@uipath/gov-tool 1.201.0-preview.115 → 1.201.0-preview.121

package/dist/tool.js

@@ -8166,7 +8166,7 @@ var init_dist = __esm(() => {
 var package_default = {
   name: "@uipath/gov-tool",
   license: "MIT",
-  version: "1.201.0-preview.115",
+  version: "1.201.0-preview.121",
   description: "Manage UiPath governance — AOps policies, Access policies, and compliance packs.",
   private: false,
   repository: {
@@ -10462,6 +10462,8 @@ init_constants();
 
 // ../../auth/src/interactive.ts
 init_src();
+// ../../auth/src/tenantSelection.ts
+var IDENTIFIER_STATUSES = new Set([400, 403, 404]);
 
 // ../../auth/src/selectTenant.ts
 var TENANT_SELECTION_REQUIRED_CODE = "TENANT_SELECTION_REQUIRED";
@@ -10571,17 +10573,18 @@ var TLS_ERROR_CODES = new Set([
 ]);
 var TLS_INSTRUCTIONS = "The server's TLS certificate could not be verified. Most often a " + "corporate proxy/firewall re-signs HTTPS with a root CA that Node does " + "not trust — set NODE_EXTRA_CA_CERTS to that CA's PEM file (and HTTPS_PROXY " + "if you connect through a proxy). If the certificate is instead expired or " + "its hostname does not match, fix the endpoint URL or the system clock. " + "Then retry.";
 var NETWORK_INSTRUCTIONS = "Could not reach the UiPath service. Check your network connection and " + "VPN, confirm any HTTP_PROXY/HTTPS_PROXY/NO_PROXY settings are correct, " + "then retry.";
+var LOCAL_PERMISSION_ERROR_CODES = new Set(["EACCES", "EPERM", "EROFS"]);
+var LOCAL_PERMISSION_MESSAGE_PATTERN = /\b(EACCES|EPERM|EROFS)\b/;
+function localPermissionInstructions(code, path3) {
+  const target = path3 !== undefined ? `'${path3}'` : "a local file or resource";
+  if (code === "EROFS") {
+    return `The filesystem containing ${target} is read-only (EROFS), so the ` + "CLI could not write to it. This is a local environment problem, " + "not a UiPath service error — retrying will not help. Use a " + "writable location, or give this environment write access to the " + "path.";
+  }
+  const remedy = process.platform === "win32" ? "Re-run from an elevated terminal, close any program holding " + "the file open, or grant your user access to the path." : "Grant this user (or the sandbox the command runs in) access " + "to the path, or run the command outside the sandbox.";
+  return `The operating system denied access to ${target} (${code}). This is ` + "a local permission problem, not a UiPath service error — retrying " + `without a permission change will not help. ${remedy}`;
+}
 function describeConnectivityError(error) {
-  const queue = [error];
-  const seen = new Set;
-  for (let steps = 0;queue.length > 0 && steps < 32; steps++) {
-    const current = queue.shift();
-    if (current === null || typeof current !== "object")
-      continue;
-    if (seen.has(current))
-      continue;
-    seen.add(current);
-    const cur = current;
+  for (const cur of walkErrorGraph(error)) {
     const code = typeof cur.code === "string" ? cur.code : undefined;
     const message = typeof cur.message === "string" ? cur.message : undefined;
     if (code && TLS_ERROR_CODES.has(code)) {
@@ -10600,6 +10603,49 @@ function describeConnectivityError(error) {
         instructions: NETWORK_INSTRUCTIONS
       };
     }
+  }
+  return;
+}
+function describePermissionError(error) {
+  for (const cur of walkErrorGraph(error)) {
+    const message = typeof cur.message === "string" ? cur.message : undefined;
+    const code = matchLocalPermissionCode(cur.code, message);
+    if (!code)
+      continue;
+    const path3 = localPermissionPath(cur.path, message);
+    return {
+      code,
+      message: message ?? code,
+      ...path3 !== undefined ? { path: path3 } : {},
+      instructions: localPermissionInstructions(code, path3)
+    };
+  }
+  return;
+}
+function matchLocalPermissionCode(code, message) {
+  if (typeof code === "string" && LOCAL_PERMISSION_ERROR_CODES.has(code)) {
+    return code;
+  }
+  const match = message ? LOCAL_PERMISSION_MESSAGE_PATTERN.exec(message) : null;
+  return match ? match[1] : undefined;
+}
+function localPermissionPath(path3, message) {
+  if (typeof path3 === "string")
+    return path3;
+  return message ? /'([^']+)'/.exec(message)?.[1] : undefined;
+}
+function* walkErrorGraph(error) {
+  const queue = [error];
+  const seen = new Set;
+  for (let steps = 0;queue.length > 0 && steps < 32; steps++) {
+    const current = queue.shift();
+    if (current === null || typeof current !== "object")
+      continue;
+    if (seen.has(current))
+      continue;
+    seen.add(current);
+    const cur = current;
+    yield cur;
     if (cur.cause !== undefined)
       queue.push(cur.cause);
     if (Array.isArray(cur.errors))
@@ -10660,6 +10706,12 @@ function classifyError(status, error) {
   if (status !== undefined && status >= 500 && status < 600) {
     return { errorCode: "server_error", retry: "RetryLater" };
   }
+  if (status === undefined && describePermissionError(error)) {
+    return {
+      errorCode: "local_permission_denied",
+      retry: "RetryWillNotFix"
+    };
+  }
   const connectivity = describeConnectivityError(error);
   if (connectivity) {
     return {
@@ -10762,6 +10814,16 @@ async function extractErrorDetails(error, options) {
       message = `${message}: ${connectivity.message}`;
     }
   }
+  const permission = status === undefined ? describePermissionError(error) : undefined;
+  if (permission) {
+    if (permission.message !== message && !message.includes(permission.message)) {
+      message = `${message}: ${permission.message}`;
+    }
+    if (!message.includes(permission.instructions)) {
+      const punctuated = message.endsWith(".") ? message : `${message}.`;
+      message = `${punctuated} ${permission.instructions}`;
+    }
+  }
   let details = rawMessage;
   if (rawBody) {
     if (parsedBody) {
@@ -10801,6 +10863,9 @@ async function extractErrorDetails(error, options) {
   if (parsedBody?.traceId && typeof parsedBody.traceId === "string") {
     context.traceId = parsedBody.traceId;
   }
+  if (permission?.path !== undefined) {
+    context.path = permission.path;
+  }
   if (status === 429) {
     const resp = response;
     const headersObj = resp?.headers;
@@ -12005,6 +12070,7 @@ var CLI_ERROR_CODES = [
   "invalid_argument",
   "authentication_required",
   "permission_denied",
+  "local_permission_denied",
   "not_found",
   "rate_limited",
   "network_error",
@@ -12440,12 +12506,16 @@ function defaultErrorCodeForHttpStatus(status) {
     return "server_error";
   return;
 }
+var LOCAL_PERMISSION_TEXT_PATTERN = /(?:\b|\()(?:EACCES|EPERM|EROFS)(?::\s|\))/;
 function defaultErrorCodeForFailure(data) {
   if (data.Result === RESULTS.Failure) {
     const status = data.Context?.httpStatus ?? parseHttpStatusFromMessage2(data.Message);
     const errorCode2 = defaultErrorCodeForHttpStatus(status);
     if (errorCode2)
       return errorCode2;
+    if (status === undefined && (LOCAL_PERMISSION_TEXT_PATTERN.test(data.Message) || LOCAL_PERMISSION_TEXT_PATTERN.test(data.Instructions))) {
+      return "local_permission_denied";
+    }
   }
   return defaultErrorCodeForResult(data.Result);
 }
@@ -12947,11 +13017,10 @@ var ScreenLogger;
   }
   ScreenLogger.progress = progress;
 })(ScreenLogger ||= {});
-// ../../common/src/tool-provider.ts
-var factorySlot = singleton("PackagerFactoryProvider");
-var moduleSlot = singleton("ToolModuleProvider");
 // ../../common/src/telemetry/ship-succeeded.ts
 var shippedKeysSlot = singleton("ShipSucceededDedupeKeys");
+// ../../common/src/tool-provider.ts
+var factorySlot = singleton("PackagerFactoryProvider");
 // src/commands/access-policy/policy.ts
 init_src();
 var RESOURCE_TYPES = Object.values(PolicyResourceType);
@@ -17138,6 +17207,12 @@ var registerDeploymentTenantCommands = (deployment) => {
     "modifies the tenant's assignments between the read and the save, their change will be lost.",
     "Avoid running concurrently against the same tenant.",
     "",
+    "Cannot clear the LAST assignment: the governance service treats a save of an empty",
+    "assignment list as a no-op, so the entries would survive while the call reported success.",
+    "This command refuses that case instead. To stop a policy applying when it is the only",
+    "assignment left, pin 'No Policy' with `deployment tenant configure` and",
+    '"policyIdentifier": null.',
+    "",
     "Output includes both the removed entries and the new tenantPolicies snapshot so you can audit the change."
   ].join(`
 `)).argument("<tenantIdentifier>", "Tenant GUID. From `deployment tenant list`.").requiredOption("--product-name <product-name>", "Product to unpin (e.g. StudioX). Matches the `productIdentifier` field on the tenant's saved entries.").option("--license-type <license-type>", "Narrow the removal to one license type. Omit to remove every license-type entry for the product.").option("--login-validity <minutes>", "Override the interactive-login token lifetime for this call. Rarely needed.", (v) => Number.parseInt(v, 10)).examples(REMOVE_EXAMPLES).trackedAction(processContext, async (tenantIdentifier, options) => {
@@ -17168,6 +17243,9 @@ var registerDeploymentTenantCommands = (deployment) => {
       if (removed.length === 0) {
         throw new Error("No matching policy assignment to remove.");
       }
+      if (kept.length === 0) {
+        throw new Error("Removing every remaining assignment is not supported by the governance service: " + "saving an empty assignment list is a no-op, so the tenant would keep them. " + "Pin 'No Policy' instead with `deployment tenant configure`, passing the entry " + 'with "policyIdentifier": null.');
+      }
       const savedRaw = await tenantApi.tenantSaveTenantPoliciesRaw({
         tenantPolicyDto: kept
       });
@@ -23509,6 +23587,7 @@ function errorMessage2(error) {
 }
 init_constants2();
 init_src2();
+var IDENTIFIER_STATUSES2 = new Set([400, 403, 404]);
 var TENANT_SELECTION_REQUIRED_CODE2 = "TENANT_SELECTION_REQUIRED";
 var INVALID_TENANT_CODE2 = "INVALID_TENANT";
 var TENANT_SELECTION_CODES2 = new Set([
@@ -23999,4 +24078,4 @@ export {
   metadata
 };
 
-//# debugId=2998D3F7C8475D0564756E2164756E21
+//# debugId=12A1BE759A55E4B164756E2164756E21

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@uipath/gov-tool",
   "license": "MIT",
-  "version": "1.201.0-preview.115",
+  "version": "1.201.0-preview.121",
   "description": "Manage UiPath governance — AOps policies, Access policies, and compliance packs.",
   "private": false,
   "repository": {
@@ -23,5 +23,5 @@
   "files": [
     "dist"
   ],
-  "gitHead": "f1086b73654d7728cb71f280588b3e0c77d535fc"
+  "gitHead": "c70ccfc0b12e637441d67df1d212b71d7784b5f8"
 }