@uipath/uipath-typescript 1.1.0 → 1.1.2

package/dist/index.umd.js

@@ -3887,6 +3887,16 @@
      * Checks if code is running in a browser environment
      */
     const isBrowser = typeof window !== 'undefined' && typeof window.document !== 'undefined';
+    const isInActionCenter = isBrowser && window.self != window.top && window.location.href.includes('source=ActionCenter');
+
+    /**
+     * Session storage keys used by the auth module
+     */
+    const AUTH_STORAGE_KEYS = {
+        TOKEN_PREFIX: 'uipath_sdk_user_token-',
+        OAUTH_CONTEXT: 'uipath_sdk_oauth_context',
+        CODE_VERIFIER: 'uipath_sdk_code_verifier',
+    };
 
     // Type guard to check if config has OAuth credentials
     function hasOAuthConfig(config) {
@@ -4194,6 +4204,102 @@
         };
     }
 
+    var ActionCenterEventNames;
+    (function (ActionCenterEventNames) {
+        ActionCenterEventNames["TOKENREFRESHED"] = "AC.tokenRefreshed";
+        ActionCenterEventNames["REFRESHTOKEN"] = "AC.refreshToken";
+    })(ActionCenterEventNames || (ActionCenterEventNames = {}));
+
+    const AUTHENTICATION_TIMEOUT = 8000;
+    class ActionCenterTokenManager {
+        constructor(config, onTokenRefreshed) {
+            this.config = config;
+            this.onTokenRefreshed = onTokenRefreshed;
+            this.parentOrigin = new URLSearchParams(window.location.search).get('basedomain');
+            this.refreshPromise = null;
+        }
+        async refreshAccessToken(tokenInfo) {
+            if (!this.isTokenExpired(tokenInfo)) {
+                return tokenInfo.token;
+            }
+            if (this.refreshPromise) {
+                return this.refreshPromise;
+            }
+            this.refreshPromise = new Promise((resolve, reject) => {
+                const content = {
+                    clientId: this.config.clientId,
+                    scope: this.config.scope,
+                };
+                this.sendMessageToParent(ActionCenterEventNames.REFRESHTOKEN, content);
+                const messageListener = (event) => {
+                    if (event.origin !== this.parentOrigin)
+                        return;
+                    if (event.data?.eventType !== ActionCenterEventNames.TOKENREFRESHED)
+                        return;
+                    clearTimeout(timer);
+                    if (event.data?.content?.token) {
+                        const { accessToken, expiresAt } = event.data.content.token;
+                        this.onTokenRefreshed({ token: accessToken, type: 'secret', expiresAt });
+                        resolve(accessToken);
+                    }
+                    else {
+                        reject(new AuthenticationError({
+                            message: 'Failed to fetch access token',
+                            statusCode: HttpStatus.UNAUTHORIZED,
+                        }));
+                    }
+                    this.refreshPromise = null;
+                    this.cleanup(messageListener);
+                };
+                const timer = setTimeout(() => {
+                    reject(new AuthenticationError({
+                        message: 'Failed to fetch access token',
+                        statusCode: HttpStatus.UNAUTHORIZED,
+                    }));
+                    this.refreshPromise = null;
+                    this.cleanup(messageListener);
+                }, AUTHENTICATION_TIMEOUT);
+                window.addEventListener('message', messageListener);
+            });
+            return this.refreshPromise;
+        }
+        isTokenExpired(tokenInfo) {
+            if (!tokenInfo?.expiresAt) {
+                return true;
+            }
+            return new Date() >= tokenInfo.expiresAt;
+        }
+        sendMessageToParent(eventType, content) {
+            if (window.parent && this.isValidOrigin(this.parentOrigin)) {
+                try {
+                    window.parent.postMessage({ eventType, content }, this.parentOrigin);
+                }
+                catch (error) {
+                    console.warn('Failed to send message to Action Center', JSON.stringify(error));
+                }
+            }
+        }
+        cleanup(messageListener) {
+            window.removeEventListener('message', messageListener);
+        }
+        isValidOrigin(origin) {
+            const ALLOWED_ORIGINS = ['https://alpha.uipath.com', 'https://staging.uipath.com', 'https://cloud.uipath.com'];
+            if (!origin) {
+                return false;
+            }
+            if (ALLOWED_ORIGINS.includes(origin)) {
+                return true;
+            }
+            try {
+                const url = new URL(origin);
+                return url.hostname === 'localhost';
+            }
+            catch {
+                return false;
+            }
+        }
+    }
+
     /**
      * TokenManager is responsible for managing authentication tokens.
      * It provides token operations for a specific client ID.
@@ -4211,8 +4317,12 @@
             this.executionContext = executionContext;
             this.config = config;
             this.isOAuth = isOAuth;
-            this.STORAGE_KEY_PREFIX = 'uipath_sdk_user_token-';
             this.refreshPromise = null;
+            this.actionCenterTokenManager = null;
+            if (isInActionCenter) {
+                this.actionCenterTokenManager = new ActionCenterTokenManager(config, (tokenInfo) => this.setToken(tokenInfo));
+                this.isOAuth = false;
+            }
         }
         /**
          * Checks if a token is expired
@@ -4240,6 +4350,9 @@
                     message: 'No authentication token available. Make sure to initialize the SDK first.'
                 });
             }
+            if (this.actionCenterTokenManager) {
+                return await this.actionCenterTokenManager.refreshAccessToken(tokenInfo);
+            }
             // For secret-based tokens, they never expire
             if (tokenInfo.type === 'secret') {
                 return tokenInfo.token;
@@ -4265,7 +4378,7 @@
          * Gets the storage key for this TokenManager instance
          */
         _getStorageKey() {
-            return `${this.STORAGE_KEY_PREFIX}${this.config.clientId}`;
+            return `${AUTH_STORAGE_KEYS.TOKEN_PREFIX}${this.config.clientId}`;
         }
         /**
          * Loads token from session storage if available
@@ -4384,9 +4497,6 @@
         clearToken() {
             this.currentToken = undefined;
             this.executionContext.set('tokenInfo', undefined);
-            const headers = this.executionContext.getHeaders();
-            delete headers['Authorization'];
-            this.executionContext.setHeaders(headers);
             // Remove from session storage if this is an OAuth token
             if (isBrowser && this.isOAuth) {
                 try {
@@ -4402,10 +4512,6 @@
          */
         _updateExecutionContext(tokenInfo) {
             this.executionContext.set('tokenInfo', tokenInfo);
-            // Update authorization header
-            this.executionContext.setHeaders({
-                'Authorization': `Bearer ${tokenInfo.token}`
-            });
         }
         /**
          * Refreshes the access token using the stored refresh token.
@@ -4609,8 +4715,15 @@
 
     class AuthService {
         constructor(config, executionContext) {
-            // Check if we should use stored OAuth context instead of provided config
-            const storedContext = AuthService.getStoredOAuthContext();
+            // Only use stored OAuth context when completing an active callback (URL has ?code=).
+            // If stored context exists but we're NOT in a callback, it's stale from a
+            // failed/abandoned flow (e.g. scope mismatch, invalid redirect URI) and must
+            // be cleared so the fresh config takes effect.
+            const isCallback = AuthService.isInOAuthCallback();
+            const storedContext = isCallback ? AuthService.getStoredOAuthContext() : null;
+            if (!isCallback) {
+                AuthService._clearStoredOAuthContext();
+            }
             const effectiveConfig = storedContext ? AuthService._mergeConfigWithContext(config, storedContext) : config;
             this.config = effectiveConfig;
             const isOAuth = hasOAuthConfig(effectiveConfig);
@@ -4627,7 +4740,7 @@
                 return false;
             const urlParams = new URLSearchParams(window.location.search);
             const code = urlParams.get('code');
-            const hasCodeVerifier = sessionStorage.getItem('uipath_sdk_code_verifier');
+            const hasCodeVerifier = sessionStorage.getItem(AUTH_STORAGE_KEYS.CODE_VERIFIER);
             return !!(code && hasCodeVerifier);
         }
         /**
@@ -4638,7 +4751,7 @@
                 return null;
             }
             try {
-                const stored = sessionStorage.getItem('uipath_sdk_oauth_context');
+                const stored = sessionStorage.getItem(AUTH_STORAGE_KEYS.OAUTH_CONTEXT);
                 if (!stored) {
                     return null;
                 }
@@ -4646,17 +4759,33 @@
                 // Validate required fields
                 if (!context.codeVerifier || !context.clientId || !context.redirectUri ||
                     !context.baseUrl || !context.orgName) {
-                    sessionStorage.removeItem('uipath_sdk_oauth_context');
+                    sessionStorage.removeItem(AUTH_STORAGE_KEYS.OAUTH_CONTEXT);
                     return null;
                 }
                 return context;
             }
             catch (error) {
-                sessionStorage.removeItem('uipath_sdk_oauth_context');
+                sessionStorage.removeItem(AUTH_STORAGE_KEYS.OAUTH_CONTEXT);
                 console.warn('Failed to parse stored OAuth context from session storage', error);
                 return null;
             }
         }
+        /**
+         * Clear stale OAuth context from session storage.
+         * Called when there is no active OAuth callback, meaning any stored context
+         * is left over from a failed or abandoned flow.
+         */
+        static _clearStoredOAuthContext() {
+            if (!isBrowser)
+                return;
+            try {
+                sessionStorage.removeItem(AUTH_STORAGE_KEYS.OAUTH_CONTEXT);
+                sessionStorage.removeItem(AUTH_STORAGE_KEYS.CODE_VERIFIER);
+            }
+            catch {
+                // Ignore storage errors
+            }
+        }
         /**
          * Merges provided config with stored OAuth context, prioritizing stored values
          */
@@ -4727,7 +4856,7 @@
                 throw new Error('OAuth flow is only supported in browser environments');
             }
             // Check if we have a stored code verifier indicating we're in an OAuth flow
-            const codeVerifier = sessionStorage.getItem('uipath_sdk_code_verifier');
+            const codeVerifier = sessionStorage.getItem(AUTH_STORAGE_KEYS.CODE_VERIFIER);
             const isInOAuthFlow = codeVerifier !== null;
             const urlParams = new URLSearchParams(window.location.search);
             const code = urlParams.get('code');
@@ -4736,7 +4865,7 @@
                 // We're expecting a callback - validate parameters
                 if (!code) {
                     // Clear stored state on error
-                    sessionStorage.removeItem('uipath_sdk_code_verifier');
+                    sessionStorage.removeItem(AUTH_STORAGE_KEYS.CODE_VERIFIER);
                     throw new Error('Authorization code missing in OAuth callback');
                 }
                 // Validate the authorization code format before using it
@@ -4744,7 +4873,7 @@
                 const codePattern = /^[A-Za-z0-9\-._~+/]+=*$/;
                 if (!codePattern.test(code)) {
                     // Clear stored state on error
-                    sessionStorage.removeItem('uipath_sdk_code_verifier');
+                    sessionStorage.removeItem(AUTH_STORAGE_KEYS.CODE_VERIFIER);
                     throw new Error('Invalid authorization code format');
                 }
                 // Authorization code is present and validated, so we can exchange it for a token.
@@ -4785,6 +4914,24 @@
         hasValidToken() {
             return this.tokenManager.hasValidToken();
         }
+        /**
+         * Clears all authentication state including tokens and stored OAuth context.
+         */
+        logout() {
+            this.tokenManager.clearToken();
+            // Clear OAuth context from session storage. These are normally cleaned up in _handleOAuthCallback after a successful
+            // token exchange, but if a user calls logout() while an OAuth flow is
+            // mid-redirect (before callback completes), they'd be left behind.
+            if (isBrowser) {
+                try {
+                    sessionStorage.removeItem(AUTH_STORAGE_KEYS.OAUTH_CONTEXT);
+                    sessionStorage.removeItem(AUTH_STORAGE_KEYS.CODE_VERIFIER);
+                }
+                catch (error) {
+                    console.warn('Failed to clear OAuth context from session storage', error);
+                }
+            }
+        }
         /**
          * Get the current token
          */
@@ -4916,8 +5063,8 @@
                 tenantName: this.config.tenantName,
                 scope
             };
-            sessionStorage.setItem('uipath_sdk_oauth_context', JSON.stringify(oauthContext));
-            sessionStorage.setItem('uipath_sdk_code_verifier', codeVerifier);
+            sessionStorage.setItem(AUTH_STORAGE_KEYS.OAUTH_CONTEXT, JSON.stringify(oauthContext));
+            sessionStorage.setItem(AUTH_STORAGE_KEYS.CODE_VERIFIER, codeVerifier);
             const authUrl = this.getAuthorizationUrl({
                 clientId,
                 redirectUri,
@@ -4927,7 +5074,7 @@
             window.location.href = authUrl;
         }
         async _handleOAuthCallback(code, clientId, redirectUri) {
-            const codeVerifier = sessionStorage.getItem('uipath_sdk_code_verifier');
+            const codeVerifier = sessionStorage.getItem(AUTH_STORAGE_KEYS.CODE_VERIFIER);
             if (!codeVerifier) {
                 throw new Error('Code verifier not found in session storage. Authentication may have been interrupted.');
             }
@@ -4938,8 +5085,8 @@
                 codeVerifier
             });
             // Clear OAuth context and code verifier after successful token exchange
-            sessionStorage.removeItem('uipath_sdk_oauth_context');
-            sessionStorage.removeItem('uipath_sdk_code_verifier');
+            sessionStorage.removeItem(AUTH_STORAGE_KEYS.OAUTH_CONTEXT);
+            sessionStorage.removeItem(AUTH_STORAGE_KEYS.CODE_VERIFIER);
             const url = new URL(window.location.href);
             url.searchParams.delete('code');
             url.searchParams.delete('state');
@@ -4947,14 +5094,42 @@
         }
     }
 
+    /**
+     * Check if config has all required base fields
+     */
+    function hasRequiredBaseFields(config) {
+        return Boolean(config.baseUrl && config.orgName && config.tenantName);
+    }
+    /**
+     * Check if config has exactly one authentication method (secret XOR oauth)
+     * Returns true if exactly one auth method is present, false otherwise
+     */
+    function hasValidAuthConfig(config) {
+        const hasSecret = hasSecretConfig(config);
+        const hasOAuth = hasOAuthConfig(config);
+        // XOR: exactly one auth method, not both, not neither
+        return hasSecret !== hasOAuth;
+    }
     function validateConfig(config) {
-        if (!config.baseUrl || !config.orgName || !config.tenantName) {
+        if (!hasRequiredBaseFields(config)) {
             throw new Error('Missing required configuration: baseUrl, orgName, and tenantName are required');
         }
-        if (!hasSecretConfig(config) && !hasOAuthConfig(config)) {
-            throw new Error('Invalid configuration: must provide either secret or (clientId, redirectUri, and scope)');
+        const hasSecret = hasSecretConfig(config);
+        const hasOAuth = hasOAuthConfig(config);
+        if (hasSecret && hasOAuth) {
+            throw new Error('Invalid configuration: cannot provide both secret and OAuth credentials. Choose one authentication method.');
+        }
+        if (!hasSecret && !hasOAuth) {
+            throw new Error('Invalid configuration: must provide either secret or OAuth credentials (clientId, redirectUri, and scope)');
         }
     }
+    /**
+     * Check if partial config has all required fields for a complete SDK config
+     * Requires base fields and exactly one authentication method (secret XOR oauth)
+     */
+    function isCompleteConfig(config) {
+        return hasRequiredBaseFields(config) && hasValidAuthConfig(config);
+    }
     function normalizeBaseUrl(url) {
         return url.endsWith('/') ? url.slice(0, -1) : url;
     }
@@ -8720,7 +8895,7 @@
     // Connection string placeholder that will be replaced during build
     const CONNECTION_STRING = "InstrumentationKey=a6efa11d-1feb-4508-9738-e13e12dcae5e;IngestionEndpoint=https://westeurope-5.in.applicationinsights.azure.com/;LiveEndpoint=https://westeurope.livediagnostics.monitor.azure.com/;ApplicationId=7c58eb1c-9581-4ba6-839e-11725848a037";
     // SDK Version placeholder 
-    const SDK_VERSION = "1.1.0";
+    const SDK_VERSION = "1.1.2";
     const VERSION = "Version";
     const SERVICE = "Service";
     const CLOUD_ORGANIZATION_NAME = "CloudOrganizationName";
@@ -9049,19 +9224,71 @@
         }
     }
 
-    var _UiPath_config, _UiPath_authService, _UiPath_initialized;
+    /**
+     * UiPath meta tag names for runtime configuration.
+     *
+     * These meta tags are injected at deployment time by the Apps Service
+     * to configure SDK authentication and asset resolution in production.
+     */
+    exports.UiPathMetaTags = void 0;
+    (function (UiPathMetaTags) {
+        // SDK/OAuth configuration
+        UiPathMetaTags["CLIENT_ID"] = "uipath:client-id";
+        UiPathMetaTags["SCOPE"] = "uipath:scope";
+        UiPathMetaTags["ORG_NAME"] = "uipath:org-name";
+        UiPathMetaTags["TENANT_NAME"] = "uipath:tenant-name";
+        UiPathMetaTags["BASE_URL"] = "uipath:base-url";
+        UiPathMetaTags["REDIRECT_URI"] = "uipath:redirect-uri";
+        // Asset resolution and routing
+        UiPathMetaTags["CDN_BASE"] = "uipath:cdn-base";
+        UiPathMetaTags["APP_BASE"] = "uipath:app-base";
+    })(exports.UiPathMetaTags || (exports.UiPathMetaTags = {}));
+
+    /**
+     * Get the content of a meta tag by name.
+     * Returns undefined if not in browser environment or meta tag is not found.
+     */
+    function getMetaTagContent(name) {
+        if (!isBrowser)
+            return undefined;
+        return document.querySelector(`meta[name="${name}"]`)?.content;
+    }
+    /**
+     * Load configuration from HTML meta tags injected at runtime.
+     * These meta tags are injected by @uipath/coded-apps during build
+     * or by the Apps service during deployment.
+     *
+     * Returns partial config with values found, or null if no meta tags present.
+     */
+    function loadFromMetaTags() {
+        if (!isBrowser)
+            return null;
+        const config = {
+            clientId: getMetaTagContent(exports.UiPathMetaTags.CLIENT_ID),
+            scope: getMetaTagContent(exports.UiPathMetaTags.SCOPE),
+            orgName: getMetaTagContent(exports.UiPathMetaTags.ORG_NAME),
+            tenantName: getMetaTagContent(exports.UiPathMetaTags.TENANT_NAME),
+            baseUrl: getMetaTagContent(exports.UiPathMetaTags.BASE_URL),
+            redirectUri: getMetaTagContent(exports.UiPathMetaTags.REDIRECT_URI),
+        };
+        const hasAnyValue = Object.values(config).some(Boolean);
+        return hasAnyValue ? config : null;
+    }
+
+    var _UiPath_instances, _UiPath_config, _UiPath_authService, _UiPath_initialized, _UiPath_partialConfig, _UiPath_initializeWithConfig, _UiPath_loadConfig;
     /**
      * UiPath - Core SDK class for authentication and configuration management.
      *
      * Handles authentication, configuration, and provides access to SDK internals
      * for service instantiation in the modular pattern.
      *
+     * Supports two usage patterns:
+     * 1. Full config in constructor — for server-side or explicit configuration
+     * 2. No config / partial config — loads from meta tags injected by @uipath/coded-apps plugin
+     *
      * @example
      * ```typescript
-     * // Modular pattern
-     * import { UiPath } from '@uipath/uipath-typescript/core';
-     * import { Entities } from '@uipath/uipath-typescript/entities';
-     *
+     * // Explicit config
      * const sdk = new UiPath({
      *   baseUrl: 'https://cloud.uipath.com',
      *   orgName: 'myorg',
@@ -9070,70 +9297,47 @@
      *   redirectUri: 'http://localhost:3000/callback',
      *   scope: 'OR.Users OR.Robots'
      * });
-     *
      * await sdk.initialize();
+     * ```
      *
-     * const entitiesService = new Entities(sdk);
-     * const allEntities = await entitiesService.getAll();
+     * @example
+     * ```typescript
+     * // Auto-load from meta tags (coded apps)
+     * const sdk = new UiPath();
+     * await sdk.initialize();
      * ```
      */
     let UiPath$1 = class UiPath {
         constructor(config) {
+            _UiPath_instances.add(this);
             // Private fields - true runtime privacy, not visible via Object.keys()
             _UiPath_config.set(this, void 0);
             _UiPath_authService.set(this, void 0);
             _UiPath_initialized.set(this, false);
-            // Validate and normalize the configuration
-            validateConfig(config);
-            const hasSecretAuth = hasSecretConfig(config);
-            const hasOAuthAuth = hasOAuthConfig(config);
-            // Initialize core components
-            const internalConfig = new UiPathConfig({
-                baseUrl: normalizeBaseUrl(config.baseUrl),
-                orgName: config.orgName,
-                tenantName: config.tenantName,
-                secret: hasSecretAuth ? config.secret : undefined,
-                clientId: hasOAuthAuth ? config.clientId : undefined,
-                redirectUri: hasOAuthAuth ? config.redirectUri : undefined,
-                scope: hasOAuthAuth ? config.scope : undefined
-            });
-            const executionContext = new ExecutionContext();
-            __classPrivateFieldSet(this, _UiPath_authService, new AuthService(internalConfig, executionContext), "f");
-            __classPrivateFieldSet(this, _UiPath_config, internalConfig, "f");
-            // Store internals in SDKInternalsRegistry (not visible on instance)
-            SDKInternalsRegistry.set(this, {
-                config: internalConfig,
-                context: executionContext,
-                tokenManager: __classPrivateFieldGet(this, _UiPath_authService, "f").getTokenManager()
-            });
-            // Expose read-only config for user convenience
-            this.config = {
-                baseUrl: internalConfig.baseUrl,
-                orgName: internalConfig.orgName,
-                tenantName: internalConfig.tenantName
-            };
-            // Initialize telemetry with SDK configuration
-            telemetryClient.initialize({
-                baseUrl: config.baseUrl,
-                orgName: config.orgName,
-                tenantName: config.tenantName,
-                clientId: hasOAuthAuth ? config.clientId : undefined,
-                redirectUri: hasOAuthAuth ? config.redirectUri : undefined
-            });
-            // Track SDK initialization
-            trackEvent('Sdk.Auth');
-            // Auto-initialize for secret-based auth
-            if (hasSecretAuth) {
-                __classPrivateFieldGet(this, _UiPath_authService, "f").authenticateWithSecret(config.secret);
-                __classPrivateFieldSet(this, _UiPath_initialized, true, "f");
+            _UiPath_partialConfig.set(this, void 0);
+            // Load configuration from meta tags
+            const configFromMetaTags = loadFromMetaTags();
+            // Merge configuration: constructor config overrides meta tags
+            const mergedConfig = config ? { ...configFromMetaTags, ...config } : configFromMetaTags;
+            if (mergedConfig && isCompleteConfig(mergedConfig)) {
+                __classPrivateFieldGet(this, _UiPath_instances, "m", _UiPath_initializeWithConfig).call(this, mergedConfig);
+            }
+            else if (config) {
+                __classPrivateFieldSet(this, _UiPath_partialConfig, config, "f");
             }
         }
         /**
          * Initialize the SDK based on the provided configuration.
          * This method handles both OAuth flow initiation and completion automatically.
          * For secret-based authentication, initialization is automatic and this returns immediately.
+         * If no config was provided in constructor, loads from meta tags.
          */
         async initialize() {
+            // Load config from meta tags if not provided in constructor
+            if (!__classPrivateFieldGet(this, _UiPath_config, "f")) {
+                const loadedConfig = __classPrivateFieldGet(this, _UiPath_instances, "m", _UiPath_loadConfig).call(this);
+                __classPrivateFieldGet(this, _UiPath_instances, "m", _UiPath_initializeWithConfig).call(this, loadedConfig);
+            }
             // For secret-based auth, it's already initialized in constructor
             if (hasSecretConfig(__classPrivateFieldGet(this, _UiPath_config, "f"))) {
                 return;
@@ -9180,6 +9384,11 @@
             if (!AuthService.isInOAuthCallback()) {
                 throw new Error('Not in OAuth callback state. Call initialize() first to start OAuth flow.');
             }
+            // Load config if not yet initialized
+            if (!__classPrivateFieldGet(this, _UiPath_config, "f")) {
+                const loadedConfig = __classPrivateFieldGet(this, _UiPath_instances, "m", _UiPath_loadConfig).call(this);
+                __classPrivateFieldGet(this, _UiPath_instances, "m", _UiPath_initializeWithConfig).call(this, loadedConfig);
+            }
             try {
                 const success = await __classPrivateFieldGet(this, _UiPath_authService, "f").authenticate(__classPrivateFieldGet(this, _UiPath_config, "f"));
                 if (success && this.isAuthenticated()) {
@@ -9197,16 +9406,85 @@
          * Check if the user is authenticated (has valid token)
          */
         isAuthenticated() {
-            return __classPrivateFieldGet(this, _UiPath_authService, "f").hasValidToken();
+            return __classPrivateFieldGet(this, _UiPath_authService, "f")?.hasValidToken() ?? false;
         }
         /**
          * Get the current authentication token
          */
         getToken() {
-            return __classPrivateFieldGet(this, _UiPath_authService, "f").getToken();
+            return __classPrivateFieldGet(this, _UiPath_authService, "f")?.getToken();
         }
+        /**
+         * Logout from the SDK, clearing all authentication state.
+         * After calling this method, the user will need to re-initialize to authenticate again.
+         */
+        logout() {
+            // Secret-based auth has no session to end — skip silently
+            if (__classPrivateFieldGet(this, _UiPath_config, "f") && hasSecretConfig(__classPrivateFieldGet(this, _UiPath_config, "f"))) {
+                return;
+            }
+            __classPrivateFieldGet(this, _UiPath_authService, "f")?.logout();
+            __classPrivateFieldSet(this, _UiPath_initialized, false, "f");
+        }
+    };
+    _UiPath_config = new WeakMap(), _UiPath_authService = new WeakMap(), _UiPath_initialized = new WeakMap(), _UiPath_partialConfig = new WeakMap(), _UiPath_instances = new WeakSet(), _UiPath_initializeWithConfig = function _UiPath_initializeWithConfig(config) {
+        // Validate and normalize the configuration
+        validateConfig(config);
+        const hasSecretAuth = hasSecretConfig(config);
+        const hasOAuthAuth = hasOAuthConfig(config);
+        // Initialize core components
+        const internalConfig = new UiPathConfig({
+            baseUrl: normalizeBaseUrl(config.baseUrl),
+            orgName: config.orgName,
+            tenantName: config.tenantName,
+            secret: hasSecretAuth ? config.secret : undefined,
+            clientId: hasOAuthAuth ? config.clientId : undefined,
+            redirectUri: hasOAuthAuth ? config.redirectUri : undefined,
+            scope: hasOAuthAuth ? config.scope : undefined
+        });
+        const executionContext = new ExecutionContext();
+        __classPrivateFieldSet(this, _UiPath_authService, new AuthService(internalConfig, executionContext), "f");
+        __classPrivateFieldSet(this, _UiPath_config, internalConfig, "f");
+        // Store internals in SDKInternalsRegistry (not visible on instance)
+        SDKInternalsRegistry.set(this, {
+            config: internalConfig,
+            context: executionContext,
+            tokenManager: __classPrivateFieldGet(this, _UiPath_authService, "f").getTokenManager()
+        });
+        // Expose read-only config for user convenience
+        this.config = {
+            baseUrl: internalConfig.baseUrl,
+            orgName: internalConfig.orgName,
+            tenantName: internalConfig.tenantName
+        };
+        // Initialize telemetry with SDK configuration
+        telemetryClient.initialize({
+            baseUrl: config.baseUrl,
+            orgName: config.orgName,
+            tenantName: config.tenantName,
+            clientId: hasOAuthAuth ? config.clientId : undefined,
+            redirectUri: hasOAuthAuth ? config.redirectUri : undefined
+        });
+        // Track SDK initialization
+        trackEvent('Sdk.Auth');
+        /** Auto-initialize for secret-based auth
+         * When viewed in Action Center, initialize tokenInfo with empty token. When an sdk call is made Action Center passes the token to sdk.
+         */
+        if (hasSecretAuth || isInActionCenter) {
+            __classPrivateFieldGet(this, _UiPath_authService, "f").authenticateWithSecret(config.secret ?? '');
+            __classPrivateFieldSet(this, _UiPath_initialized, true, "f");
+        }
+    }, _UiPath_loadConfig = function _UiPath_loadConfig() {
+        // Load from meta tags
+        const metaConfig = loadFromMetaTags();
+        // Merge with any partial config from constructor (constructor overrides meta tags)
+        const merged = { ...metaConfig, ...__classPrivateFieldGet(this, _UiPath_partialConfig, "f") };
+        if (!isCompleteConfig(merged)) {
+            throw new Error('UiPath SDK configuration not found. ' +
+                'Ensure @uipath/coded-apps plugin is set up in your bundler to inject configuration during development and build.');
+        }
+        return merged;
     };
-    _UiPath_config = new WeakMap(), _UiPath_authService = new WeakMap(), _UiPath_initialized = new WeakMap();
 
     /**
      * Type guards for error response types
@@ -9485,15 +9763,6 @@
         async getDefaultHeaders() {
             // Get headers from execution context first
             const contextHeaders = this.executionContext.getHeaders();
-            // If Authorization header is already set in context, use that
-            if (contextHeaders['Authorization']) {
-                return {
-                    ...contextHeaders,
-                    'Content-Type': CONTENT_TYPES.JSON,
-                    ...this.defaultHeaders,
-                    ...this.clientConfig.headers
-                };
-            }
             const token = await this.getValidToken();
             return {
                 ...contextHeaders,
@@ -14837,6 +15106,81 @@
         ...CommonFieldMap
     };
 
+    /**
+     * Asset resolution utilities for UiPath Coded Apps
+     *
+     * These helpers enable developers to write code that works identically
+     * in local development and production environments.
+     *
+     * Values are read from meta tags injected at deployment:
+     * - <meta name="uipath:cdn-base" content="https://cdn.example.com/appId/folder">
+     * - <meta name="uipath:app-base" content="/org/apps_/.../public">
+     */
+    /**
+     * Resolves an asset path to the CDN URL (if available)
+     *
+     * In local development: returns path as-is (loads from local dev server)
+     * In production: prepends CDN base URL from meta tag
+     *
+     * @param path - The asset path (e.g., './assets/logo.png' or '/assets/logo.png')
+     * @returns The resolved asset URL
+     *
+     * @example
+     * ```tsx
+     * import { getAsset } from '@uipath/uipath-typescript';
+     * import logoPath from './assets/logo.png';
+     *
+     * function MyComponent() {
+     *   return <img src={getAsset(logoPath)} alt="Logo" />;
+     * }
+     * ```
+     */
+    function getAsset(path) {
+        // If path is already an absolute URL, return as-is
+        if (path.startsWith('http://') || path.startsWith('https://')) {
+            return path;
+        }
+        const cdnBase = getMetaTagContent(exports.UiPathMetaTags.CDN_BASE);
+        if (!cdnBase)
+            return path;
+        // Normalize CDN base URL to remove trailing slash
+        const normalizedCdnBase = normalizeBaseUrl(cdnBase);
+        // Normalize path to ensure it starts with /
+        let normalizedPath = path;
+        if (normalizedPath.startsWith('./')) {
+            normalizedPath = normalizedPath.substring(1); // ./assets -> /assets
+        }
+        else if (!normalizedPath.startsWith('/')) {
+            normalizedPath = '/' + normalizedPath; // assets -> /assets
+        }
+        return normalizedCdnBase + normalizedPath;
+    }
+    /**
+     * Returns the app base path for router configuration
+     *
+     * In local development: returns '/'
+     * In production: returns the deployed app path from meta tag
+     *
+     * @returns The app base path
+     *
+     * @example
+     * ```tsx
+     * import { getAppBase } from '@uipath/uipath-typescript';
+     * import { BrowserRouter } from 'react-router-dom';
+     *
+     * function App() {
+     *   return (
+     *     <BrowserRouter basename={getAppBase()}>
+     *       {/* routes *\/}
+     *     </BrowserRouter>
+     *   );
+     * }
+     * ```
+     */
+    function getAppBase() {
+        return getMetaTagContent(exports.UiPathMetaTags.APP_BASE) || '/';
+    }
+
     exports.APP_NAME = APP_NAME;
     exports.AgentMap = AgentMap;
     exports.AuthenticationError = AuthenticationError;
@@ -14879,6 +15223,8 @@
     exports.createProcessInstanceWithMethods = createProcessInstanceWithMethods;
     exports.createProcessWithMethods = createProcessWithMethods;
     exports.createTaskWithMethods = createTaskWithMethods;
+    exports.getAppBase = getAppBase;
+    exports.getAsset = getAsset;
     exports.getErrorDetails = getErrorDetails;
     exports.getLimitedPageSize = getLimitedPageSize;
     exports.isAuthenticationError = isAuthenticationError;
@@ -14889,6 +15235,7 @@
     exports.isServerError = isServerError;
     exports.isUiPathError = isUiPathError;
     exports.isValidationError = isValidationError;
+    exports.loadFromMetaTags = loadFromMetaTags;
     exports.telemetryClient = telemetryClient;
     exports.track = track;
     exports.trackEvent = trackEvent;