@uipath/uipath-typescript 1.1.1 → 1.1.3

package/dist/index.umd.js

@@ -3887,6 +3887,7 @@
      * Checks if code is running in a browser environment
      */
     const isBrowser = typeof window !== 'undefined' && typeof window.document !== 'undefined';
+    const isInActionCenter = isBrowser && window.self != window.top && window.location.href.includes('source=ActionCenter');
 
     /**
      * Session storage keys used by the auth module
@@ -4203,6 +4204,102 @@
         };
     }
 
+    var ActionCenterEventNames;
+    (function (ActionCenterEventNames) {
+        ActionCenterEventNames["TOKENREFRESHED"] = "AC.tokenRefreshed";
+        ActionCenterEventNames["REFRESHTOKEN"] = "AC.refreshToken";
+    })(ActionCenterEventNames || (ActionCenterEventNames = {}));
+
+    const AUTHENTICATION_TIMEOUT = 8000;
+    class ActionCenterTokenManager {
+        constructor(config, onTokenRefreshed) {
+            this.config = config;
+            this.onTokenRefreshed = onTokenRefreshed;
+            this.parentOrigin = new URLSearchParams(window.location.search).get('basedomain');
+            this.refreshPromise = null;
+        }
+        async refreshAccessToken(tokenInfo) {
+            if (!this.isTokenExpired(tokenInfo)) {
+                return tokenInfo.token;
+            }
+            if (this.refreshPromise) {
+                return this.refreshPromise;
+            }
+            this.refreshPromise = new Promise((resolve, reject) => {
+                const content = {
+                    clientId: this.config.clientId,
+                    scope: this.config.scope,
+                };
+                this.sendMessageToParent(ActionCenterEventNames.REFRESHTOKEN, content);
+                const messageListener = (event) => {
+                    if (event.origin !== this.parentOrigin)
+                        return;
+                    if (event.data?.eventType !== ActionCenterEventNames.TOKENREFRESHED)
+                        return;
+                    clearTimeout(timer);
+                    if (event.data?.content?.token) {
+                        const { accessToken, expiresAt } = event.data.content.token;
+                        this.onTokenRefreshed({ token: accessToken, type: 'secret', expiresAt });
+                        resolve(accessToken);
+                    }
+                    else {
+                        reject(new AuthenticationError({
+                            message: 'Failed to fetch access token',
+                            statusCode: HttpStatus.UNAUTHORIZED,
+                        }));
+                    }
+                    this.refreshPromise = null;
+                    this.cleanup(messageListener);
+                };
+                const timer = setTimeout(() => {
+                    reject(new AuthenticationError({
+                        message: 'Failed to fetch access token',
+                        statusCode: HttpStatus.UNAUTHORIZED,
+                    }));
+                    this.refreshPromise = null;
+                    this.cleanup(messageListener);
+                }, AUTHENTICATION_TIMEOUT);
+                window.addEventListener('message', messageListener);
+            });
+            return this.refreshPromise;
+        }
+        isTokenExpired(tokenInfo) {
+            if (!tokenInfo?.expiresAt) {
+                return true;
+            }
+            return new Date() >= tokenInfo.expiresAt;
+        }
+        sendMessageToParent(eventType, content) {
+            if (window.parent && this.isValidOrigin(this.parentOrigin)) {
+                try {
+                    window.parent.postMessage({ eventType, content }, this.parentOrigin);
+                }
+                catch (error) {
+                    console.warn('Failed to send message to Action Center', JSON.stringify(error));
+                }
+            }
+        }
+        cleanup(messageListener) {
+            window.removeEventListener('message', messageListener);
+        }
+        isValidOrigin(origin) {
+            const ALLOWED_ORIGINS = ['https://alpha.uipath.com', 'https://staging.uipath.com', 'https://cloud.uipath.com'];
+            if (!origin) {
+                return false;
+            }
+            if (ALLOWED_ORIGINS.includes(origin)) {
+                return true;
+            }
+            try {
+                const url = new URL(origin);
+                return url.hostname === 'localhost';
+            }
+            catch {
+                return false;
+            }
+        }
+    }
+
     /**
      * TokenManager is responsible for managing authentication tokens.
      * It provides token operations for a specific client ID.
@@ -4221,6 +4318,11 @@
             this.config = config;
             this.isOAuth = isOAuth;
             this.refreshPromise = null;
+            this.actionCenterTokenManager = null;
+            if (isInActionCenter) {
+                this.actionCenterTokenManager = new ActionCenterTokenManager(config, (tokenInfo) => this.setToken(tokenInfo));
+                this.isOAuth = false;
+            }
         }
         /**
          * Checks if a token is expired
@@ -4248,6 +4350,9 @@
                     message: 'No authentication token available. Make sure to initialize the SDK first.'
                 });
             }
+            if (this.actionCenterTokenManager) {
+                return await this.actionCenterTokenManager.refreshAccessToken(tokenInfo);
+            }
             // For secret-based tokens, they never expire
             if (tokenInfo.type === 'secret') {
                 return tokenInfo.token;
@@ -4392,9 +4497,6 @@
         clearToken() {
             this.currentToken = undefined;
             this.executionContext.set('tokenInfo', undefined);
-            const headers = this.executionContext.getHeaders();
-            delete headers['Authorization'];
-            this.executionContext.setHeaders(headers);
             // Remove from session storage if this is an OAuth token
             if (isBrowser && this.isOAuth) {
                 try {
@@ -4410,10 +4512,6 @@
          */
         _updateExecutionContext(tokenInfo) {
             this.executionContext.set('tokenInfo', tokenInfo);
-            // Update authorization header
-            this.executionContext.setHeaders({
-                'Authorization': `Bearer ${tokenInfo.token}`
-            });
         }
         /**
          * Refreshes the access token using the stored refresh token.
@@ -4597,6 +4695,7 @@
             UPDATE_BY_ID: (entityId) => `${DATAFABRIC_BASE}/api/EntityService/entity/${entityId}/update-batch`,
             DELETE_BY_ID: (entityId) => `${DATAFABRIC_BASE}/api/EntityService/entity/${entityId}/delete-batch`,
             DOWNLOAD_ATTACHMENT: (entityName, recordId, fieldName) => `${DATAFABRIC_BASE}/api/Attachment/${entityName}/${recordId}/${fieldName}`,
+            UPLOAD_ATTACHMENT: (entityName, recordId, fieldName) => `${DATAFABRIC_BASE}/api/Attachment/${entityName}/${recordId}/${fieldName}`,
         },
         CHOICESETS: {
             GET_ALL: `${DATAFABRIC_BASE}/api/Entity/choiceset`,
@@ -4617,8 +4716,15 @@
 
     class AuthService {
         constructor(config, executionContext) {
-            // Check if we should use stored OAuth context instead of provided config
-            const storedContext = AuthService.getStoredOAuthContext();
+            // Only use stored OAuth context when completing an active callback (URL has ?code=).
+            // If stored context exists but we're NOT in a callback, it's stale from a
+            // failed/abandoned flow (e.g. scope mismatch, invalid redirect URI) and must
+            // be cleared so the fresh config takes effect.
+            const isCallback = AuthService.isInOAuthCallback();
+            const storedContext = isCallback ? AuthService.getStoredOAuthContext() : null;
+            if (!isCallback) {
+                AuthService._clearStoredOAuthContext();
+            }
             const effectiveConfig = storedContext ? AuthService._mergeConfigWithContext(config, storedContext) : config;
             this.config = effectiveConfig;
             const isOAuth = hasOAuthConfig(effectiveConfig);
@@ -4665,6 +4771,22 @@
                 return null;
             }
         }
+        /**
+         * Clear stale OAuth context from session storage.
+         * Called when there is no active OAuth callback, meaning any stored context
+         * is left over from a failed or abandoned flow.
+         */
+        static _clearStoredOAuthContext() {
+            if (!isBrowser)
+                return;
+            try {
+                sessionStorage.removeItem(AUTH_STORAGE_KEYS.OAUTH_CONTEXT);
+                sessionStorage.removeItem(AUTH_STORAGE_KEYS.CODE_VERIFIER);
+            }
+            catch {
+                // Ignore storage errors
+            }
+        }
         /**
          * Merges provided config with stored OAuth context, prioritizing stored values
          */
@@ -4973,14 +5095,42 @@
         }
     }
 
+    /**
+     * Check if config has all required base fields
+     */
+    function hasRequiredBaseFields(config) {
+        return Boolean(config.baseUrl && config.orgName && config.tenantName);
+    }
+    /**
+     * Check if config has exactly one authentication method (secret XOR oauth)
+     * Returns true if exactly one auth method is present, false otherwise
+     */
+    function hasValidAuthConfig(config) {
+        const hasSecret = hasSecretConfig(config);
+        const hasOAuth = hasOAuthConfig(config);
+        // XOR: exactly one auth method, not both, not neither
+        return hasSecret !== hasOAuth;
+    }
     function validateConfig(config) {
-        if (!config.baseUrl || !config.orgName || !config.tenantName) {
+        if (!hasRequiredBaseFields(config)) {
             throw new Error('Missing required configuration: baseUrl, orgName, and tenantName are required');
         }
-        if (!hasSecretConfig(config) && !hasOAuthConfig(config)) {
-            throw new Error('Invalid configuration: must provide either secret or (clientId, redirectUri, and scope)');
+        const hasSecret = hasSecretConfig(config);
+        const hasOAuth = hasOAuthConfig(config);
+        if (hasSecret && hasOAuth) {
+            throw new Error('Invalid configuration: cannot provide both secret and OAuth credentials. Choose one authentication method.');
+        }
+        if (!hasSecret && !hasOAuth) {
+            throw new Error('Invalid configuration: must provide either secret or OAuth credentials (clientId, redirectUri, and scope)');
         }
     }
+    /**
+     * Check if partial config has all required fields for a complete SDK config
+     * Requires base fields and exactly one authentication method (secret XOR oauth)
+     */
+    function isCompleteConfig(config) {
+        return hasRequiredBaseFields(config) && hasValidAuthConfig(config);
+    }
     function normalizeBaseUrl(url) {
         return url.endsWith('/') ? url.slice(0, -1) : url;
     }
@@ -8746,7 +8896,7 @@
     // Connection string placeholder that will be replaced during build
     const CONNECTION_STRING = "InstrumentationKey=a6efa11d-1feb-4508-9738-e13e12dcae5e;IngestionEndpoint=https://westeurope-5.in.applicationinsights.azure.com/;LiveEndpoint=https://westeurope.livediagnostics.monitor.azure.com/;ApplicationId=7c58eb1c-9581-4ba6-839e-11725848a037";
     // SDK Version placeholder 
-    const SDK_VERSION = "1.1.1";
+    const SDK_VERSION = "1.1.3";
     const VERSION = "Version";
     const SERVICE = "Service";
     const CLOUD_ORGANIZATION_NAME = "CloudOrganizationName";
@@ -9075,19 +9225,71 @@
         }
     }
 
-    var _UiPath_config, _UiPath_authService, _UiPath_initialized;
+    /**
+     * UiPath meta tag names for runtime configuration.
+     *
+     * These meta tags are injected at deployment time by the Apps Service
+     * to configure SDK authentication and asset resolution in production.
+     */
+    exports.UiPathMetaTags = void 0;
+    (function (UiPathMetaTags) {
+        // SDK/OAuth configuration
+        UiPathMetaTags["CLIENT_ID"] = "uipath:client-id";
+        UiPathMetaTags["SCOPE"] = "uipath:scope";
+        UiPathMetaTags["ORG_NAME"] = "uipath:org-name";
+        UiPathMetaTags["TENANT_NAME"] = "uipath:tenant-name";
+        UiPathMetaTags["BASE_URL"] = "uipath:base-url";
+        UiPathMetaTags["REDIRECT_URI"] = "uipath:redirect-uri";
+        // Asset resolution and routing
+        UiPathMetaTags["CDN_BASE"] = "uipath:cdn-base";
+        UiPathMetaTags["APP_BASE"] = "uipath:app-base";
+    })(exports.UiPathMetaTags || (exports.UiPathMetaTags = {}));
+
+    /**
+     * Get the content of a meta tag by name.
+     * Returns undefined if not in browser environment or meta tag is not found.
+     */
+    function getMetaTagContent(name) {
+        if (!isBrowser)
+            return undefined;
+        return document.querySelector(`meta[name="${name}"]`)?.content;
+    }
+    /**
+     * Load configuration from HTML meta tags injected at runtime.
+     * These meta tags are injected by @uipath/coded-apps during build
+     * or by the Apps service during deployment.
+     *
+     * Returns partial config with values found, or null if no meta tags present.
+     */
+    function loadFromMetaTags() {
+        if (!isBrowser)
+            return null;
+        const config = {
+            clientId: getMetaTagContent(exports.UiPathMetaTags.CLIENT_ID),
+            scope: getMetaTagContent(exports.UiPathMetaTags.SCOPE),
+            orgName: getMetaTagContent(exports.UiPathMetaTags.ORG_NAME),
+            tenantName: getMetaTagContent(exports.UiPathMetaTags.TENANT_NAME),
+            baseUrl: getMetaTagContent(exports.UiPathMetaTags.BASE_URL),
+            redirectUri: getMetaTagContent(exports.UiPathMetaTags.REDIRECT_URI),
+        };
+        const hasAnyValue = Object.values(config).some(Boolean);
+        return hasAnyValue ? config : null;
+    }
+
+    var _UiPath_instances, _UiPath_config, _UiPath_authService, _UiPath_initialized, _UiPath_partialConfig, _UiPath_initializeWithConfig, _UiPath_loadConfig;
     /**
      * UiPath - Core SDK class for authentication and configuration management.
      *
      * Handles authentication, configuration, and provides access to SDK internals
      * for service instantiation in the modular pattern.
      *
+     * Supports two usage patterns:
+     * 1. Full config in constructor — for server-side or explicit configuration
+     * 2. No config / partial config — loads from meta tags injected by @uipath/coded-apps plugin
+     *
      * @example
      * ```typescript
-     * // Modular pattern
-     * import { UiPath } from '@uipath/uipath-typescript/core';
-     * import { Entities } from '@uipath/uipath-typescript/entities';
-     *
+     * // Explicit config
      * const sdk = new UiPath({
      *   baseUrl: 'https://cloud.uipath.com',
      *   orgName: 'myorg',
@@ -9096,70 +9298,47 @@
      *   redirectUri: 'http://localhost:3000/callback',
      *   scope: 'OR.Users OR.Robots'
      * });
-     *
      * await sdk.initialize();
+     * ```
      *
-     * const entitiesService = new Entities(sdk);
-     * const allEntities = await entitiesService.getAll();
+     * @example
+     * ```typescript
+     * // Auto-load from meta tags (coded apps)
+     * const sdk = new UiPath();
+     * await sdk.initialize();
      * ```
      */
     let UiPath$1 = class UiPath {
         constructor(config) {
+            _UiPath_instances.add(this);
             // Private fields - true runtime privacy, not visible via Object.keys()
             _UiPath_config.set(this, void 0);
             _UiPath_authService.set(this, void 0);
             _UiPath_initialized.set(this, false);
-            // Validate and normalize the configuration
-            validateConfig(config);
-            const hasSecretAuth = hasSecretConfig(config);
-            const hasOAuthAuth = hasOAuthConfig(config);
-            // Initialize core components
-            const internalConfig = new UiPathConfig({
-                baseUrl: normalizeBaseUrl(config.baseUrl),
-                orgName: config.orgName,
-                tenantName: config.tenantName,
-                secret: hasSecretAuth ? config.secret : undefined,
-                clientId: hasOAuthAuth ? config.clientId : undefined,
-                redirectUri: hasOAuthAuth ? config.redirectUri : undefined,
-                scope: hasOAuthAuth ? config.scope : undefined
-            });
-            const executionContext = new ExecutionContext();
-            __classPrivateFieldSet(this, _UiPath_authService, new AuthService(internalConfig, executionContext), "f");
-            __classPrivateFieldSet(this, _UiPath_config, internalConfig, "f");
-            // Store internals in SDKInternalsRegistry (not visible on instance)
-            SDKInternalsRegistry.set(this, {
-                config: internalConfig,
-                context: executionContext,
-                tokenManager: __classPrivateFieldGet(this, _UiPath_authService, "f").getTokenManager()
-            });
-            // Expose read-only config for user convenience
-            this.config = {
-                baseUrl: internalConfig.baseUrl,
-                orgName: internalConfig.orgName,
-                tenantName: internalConfig.tenantName
-            };
-            // Initialize telemetry with SDK configuration
-            telemetryClient.initialize({
-                baseUrl: config.baseUrl,
-                orgName: config.orgName,
-                tenantName: config.tenantName,
-                clientId: hasOAuthAuth ? config.clientId : undefined,
-                redirectUri: hasOAuthAuth ? config.redirectUri : undefined
-            });
-            // Track SDK initialization
-            trackEvent('Sdk.Auth');
-            // Auto-initialize for secret-based auth
-            if (hasSecretAuth) {
-                __classPrivateFieldGet(this, _UiPath_authService, "f").authenticateWithSecret(config.secret);
-                __classPrivateFieldSet(this, _UiPath_initialized, true, "f");
+            _UiPath_partialConfig.set(this, void 0);
+            // Load configuration from meta tags
+            const configFromMetaTags = loadFromMetaTags();
+            // Merge configuration: constructor config overrides meta tags
+            const mergedConfig = config ? { ...configFromMetaTags, ...config } : configFromMetaTags;
+            if (mergedConfig && isCompleteConfig(mergedConfig)) {
+                __classPrivateFieldGet(this, _UiPath_instances, "m", _UiPath_initializeWithConfig).call(this, mergedConfig);
+            }
+            else if (config) {
+                __classPrivateFieldSet(this, _UiPath_partialConfig, config, "f");
             }
         }
         /**
          * Initialize the SDK based on the provided configuration.
          * This method handles both OAuth flow initiation and completion automatically.
          * For secret-based authentication, initialization is automatic and this returns immediately.
+         * If no config was provided in constructor, loads from meta tags.
          */
         async initialize() {
+            // Load config from meta tags if not provided in constructor
+            if (!__classPrivateFieldGet(this, _UiPath_config, "f")) {
+                const loadedConfig = __classPrivateFieldGet(this, _UiPath_instances, "m", _UiPath_loadConfig).call(this);
+                __classPrivateFieldGet(this, _UiPath_instances, "m", _UiPath_initializeWithConfig).call(this, loadedConfig);
+            }
             // For secret-based auth, it's already initialized in constructor
             if (hasSecretConfig(__classPrivateFieldGet(this, _UiPath_config, "f"))) {
                 return;
@@ -9206,6 +9385,11 @@
             if (!AuthService.isInOAuthCallback()) {
                 throw new Error('Not in OAuth callback state. Call initialize() first to start OAuth flow.');
             }
+            // Load config if not yet initialized
+            if (!__classPrivateFieldGet(this, _UiPath_config, "f")) {
+                const loadedConfig = __classPrivateFieldGet(this, _UiPath_instances, "m", _UiPath_loadConfig).call(this);
+                __classPrivateFieldGet(this, _UiPath_instances, "m", _UiPath_initializeWithConfig).call(this, loadedConfig);
+            }
             try {
                 const success = await __classPrivateFieldGet(this, _UiPath_authService, "f").authenticate(__classPrivateFieldGet(this, _UiPath_config, "f"));
                 if (success && this.isAuthenticated()) {
@@ -9223,13 +9407,13 @@
          * Check if the user is authenticated (has valid token)
          */
         isAuthenticated() {
-            return __classPrivateFieldGet(this, _UiPath_authService, "f").hasValidToken();
+            return __classPrivateFieldGet(this, _UiPath_authService, "f")?.hasValidToken() ?? false;
         }
         /**
          * Get the current authentication token
          */
         getToken() {
-            return __classPrivateFieldGet(this, _UiPath_authService, "f").getToken();
+            return __classPrivateFieldGet(this, _UiPath_authService, "f")?.getToken();
         }
         /**
          * Logout from the SDK, clearing all authentication state.
@@ -9237,14 +9421,71 @@
          */
         logout() {
             // Secret-based auth has no session to end — skip silently
-            if (hasSecretConfig(__classPrivateFieldGet(this, _UiPath_config, "f"))) {
+            if (__classPrivateFieldGet(this, _UiPath_config, "f") && hasSecretConfig(__classPrivateFieldGet(this, _UiPath_config, "f"))) {
                 return;
             }
-            __classPrivateFieldGet(this, _UiPath_authService, "f").logout();
+            __classPrivateFieldGet(this, _UiPath_authService, "f")?.logout();
             __classPrivateFieldSet(this, _UiPath_initialized, false, "f");
         }
     };
-    _UiPath_config = new WeakMap(), _UiPath_authService = new WeakMap(), _UiPath_initialized = new WeakMap();
+    _UiPath_config = new WeakMap(), _UiPath_authService = new WeakMap(), _UiPath_initialized = new WeakMap(), _UiPath_partialConfig = new WeakMap(), _UiPath_instances = new WeakSet(), _UiPath_initializeWithConfig = function _UiPath_initializeWithConfig(config) {
+        // Validate and normalize the configuration
+        validateConfig(config);
+        const hasSecretAuth = hasSecretConfig(config);
+        const hasOAuthAuth = hasOAuthConfig(config);
+        // Initialize core components
+        const internalConfig = new UiPathConfig({
+            baseUrl: normalizeBaseUrl(config.baseUrl),
+            orgName: config.orgName,
+            tenantName: config.tenantName,
+            secret: hasSecretAuth ? config.secret : undefined,
+            clientId: hasOAuthAuth ? config.clientId : undefined,
+            redirectUri: hasOAuthAuth ? config.redirectUri : undefined,
+            scope: hasOAuthAuth ? config.scope : undefined
+        });
+        const executionContext = new ExecutionContext();
+        __classPrivateFieldSet(this, _UiPath_authService, new AuthService(internalConfig, executionContext), "f");
+        __classPrivateFieldSet(this, _UiPath_config, internalConfig, "f");
+        // Store internals in SDKInternalsRegistry (not visible on instance)
+        SDKInternalsRegistry.set(this, {
+            config: internalConfig,
+            context: executionContext,
+            tokenManager: __classPrivateFieldGet(this, _UiPath_authService, "f").getTokenManager()
+        });
+        // Expose read-only config for user convenience
+        this.config = {
+            baseUrl: internalConfig.baseUrl,
+            orgName: internalConfig.orgName,
+            tenantName: internalConfig.tenantName
+        };
+        // Initialize telemetry with SDK configuration
+        telemetryClient.initialize({
+            baseUrl: config.baseUrl,
+            orgName: config.orgName,
+            tenantName: config.tenantName,
+            clientId: hasOAuthAuth ? config.clientId : undefined,
+            redirectUri: hasOAuthAuth ? config.redirectUri : undefined
+        });
+        // Track SDK initialization
+        trackEvent('Sdk.Auth');
+        /** Auto-initialize for secret-based auth
+         * When viewed in Action Center, initialize tokenInfo with empty token. When an sdk call is made Action Center passes the token to sdk.
+         */
+        if (hasSecretAuth || isInActionCenter) {
+            __classPrivateFieldGet(this, _UiPath_authService, "f").authenticateWithSecret(config.secret ?? '');
+            __classPrivateFieldSet(this, _UiPath_initialized, true, "f");
+        }
+    }, _UiPath_loadConfig = function _UiPath_loadConfig() {
+        // Load from meta tags
+        const metaConfig = loadFromMetaTags();
+        // Merge with any partial config from constructor (constructor overrides meta tags)
+        const merged = { ...metaConfig, ...__classPrivateFieldGet(this, _UiPath_partialConfig, "f") };
+        if (!isCompleteConfig(merged)) {
+            throw new Error('UiPath SDK configuration not found. ' +
+                'Ensure @uipath/coded-apps plugin is set up in your bundler to inject configuration during development and build.');
+        }
+        return merged;
+    };
 
     /**
      * Type guards for error response types
@@ -9523,15 +9764,6 @@
         async getDefaultHeaders() {
             // Get headers from execution context first
             const contextHeaders = this.executionContext.getHeaders();
-            // If Authorization header is already set in context, use that
-            if (contextHeaders['Authorization']) {
-                return {
-                    ...contextHeaders,
-                    'Content-Type': CONTENT_TYPES.JSON,
-                    ...this.defaultHeaders,
-                    ...this.clientConfig.headers
-                };
-            }
             const token = await this.getValidToken();
             return {
                 ...contextHeaders,
@@ -9546,8 +9778,13 @@
             const normalizedPath = path.startsWith('/') ? path.substring(1) : path;
             // Construct URL with org and tenant names
             const url = new URL(`${this.config.orgName}/${this.config.tenantName}/${normalizedPath}`, this.config.baseUrl).toString();
+            const isFormData = options.body instanceof FormData;
+            const defaultHeaders = await this.getDefaultHeaders();
+            if (isFormData) {
+                delete defaultHeaders['Content-Type'];
+            }
             const headers = {
-                ...await this.getDefaultHeaders(),
+                ...defaultHeaders,
                 ...options.headers
             };
             // Convert params to URLSearchParams
@@ -9558,11 +9795,15 @@
                 });
             }
             const fullUrl = searchParams.toString() ? `${url}?${searchParams.toString()}` : url;
+            let body = undefined;
+            if (options.body) {
+                body = isFormData ? options.body : JSON.stringify(options.body);
+            }
             try {
                 const response = await fetch(fullUrl, {
                     method,
                     headers,
-                    body: options.body ? JSON.stringify(options.body) : undefined,
+                    body,
                     signal: options.signal
                 });
                 if (!response.ok) {
@@ -10853,6 +11094,17 @@
                     fieldName
                 });
             },
+            async uploadAttachment(recordId, fieldName, file, expansionLevel) {
+                if (!entityData.name)
+                    throw new Error('Entity name is undefined');
+                return service.uploadAttachment({
+                    entityName: entityData.name,
+                    recordId,
+                    fieldName,
+                    file,
+                    expansionLevel
+                });
+            },
             async insert(data, options) {
                 return this.insertRecord(data, options);
             },
@@ -11356,6 +11608,42 @@
             });
             return response.data;
         }
+        /**
+         * Uploads an attachment to a File-type field of an entity record
+         *
+         * @param options - Options containing entityName, recordId, fieldName, file, and optional expansionLevel
+         * @returns Promise resolving to the upload response
+         *
+         * @example
+         * ```typescript
+         * import { Entities } from '@uipath/uipath-typescript/entities';
+         *
+         * const entities = new Entities(sdk);
+         *
+         * // Upload a file attachment
+         * const response = await entities.uploadAttachment({
+         *   entityName: 'Invoice',
+         *   recordId: '<record-uuid>',
+         *   fieldName: 'Documents',
+         *   file: file
+         * });
+         * ```
+         */
+        async uploadAttachment(options) {
+            const { entityName, recordId, fieldName, file, expansionLevel } = options;
+            const formData = new FormData();
+            if (file instanceof Uint8Array) {
+                formData.append('file', new Blob([file.buffer]));
+            }
+            else {
+                formData.append('file', file);
+            }
+            const params = createParams({ expansionLevel });
+            const response = await this.post(DATA_FABRIC_ENDPOINTS.ENTITY.UPLOAD_ATTACHMENT(entityName, recordId, fieldName), formData, { params });
+            // Convert PascalCase response to camelCase
+            const camelResponse = pascalToCamelCaseKeys(response.data);
+            return camelResponse;
+        }
         /**
        * @hidden
        * @deprecated Use {@link getAllRecords} instead.
@@ -11489,6 +11777,9 @@
     __decorate([
         track('Entities.DownloadAttachment')
     ], EntityService.prototype, "downloadAttachment", null);
+    __decorate([
+        track('Entities.UploadAttachment')
+    ], EntityService.prototype, "uploadAttachment", null);
 
     class ChoiceSetService extends BaseService {
         /**
@@ -14875,6 +15166,81 @@
         ...CommonFieldMap
     };
 
+    /**
+     * Asset resolution utilities for UiPath Coded Apps
+     *
+     * These helpers enable developers to write code that works identically
+     * in local development and production environments.
+     *
+     * Values are read from meta tags injected at deployment:
+     * - <meta name="uipath:cdn-base" content="https://cdn.example.com/appId/folder">
+     * - <meta name="uipath:app-base" content="/org/apps_/.../public">
+     */
+    /**
+     * Resolves an asset path to the CDN URL (if available)
+     *
+     * In local development: returns path as-is (loads from local dev server)
+     * In production: prepends CDN base URL from meta tag
+     *
+     * @param path - The asset path (e.g., './assets/logo.png' or '/assets/logo.png')
+     * @returns The resolved asset URL
+     *
+     * @example
+     * ```tsx
+     * import { getAsset } from '@uipath/uipath-typescript';
+     * import logoPath from './assets/logo.png';
+     *
+     * function MyComponent() {
+     *   return <img src={getAsset(logoPath)} alt="Logo" />;
+     * }
+     * ```
+     */
+    function getAsset(path) {
+        // If path is already an absolute URL, return as-is
+        if (path.startsWith('http://') || path.startsWith('https://')) {
+            return path;
+        }
+        const cdnBase = getMetaTagContent(exports.UiPathMetaTags.CDN_BASE);
+        if (!cdnBase)
+            return path;
+        // Normalize CDN base URL to remove trailing slash
+        const normalizedCdnBase = normalizeBaseUrl(cdnBase);
+        // Normalize path to ensure it starts with /
+        let normalizedPath = path;
+        if (normalizedPath.startsWith('./')) {
+            normalizedPath = normalizedPath.substring(1); // ./assets -> /assets
+        }
+        else if (!normalizedPath.startsWith('/')) {
+            normalizedPath = '/' + normalizedPath; // assets -> /assets
+        }
+        return normalizedCdnBase + normalizedPath;
+    }
+    /**
+     * Returns the app base path for router configuration
+     *
+     * In local development: returns '/'
+     * In production: returns the deployed app path from meta tag
+     *
+     * @returns The app base path
+     *
+     * @example
+     * ```tsx
+     * import { getAppBase } from '@uipath/uipath-typescript';
+     * import { BrowserRouter } from 'react-router-dom';
+     *
+     * function App() {
+     *   return (
+     *     <BrowserRouter basename={getAppBase()}>
+     *       {/* routes *\/}
+     *     </BrowserRouter>
+     *   );
+     * }
+     * ```
+     */
+    function getAppBase() {
+        return getMetaTagContent(exports.UiPathMetaTags.APP_BASE) || '/';
+    }
+
     exports.APP_NAME = APP_NAME;
     exports.AgentMap = AgentMap;
     exports.AuthenticationError = AuthenticationError;
@@ -14917,6 +15283,8 @@
     exports.createProcessInstanceWithMethods = createProcessInstanceWithMethods;
     exports.createProcessWithMethods = createProcessWithMethods;
     exports.createTaskWithMethods = createTaskWithMethods;
+    exports.getAppBase = getAppBase;
+    exports.getAsset = getAsset;
     exports.getErrorDetails = getErrorDetails;
     exports.getLimitedPageSize = getLimitedPageSize;
     exports.isAuthenticationError = isAuthenticationError;
@@ -14927,6 +15295,7 @@
     exports.isServerError = isServerError;
     exports.isUiPathError = isUiPathError;
     exports.isValidationError = isValidationError;
+    exports.loadFromMetaTags = loadFromMetaTags;
     exports.telemetryClient = telemetryClient;
     exports.track = track;
     exports.trackEvent = trackEvent;