@uipath/solution-sdk 1.202.1 → 1.203.0-preview.180

package/dist/index-y8tgscfm.js

@@ -0,0 +1,1381 @@
+import {
+  getFileSystem
+} from "./index-g0hcxnae.js";
+import {
+  __require
+} from "./index-1de529jm.js";
+
+// ../auth/src/catch-error.ts
+function isPromiseLike(value) {
+  return value !== null && typeof value === "object" && typeof value.then === "function";
+}
+function catchError(fnOrPromise) {
+  if (isPromiseLike(fnOrPromise)) {
+    return settlePromiseLike(fnOrPromise);
+  }
+  try {
+    const result = fnOrPromise();
+    if (isPromiseLike(result)) {
+      return settlePromiseLike(result);
+    }
+    return [undefined, result];
+  } catch (error) {
+    return [
+      error instanceof Error ? error : new Error(String(error)),
+      undefined
+    ];
+  }
+}
+function settlePromiseLike(thenable) {
+  return Promise.resolve(thenable).then((data) => [undefined, data]).catch((error) => [
+    error instanceof Error ? error : new Error(String(error)),
+    undefined
+  ]);
+}
+
+// ../auth/src/constants.ts
+var UIPATH_HOME_DIR = ".uipath";
+var AUTH_FILENAME = ".auth";
+var DEFAULT_BASE_URL = "https://cloud.uipath.com";
+var DEFAULT_AUTH_TIMEOUT_MS = 5 * 60 * 1000;
+
+// ../auth/src/config.ts
+var DEFAULT_CLIENT_ID = "36dea5b8-e8bb-423d-8e7b-c808df8f1c00";
+var AUTH_FILE_CONFIG_KEY = Symbol.for("@uipath/auth/AuthFileConfig");
+var globalSlot = globalThis;
+var getAuthFileConfig = () => globalSlot[AUTH_FILE_CONFIG_KEY] ?? {};
+
+class InvalidBaseUrlError extends Error {
+  url;
+  reason;
+  constructor(url, reason) {
+    super(`Invalid base URL: "${url}"
+` + `Reason: ${reason}
+
+` + `Expected format: an https:// URL (or bare host — https:// is assumed), e.g. https://cloud.uipath.com (commercial), https://govcloud.uipath.us (Public Sector), or your Automation Suite host (https://<your-host>).
+` + `You can specify the URL via:
+` + `  • --authority flag
+` + `  • UIPATH_URL environment variable
+` + `  • auth.authority in config file`);
+    this.url = url;
+    this.reason = reason;
+    this.name = "InvalidBaseUrlError";
+  }
+}
+var DEFAULT_SCOPES = ["openid", "profile", "offline_access"];
+var normalizeAndValidateBaseUrl = (rawUrl) => {
+  let baseUrl = rawUrl;
+  if (baseUrl.endsWith("/identity_/")) {
+    baseUrl = baseUrl.slice(0, -11);
+  } else if (baseUrl.endsWith("/identity_")) {
+    baseUrl = baseUrl.slice(0, -10);
+  }
+  while (baseUrl.endsWith("/")) {
+    baseUrl = baseUrl.slice(0, -1);
+  }
+  const hasScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(baseUrl);
+  const [hostCandidate] = baseUrl.split(/[/?#]/, 1);
+  if (!hasScheme && hostCandidate.includes(".")) {
+    baseUrl = `https://${baseUrl}`;
+  }
+  const resolvedBaseUrl = baseUrl;
+  const [urlError, url] = catchError(() => new URL(resolvedBaseUrl));
+  if (urlError) {
+    const shapeHint = !hasScheme && !hostCandidate.includes(".") ? ` "${rawUrl.trim()}" is not a URL or a host name. Pass the full authority URL — https://<host>, or just <host> (https:// is assumed).` : ` ${urlError instanceof Error ? urlError.message : "Unknown error"}`;
+    throw new InvalidBaseUrlError(baseUrl, `Malformed URL.${shapeHint}`);
+  }
+  if (url.protocol !== "https:") {
+    throw new InvalidBaseUrlError(baseUrl, `Authority must use https:// scheme, got ${url.protocol}//. OIDC token exchange requires TLS end-to-end.`);
+  }
+  return url.pathname.length > 1 ? url.origin : baseUrl;
+};
+var resolveScopes = (isExternalAppAuth, customScopes, fileScopes) => {
+  const requestedScopes = customScopes?.length ? customScopes : fileScopes ?? [];
+  if (isExternalAppAuth)
+    return requestedScopes;
+  return [...new Set([...DEFAULT_SCOPES, ...requestedScopes])];
+};
+var resolveConfigAsync = async ({
+  customAuthority,
+  customClientId,
+  customClientSecret,
+  customClientAssertion,
+  customScopes
+} = {}) => {
+  const fileAuth = getAuthFileConfig();
+  let baseUrl = customAuthority;
+  if (!baseUrl) {
+    baseUrl = process.env.UIPATH_URL;
+  }
+  if (!baseUrl && fileAuth.authority) {
+    baseUrl = fileAuth.authority;
+  }
+  if (!baseUrl) {
+    baseUrl = DEFAULT_BASE_URL;
+  }
+  baseUrl = normalizeAndValidateBaseUrl(baseUrl);
+  let clientId = customClientId;
+  if (!clientId && fileAuth.clientId) {
+    clientId = fileAuth.clientId;
+  }
+  if (!clientId) {
+    clientId = DEFAULT_CLIENT_ID;
+  }
+  let clientSecret = customClientSecret;
+  if (!clientSecret && fileAuth.clientSecret) {
+    clientSecret = fileAuth.clientSecret;
+  }
+  const isExternalAppAuth = clientId !== DEFAULT_CLIENT_ID && (Boolean(clientSecret) || Boolean(customClientAssertion));
+  const scopes = resolveScopes(isExternalAppAuth, customScopes, fileAuth.scopes);
+  return {
+    clientId,
+    clientSecret,
+    scopes,
+    baseUrl,
+    authorizationEndpoint: `${baseUrl}/identity_/connect/authorize`,
+    tokenEndpoint: `${baseUrl}/identity_/connect/token`
+  };
+};
+
+// ../auth/src/utils/platform.ts
+function isBrowser() {
+  return typeof globalThis !== "undefined" && "window" in globalThis && "document" in globalThis;
+}
+
+// ../auth/src/authProfile.ts
+var DEFAULT_AUTH_PROFILE = "default";
+var PROFILE_DIR = "profiles";
+var PROFILE_NAME_RE = /^[A-Za-z0-9._-]+$/;
+var ACTIVE_AUTH_PROFILE_KEY = Symbol.for("@uipath/auth/ActiveAuthProfile");
+var AUTH_PROFILE_STORAGE_KEY = Symbol.for("@uipath/auth/ProfileStorage");
+var globalSlot2 = globalThis;
+function isAuthProfileStorage(value) {
+  return value !== null && typeof value === "object" && "getStore" in value && "run" in value;
+}
+function createProfileStorage() {
+  const [error, mod] = catchError(() => __require("node:async_hooks"));
+  if (error || typeof mod?.AsyncLocalStorage !== "function") {
+    return {
+      getStore: () => {
+        return;
+      },
+      run: (_store, fn) => fn()
+    };
+  }
+  return new mod.AsyncLocalStorage;
+}
+function getProfileStorage() {
+  const existing = globalSlot2[AUTH_PROFILE_STORAGE_KEY];
+  if (isAuthProfileStorage(existing)) {
+    return existing;
+  }
+  const storage = createProfileStorage();
+  globalSlot2[AUTH_PROFILE_STORAGE_KEY] = storage;
+  return storage;
+}
+var profileStorage = getProfileStorage();
+
+class AuthProfileValidationError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AuthProfileValidationError";
+  }
+}
+function normalizeAuthProfileName(profile) {
+  if (profile === undefined || profile === DEFAULT_AUTH_PROFILE) {
+    return;
+  }
+  if (profile.length === 0 || profile === "." || profile === ".." || !PROFILE_NAME_RE.test(profile)) {
+    throw new AuthProfileValidationError(`Invalid profile name "${profile}". Profile names may contain only letters, numbers, '.', '_', and '-'.`);
+  }
+  return profile;
+}
+function getActiveAuthProfile() {
+  const scopedState = profileStorage.getStore();
+  if (scopedState !== undefined) {
+    return scopedState.profile;
+  }
+  return globalSlot2[ACTIVE_AUTH_PROFILE_KEY]?.profile;
+}
+function resolveAuthProfileFilePath(profile) {
+  const normalized = normalizeAuthProfileName(profile);
+  if (normalized === undefined) {
+    throw new AuthProfileValidationError(`"${DEFAULT_AUTH_PROFILE}" is the built-in profile and does not have a profile file path.`);
+  }
+  const fs = getFileSystem();
+  return fs.path.join(fs.env.homedir(), UIPATH_HOME_DIR, PROFILE_DIR, normalized, AUTH_FILENAME);
+}
+function getActiveAuthProfileFilePath() {
+  const profile = getActiveAuthProfile();
+  return profile ? resolveAuthProfileFilePath(profile) : undefined;
+}
+
+// ../auth/src/utils/jwt.ts
+class InvalidIssuerError extends Error {
+  expected;
+  actual;
+  constructor(expected, actual) {
+    const actualText = actual ?? "<missing>";
+    super(`Token issuer does not match the authority used to log in.
+` + `Expected: ${expected}
+` + `Actual:   ${actualText}
+
+` + `The identity server that issued this token is not the one ` + `you pointed --authority at. Refusing to save credentials.`);
+    this.expected = expected;
+    this.actual = actual;
+    this.name = "InvalidIssuerError";
+  }
+}
+var parseJWT = (token) => {
+  try {
+    const parts = token.split(".");
+    const base64Url = parts[1];
+    if (!base64Url) {
+      throw new Error("Invalid JWT token format - missing payload section");
+    }
+    const base64 = base64Url.replace(/-/g, "+").replace(/_/g, "/");
+    let decodedString;
+    if (isBrowser() && typeof atob !== "undefined") {
+      decodedString = atob(base64);
+    } else {
+      decodedString = Buffer.from(base64, "base64").toString();
+    }
+    const jsonPayload = decodeURIComponent(decodedString.split("").map((c) => `%${`00${c.charCodeAt(0).toString(16)}`.slice(-2)}`).join(""));
+    const parsed = JSON.parse(jsonPayload);
+    return parsed;
+  } catch (error) {
+    throw new Error(`Failed to parse JWT: ${error instanceof Error ? error.message : "Unknown error"}`);
+  }
+};
+var assertIssuerMatchesAuthority = (token, authority) => {
+  let payload;
+  try {
+    payload = parseJWT(token);
+  } catch (error) {
+    throw new InvalidIssuerError(`${authority.replace(/\/+$/, "")}/identity_`, `<unparseable: ${error instanceof Error ? error.message : "unknown error"}>`);
+  }
+  const stripTrailingSlash = (s) => s.replace(/\/+$/, "");
+  const expected = `${stripTrailingSlash(authority)}/identity_`;
+  const actual = typeof payload.iss === "string" ? stripTrailingSlash(payload.iss) : undefined;
+  if (actual !== expected) {
+    throw new InvalidIssuerError(expected, payload.iss);
+  }
+};
+var getTokenExpiration = (accessToken) => {
+  try {
+    const parts = accessToken.split(".");
+    if (parts.length !== 3) {
+      return;
+    }
+    const payload = parts[1];
+    const base64 = payload.replace(/-/g, "+").replace(/_/g, "/");
+    const padded = base64 + "=".repeat((4 - base64.length % 4) % 4);
+    const decoded = atob(padded);
+    const claims = JSON.parse(decoded);
+    if (typeof claims.exp !== "number") {
+      return;
+    }
+    return new Date(claims.exp * 1000);
+  } catch {
+    return;
+  }
+};
+
+// ../auth/src/sessionIdentity.ts
+var parseAuthFlow = (value) => value === "authorization_code" || value === "client_credentials" || value === "federated_credentials" ? value : undefined;
+var decodeClaims = (accessToken) => {
+  const [error, claims] = catchError(() => parseJWT(accessToken));
+  return error ? undefined : claims;
+};
+var asString = (value) => typeof value === "string" && value.length > 0 ? value : undefined;
+var resolveIdentityType = (claims, authFlow, email) => {
+  const subType = asString(claims?.sub_type);
+  if (subType) {
+    return subType.startsWith("service") ? "Application" : "User";
+  }
+  if (authFlow) {
+    return authFlow === "authorization_code" ? "User" : "Application";
+  }
+  if (email)
+    return "User";
+  if (asString(claims?.client_id) && !asString(claims?.sub)) {
+    return "Application";
+  }
+  return;
+};
+var looksLikeEmail = (value) => value?.includes("@") ?? false;
+var pickEmail = (claims) => {
+  for (const candidate of [claims?.email, claims?.preferred_username]) {
+    const value = asString(candidate);
+    if (looksLikeEmail(value))
+      return value;
+  }
+  return;
+};
+var pickName = (claims) => {
+  const username = asString(claims?.preferred_username);
+  return asString(claims?.name) ?? (looksLikeEmail(username) ? undefined : username);
+};
+var resolveSessionIdentity = (accessToken, authFlow) => {
+  const claims = accessToken ? decodeClaims(accessToken) : undefined;
+  const email = pickEmail(claims);
+  const type = resolveIdentityType(claims, authFlow, email);
+  if (!type)
+    return;
+  const identity = { type };
+  if (authFlow)
+    identity.authFlow = authFlow;
+  if (type === "User") {
+    const userId = asString(claims?.sub);
+    if (userId)
+      identity.userId = userId;
+    if (email)
+      identity.userEmail = email;
+    const name = pickName(claims);
+    if (name)
+      identity.userName = name;
+    return identity;
+  }
+  const clientId = asString(claims?.client_id);
+  if (clientId)
+    identity.clientId = clientId;
+  return identity;
+};
+
+// ../auth/src/envAuth.ts
+var ENV_AUTH_ENABLE_VAR = "UIPATH_CLI_ENABLE_ENV_AUTH";
+var ENFORCE_ROBOT_AUTH_VAR = "UIPATH_CLI_ENFORCE_ROBOT_AUTH";
+var ENV_AUTH_VARS = {
+  token: "UIPATH_CLI_AUTH_TOKEN",
+  organizationName: "UIPATH_CLI_ORGANIZATION_NAME",
+  organizationId: "UIPATH_CLI_ORGANIZATION_ID",
+  tenantName: "UIPATH_CLI_TENANT_NAME",
+  tenantId: "UIPATH_CLI_TENANT_ID"
+};
+
+class EnvAuthConfigError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "EnvAuthConfigError";
+  }
+}
+var isEnvAuthEnabled = () => process.env[ENV_AUTH_ENABLE_VAR] === "true";
+var isRobotAuthEnforced = () => process.env[ENFORCE_ROBOT_AUTH_VAR] === "true";
+var requireEnv = (name) => {
+  const value = process.env[name];
+  if (!value) {
+    throw new EnvAuthConfigError(`${ENV_AUTH_ENABLE_VAR}=true but ${name} is not set. ` + `Set ${name} to enable env-var authentication.`);
+  }
+  return value;
+};
+var OPAQUE_TOKEN_BASE_URL_VAR = "UIPATH_URL";
+var resolveBaseUrl = (rawUrl, failureContext) => {
+  const [baseUrlError, baseUrl] = catchError(() => normalizeAndValidateBaseUrl(rawUrl));
+  if (baseUrlError) {
+    if (baseUrlError instanceof InvalidBaseUrlError) {
+      throw baseUrlError;
+    }
+    throw new EnvAuthConfigError(`${failureContext}: ` + `${baseUrlError instanceof Error ? baseUrlError.message : String(baseUrlError)}`);
+  }
+  return baseUrl;
+};
+var readAuthFromEnv = () => {
+  const accessToken = requireEnv(ENV_AUTH_VARS.token);
+  const organizationName = requireEnv(ENV_AUTH_VARS.organizationName);
+  const organizationId = requireEnv(ENV_AUTH_VARS.organizationId);
+  const tenantName = requireEnv(ENV_AUTH_VARS.tenantName);
+  const tenantId = requireEnv(ENV_AUTH_VARS.tenantId);
+  const [parseError, payload] = catchError(() => parseJWT(accessToken));
+  if (parseError) {
+    const parseErrorMessage = parseError instanceof Error ? parseError.message : String(parseError);
+    const rawUrl = process.env[OPAQUE_TOKEN_BASE_URL_VAR];
+    if (!rawUrl) {
+      throw new EnvAuthConfigError(`${ENV_AUTH_VARS.token} is not a JWT (treating it as an opaque token, ` + `e.g. a Personal Access Token). Set ${OPAQUE_TOKEN_BASE_URL_VAR} to the ` + `UiPath base URL if this is a PAT, or fix the token if it was meant to ` + `be a JWT (parse error: ${parseErrorMessage}).`);
+    }
+    const baseUrl2 = resolveBaseUrl(rawUrl, `Failed to validate ${OPAQUE_TOKEN_BASE_URL_VAR}`);
+    return {
+      loginStatus: "Logged in",
+      accessToken,
+      baseUrl: baseUrl2,
+      organizationName,
+      organizationId,
+      tenantName,
+      tenantId,
+      source: "env-vars" /* EnvironmentVariables */,
+      hint: "Token is opaque (not a JWT) - expiration and identity cannot be " + "determined locally. Commands will fail with 401 once it is revoked or " + `expired. If this was meant to be a JWT instead of a PAT, note: ${parseErrorMessage}`
+    };
+  }
+  const iss = payload.iss;
+  if (typeof iss !== "string" || iss.length === 0) {
+    throw new EnvAuthConfigError(`${ENV_AUTH_VARS.token} has no 'iss' claim; cannot determine ` + `the UiPath server. Ensure the token was issued by a UiPath identity server.`);
+  }
+  const baseUrl = resolveBaseUrl(iss, "Failed to derive server URL from token 'iss' claim");
+  const expiration = getTokenExpiration(accessToken);
+  const loginStatus = expiration && expiration <= new Date ? "Expired" : "Logged in";
+  const identity = resolveSessionIdentity(accessToken);
+  return {
+    loginStatus,
+    accessToken,
+    baseUrl,
+    organizationName,
+    organizationId,
+    tenantName,
+    tenantId,
+    expiration,
+    source: "env-vars" /* EnvironmentVariables */,
+    ...identity ? { identity } : {}
+  };
+};
+
+// ../auth/src/refreshCircuitBreaker.ts
+var BREAKER_SUFFIX = ".refresh-state";
+var BACKOFF_BASE_MS = 60000;
+var BACKOFF_CAP_MS = 60 * 60 * 1000;
+var SURFACE_WINDOW_MS = 60 * 60 * 1000;
+async function refreshTokenFingerprint(refreshToken) {
+  const bytes = new TextEncoder().encode(refreshToken);
+  if (globalThis.crypto?.subtle) {
+    const digest = await globalThis.crypto.subtle.digest("SHA-256", bytes);
+    return Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, "0")).join("").slice(0, 16);
+  }
+  const { createHash } = await import("node:crypto");
+  return createHash("sha256").update(refreshToken).digest("hex").slice(0, 16);
+}
+function breakerPathFor(authPath) {
+  return `${authPath}${BREAKER_SUFFIX}`;
+}
+async function loadRefreshBreaker(authPath) {
+  const fs = getFileSystem();
+  try {
+    const content = await fs.readFile(breakerPathFor(authPath), "utf-8");
+    if (!content)
+      return {};
+    const parsed = JSON.parse(content);
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+async function saveRefreshBreaker(authPath, state) {
+  try {
+    const fs = getFileSystem();
+    const path = breakerPathFor(authPath);
+    await fs.mkdir(fs.path.dirname(path));
+    const tempPath = `${path}.tmp`;
+    await fs.writeFile(tempPath, JSON.stringify(state));
+    await fs.rename(tempPath, path);
+  } catch {}
+}
+async function clearRefreshBreaker(authPath) {
+  const fs = getFileSystem();
+  const path = breakerPathFor(authPath);
+  try {
+    if (await fs.exists(path)) {
+      await fs.rm(path);
+    }
+  } catch {}
+}
+function nextBackoffMs(attempts) {
+  const shift = Math.max(0, attempts - 1);
+  return Math.min(BACKOFF_BASE_MS * 2 ** shift, BACKOFF_CAP_MS);
+}
+function shouldSurface(state, nowMs) {
+  if (state.lastSurfacedAtMs === undefined)
+    return true;
+  return nowMs - state.lastSurfacedAtMs >= SURFACE_WINDOW_MS;
+}
+
+// ../auth/src/robotClientFallback.ts
+var DEFAULT_TIMEOUT_MS = 1000;
+var CLOSE_TIMEOUT_MS = 500;
+var ROBOT_USER_SERVICES_PIPE = "UiPathUserServices";
+var ROBOT_USER_SERVICES_ALTERNATE_PIPE = `${ROBOT_USER_SERVICES_PIPE}Alternate`;
+var PIPE_NAME_MAX_LENGTH = 103;
+var getRobotIpcPipeNames = async () => {
+  const fs = getFileSystem();
+  const username = fs.env.getenv("USER") ?? fs.env.getenv("USERNAME");
+  if (!username) {
+    throw new Error("Unable to determine current username");
+  }
+  const tempPath = fs.env.getenv("TMPDIR") ?? "/tmp/";
+  return [ROBOT_USER_SERVICES_PIPE, ROBOT_USER_SERVICES_ALTERNATE_PIPE].map((baseName) => fs.path.join(tempPath, `${baseName}_${username}`).substring(0, PIPE_NAME_MAX_LENGTH));
+};
+var defaultIsRobotIpcAvailable = async () => {
+  if (process.platform === "win32") {
+    return true;
+  }
+  const [pipeNamesError, pipeNames] = await catchError(getRobotIpcPipeNames());
+  if (pipeNamesError || !pipeNames) {
+    return false;
+  }
+  const fs = getFileSystem();
+  for (const pipeName of pipeNames) {
+    const [existsError, exists] = await catchError(fs.exists(pipeName));
+    if (!existsError && exists === true) {
+      return true;
+    }
+  }
+  return false;
+};
+var withTimeout = (promise, timeoutMs) => new Promise((resolve, reject) => {
+  const timer = setTimeout(() => reject(new Error(`Robot IPC call timed out after ${timeoutMs}ms`)), timeoutMs);
+  promise.then((value) => {
+    clearTimeout(timer);
+    resolve(value);
+  }, (error) => {
+    clearTimeout(timer);
+    reject(error);
+  });
+});
+var parseResourceUrl = (url) => {
+  const [error, parsed] = catchError(() => new URL(url));
+  if (error || !parsed)
+    return;
+  const segments = parsed.pathname.split("/").filter(Boolean);
+  return {
+    baseUrl: parsed.origin,
+    organizationName: segments[0],
+    tenantName: segments[1]
+  };
+};
+var ROBOT_CLIENT_LOADER_KEY = Symbol.for("@uipath/auth/RobotClientLoader");
+var getRegisteredRobotClientLoader = () => {
+  const loader = globalThis[ROBOT_CLIENT_LOADER_KEY];
+  return typeof loader === "function" ? loader : undefined;
+};
+var defaultLoadModule = async () => {
+  const hostLoader = getRegisteredRobotClientLoader();
+  if (!hostLoader) {
+    return;
+  }
+  const [error, mod] = await catchError(() => hostLoader());
+  if (error || !mod) {
+    return;
+  }
+  return mod;
+};
+var tryRobotClientFallback = async (options = {}) => {
+  if (isBrowser())
+    return;
+  if (!options.force) {
+    if (process.env.CI || process.env.GITHUB_ACTIONS) {
+      return;
+    }
+    if (process.env.UIPATH_URL) {
+      return;
+    }
+  }
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const isRobotIpcAvailable = options.isRobotIpcAvailable ?? defaultIsRobotIpcAvailable;
+  const loadModule = options.loadModule ?? defaultLoadModule;
+  if (!await isRobotIpcAvailable()) {
+    return;
+  }
+  const mod = await loadModule();
+  if (!mod)
+    return;
+  const [ctorError, proxy] = catchError(() => new mod.RobotProxyConstructor);
+  if (ctorError || !proxy) {
+    return;
+  }
+  try {
+    const enabled = await withTimeout(proxy.interactiveConnectFlow.IsEnabled(), timeoutMs);
+    if (!enabled) {
+      return;
+    }
+    const [resourceUrl, accessToken] = await Promise.all([
+      withTimeout(proxy.accessProvider.GetResourceUrl("Orchestrator"), timeoutMs),
+      withTimeout(proxy.accessProvider.GetAccessToken("Orchestrator", false), timeoutMs)
+    ]);
+    if (!accessToken) {
+      return;
+    }
+    const parsedUrl = parseResourceUrl(resourceUrl);
+    if (!parsedUrl) {
+      return;
+    }
+    let organizationIdFromToken;
+    let tenantIdFromToken;
+    let issuerFromToken;
+    const [jwtError, claims] = catchError(() => parseJWT(accessToken));
+    if (!jwtError && claims) {
+      const rawOrgId = claims.prtId ?? claims.organizationId ?? claims.prt_id;
+      if (typeof rawOrgId === "string" && rawOrgId.length > 0) {
+        organizationIdFromToken = rawOrgId;
+      }
+      const tenantClaim = claims.tenantId ?? claims.tenant_id;
+      if (typeof tenantClaim === "string" && tenantClaim.length > 0) {
+        tenantIdFromToken = tenantClaim;
+      }
+      const issClaim = claims.iss;
+      if (typeof issClaim === "string" && issClaim.length > 0) {
+        issuerFromToken = issClaim;
+      }
+    }
+    return {
+      accessToken,
+      baseUrl: parsedUrl.baseUrl,
+      organizationName: parsedUrl.organizationName,
+      organizationId: organizationIdFromToken ?? parsedUrl.organizationName,
+      tenantName: parsedUrl.tenantName,
+      tenantId: tenantIdFromToken,
+      issuer: issuerFromToken
+    };
+  } catch {
+    return;
+  } finally {
+    await catchError(() => withTimeout(proxy.CloseAsync(), CLOSE_TIMEOUT_MS));
+  }
+};
+
+// ../auth/src/tokenRefresh.ts
+var TOKEN_REFRESH_REAUTHENTICATE_MESSAGE = "Token refresh failed. Run 'uip login' to re-authenticate.";
+
+class TokenRefreshOAuthError extends Error {
+  __brand = "TokenRefreshOAuthError";
+  constructor() {
+    super(TOKEN_REFRESH_REAUTHENTICATE_MESSAGE);
+    this.name = "TokenRefreshOAuthError";
+  }
+}
+function isTokenRefreshOAuthFailure(error) {
+  return error instanceof TokenRefreshOAuthError;
+}
+var refreshAccessToken = async ({
+  refreshToken,
+  tokenEndpoint,
+  clientId,
+  expectedAuthority
+}) => {
+  const tokenParams = new URLSearchParams({
+    grant_type: "refresh_token",
+    refresh_token: refreshToken,
+    client_id: clientId
+  });
+  const tokenResponse = await fetch(tokenEndpoint, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded"
+    },
+    body: tokenParams
+  });
+  const tokenData = await tokenResponse.json();
+  if (!tokenResponse.ok) {
+    throw new TokenRefreshOAuthError;
+  }
+  const newAccessToken = tokenData.access_token;
+  const newRefreshToken = tokenData.refresh_token;
+  if (typeof newAccessToken !== "string" || typeof newRefreshToken !== "string") {
+    throw new Error("Token refresh response is missing access_token or refresh_token");
+  }
+  if (expectedAuthority) {
+    assertIssuerMatchesAuthority(newAccessToken, expectedAuthority);
+  }
+  return { accessToken: newAccessToken, refreshToken: newRefreshToken };
+};
+
+// ../auth/src/types.ts
+var AUTH_FLOW_ENV_VAR = "UIPATH_AUTH_FLOW";
+
+// ../auth/src/utils/envFile.ts
+var DEFAULT_ENV_FILENAME = `${UIPATH_HOME_DIR}/${AUTH_FILENAME}`;
+var KNOWN_ERROR_CODES = new Set([
+  "EISDIR",
+  "EACCES",
+  "EPERM",
+  "ELOOP",
+  "ENOTDIR",
+  "EUNKNOWN"
+]);
+var errorCode = (err) => {
+  if (err !== null && typeof err === "object" && "code" in err && typeof err.code === "string") {
+    const raw = err.code;
+    return KNOWN_ERROR_CODES.has(raw) ? raw : "EUNKNOWN";
+  }
+  return "EUNKNOWN";
+};
+var probeAsync = async (fs, candidate) => {
+  try {
+    const stats = await fs.stat(candidate);
+    if (stats === null) {
+      return { exists: false };
+    }
+    if (!stats.isFile()) {
+      return {
+        exists: false,
+        unusable: {
+          reason: "not-a-file",
+          code: "EISDIR",
+          message: `Path is not a regular file: ${candidate}`
+        }
+      };
+    }
+    return { exists: true };
+  } catch (err) {
+    return {
+      exists: false,
+      unusable: {
+        reason: "unreadable",
+        code: errorCode(err),
+        message: err instanceof Error ? err.message : String(err)
+      }
+    };
+  }
+};
+var resolveEnvFileLocationAsync = async (envFilePath = DEFAULT_ENV_FILENAME, opts) => {
+  const fs = getFileSystem();
+  if (fs.path.isAbsolute(envFilePath)) {
+    const probe2 = await probeAsync(fs, envFilePath);
+    return probe2.exists ? { exists: true, absolutePath: envFilePath, source: "absolute" } : {
+      exists: false,
+      absolutePath: envFilePath,
+      source: "absolute",
+      ...probe2.unusable ? { unusable: probe2.unusable } : {}
+    };
+  }
+  const cwd = opts?.cwd ?? fs.env.cwd();
+  let searchDir = cwd;
+  while (true) {
+    const candidate = fs.path.join(searchDir, envFilePath);
+    const probe2 = await probeAsync(fs, candidate);
+    if (probe2.exists) {
+      return {
+        exists: true,
+        absolutePath: candidate,
+        source: searchDir === cwd ? "cwd" : "ancestor"
+      };
+    }
+    const parentDir = fs.path.dirname(searchDir);
+    if (parentDir === searchDir) {
+      break;
+    }
+    searchDir = parentDir;
+  }
+  const homePath = fs.path.join(fs.env.homedir(), envFilePath);
+  const probe = await probeAsync(fs, homePath);
+  if (probe.exists) {
+    return { exists: true, absolutePath: homePath, source: "home" };
+  }
+  return {
+    exists: false,
+    absolutePath: homePath,
+    source: "default",
+    ...probe.unusable ? { unusable: probe.unusable } : {}
+  };
+};
+var resolveEnvFilePathAsync = async (envFilePath = DEFAULT_ENV_FILENAME, opts) => {
+  const location = await resolveEnvFileLocationAsync(envFilePath, opts);
+  if (location.exists) {
+    return { absolutePath: location.absolutePath };
+  }
+  return {
+    absolutePath: undefined,
+    errorMessage: location.source === "absolute" ? `Environment file not found: ${envFilePath}` : `Unable to locate environment file: ${envFilePath}. Run 'uip login' to authenticate.`
+  };
+};
+var parseEnvContent = (content) => {
+  const env = {};
+  for (const line of content.split(`
+`)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) {
+      continue;
+    }
+    const equalIndex = trimmed.indexOf("=");
+    if (equalIndex === -1) {
+      continue;
+    }
+    const key = trimmed.slice(0, equalIndex).trim();
+    let value = trimmed.slice(equalIndex + 1).trim();
+    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+      value = value.slice(1, -1);
+    }
+    env[key] = value;
+  }
+  return env;
+};
+var loadEnvFileAsync = async ({ envPath }) => {
+  const fs = getFileSystem();
+  const absolutePath = fs.path.isAbsolute(envPath) ? envPath : fs.path.join(fs.env.cwd(), envPath);
+  if (!await fs.exists(absolutePath)) {
+    throw new Error(`Environment file not found: ${envPath}`);
+  }
+  const content = await fs.readFile(absolutePath, "utf-8");
+  if (content === null) {
+    throw new Error(`Environment file not found: ${envPath}`);
+  }
+  return parseEnvContent(content);
+};
+var saveEnvFileAsync = async ({
+  envPath,
+  data,
+  merge = true
+}) => {
+  const fs = getFileSystem();
+  const absolutePath = fs.path.isAbsolute(envPath) ? envPath : fs.path.join(fs.env.homedir(), envPath);
+  let existingData = {};
+  if (merge && await fs.exists(absolutePath)) {
+    try {
+      existingData = await loadEnvFileAsync({ envPath: absolutePath });
+    } catch {}
+  }
+  const finalData = { ...existingData, ...data };
+  const lines = [];
+  for (const [key, value] of Object.entries(finalData)) {
+    if (value === undefined) {
+      continue;
+    }
+    const needsQuotes = value.includes(" ") || value.includes("#");
+    const finalValue = needsQuotes ? `"${value}"` : value;
+    lines.push(`${key}=${finalValue}`);
+  }
+  const content = `${lines.join(`
+`)}
+`;
+  const dir = fs.path.dirname(absolutePath);
+  await fs.mkdir(dir);
+  const tempPath = `${absolutePath}.tmp`;
+  await fs.writeFile(tempPath, content);
+  await fs.rename(tempPath, absolutePath);
+};
+
+// ../auth/src/loginStatus.ts
+var getLoginStatusAsync = async (options = {}) => {
+  return getLoginStatusWithDeps(options);
+};
+var getLoginStatusWithDeps = async (options = {}, deps = {}) => {
+  const {
+    resolveEnvFilePath = resolveEnvFilePathAsync,
+    loadEnvFile = loadEnvFileAsync,
+    saveEnvFile = saveEnvFileAsync,
+    getFs = getFileSystem,
+    refreshToken: refreshTokenFn = refreshAccessToken,
+    resolveConfig = resolveConfigAsync,
+    robotFallback = tryRobotClientFallback,
+    loadBreaker = loadRefreshBreaker,
+    saveBreaker = saveRefreshBreaker,
+    clearBreaker = clearRefreshBreaker
+  } = deps;
+  if (isRobotAuthEnforced()) {
+    return resolveRobotEnforcedStatus(robotFallback);
+  }
+  if (isEnvAuthEnabled()) {
+    return readAuthFromEnv();
+  }
+  const activeProfile = getActiveAuthProfile();
+  const activeProfileFilePath = getActiveAuthProfileFilePath();
+  const usingActiveProfile = activeProfile !== undefined && (options.envFilePath === undefined || options.envFilePath === activeProfileFilePath);
+  const envFilePath = options.envFilePath ?? activeProfileFilePath ?? DEFAULT_ENV_FILENAME;
+  const { ensureTokenValidityMinutes } = options;
+  const { absolutePath } = await resolveEnvFilePath(envFilePath);
+  if (absolutePath === undefined) {
+    if (usingActiveProfile) {
+      return {
+        loginStatus: "Not logged in",
+        hint: `No credentials found for profile "${activeProfile}". Run 'uip login --profile ${activeProfile}' to authenticate this profile.`
+      };
+    }
+    return resolveBorrowedRobotStatus(robotFallback);
+  }
+  const loaded = await loadFileCredentials(loadEnvFile, absolutePath);
+  if ("status" in loaded) {
+    return loaded.status;
+  }
+  const { credentials } = loaded;
+  const globalHint = () => usingActiveProfile ? Promise.resolve(undefined) : getGlobalCredsHint(getFs, loadEnvFile, absolutePath, envFilePath);
+  const expiration = getTokenExpiration(credentials.UIPATH_ACCESS_TOKEN);
+  const outerThreshold = computeExpirationThreshold(ensureTokenValidityMinutes);
+  let tokens = {
+    accessToken: credentials.UIPATH_ACCESS_TOKEN,
+    refreshToken: credentials.UIPATH_REFRESH_TOKEN,
+    expiration,
+    lockReleaseFailed: false
+  };
+  const refreshToken = credentials.UIPATH_REFRESH_TOKEN;
+  if (expiration && expiration <= outerThreshold && refreshToken) {
+    const refreshed = await attemptRefresh({
+      absolutePath,
+      credentials,
+      accessToken: credentials.UIPATH_ACCESS_TOKEN,
+      refreshToken,
+      expiration,
+      ensureTokenValidityMinutes,
+      getFs,
+      loadEnvFile,
+      saveEnvFile,
+      refreshFn: refreshTokenFn,
+      resolveConfig,
+      loadBreaker,
+      saveBreaker,
+      clearBreaker,
+      globalHint
+    });
+    if (refreshed.kind === "terminal") {
+      return refreshed.status;
+    }
+    tokens = refreshed.tokens;
+  }
+  return buildFileStatus(tokens, credentials, globalHint);
+};
+async function resolveRobotEnforcedStatus(robotFallback) {
+  if (isEnvAuthEnabled()) {
+    throw new EnvAuthConfigError(`${ENV_AUTH_ENABLE_VAR}=true and ${ENFORCE_ROBOT_AUTH_VAR}=true ` + `are mutually exclusive. Unset one of them and re-run.`);
+  }
+  const robotCreds = await robotFallback({ force: true });
+  if (!robotCreds) {
+    return {
+      loginStatus: "Not logged in",
+      hint: `${ENFORCE_ROBOT_AUTH_VAR}=true but the UiPath Robot ` + `session is unavailable. Start and sign in to the Assistant, ` + `or unset ${ENFORCE_ROBOT_AUTH_VAR} to fall back to file or ` + `env-var authentication.`
+    };
+  }
+  return buildRobotStatus(robotCreds);
+}
+async function resolveBorrowedRobotStatus(robotFallback) {
+  const robotCreds = await robotFallback();
+  return robotCreds ? buildRobotStatus(robotCreds) : { loginStatus: "Not logged in" };
+}
+async function loadFileCredentials(loadEnvFile, absolutePath) {
+  let credentials;
+  try {
+    credentials = await loadEnvFile({ envPath: absolutePath });
+  } catch (error) {
+    if (isFileNotFoundError(error)) {
+      return { status: { loginStatus: "Not logged in" } };
+    }
+    throw error;
+  }
+  if (!credentials.UIPATH_ACCESS_TOKEN) {
+    return { status: { loginStatus: "Not logged in" } };
+  }
+  return { credentials };
+}
+async function getGlobalCredsHint(getFs, loadEnvFile, absolutePath, envFilePath) {
+  const fs = getFs();
+  const globalPath = fs.path.join(fs.env.homedir(), envFilePath);
+  if (absolutePath === globalPath)
+    return;
+  if (!await fs.exists(globalPath))
+    return;
+  try {
+    const globalCreds = await loadEnvFile({ envPath: globalPath });
+    if (!globalCreds.UIPATH_ACCESS_TOKEN)
+      return;
+    const globalExp = getTokenExpiration(globalCreds.UIPATH_ACCESS_TOKEN);
+    if (globalExp && globalExp <= new Date)
+      return;
+    return `Local credentials file at ${absolutePath} has expired credentials. Valid credentials exist in ${globalPath}. Remove the local file or run 'uip login' to re-authenticate.`;
+  } catch {
+    return;
+  }
+}
+function computeExpirationThreshold(ensureTokenValidityMinutes) {
+  return new Date(Date.now() + (ensureTokenValidityMinutes ?? 0) * 60 * 1000);
+}
+async function attemptRefresh(ctx) {
+  const shortCircuit = await circuitBreakerShortCircuit(ctx);
+  if (shortCircuit) {
+    return { kind: "terminal", status: shortCircuit };
+  }
+  let release;
+  try {
+    release = await ctx.getFs().acquireLock(ctx.absolutePath);
+  } catch (error) {
+    return {
+      kind: "terminal",
+      status: await lockAcquireFailureStatus(ctx, error)
+    };
+  }
+  let lockedFailure;
+  let lockReleaseFailed = false;
+  let success;
+  try {
+    const outcome = await runRefreshLocked({
+      absolutePath: ctx.absolutePath,
+      refreshToken: ctx.refreshToken,
+      customAuthority: ctx.credentials.UIPATH_URL,
+      ensureTokenValidityMinutes: ctx.ensureTokenValidityMinutes,
+      loadEnvFile: ctx.loadEnvFile,
+      saveEnvFile: ctx.saveEnvFile,
+      refreshFn: ctx.refreshFn,
+      resolveConfig: ctx.resolveConfig,
+      loadBreaker: ctx.loadBreaker,
+      saveBreaker: ctx.saveBreaker,
+      clearBreaker: ctx.clearBreaker
+    });
+    if (outcome.kind === "fail") {
+      lockedFailure = outcome.status;
+    } else {
+      success = outcome;
+    }
+  } finally {
+    try {
+      await release();
+    } catch {
+      lockReleaseFailed = true;
+    }
+  }
+  if (lockedFailure) {
+    const globalHint = await ctx.globalHint();
+    const base = globalHint ? { ...lockedFailure, loginStatus: "Expired", hint: globalHint } : lockedFailure;
+    return {
+      kind: "terminal",
+      status: lockReleaseFailed ? { ...base, lockReleaseFailed: true } : base
+    };
+  }
+  return {
+    kind: "refreshed",
+    tokens: {
+      accessToken: success?.accessToken,
+      refreshToken: success?.refreshToken,
+      expiration: success?.expiration,
+      tokenRefresh: success?.tokenRefresh,
+      persistenceWarning: success?.persistenceWarning,
+      lockReleaseFailed
+    }
+  };
+}
+async function buildFileStatus(tokens, credentials, globalHint) {
+  const result = {
+    loginStatus: tokens.expiration && tokens.expiration <= new Date ? "Expired" : "Logged in",
+    accessToken: tokens.accessToken,
+    refreshToken: tokens.refreshToken,
+    baseUrl: credentials.UIPATH_URL,
+    organizationName: credentials.UIPATH_ORGANIZATION_NAME,
+    organizationId: credentials.UIPATH_ORGANIZATION_ID,
+    tenantName: credentials.UIPATH_TENANT_NAME,
+    tenantId: credentials.UIPATH_TENANT_ID,
+    expiration: tokens.expiration,
+    source: "saved-login" /* SavedLogin */,
+    ...identityFields(tokens.accessToken, credentials),
+    ...tokens.persistenceWarning ? { hint: tokens.persistenceWarning, persistenceFailed: true } : {},
+    ...tokens.lockReleaseFailed ? { lockReleaseFailed: true } : {},
+    ...tokens.tokenRefresh ? { tokenRefresh: tokens.tokenRefresh } : {}
+  };
+  if (result.loginStatus === "Expired") {
+    const hint = await globalHint();
+    if (hint) {
+      result.hint = hint;
+    }
+  }
+  return result;
+}
+function identityFields(accessToken, credentials) {
+  const identity = resolveSessionIdentity(accessToken, parseAuthFlow(credentials[AUTH_FLOW_ENV_VAR]));
+  return identity ? { identity } : {};
+}
+function buildRobotStatus(robotCreds) {
+  const identity = resolveSessionIdentity(robotCreds.accessToken);
+  return {
+    loginStatus: "Logged in",
+    accessToken: robotCreds.accessToken,
+    baseUrl: robotCreds.baseUrl,
+    organizationName: robotCreds.organizationName,
+    organizationId: robotCreds.organizationId,
+    tenantName: robotCreds.tenantName,
+    tenantId: robotCreds.tenantId,
+    issuer: robotCreds.issuer,
+    expiration: getTokenExpiration(robotCreds.accessToken),
+    source: "robot" /* Robot */,
+    ...identity ? { identity } : {}
+  };
+}
+var isFileNotFoundError = (error) => {
+  if (!(error instanceof Object))
+    return false;
+  return error.code === "ENOENT";
+};
+async function circuitBreakerShortCircuit(ctx) {
+  const {
+    absolutePath,
+    refreshToken,
+    accessToken,
+    credentials,
+    expiration,
+    loadBreaker,
+    saveBreaker,
+    clearBreaker
+  } = ctx;
+  const fingerprint = await refreshTokenFingerprint(refreshToken);
+  const breaker = await loadBreaker(absolutePath).catch(() => ({}));
+  if (breaker.deadTokenFp && breaker.deadTokenFp !== fingerprint) {
+    await clearBreaker(absolutePath);
+    breaker.deadTokenFp = undefined;
+  }
+  const nowMs = Date.now();
+  const tokenIsDead = breaker.deadTokenFp === fingerprint;
+  const inBackoff = breaker.backoffUntilMs !== undefined && nowMs < breaker.backoffUntilMs;
+  if (!tokenIsDead && !inBackoff)
+    return;
+  const globalHint = await ctx.globalHint();
+  const suppressed = !shouldSurface(breaker, nowMs);
+  if (!suppressed) {
+    await saveBreaker(absolutePath, {
+      ...breaker,
+      lastSurfacedAtMs: nowMs
+    });
+  }
+  const deadHint = "Run 'uip login' to re-authenticate — the stored refresh token is invalid or expired. In a non-interactive context, authenticate with: uip login --client-id <id> --client-secret <secret> -t <tenant>.";
+  const backoffHint = "Token refresh is temporarily backed off after a recent network error and will retry automatically once the backoff window elapses.";
+  return {
+    loginStatus: globalHint ? "Expired" : "Refresh Failed",
+    ...globalHint ? {
+      accessToken,
+      refreshToken,
+      baseUrl: credentials.UIPATH_URL,
+      organizationName: credentials.UIPATH_ORGANIZATION_NAME,
+      organizationId: credentials.UIPATH_ORGANIZATION_ID,
+      tenantName: credentials.UIPATH_TENANT_NAME,
+      tenantId: credentials.UIPATH_TENANT_ID,
+      expiration,
+      source: "saved-login" /* SavedLogin */,
+      ...identityFields(accessToken, credentials)
+    } : {},
+    hint: globalHint ?? (tokenIsDead ? deadHint : backoffHint),
+    refreshCircuitOpen: true,
+    refreshTelemetrySuppressed: suppressed,
+    tokenRefresh: { attempted: false, success: false }
+  };
+}
+async function lockAcquireFailureStatus(ctx, error) {
+  const msg = errorMessage(error);
+  const globalHint = await ctx.globalHint();
+  if (globalHint) {
+    return {
+      loginStatus: "Expired",
+      accessToken: ctx.accessToken,
+      refreshToken: ctx.refreshToken,
+      baseUrl: ctx.credentials.UIPATH_URL,
+      organizationName: ctx.credentials.UIPATH_ORGANIZATION_NAME,
+      organizationId: ctx.credentials.UIPATH_ORGANIZATION_ID,
+      tenantName: ctx.credentials.UIPATH_TENANT_NAME,
+      tenantId: ctx.credentials.UIPATH_TENANT_ID,
+      expiration: ctx.expiration,
+      source: "saved-login" /* SavedLogin */,
+      ...identityFields(ctx.accessToken, ctx.credentials),
+      hint: globalHint,
+      tokenRefresh: {
+        attempted: false,
+        success: false,
+        errorMessage: `lock acquisition failed: ${msg}`
+      }
+    };
+  }
+  return {
+    loginStatus: "Refresh Failed",
+    hint: "Could not acquire the auth-file lock — too many concurrent `uip` processes, or a permission issue on the auth directory. Retry, or run 'uip login' to re-authenticate.",
+    tokenRefresh: {
+      attempted: false,
+      success: false,
+      errorMessage: `lock acquisition failed: ${msg}`
+    }
+  };
+}
+async function runRefreshLocked(inputs) {
+  const {
+    absolutePath,
+    refreshToken: callerRefreshToken,
+    customAuthority,
+    ensureTokenValidityMinutes,
+    loadEnvFile,
+    saveEnvFile,
+    refreshFn,
+    resolveConfig,
+    loadBreaker,
+    saveBreaker,
+    clearBreaker
+  } = inputs;
+  const expirationThreshold = computeExpirationThreshold(ensureTokenValidityMinutes);
+  let fresh;
+  try {
+    fresh = await loadEnvFile({ envPath: absolutePath });
+  } catch (error) {
+    return {
+      kind: "fail",
+      status: {
+        loginStatus: "Refresh Failed",
+        hint: "Could not read the auth file while refreshing. Retry, or run 'uip login' to re-authenticate.",
+        tokenRefresh: {
+          attempted: false,
+          success: false,
+          errorMessage: `auth file read failed: ${errorMessage(error)}`
+        }
+      }
+    };
+  }
+  const freshAccess = fresh.UIPATH_ACCESS_TOKEN;
+  const freshExp = freshAccess ? getTokenExpiration(freshAccess) : undefined;
+  if (freshAccess && freshExp && freshExp > expirationThreshold) {
+    await clearBreaker(absolutePath);
+    return {
+      kind: "ok",
+      accessToken: freshAccess,
+      refreshToken: fresh.UIPATH_REFRESH_TOKEN ?? callerRefreshToken,
+      expiration: freshExp,
+      tokenRefresh: { attempted: false, success: true }
+    };
+  }
+  const tokenForIdP = fresh.UIPATH_REFRESH_TOKEN ?? callerRefreshToken;
+  let refreshedAccess;
+  let refreshedRefresh;
+  try {
+    const config = await resolveConfig({ customAuthority });
+    const refreshed = await refreshFn({
+      refreshToken: tokenForIdP,
+      tokenEndpoint: config.tokenEndpoint,
+      clientId: config.clientId,
+      expectedAuthority: customAuthority
+    });
+    refreshedAccess = refreshed.accessToken;
+    refreshedRefresh = refreshed.refreshToken;
+  } catch (error) {
+    const isOAuthFailure = isTokenRefreshOAuthFailure(error);
+    const hint = isOAuthFailure ? "Run 'uip login' to re-authenticate — the stored refresh token is invalid or expired. In a non-interactive context, authenticate with: uip login --client-id <id> --client-secret <secret> -t <tenant>." : "Token refresh failed. Check your network connection, then retry or run 'uip login' to re-authenticate.";
+    const message = isOAuthFailure ? normalizeTokenRefreshFailure() : normalizeTokenRefreshUnavailableFailure();
+    const fp = await refreshTokenFingerprint(tokenForIdP);
+    if (isOAuthFailure) {
+      await saveBreaker(absolutePath, { deadTokenFp: fp });
+    } else {
+      const prior = await loadBreaker(absolutePath).catch(() => ({}));
+      const attempts = (prior.attempts ?? 0) + 1;
+      await saveBreaker(absolutePath, {
+        ...prior,
+        deadTokenFp: undefined,
+        attempts,
+        backoffUntilMs: Date.now() + nextBackoffMs(attempts)
+      });
+    }
+    return {
+      kind: "fail",
+      status: {
+        loginStatus: "Refresh Failed",
+        hint,
+        tokenRefresh: {
+          attempted: true,
+          success: false,
+          errorMessage: message
+        }
+      }
+    };
+  }
+  const refreshedExp = getTokenExpiration(refreshedAccess);
+  if (!refreshedExp || refreshedExp <= new Date) {
+    return {
+      kind: "fail",
+      status: {
+        loginStatus: "Refresh Failed",
+        hint: "The identity server returned an unusable token. Run 'uip login' to re-authenticate.",
+        tokenRefresh: {
+          attempted: true,
+          success: false,
+          errorMessage: "refreshed token has no valid expiration claim"
+        }
+      }
+    };
+  }
+  await clearBreaker(absolutePath);
+  try {
+    await saveEnvFile({
+      envPath: absolutePath,
+      data: {
+        UIPATH_ACCESS_TOKEN: refreshedAccess,
+        UIPATH_REFRESH_TOKEN: refreshedRefresh
+      },
+      merge: true
+    });
+    return {
+      kind: "ok",
+      accessToken: refreshedAccess,
+      refreshToken: refreshedRefresh,
+      expiration: refreshedExp,
+      tokenRefresh: { attempted: true, success: true }
+    };
+  } catch (error) {
+    const msg = errorMessage(error);
+    return {
+      kind: "ok",
+      accessToken: refreshedAccess,
+      refreshToken: refreshedRefresh,
+      expiration: refreshedExp,
+      persistenceWarning: `Access token refreshed in memory but could not be written to ${absolutePath}: ${msg}. The next CLI invocation will fail until the file can be updated — run 'uip login' to re-authenticate.`,
+      tokenRefresh: {
+        attempted: true,
+        success: true,
+        errorMessage: `persistence failed: ${msg}`
+      }
+    };
+  }
+}
+function normalizeTokenRefreshFailure() {
+  return "stored refresh token is invalid or expired";
+}
+function normalizeTokenRefreshUnavailableFailure() {
+  return "token refresh failed before authentication completed";
+}
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+// ../auth/src/authContext.ts
+var getAuthContext = async (options = {}) => {
+  const status = await getLoginStatusAsync({
+    ensureTokenValidityMinutes: options.ensureTokenValidityMinutes,
+    envFilePath: options.envFilePath
+  });
+  if (status.loginStatus !== "Logged in" || !status.baseUrl || !status.accessToken) {
+    throw new Error(status.hint ? `Not logged in. ${status.hint}` : "Not logged in. Run 'uip login' first.");
+  }
+  const tenantName = options.tenant ?? status.tenantName;
+  if (options.requireOrganizationId && !status.organizationId) {
+    throw new Error("Organization ID not available. Ensure you are logged in with an organization context.");
+  }
+  if (options.requireOrganizationName && !status.organizationName) {
+    throw new Error("Organization name not available. Ensure you are logged in with an organization context.");
+  }
+  if (options.requireTenantId && !status.tenantId) {
+    throw new Error("Tenant ID not available. Ensure UIPATH_TENANT_ID is set.");
+  }
+  if (options.requireTenantName && tenantName === undefined) {
+    throw new Error("Tenant not provided and UIPATH_TENANT_NAME not set. Run 'uip login' to select a tenant, or use 'uip login tenant set <tenant>' to switch tenants.");
+  }
+  return {
+    baseUrl: status.baseUrl,
+    accessToken: status.accessToken,
+    organizationId: status.organizationId,
+    organizationName: status.organizationName,
+    tenantId: status.tenantId,
+    tenantName
+  };
+};
+// ../auth/src/tenantSelection.ts
+var IDENTIFIER_STATUSES = new Set([400, 403, 404]);
+
+// ../auth/src/selectTenant.ts
+var TENANT_SELECTION_REQUIRED_CODE = "TENANT_SELECTION_REQUIRED";
+var INVALID_TENANT_CODE = "INVALID_TENANT";
+var TENANT_SELECTION_CODES = new Set([
+  TENANT_SELECTION_REQUIRED_CODE,
+  INVALID_TENANT_CODE
+]);
+// src/solution-auth.ts
+async function getSolutionAuthContext(options) {
+  const ctx = await getAuthContext({
+    tenant: options.tenant,
+    ensureTokenValidityMinutes: options.loginValidity ?? 10,
+    envFilePath: options.envFilePath,
+    requireOrganizationId: true,
+    requireTenantName: true
+  });
+  const organizationId = ctx.organizationId;
+  const tenantName = ctx.tenantName;
+  const basePath = `${ctx.baseUrl}/${organizationId}/${tenantName}/automationsolutions_`;
+  return {
+    accessToken: ctx.accessToken,
+    basePath,
+    organizationId,
+    tenantName
+  };
+}
+
+export { getLoginStatusAsync, getAuthContext, getSolutionAuthContext };
+
+//# debugId=23A570105E3E594664756E2164756E21