@uipath/uipath-typescript 1.1.0 → 1.1.2

package/dist/index.mjs

@@ -3883,6 +3883,16 @@ class ExecutionContext {
  * Checks if code is running in a browser environment
  */
 const isBrowser = typeof window !== 'undefined' && typeof window.document !== 'undefined';
+const isInActionCenter = isBrowser && window.self != window.top && window.location.href.includes('source=ActionCenter');
+
+/**
+ * Session storage keys used by the auth module
+ */
+const AUTH_STORAGE_KEYS = {
+    TOKEN_PREFIX: 'uipath_sdk_user_token-',
+    OAUTH_CONTEXT: 'uipath_sdk_oauth_context',
+    CODE_VERIFIER: 'uipath_sdk_code_verifier',
+};
 
 // Type guard to check if config has OAuth credentials
 function hasOAuthConfig(config) {
@@ -4190,6 +4200,102 @@ function getErrorDetails(error) {
     };
 }
 
+var ActionCenterEventNames;
+(function (ActionCenterEventNames) {
+    ActionCenterEventNames["TOKENREFRESHED"] = "AC.tokenRefreshed";
+    ActionCenterEventNames["REFRESHTOKEN"] = "AC.refreshToken";
+})(ActionCenterEventNames || (ActionCenterEventNames = {}));
+
+const AUTHENTICATION_TIMEOUT = 8000;
+class ActionCenterTokenManager {
+    constructor(config, onTokenRefreshed) {
+        this.config = config;
+        this.onTokenRefreshed = onTokenRefreshed;
+        this.parentOrigin = new URLSearchParams(window.location.search).get('basedomain');
+        this.refreshPromise = null;
+    }
+    async refreshAccessToken(tokenInfo) {
+        if (!this.isTokenExpired(tokenInfo)) {
+            return tokenInfo.token;
+        }
+        if (this.refreshPromise) {
+            return this.refreshPromise;
+        }
+        this.refreshPromise = new Promise((resolve, reject) => {
+            const content = {
+                clientId: this.config.clientId,
+                scope: this.config.scope,
+            };
+            this.sendMessageToParent(ActionCenterEventNames.REFRESHTOKEN, content);
+            const messageListener = (event) => {
+                if (event.origin !== this.parentOrigin)
+                    return;
+                if (event.data?.eventType !== ActionCenterEventNames.TOKENREFRESHED)
+                    return;
+                clearTimeout(timer);
+                if (event.data?.content?.token) {
+                    const { accessToken, expiresAt } = event.data.content.token;
+                    this.onTokenRefreshed({ token: accessToken, type: 'secret', expiresAt });
+                    resolve(accessToken);
+                }
+                else {
+                    reject(new AuthenticationError({
+                        message: 'Failed to fetch access token',
+                        statusCode: HttpStatus.UNAUTHORIZED,
+                    }));
+                }
+                this.refreshPromise = null;
+                this.cleanup(messageListener);
+            };
+            const timer = setTimeout(() => {
+                reject(new AuthenticationError({
+                    message: 'Failed to fetch access token',
+                    statusCode: HttpStatus.UNAUTHORIZED,
+                }));
+                this.refreshPromise = null;
+                this.cleanup(messageListener);
+            }, AUTHENTICATION_TIMEOUT);
+            window.addEventListener('message', messageListener);
+        });
+        return this.refreshPromise;
+    }
+    isTokenExpired(tokenInfo) {
+        if (!tokenInfo?.expiresAt) {
+            return true;
+        }
+        return new Date() >= tokenInfo.expiresAt;
+    }
+    sendMessageToParent(eventType, content) {
+        if (window.parent && this.isValidOrigin(this.parentOrigin)) {
+            try {
+                window.parent.postMessage({ eventType, content }, this.parentOrigin);
+            }
+            catch (error) {
+                console.warn('Failed to send message to Action Center', JSON.stringify(error));
+            }
+        }
+    }
+    cleanup(messageListener) {
+        window.removeEventListener('message', messageListener);
+    }
+    isValidOrigin(origin) {
+        const ALLOWED_ORIGINS = ['https://alpha.uipath.com', 'https://staging.uipath.com', 'https://cloud.uipath.com'];
+        if (!origin) {
+            return false;
+        }
+        if (ALLOWED_ORIGINS.includes(origin)) {
+            return true;
+        }
+        try {
+            const url = new URL(origin);
+            return url.hostname === 'localhost';
+        }
+        catch {
+            return false;
+        }
+    }
+}
+
 /**
  * TokenManager is responsible for managing authentication tokens.
  * It provides token operations for a specific client ID.
@@ -4207,8 +4313,12 @@ class TokenManager {
         this.executionContext = executionContext;
         this.config = config;
         this.isOAuth = isOAuth;
-        this.STORAGE_KEY_PREFIX = 'uipath_sdk_user_token-';
         this.refreshPromise = null;
+        this.actionCenterTokenManager = null;
+        if (isInActionCenter) {
+            this.actionCenterTokenManager = new ActionCenterTokenManager(config, (tokenInfo) => this.setToken(tokenInfo));
+            this.isOAuth = false;
+        }
     }
     /**
      * Checks if a token is expired
@@ -4236,6 +4346,9 @@ class TokenManager {
                 message: 'No authentication token available. Make sure to initialize the SDK first.'
             });
         }
+        if (this.actionCenterTokenManager) {
+            return await this.actionCenterTokenManager.refreshAccessToken(tokenInfo);
+        }
         // For secret-based tokens, they never expire
         if (tokenInfo.type === 'secret') {
             return tokenInfo.token;
@@ -4261,7 +4374,7 @@ class TokenManager {
      * Gets the storage key for this TokenManager instance
      */
     _getStorageKey() {
-        return `${this.STORAGE_KEY_PREFIX}${this.config.clientId}`;
+        return `${AUTH_STORAGE_KEYS.TOKEN_PREFIX}${this.config.clientId}`;
     }
     /**
      * Loads token from session storage if available
@@ -4380,9 +4493,6 @@ class TokenManager {
     clearToken() {
         this.currentToken = undefined;
         this.executionContext.set('tokenInfo', undefined);
-        const headers = this.executionContext.getHeaders();
-        delete headers['Authorization'];
-        this.executionContext.setHeaders(headers);
         // Remove from session storage if this is an OAuth token
         if (isBrowser && this.isOAuth) {
             try {
@@ -4398,10 +4508,6 @@ class TokenManager {
      */
     _updateExecutionContext(tokenInfo) {
         this.executionContext.set('tokenInfo', tokenInfo);
-        // Update authorization header
-        this.executionContext.setHeaders({
-            'Authorization': `Bearer ${tokenInfo.token}`
-        });
     }
     /**
      * Refreshes the access token using the stored refresh token.
@@ -4605,8 +4711,15 @@ const IDENTITY_ENDPOINTS = {
 
 class AuthService {
     constructor(config, executionContext) {
-        // Check if we should use stored OAuth context instead of provided config
-        const storedContext = AuthService.getStoredOAuthContext();
+        // Only use stored OAuth context when completing an active callback (URL has ?code=).
+        // If stored context exists but we're NOT in a callback, it's stale from a
+        // failed/abandoned flow (e.g. scope mismatch, invalid redirect URI) and must
+        // be cleared so the fresh config takes effect.
+        const isCallback = AuthService.isInOAuthCallback();
+        const storedContext = isCallback ? AuthService.getStoredOAuthContext() : null;
+        if (!isCallback) {
+            AuthService._clearStoredOAuthContext();
+        }
         const effectiveConfig = storedContext ? AuthService._mergeConfigWithContext(config, storedContext) : config;
         this.config = effectiveConfig;
         const isOAuth = hasOAuthConfig(effectiveConfig);
@@ -4623,7 +4736,7 @@ class AuthService {
             return false;
         const urlParams = new URLSearchParams(window.location.search);
         const code = urlParams.get('code');
-        const hasCodeVerifier = sessionStorage.getItem('uipath_sdk_code_verifier');
+        const hasCodeVerifier = sessionStorage.getItem(AUTH_STORAGE_KEYS.CODE_VERIFIER);
         return !!(code && hasCodeVerifier);
     }
     /**
@@ -4634,7 +4747,7 @@ class AuthService {
             return null;
         }
         try {
-            const stored = sessionStorage.getItem('uipath_sdk_oauth_context');
+            const stored = sessionStorage.getItem(AUTH_STORAGE_KEYS.OAUTH_CONTEXT);
             if (!stored) {
                 return null;
             }
@@ -4642,17 +4755,33 @@ class AuthService {
             // Validate required fields
             if (!context.codeVerifier || !context.clientId || !context.redirectUri ||
                 !context.baseUrl || !context.orgName) {
-                sessionStorage.removeItem('uipath_sdk_oauth_context');
+                sessionStorage.removeItem(AUTH_STORAGE_KEYS.OAUTH_CONTEXT);
                 return null;
             }
             return context;
         }
         catch (error) {
-            sessionStorage.removeItem('uipath_sdk_oauth_context');
+            sessionStorage.removeItem(AUTH_STORAGE_KEYS.OAUTH_CONTEXT);
             console.warn('Failed to parse stored OAuth context from session storage', error);
             return null;
         }
     }
+    /**
+     * Clear stale OAuth context from session storage.
+     * Called when there is no active OAuth callback, meaning any stored context
+     * is left over from a failed or abandoned flow.
+     */
+    static _clearStoredOAuthContext() {
+        if (!isBrowser)
+            return;
+        try {
+            sessionStorage.removeItem(AUTH_STORAGE_KEYS.OAUTH_CONTEXT);
+            sessionStorage.removeItem(AUTH_STORAGE_KEYS.CODE_VERIFIER);
+        }
+        catch {
+            // Ignore storage errors
+        }
+    }
     /**
      * Merges provided config with stored OAuth context, prioritizing stored values
      */
@@ -4723,7 +4852,7 @@ class AuthService {
             throw new Error('OAuth flow is only supported in browser environments');
         }
         // Check if we have a stored code verifier indicating we're in an OAuth flow
-        const codeVerifier = sessionStorage.getItem('uipath_sdk_code_verifier');
+        const codeVerifier = sessionStorage.getItem(AUTH_STORAGE_KEYS.CODE_VERIFIER);
         const isInOAuthFlow = codeVerifier !== null;
         const urlParams = new URLSearchParams(window.location.search);
         const code = urlParams.get('code');
@@ -4732,7 +4861,7 @@ class AuthService {
             // We're expecting a callback - validate parameters
             if (!code) {
                 // Clear stored state on error
-                sessionStorage.removeItem('uipath_sdk_code_verifier');
+                sessionStorage.removeItem(AUTH_STORAGE_KEYS.CODE_VERIFIER);
                 throw new Error('Authorization code missing in OAuth callback');
             }
             // Validate the authorization code format before using it
@@ -4740,7 +4869,7 @@ class AuthService {
             const codePattern = /^[A-Za-z0-9\-._~+/]+=*$/;
             if (!codePattern.test(code)) {
                 // Clear stored state on error
-                sessionStorage.removeItem('uipath_sdk_code_verifier');
+                sessionStorage.removeItem(AUTH_STORAGE_KEYS.CODE_VERIFIER);
                 throw new Error('Invalid authorization code format');
             }
             // Authorization code is present and validated, so we can exchange it for a token.
@@ -4781,6 +4910,24 @@ class AuthService {
     hasValidToken() {
         return this.tokenManager.hasValidToken();
     }
+    /**
+     * Clears all authentication state including tokens and stored OAuth context.
+     */
+    logout() {
+        this.tokenManager.clearToken();
+        // Clear OAuth context from session storage. These are normally cleaned up in _handleOAuthCallback after a successful
+        // token exchange, but if a user calls logout() while an OAuth flow is
+        // mid-redirect (before callback completes), they'd be left behind.
+        if (isBrowser) {
+            try {
+                sessionStorage.removeItem(AUTH_STORAGE_KEYS.OAUTH_CONTEXT);
+                sessionStorage.removeItem(AUTH_STORAGE_KEYS.CODE_VERIFIER);
+            }
+            catch (error) {
+                console.warn('Failed to clear OAuth context from session storage', error);
+            }
+        }
+    }
     /**
      * Get the current token
      */
@@ -4912,8 +5059,8 @@ class AuthService {
             tenantName: this.config.tenantName,
             scope
         };
-        sessionStorage.setItem('uipath_sdk_oauth_context', JSON.stringify(oauthContext));
-        sessionStorage.setItem('uipath_sdk_code_verifier', codeVerifier);
+        sessionStorage.setItem(AUTH_STORAGE_KEYS.OAUTH_CONTEXT, JSON.stringify(oauthContext));
+        sessionStorage.setItem(AUTH_STORAGE_KEYS.CODE_VERIFIER, codeVerifier);
         const authUrl = this.getAuthorizationUrl({
             clientId,
             redirectUri,
@@ -4923,7 +5070,7 @@ class AuthService {
         window.location.href = authUrl;
     }
     async _handleOAuthCallback(code, clientId, redirectUri) {
-        const codeVerifier = sessionStorage.getItem('uipath_sdk_code_verifier');
+        const codeVerifier = sessionStorage.getItem(AUTH_STORAGE_KEYS.CODE_VERIFIER);
         if (!codeVerifier) {
             throw new Error('Code verifier not found in session storage. Authentication may have been interrupted.');
         }
@@ -4934,8 +5081,8 @@ class AuthService {
             codeVerifier
         });
         // Clear OAuth context and code verifier after successful token exchange
-        sessionStorage.removeItem('uipath_sdk_oauth_context');
-        sessionStorage.removeItem('uipath_sdk_code_verifier');
+        sessionStorage.removeItem(AUTH_STORAGE_KEYS.OAUTH_CONTEXT);
+        sessionStorage.removeItem(AUTH_STORAGE_KEYS.CODE_VERIFIER);
         const url = new URL(window.location.href);
         url.searchParams.delete('code');
         url.searchParams.delete('state');
@@ -4943,14 +5090,42 @@ class AuthService {
     }
 }
 
+/**
+ * Check if config has all required base fields
+ */
+function hasRequiredBaseFields(config) {
+    return Boolean(config.baseUrl && config.orgName && config.tenantName);
+}
+/**
+ * Check if config has exactly one authentication method (secret XOR oauth)
+ * Returns true if exactly one auth method is present, false otherwise
+ */
+function hasValidAuthConfig(config) {
+    const hasSecret = hasSecretConfig(config);
+    const hasOAuth = hasOAuthConfig(config);
+    // XOR: exactly one auth method, not both, not neither
+    return hasSecret !== hasOAuth;
+}
 function validateConfig(config) {
-    if (!config.baseUrl || !config.orgName || !config.tenantName) {
+    if (!hasRequiredBaseFields(config)) {
         throw new Error('Missing required configuration: baseUrl, orgName, and tenantName are required');
     }
-    if (!hasSecretConfig(config) && !hasOAuthConfig(config)) {
-        throw new Error('Invalid configuration: must provide either secret or (clientId, redirectUri, and scope)');
+    const hasSecret = hasSecretConfig(config);
+    const hasOAuth = hasOAuthConfig(config);
+    if (hasSecret && hasOAuth) {
+        throw new Error('Invalid configuration: cannot provide both secret and OAuth credentials. Choose one authentication method.');
+    }
+    if (!hasSecret && !hasOAuth) {
+        throw new Error('Invalid configuration: must provide either secret or OAuth credentials (clientId, redirectUri, and scope)');
     }
 }
+/**
+ * Check if partial config has all required fields for a complete SDK config
+ * Requires base fields and exactly one authentication method (secret XOR oauth)
+ */
+function isCompleteConfig(config) {
+    return hasRequiredBaseFields(config) && hasValidAuthConfig(config);
+}
 function normalizeBaseUrl(url) {
     return url.endsWith('/') ? url.slice(0, -1) : url;
 }
@@ -4961,7 +5136,7 @@ function normalizeBaseUrl(url) {
 // Connection string placeholder that will be replaced during build
 const CONNECTION_STRING = "InstrumentationKey=a6efa11d-1feb-4508-9738-e13e12dcae5e;IngestionEndpoint=https://westeurope-5.in.applicationinsights.azure.com/;LiveEndpoint=https://westeurope.livediagnostics.monitor.azure.com/;ApplicationId=7c58eb1c-9581-4ba6-839e-11725848a037";
 // SDK Version placeholder 
-const SDK_VERSION = "1.1.0";
+const SDK_VERSION = "1.1.2";
 const VERSION = "Version";
 const SERVICE = "Service";
 const CLOUD_ORGANIZATION_NAME = "CloudOrganizationName";
@@ -5290,19 +5465,71 @@ class SDKInternalsRegistry {
     }
 }
 
-var _UiPath_config, _UiPath_authService, _UiPath_initialized;
+/**
+ * UiPath meta tag names for runtime configuration.
+ *
+ * These meta tags are injected at deployment time by the Apps Service
+ * to configure SDK authentication and asset resolution in production.
+ */
+var UiPathMetaTags;
+(function (UiPathMetaTags) {
+    // SDK/OAuth configuration
+    UiPathMetaTags["CLIENT_ID"] = "uipath:client-id";
+    UiPathMetaTags["SCOPE"] = "uipath:scope";
+    UiPathMetaTags["ORG_NAME"] = "uipath:org-name";
+    UiPathMetaTags["TENANT_NAME"] = "uipath:tenant-name";
+    UiPathMetaTags["BASE_URL"] = "uipath:base-url";
+    UiPathMetaTags["REDIRECT_URI"] = "uipath:redirect-uri";
+    // Asset resolution and routing
+    UiPathMetaTags["CDN_BASE"] = "uipath:cdn-base";
+    UiPathMetaTags["APP_BASE"] = "uipath:app-base";
+})(UiPathMetaTags || (UiPathMetaTags = {}));
+
+/**
+ * Get the content of a meta tag by name.
+ * Returns undefined if not in browser environment or meta tag is not found.
+ */
+function getMetaTagContent(name) {
+    if (!isBrowser)
+        return undefined;
+    return document.querySelector(`meta[name="${name}"]`)?.content;
+}
+/**
+ * Load configuration from HTML meta tags injected at runtime.
+ * These meta tags are injected by @uipath/coded-apps during build
+ * or by the Apps service during deployment.
+ *
+ * Returns partial config with values found, or null if no meta tags present.
+ */
+function loadFromMetaTags() {
+    if (!isBrowser)
+        return null;
+    const config = {
+        clientId: getMetaTagContent(UiPathMetaTags.CLIENT_ID),
+        scope: getMetaTagContent(UiPathMetaTags.SCOPE),
+        orgName: getMetaTagContent(UiPathMetaTags.ORG_NAME),
+        tenantName: getMetaTagContent(UiPathMetaTags.TENANT_NAME),
+        baseUrl: getMetaTagContent(UiPathMetaTags.BASE_URL),
+        redirectUri: getMetaTagContent(UiPathMetaTags.REDIRECT_URI),
+    };
+    const hasAnyValue = Object.values(config).some(Boolean);
+    return hasAnyValue ? config : null;
+}
+
+var _UiPath_instances, _UiPath_config, _UiPath_authService, _UiPath_initialized, _UiPath_partialConfig, _UiPath_initializeWithConfig, _UiPath_loadConfig;
 /**
  * UiPath - Core SDK class for authentication and configuration management.
  *
  * Handles authentication, configuration, and provides access to SDK internals
  * for service instantiation in the modular pattern.
  *
+ * Supports two usage patterns:
+ * 1. Full config in constructor — for server-side or explicit configuration
+ * 2. No config / partial config — loads from meta tags injected by @uipath/coded-apps plugin
+ *
  * @example
  * ```typescript
- * // Modular pattern
- * import { UiPath } from '@uipath/uipath-typescript/core';
- * import { Entities } from '@uipath/uipath-typescript/entities';
- *
+ * // Explicit config
  * const sdk = new UiPath({
  *   baseUrl: 'https://cloud.uipath.com',
  *   orgName: 'myorg',
@@ -5311,70 +5538,47 @@ var _UiPath_config, _UiPath_authService, _UiPath_initialized;
  *   redirectUri: 'http://localhost:3000/callback',
  *   scope: 'OR.Users OR.Robots'
  * });
- *
  * await sdk.initialize();
+ * ```
  *
- * const entitiesService = new Entities(sdk);
- * const allEntities = await entitiesService.getAll();
+ * @example
+ * ```typescript
+ * // Auto-load from meta tags (coded apps)
+ * const sdk = new UiPath();
+ * await sdk.initialize();
  * ```
  */
 let UiPath$1 = class UiPath {
     constructor(config) {
+        _UiPath_instances.add(this);
         // Private fields - true runtime privacy, not visible via Object.keys()
         _UiPath_config.set(this, void 0);
         _UiPath_authService.set(this, void 0);
         _UiPath_initialized.set(this, false);
-        // Validate and normalize the configuration
-        validateConfig(config);
-        const hasSecretAuth = hasSecretConfig(config);
-        const hasOAuthAuth = hasOAuthConfig(config);
-        // Initialize core components
-        const internalConfig = new UiPathConfig({
-            baseUrl: normalizeBaseUrl(config.baseUrl),
-            orgName: config.orgName,
-            tenantName: config.tenantName,
-            secret: hasSecretAuth ? config.secret : undefined,
-            clientId: hasOAuthAuth ? config.clientId : undefined,
-            redirectUri: hasOAuthAuth ? config.redirectUri : undefined,
-            scope: hasOAuthAuth ? config.scope : undefined
-        });
-        const executionContext = new ExecutionContext();
-        __classPrivateFieldSet(this, _UiPath_authService, new AuthService(internalConfig, executionContext), "f");
-        __classPrivateFieldSet(this, _UiPath_config, internalConfig, "f");
-        // Store internals in SDKInternalsRegistry (not visible on instance)
-        SDKInternalsRegistry.set(this, {
-            config: internalConfig,
-            context: executionContext,
-            tokenManager: __classPrivateFieldGet(this, _UiPath_authService, "f").getTokenManager()
-        });
-        // Expose read-only config for user convenience
-        this.config = {
-            baseUrl: internalConfig.baseUrl,
-            orgName: internalConfig.orgName,
-            tenantName: internalConfig.tenantName
-        };
-        // Initialize telemetry with SDK configuration
-        telemetryClient.initialize({
-            baseUrl: config.baseUrl,
-            orgName: config.orgName,
-            tenantName: config.tenantName,
-            clientId: hasOAuthAuth ? config.clientId : undefined,
-            redirectUri: hasOAuthAuth ? config.redirectUri : undefined
-        });
-        // Track SDK initialization
-        trackEvent('Sdk.Auth');
-        // Auto-initialize for secret-based auth
-        if (hasSecretAuth) {
-            __classPrivateFieldGet(this, _UiPath_authService, "f").authenticateWithSecret(config.secret);
-            __classPrivateFieldSet(this, _UiPath_initialized, true, "f");
+        _UiPath_partialConfig.set(this, void 0);
+        // Load configuration from meta tags
+        const configFromMetaTags = loadFromMetaTags();
+        // Merge configuration: constructor config overrides meta tags
+        const mergedConfig = config ? { ...configFromMetaTags, ...config } : configFromMetaTags;
+        if (mergedConfig && isCompleteConfig(mergedConfig)) {
+            __classPrivateFieldGet(this, _UiPath_instances, "m", _UiPath_initializeWithConfig).call(this, mergedConfig);
+        }
+        else if (config) {
+            __classPrivateFieldSet(this, _UiPath_partialConfig, config, "f");
         }
     }
     /**
      * Initialize the SDK based on the provided configuration.
      * This method handles both OAuth flow initiation and completion automatically.
      * For secret-based authentication, initialization is automatic and this returns immediately.
+     * If no config was provided in constructor, loads from meta tags.
      */
     async initialize() {
+        // Load config from meta tags if not provided in constructor
+        if (!__classPrivateFieldGet(this, _UiPath_config, "f")) {
+            const loadedConfig = __classPrivateFieldGet(this, _UiPath_instances, "m", _UiPath_loadConfig).call(this);
+            __classPrivateFieldGet(this, _UiPath_instances, "m", _UiPath_initializeWithConfig).call(this, loadedConfig);
+        }
         // For secret-based auth, it's already initialized in constructor
         if (hasSecretConfig(__classPrivateFieldGet(this, _UiPath_config, "f"))) {
             return;
@@ -5421,6 +5625,11 @@ let UiPath$1 = class UiPath {
         if (!AuthService.isInOAuthCallback()) {
             throw new Error('Not in OAuth callback state. Call initialize() first to start OAuth flow.');
         }
+        // Load config if not yet initialized
+        if (!__classPrivateFieldGet(this, _UiPath_config, "f")) {
+            const loadedConfig = __classPrivateFieldGet(this, _UiPath_instances, "m", _UiPath_loadConfig).call(this);
+            __classPrivateFieldGet(this, _UiPath_instances, "m", _UiPath_initializeWithConfig).call(this, loadedConfig);
+        }
         try {
             const success = await __classPrivateFieldGet(this, _UiPath_authService, "f").authenticate(__classPrivateFieldGet(this, _UiPath_config, "f"));
             if (success && this.isAuthenticated()) {
@@ -5438,16 +5647,85 @@ let UiPath$1 = class UiPath {
      * Check if the user is authenticated (has valid token)
      */
     isAuthenticated() {
-        return __classPrivateFieldGet(this, _UiPath_authService, "f").hasValidToken();
+        return __classPrivateFieldGet(this, _UiPath_authService, "f")?.hasValidToken() ?? false;
     }
     /**
      * Get the current authentication token
      */
     getToken() {
-        return __classPrivateFieldGet(this, _UiPath_authService, "f").getToken();
+        return __classPrivateFieldGet(this, _UiPath_authService, "f")?.getToken();
+    }
+    /**
+     * Logout from the SDK, clearing all authentication state.
+     * After calling this method, the user will need to re-initialize to authenticate again.
+     */
+    logout() {
+        // Secret-based auth has no session to end — skip silently
+        if (__classPrivateFieldGet(this, _UiPath_config, "f") && hasSecretConfig(__classPrivateFieldGet(this, _UiPath_config, "f"))) {
+            return;
+        }
+        __classPrivateFieldGet(this, _UiPath_authService, "f")?.logout();
+        __classPrivateFieldSet(this, _UiPath_initialized, false, "f");
     }
 };
-_UiPath_config = new WeakMap(), _UiPath_authService = new WeakMap(), _UiPath_initialized = new WeakMap();
+_UiPath_config = new WeakMap(), _UiPath_authService = new WeakMap(), _UiPath_initialized = new WeakMap(), _UiPath_partialConfig = new WeakMap(), _UiPath_instances = new WeakSet(), _UiPath_initializeWithConfig = function _UiPath_initializeWithConfig(config) {
+    // Validate and normalize the configuration
+    validateConfig(config);
+    const hasSecretAuth = hasSecretConfig(config);
+    const hasOAuthAuth = hasOAuthConfig(config);
+    // Initialize core components
+    const internalConfig = new UiPathConfig({
+        baseUrl: normalizeBaseUrl(config.baseUrl),
+        orgName: config.orgName,
+        tenantName: config.tenantName,
+        secret: hasSecretAuth ? config.secret : undefined,
+        clientId: hasOAuthAuth ? config.clientId : undefined,
+        redirectUri: hasOAuthAuth ? config.redirectUri : undefined,
+        scope: hasOAuthAuth ? config.scope : undefined
+    });
+    const executionContext = new ExecutionContext();
+    __classPrivateFieldSet(this, _UiPath_authService, new AuthService(internalConfig, executionContext), "f");
+    __classPrivateFieldSet(this, _UiPath_config, internalConfig, "f");
+    // Store internals in SDKInternalsRegistry (not visible on instance)
+    SDKInternalsRegistry.set(this, {
+        config: internalConfig,
+        context: executionContext,
+        tokenManager: __classPrivateFieldGet(this, _UiPath_authService, "f").getTokenManager()
+    });
+    // Expose read-only config for user convenience
+    this.config = {
+        baseUrl: internalConfig.baseUrl,
+        orgName: internalConfig.orgName,
+        tenantName: internalConfig.tenantName
+    };
+    // Initialize telemetry with SDK configuration
+    telemetryClient.initialize({
+        baseUrl: config.baseUrl,
+        orgName: config.orgName,
+        tenantName: config.tenantName,
+        clientId: hasOAuthAuth ? config.clientId : undefined,
+        redirectUri: hasOAuthAuth ? config.redirectUri : undefined
+    });
+    // Track SDK initialization
+    trackEvent('Sdk.Auth');
+    /** Auto-initialize for secret-based auth
+     * When viewed in Action Center, initialize tokenInfo with empty token. When an sdk call is made Action Center passes the token to sdk.
+     */
+    if (hasSecretAuth || isInActionCenter) {
+        __classPrivateFieldGet(this, _UiPath_authService, "f").authenticateWithSecret(config.secret ?? '');
+        __classPrivateFieldSet(this, _UiPath_initialized, true, "f");
+    }
+}, _UiPath_loadConfig = function _UiPath_loadConfig() {
+    // Load from meta tags
+    const metaConfig = loadFromMetaTags();
+    // Merge with any partial config from constructor (constructor overrides meta tags)
+    const merged = { ...metaConfig, ...__classPrivateFieldGet(this, _UiPath_partialConfig, "f") };
+    if (!isCompleteConfig(merged)) {
+        throw new Error('UiPath SDK configuration not found. ' +
+            'Ensure @uipath/coded-apps plugin is set up in your bundler to inject configuration during development and build.');
+    }
+    return merged;
+};
 
 /**
  * Type guards for error response types
@@ -5726,15 +6004,6 @@ class ApiClient {
     async getDefaultHeaders() {
         // Get headers from execution context first
         const contextHeaders = this.executionContext.getHeaders();
-        // If Authorization header is already set in context, use that
-        if (contextHeaders['Authorization']) {
-            return {
-                ...contextHeaders,
-                'Content-Type': CONTENT_TYPES.JSON,
-                ...this.defaultHeaders,
-                ...this.clientConfig.headers
-            };
-        }
         const token = await this.getValidToken();
         return {
             ...contextHeaders,
@@ -11078,4 +11347,79 @@ const UserSettingsMap = {
     ...CommonFieldMap
 };
 
-export { APP_NAME, AgentMap, AssetValueScope, AssetValueType, AuthenticationError, AuthorizationError, BucketOptions, CLOUD_CLIENT_ID, CLOUD_ORGANIZATION_NAME, CLOUD_REDIRECT_URI, CLOUD_ROLE_NAME, CLOUD_TENANT_NAME, CLOUD_URL, CONNECTION_STRING, CitationErrorType, ConversationMap, DEFAULT_ITEMS_FIELD, DEFAULT_PAGE_SIZE, DEFAULT_TOTAL_COUNT_FIELD, DataDirectionType, DebugMode, EntityFieldDataType, EntityType, ErrorType, EscalationActionType, EscalationRecipientScope, EscalationTriggerType, ExchangeMap, FeedbackRating, FieldDisplayType, HttpStatus, InputStreamSpeechSensitivity, InterruptType, JobPriority, JobState, JobType, JoinType, MAX_PAGE_SIZE, MessageMap, MessageRole, NetworkError, NotFoundError, PackageSourceType, PackageType, ProcessIncidentSeverity, ProcessIncidentStatus, ProcessIncidentType, RateLimitError, ReferenceType, RemoteControlAccess, RobotSize, SDK_LOGGER_NAME, SDK_RUN_EVENT, SDK_SERVICE_NAME, SDK_VERSION, SERVICE, SLADurationUnit, ServerError, SortOrder, StageTaskType, StartStrategy, StopStrategy, TargetFramework, TaskActivityType, TaskPriority, TaskSlaCriteria, TaskSlaStatus, TaskSourceName, TaskStatus, TaskType, UNKNOWN$1 as UNKNOWN, UiPath, UiPathError, UserSettingsMap, VERSION, ValidationError, createAgentWithMethods, createCaseInstanceWithMethods, createConversationWithMethods, createEntityWithMethods, createProcessInstanceWithMethods, createProcessWithMethods, createTaskWithMethods, getErrorDetails, getLimitedPageSize, isAuthenticationError, isAuthorizationError, isNetworkError, isNotFoundError, isRateLimitError, isServerError, isUiPathError, isValidationError, telemetryClient, track, trackEvent };
+/**
+ * Asset resolution utilities for UiPath Coded Apps
+ *
+ * These helpers enable developers to write code that works identically
+ * in local development and production environments.
+ *
+ * Values are read from meta tags injected at deployment:
+ * - <meta name="uipath:cdn-base" content="https://cdn.example.com/appId/folder">
+ * - <meta name="uipath:app-base" content="/org/apps_/.../public">
+ */
+/**
+ * Resolves an asset path to the CDN URL (if available)
+ *
+ * In local development: returns path as-is (loads from local dev server)
+ * In production: prepends CDN base URL from meta tag
+ *
+ * @param path - The asset path (e.g., './assets/logo.png' or '/assets/logo.png')
+ * @returns The resolved asset URL
+ *
+ * @example
+ * ```tsx
+ * import { getAsset } from '@uipath/uipath-typescript';
+ * import logoPath from './assets/logo.png';
+ *
+ * function MyComponent() {
+ *   return <img src={getAsset(logoPath)} alt="Logo" />;
+ * }
+ * ```
+ */
+function getAsset(path) {
+    // If path is already an absolute URL, return as-is
+    if (path.startsWith('http://') || path.startsWith('https://')) {
+        return path;
+    }
+    const cdnBase = getMetaTagContent(UiPathMetaTags.CDN_BASE);
+    if (!cdnBase)
+        return path;
+    // Normalize CDN base URL to remove trailing slash
+    const normalizedCdnBase = normalizeBaseUrl(cdnBase);
+    // Normalize path to ensure it starts with /
+    let normalizedPath = path;
+    if (normalizedPath.startsWith('./')) {
+        normalizedPath = normalizedPath.substring(1); // ./assets -> /assets
+    }
+    else if (!normalizedPath.startsWith('/')) {
+        normalizedPath = '/' + normalizedPath; // assets -> /assets
+    }
+    return normalizedCdnBase + normalizedPath;
+}
+/**
+ * Returns the app base path for router configuration
+ *
+ * In local development: returns '/'
+ * In production: returns the deployed app path from meta tag
+ *
+ * @returns The app base path
+ *
+ * @example
+ * ```tsx
+ * import { getAppBase } from '@uipath/uipath-typescript';
+ * import { BrowserRouter } from 'react-router-dom';
+ *
+ * function App() {
+ *   return (
+ *     <BrowserRouter basename={getAppBase()}>
+ *       {/* routes *\/}
+ *     </BrowserRouter>
+ *   );
+ * }
+ * ```
+ */
+function getAppBase() {
+    return getMetaTagContent(UiPathMetaTags.APP_BASE) || '/';
+}
+
+export { APP_NAME, AgentMap, AssetValueScope, AssetValueType, AuthenticationError, AuthorizationError, BucketOptions, CLOUD_CLIENT_ID, CLOUD_ORGANIZATION_NAME, CLOUD_REDIRECT_URI, CLOUD_ROLE_NAME, CLOUD_TENANT_NAME, CLOUD_URL, CONNECTION_STRING, CitationErrorType, ConversationMap, DEFAULT_ITEMS_FIELD, DEFAULT_PAGE_SIZE, DEFAULT_TOTAL_COUNT_FIELD, DataDirectionType, DebugMode, EntityFieldDataType, EntityType, ErrorType, EscalationActionType, EscalationRecipientScope, EscalationTriggerType, ExchangeMap, FeedbackRating, FieldDisplayType, HttpStatus, InputStreamSpeechSensitivity, InterruptType, JobPriority, JobState, JobType, JoinType, MAX_PAGE_SIZE, MessageMap, MessageRole, NetworkError, NotFoundError, PackageSourceType, PackageType, ProcessIncidentSeverity, ProcessIncidentStatus, ProcessIncidentType, RateLimitError, ReferenceType, RemoteControlAccess, RobotSize, SDK_LOGGER_NAME, SDK_RUN_EVENT, SDK_SERVICE_NAME, SDK_VERSION, SERVICE, SLADurationUnit, ServerError, SortOrder, StageTaskType, StartStrategy, StopStrategy, TargetFramework, TaskActivityType, TaskPriority, TaskSlaCriteria, TaskSlaStatus, TaskSourceName, TaskStatus, TaskType, UNKNOWN$1 as UNKNOWN, UiPath, UiPathError, UiPathMetaTags, UserSettingsMap, VERSION, ValidationError, createAgentWithMethods, createCaseInstanceWithMethods, createConversationWithMethods, createEntityWithMethods, createProcessInstanceWithMethods, createProcessWithMethods, createTaskWithMethods, getAppBase, getAsset, getErrorDetails, getLimitedPageSize, isAuthenticationError, isAuthorizationError, isNetworkError, isNotFoundError, isRateLimitError, isServerError, isUiPathError, isValidationError, loadFromMetaTags, telemetryClient, track, trackEvent };