@uipath/flow-tool 1.201.0 → 1.202.0-preview.136

package/dist/packager-tool-f0kd5kq4.js

@@ -0,0 +1,2327 @@
+import {
+  getGlobalThis,
+  isBrowser
+} from "./packager-tool-0gctz400.js";
+import {
+  catchError
+} from "./packager-tool-qa9gftnj.js";
+import {
+  AUTH_FILENAME,
+  DEFAULT_BASE_URL,
+  DEFAULT_REDIRECT_URI,
+  UIPATH_HOME_DIR
+} from "./packager-tool-yc4kw997.js";
+import {
+  getFileSystem
+} from "./packager-tool-0v3s8r01.js";
+import {
+  __require
+} from "./packager-tool-1yh8g550.js";
+
+// ../auth/src/config.ts
+var DEFAULT_CLIENT_ID = "36dea5b8-e8bb-423d-8e7b-c808df8f1c00";
+var AUTH_FILE_CONFIG_KEY = Symbol.for("@uipath/auth/AuthFileConfig");
+var globalSlot = globalThis;
+var setAuthFileConfig = (cfg) => {
+  globalSlot[AUTH_FILE_CONFIG_KEY] = cfg ?? {};
+};
+var getAuthFileConfig = () => globalSlot[AUTH_FILE_CONFIG_KEY] ?? {};
+
+class InvalidBaseUrlError extends Error {
+  url;
+  reason;
+  constructor(url, reason) {
+    super(`Invalid base URL: "${url}"
+` + `Reason: ${reason}
+
+` + `Expected format: an https:// URL (or bare host — https:// is assumed), e.g. https://cloud.uipath.com (commercial), https://govcloud.uipath.us (Public Sector), or your Automation Suite host (https://<your-host>).
+` + `You can specify the URL via:
+` + `  • --authority flag
+` + `  • UIPATH_URL environment variable
+` + `  • auth.authority in config file`);
+    this.url = url;
+    this.reason = reason;
+    this.name = "InvalidBaseUrlError";
+  }
+}
+var DEFAULT_SCOPES = ["openid", "profile", "offline_access"];
+var normalizeAndValidateBaseUrl = (rawUrl) => {
+  let baseUrl = rawUrl;
+  if (baseUrl.endsWith("/identity_/")) {
+    baseUrl = baseUrl.slice(0, -11);
+  } else if (baseUrl.endsWith("/identity_")) {
+    baseUrl = baseUrl.slice(0, -10);
+  }
+  while (baseUrl.endsWith("/")) {
+    baseUrl = baseUrl.slice(0, -1);
+  }
+  const hasScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(baseUrl);
+  const [hostCandidate] = baseUrl.split(/[/?#]/, 1);
+  if (!hasScheme && hostCandidate.includes(".")) {
+    baseUrl = `https://${baseUrl}`;
+  }
+  const resolvedBaseUrl = baseUrl;
+  const [urlError, url] = catchError(() => new URL(resolvedBaseUrl));
+  if (urlError) {
+    const shapeHint = !hasScheme && !hostCandidate.includes(".") ? ` "${rawUrl.trim()}" is not a URL or a host name. Pass the full authority URL — https://<host>, or just <host> (https:// is assumed).` : ` ${urlError instanceof Error ? urlError.message : "Unknown error"}`;
+    throw new InvalidBaseUrlError(baseUrl, `Malformed URL.${shapeHint}`);
+  }
+  if (url.protocol !== "https:") {
+    throw new InvalidBaseUrlError(baseUrl, `Authority must use https:// scheme, got ${url.protocol}//. OIDC token exchange requires TLS end-to-end.`);
+  }
+  return url.pathname.length > 1 ? url.origin : baseUrl;
+};
+var resolveScopes = (isExternalAppAuth, customScopes, fileScopes) => {
+  const requestedScopes = customScopes?.length ? customScopes : fileScopes ?? [];
+  if (isExternalAppAuth)
+    return requestedScopes;
+  return [...new Set([...DEFAULT_SCOPES, ...requestedScopes])];
+};
+var resolveConfigAsync = async ({
+  customAuthority,
+  customClientId,
+  customClientSecret,
+  customClientAssertion,
+  customScopes
+} = {}) => {
+  const fileAuth = getAuthFileConfig();
+  let baseUrl = customAuthority;
+  if (!baseUrl) {
+    baseUrl = process.env.UIPATH_URL;
+  }
+  if (!baseUrl && fileAuth.authority) {
+    baseUrl = fileAuth.authority;
+  }
+  if (!baseUrl) {
+    baseUrl = DEFAULT_BASE_URL;
+  }
+  baseUrl = normalizeAndValidateBaseUrl(baseUrl);
+  let clientId = customClientId;
+  if (!clientId && fileAuth.clientId) {
+    clientId = fileAuth.clientId;
+  }
+  if (!clientId) {
+    clientId = DEFAULT_CLIENT_ID;
+  }
+  let clientSecret = customClientSecret;
+  if (!clientSecret && fileAuth.clientSecret) {
+    clientSecret = fileAuth.clientSecret;
+  }
+  const isExternalAppAuth = clientId !== DEFAULT_CLIENT_ID && (Boolean(clientSecret) || Boolean(customClientAssertion));
+  const scopes = resolveScopes(isExternalAppAuth, customScopes, fileAuth.scopes);
+  return {
+    clientId,
+    clientSecret,
+    scopes,
+    baseUrl,
+    authorizationEndpoint: `${baseUrl}/identity_/connect/authorize`,
+    tokenEndpoint: `${baseUrl}/identity_/connect/token`
+  };
+};
+
+// ../../node_modules/oauth4webapi/build/index.js
+var USER_AGENT;
+if (typeof navigator === "undefined" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) {
+  const NAME = "oauth4webapi";
+  const VERSION = "v3.8.6";
+  USER_AGENT = `${NAME}/${VERSION}`;
+}
+var ERR_INVALID_ARG_VALUE = "ERR_INVALID_ARG_VALUE";
+var ERR_INVALID_ARG_TYPE = "ERR_INVALID_ARG_TYPE";
+function CodedTypeError(message, code, cause) {
+  const err = new TypeError(message, { cause });
+  Object.assign(err, { code });
+  return err;
+}
+var allowInsecureRequests = Symbol();
+var clockSkew = Symbol();
+var clockTolerance = Symbol();
+var customFetch = Symbol();
+var modifyAssertion = Symbol();
+var jweDecrypt = Symbol();
+var jwksCache = Symbol();
+var encoder = new TextEncoder;
+var decoder = new TextDecoder;
+function buf(input) {
+  if (typeof input === "string") {
+    return encoder.encode(input);
+  }
+  return decoder.decode(input);
+}
+var encodeBase64Url;
+if (Uint8Array.prototype.toBase64) {
+  encodeBase64Url = (input) => {
+    if (input instanceof ArrayBuffer) {
+      input = new Uint8Array(input);
+    }
+    return input.toBase64({ alphabet: "base64url", omitPadding: true });
+  };
+} else {
+  const CHUNK_SIZE = 32768;
+  encodeBase64Url = (input) => {
+    if (input instanceof ArrayBuffer) {
+      input = new Uint8Array(input);
+    }
+    const arr = [];
+    for (let i = 0;i < input.byteLength; i += CHUNK_SIZE) {
+      arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));
+    }
+    return btoa(arr.join("")).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+  };
+}
+var decodeBase64Url;
+if (Uint8Array.fromBase64) {
+  decodeBase64Url = (input) => {
+    try {
+      return Uint8Array.fromBase64(input, { alphabet: "base64url" });
+    } catch (cause) {
+      throw CodedTypeError("The input to be decoded is not correctly encoded.", ERR_INVALID_ARG_VALUE, cause);
+    }
+  };
+} else {
+  decodeBase64Url = (input) => {
+    try {
+      const binary = atob(input.replace(/-/g, "+").replace(/_/g, "/").replace(/\s/g, ""));
+      const bytes = new Uint8Array(binary.length);
+      for (let i = 0;i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+      }
+      return bytes;
+    } catch (cause) {
+      throw CodedTypeError("The input to be decoded is not correctly encoded.", ERR_INVALID_ARG_VALUE, cause);
+    }
+  };
+}
+function b64u(input) {
+  if (typeof input === "string") {
+    return decodeBase64Url(input);
+  }
+  return encodeBase64Url(input);
+}
+class OperationProcessingError extends Error {
+  code;
+  constructor(message, options) {
+    super(message, options);
+    this.name = this.constructor.name;
+    if (options?.code) {
+      this.code = options?.code;
+    }
+    Error.captureStackTrace?.(this, this.constructor);
+  }
+}
+function OPE(message, code, cause) {
+  return new OperationProcessingError(message, { code, cause });
+}
+function assertString(input, it, code, cause) {
+  try {
+    if (typeof input !== "string") {
+      throw CodedTypeError(`${it} must be a string`, ERR_INVALID_ARG_TYPE, cause);
+    }
+    if (input.length === 0) {
+      throw CodedTypeError(`${it} must not be empty`, ERR_INVALID_ARG_VALUE, cause);
+    }
+  } catch (err) {
+    if (code) {
+      throw OPE(err.message, code, cause);
+    }
+    throw err;
+  }
+}
+function randomBytes() {
+  return b64u(crypto.getRandomValues(new Uint8Array(32)));
+}
+function generateRandomCodeVerifier() {
+  return randomBytes();
+}
+function generateRandomState() {
+  return randomBytes();
+}
+async function calculatePKCECodeChallenge(codeVerifier) {
+  assertString(codeVerifier, "codeVerifier");
+  return b64u(await crypto.subtle.digest("SHA-256", buf(codeVerifier)));
+}
+function ClientSecretPost(clientSecret) {
+  assertString(clientSecret, '"clientSecret"');
+  return (_as, client, body, _headers) => {
+    body.set("client_id", client.client_id);
+    body.set("client_secret", clientSecret);
+  };
+}
+function None() {
+  return (_as, client, body, _headers) => {
+    body.set("client_id", client.client_id);
+  };
+}
+var URLParse = URL.parse ? (url, base) => URL.parse(url, base) : (url, base) => {
+  try {
+    return new URL(url, base);
+  } catch {
+    return null;
+  }
+};
+var tokenMatch = "[a-zA-Z0-9!#$%&\\'\\*\\+\\-\\.\\^_`\\|~]+";
+var token68Match = "[a-zA-Z0-9\\-\\._\\~\\+\\/]+={0,2}";
+var quotedMatch = '"((?:[^"\\\\]|\\\\[\\s\\S])*)"';
+var quotedParamMatcher = "(" + tokenMatch + ")\\s*=\\s*" + quotedMatch;
+var paramMatcher = "(" + tokenMatch + ")\\s*=\\s*(" + tokenMatch + ")";
+var schemeRE = new RegExp("^[,\\s]*(" + tokenMatch + ")");
+var quotedParamRE = new RegExp("^[,\\s]*" + quotedParamMatcher + "[,\\s]*(.*)");
+var unquotedParamRE = new RegExp("^[,\\s]*" + paramMatcher + "[,\\s]*(.*)");
+var token68ParamRE = new RegExp("^(" + token68Match + ")(?:$|[,\\s])(.*)");
+var skipSubjectCheck = Symbol();
+var idTokenClaims = new WeakMap;
+var jwtRefs = new WeakMap;
+var branded = new WeakSet;
+var nopkce = Symbol();
+var expectNoNonce = Symbol();
+var skipAuthTimeCheck = Symbol();
+var skipStateCheck = Symbol();
+var expectNoState = Symbol();
+var _nodiscoverycheck = Symbol();
+var _expectedIssuer = Symbol();
+
+// ../../node_modules/openid-client/build/index.js
+var headers;
+var USER_AGENT2;
+if (typeof navigator === "undefined" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) {
+  const NAME = "openid-client";
+  const VERSION = "v6.8.4";
+  USER_AGENT2 = `${NAME}/${VERSION}`;
+  headers = { "user-agent": USER_AGENT2 };
+}
+var int = (config) => {
+  return props.get(config);
+};
+var props;
+var tbi;
+function ClientSecretPost2(clientSecret) {
+  if (clientSecret !== undefined) {
+    return ClientSecretPost(clientSecret);
+  }
+  tbi ||= new WeakMap;
+  return (as, client, body, headers2) => {
+    let auth;
+    if (!(auth = tbi.get(client))) {
+      assertString2(client.client_secret, '"metadata.client_secret"');
+      auth = ClientSecretPost(client.client_secret);
+      tbi.set(client, auth);
+    }
+    return auth(as, client, body, headers2);
+  };
+}
+function assertString2(input, it) {
+  if (typeof input !== "string") {
+    throw CodedTypeError2(`${it} must be a string`, ERR_INVALID_ARG_TYPE2);
+  }
+  if (input.length === 0) {
+    throw CodedTypeError2(`${it} must not be empty`, ERR_INVALID_ARG_VALUE2);
+  }
+}
+function None2() {
+  return None();
+}
+var customFetch2 = customFetch;
+var ERR_INVALID_ARG_VALUE2 = "ERR_INVALID_ARG_VALUE";
+var ERR_INVALID_ARG_TYPE2 = "ERR_INVALID_ARG_TYPE";
+function CodedTypeError2(message, code, cause) {
+  const err = new TypeError(message, { cause });
+  Object.assign(err, { code });
+  return err;
+}
+function calculatePKCECodeChallenge2(codeVerifier) {
+  return calculatePKCECodeChallenge(codeVerifier);
+}
+function randomPKCECodeVerifier() {
+  return generateRandomCodeVerifier();
+}
+function randomState() {
+  return generateRandomState();
+}
+var decoder2 = new TextDecoder;
+function getServerHelpers(metadata) {
+  return {
+    supportsPKCE: {
+      __proto__: null,
+      value(method = "S256") {
+        return metadata.code_challenge_methods_supported?.includes(method) === true;
+      }
+    }
+  };
+}
+function addServerHelpers(metadata) {
+  Object.defineProperties(metadata, getServerHelpers(metadata));
+}
+var kEntraId = Symbol();
+
+class Configuration {
+  constructor(server, clientId, metadata, clientAuthentication) {
+    if (typeof clientId !== "string" || !clientId.length) {
+      throw CodedTypeError2('"clientId" must be a non-empty string', ERR_INVALID_ARG_TYPE2);
+    }
+    if (typeof metadata === "string") {
+      metadata = { client_secret: metadata };
+    }
+    if (metadata?.client_id !== undefined && clientId !== metadata.client_id) {
+      throw CodedTypeError2('"clientId" and "metadata.client_id" must be the same', ERR_INVALID_ARG_VALUE2);
+    }
+    const client = {
+      ...structuredClone(metadata),
+      client_id: clientId
+    };
+    client[clockSkew] = metadata?.[clockSkew] ?? 0;
+    client[clockTolerance] = metadata?.[clockTolerance] ?? 30;
+    let auth;
+    if (clientAuthentication) {
+      auth = clientAuthentication;
+    } else {
+      if (typeof client.client_secret === "string" && client.client_secret.length) {
+        auth = ClientSecretPost2(client.client_secret);
+      } else {
+        auth = None2();
+      }
+    }
+    let c = Object.freeze(client);
+    const clone = structuredClone(server);
+    if (kEntraId in server) {
+      clone[_expectedIssuer] = ({ claims: { tid } }) => server.issuer.replace("{tenantid}", tid);
+    }
+    let as = Object.freeze(clone);
+    props ||= new WeakMap;
+    props.set(this, {
+      __proto__: null,
+      as,
+      c,
+      auth,
+      tlsOnly: true,
+      jwksCache: {}
+    });
+  }
+  serverMetadata() {
+    const metadata = structuredClone(int(this).as);
+    addServerHelpers(metadata);
+    return metadata;
+  }
+  clientMetadata() {
+    const metadata = structuredClone(int(this).c);
+    return metadata;
+  }
+  get timeout() {
+    return int(this).timeout;
+  }
+  set timeout(value) {
+    int(this).timeout = value;
+  }
+  get [customFetch2]() {
+    return int(this).fetch;
+  }
+  set [customFetch2](value) {
+    int(this).fetch = value;
+  }
+}
+Object.freeze(Configuration.prototype);
+var retry = Symbol();
+
+// ../auth/src/oidc.ts
+var getOidcParams = async () => {
+  const code_verifier = randomPKCECodeVerifier();
+  const code_challenge = await calculatePKCECodeChallenge2(code_verifier);
+  const state = randomState();
+  return {
+    code_verifier,
+    code_challenge,
+    state
+  };
+};
+
+// ../auth/src/tokenExchange.ts
+var exchangeCodeForTokens = async ({
+  code,
+  codeVerifier,
+  redirectUri,
+  clientId,
+  clientSecret,
+  tokenEndpoint
+}) => {
+  const params = {
+    grant_type: "authorization_code",
+    code,
+    redirect_uri: redirectUri.toString(),
+    client_id: clientId,
+    code_verifier: codeVerifier
+  };
+  if (clientSecret) {
+    params.client_secret = clientSecret;
+  }
+  const tokenParams = new URLSearchParams(params);
+  const tokenResponse = await fetch(tokenEndpoint, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded"
+    },
+    body: tokenParams
+  });
+  const tokenData = await tokenResponse.json();
+  if (!tokenResponse.ok) {
+    throw new Error(`Token exchange failed: ${String(tokenData.error ?? "unknown_error")} — ${String(tokenData.error_description ?? "no description")}`);
+  }
+  const accessToken = tokenData.access_token;
+  const refreshToken = tokenData.refresh_token;
+  if (typeof accessToken !== "string" || typeof refreshToken !== "string") {
+    throw new Error("Token exchange response is missing access_token or refresh_token");
+  }
+  return { accessToken, refreshToken };
+};
+
+// ../auth/src/authProfile.ts
+var DEFAULT_AUTH_PROFILE = "default";
+var PROFILE_DIR = "profiles";
+var PROFILE_NAME_RE = /^[A-Za-z0-9._-]+$/;
+var ACTIVE_AUTH_PROFILE_KEY = Symbol.for("@uipath/auth/ActiveAuthProfile");
+var AUTH_PROFILE_STORAGE_KEY = Symbol.for("@uipath/auth/ProfileStorage");
+var globalSlot2 = globalThis;
+function isAuthProfileStorage(value) {
+  return value !== null && typeof value === "object" && "getStore" in value && "run" in value;
+}
+function createProfileStorage() {
+  const [error, mod] = catchError(() => __require("node:async_hooks"));
+  if (error || typeof mod?.AsyncLocalStorage !== "function") {
+    return {
+      getStore: () => {
+        return;
+      },
+      run: (_store, fn) => fn()
+    };
+  }
+  return new mod.AsyncLocalStorage;
+}
+function getProfileStorage() {
+  const existing = globalSlot2[AUTH_PROFILE_STORAGE_KEY];
+  if (isAuthProfileStorage(existing)) {
+    return existing;
+  }
+  const storage = createProfileStorage();
+  globalSlot2[AUTH_PROFILE_STORAGE_KEY] = storage;
+  return storage;
+}
+var profileStorage = getProfileStorage();
+
+class AuthProfileValidationError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AuthProfileValidationError";
+  }
+}
+function normalizeAuthProfileName(profile) {
+  if (profile === undefined || profile === DEFAULT_AUTH_PROFILE) {
+    return;
+  }
+  if (profile.length === 0 || profile === "." || profile === ".." || !PROFILE_NAME_RE.test(profile)) {
+    throw new AuthProfileValidationError(`Invalid profile name "${profile}". Profile names may contain only letters, numbers, '.', '_', and '-'.`);
+  }
+  return profile;
+}
+function setActiveAuthProfile(profile) {
+  const normalized = normalizeAuthProfileName(profile);
+  const scopedState = profileStorage.getStore();
+  if (scopedState !== undefined) {
+    if (normalized === undefined) {
+      delete scopedState.profile;
+      return;
+    }
+    scopedState.profile = normalized;
+    return;
+  }
+  if (normalized === undefined) {
+    delete globalSlot2[ACTIVE_AUTH_PROFILE_KEY];
+    return;
+  }
+  globalSlot2[ACTIVE_AUTH_PROFILE_KEY] = { profile: normalized };
+}
+function clearActiveAuthProfile() {
+  const scopedState = profileStorage.getStore();
+  if (scopedState !== undefined) {
+    delete scopedState.profile;
+    return;
+  }
+  delete globalSlot2[ACTIVE_AUTH_PROFILE_KEY];
+}
+function getActiveAuthProfile() {
+  const scopedState = profileStorage.getStore();
+  if (scopedState !== undefined) {
+    return scopedState.profile;
+  }
+  return globalSlot2[ACTIVE_AUTH_PROFILE_KEY]?.profile;
+}
+function runWithAuthProfile(profile, fn) {
+  const normalized = normalizeAuthProfileName(profile);
+  return profileStorage.run(normalized === undefined ? {} : { profile: normalized }, fn);
+}
+function resolveAuthProfileFilePath(profile) {
+  const normalized = normalizeAuthProfileName(profile);
+  if (normalized === undefined) {
+    throw new AuthProfileValidationError(`"${DEFAULT_AUTH_PROFILE}" is the built-in profile and does not have a profile file path.`);
+  }
+  const fs = getFileSystem();
+  return fs.path.join(fs.env.homedir(), UIPATH_HOME_DIR, PROFILE_DIR, normalized, AUTH_FILENAME);
+}
+function getActiveAuthProfileFilePath() {
+  const profile = getActiveAuthProfile();
+  return profile ? resolveAuthProfileFilePath(profile) : undefined;
+}
+
+// ../auth/src/utils/jwt.ts
+class InvalidIssuerError extends Error {
+  expected;
+  actual;
+  constructor(expected, actual) {
+    const actualText = actual ?? "<missing>";
+    super(`Token issuer does not match the authority used to log in.
+` + `Expected: ${expected}
+` + `Actual:   ${actualText}
+
+` + `The identity server that issued this token is not the one ` + `you pointed --authority at. Refusing to save credentials.`);
+    this.expected = expected;
+    this.actual = actual;
+    this.name = "InvalidIssuerError";
+  }
+}
+var parseJWT = (token) => {
+  try {
+    const parts = token.split(".");
+    const base64Url = parts[1];
+    if (!base64Url) {
+      throw new Error("Invalid JWT token format - missing payload section");
+    }
+    const base64 = base64Url.replace(/-/g, "+").replace(/_/g, "/");
+    let decodedString;
+    if (isBrowser() && typeof atob !== "undefined") {
+      decodedString = atob(base64);
+    } else {
+      decodedString = Buffer.from(base64, "base64").toString();
+    }
+    const jsonPayload = decodeURIComponent(decodedString.split("").map((c) => `%${`00${c.charCodeAt(0).toString(16)}`.slice(-2)}`).join(""));
+    const parsed = JSON.parse(jsonPayload);
+    return parsed;
+  } catch (error) {
+    throw new Error(`Failed to parse JWT: ${error instanceof Error ? error.message : "Unknown error"}`);
+  }
+};
+var assertIssuerMatchesAuthority = (token, authority) => {
+  let payload;
+  try {
+    payload = parseJWT(token);
+  } catch (error) {
+    throw new InvalidIssuerError(`${authority.replace(/\/+$/, "")}/identity_`, `<unparseable: ${error instanceof Error ? error.message : "unknown error"}>`);
+  }
+  const stripTrailingSlash = (s) => s.replace(/\/+$/, "");
+  const expected = `${stripTrailingSlash(authority)}/identity_`;
+  const actual = typeof payload.iss === "string" ? stripTrailingSlash(payload.iss) : undefined;
+  if (actual !== expected) {
+    throw new InvalidIssuerError(expected, payload.iss);
+  }
+};
+var getTokenExpiration = (accessToken) => {
+  try {
+    const parts = accessToken.split(".");
+    if (parts.length !== 3) {
+      return;
+    }
+    const payload = parts[1];
+    const base64 = payload.replace(/-/g, "+").replace(/_/g, "/");
+    const padded = base64 + "=".repeat((4 - base64.length % 4) % 4);
+    const decoded = atob(padded);
+    const claims = JSON.parse(decoded);
+    if (typeof claims.exp !== "number") {
+      return;
+    }
+    return new Date(claims.exp * 1000);
+  } catch {
+    return;
+  }
+};
+
+// ../auth/src/sessionIdentity.ts
+var parseAuthFlow = (value) => value === "authorization_code" || value === "client_credentials" || value === "federated_credentials" ? value : undefined;
+var decodeClaims = (accessToken) => {
+  const [error, claims] = catchError(() => parseJWT(accessToken));
+  return error ? undefined : claims;
+};
+var asString = (value) => typeof value === "string" && value.length > 0 ? value : undefined;
+var resolveIdentityType = (claims, authFlow, email) => {
+  const subType = asString(claims?.sub_type);
+  if (subType) {
+    return subType.startsWith("service") ? "Application" : "User";
+  }
+  if (authFlow) {
+    return authFlow === "authorization_code" ? "User" : "Application";
+  }
+  if (email)
+    return "User";
+  if (asString(claims?.client_id) && !asString(claims?.sub)) {
+    return "Application";
+  }
+  return;
+};
+var looksLikeEmail = (value) => value?.includes("@") ?? false;
+var pickEmail = (claims) => {
+  for (const candidate of [claims?.email, claims?.preferred_username]) {
+    const value = asString(candidate);
+    if (looksLikeEmail(value))
+      return value;
+  }
+  return;
+};
+var pickName = (claims) => {
+  const username = asString(claims?.preferred_username);
+  return asString(claims?.name) ?? (looksLikeEmail(username) ? undefined : username);
+};
+var resolveSessionIdentity = (accessToken, authFlow) => {
+  const claims = accessToken ? decodeClaims(accessToken) : undefined;
+  const email = pickEmail(claims);
+  const type = resolveIdentityType(claims, authFlow, email);
+  if (!type)
+    return;
+  const identity = { type };
+  if (authFlow)
+    identity.authFlow = authFlow;
+  if (type === "User") {
+    const userId = asString(claims?.sub);
+    if (userId)
+      identity.userId = userId;
+    if (email)
+      identity.userEmail = email;
+    const name = pickName(claims);
+    if (name)
+      identity.userName = name;
+    return identity;
+  }
+  const clientId = asString(claims?.client_id);
+  if (clientId)
+    identity.clientId = clientId;
+  return identity;
+};
+
+// ../auth/src/envAuth.ts
+var ENV_AUTH_ENABLE_VAR = "UIPATH_CLI_ENABLE_ENV_AUTH";
+var ENFORCE_ROBOT_AUTH_VAR = "UIPATH_CLI_ENFORCE_ROBOT_AUTH";
+var ENV_AUTH_VARS = {
+  token: "UIPATH_CLI_AUTH_TOKEN",
+  organizationName: "UIPATH_CLI_ORGANIZATION_NAME",
+  organizationId: "UIPATH_CLI_ORGANIZATION_ID",
+  tenantName: "UIPATH_CLI_TENANT_NAME",
+  tenantId: "UIPATH_CLI_TENANT_ID"
+};
+
+class EnvAuthConfigError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "EnvAuthConfigError";
+  }
+}
+var isEnvAuthEnabled = () => process.env[ENV_AUTH_ENABLE_VAR] === "true";
+var isRobotAuthEnforced = () => process.env[ENFORCE_ROBOT_AUTH_VAR] === "true";
+var requireEnv = (name) => {
+  const value = process.env[name];
+  if (!value) {
+    throw new EnvAuthConfigError(`${ENV_AUTH_ENABLE_VAR}=true but ${name} is not set. ` + `Set ${name} to enable env-var authentication.`);
+  }
+  return value;
+};
+var OPAQUE_TOKEN_BASE_URL_VAR = "UIPATH_URL";
+var resolveBaseUrl = (rawUrl, failureContext) => {
+  const [baseUrlError, baseUrl] = catchError(() => normalizeAndValidateBaseUrl(rawUrl));
+  if (baseUrlError) {
+    if (baseUrlError instanceof InvalidBaseUrlError) {
+      throw baseUrlError;
+    }
+    throw new EnvAuthConfigError(`${failureContext}: ` + `${baseUrlError instanceof Error ? baseUrlError.message : String(baseUrlError)}`);
+  }
+  return baseUrl;
+};
+var readAuthFromEnv = () => {
+  const accessToken = requireEnv(ENV_AUTH_VARS.token);
+  const organizationName = requireEnv(ENV_AUTH_VARS.organizationName);
+  const organizationId = requireEnv(ENV_AUTH_VARS.organizationId);
+  const tenantName = requireEnv(ENV_AUTH_VARS.tenantName);
+  const tenantId = requireEnv(ENV_AUTH_VARS.tenantId);
+  const [parseError, payload] = catchError(() => parseJWT(accessToken));
+  if (parseError) {
+    const parseErrorMessage = parseError instanceof Error ? parseError.message : String(parseError);
+    const rawUrl = process.env[OPAQUE_TOKEN_BASE_URL_VAR];
+    if (!rawUrl) {
+      throw new EnvAuthConfigError(`${ENV_AUTH_VARS.token} is not a JWT (treating it as an opaque token, ` + `e.g. a Personal Access Token). Set ${OPAQUE_TOKEN_BASE_URL_VAR} to the ` + `UiPath base URL if this is a PAT, or fix the token if it was meant to ` + `be a JWT (parse error: ${parseErrorMessage}).`);
+    }
+    const baseUrl2 = resolveBaseUrl(rawUrl, `Failed to validate ${OPAQUE_TOKEN_BASE_URL_VAR}`);
+    return {
+      loginStatus: "Logged in",
+      accessToken,
+      baseUrl: baseUrl2,
+      organizationName,
+      organizationId,
+      tenantName,
+      tenantId,
+      source: "env-vars" /* EnvironmentVariables */,
+      hint: "Token is opaque (not a JWT) - expiration and identity cannot be " + "determined locally. Commands will fail with 401 once it is revoked or " + `expired. If this was meant to be a JWT instead of a PAT, note: ${parseErrorMessage}`
+    };
+  }
+  const iss = payload.iss;
+  if (typeof iss !== "string" || iss.length === 0) {
+    throw new EnvAuthConfigError(`${ENV_AUTH_VARS.token} has no 'iss' claim; cannot determine ` + `the UiPath server. Ensure the token was issued by a UiPath identity server.`);
+  }
+  const baseUrl = resolveBaseUrl(iss, "Failed to derive server URL from token 'iss' claim");
+  const expiration = getTokenExpiration(accessToken);
+  const loginStatus = expiration && expiration <= new Date ? "Expired" : "Logged in";
+  const identity = resolveSessionIdentity(accessToken);
+  return {
+    loginStatus,
+    accessToken,
+    baseUrl,
+    organizationName,
+    organizationId,
+    tenantName,
+    tenantId,
+    expiration,
+    source: "env-vars" /* EnvironmentVariables */,
+    ...identity ? { identity } : {}
+  };
+};
+
+// ../auth/src/refreshCircuitBreaker.ts
+var BREAKER_SUFFIX = ".refresh-state";
+var BACKOFF_BASE_MS = 60000;
+var BACKOFF_CAP_MS = 60 * 60 * 1000;
+var SURFACE_WINDOW_MS = 60 * 60 * 1000;
+async function refreshTokenFingerprint(refreshToken) {
+  const bytes = new TextEncoder().encode(refreshToken);
+  if (globalThis.crypto?.subtle) {
+    const digest = await globalThis.crypto.subtle.digest("SHA-256", bytes);
+    return Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, "0")).join("").slice(0, 16);
+  }
+  const { createHash } = await import("node:crypto");
+  return createHash("sha256").update(refreshToken).digest("hex").slice(0, 16);
+}
+function breakerPathFor(authPath) {
+  return `${authPath}${BREAKER_SUFFIX}`;
+}
+async function loadRefreshBreaker(authPath) {
+  const fs = getFileSystem();
+  try {
+    const content = await fs.readFile(breakerPathFor(authPath), "utf-8");
+    if (!content)
+      return {};
+    const parsed = JSON.parse(content);
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+async function saveRefreshBreaker(authPath, state) {
+  try {
+    const fs = getFileSystem();
+    const path = breakerPathFor(authPath);
+    await fs.mkdir(fs.path.dirname(path));
+    const tempPath = `${path}.tmp`;
+    await fs.writeFile(tempPath, JSON.stringify(state));
+    await fs.rename(tempPath, path);
+  } catch {}
+}
+async function clearRefreshBreaker(authPath) {
+  const fs = getFileSystem();
+  const path = breakerPathFor(authPath);
+  try {
+    if (await fs.exists(path)) {
+      await fs.rm(path);
+    }
+  } catch {}
+}
+function nextBackoffMs(attempts) {
+  const shift = Math.max(0, attempts - 1);
+  return Math.min(BACKOFF_BASE_MS * 2 ** shift, BACKOFF_CAP_MS);
+}
+function shouldSurface(state, nowMs) {
+  if (state.lastSurfacedAtMs === undefined)
+    return true;
+  return nowMs - state.lastSurfacedAtMs >= SURFACE_WINDOW_MS;
+}
+
+// ../auth/src/robotClientFallback.ts
+var DEFAULT_TIMEOUT_MS = 1000;
+var CLOSE_TIMEOUT_MS = 500;
+var ROBOT_USER_SERVICES_PIPE = "UiPathUserServices";
+var ROBOT_USER_SERVICES_ALTERNATE_PIPE = `${ROBOT_USER_SERVICES_PIPE}Alternate`;
+var PIPE_NAME_MAX_LENGTH = 103;
+var getRobotIpcPipeNames = async () => {
+  const fs = getFileSystem();
+  const username = fs.env.getenv("USER") ?? fs.env.getenv("USERNAME");
+  if (!username) {
+    throw new Error("Unable to determine current username");
+  }
+  const tempPath = fs.env.getenv("TMPDIR") ?? "/tmp/";
+  return [ROBOT_USER_SERVICES_PIPE, ROBOT_USER_SERVICES_ALTERNATE_PIPE].map((baseName) => fs.path.join(tempPath, `${baseName}_${username}`).substring(0, PIPE_NAME_MAX_LENGTH));
+};
+var defaultIsRobotIpcAvailable = async () => {
+  if (process.platform === "win32") {
+    return true;
+  }
+  const [pipeNamesError, pipeNames] = await catchError(getRobotIpcPipeNames());
+  if (pipeNamesError || !pipeNames) {
+    return false;
+  }
+  const fs = getFileSystem();
+  for (const pipeName of pipeNames) {
+    const [existsError, exists] = await catchError(fs.exists(pipeName));
+    if (!existsError && exists === true) {
+      return true;
+    }
+  }
+  return false;
+};
+var withTimeout = (promise, timeoutMs) => new Promise((resolve, reject) => {
+  const timer = setTimeout(() => reject(new Error(`Robot IPC call timed out after ${timeoutMs}ms`)), timeoutMs);
+  promise.then((value) => {
+    clearTimeout(timer);
+    resolve(value);
+  }, (error) => {
+    clearTimeout(timer);
+    reject(error);
+  });
+});
+var parseResourceUrl = (url) => {
+  const [error, parsed] = catchError(() => new URL(url));
+  if (error || !parsed)
+    return;
+  const segments = parsed.pathname.split("/").filter(Boolean);
+  return {
+    baseUrl: parsed.origin,
+    organizationName: segments[0],
+    tenantName: segments[1]
+  };
+};
+var ROBOT_CLIENT_LOADER_KEY = Symbol.for("@uipath/auth/RobotClientLoader");
+var registerRobotClientLoader = (loader) => {
+  globalThis[ROBOT_CLIENT_LOADER_KEY] = loader;
+};
+var getRegisteredRobotClientLoader = () => {
+  const loader = globalThis[ROBOT_CLIENT_LOADER_KEY];
+  return typeof loader === "function" ? loader : undefined;
+};
+var defaultLoadModule = async () => {
+  const hostLoader = getRegisteredRobotClientLoader();
+  if (!hostLoader) {
+    return;
+  }
+  const [error, mod] = await catchError(() => hostLoader());
+  if (error || !mod) {
+    return;
+  }
+  return mod;
+};
+var tryRobotClientFallback = async (options = {}) => {
+  if (isBrowser())
+    return;
+  if (!options.force) {
+    if (process.env.CI || process.env.GITHUB_ACTIONS) {
+      return;
+    }
+    if (process.env.UIPATH_URL) {
+      return;
+    }
+  }
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const isRobotIpcAvailable = options.isRobotIpcAvailable ?? defaultIsRobotIpcAvailable;
+  const loadModule = options.loadModule ?? defaultLoadModule;
+  if (!await isRobotIpcAvailable()) {
+    return;
+  }
+  const mod = await loadModule();
+  if (!mod)
+    return;
+  const [ctorError, proxy] = catchError(() => new mod.RobotProxyConstructor);
+  if (ctorError || !proxy) {
+    return;
+  }
+  try {
+    const enabled = await withTimeout(proxy.interactiveConnectFlow.IsEnabled(), timeoutMs);
+    if (!enabled) {
+      return;
+    }
+    const [resourceUrl, accessToken] = await Promise.all([
+      withTimeout(proxy.accessProvider.GetResourceUrl("Orchestrator"), timeoutMs),
+      withTimeout(proxy.accessProvider.GetAccessToken("Orchestrator", false), timeoutMs)
+    ]);
+    if (!accessToken) {
+      return;
+    }
+    const parsedUrl = parseResourceUrl(resourceUrl);
+    if (!parsedUrl) {
+      return;
+    }
+    let organizationIdFromToken;
+    let tenantIdFromToken;
+    let issuerFromToken;
+    const [jwtError, claims] = catchError(() => parseJWT(accessToken));
+    if (!jwtError && claims) {
+      const rawOrgId = claims.prtId ?? claims.organizationId ?? claims.prt_id;
+      if (typeof rawOrgId === "string" && rawOrgId.length > 0) {
+        organizationIdFromToken = rawOrgId;
+      }
+      const tenantClaim = claims.tenantId ?? claims.tenant_id;
+      if (typeof tenantClaim === "string" && tenantClaim.length > 0) {
+        tenantIdFromToken = tenantClaim;
+      }
+      const issClaim = claims.iss;
+      if (typeof issClaim === "string" && issClaim.length > 0) {
+        issuerFromToken = issClaim;
+      }
+    }
+    return {
+      accessToken,
+      baseUrl: parsedUrl.baseUrl,
+      organizationName: parsedUrl.organizationName,
+      organizationId: organizationIdFromToken ?? parsedUrl.organizationName,
+      tenantName: parsedUrl.tenantName,
+      tenantId: tenantIdFromToken,
+      issuer: issuerFromToken
+    };
+  } catch {
+    return;
+  } finally {
+    await catchError(() => withTimeout(proxy.CloseAsync(), CLOSE_TIMEOUT_MS));
+  }
+};
+
+// ../auth/src/tokenRefresh.ts
+var TOKEN_REFRESH_REAUTHENTICATE_MESSAGE = "Token refresh failed. Run 'uip login' to re-authenticate.";
+
+class TokenRefreshOAuthError extends Error {
+  __brand = "TokenRefreshOAuthError";
+  constructor() {
+    super(TOKEN_REFRESH_REAUTHENTICATE_MESSAGE);
+    this.name = "TokenRefreshOAuthError";
+  }
+}
+function isTokenRefreshOAuthFailure(error) {
+  return error instanceof TokenRefreshOAuthError;
+}
+var refreshAccessToken = async ({
+  refreshToken,
+  tokenEndpoint,
+  clientId,
+  expectedAuthority
+}) => {
+  const tokenParams = new URLSearchParams({
+    grant_type: "refresh_token",
+    refresh_token: refreshToken,
+    client_id: clientId
+  });
+  const tokenResponse = await fetch(tokenEndpoint, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded"
+    },
+    body: tokenParams
+  });
+  const tokenData = await tokenResponse.json();
+  if (!tokenResponse.ok) {
+    throw new TokenRefreshOAuthError;
+  }
+  const newAccessToken = tokenData.access_token;
+  const newRefreshToken = tokenData.refresh_token;
+  if (typeof newAccessToken !== "string" || typeof newRefreshToken !== "string") {
+    throw new Error("Token refresh response is missing access_token or refresh_token");
+  }
+  if (expectedAuthority) {
+    assertIssuerMatchesAuthority(newAccessToken, expectedAuthority);
+  }
+  return { accessToken: newAccessToken, refreshToken: newRefreshToken };
+};
+
+// ../auth/src/types.ts
+var AUTH_FLOW_ENV_VAR = "UIPATH_AUTH_FLOW";
+
+// ../auth/src/utils/envFile.ts
+var DEFAULT_AUTH_FILENAME = AUTH_FILENAME;
+var DEFAULT_ENV_FILENAME = `${UIPATH_HOME_DIR}/${AUTH_FILENAME}`;
+var KNOWN_ERROR_CODES = new Set([
+  "EISDIR",
+  "EACCES",
+  "EPERM",
+  "ELOOP",
+  "ENOTDIR",
+  "EUNKNOWN"
+]);
+var errorCode = (err) => {
+  if (err !== null && typeof err === "object" && "code" in err && typeof err.code === "string") {
+    const raw = err.code;
+    return KNOWN_ERROR_CODES.has(raw) ? raw : "EUNKNOWN";
+  }
+  return "EUNKNOWN";
+};
+var probeAsync = async (fs, candidate) => {
+  try {
+    const stats = await fs.stat(candidate);
+    if (stats === null) {
+      return { exists: false };
+    }
+    if (!stats.isFile()) {
+      return {
+        exists: false,
+        unusable: {
+          reason: "not-a-file",
+          code: "EISDIR",
+          message: `Path is not a regular file: ${candidate}`
+        }
+      };
+    }
+    return { exists: true };
+  } catch (err) {
+    return {
+      exists: false,
+      unusable: {
+        reason: "unreadable",
+        code: errorCode(err),
+        message: err instanceof Error ? err.message : String(err)
+      }
+    };
+  }
+};
+var resolveEnvFileLocationAsync = async (envFilePath = DEFAULT_ENV_FILENAME, opts) => {
+  const fs = getFileSystem();
+  if (fs.path.isAbsolute(envFilePath)) {
+    const probe2 = await probeAsync(fs, envFilePath);
+    return probe2.exists ? { exists: true, absolutePath: envFilePath, source: "absolute" } : {
+      exists: false,
+      absolutePath: envFilePath,
+      source: "absolute",
+      ...probe2.unusable ? { unusable: probe2.unusable } : {}
+    };
+  }
+  const cwd = opts?.cwd ?? fs.env.cwd();
+  let searchDir = cwd;
+  while (true) {
+    const candidate = fs.path.join(searchDir, envFilePath);
+    const probe2 = await probeAsync(fs, candidate);
+    if (probe2.exists) {
+      return {
+        exists: true,
+        absolutePath: candidate,
+        source: searchDir === cwd ? "cwd" : "ancestor"
+      };
+    }
+    const parentDir = fs.path.dirname(searchDir);
+    if (parentDir === searchDir) {
+      break;
+    }
+    searchDir = parentDir;
+  }
+  const homePath = fs.path.join(fs.env.homedir(), envFilePath);
+  const probe = await probeAsync(fs, homePath);
+  if (probe.exists) {
+    return { exists: true, absolutePath: homePath, source: "home" };
+  }
+  return {
+    exists: false,
+    absolutePath: homePath,
+    source: "default",
+    ...probe.unusable ? { unusable: probe.unusable } : {}
+  };
+};
+var resolveEnvFilePathAsync = async (envFilePath = DEFAULT_ENV_FILENAME, opts) => {
+  const location = await resolveEnvFileLocationAsync(envFilePath, opts);
+  if (location.exists) {
+    return { absolutePath: location.absolutePath };
+  }
+  return {
+    absolutePath: undefined,
+    errorMessage: location.source === "absolute" ? `Environment file not found: ${envFilePath}` : `Unable to locate environment file: ${envFilePath}. Run 'uip login' to authenticate.`
+  };
+};
+var loadEnvFileAsync = async ({ envPath }) => {
+  const fs = getFileSystem();
+  const absolutePath = fs.path.isAbsolute(envPath) ? envPath : fs.path.join(fs.env.cwd(), envPath);
+  if (!await fs.exists(absolutePath)) {
+    throw new Error(`Environment file not found: ${envPath}`);
+  }
+  const content = await fs.readFile(absolutePath, "utf-8");
+  if (content === null) {
+    throw new Error(`Environment file not found: ${envPath}`);
+  }
+  const env = {};
+  for (const line of content.split(`
+`)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) {
+      continue;
+    }
+    const equalIndex = trimmed.indexOf("=");
+    if (equalIndex === -1) {
+      continue;
+    }
+    const key = trimmed.slice(0, equalIndex).trim();
+    let value = trimmed.slice(equalIndex + 1).trim();
+    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+      value = value.slice(1, -1);
+    }
+    env[key] = value;
+  }
+  return env;
+};
+var saveEnvFileAsync = async ({
+  envPath,
+  data,
+  merge = true
+}) => {
+  const fs = getFileSystem();
+  const absolutePath = fs.path.isAbsolute(envPath) ? envPath : fs.path.join(fs.env.homedir(), envPath);
+  let existingData = {};
+  if (merge && await fs.exists(absolutePath)) {
+    try {
+      existingData = await loadEnvFileAsync({ envPath: absolutePath });
+    } catch {}
+  }
+  const finalData = { ...existingData, ...data };
+  const lines = [];
+  for (const [key, value] of Object.entries(finalData)) {
+    if (value === undefined) {
+      continue;
+    }
+    const needsQuotes = value.includes(" ") || value.includes("#");
+    const finalValue = needsQuotes ? `"${value}"` : value;
+    lines.push(`${key}=${finalValue}`);
+  }
+  const content = `${lines.join(`
+`)}
+`;
+  const dir = fs.path.dirname(absolutePath);
+  await fs.mkdir(dir);
+  const tempPath = `${absolutePath}.tmp`;
+  await fs.writeFile(tempPath, content);
+  await fs.rename(tempPath, absolutePath);
+};
+
+// ../auth/src/loginStatus.ts
+var CredentialSource;
+((CredentialSource2) => {
+  CredentialSource2["SavedLogin"] = "saved-login";
+  CredentialSource2["Robot"] = "robot";
+  CredentialSource2["EnvironmentVariables"] = "env-vars";
+})(CredentialSource ||= {});
+var getLoginStatusAsync = async (options = {}) => {
+  return getLoginStatusWithDeps(options);
+};
+var getLoginStatusWithDeps = async (options = {}, deps = {}) => {
+  const {
+    resolveEnvFilePath = resolveEnvFilePathAsync,
+    loadEnvFile = loadEnvFileAsync,
+    saveEnvFile = saveEnvFileAsync,
+    getFs = getFileSystem,
+    refreshToken: refreshTokenFn = refreshAccessToken,
+    resolveConfig = resolveConfigAsync,
+    robotFallback = tryRobotClientFallback,
+    loadBreaker = loadRefreshBreaker,
+    saveBreaker = saveRefreshBreaker,
+    clearBreaker = clearRefreshBreaker
+  } = deps;
+  if (isRobotAuthEnforced()) {
+    return resolveRobotEnforcedStatus(robotFallback);
+  }
+  if (isEnvAuthEnabled()) {
+    return readAuthFromEnv();
+  }
+  const activeProfile = getActiveAuthProfile();
+  const activeProfileFilePath = getActiveAuthProfileFilePath();
+  const usingActiveProfile = activeProfile !== undefined && (options.envFilePath === undefined || options.envFilePath === activeProfileFilePath);
+  const envFilePath = options.envFilePath ?? activeProfileFilePath ?? DEFAULT_ENV_FILENAME;
+  const { ensureTokenValidityMinutes } = options;
+  const { absolutePath } = await resolveEnvFilePath(envFilePath);
+  if (absolutePath === undefined) {
+    if (usingActiveProfile) {
+      return {
+        loginStatus: "Not logged in",
+        hint: `No credentials found for profile "${activeProfile}". Run 'uip login --profile ${activeProfile}' to authenticate this profile.`
+      };
+    }
+    return resolveBorrowedRobotStatus(robotFallback);
+  }
+  const loaded = await loadFileCredentials(loadEnvFile, absolutePath);
+  if ("status" in loaded) {
+    return loaded.status;
+  }
+  const { credentials } = loaded;
+  const globalHint = () => usingActiveProfile ? Promise.resolve(undefined) : getGlobalCredsHint(getFs, loadEnvFile, absolutePath, envFilePath);
+  const expiration = getTokenExpiration(credentials.UIPATH_ACCESS_TOKEN);
+  const outerThreshold = computeExpirationThreshold(ensureTokenValidityMinutes);
+  let tokens = {
+    accessToken: credentials.UIPATH_ACCESS_TOKEN,
+    refreshToken: credentials.UIPATH_REFRESH_TOKEN,
+    expiration,
+    lockReleaseFailed: false
+  };
+  const refreshToken = credentials.UIPATH_REFRESH_TOKEN;
+  if (expiration && expiration <= outerThreshold && refreshToken) {
+    const refreshed = await attemptRefresh({
+      absolutePath,
+      credentials,
+      accessToken: credentials.UIPATH_ACCESS_TOKEN,
+      refreshToken,
+      expiration,
+      ensureTokenValidityMinutes,
+      getFs,
+      loadEnvFile,
+      saveEnvFile,
+      refreshFn: refreshTokenFn,
+      resolveConfig,
+      loadBreaker,
+      saveBreaker,
+      clearBreaker,
+      globalHint
+    });
+    if (refreshed.kind === "terminal") {
+      return refreshed.status;
+    }
+    tokens = refreshed.tokens;
+  }
+  return buildFileStatus(tokens, credentials, globalHint);
+};
+async function resolveRobotEnforcedStatus(robotFallback) {
+  if (isEnvAuthEnabled()) {
+    throw new EnvAuthConfigError(`${ENV_AUTH_ENABLE_VAR}=true and ${ENFORCE_ROBOT_AUTH_VAR}=true ` + `are mutually exclusive. Unset one of them and re-run.`);
+  }
+  const robotCreds = await robotFallback({ force: true });
+  if (!robotCreds) {
+    return {
+      loginStatus: "Not logged in",
+      hint: `${ENFORCE_ROBOT_AUTH_VAR}=true but the UiPath Robot ` + `session is unavailable. Start and sign in to the Assistant, ` + `or unset ${ENFORCE_ROBOT_AUTH_VAR} to fall back to file or ` + `env-var authentication.`
+    };
+  }
+  return buildRobotStatus(robotCreds);
+}
+async function resolveBorrowedRobotStatus(robotFallback) {
+  const robotCreds = await robotFallback();
+  return robotCreds ? buildRobotStatus(robotCreds) : { loginStatus: "Not logged in" };
+}
+async function loadFileCredentials(loadEnvFile, absolutePath) {
+  let credentials;
+  try {
+    credentials = await loadEnvFile({ envPath: absolutePath });
+  } catch (error) {
+    if (isFileNotFoundError(error)) {
+      return { status: { loginStatus: "Not logged in" } };
+    }
+    throw error;
+  }
+  if (!credentials.UIPATH_ACCESS_TOKEN) {
+    return { status: { loginStatus: "Not logged in" } };
+  }
+  return { credentials };
+}
+async function getGlobalCredsHint(getFs, loadEnvFile, absolutePath, envFilePath) {
+  const fs = getFs();
+  const globalPath = fs.path.join(fs.env.homedir(), envFilePath);
+  if (absolutePath === globalPath)
+    return;
+  if (!await fs.exists(globalPath))
+    return;
+  try {
+    const globalCreds = await loadEnvFile({ envPath: globalPath });
+    if (!globalCreds.UIPATH_ACCESS_TOKEN)
+      return;
+    const globalExp = getTokenExpiration(globalCreds.UIPATH_ACCESS_TOKEN);
+    if (globalExp && globalExp <= new Date)
+      return;
+    return `Local credentials file at ${absolutePath} has expired credentials. Valid credentials exist in ${globalPath}. Remove the local file or run 'uip login' to re-authenticate.`;
+  } catch {
+    return;
+  }
+}
+function computeExpirationThreshold(ensureTokenValidityMinutes) {
+  return new Date(Date.now() + (ensureTokenValidityMinutes ?? 0) * 60 * 1000);
+}
+async function attemptRefresh(ctx) {
+  const shortCircuit = await circuitBreakerShortCircuit(ctx);
+  if (shortCircuit) {
+    return { kind: "terminal", status: shortCircuit };
+  }
+  let release;
+  try {
+    release = await ctx.getFs().acquireLock(ctx.absolutePath);
+  } catch (error) {
+    return {
+      kind: "terminal",
+      status: await lockAcquireFailureStatus(ctx, error)
+    };
+  }
+  let lockedFailure;
+  let lockReleaseFailed = false;
+  let success;
+  try {
+    const outcome = await runRefreshLocked({
+      absolutePath: ctx.absolutePath,
+      refreshToken: ctx.refreshToken,
+      customAuthority: ctx.credentials.UIPATH_URL,
+      ensureTokenValidityMinutes: ctx.ensureTokenValidityMinutes,
+      loadEnvFile: ctx.loadEnvFile,
+      saveEnvFile: ctx.saveEnvFile,
+      refreshFn: ctx.refreshFn,
+      resolveConfig: ctx.resolveConfig,
+      loadBreaker: ctx.loadBreaker,
+      saveBreaker: ctx.saveBreaker,
+      clearBreaker: ctx.clearBreaker
+    });
+    if (outcome.kind === "fail") {
+      lockedFailure = outcome.status;
+    } else {
+      success = outcome;
+    }
+  } finally {
+    try {
+      await release();
+    } catch {
+      lockReleaseFailed = true;
+    }
+  }
+  if (lockedFailure) {
+    const globalHint = await ctx.globalHint();
+    const base = globalHint ? { ...lockedFailure, loginStatus: "Expired", hint: globalHint } : lockedFailure;
+    return {
+      kind: "terminal",
+      status: lockReleaseFailed ? { ...base, lockReleaseFailed: true } : base
+    };
+  }
+  return {
+    kind: "refreshed",
+    tokens: {
+      accessToken: success?.accessToken,
+      refreshToken: success?.refreshToken,
+      expiration: success?.expiration,
+      tokenRefresh: success?.tokenRefresh,
+      persistenceWarning: success?.persistenceWarning,
+      lockReleaseFailed
+    }
+  };
+}
+async function buildFileStatus(tokens, credentials, globalHint) {
+  const result = {
+    loginStatus: tokens.expiration && tokens.expiration <= new Date ? "Expired" : "Logged in",
+    accessToken: tokens.accessToken,
+    refreshToken: tokens.refreshToken,
+    baseUrl: credentials.UIPATH_URL,
+    organizationName: credentials.UIPATH_ORGANIZATION_NAME,
+    organizationId: credentials.UIPATH_ORGANIZATION_ID,
+    tenantName: credentials.UIPATH_TENANT_NAME,
+    tenantId: credentials.UIPATH_TENANT_ID,
+    expiration: tokens.expiration,
+    source: "saved-login" /* SavedLogin */,
+    ...identityFields(tokens.accessToken, credentials),
+    ...tokens.persistenceWarning ? { hint: tokens.persistenceWarning, persistenceFailed: true } : {},
+    ...tokens.lockReleaseFailed ? { lockReleaseFailed: true } : {},
+    ...tokens.tokenRefresh ? { tokenRefresh: tokens.tokenRefresh } : {}
+  };
+  if (result.loginStatus === "Expired") {
+    const hint = await globalHint();
+    if (hint) {
+      result.hint = hint;
+    }
+  }
+  return result;
+}
+function identityFields(accessToken, credentials) {
+  const identity = resolveSessionIdentity(accessToken, parseAuthFlow(credentials[AUTH_FLOW_ENV_VAR]));
+  return identity ? { identity } : {};
+}
+function buildRobotStatus(robotCreds) {
+  const identity = resolveSessionIdentity(robotCreds.accessToken);
+  return {
+    loginStatus: "Logged in",
+    accessToken: robotCreds.accessToken,
+    baseUrl: robotCreds.baseUrl,
+    organizationName: robotCreds.organizationName,
+    organizationId: robotCreds.organizationId,
+    tenantName: robotCreds.tenantName,
+    tenantId: robotCreds.tenantId,
+    issuer: robotCreds.issuer,
+    expiration: getTokenExpiration(robotCreds.accessToken),
+    source: "robot" /* Robot */,
+    ...identity ? { identity } : {}
+  };
+}
+var isFileNotFoundError = (error) => {
+  if (!(error instanceof Object))
+    return false;
+  return error.code === "ENOENT";
+};
+async function circuitBreakerShortCircuit(ctx) {
+  const {
+    absolutePath,
+    refreshToken,
+    accessToken,
+    credentials,
+    expiration,
+    loadBreaker,
+    saveBreaker,
+    clearBreaker
+  } = ctx;
+  const fingerprint = await refreshTokenFingerprint(refreshToken);
+  const breaker = await loadBreaker(absolutePath).catch(() => ({}));
+  if (breaker.deadTokenFp && breaker.deadTokenFp !== fingerprint) {
+    await clearBreaker(absolutePath);
+    breaker.deadTokenFp = undefined;
+  }
+  const nowMs = Date.now();
+  const tokenIsDead = breaker.deadTokenFp === fingerprint;
+  const inBackoff = breaker.backoffUntilMs !== undefined && nowMs < breaker.backoffUntilMs;
+  if (!tokenIsDead && !inBackoff)
+    return;
+  const globalHint = await ctx.globalHint();
+  const suppressed = !shouldSurface(breaker, nowMs);
+  if (!suppressed) {
+    await saveBreaker(absolutePath, {
+      ...breaker,
+      lastSurfacedAtMs: nowMs
+    });
+  }
+  const deadHint = "Run 'uip login' to re-authenticate — the stored refresh token is invalid or expired. In a non-interactive context, authenticate with: uip login --client-id <id> --client-secret <secret> -t <tenant>.";
+  const backoffHint = "Token refresh is temporarily backed off after a recent network error and will retry automatically once the backoff window elapses.";
+  return {
+    loginStatus: globalHint ? "Expired" : "Refresh Failed",
+    ...globalHint ? {
+      accessToken,
+      refreshToken,
+      baseUrl: credentials.UIPATH_URL,
+      organizationName: credentials.UIPATH_ORGANIZATION_NAME,
+      organizationId: credentials.UIPATH_ORGANIZATION_ID,
+      tenantName: credentials.UIPATH_TENANT_NAME,
+      tenantId: credentials.UIPATH_TENANT_ID,
+      expiration,
+      source: "saved-login" /* SavedLogin */,
+      ...identityFields(accessToken, credentials)
+    } : {},
+    hint: globalHint ?? (tokenIsDead ? deadHint : backoffHint),
+    refreshCircuitOpen: true,
+    refreshTelemetrySuppressed: suppressed,
+    tokenRefresh: { attempted: false, success: false }
+  };
+}
+async function lockAcquireFailureStatus(ctx, error) {
+  const msg = errorMessage(error);
+  const globalHint = await ctx.globalHint();
+  if (globalHint) {
+    return {
+      loginStatus: "Expired",
+      accessToken: ctx.accessToken,
+      refreshToken: ctx.refreshToken,
+      baseUrl: ctx.credentials.UIPATH_URL,
+      organizationName: ctx.credentials.UIPATH_ORGANIZATION_NAME,
+      organizationId: ctx.credentials.UIPATH_ORGANIZATION_ID,
+      tenantName: ctx.credentials.UIPATH_TENANT_NAME,
+      tenantId: ctx.credentials.UIPATH_TENANT_ID,
+      expiration: ctx.expiration,
+      source: "saved-login" /* SavedLogin */,
+      ...identityFields(ctx.accessToken, ctx.credentials),
+      hint: globalHint,
+      tokenRefresh: {
+        attempted: false,
+        success: false,
+        errorMessage: `lock acquisition failed: ${msg}`
+      }
+    };
+  }
+  return {
+    loginStatus: "Refresh Failed",
+    hint: "Could not acquire the auth-file lock — too many concurrent `uip` processes, or a permission issue on the auth directory. Retry, or run 'uip login' to re-authenticate.",
+    tokenRefresh: {
+      attempted: false,
+      success: false,
+      errorMessage: `lock acquisition failed: ${msg}`
+    }
+  };
+}
+async function runRefreshLocked(inputs) {
+  const {
+    absolutePath,
+    refreshToken: callerRefreshToken,
+    customAuthority,
+    ensureTokenValidityMinutes,
+    loadEnvFile,
+    saveEnvFile,
+    refreshFn,
+    resolveConfig,
+    loadBreaker,
+    saveBreaker,
+    clearBreaker
+  } = inputs;
+  const expirationThreshold = computeExpirationThreshold(ensureTokenValidityMinutes);
+  let fresh;
+  try {
+    fresh = await loadEnvFile({ envPath: absolutePath });
+  } catch (error) {
+    return {
+      kind: "fail",
+      status: {
+        loginStatus: "Refresh Failed",
+        hint: "Could not read the auth file while refreshing. Retry, or run 'uip login' to re-authenticate.",
+        tokenRefresh: {
+          attempted: false,
+          success: false,
+          errorMessage: `auth file read failed: ${errorMessage(error)}`
+        }
+      }
+    };
+  }
+  const freshAccess = fresh.UIPATH_ACCESS_TOKEN;
+  const freshExp = freshAccess ? getTokenExpiration(freshAccess) : undefined;
+  if (freshAccess && freshExp && freshExp > expirationThreshold) {
+    await clearBreaker(absolutePath);
+    return {
+      kind: "ok",
+      accessToken: freshAccess,
+      refreshToken: fresh.UIPATH_REFRESH_TOKEN ?? callerRefreshToken,
+      expiration: freshExp,
+      tokenRefresh: { attempted: false, success: true }
+    };
+  }
+  const tokenForIdP = fresh.UIPATH_REFRESH_TOKEN ?? callerRefreshToken;
+  let refreshedAccess;
+  let refreshedRefresh;
+  try {
+    const config = await resolveConfig({ customAuthority });
+    const refreshed = await refreshFn({
+      refreshToken: tokenForIdP,
+      tokenEndpoint: config.tokenEndpoint,
+      clientId: config.clientId,
+      expectedAuthority: customAuthority
+    });
+    refreshedAccess = refreshed.accessToken;
+    refreshedRefresh = refreshed.refreshToken;
+  } catch (error) {
+    const isOAuthFailure = isTokenRefreshOAuthFailure(error);
+    const hint = isOAuthFailure ? "Run 'uip login' to re-authenticate — the stored refresh token is invalid or expired. In a non-interactive context, authenticate with: uip login --client-id <id> --client-secret <secret> -t <tenant>." : "Token refresh failed. Check your network connection, then retry or run 'uip login' to re-authenticate.";
+    const message = isOAuthFailure ? normalizeTokenRefreshFailure() : normalizeTokenRefreshUnavailableFailure();
+    const fp = await refreshTokenFingerprint(tokenForIdP);
+    if (isOAuthFailure) {
+      await saveBreaker(absolutePath, { deadTokenFp: fp });
+    } else {
+      const prior = await loadBreaker(absolutePath).catch(() => ({}));
+      const attempts = (prior.attempts ?? 0) + 1;
+      await saveBreaker(absolutePath, {
+        ...prior,
+        deadTokenFp: undefined,
+        attempts,
+        backoffUntilMs: Date.now() + nextBackoffMs(attempts)
+      });
+    }
+    return {
+      kind: "fail",
+      status: {
+        loginStatus: "Refresh Failed",
+        hint,
+        tokenRefresh: {
+          attempted: true,
+          success: false,
+          errorMessage: message
+        }
+      }
+    };
+  }
+  const refreshedExp = getTokenExpiration(refreshedAccess);
+  if (!refreshedExp || refreshedExp <= new Date) {
+    return {
+      kind: "fail",
+      status: {
+        loginStatus: "Refresh Failed",
+        hint: "The identity server returned an unusable token. Run 'uip login' to re-authenticate.",
+        tokenRefresh: {
+          attempted: true,
+          success: false,
+          errorMessage: "refreshed token has no valid expiration claim"
+        }
+      }
+    };
+  }
+  await clearBreaker(absolutePath);
+  try {
+    await saveEnvFile({
+      envPath: absolutePath,
+      data: {
+        UIPATH_ACCESS_TOKEN: refreshedAccess,
+        UIPATH_REFRESH_TOKEN: refreshedRefresh
+      },
+      merge: true
+    });
+    return {
+      kind: "ok",
+      accessToken: refreshedAccess,
+      refreshToken: refreshedRefresh,
+      expiration: refreshedExp,
+      tokenRefresh: { attempted: true, success: true }
+    };
+  } catch (error) {
+    const msg = errorMessage(error);
+    return {
+      kind: "ok",
+      accessToken: refreshedAccess,
+      refreshToken: refreshedRefresh,
+      expiration: refreshedExp,
+      persistenceWarning: `Access token refreshed in memory but could not be written to ${absolutePath}: ${msg}. The next CLI invocation will fail until the file can be updated — run 'uip login' to re-authenticate.`,
+      tokenRefresh: {
+        attempted: true,
+        success: true,
+        errorMessage: `persistence failed: ${msg}`
+      }
+    };
+  }
+}
+function normalizeTokenRefreshFailure() {
+  return "stored refresh token is invalid or expired";
+}
+function normalizeTokenRefreshUnavailableFailure() {
+  return "token refresh failed before authentication completed";
+}
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+// ../auth/src/authContext.ts
+var getAuthContext = async (options = {}) => {
+  const status = await getLoginStatusAsync({
+    ensureTokenValidityMinutes: options.ensureTokenValidityMinutes,
+    envFilePath: options.envFilePath
+  });
+  if (status.loginStatus !== "Logged in" || !status.baseUrl || !status.accessToken) {
+    throw new Error(status.hint ? `Not logged in. ${status.hint}` : "Not logged in. Run 'uip login' first.");
+  }
+  const tenantName = options.tenant ?? status.tenantName;
+  if (options.requireOrganizationId && !status.organizationId) {
+    throw new Error("Organization ID not available. Ensure you are logged in with an organization context.");
+  }
+  if (options.requireOrganizationName && !status.organizationName) {
+    throw new Error("Organization name not available. Ensure you are logged in with an organization context.");
+  }
+  if (options.requireTenantId && !status.tenantId) {
+    throw new Error("Tenant ID not available. Ensure UIPATH_TENANT_ID is set.");
+  }
+  if (options.requireTenantName && tenantName === undefined) {
+    throw new Error("Tenant not provided and UIPATH_TENANT_NAME not set. Run 'uip login' to select a tenant, or use 'uip login tenant set <tenant>' to switch tenants.");
+  }
+  return {
+    baseUrl: status.baseUrl,
+    accessToken: status.accessToken,
+    organizationId: status.organizationId,
+    organizationName: status.organizationName,
+    tenantId: status.tenantId,
+    tenantName
+  };
+};
+var getAuthEnv = async (options = {}) => {
+  const authEnv = {};
+  let status;
+  try {
+    status = await getLoginStatusAsync(options);
+  } catch {
+    return { authEnv };
+  }
+  if (status.loginStatus === "Logged in" && status.accessToken) {
+    authEnv.UIPATH_ACCESS_TOKEN = status.accessToken;
+    if (status.baseUrl) {
+      const org = status.organizationName || status.organizationId;
+      const tenant = status.tenantName || status.tenantId;
+      if (org && tenant) {
+        authEnv.UIPATH_URL = `${status.baseUrl.replace(/\/+$/, "")}/${org}/${tenant}`;
+      }
+    }
+    if (status.organizationId)
+      authEnv.UIPATH_ORGANIZATION_ID = status.organizationId;
+    if (status.organizationName)
+      authEnv.UIPATH_ORGANIZATION_NAME = status.organizationName;
+    if (status.tenantId)
+      authEnv.UIPATH_TENANT_ID = status.tenantId;
+    if (status.tenantName)
+      authEnv.UIPATH_TENANT_NAME = status.tenantName;
+  }
+  return { authEnv, loginStatus: status };
+};
+// ../auth/src/tokenGrant.ts
+var requestClientCredentialsToken = async ({
+  tokenEndpoint,
+  baseUrl,
+  params,
+  buildError
+}) => {
+  const tokenResponse = await fetch(tokenEndpoint, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded"
+    },
+    body: new URLSearchParams(params)
+  });
+  const [parseError, tokenData] = await catchError(tokenResponse.json());
+  if (!tokenResponse.ok) {
+    const data = parseError ? {} : tokenData ?? {};
+    throw buildError({
+      status: tokenResponse.status,
+      errorType: data.error || "authentication_failed",
+      errorDesc: data.error_description || "Unknown error"
+    });
+  }
+  if (parseError || !tokenData) {
+    throw buildError({
+      status: tokenResponse.status,
+      errorType: "invalid_response",
+      errorDesc: "Token endpoint returned a non-JSON response."
+    });
+  }
+  if (!tokenData.access_token) {
+    throw buildError({
+      status: tokenResponse.status,
+      errorType: "invalid_response",
+      errorDesc: "Token endpoint response did not include an access_token."
+    });
+  }
+  return {
+    UIPATH_ACCESS_TOKEN: tokenData.access_token,
+    UIPATH_URL: baseUrl
+  };
+};
+
+// ../auth/src/clientCredentials.ts
+class ClientCredentialsAuthenticationError extends Error {
+  status;
+  constructor(message, status) {
+    super(message);
+    this.name = "ClientCredentialsAuthenticationError";
+    this.status = status;
+  }
+}
+var buildClientCredentialsError = ({
+  status,
+  errorType,
+  errorDesc
+}) => {
+  let troubleshooting = "";
+  if (errorType === "invalid_client" || status === 401) {
+    troubleshooting = `
+
+Troubleshooting:` + `
+  • Verify your Client ID is correct` + `
+  • Ensure your Client Secret hasn't expired` + `
+  • Check that the external application is enabled in UiPath` + `
+  • Confirm you're using the correct authority URL`;
+  } else if (errorType === "invalid_scope") {
+    troubleshooting = `
+
+Troubleshooting:` + `
+  • The requested scopes may not be available for your account` + `
+  • Try using default scopes or contact your UiPath administrator`;
+  }
+  return new ClientCredentialsAuthenticationError(`Client Credentials authentication failed (${status})
+` + `Error: ${errorType}
+` + `Details: ${errorDesc}${troubleshooting}`, status);
+};
+var clientCredentialsLogin = async ({
+  clientId,
+  clientSecret,
+  scope,
+  authority
+}) => {
+  const config = await resolveConfigAsync({
+    customAuthority: authority,
+    customClientId: clientId,
+    customClientSecret: clientSecret,
+    customScopes: scope
+  });
+  const params = {
+    grant_type: "client_credentials",
+    client_id: config.clientId,
+    client_secret: config.clientSecret ?? ""
+  };
+  if (config.scopes.length > 0) {
+    params.scope = config.scopes.join(" ");
+  }
+  return await requestClientCredentialsToken({
+    tokenEndpoint: config.tokenEndpoint,
+    baseUrl: config.baseUrl,
+    params,
+    buildError: buildClientCredentialsError
+  });
+};
+// ../auth/src/federatedCredentials.ts
+var JWT_BEARER_ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
+
+class FederatedCredentialsAuthenticationError extends Error {
+  status;
+  constructor(message, status) {
+    super(message);
+    this.name = "FederatedCredentialsAuthenticationError";
+    this.status = status;
+  }
+}
+var buildFederatedError = ({
+  status,
+  errorType,
+  errorDesc
+}) => {
+  let troubleshooting = "";
+  if (errorType === "invalid_client" || errorType === "invalid_grant" || errorType === "invalid_request" || status === 401) {
+    troubleshooting = `
+
+Troubleshooting:` + `
+  • Verify your Client ID matches the external application` + `
+  • Confirm a federated credential is registered on the app whose` + `
+    issuer, audience, and subject exactly match the token's claims` + `
+    (list them: uip admin external-apps federated-credentials list <client-id>)` + `
+  • Check the token was issued by the expected provider and has not expired` + `
+  • Confirm you're using the correct authority URL`;
+  } else if (errorType === "invalid_scope") {
+    troubleshooting = `
+
+Troubleshooting:` + `
+  • The requested scopes may not be available for your application` + `
+  • Try using default scopes or contact your UiPath administrator`;
+  }
+  return new FederatedCredentialsAuthenticationError(`Federated Credentials authentication failed (${status})
+` + `Error: ${errorType}
+` + `Details: ${errorDesc}${troubleshooting}`, status);
+};
+var federatedCredentialsLogin = async ({
+  clientId,
+  clientAssertion,
+  scope,
+  authority
+}) => {
+  const config = await resolveConfigAsync({
+    customAuthority: authority,
+    customClientId: clientId,
+    customClientAssertion: clientAssertion,
+    customScopes: scope
+  });
+  const params = {
+    grant_type: "client_credentials",
+    client_id: config.clientId,
+    client_assertion: clientAssertion,
+    client_assertion_type: JWT_BEARER_ASSERTION_TYPE
+  };
+  if (config.scopes.length > 0) {
+    params.scope = config.scopes.join(" ");
+  }
+  return await requestClientCredentialsToken({
+    tokenEndpoint: config.tokenEndpoint,
+    baseUrl: config.baseUrl,
+    params,
+    buildError: buildFederatedError
+  });
+};
+// ../auth/src/tenantSelection.ts
+var LOGIN_STATUS_HINT = "Run 'uip login status' to see the organization the CLI is signed in to.";
+var organizationHint = (organizationId) => `The request used '${organizationId}' as the organization. ${LOGIN_STATUS_HINT}`;
+var IDENTIFIER_STATUSES = new Set([400, 403, 404]);
+var describeNonJsonResponse = (organizationId, response, parseError) => {
+  if (response.redirected) {
+    return `Could not find organization '${organizationId}': the request was ` + `redirected to a sign-in page instead of the organization's tenant ` + `list. ${LOGIN_STATUS_HINT}`;
+  }
+  const contentType = response.headers.get("content-type") ?? "unknown";
+  return `The organization service returned a '${contentType}' response instead ` + `of JSON: ${parseError.message}. ${organizationHint(organizationId)}`;
+};
+var fetchTenantsAndOrganizations = async (baseUrl, accessToken, organizationId) => {
+  const url = `${baseUrl}/${organizationId}/portal_/api/filtering/leftnav/tenantsAndOrganizationInfo`;
+  const response = await fetch(url, {
+    headers: {
+      Authorization: `Bearer ${accessToken}`
+    }
+  });
+  if (!response.ok) {
+    if (response.status === 401) {
+      throw new Error(`Unauthorized: the access token was rejected, it was not ` + `issued for organization '${organizationId}', or ` + `'${organizationId}' was not accepted as an organization ` + `URL segment in this environment. ` + LOGIN_STATUS_HINT);
+    }
+    const errorText = await response.text();
+    const message = `Failed to get tenants and organizations: ${response.status} ${errorText}`;
+    throw new Error(IDENTIFIER_STATUSES.has(response.status) ? `${message}. ${organizationHint(organizationId)}` : message);
+  }
+  const [parseError, data] = await catchError(response.json());
+  if (parseError) {
+    throw new Error(describeNonJsonResponse(organizationId, response, parseError));
+  }
+  return data;
+};
+
+// ../auth/src/selectTenant.ts
+var TENANT_SELECTION_REQUIRED_CODE = "TENANT_SELECTION_REQUIRED";
+var INVALID_TENANT_CODE = "INVALID_TENANT";
+
+class TenantSelectionError extends Error {
+  availableTenants;
+  organizationName;
+  constructor(message, organizationName, availableTenants) {
+    super(message);
+    this.organizationName = organizationName;
+    this.availableTenants = availableTenants;
+  }
+}
+
+class TenantSelectionRequiredError extends TenantSelectionError {
+  code = TENANT_SELECTION_REQUIRED_CODE;
+  constructor(organizationName, availableTenants) {
+    super(`Multiple tenants available in organization "${organizationName}"; none selected.`, organizationName, availableTenants);
+    this.name = "TenantSelectionRequiredError";
+  }
+}
+
+class InvalidTenantError extends TenantSelectionError {
+  code = INVALID_TENANT_CODE;
+  requestedTenant;
+  constructor(requestedTenant, organizationName, availableTenants) {
+    super(`Invalid tenant requested: "${requestedTenant}"
+` + `Organization: ${organizationName}
+` + `Available tenants: ${availableTenants.join(", ")}`, organizationName, availableTenants);
+    this.name = "InvalidTenantError";
+    this.requestedTenant = requestedTenant;
+  }
+}
+var TENANT_SELECTION_CODES = new Set([
+  TENANT_SELECTION_REQUIRED_CODE,
+  INVALID_TENANT_CODE
+]);
+function isTenantSelectionError(error) {
+  if (!(error instanceof Object) || !("code" in error)) {
+    return false;
+  }
+  const code = error.code;
+  return typeof code === "string" && TENANT_SELECTION_CODES.has(code) && Array.isArray(error.availableTenants);
+}
+var selectTenantWithDeps = async (baseUrl, accessToken, organizationId, targetTenantName, interactive, deps = {}) => {
+  const {
+    fetchTenantsAndOrgs = fetchTenantsAndOrganizations,
+    selectFromList
+  } = deps;
+  const data = await fetchTenantsAndOrgs(baseUrl, accessToken, organizationId);
+  const { tenants, organization } = data;
+  if (!tenants || tenants.length === 0) {
+    throw new Error("No tenants found for this organization");
+  }
+  const tenantNames = tenants.map((tenant) => tenant.name);
+  let selectedIndex;
+  if (targetTenantName !== undefined) {
+    selectedIndex = tenants.findIndex((tenant) => tenant.name === targetTenantName);
+    if (selectedIndex === -1) {
+      throw new InvalidTenantError(targetTenantName, organization.name, tenantNames);
+    }
+  } else if (tenants.length === 1) {
+    selectedIndex = 0;
+  } else if (interactive) {
+    if (!selectFromList) {
+      throw new Error("Interactive tenant selection requires a `selectFromList` callback. " + "Pass one via the `deps` argument of `selectTenantWithDeps`.");
+    }
+    selectedIndex = await selectFromList(tenantNames, "Select a tenant:");
+  } else {
+    throw new TenantSelectionRequiredError(organization.name, tenantNames);
+  }
+  const selectedTenant = tenants[selectedIndex];
+  return [selectedTenant.name, selectedTenant.id, organization.name];
+};
+
+// ../auth/src/interactive.ts
+var interactiveLoginWithDeps = async (options, deps) => {
+  const {
+    resolveConfig = resolveConfigAsync,
+    clientCredentials = clientCredentialsLogin,
+    federatedCredentials = federatedCredentialsLogin,
+    auth = authenticate,
+    saveEnvFile = saveEnvFileAsync,
+    loadEnvFile = loadEnvFileAsync,
+    getFs = getFileSystem,
+    jwtParser = parseJWT,
+    issuerAsserter = assertIssuerMatchesAuthority,
+    tenantSelector = (baseUrl, accessToken, organizationId, tenantName, interactive2) => selectTenantWithDeps(baseUrl, accessToken, organizationId, tenantName, interactive2, { selectFromList: options.selectFromList })
+  } = deps;
+  const {
+    envFilePath,
+    scope,
+    authority,
+    clientId,
+    clientSecret,
+    clientAssertion,
+    tenant,
+    organization,
+    interactive,
+    onEvent,
+    timeoutMs,
+    noBrowser,
+    signal
+  } = options;
+  const emit = (event) => {
+    if (!onEvent)
+      return;
+    try {
+      onEvent(event);
+    } catch {}
+  };
+  const deliverAuthUrl = (url) => {
+    try {
+      onEvent?.({ type: "auth-url", url });
+    } catch (error) {
+      throw new Error("Failed to deliver the authorize URL to the onEvent subscriber; " + "cannot continue headless login.", { cause: error });
+    }
+  };
+  const config = await resolveConfig({
+    customAuthority: authority,
+    customClientId: clientId,
+    customClientSecret: clientSecret,
+    customClientAssertion: clientAssertion
+  });
+  const { clientSecret: resolvedSecret } = config;
+  if (noBrowser && !resolvedSecret && !clientAssertion && !onEvent) {
+    throw new Error("noBrowser login requires an onEvent subscriber to receive the " + "auth-url event — the authorize URL is delivered through it.");
+  }
+  const authFlow = clientAssertion ? "federated_credentials" : resolvedSecret ? "client_credentials" : "authorization_code";
+  const authPromise = clientAssertion ? (async () => {
+    return await federatedCredentials({
+      clientId: config.clientId,
+      clientAssertion,
+      authority: config.baseUrl,
+      scope
+    });
+  })() : resolvedSecret ? (async () => {
+    return await clientCredentials({
+      clientId: config.clientId,
+      clientSecret: resolvedSecret,
+      authority: config.baseUrl,
+      scope
+    });
+  })() : (async () => {
+    const authTokens = await auth({
+      baseUrl: authority,
+      clientId,
+      clientSecret,
+      scope,
+      organization,
+      timeoutMs,
+      noBrowser,
+      signal,
+      onAuthUrl: noBrowser ? (url) => deliverAuthUrl(url) : undefined,
+      onPortReclaimed: ({ pid }) => emit({
+        type: "port-reclaimed",
+        message: `A previous 'uip login'${pid === undefined ? "" : ` (PID ${pid})`} was still holding the callback port ` + `(${new URL(DEFAULT_REDIRECT_URI).port}) and was released; continuing with this login.`
+      })
+    });
+    return {
+      UIPATH_ACCESS_TOKEN: authTokens.accessToken,
+      UIPATH_REFRESH_TOKEN: authTokens.refreshToken
+    };
+  })();
+  const [authError, tokens] = await catchError(authPromise);
+  if (authError) {
+    throw authError;
+  }
+  issuerAsserter(tokens.UIPATH_ACCESS_TOKEN, config.baseUrl);
+  const credentials = {
+    ...tokens,
+    UIPATH_URL: config.baseUrl,
+    [AUTH_FLOW_ENV_VAR]: authFlow
+  };
+  if (authFlow !== "authorization_code") {
+    credentials.UIPATH_REFRESH_TOKEN = undefined;
+  }
+  try {
+    const tokenData = jwtParser(tokens.UIPATH_ACCESS_TOKEN);
+    const orgId = tokenData.prtId || tokenData.organizationId || tokenData.prt_id;
+    if (typeof orgId !== "string" || orgId.length === 0) {
+      throw new Error("Organization ID not available from login token. Cannot establish an active tenant.");
+    }
+    credentials.UIPATH_ORGANIZATION_ID = orgId;
+    if (organization) {
+      credentials.UIPATH_ORGANIZATION_NAME = organization;
+    }
+    const [tenantName, tenantId, orgName] = await tenantSelector(config.baseUrl, tokens.UIPATH_ACCESS_TOKEN, orgId, tenant, interactive);
+    credentials.UIPATH_ORGANIZATION_NAME = orgName;
+    credentials.UIPATH_TENANT_NAME = tenantName;
+    credentials.UIPATH_TENANT_ID = tenantId;
+  } catch (error) {
+    if (!isTenantSelectionError(error)) {
+      emit({
+        type: "tenant-fetch-failed",
+        message: error instanceof Error ? error.message : String(error)
+      });
+    }
+    throw error;
+  }
+  const fs = getFs();
+  const requestedPath = envFilePath ?? DEFAULT_ENV_FILENAME;
+  let savePath = requestedPath;
+  let savedLocally = false;
+  if (!fs.path.isAbsolute(savePath)) {
+    let searchDir = fs.env.cwd();
+    while (true) {
+      const candidate = fs.path.join(searchDir, savePath);
+      if (await fs.exists(candidate)) {
+        try {
+          const existing = await loadEnvFile({
+            envPath: candidate
+          });
+          if (existing.UIPATH_ACCESS_TOKEN) {
+            savePath = candidate;
+            savedLocally = true;
+            break;
+          }
+        } catch {}
+      }
+      const parentDir = fs.path.dirname(searchDir);
+      if (parentDir === searchDir) {
+        break;
+      }
+      searchDir = parentDir;
+    }
+  }
+  let saveRelease;
+  try {
+    if (typeof fs.acquireLock === "function") {
+      saveRelease = await fs.acquireLock(savePath);
+    }
+  } catch {
+    saveRelease = undefined;
+  }
+  try {
+    await saveEnvFile({
+      envPath: savePath,
+      data: credentials,
+      merge: true
+    });
+  } finally {
+    if (saveRelease) {
+      await saveRelease().catch(() => {});
+    }
+  }
+  const reportedPath = fs.path.isAbsolute(savePath) ? savePath : fs.path.join(fs.env.homedir(), savePath);
+  emit({
+    type: "saved",
+    path: reportedPath,
+    locality: savedLocally ? "local" : "global"
+  });
+  return credentials;
+};
+var interactiveLogin = async (options) => {
+  return interactiveLoginWithDeps(options, {});
+};
+// ../auth/src/logout.ts
+async function logoutWithDeps(options, deps = {}) {
+  const {
+    resolveEnvFilePath = resolveEnvFilePathAsync,
+    getFileSystem: getFs = getFileSystem,
+    clearBreaker = clearRefreshBreaker,
+    getActiveProfileFilePath = getActiveAuthProfileFilePath
+  } = deps;
+  const fs = getFs();
+  const { absolutePath } = await resolveEnvFilePath(options.file ?? getActiveProfileFilePath());
+  if (absolutePath && await fs.exists(absolutePath)) {
+    let release;
+    try {
+      if (typeof fs.acquireLock === "function") {
+        release = await fs.acquireLock(absolutePath);
+      }
+    } catch {
+      release = undefined;
+    }
+    try {
+      await fs.rm(absolutePath);
+      await clearBreaker(absolutePath);
+    } finally {
+      if (release) {
+        await release().catch(() => {});
+      }
+    }
+    return {
+      success: true,
+      message: `Logged out successfully. Removed ${absolutePath}`,
+      removedPath: absolutePath
+    };
+  }
+  return {
+    success: false,
+    message: "No credentials file found. You are already logged out.",
+    reason: "no_credentials_file"
+  };
+}
+async function logout(options) {
+  return logoutWithDeps(options);
+}
+
+// ../auth/src/index.ts
+var authenticate = async ({
+  baseUrl,
+  clientId,
+  clientSecret,
+  redirectUri,
+  scope,
+  organization,
+  timeoutMs,
+  noBrowser,
+  onAuthUrl,
+  signal,
+  onPortReclaimed
+}) => {
+  const config = await resolveConfigAsync({
+    customAuthority: baseUrl,
+    customClientId: clientId,
+    customClientSecret: clientSecret,
+    customScopes: scope
+  });
+  const {
+    authorizationEndpoint,
+    tokenEndpoint,
+    clientId: resolvedClientId,
+    clientSecret: resolvedClientSecret,
+    scopes: resolvedScopes
+  } = config;
+  const { code_challenge, code_verifier, state } = await getOidcParams();
+  let effectiveRedirectUri;
+  if (redirectUri) {
+    effectiveRedirectUri = redirectUri.toString();
+  } else if (isBrowser()) {
+    const origin = getGlobalThis()?.window?.location?.origin ?? "";
+    effectiveRedirectUri = `${origin}/oidc/login`;
+  } else {
+    effectiveRedirectUri = DEFAULT_REDIRECT_URI;
+  }
+  const effectiveRedirectUriUrl = new URL(effectiveRedirectUri);
+  const authParams = new URLSearchParams({
+    client_id: resolvedClientId,
+    redirect_uri: effectiveRedirectUriUrl.toString(),
+    response_type: "code",
+    scope: resolvedScopes.join(" "),
+    code_challenge,
+    code_challenge_method: "S256",
+    state
+  });
+  if (organization) {
+    if (/[\s:]/.test(organization)) {
+      throw new Error(`Invalid organization name: "${organization}". Whitespace and colons are not allowed; use the organization's logical name (e.g. "my-org").`);
+    }
+    authParams.set("acr_values", `tenantName:${organization}`);
+  }
+  const authUrl = `${authorizationEndpoint}?${authParams.toString()}`;
+  let strategy;
+  if (isBrowser()) {
+    const { BrowserAuthStrategy } = await import("./browser-strategy-6atc7v8s.js");
+    strategy = new BrowserAuthStrategy;
+  } else {
+    const { NodeAuthStrategy } = await import("./node-strategy-gc4sg6a2.js");
+    strategy = new NodeAuthStrategy;
+  }
+  const code = await strategy.execute(authUrl, effectiveRedirectUriUrl, state, {
+    timeoutMs,
+    noBrowser,
+    onAuthUrl,
+    signal,
+    onPortReclaimed
+  });
+  return await exchangeCodeForTokens({
+    code,
+    codeVerifier: code_verifier,
+    redirectUri: effectiveRedirectUriUrl,
+    clientId: resolvedClientId,
+    clientSecret: resolvedClientSecret,
+    tokenEndpoint
+  });
+};
+
+export { setAuthFileConfig, InvalidBaseUrlError, DEFAULT_AUTH_PROFILE, AuthProfileValidationError, normalizeAuthProfileName, setActiveAuthProfile, clearActiveAuthProfile, getActiveAuthProfile, runWithAuthProfile, resolveAuthProfileFilePath, getActiveAuthProfileFilePath, parseJWT, parseAuthFlow, resolveSessionIdentity, ENV_AUTH_ENABLE_VAR, ENFORCE_ROBOT_AUTH_VAR, ENV_AUTH_VARS, EnvAuthConfigError, isEnvAuthEnabled, isRobotAuthEnforced, readAuthFromEnv, refreshTokenFingerprint, loadRefreshBreaker, saveRefreshBreaker, clearRefreshBreaker, registerRobotClientLoader, TokenRefreshOAuthError, isTokenRefreshOAuthFailure, refreshAccessToken, AUTH_FLOW_ENV_VAR, DEFAULT_AUTH_FILENAME, DEFAULT_ENV_FILENAME, resolveEnvFileLocationAsync, resolveEnvFilePathAsync, loadEnvFileAsync, saveEnvFileAsync, CredentialSource, getLoginStatusAsync, getLoginStatusWithDeps, getAuthContext, getAuthEnv, ClientCredentialsAuthenticationError, clientCredentialsLogin, JWT_BEARER_ASSERTION_TYPE, FederatedCredentialsAuthenticationError, federatedCredentialsLogin, fetchTenantsAndOrganizations, TENANT_SELECTION_REQUIRED_CODE, INVALID_TENANT_CODE, TenantSelectionError, TenantSelectionRequiredError, InvalidTenantError, isTenantSelectionError, selectTenantWithDeps, interactiveLoginWithDeps, interactiveLogin, logoutWithDeps, logout, authenticate };
+
+//# debugId=E193A5CF0DF55D1D64756E2164756E21