type !== "private") {
-    throw CodedTypeError(`${it} must be a private CryptoKey`, ERR_INVALID_ARG_VALUE);
-  }
-}
-function assertPublicKey(key, it) {
-  assertCryptoKey(key, it);
-  if (key.type !== "public") {
-    throw CodedTypeError(`${it} must be a public CryptoKey`, ERR_INVALID_ARG_VALUE);
-  }
-}
 function assertString(input, it, code, cause) {
   try {
     if (typeof input !== "string") {
@@ -297,72 +238,6 @@ async function calculatePKCECodeChallenge(codeVerifier) {
   assertString(codeVerifier, "codeVerifier");
   return b64u(await crypto.subtle.digest("SHA-256", buf(codeVerifier)));
 }
-function psAlg(key) {
-  switch (key.algorithm.hash.name) {
-    case "SHA-256":
-      return "PS256";
-    case "SHA-384":
-      return "PS384";
-    case "SHA-512":
-      return "PS512";
-    default:
-      throw new UnsupportedOperationError("unsupported RsaHashedKeyAlgorithm hash name", {
-        cause: key
-      });
-  }
-}
-function rsAlg(key) {
-  switch (key.algorithm.hash.name) {
-    case "SHA-256":
-      return "RS256";
-    case "SHA-384":
-      return "RS384";
-    case "SHA-512":
-      return "RS512";
-    default:
-      throw new UnsupportedOperationError("unsupported RsaHashedKeyAlgorithm hash name", {
-        cause: key
-      });
-  }
-}
-function esAlg(key) {
-  switch (key.algorithm.namedCurve) {
-    case "P-256":
-      return "ES256";
-    case "P-384":
-      return "ES384";
-    case "P-521":
-      return "ES512";
-    default:
-      throw new UnsupportedOperationError("unsupported EcKeyAlgorithm namedCurve", { cause: key });
-  }
-}
-function keyToJws(key) {
-  switch (key.algorithm.name) {
-    case "RSA-PSS":
-      return psAlg(key);
-    case "RSASSA-PKCS1-v1_5":
-      return rsAlg(key);
-    case "ECDSA":
-      return esAlg(key);
-    case "Ed25519":
-    case "ML-DSA-44":
-    case "ML-DSA-65":
-    case "ML-DSA-87":
-      return key.algorithm.name;
-    case "EdDSA":
-      return "Ed25519";
-    default:
-      throw new UnsupportedOperationError("unsupported CryptoKey algorithm name", { cause: key });
-  }
-}
-function getClockSkew(client) {
-  const skew = client?.[clockSkew];
-  return typeof skew === "number" && Number.isFinite(skew) ? skew : 0;
-}
-function epochTime() {
-  return Math.floor(Date.now() / 1000);
-}
 function ClientSecretPost(clientSecret) {
   assertString(clientSecret, '"clientSecret"');
   return (_as, client, body, _headers) => {
@@ -375,27 +250,6 @@ function None() {
     body.set("client_id", client.client_id);
   };
 }
-async function signJwt(header, payload, key) {
-  if (!key.usages.includes("sign")) {
-    throw CodedTypeError('CryptoKey instances used for signing assertions must include "sign" in their "usages"', ERR_INVALID_ARG_VALUE);
-  }
-  const input = `${b64u(buf(JSON.stringify(header)))}.${b64u(buf(JSON.stringify(payload)))}`;
-  const signature = b64u(await crypto.subtle.sign(keyToSubtle(key), key, buf(input)));
-  return `${input}.${signature}`;
-}
-var jwkCache;
-async function getSetPublicJwkCache(key, alg) {
-  const { kty, e, n, x, y, crv, pub } = await crypto.subtle.exportKey("jwk", key);
-  const jwk = { kty, e, n, x, y, crv, pub };
-  if (kty === "AKP")
-    jwk.alg = alg;
-  jwkCache.set(key, jwk);
-  return jwk;
-}
-async function publicJwk(key, alg) {
-  jwkCache ||= new WeakMap;
-  return jwkCache.get(key) || getSetPublicJwkCache(key, alg);
-}
 var URLParse = URL.parse ? (url, base) => URL.parse(url, base) : (url, base) => {
   try {
     return new URL(url, base);
@@ -403,79 +257,6 @@ var URLParse = URL.parse ? (url, base) => URL.parse(url, base) : (url, base) =>
     return null;
   }
 };
-class DPoPHandler {
-  #header;
-  #privateKey;
-  #publicKey;
-  #clockSkew;
-  #modifyAssertion;
-  #map;
-  #jkt;
-  constructor(client, keyPair, options) {
-    assertPrivateKey(keyPair?.privateKey, '"DPoP.privateKey"');
-    assertPublicKey(keyPair?.publicKey, '"DPoP.publicKey"');
-    if (!keyPair.publicKey.extractable) {
-      throw CodedTypeError('"DPoP.publicKey.extractable" must be true', ERR_INVALID_ARG_VALUE);
-    }
-    this.#modifyAssertion = options?.[modifyAssertion];
-    this.#clockSkew = getClockSkew(client);
-    this.#privateKey = keyPair.privateKey;
-    this.#publicKey = keyPair.publicKey;
-    branded.add(this);
-  }
-  #get(key) {
-    this.#map ||= new Map;
-    let item = this.#map.get(key);
-    if (item) {
-      this.#map.delete(key);
-      this.#map.set(key, item);
-    }
-    return item;
-  }
-  #set(key, val) {
-    this.#map ||= new Map;
-    this.#map.delete(key);
-    if (this.#map.size === 100) {
-      this.#map.delete(this.#map.keys().next().value);
-    }
-    this.#map.set(key, val);
-  }
-  async calculateThumbprint() {
-    if (!this.#jkt) {
-      const jwk = await crypto.subtle.exportKey("jwk", this.#publicKey);
-      this.#jkt ||= await calculateJwkThumbprint(jwk);
-    }
-    return this.#jkt;
-  }
-  async addProof(url, headers, htm, accessToken) {
-    const alg = keyToJws(this.#privateKey);
-    this.#header ||= {
-      alg,
-      typ: "dpop+jwt",
-      jwk: await publicJwk(this.#publicKey, alg)
-    };
-    const nonce = this.#get(url.origin);
-    const now = epochTime() + this.#clockSkew;
-    const payload = {
-      iat: now,
-      jti: randomBytes(),
-      htm,
-      nonce,
-      htu: `${url.origin}${url.pathname}`,
-      ath: accessToken ? b64u(await crypto.subtle.digest("SHA-256", buf(accessToken))) : undefined
-    };
-    this.#modifyAssertion?.(this.#header, payload);
-    headers.set("dpop", await signJwt(this.#header, payload, this.#privateKey));
-  }
-  cacheNonce(response, url) {
-    try {
-      const nonce = response.headers.get("dpop-nonce");
-      if (nonce) {
-        this.#set(url.origin, nonce);
-      }
-    } catch {}
-  }
-}
 var tokenMatch = "[a-zA-Z0-9!#$%&\\'\\*\\+\\-\\.\\^_`\\|~]+";
 var token68Match = "[a-zA-Z0-9\\-\\._\\~\\+\\/]+={0,2}";
 var quotedMatch = '"((?:[^"\\\\]|\\\\[\\s\\S])*)"';
@@ -492,60 +273,6 @@ var branded = new WeakSet;
 var nopkce = Symbol();
 var expectNoNonce = Symbol();
 var skipAuthTimeCheck = Symbol();
-var UNSUPPORTED_OPERATION = "OAUTH_UNSUPPORTED_OPERATION";
-function checkRsaKeyAlgorithm(key) {
-  const { algorithm } = key;
-  if (typeof algorithm.modulusLength !== "number" || algorithm.modulusLength < 2048) {
-    throw new UnsupportedOperationError(`unsupported ${algorithm.name} modulusLength`, {
-      cause: key
-    });
-  }
-}
-function ecdsaHashName(key) {
-  const { algorithm } = key;
-  switch (algorithm.namedCurve) {
-    case "P-256":
-      return "SHA-256";
-    case "P-384":
-      return "SHA-384";
-    case "P-521":
-      return "SHA-512";
-    default:
-      throw new UnsupportedOperationError("unsupported ECDSA namedCurve", { cause: key });
-  }
-}
-function keyToSubtle(key) {
-  switch (key.algorithm.name) {
-    case "ECDSA":
-      return {
-        name: key.algorithm.name,
-        hash: ecdsaHashName(key)
-      };
-    case "RSA-PSS": {
-      checkRsaKeyAlgorithm(key);
-      switch (key.algorithm.hash.name) {
-        case "SHA-256":
-        case "SHA-384":
-        case "SHA-512":
-          return {
-            name: key.algorithm.name,
-            saltLength: parseInt(key.algorithm.hash.name.slice(-3), 10) >> 3
-          };
-        default:
-          throw new UnsupportedOperationError("unsupported RSA-PSS hash name", { cause: key });
-      }
-    }
-    case "RSASSA-PKCS1-v1_5":
-      checkRsaKeyAlgorithm(key);
-      return key.algorithm.name;
-    case "ML-DSA-44":
-    case "ML-DSA-65":
-    case "ML-DSA-87":
-    case "Ed25519":
-      return key.algorithm.name;
-  }
-  throw new UnsupportedOperationError("unsupported CryptoKey algorithm name", { cause: key });
-}
 var skipStateCheck = Symbol();
 var expectNoState = Symbol();
 var _nodiscoverycheck = Symbol();
@@ -998,6 +725,17 @@ var requireEnv = (name) => {
   }
   return value;
 };
+var OPAQUE_TOKEN_BASE_URL_VAR = "UIPATH_URL";
+var resolveBaseUrl = (rawUrl, failureContext) => {
+  const [baseUrlError, baseUrl] = catchError(() => normalizeAndValidateBaseUrl(rawUrl));
+  if (baseUrlError) {
+    if (baseUrlError instanceof InvalidBaseUrlError) {
+      throw baseUrlError;
+    }
+    throw new EnvAuthConfigError(`${failureContext}: ` + `${baseUrlError instanceof Error ? baseUrlError.message : String(baseUrlError)}`);
+  }
+  return baseUrl;
+};
 var readAuthFromEnv = () => {
   const accessToken = requireEnv(ENV_AUTH_VARS.token);
   const organizationName = requireEnv(ENV_AUTH_VARS.organizationName);
@@ -1006,19 +744,29 @@ var readAuthFromEnv = () => {
   const tenantId = requireEnv(ENV_AUTH_VARS.tenantId);
   const [parseError, payload] = catchError(() => parseJWT(accessToken));
   if (parseError) {
-    throw new EnvAuthConfigError(`${ENV_AUTH_VARS.token} is not a valid JWT: ` + `${parseError instanceof Error ? parseError.message : String(parseError)}`);
+    const parseErrorMessage = parseError instanceof Error ? parseError.message : String(parseError);
+    const rawUrl = process.env[OPAQUE_TOKEN_BASE_URL_VAR];
+    if (!rawUrl) {
+      throw new EnvAuthConfigError(`${ENV_AUTH_VARS.token} is not a JWT (treating it as an opaque token, ` + `e.g. a Personal Access Token). Set ${OPAQUE_TOKEN_BASE_URL_VAR} to the ` + `UiPath base URL if this is a PAT, or fix the token if it was meant to ` + `be a JWT (parse error: ${parseErrorMessage}).`);
+    }
+    const baseUrl2 = resolveBaseUrl(rawUrl, `Failed to validate ${OPAQUE_TOKEN_BASE_URL_VAR}`);
+    return {
+      loginStatus: "Logged in",
+      accessToken,
+      baseUrl: baseUrl2,
+      organizationName,
+      organizationId,
+      tenantName,
+      tenantId,
+      source: "env-vars" /* EnvironmentVariables */,
+      hint: "Token is opaque (not a JWT) - expiration and identity cannot be " + "determined locally. Commands will fail with 401 once it is revoked or " + `expired. If this was meant to be a JWT instead of a PAT, note: ${parseErrorMessage}`
+    };
   }
   const iss = payload.iss;
   if (typeof iss !== "string" || iss.length === 0) {
     throw new EnvAuthConfigError(`${ENV_AUTH_VARS.token} has no 'iss' claim; cannot determine ` + `the UiPath server. Ensure the token was issued by a UiPath identity server.`);
   }
-  const [baseUrlError, baseUrl] = catchError(() => normalizeAndValidateBaseUrl(iss));
-  if (baseUrlError) {
-    if (baseUrlError instanceof InvalidBaseUrlError) {
-      throw baseUrlError;
-    }
-    throw new EnvAuthConfigError(`Failed to derive server URL from token 'iss' claim: ` + `${baseUrlError instanceof Error ? baseUrlError.message : String(baseUrlError)}`);
-  }
+  const baseUrl = resolveBaseUrl(iss, "Failed to derive server URL from token 'iss' claim");
   const expiration = getTokenExpiration(accessToken);
   const loginStatus = expiration && expiration <= new Date ? "Expired" : "Logged in";
   const identity = resolveSessionIdentity(accessToken);
@@ -2346,7 +2094,11 @@ var interactiveLoginWithDeps = async (options, deps) => {
       timeoutMs,
       noBrowser,
       signal,
-      onAuthUrl: noBrowser ? (url) => deliverAuthUrl(url) : undefined
+      onAuthUrl: noBrowser ? (url) => deliverAuthUrl(url) : undefined,
+      onPortReclaimed: ({ pid }) => emit({
+        type: "port-reclaimed",
+        message: `A previous 'uip login'${pid === undefined ? "" : ` (PID ${pid})`} was still holding the callback port ` + `(${new URL(DEFAULT_REDIRECT_URI).port}) and was released; continuing with this login.`
+      })
     });
     return {
       UIPATH_ACCESS_TOKEN: authTokens.accessToken,
@@ -2500,7 +2252,8 @@ var authenticate = async ({
   timeoutMs,
   noBrowser,
   onAuthUrl,
-  signal
+  signal,
+  onPortReclaimed
 }) => {
   const config = await resolveConfigAsync({
     customAuthority: baseUrl,
@@ -2544,17 +2297,18 @@ var authenticate = async ({
   const authUrl = `${authorizationEndpoint}?${authParams.toString()}`;
   let strategy;
   if (isBrowser()) {
-    const { BrowserAuthStrategy } = await import("./browser-strategy-16yagjhr.js");
+    const { BrowserAuthStrategy } = await import("./browser-strategy-6atc7v8s.js");
     strategy = new BrowserAuthStrategy;
   } else {
-    const { NodeAuthStrategy } = await import("./node-strategy-gfq7k0sx.js");
+    const { NodeAuthStrategy } = await import("./node-strategy-bpshtz02.js");
     strategy = new NodeAuthStrategy;
   }
   const code = await strategy.execute(authUrl, effectiveRedirectUriUrl, state, {
     timeoutMs,
     noBrowser,
     onAuthUrl,
-    signal
+    signal,
+    onPortReclaimed
   });
   return await exchangeCodeForTokens({
     code,
@@ -2568,4 +2322,4 @@ var authenticate = async ({
 
 export { setAuthFileConfig, InvalidBaseUrlError, DEFAULT_AUTH_PROFILE, AuthProfileValidationError, normalizeAuthProfileName, setActiveAuthProfile, clearActiveAuthProfile, getActiveAuthProfile, runWithAuthProfile, resolveAuthProfileFilePath, getActiveAuthProfileFilePath, parseJWT, parseAuthFlow, resolveSessionIdentity, ENV_AUTH_ENABLE_VAR, ENFORCE_ROBOT_AUTH_VAR, ENV_AUTH_VARS, EnvAuthConfigError, isEnvAuthEnabled, isRobotAuthEnforced, readAuthFromEnv, refreshTokenFingerprint, loadRefreshBreaker, saveRefreshBreaker, clearRefreshBreaker, registerRobotClientLoader, TokenRefreshOAuthError, isTokenRefreshOAuthFailure, refreshAccessToken, AUTH_FLOW_ENV_VAR, DEFAULT_AUTH_FILENAME, DEFAULT_ENV_FILENAME, resolveEnvFileLocationAsync, resolveEnvFilePathAsync, loadEnvFileAsync, saveEnvFileAsync, CredentialSource, getLoginStatusAsync, getLoginStatusWithDeps, getAuthContext, getAuthEnv, ClientCredentialsAuthenticationError, clientCredentialsLogin, JWT_BEARER_ASSERTION_TYPE, FederatedCredentialsAuthenticationError, federatedCredentialsLogin, fetchTenantsAndOrganizations, TENANT_SELECTION_REQUIRED_CODE, INVALID_TENANT_CODE, TenantSelectionError, TenantSelectionRequiredError, InvalidTenantError, isTenantSelectionError, selectTenantWithDeps, interactiveLoginWithDeps, interactiveLogin, logoutWithDeps, logout, authenticate };
 
-//# debugId=AE89F90F78CF3CD464756E2164756E21
+//# debugId=432C00A85D700C2164756E2164756E21