@uipath/solution-sdk 1.202.0-preview.138 → 1.202.0-preview.139

package/dist/index.js

@@ -8544,7 +8544,7 @@ class TextApiResponse {
 var package_default = {
   name: "@uipath/solution-sdk",
   license: "MIT",
-  version: "1.202.0-preview.138",
+  version: "1.202.0-preview.139",
   repository: {
     type: "git",
     url: "https://github.com/UiPath/cli.git",
@@ -17363,9 +17363,11 @@ async function listStudioWebSolutions(config, organizationName, options = {}) {
 // src/upload-service.ts
 class HttpError extends Error {
   status;
-  constructor(status, message) {
+  authChallenge;
+  constructor(status, message, authChallenge) {
     super(message);
     this.status = status;
+    this.authChallenge = authChallenge;
   }
 }
 
@@ -17379,6 +17381,7 @@ class SolutionUploadHttpError extends Error {
   solutionId;
   parsedErrorCode;
   parsedErrorMessage;
+  authChallenge;
   constructor(details) {
     super(details.message);
     this.name = "SolutionUploadHttpError";
@@ -17391,6 +17394,7 @@ class SolutionUploadHttpError extends Error {
     if (details.operation === "overwrite") {
       this.solutionId = details.solutionId;
     }
+    this.authChallenge = details.authChallenge;
     const parsed = parseUploadErrorBody(details.body);
     this.parsedErrorCode = parsed.code;
     this.parsedErrorMessage = parsed.message;
@@ -17414,16 +17418,71 @@ function requestPath(url) {
   const [, parsed] = catchError(() => new URL(url));
   return parsed ? `${parsed.pathname}${parsed.search}` : url;
 }
+var TOKEN_SHAPED = /\beyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]*)?|\bBearer\s+[A-Za-z0-9._~+/=-]{8,}/gi;
+function redactTokens(text) {
+  return text.replace(TOKEN_SHAPED, "[REDACTED]");
+}
+var MAX_CHALLENGE_DESCRIPTION = 200;
+function parseAuthChallenge(header) {
+  if (!header)
+    return {};
+  const code = /\berror="([^"]*)"/.exec(header)?.[1]?.trim();
+  const raw = /\berror_description="([^"]*)"/.exec(header)?.[1]?.trim();
+  const description = raw ? redactTokens(raw).slice(0, MAX_CHALLENGE_DESCRIPTION) : undefined;
+  return {
+    error: code || undefined,
+    description: description || undefined
+  };
+}
+function summarizeAuthRefusalBody(body) {
+  return summarizePlatformBody(redactTokens(body));
+}
+function isAuthRefusal(status) {
+  return status === 401 || status === 403;
+}
+function buildAuthRefusalInstructions({
+  err: err2,
+  subject,
+  target,
+  bodySuffix,
+  identityType,
+  clientId
+}) {
+  const refusal = err2.status === 401 ? "rejected the call as unauthorized (401)" : "forbade the call (403)";
+  const what = err2.operation === "overwrite" ? `replacing the contents of solution ${target}` : "importing the solution package";
+  const actor = identityType === "Application" ? `This session acts as external application ${clientId ?? "(client id unknown)"}, so ` + `check what that application is allowed to do: it needs the Studio ` + `Web scopes that cover writing a solution (the StudioWebS2S grants ` + `on the external application), not just the Orchestrator or ` + `Solutions ones. ` : identityType === "User" ? `This session acts as a user, so check that your account has ` + `Studio Web access in this tenant. ` : `Check what this session is allowed to do in Studio Web — an ` + `external application needs the StudioWebS2S grants that cover ` + `writing a solution, a user needs Studio Web access in the tenant. `;
+  const tenant = err2.operation === "overwrite" ? `Also confirm that ${target} is the solution this project should ` + `publish to, and that it lives in the organization and tenant ` + `this session logged into — the id comes from the SolutionId ` + `recorded in the enclosing solution file. An id this session ` + `cannot see at all is reported separately, as nothing to ` + `overwrite, so a refusal here points at the grants first. ` : `Also confirm you are logged into the organization and tenant the ` + `solution should land in. `;
+  const challenge = parseAuthChallenge(err2.authChallenge);
+  const quoted = challenge.description ? ` ("${challenge.description}")` : "";
+  if (challenge.error === "invalid_token") {
+    return `Studio Web ${refusal} while ${what}, and rejected the credential ` + `itself with the reason \`invalid_token\`${quoted}. That is the ` + `platform refusing this token rather than the permissions behind ` + `it, so unlike a grants refusal this one is worth a fresh ` + `\`uip login\` — or, in a pipeline, a newly minted ` + `client-credentials token. Check too that the token was issued for ` + `the organization being called: one minted against a different ` + `environment or audience is refused this way. Nothing was uploaded ` + `and nothing ran, so the ${subject} is not the cause.${bodySuffix}`;
+  }
+  const authenticated = `The session is authenticated — the token was issued and had not ` + `expired when the call went out — so re-running \`uip login\` mints ` + `the same token and fails the same way. `;
+  const diagnosis = challenge.error === "insufficient_scope" ? `Studio Web reported \`insufficient_scope\`${quoted}, so the ` + `token is valid and simply not allowed to do this: logging in ` + `again will not change it. ` : challenge.error ? `${authenticated}Studio Web gave the reason ` + `\`${challenge.error}\`${quoted}. ` : authenticated;
+  const closing = bodySuffix ? `If the grants and the tenant are already right, report the platform ` + `response, including its traceId.${bodySuffix}` : challenge.error ? `If the grants and the tenant are already right, report that reason ` + `together with the request path and status above.` : `If the grants and the tenant are already right, report the request ` + `path and status above — Studio Web returned no response body and ` + `no authentication challenge, so there is nothing further to quote.`;
+  return `Studio Web ${refusal} while ${what}. ${diagnosis}${actor}${tenant}` + `Nothing was uploaded and nothing ran, so the ${subject} is not the ` + `cause. ${closing}`;
+}
 function buildSolutionUploadFailureOutput(err2, options = {}) {
   const stage = err2.operation === "overwrite" ? "overwrite-solution" : "import-solution";
-  const detail = err2.parsedErrorMessage ? ` — ${err2.parsedErrorMessage}` : "";
+  const authRefusal = isAuthRefusal(err2.status);
+  const parsedMessage = authRefusal && err2.parsedErrorMessage ? redactTokens(err2.parsedErrorMessage) : err2.parsedErrorMessage;
+  const detail = parsedMessage ? ` — ${parsedMessage}` : "";
   const Message = `Failed during ${stage}: HTTP ${err2.status} on ${err2.method} ` + `${err2.endpoint}${detail}`;
-  const body = err2.parsedErrorMessage ? "" : summarizePlatformBody(err2.body);
+  const quote = authRefusal ? summarizeAuthRefusalBody : summarizePlatformBody;
+  const body = err2.parsedErrorMessage ? "" : quote(err2.body);
   const bodySuffix = body ? ` Platform response: "${body}".` : "";
   const importHint = options.importCheckHint ? ` ${options.importCheckHint}` : "";
   const subject = options.subject ?? "project";
   const target = err2.solutionId ?? `the solution at ${err2.endpoint}`;
-  const Instructions = err2.operation === "overwrite" ? `Studio Web refused to replace the contents of solution ` + `${target}. Nothing was uploaded and nothing ran, so the ` + `${subject} is not the cause: do not re-author it, and do not ` + `copy the project into another solution. Confirm that ${target} ` + `is a solution you can still write to, and that it is the one ` + `this project should publish to — it comes from the SolutionId ` + `recorded in the enclosing solution file. If it is right, report ` + `the platform response.${bodySuffix}` : `Studio Web refused to import the solution package. Nothing was ` + `uploaded and nothing ran, so no part of the ${subject} executed ` + `— but the package itself may be what was rejected.${importHint} ` + `Report the platform response if the ${subject} is ` + `well-formed.${bodySuffix}`;
+  const authInstructions = isAuthRefusal(err2.status) ? buildAuthRefusalInstructions({
+    err: err2,
+    subject,
+    target,
+    bodySuffix,
+    identityType: options.identityType,
+    clientId: options.clientId
+  }) : undefined;
+  const Instructions = authInstructions ?? (err2.operation === "overwrite" ? `Studio Web refused to replace the contents of solution ` + `${target}. Nothing was uploaded and nothing ran, so the ` + `${subject} is not the cause: do not re-author it, and do not ` + `copy the project into another solution. Confirm that ${target} ` + `is a solution you can still write to, and that it is the one ` + `this project should publish to — it comes from the SolutionId ` + `recorded in the enclosing solution file. If it is right, report ` + `the platform response.${bodySuffix}` : `Studio Web refused to import the solution package. Nothing was ` + `uploaded and nothing ran, so no part of the ${subject} executed ` + `— but the package itself may be what was rejected.${importHint} ` + `Report the platform response if the ${subject} is ` + `well-formed.${bodySuffix}`);
   const Context = {
     httpStatus: err2.status,
     stage,
@@ -17439,6 +17498,9 @@ function buildSolutionUploadFailureOutput(err2, options = {}) {
     Instructions,
     Context
   };
+  if (err2.status === 401 && options.identityType === "Application") {
+    output.ErrorCode = "permission_denied";
+  }
   if (err2.operation === "overwrite" && err2.status >= 500 && err2.status < 600) {
     output.Retry = "RetryAfter30Seconds";
   }
@@ -17489,8 +17551,10 @@ async function solutionExistsOnStudioWeb(config, organizationName, solutionId) {
       if (error.response.status === 404) {
         return false;
       }
+      const status = error.response.status;
       const text = await error.response.text().catch(() => "");
-      throw new HttpError(error.response.status, `Studio Web solution existence probe failed (${error.response.status}): ${text}`);
+      const body = isAuthRefusal(status) ? summarizeAuthRefusalBody(text) : text;
+      throw new HttpError(status, `Studio Web solution existence probe failed (${status}): ${body}`, parseAuthChallenge(error.response.headers?.get("www-authenticate") ?? undefined));
     }
     throw error;
   }
@@ -17519,6 +17583,7 @@ async function importSolution(config, organizationName, fileBuffer, fileName) {
       endpoint: requestPath(importUrl),
       url: importUrl,
       body: text,
+      authChallenge: response.headers?.get("www-authenticate") ?? undefined,
       message: `Import failed (${response.status}): ${text}`
     });
   }
@@ -17550,6 +17615,7 @@ async function overwriteSolution(config, organizationName, fileBuffer, fileName,
       endpoint: requestPath(overwriteUrl),
       url: overwriteUrl,
       body: text,
+      authChallenge: response.headers?.get("www-authenticate") ?? undefined,
       message: `Overwrite failed (${response.status}): ${text}`,
       solutionId
     });
@@ -17901,4 +17967,4 @@ export {
   uploadOrOverwriteSolution
 };
 
-//# debugId=CE11D385CFED5B9064756E2164756E21
+//# debugId=C66D5C6F8D87285E64756E2164756E21

package/dist/resources/index.js

@@ -30515,6 +30515,59 @@ class FileSystemFileStorageProviderFactory {
   }
 }
 
+// src/resources/providers/resource-builder-logger.ts
+var PLACEHOLDER = /\{(\w+)\}|%[sdifoOj]/g;
+function render(value) {
+  if (typeof value === "string")
+    return value;
+  if (value === null || value === undefined)
+    return String(value);
+  if (typeof value !== "object")
+    return String(value);
+  try {
+    return JSON.stringify(value) ?? String(value);
+  } catch {
+    return String(value);
+  }
+}
+function interpolate(message, args) {
+  const fields = args[0] !== null && typeof args[0] === "object" && !Array.isArray(args[0]) ? args[0] : undefined;
+  const consumed = new Set;
+  let positional = 0;
+  const filled = message.replace(PLACEHOLDER, (match, name) => {
+    if (name !== undefined) {
+      if (fields && name in fields) {
+        consumed.add(0);
+        return render(fields[name]);
+      }
+      return match;
+    }
+    const index = positional;
+    positional += 1;
+    if (index >= args.length)
+      return match;
+    consumed.add(index);
+    return render(args[index]);
+  });
+  const extra = args.filter((_, index) => !consumed.has(index)).map(render).filter((text) => text.length > 0);
+  return extra.length > 0 ? `${filled} ${extra.join(" ")}` : filled;
+}
+
+class CliResourceBuilderLoggerFactory {
+  create(target) {
+    const name = typeof target === "string" ? target : target.name;
+    const line = (message, args) => `[${name}] ${interpolate(message, args)}`;
+    return {
+      trace: (message, ...args) => logger.debug(line(message, args)),
+      debug: (message, ...args) => logger.debug(line(message, args)),
+      info: (message, ...args) => logger.info(line(message, args)),
+      warn: (message, ...args) => logger.warn(line(message, args)),
+      error: (message, error, ...args) => logger.error(error ? `${line(message, args)}: ${error.message}` : line(message, args)),
+      fatal: (message, ...args) => logger.error(line(message, args))
+    };
+  }
+}
+
 // ../orchestrator-sdk/generated/src/runtime.ts
 var BASE_PATH = "https://alpha.uipath.com/uipattycyrhx/abizon_1/orchestrator_".replace(/\/+$/, "");
 
@@ -32388,7 +32441,7 @@ class SolutionAccessProvider {
 
 // src/resources/providers/resource-builder-init.ts
 async function createResourceBuilderServices() {
-  return await createResourceBuilderConfiguration().addAccessProvider(new SolutionAccessProvider).addFileStorageProviderFactory(new FileSystemFileStorageProviderFactory).addArtifactResourceSpecEnhancer(new EntryPointSpecEnhancer).build();
+  return await createResourceBuilderConfiguration().addAccessProvider(new SolutionAccessProvider).addFileStorageProviderFactory(new FileSystemFileStorageProviderFactory).addArtifactResourceSpecEnhancer(new EntryPointSpecEnhancer).addLoggerFactory(new CliResourceBuilderLoggerFactory).build();
 }
 
 // src/resources/commands/project-utils.ts
@@ -33339,4 +33392,4 @@ export {
   writeSolutionFile
 };
 
-//# debugId=BE6597D080D5AC2664756E2164756E21
+//# debugId=E988507D1077967864756E2164756E21

package/dist/src/resources/providers/resource-builder-init.d.ts

@@ -8,5 +8,9 @@ import { type IResourceBuilderServices } from "@uipath/resource-builder-sdk";
  * `EntryPointSpecEnhancer` is registered so artefact resources (resources
  * with a `projectKey`) reflect the latest `entry-points.json` from disk at
  * read time, instead of the snapshot captured at `solution projects add`.
+ *
+ * `CliResourceBuilderLoggerFactory` replaces the SDK's default logger, which
+ * prints its message templates unfilled (`{solutionKey}`, `%s`) and bypasses
+ * `--log-level` / `--log-file` — see that file for why both matter.
  */
 export declare function createResourceBuilderServices(): Promise<IResourceBuilderServices>;

package/dist/src/resources/providers/resource-builder-logger.d.ts

@@ -0,0 +1,25 @@
+import type { ILogger, ILoggerFactory } from "@uipath/resource-builder-sdk";
+/**
+ * Fill a message template from the arguments the SDK passed alongside it.
+ *
+ * `{name}` is looked up on the first argument when that is a plain object —
+ * the shape the SDK uses. `%s` and friends consume arguments in order. A
+ * placeholder with nothing to fill it is left as written rather than replaced
+ * with "undefined", so a template the SDK logs with no arguments at all still
+ * reads as a template.
+ *
+ * Arguments no placeholder consumed are appended, so nothing the SDK meant to
+ * report is dropped.
+ */
+export declare function interpolate(message: string, args: unknown[]): string;
+/**
+ * The CLI's `ILoggerFactory` for the resource engine.
+ *
+ * The SDK's own factory prefixes each line with a timestamp and its component
+ * name; `logger` already stamps its own lines, so only the component name is
+ * carried over — it is what tells a `solution resource refresh` line apart
+ * from a `solution upload` one in a `--log-file`.
+ */
+export declare class CliResourceBuilderLoggerFactory implements ILoggerFactory {
+    create(target: (new (...args: never[]) => unknown) | string): ILogger;
+}

package/dist/src/upload-service.d.ts

@@ -17,6 +17,9 @@ type SolutionUploadFailureDetails = {
     /** Full request URL, for diagnostics. */
     url: string;
     body: string;
+    /** Raw `WWW-Authenticate` when the response carried one. Parsed, never
+     *  echoed whole — see {@link parseAuthChallenge}. */
+    authChallenge?: string;
     message: string;
 } & ({
     operation: "import";
@@ -47,11 +50,44 @@ export declare class SolutionUploadHttpError extends Error {
     /** From a `{"code":…,"message":…}` body; undefined for any other shape. */
     readonly parsedErrorCode?: string;
     readonly parsedErrorMessage?: string;
+    /** Raw `WWW-Authenticate`, when the response had one. On a real 401 from
+     *  Studio Web this is often the *only* diagnostic: the body is empty
+     *  (`content-length: 0`) and the reason is in this header. */
+    readonly authChallenge?: string;
     constructor(details: SolutionUploadFailureDetails);
 }
 /** Matched by shape, not `instanceof`: tools bundle their own copy of this
  *  package, so a cross-bundle `instanceof` is not reliable. */
 export declare function isSolutionUploadHttpError(error: unknown): error is SolutionUploadHttpError;
+/** Replace anything token-shaped in `text`. Exported for the auth-refusal
+ *  paths and their tests; not re-exported from the package barrel. */
+export declare function redactTokens(text: string): string;
+/**
+ * Pull the reason out of a `WWW-Authenticate` challenge.
+ *
+ * Measured against alpha: a real Studio Web 401 comes back with
+ * `content-length: 0` and puts the whole diagnostic in this header —
+ * `Bearer realm="…", error="invalid_token", error_description="The audience
+ * 'empty' is invalid"`. Without this the CLI has nothing to tell the user, and
+ * the envelope ends up asking them to report a platform response that does not
+ * exist.
+ *
+ * Only the two RFC 6750 fields are taken. `realm` is deliberately dropped: it
+ * is an internal endpoint URL, it says nothing about why the call failed, and
+ * echoing routing metadata into user-facing errors is the pattern the security
+ * checklist warns about. `error` is a small fixed vocabulary; `error_description`
+ * is free text, so it goes through {@link redactTokens} and a length cap in
+ * case Identity ever quotes the presented credential back.
+ */
+export declare function parseAuthChallenge(header?: string): {
+    error?: string;
+    description?: string;
+};
+/** Quote a platform body for an auth refusal, minus anything token-shaped.
+ *  Redaction runs before `summarizePlatformBody`'s length cap, so a token
+ *  cannot survive by being truncated mid-string into something the pattern no
+ *  longer matches. */
+export declare function summarizeAuthRefusalBody(body: string): string;
 /**
  * Build the CLI failure envelope for a Studio Web upload refusal.
  *
@@ -66,11 +102,20 @@ export declare function isSolutionUploadHttpError(error: unknown): error is Solu
  * the caller has a command for checking it; an overwrite refusal is about the
  * target solution, not the package.
  *
- * `Context.httpStatus` is what gives the envelope its `ErrorCode`.
+ * `identityType` (with `clientId` when it is known) only changes the wording
+ * of a 401/403: who the session acts as decides whether "check your Studio Web
+ * access" or "check the external application's scopes" is the useful sentence.
+ * It is read from unverified token claims, so it must never be used for
+ * anything but text — see `SessionIdentity` in `@uipath/auth`.
+ *
+ * `Context.httpStatus` is what gives the envelope its `ErrorCode`, except on an
+ * application 401 — see {@link buildAuthRefusalInstructions}.
  */
 export declare function buildSolutionUploadFailureOutput(err: SolutionUploadHttpError, options?: {
     subject?: string;
     importCheckHint?: string;
+    identityType?: "User" | "Application";
+    clientId?: string;
 }): FailureOutput;
 /**
  * Escape hatch for very large solutions or unusually slow links:

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@uipath/solution-sdk",
     "license": "MIT",
-    "version": "1.202.0-preview.138",
+    "version": "1.202.0-preview.139",
     "repository": {
         "type": "git",
         "url": "https://github.com/UiPath/cli.git",
@@ -39,5 +39,5 @@
         "dist"
     ],
     "private": false,
-    "gitHead": "46372d5c4c4ae9352e9457a99e9d5efc1890cb48"
+    "gitHead": "fd9f8b8a05749404743763d22187b1b012c44274"
 }