@uipath/uipath-typescript 1.1.1 → 1.1.3

package/dist/index.cjs

@@ -3885,6 +3885,7 @@ class ExecutionContext {
  * Checks if code is running in a browser environment
  */
 const isBrowser = typeof window !== 'undefined' && typeof window.document !== 'undefined';
+const isInActionCenter = isBrowser && window.self != window.top && window.location.href.includes('source=ActionCenter');
 
 /**
  * Session storage keys used by the auth module
@@ -4201,6 +4202,102 @@ function getErrorDetails(error) {
     };
 }
 
+var ActionCenterEventNames;
+(function (ActionCenterEventNames) {
+    ActionCenterEventNames["TOKENREFRESHED"] = "AC.tokenRefreshed";
+    ActionCenterEventNames["REFRESHTOKEN"] = "AC.refreshToken";
+})(ActionCenterEventNames || (ActionCenterEventNames = {}));
+
+const AUTHENTICATION_TIMEOUT = 8000;
+class ActionCenterTokenManager {
+    constructor(config, onTokenRefreshed) {
+        this.config = config;
+        this.onTokenRefreshed = onTokenRefreshed;
+        this.parentOrigin = new URLSearchParams(window.location.search).get('basedomain');
+        this.refreshPromise = null;
+    }
+    async refreshAccessToken(tokenInfo) {
+        if (!this.isTokenExpired(tokenInfo)) {
+            return tokenInfo.token;
+        }
+        if (this.refreshPromise) {
+            return this.refreshPromise;
+        }
+        this.refreshPromise = new Promise((resolve, reject) => {
+            const content = {
+                clientId: this.config.clientId,
+                scope: this.config.scope,
+            };
+            this.sendMessageToParent(ActionCenterEventNames.REFRESHTOKEN, content);
+            const messageListener = (event) => {
+                if (event.origin !== this.parentOrigin)
+                    return;
+                if (event.data?.eventType !== ActionCenterEventNames.TOKENREFRESHED)
+                    return;
+                clearTimeout(timer);
+                if (event.data?.content?.token) {
+                    const { accessToken, expiresAt } = event.data.content.token;
+                    this.onTokenRefreshed({ token: accessToken, type: 'secret', expiresAt });
+                    resolve(accessToken);
+                }
+                else {
+                    reject(new AuthenticationError({
+                        message: 'Failed to fetch access token',
+                        statusCode: HttpStatus.UNAUTHORIZED,
+                    }));
+                }
+                this.refreshPromise = null;
+                this.cleanup(messageListener);
+            };
+            const timer = setTimeout(() => {
+                reject(new AuthenticationError({
+                    message: 'Failed to fetch access token',
+                    statusCode: HttpStatus.UNAUTHORIZED,
+                }));
+                this.refreshPromise = null;
+                this.cleanup(messageListener);
+            }, AUTHENTICATION_TIMEOUT);
+            window.addEventListener('message', messageListener);
+        });
+        return this.refreshPromise;
+    }
+    isTokenExpired(tokenInfo) {
+        if (!tokenInfo?.expiresAt) {
+            return true;
+        }
+        return new Date() >= tokenInfo.expiresAt;
+    }
+    sendMessageToParent(eventType, content) {
+        if (window.parent && this.isValidOrigin(this.parentOrigin)) {
+            try {
+                window.parent.postMessage({ eventType, content }, this.parentOrigin);
+            }
+            catch (error) {
+                console.warn('Failed to send message to Action Center', JSON.stringify(error));
+            }
+        }
+    }
+    cleanup(messageListener) {
+        window.removeEventListener('message', messageListener);
+    }
+    isValidOrigin(origin) {
+        const ALLOWED_ORIGINS = ['https://alpha.uipath.com', 'https://staging.uipath.com', 'https://cloud.uipath.com'];
+        if (!origin) {
+            return false;
+        }
+        if (ALLOWED_ORIGINS.includes(origin)) {
+            return true;
+        }
+        try {
+            const url = new URL(origin);
+            return url.hostname === 'localhost';
+        }
+        catch {
+            return false;
+        }
+    }
+}
+
 /**
  * TokenManager is responsible for managing authentication tokens.
  * It provides token operations for a specific client ID.
@@ -4219,6 +4316,11 @@ class TokenManager {
         this.config = config;
         this.isOAuth = isOAuth;
         this.refreshPromise = null;
+        this.actionCenterTokenManager = null;
+        if (isInActionCenter) {
+            this.actionCenterTokenManager = new ActionCenterTokenManager(config, (tokenInfo) => this.setToken(tokenInfo));
+            this.isOAuth = false;
+        }
     }
     /**
      * Checks if a token is expired
@@ -4246,6 +4348,9 @@ class TokenManager {
                 message: 'No authentication token available. Make sure to initialize the SDK first.'
             });
         }
+        if (this.actionCenterTokenManager) {
+            return await this.actionCenterTokenManager.refreshAccessToken(tokenInfo);
+        }
         // For secret-based tokens, they never expire
         if (tokenInfo.type === 'secret') {
             return tokenInfo.token;
@@ -4390,9 +4495,6 @@ class TokenManager {
     clearToken() {
         this.currentToken = undefined;
         this.executionContext.set('tokenInfo', undefined);
-        const headers = this.executionContext.getHeaders();
-        delete headers['Authorization'];
-        this.executionContext.setHeaders(headers);
         // Remove from session storage if this is an OAuth token
         if (isBrowser && this.isOAuth) {
             try {
@@ -4408,10 +4510,6 @@ class TokenManager {
      */
     _updateExecutionContext(tokenInfo) {
         this.executionContext.set('tokenInfo', tokenInfo);
-        // Update authorization header
-        this.executionContext.setHeaders({
-            'Authorization': `Bearer ${tokenInfo.token}`
-        });
     }
     /**
      * Refreshes the access token using the stored refresh token.
@@ -4595,6 +4693,7 @@ const DATA_FABRIC_ENDPOINTS = {
         UPDATE_BY_ID: (entityId) => `${DATAFABRIC_BASE}/api/EntityService/entity/${entityId}/update-batch`,
         DELETE_BY_ID: (entityId) => `${DATAFABRIC_BASE}/api/EntityService/entity/${entityId}/delete-batch`,
         DOWNLOAD_ATTACHMENT: (entityName, recordId, fieldName) => `${DATAFABRIC_BASE}/api/Attachment/${entityName}/${recordId}/${fieldName}`,
+        UPLOAD_ATTACHMENT: (entityName, recordId, fieldName) => `${DATAFABRIC_BASE}/api/Attachment/${entityName}/${recordId}/${fieldName}`,
     },
     CHOICESETS: {
         GET_ALL: `${DATAFABRIC_BASE}/api/Entity/choiceset`,
@@ -4615,8 +4714,15 @@ const IDENTITY_ENDPOINTS = {
 
 class AuthService {
     constructor(config, executionContext) {
-        // Check if we should use stored OAuth context instead of provided config
-        const storedContext = AuthService.getStoredOAuthContext();
+        // Only use stored OAuth context when completing an active callback (URL has ?code=).
+        // If stored context exists but we're NOT in a callback, it's stale from a
+        // failed/abandoned flow (e.g. scope mismatch, invalid redirect URI) and must
+        // be cleared so the fresh config takes effect.
+        const isCallback = AuthService.isInOAuthCallback();
+        const storedContext = isCallback ? AuthService.getStoredOAuthContext() : null;
+        if (!isCallback) {
+            AuthService._clearStoredOAuthContext();
+        }
         const effectiveConfig = storedContext ? AuthService._mergeConfigWithContext(config, storedContext) : config;
         this.config = effectiveConfig;
         const isOAuth = hasOAuthConfig(effectiveConfig);
@@ -4663,6 +4769,22 @@ class AuthService {
             return null;
         }
     }
+    /**
+     * Clear stale OAuth context from session storage.
+     * Called when there is no active OAuth callback, meaning any stored context
+     * is left over from a failed or abandoned flow.
+     */
+    static _clearStoredOAuthContext() {
+        if (!isBrowser)
+            return;
+        try {
+            sessionStorage.removeItem(AUTH_STORAGE_KEYS.OAUTH_CONTEXT);
+            sessionStorage.removeItem(AUTH_STORAGE_KEYS.CODE_VERIFIER);
+        }
+        catch {
+            // Ignore storage errors
+        }
+    }
     /**
      * Merges provided config with stored OAuth context, prioritizing stored values
      */
@@ -4971,13 +5093,41 @@ class AuthService {
     }
 }
 
+/**
+ * Check if config has all required base fields
+ */
+function hasRequiredBaseFields(config) {
+    return Boolean(config.baseUrl && config.orgName && config.tenantName);
+}
+/**
+ * Check if config has exactly one authentication method (secret XOR oauth)
+ * Returns true if exactly one auth method is present, false otherwise
+ */
+function hasValidAuthConfig(config) {
+    const hasSecret = hasSecretConfig(config);
+    const hasOAuth = hasOAuthConfig(config);
+    // XOR: exactly one auth method, not both, not neither
+    return hasSecret !== hasOAuth;
+}
 function validateConfig(config) {
-    if (!config.baseUrl || !config.orgName || !config.tenantName) {
+    if (!hasRequiredBaseFields(config)) {
         throw new Error('Missing required configuration: baseUrl, orgName, and tenantName are required');
     }
-    if (!hasSecretConfig(config) && !hasOAuthConfig(config)) {
-        throw new Error('Invalid configuration: must provide either secret or (clientId, redirectUri, and scope)');
+    const hasSecret = hasSecretConfig(config);
+    const hasOAuth = hasOAuthConfig(config);
+    if (hasSecret && hasOAuth) {
+        throw new Error('Invalid configuration: cannot provide both secret and OAuth credentials. Choose one authentication method.');
     }
+    if (!hasSecret && !hasOAuth) {
+        throw new Error('Invalid configuration: must provide either secret or OAuth credentials (clientId, redirectUri, and scope)');
+    }
+}
+/**
+ * Check if partial config has all required fields for a complete SDK config
+ * Requires base fields and exactly one authentication method (secret XOR oauth)
+ */
+function isCompleteConfig(config) {
+    return hasRequiredBaseFields(config) && hasValidAuthConfig(config);
 }
 function normalizeBaseUrl(url) {
     return url.endsWith('/') ? url.slice(0, -1) : url;
@@ -4989,7 +5139,7 @@ function normalizeBaseUrl(url) {
 // Connection string placeholder that will be replaced during build
 const CONNECTION_STRING = "InstrumentationKey=a6efa11d-1feb-4508-9738-e13e12dcae5e;IngestionEndpoint=https://westeurope-5.in.applicationinsights.azure.com/;LiveEndpoint=https://westeurope.livediagnostics.monitor.azure.com/;ApplicationId=7c58eb1c-9581-4ba6-839e-11725848a037";
 // SDK Version placeholder 
-const SDK_VERSION = "1.1.1";
+const SDK_VERSION = "1.1.3";
 const VERSION = "Version";
 const SERVICE = "Service";
 const CLOUD_ORGANIZATION_NAME = "CloudOrganizationName";
@@ -5318,19 +5468,71 @@ class SDKInternalsRegistry {
     }
 }
 
-var _UiPath_config, _UiPath_authService, _UiPath_initialized;
+/**
+ * UiPath meta tag names for runtime configuration.
+ *
+ * These meta tags are injected at deployment time by the Apps Service
+ * to configure SDK authentication and asset resolution in production.
+ */
+exports.UiPathMetaTags = void 0;
+(function (UiPathMetaTags) {
+    // SDK/OAuth configuration
+    UiPathMetaTags["CLIENT_ID"] = "uipath:client-id";
+    UiPathMetaTags["SCOPE"] = "uipath:scope";
+    UiPathMetaTags["ORG_NAME"] = "uipath:org-name";
+    UiPathMetaTags["TENANT_NAME"] = "uipath:tenant-name";
+    UiPathMetaTags["BASE_URL"] = "uipath:base-url";
+    UiPathMetaTags["REDIRECT_URI"] = "uipath:redirect-uri";
+    // Asset resolution and routing
+    UiPathMetaTags["CDN_BASE"] = "uipath:cdn-base";
+    UiPathMetaTags["APP_BASE"] = "uipath:app-base";
+})(exports.UiPathMetaTags || (exports.UiPathMetaTags = {}));
+
+/**
+ * Get the content of a meta tag by name.
+ * Returns undefined if not in browser environment or meta tag is not found.
+ */
+function getMetaTagContent(name) {
+    if (!isBrowser)
+        return undefined;
+    return document.querySelector(`meta[name="${name}"]`)?.content;
+}
+/**
+ * Load configuration from HTML meta tags injected at runtime.
+ * These meta tags are injected by @uipath/coded-apps during build
+ * or by the Apps service during deployment.
+ *
+ * Returns partial config with values found, or null if no meta tags present.
+ */
+function loadFromMetaTags() {
+    if (!isBrowser)
+        return null;
+    const config = {
+        clientId: getMetaTagContent(exports.UiPathMetaTags.CLIENT_ID),
+        scope: getMetaTagContent(exports.UiPathMetaTags.SCOPE),
+        orgName: getMetaTagContent(exports.UiPathMetaTags.ORG_NAME),
+        tenantName: getMetaTagContent(exports.UiPathMetaTags.TENANT_NAME),
+        baseUrl: getMetaTagContent(exports.UiPathMetaTags.BASE_URL),
+        redirectUri: getMetaTagContent(exports.UiPathMetaTags.REDIRECT_URI),
+    };
+    const hasAnyValue = Object.values(config).some(Boolean);
+    return hasAnyValue ? config : null;
+}
+
+var _UiPath_instances, _UiPath_config, _UiPath_authService, _UiPath_initialized, _UiPath_partialConfig, _UiPath_initializeWithConfig, _UiPath_loadConfig;
 /**
  * UiPath - Core SDK class for authentication and configuration management.
  *
  * Handles authentication, configuration, and provides access to SDK internals
  * for service instantiation in the modular pattern.
  *
+ * Supports two usage patterns:
+ * 1. Full config in constructor — for server-side or explicit configuration
+ * 2. No config / partial config — loads from meta tags injected by @uipath/coded-apps plugin
+ *
  * @example
  * ```typescript
- * // Modular pattern
- * import { UiPath } from '@uipath/uipath-typescript/core';
- * import { Entities } from '@uipath/uipath-typescript/entities';
- *
+ * // Explicit config
  * const sdk = new UiPath({
  *   baseUrl: 'https://cloud.uipath.com',
  *   orgName: 'myorg',
@@ -5339,70 +5541,47 @@ var _UiPath_config, _UiPath_authService, _UiPath_initialized;
  *   redirectUri: 'http://localhost:3000/callback',
  *   scope: 'OR.Users OR.Robots'
  * });
- *
  * await sdk.initialize();
+ * ```
  *
- * const entitiesService = new Entities(sdk);
- * const allEntities = await entitiesService.getAll();
+ * @example
+ * ```typescript
+ * // Auto-load from meta tags (coded apps)
+ * const sdk = new UiPath();
+ * await sdk.initialize();
  * ```
  */
 let UiPath$1 = class UiPath {
     constructor(config) {
+        _UiPath_instances.add(this);
         // Private fields - true runtime privacy, not visible via Object.keys()
         _UiPath_config.set(this, void 0);
         _UiPath_authService.set(this, void 0);
         _UiPath_initialized.set(this, false);
-        // Validate and normalize the configuration
-        validateConfig(config);
-        const hasSecretAuth = hasSecretConfig(config);
-        const hasOAuthAuth = hasOAuthConfig(config);
-        // Initialize core components
-        const internalConfig = new UiPathConfig({
-            baseUrl: normalizeBaseUrl(config.baseUrl),
-            orgName: config.orgName,
-            tenantName: config.tenantName,
-            secret: hasSecretAuth ? config.secret : undefined,
-            clientId: hasOAuthAuth ? config.clientId : undefined,
-            redirectUri: hasOAuthAuth ? config.redirectUri : undefined,
-            scope: hasOAuthAuth ? config.scope : undefined
-        });
-        const executionContext = new ExecutionContext();
-        __classPrivateFieldSet(this, _UiPath_authService, new AuthService(internalConfig, executionContext), "f");
-        __classPrivateFieldSet(this, _UiPath_config, internalConfig, "f");
-        // Store internals in SDKInternalsRegistry (not visible on instance)
-        SDKInternalsRegistry.set(this, {
-            config: internalConfig,
-            context: executionContext,
-            tokenManager: __classPrivateFieldGet(this, _UiPath_authService, "f").getTokenManager()
-        });
-        // Expose read-only config for user convenience
-        this.config = {
-            baseUrl: internalConfig.baseUrl,
-            orgName: internalConfig.orgName,
-            tenantName: internalConfig.tenantName
-        };
-        // Initialize telemetry with SDK configuration
-        telemetryClient.initialize({
-            baseUrl: config.baseUrl,
-            orgName: config.orgName,
-            tenantName: config.tenantName,
-            clientId: hasOAuthAuth ? config.clientId : undefined,
-            redirectUri: hasOAuthAuth ? config.redirectUri : undefined
-        });
-        // Track SDK initialization
-        trackEvent('Sdk.Auth');
-        // Auto-initialize for secret-based auth
-        if (hasSecretAuth) {
-            __classPrivateFieldGet(this, _UiPath_authService, "f").authenticateWithSecret(config.secret);
-            __classPrivateFieldSet(this, _UiPath_initialized, true, "f");
+        _UiPath_partialConfig.set(this, void 0);
+        // Load configuration from meta tags
+        const configFromMetaTags = loadFromMetaTags();
+        // Merge configuration: constructor config overrides meta tags
+        const mergedConfig = config ? { ...configFromMetaTags, ...config } : configFromMetaTags;
+        if (mergedConfig && isCompleteConfig(mergedConfig)) {
+            __classPrivateFieldGet(this, _UiPath_instances, "m", _UiPath_initializeWithConfig).call(this, mergedConfig);
+        }
+        else if (config) {
+            __classPrivateFieldSet(this, _UiPath_partialConfig, config, "f");
         }
     }
     /**
      * Initialize the SDK based on the provided configuration.
      * This method handles both OAuth flow initiation and completion automatically.
      * For secret-based authentication, initialization is automatic and this returns immediately.
+     * If no config was provided in constructor, loads from meta tags.
      */
     async initialize() {
+        // Load config from meta tags if not provided in constructor
+        if (!__classPrivateFieldGet(this, _UiPath_config, "f")) {
+            const loadedConfig = __classPrivateFieldGet(this, _UiPath_instances, "m", _UiPath_loadConfig).call(this);
+            __classPrivateFieldGet(this, _UiPath_instances, "m", _UiPath_initializeWithConfig).call(this, loadedConfig);
+        }
         // For secret-based auth, it's already initialized in constructor
         if (hasSecretConfig(__classPrivateFieldGet(this, _UiPath_config, "f"))) {
             return;
@@ -5449,6 +5628,11 @@ let UiPath$1 = class UiPath {
         if (!AuthService.isInOAuthCallback()) {
             throw new Error('Not in OAuth callback state. Call initialize() first to start OAuth flow.');
         }
+        // Load config if not yet initialized
+        if (!__classPrivateFieldGet(this, _UiPath_config, "f")) {
+            const loadedConfig = __classPrivateFieldGet(this, _UiPath_instances, "m", _UiPath_loadConfig).call(this);
+            __classPrivateFieldGet(this, _UiPath_instances, "m", _UiPath_initializeWithConfig).call(this, loadedConfig);
+        }
         try {
             const success = await __classPrivateFieldGet(this, _UiPath_authService, "f").authenticate(__classPrivateFieldGet(this, _UiPath_config, "f"));
             if (success && this.isAuthenticated()) {
@@ -5466,13 +5650,13 @@ let UiPath$1 = class UiPath {
      * Check if the user is authenticated (has valid token)
      */
     isAuthenticated() {
-        return __classPrivateFieldGet(this, _UiPath_authService, "f").hasValidToken();
+        return __classPrivateFieldGet(this, _UiPath_authService, "f")?.hasValidToken() ?? false;
     }
     /**
      * Get the current authentication token
      */
     getToken() {
-        return __classPrivateFieldGet(this, _UiPath_authService, "f").getToken();
+        return __classPrivateFieldGet(this, _UiPath_authService, "f")?.getToken();
     }
     /**
      * Logout from the SDK, clearing all authentication state.
@@ -5480,14 +5664,71 @@ let UiPath$1 = class UiPath {
      */
     logout() {
         // Secret-based auth has no session to end — skip silently
-        if (hasSecretConfig(__classPrivateFieldGet(this, _UiPath_config, "f"))) {
+        if (__classPrivateFieldGet(this, _UiPath_config, "f") && hasSecretConfig(__classPrivateFieldGet(this, _UiPath_config, "f"))) {
             return;
         }
-        __classPrivateFieldGet(this, _UiPath_authService, "f").logout();
+        __classPrivateFieldGet(this, _UiPath_authService, "f")?.logout();
         __classPrivateFieldSet(this, _UiPath_initialized, false, "f");
     }
 };
-_UiPath_config = new WeakMap(), _UiPath_authService = new WeakMap(), _UiPath_initialized = new WeakMap();
+_UiPath_config = new WeakMap(), _UiPath_authService = new WeakMap(), _UiPath_initialized = new WeakMap(), _UiPath_partialConfig = new WeakMap(), _UiPath_instances = new WeakSet(), _UiPath_initializeWithConfig = function _UiPath_initializeWithConfig(config) {
+    // Validate and normalize the configuration
+    validateConfig(config);
+    const hasSecretAuth = hasSecretConfig(config);
+    const hasOAuthAuth = hasOAuthConfig(config);
+    // Initialize core components
+    const internalConfig = new UiPathConfig({
+        baseUrl: normalizeBaseUrl(config.baseUrl),
+        orgName: config.orgName,
+        tenantName: config.tenantName,
+        secret: hasSecretAuth ? config.secret : undefined,
+        clientId: hasOAuthAuth ? config.clientId : undefined,
+        redirectUri: hasOAuthAuth ? config.redirectUri : undefined,
+        scope: hasOAuthAuth ? config.scope : undefined
+    });
+    const executionContext = new ExecutionContext();
+    __classPrivateFieldSet(this, _UiPath_authService, new AuthService(internalConfig, executionContext), "f");
+    __classPrivateFieldSet(this, _UiPath_config, internalConfig, "f");
+    // Store internals in SDKInternalsRegistry (not visible on instance)
+    SDKInternalsRegistry.set(this, {
+        config: internalConfig,
+        context: executionContext,
+        tokenManager: __classPrivateFieldGet(this, _UiPath_authService, "f").getTokenManager()
+    });
+    // Expose read-only config for user convenience
+    this.config = {
+        baseUrl: internalConfig.baseUrl,
+        orgName: internalConfig.orgName,
+        tenantName: internalConfig.tenantName
+    };
+    // Initialize telemetry with SDK configuration
+    telemetryClient.initialize({
+        baseUrl: config.baseUrl,
+        orgName: config.orgName,
+        tenantName: config.tenantName,
+        clientId: hasOAuthAuth ? config.clientId : undefined,
+        redirectUri: hasOAuthAuth ? config.redirectUri : undefined
+    });
+    // Track SDK initialization
+    trackEvent('Sdk.Auth');
+    /** Auto-initialize for secret-based auth
+     * When viewed in Action Center, initialize tokenInfo with empty token. When an sdk call is made Action Center passes the token to sdk.
+     */
+    if (hasSecretAuth || isInActionCenter) {
+        __classPrivateFieldGet(this, _UiPath_authService, "f").authenticateWithSecret(config.secret ?? '');
+        __classPrivateFieldSet(this, _UiPath_initialized, true, "f");
+    }
+}, _UiPath_loadConfig = function _UiPath_loadConfig() {
+    // Load from meta tags
+    const metaConfig = loadFromMetaTags();
+    // Merge with any partial config from constructor (constructor overrides meta tags)
+    const merged = { ...metaConfig, ...__classPrivateFieldGet(this, _UiPath_partialConfig, "f") };
+    if (!isCompleteConfig(merged)) {
+        throw new Error('UiPath SDK configuration not found. ' +
+            'Ensure @uipath/coded-apps plugin is set up in your bundler to inject configuration during development and build.');
+    }
+    return merged;
+};
 
 /**
  * Type guards for error response types
@@ -5766,15 +6007,6 @@ class ApiClient {
     async getDefaultHeaders() {
         // Get headers from execution context first
         const contextHeaders = this.executionContext.getHeaders();
-        // If Authorization header is already set in context, use that
-        if (contextHeaders['Authorization']) {
-            return {
-                ...contextHeaders,
-                'Content-Type': CONTENT_TYPES.JSON,
-                ...this.defaultHeaders,
-                ...this.clientConfig.headers
-            };
-        }
         const token = await this.getValidToken();
         return {
             ...contextHeaders,
@@ -5789,8 +6021,13 @@ class ApiClient {
         const normalizedPath = path.startsWith('/') ? path.substring(1) : path;
         // Construct URL with org and tenant names
         const url = new URL(`${this.config.orgName}/${this.config.tenantName}/${normalizedPath}`, this.config.baseUrl).toString();
+        const isFormData = options.body instanceof FormData;
+        const defaultHeaders = await this.getDefaultHeaders();
+        if (isFormData) {
+            delete defaultHeaders['Content-Type'];
+        }
         const headers = {
-            ...await this.getDefaultHeaders(),
+            ...defaultHeaders,
             ...options.headers
         };
         // Convert params to URLSearchParams
@@ -5801,11 +6038,15 @@ class ApiClient {
             });
         }
         const fullUrl = searchParams.toString() ? `${url}?${searchParams.toString()}` : url;
+        let body = undefined;
+        if (options.body) {
+            body = isFormData ? options.body : JSON.stringify(options.body);
+        }
         try {
             const response = await fetch(fullUrl, {
                 method,
                 headers,
-                body: options.body ? JSON.stringify(options.body) : undefined,
+                body,
                 signal: options.signal
             });
             if (!response.ok) {
@@ -7096,6 +7337,17 @@ function createEntityMethods(entityData, service) {
                 fieldName
             });
         },
+        async uploadAttachment(recordId, fieldName, file, expansionLevel) {
+            if (!entityData.name)
+                throw new Error('Entity name is undefined');
+            return service.uploadAttachment({
+                entityName: entityData.name,
+                recordId,
+                fieldName,
+                file,
+                expansionLevel
+            });
+        },
         async insert(data, options) {
             return this.insertRecord(data, options);
         },
@@ -7599,6 +7851,42 @@ class EntityService extends BaseService {
         });
         return response.data;
     }
+    /**
+     * Uploads an attachment to a File-type field of an entity record
+     *
+     * @param options - Options containing entityName, recordId, fieldName, file, and optional expansionLevel
+     * @returns Promise resolving to the upload response
+     *
+     * @example
+     * ```typescript
+     * import { Entities } from '@uipath/uipath-typescript/entities';
+     *
+     * const entities = new Entities(sdk);
+     *
+     * // Upload a file attachment
+     * const response = await entities.uploadAttachment({
+     *   entityName: 'Invoice',
+     *   recordId: '<record-uuid>',
+     *   fieldName: 'Documents',
+     *   file: file
+     * });
+     * ```
+     */
+    async uploadAttachment(options) {
+        const { entityName, recordId, fieldName, file, expansionLevel } = options;
+        const formData = new FormData();
+        if (file instanceof Uint8Array) {
+            formData.append('file', new Blob([file.buffer]));
+        }
+        else {
+            formData.append('file', file);
+        }
+        const params = createParams({ expansionLevel });
+        const response = await this.post(DATA_FABRIC_ENDPOINTS.ENTITY.UPLOAD_ATTACHMENT(entityName, recordId, fieldName), formData, { params });
+        // Convert PascalCase response to camelCase
+        const camelResponse = pascalToCamelCaseKeys(response.data);
+        return camelResponse;
+    }
     /**
    * @hidden
    * @deprecated Use {@link getAllRecords} instead.
@@ -7732,6 +8020,9 @@ __decorate([
 __decorate([
     track('Entities.DownloadAttachment')
 ], EntityService.prototype, "downloadAttachment", null);
+__decorate([
+    track('Entities.UploadAttachment')
+], EntityService.prototype, "uploadAttachment", null);
 
 class ChoiceSetService extends BaseService {
     /**
@@ -11118,6 +11409,81 @@ const UserSettingsMap = {
     ...CommonFieldMap
 };
 
+/**
+ * Asset resolution utilities for UiPath Coded Apps
+ *
+ * These helpers enable developers to write code that works identically
+ * in local development and production environments.
+ *
+ * Values are read from meta tags injected at deployment:
+ * - <meta name="uipath:cdn-base" content="https://cdn.example.com/appId/folder">
+ * - <meta name="uipath:app-base" content="/org/apps_/.../public">
+ */
+/**
+ * Resolves an asset path to the CDN URL (if available)
+ *
+ * In local development: returns path as-is (loads from local dev server)
+ * In production: prepends CDN base URL from meta tag
+ *
+ * @param path - The asset path (e.g., './assets/logo.png' or '/assets/logo.png')
+ * @returns The resolved asset URL
+ *
+ * @example
+ * ```tsx
+ * import { getAsset } from '@uipath/uipath-typescript';
+ * import logoPath from './assets/logo.png';
+ *
+ * function MyComponent() {
+ *   return <img src={getAsset(logoPath)} alt="Logo" />;
+ * }
+ * ```
+ */
+function getAsset(path) {
+    // If path is already an absolute URL, return as-is
+    if (path.startsWith('http://') || path.startsWith('https://')) {
+        return path;
+    }
+    const cdnBase = getMetaTagContent(exports.UiPathMetaTags.CDN_BASE);
+    if (!cdnBase)
+        return path;
+    // Normalize CDN base URL to remove trailing slash
+    const normalizedCdnBase = normalizeBaseUrl(cdnBase);
+    // Normalize path to ensure it starts with /
+    let normalizedPath = path;
+    if (normalizedPath.startsWith('./')) {
+        normalizedPath = normalizedPath.substring(1); // ./assets -> /assets
+    }
+    else if (!normalizedPath.startsWith('/')) {
+        normalizedPath = '/' + normalizedPath; // assets -> /assets
+    }
+    return normalizedCdnBase + normalizedPath;
+}
+/**
+ * Returns the app base path for router configuration
+ *
+ * In local development: returns '/'
+ * In production: returns the deployed app path from meta tag
+ *
+ * @returns The app base path
+ *
+ * @example
+ * ```tsx
+ * import { getAppBase } from '@uipath/uipath-typescript';
+ * import { BrowserRouter } from 'react-router-dom';
+ *
+ * function App() {
+ *   return (
+ *     <BrowserRouter basename={getAppBase()}>
+ *       {/* routes *\/}
+ *     </BrowserRouter>
+ *   );
+ * }
+ * ```
+ */
+function getAppBase() {
+    return getMetaTagContent(exports.UiPathMetaTags.APP_BASE) || '/';
+}
+
 exports.APP_NAME = APP_NAME;
 exports.AgentMap = AgentMap;
 exports.AuthenticationError = AuthenticationError;
@@ -11160,6 +11526,8 @@ exports.createEntityWithMethods = createEntityWithMethods;
 exports.createProcessInstanceWithMethods = createProcessInstanceWithMethods;
 exports.createProcessWithMethods = createProcessWithMethods;
 exports.createTaskWithMethods = createTaskWithMethods;
+exports.getAppBase = getAppBase;
+exports.getAsset = getAsset;
 exports.getErrorDetails = getErrorDetails;
 exports.getLimitedPageSize = getLimitedPageSize;
 exports.isAuthenticationError = isAuthenticationError;
@@ -11170,6 +11538,7 @@ exports.isRateLimitError = isRateLimitError;
 exports.isServerError = isServerError;
 exports.isUiPathError = isUiPathError;
 exports.isValidationError = isValidationError;
+exports.loadFromMetaTags = loadFromMetaTags;
 exports.telemetryClient = telemetryClient;
 exports.track = track;
 exports.trackEvent = trackEvent;