@uipath/uipath-typescript 1.3.11 → 1.4.1

package/dist/core/index.mjs

@@ -4011,7 +4011,7 @@ object({
     secret: string().optional(),
     clientId: string().optional(),
     redirectUri: string().url().optional(),
-    scope: string().optional()
+    scope: string().optional(),
 });
 class UiPathConfig {
     constructor(options) {
@@ -4062,6 +4062,32 @@ class ExecutionContext {
  */
 const isBrowser = typeof window !== 'undefined' && typeof window.document !== 'undefined';
 const isInActionCenter = isBrowser && window.self != window.top && window.location.href.includes('source=ActionCenter');
+const _params = isBrowser ? new URLSearchParams(window.location.search) : null;
+/**
+ * True when the coded app has been loaded inside a host frame that explicitly
+ * opted into token delegation by adding `?host=embed` to the iframe src URL.
+ */
+const isHostEmbedded = isBrowser && window.self !== window.top && _params?.get('host') === 'embed';
+/**
+ * The validated parent origin, read from the `?basedomain=` query param set
+ * by the embedding host in the iframe src URL.
+ * Mirrors the same mechanism used by ActionCenterTokenManager.
+ * Non-null only when `?host=embed` is present and `?basedomain=` is a valid URL.
+ */
+const embeddingOrigin = (() => {
+    if (!isHostEmbedded)
+        return null;
+    const basedomain = _params?.get('basedomain');
+    if (!basedomain)
+        return null;
+    try {
+        return new URL(basedomain).origin;
+    }
+    catch {
+        console.warn('embeddingOrigin: basedomain query param is not a valid URL', basedomain);
+        return null;
+    }
+})();
 
 /**
  * Session storage keys used by the auth module
@@ -4449,6 +4475,24 @@ var TaskActivityType;
     TaskActivityType["BulkCompleted"] = "BulkCompleted";
     TaskActivityType["FirstOpened"] = "FirstOpened";
 })(TaskActivityType || (TaskActivityType = {}));
+/**
+ * Defines how a task assignment is distributed.
+ *
+ * Defaults to {@link TaskAssignmentCriteria.SingleUser} (a direct single-user
+ * assignment) when not specified. The group-based criteria tell Action Center
+ * how to distribute the task across the members of a directory group.
+ */
+var TaskAssignmentCriteria;
+(function (TaskAssignmentCriteria) {
+    /** Assigned to a single user, like a direct assignment. */
+    TaskAssignmentCriteria["SingleUser"] = "SingleUser";
+    /** Assigned to the group member with the fewest pending tasks. */
+    TaskAssignmentCriteria["Workload"] = "Workload";
+    /** Assigned to all users in the group. */
+    TaskAssignmentCriteria["AllUsers"] = "AllUsers";
+    /** Assigned in a round-robin manner across the group's members. */
+    TaskAssignmentCriteria["RoundRobin"] = "RoundRobin";
+})(TaskAssignmentCriteria || (TaskAssignmentCriteria = {}));
 
 /**
  * Base path constants for different services
@@ -4494,6 +4538,105 @@ var ActionCenterEventNames;
 })(ActionCenterEventNames || (ActionCenterEventNames = {}));
 
 const AUTHENTICATION_TIMEOUT = 8000;
+const ALLOWED_HOST_ORIGINS = new Set([
+    'https://alpha.uipath.com',
+    'https://staging.uipath.com',
+    'https://cloud.uipath.com',
+]);
+/**
+ * Returns true if the origin is a trusted UiPath host that may initiate
+ * token delegation. Mirrors the same allowlist used by ActionCenterTokenManager.
+ */
+function isValidHostOrigin(origin) {
+    if (!origin)
+        return false;
+    if (ALLOWED_HOST_ORIGINS.has(origin))
+        return true;
+    try {
+        return new URL(origin).hostname === 'localhost';
+    }
+    catch {
+        console.warn('isValidHostOrigin: received a malformed origin URL', origin);
+        return false;
+    }
+}
+function isTokenExpired(tokenInfo) {
+    if (!tokenInfo?.expiresAt)
+        return true;
+    return new Date() >= tokenInfo.expiresAt;
+}
+/**
+ * The validated host origin when the app is running as a trusted, generic
+ * host-embedded app (`?host=embed&basedomain=<origin>` with an allowlisted
+ * UiPath origin); otherwise null. Shared by TokenManager (to create the
+ * EmbeddedTokenManager) and UiPath init (to seed an empty token so getValidToken
+ * can bootstrap the postMessage token flow), which previously duplicated this
+ * condition inline.
+ */
+const trustedEmbeddingOrigin = isHostEmbedded && embeddingOrigin && isValidHostOrigin(embeddingOrigin) ? embeddingOrigin : null;
+/**
+ * Waits for the next window message that satisfies `filter`.
+ * Rejects if the AbortSignal fires before a matching message arrives.
+ */
+function waitForMessage(filter, signal) {
+    return new Promise((resolve, reject) => {
+        const handler = (event) => {
+            if (!filter(event))
+                return;
+            window.removeEventListener('message', handler);
+            resolve(event);
+        };
+        signal.addEventListener('abort', () => {
+            window.removeEventListener('message', handler);
+            reject(signal.reason);
+        }, { once: true });
+        window.addEventListener('message', handler);
+    });
+}
+/**
+ * Sends a token-refresh request to a parent host frame and waits for the
+ * response. Handles timeout, origin filtering, and listener cleanup.
+ *
+ * Both ActionCenterTokenManager and EmbeddedTokenManager delegate to this
+ * function; they differ only in the event names and message shape they use.
+ */
+function requestHostToken(options) {
+    const { pinnedOrigin, sendRequest, responseEventType, extractToken, onTokenRefreshed } = options;
+    const controller = new AbortController();
+    const cancel = () => controller.abort(new AuthenticationError({
+        message: 'Token refresh cancelled',
+        statusCode: HttpStatus.UNAUTHORIZED,
+    }));
+    const promise = (async () => {
+        const timer = setTimeout(() => controller.abort(new AuthenticationError({
+            message: `Token refresh timed out after ${AUTHENTICATION_TIMEOUT}ms waiting for host response`,
+            statusCode: HttpStatus.UNAUTHORIZED,
+        })), AUTHENTICATION_TIMEOUT);
+        try {
+            // Register listener before sending — avoids any race between send and response
+            const responsePromise = waitForMessage(event => event.origin === pinnedOrigin && event.data?.eventType === responseEventType, controller.signal);
+            sendRequest();
+            const event = await responsePromise;
+            const token = extractToken(event.data);
+            if (!token) {
+                throw new AuthenticationError({
+                    message: 'Host responded but did not include a valid access token',
+                    statusCode: HttpStatus.UNAUTHORIZED,
+                });
+            }
+            // type: 'secret' intentionally prevents the SDK's internal OAuth refresh path
+            // from running — the host manager owns the refresh cycle via requestHostToken.
+            // This mirrors the same pattern used by ActionCenterTokenManager.
+            onTokenRefreshed({ token: token.accessToken, type: 'secret', expiresAt: token.expiresAt });
+            return token.accessToken;
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    })();
+    return { promise, cancel };
+}
+
 class ActionCenterTokenManager {
     constructor(config, onTokenRefreshed) {
         this.config = config;
@@ -4502,85 +4645,283 @@ class ActionCenterTokenManager {
         this.refreshPromise = null;
     }
     async refreshAccessToken(tokenInfo) {
-        if (!this.isTokenExpired(tokenInfo)) {
+        if (!isTokenExpired(tokenInfo)) {
             return tokenInfo.token;
         }
         if (this.refreshPromise) {
             return this.refreshPromise;
         }
-        this.refreshPromise = new Promise((resolve, reject) => {
-            const content = {
+        const parentOrigin = this.parentOrigin;
+        if (!parentOrigin) {
+            return Promise.reject(new AuthenticationError({
+                message: 'Cannot refresh token: basedomain query parameter is missing',
+                statusCode: HttpStatus.UNAUTHORIZED,
+            }));
+        }
+        // Guard before requestHostToken registers the inbound listener — an untrusted
+        // basedomain would otherwise leave the listener live for the full timeout window,
+        // accepting a forged TOKENREFRESHED from that origin.
+        if (!isValidHostOrigin(parentOrigin)) {
+            return Promise.reject(new AuthenticationError({
+                message: 'Cannot refresh token: basedomain is not a trusted UiPath host origin',
+                statusCode: HttpStatus.UNAUTHORIZED,
+            }));
+        }
+        const { promise } = requestHostToken({
+            pinnedOrigin: parentOrigin,
+            sendRequest: () => this.sendMessageToParent(ActionCenterEventNames.REFRESHTOKEN, {
                 clientId: this.config.clientId,
                 scope: this.config.scope,
-            };
-            this.sendMessageToParent(ActionCenterEventNames.REFRESHTOKEN, content);
-            const messageListener = (event) => {
-                if (event.origin !== this.parentOrigin)
-                    return;
-                if (event.data?.eventType !== ActionCenterEventNames.TOKENREFRESHED)
-                    return;
-                clearTimeout(timer);
-                if (event.data?.content?.token) {
-                    const { accessToken, expiresAt } = event.data.content.token;
-                    this.onTokenRefreshed({ token: accessToken, type: 'secret', expiresAt });
-                    resolve(accessToken);
-                }
-                else {
-                    reject(new AuthenticationError({
-                        message: 'Failed to fetch access token',
-                        statusCode: HttpStatus.UNAUTHORIZED,
-                    }));
-                }
-                this.refreshPromise = null;
-                this.cleanup(messageListener);
-            };
-            const timer = setTimeout(() => {
-                reject(new AuthenticationError({
-                    message: 'Failed to fetch access token',
-                    statusCode: HttpStatus.UNAUTHORIZED,
-                }));
-                this.refreshPromise = null;
-                this.cleanup(messageListener);
-            }, AUTHENTICATION_TIMEOUT);
-            window.addEventListener('message', messageListener);
+            }),
+            responseEventType: ActionCenterEventNames.TOKENREFRESHED,
+            extractToken: (data) => {
+                const token = data?.content?.token;
+                if (!token?.accessToken)
+                    return undefined;
+                return { accessToken: token.accessToken, expiresAt: token.expiresAt };
+            },
+            onTokenRefreshed: this.onTokenRefreshed,
         });
-        return this.refreshPromise;
-    }
-    isTokenExpired(tokenInfo) {
-        if (!tokenInfo?.expiresAt) {
-            return true;
+        this.refreshPromise = promise;
+        try {
+            return await this.refreshPromise;
+        }
+        finally {
+            this.refreshPromise = null;
         }
-        return new Date() >= tokenInfo.expiresAt;
     }
     sendMessageToParent(eventType, content) {
-        if (window.parent && this.isValidOrigin(this.parentOrigin)) {
+        if (window.parent && isValidHostOrigin(this.parentOrigin)) {
             try {
                 window.parent.postMessage({ eventType, content }, this.parentOrigin);
             }
             catch (error) {
-                console.warn('Failed to send message to Action Center', JSON.stringify(error));
+                console.warn('ActionCenterTokenManager: postMessage to host failed', JSON.stringify(error));
             }
         }
     }
-    cleanup(messageListener) {
-        window.removeEventListener('message', messageListener);
+}
+
+/**
+ * Event names and payload types for the UIP.* postMessage protocol used
+ * when a coded app is embedded inside a UiPath host (e.g. Governance Portal, Insights UI).
+ *
+ * Flow — app-initiated, mirrors the Action Center protocol:
+ *  App → Host: UIP.refreshToken   (requests a token; carries clientId + scope
+ *                                   so the host knows which OAuth client to use)
+ *  Host → App: UIP.tokenRefreshed (delivers the access token)
+ *
+ * Detection: the host signals embedding via `?host=embed&basedomain=<origin>` in
+ * the iframe src URL. No explicit init message from the host is required.
+ */
+var UipEmbeddedEventNames;
+(function (UipEmbeddedEventNames) {
+    UipEmbeddedEventNames["REFRESH_TOKEN"] = "UIP.refreshToken";
+    UipEmbeddedEventNames["TOKEN_REFRESHED"] = "UIP.tokenRefreshed";
+})(UipEmbeddedEventNames || (UipEmbeddedEventNames = {}));
+
+function parseExpiresAt(raw) {
+    const d = new Date(raw);
+    if (isNaN(d.getTime())) {
+        console.warn('EmbeddedTokenManager: host sent a malformed expiresAt value — treating token as already expired', raw);
+        return new Date(0);
     }
-    isValidOrigin(origin) {
-        const ALLOWED_ORIGINS = ['https://alpha.uipath.com', 'https://staging.uipath.com', 'https://cloud.uipath.com'];
-        if (!origin) {
-            return false;
+    return d;
+}
+function extractToken(data) {
+    const token = data?.content?.token;
+    if (!token?.accessToken)
+        return undefined;
+    return { accessToken: token.accessToken, expiresAt: parseExpiresAt(token.expiresAt) };
+}
+/**
+ * Handles token delegation for coded apps embedded inside a UiPath host
+ * (e.g. Governance Portal, Insights UI).
+ *
+ * Detection: the host signals embedding via `?host=embed&basedomain=<origin>`
+ * in the iframe src URL. `parentOrigin` is read from `?basedomain=` and validated
+ * against the trusted UiPath host allowlist before this manager is constructed.
+ * This mirrors the mechanism used by ActionCenterTokenManager.
+ *
+ * On every token expiry the SDK sends `UIP.refreshToken` with `clientId` and
+ * `scope`; the host performs silent SSO and responds with `UIP.tokenRefreshed`.
+ */
+class EmbeddedTokenManager {
+    /**
+     * @param parentOrigin Validated UiPath host origin from the `?basedomain=` query parameter.
+     * @param config SDK configuration — `clientId` and `scope` are required and forwarded
+     *   in every `UIP.refreshToken` request so the host knows which OAuth client to use.
+     * @param onTokenRefreshed Called with the refreshed TokenInfo so the caller
+     *   can persist it in the execution context.
+     * @throws {AuthenticationError} if `config.clientId` or `config.scope` are not set.
+     */
+    constructor(parentOrigin, config, onTokenRefreshed) {
+        this.parentOrigin = parentOrigin;
+        this.onTokenRefreshed = onTokenRefreshed;
+        this.refreshPromise = null;
+        this.cancelRefresh = null;
+        if (!config.clientId || !config.scope) {
+            throw new ValidationError({
+                message: 'EmbeddedTokenManager requires clientId and scope to be configured for host-delegated authentication',
+            });
         }
-        if (ALLOWED_ORIGINS.includes(origin)) {
-            return true;
+        this.clientId = config.clientId;
+        this.scope = config.scope;
+    }
+    async refreshAccessToken(tokenInfo) {
+        if (!isTokenExpired(tokenInfo)) {
+            return tokenInfo.token;
         }
+        if (this.refreshPromise) {
+            return this.refreshPromise;
+        }
+        const { promise, cancel } = requestHostToken({
+            pinnedOrigin: this.parentOrigin,
+            sendRequest: () => {
+                try {
+                    const message = {
+                        eventType: UipEmbeddedEventNames.REFRESH_TOKEN,
+                        content: { clientId: this.clientId, scope: this.scope },
+                    };
+                    window.parent.postMessage(message, this.parentOrigin);
+                }
+                catch (error) {
+                    console.warn('EmbeddedTokenManager: postMessage to host failed', error);
+                }
+            },
+            responseEventType: UipEmbeddedEventNames.TOKEN_REFRESHED,
+            extractToken,
+            onTokenRefreshed: this.onTokenRefreshed,
+        });
+        this.cancelRefresh = cancel;
+        this.refreshPromise = promise;
         try {
-            const url = new URL(origin);
-            return url.hostname === 'localhost';
+            return await this.refreshPromise;
         }
-        catch {
-            return false;
+        finally {
+            this.refreshPromise = null;
+            this.cancelRefresh = null;
         }
     }
+    /** Cancels any in-flight token-refresh request. */
+    destroy() {
+        this.cancelRefresh?.();
+    }
+}
+
+/**
+ * SDK Telemetry constants.
+ *
+ * Only the SDK's identity (version, service name, role name, …) lives
+ * here. The Application Insights connection string is injected into
+ * `@uipath/core-telemetry` itself at publish time, and the generic attribute
+ * keys (`Version`, `Service`, `CloudOrganizationName`, …) are owned by
+ * `@uipath/core-telemetry` and consumed there — they are not part of the
+ * SDK's public API.
+ */
+/** SDK version placeholder — patched by the SDK publish workflow. */
+const SDK_VERSION = '1.4.1';
+const CLOUD_ROLE_NAME = 'uipath-ts-sdk';
+const SDK_SERVICE_NAME = 'UiPath.TypeScript.Sdk';
+const SDK_LOGGER_NAME = 'uipath-ts-sdk-telemetry';
+const SDK_RUN_EVENT = 'Sdk.Run';
+
+/**
+ * UiPath TypeScript SDK Telemetry
+ *
+ * Constructs the SDK's own `TelemetryClient` and binds the SDK-local
+ * `track` / `trackEvent` to it. Each consumer of `@uipath/core-telemetry`
+ * does this independently, so events carry their own consumer's identity
+ * and tenant context.
+ */
+// Keyed by `CLOUD_ROLE_NAME` so every SDK subpath bundle resolves to the
+// same `TelemetryClient` instance at runtime. A single `initialize(...)`
+// from the `UiPath` constructor therefore wires up `@track` decorators
+// across every subpath bundle (`assets`, `feedback`, `tasks`, …).
+const sdkClient = getOrCreateClient(CLOUD_ROLE_NAME);
+const track = createTrack(sdkClient);
+const trackEvent = createTrackEvent(sdkClient);
+const telemetryClient = {
+    initialize(context) {
+        sdkClient.initialize({
+            sdkVersion: SDK_VERSION,
+            serviceName: SDK_SERVICE_NAME,
+            cloudRoleName: CLOUD_ROLE_NAME,
+            loggerName: SDK_LOGGER_NAME,
+            defaultEventName: SDK_RUN_EVENT,
+            context,
+        });
+    },
+    /**
+     * Sets the authenticated user's id so every subsequently emitted event
+     * carries it as `CloudUserId`.
+     */
+    setUserId(userId) {
+        sdkClient.setUserId(userId);
+    },
+};
+
+/**
+ * Base64 encoding/decoding
+ */
+/**
+ * Decodes a base64 string
+ * @param base64 - The base64 string to decode
+ * @returns Decoded string
+ */
+function decodeBase64(base64) {
+    let bytes;
+    if (isBrowser) {
+        // Browser environment
+        const binaryString = atob(base64);
+        bytes = new Uint8Array(binaryString.length);
+        for (let i = 0; i < binaryString.length; i++) {
+            bytes[i] = binaryString.charCodeAt(i);
+        }
+    }
+    else {
+        // Node.js environment
+        bytes = new Uint8Array(Buffer.from(base64, 'base64'));
+    }
+    // TextDecoder for UTF-8 decoding (works in both browser and Node.js)
+    const decoder = new TextDecoder();
+    return decoder.decode(bytes);
+}
+
+/**
+ * JWT decoding helpers — payload inspection only, no signature verification.
+ */
+const BASE64URL_DASH_RE = /-/g;
+const BASE64URL_UNDERSCORE_RE = /_/g;
+/**
+ * Converts a base64url-encoded JWT segment to standard base64 with padding.
+ */
+function base64UrlToBase64(value) {
+    const base64 = value
+        .replace(BASE64URL_DASH_RE, '+')
+        .replace(BASE64URL_UNDERSCORE_RE, '/');
+    return base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), '=');
+}
+/**
+ * Extracts the user id (`sub` claim) from a JWT access token payload.
+ * Returns an empty string for opaque (non-JWT) tokens or malformed payloads.
+ *
+ * @param token - The access token to inspect
+ * @returns The user id, or an empty string if it cannot be extracted
+ */
+function extractUserIdFromToken(token) {
+    try {
+        const payload = token.split('.')[1];
+        if (!payload) {
+            return '';
+        }
+        const claims = JSON.parse(decodeBase64(base64UrlToBase64(payload)));
+        const sub = claims['sub'];
+        return typeof sub === 'string' && sub ? sub : '';
+    }
+    catch {
+        return '';
+    }
 }
 
 /**
@@ -4602,10 +4943,15 @@ class TokenManager {
         this.isOAuth = isOAuth;
         this.refreshPromise = null;
         this.actionCenterTokenManager = null;
+        this.embeddedTokenManager = null;
         if (isInActionCenter) {
             this.actionCenterTokenManager = new ActionCenterTokenManager(config, (tokenInfo) => this.setToken(tokenInfo));
             this.isOAuth = false;
         }
+        else if (trustedEmbeddingOrigin) {
+            this.embeddedTokenManager = new EmbeddedTokenManager(trustedEmbeddingOrigin, config, tokenInfo => this.setToken(tokenInfo));
+            this.isOAuth = false;
+        }
     }
     /**
      * Checks if a token is expired
@@ -4636,6 +4982,10 @@ class TokenManager {
         if (this.actionCenterTokenManager) {
             return await this.actionCenterTokenManager.refreshAccessToken(tokenInfo);
         }
+        // Generic embedded path — active whenever the app is embedded in a UiPath host page
+        if (this.embeddedTokenManager) {
+            return await this.embeddedTokenManager.refreshAccessToken(tokenInfo);
+        }
         // For secret-based tokens, they never expire
         if (tokenInfo.type === 'secret') {
             return tokenInfo.token;
@@ -4774,6 +5124,13 @@ class TokenManager {
         }
         return true;
     }
+    /**
+     * Releases resources held by this instance.
+     * Must be called when the TokenManager is no longer needed to prevent listener leaks.
+     */
+    destroy() {
+        this.embeddedTokenManager?.destroy();
+    }
     /**
      * Clears the current token
      */
@@ -4795,6 +5152,7 @@ class TokenManager {
      */
     _updateExecutionContext(tokenInfo) {
         this.executionContext.set('tokenInfo', tokenInfo);
+        telemetryClient.setUserId(extractUserIdFromToken(tokenInfo.token));
     }
     /**
      * Refreshes the access token using the stored refresh token.
@@ -4824,6 +5182,9 @@ class TokenManager {
      * Internal method to perform the actual token refresh
      */
     async _doRefreshToken() {
+        // Destructure before the type guard — hasOAuthConfig narrows this.config to
+        // { clientId, redirectUri, scope } which does not include BaseConfig fields.
+        const { orgName, baseUrl } = this.config;
         // Check if we're in OAuth flow
         if (!hasOAuthConfig(this.config)) {
             throw new Error('refreshAccessToken is only available in OAuth flow');
@@ -4833,13 +5194,12 @@ class TokenManager {
         if (!tokenInfo?.refreshToken) {
             throw new Error('No refresh token available. User may need to re-authenticate.');
         }
-        const orgName = this.config.orgName;
         const body = new URLSearchParams({
             grant_type: 'refresh_token',
             client_id: this.config.clientId,
             refresh_token: tokenInfo.refreshToken
         });
-        const response = await fetch(`${this.config.baseUrl}/${orgName}/identity_/connect/token`, {
+        const response = await fetch(`${baseUrl}/${orgName}/identity_/connect/token`, {
             method: 'POST',
             headers: {
                 'Content-Type': 'application/x-www-form-urlencoded'
@@ -5299,51 +5659,6 @@ function normalizeBaseUrl(url) {
     return url.endsWith('/') ? url.slice(0, -1) : url;
 }
 
-/**
- * SDK Telemetry constants.
- *
- * Only the SDK's identity (version, service name, role name, …) lives
- * here. The Application Insights connection string is injected into
- * `@uipath/core-telemetry` itself at publish time, and the generic attribute
- * keys (`Version`, `Service`, `CloudOrganizationName`, …) are owned by
- * `@uipath/core-telemetry` and consumed there — they are not part of the
- * SDK's public API.
- */
-/** SDK version placeholder — patched by the SDK publish workflow. */
-const SDK_VERSION = '1.3.11';
-const CLOUD_ROLE_NAME = 'uipath-ts-sdk';
-const SDK_SERVICE_NAME = 'UiPath.TypeScript.Sdk';
-const SDK_LOGGER_NAME = 'uipath-ts-sdk-telemetry';
-const SDK_RUN_EVENT = 'Sdk.Run';
-
-/**
- * UiPath TypeScript SDK Telemetry
- *
- * Constructs the SDK's own `TelemetryClient` and binds the SDK-local
- * `track` / `trackEvent` to it. Each consumer of `@uipath/core-telemetry`
- * does this independently, so events carry their own consumer's identity
- * and tenant context.
- */
-// Keyed by `CLOUD_ROLE_NAME` so every SDK subpath bundle resolves to the
-// same `TelemetryClient` instance at runtime. A single `initialize(...)`
-// from the `UiPath` constructor therefore wires up `@track` decorators
-// across every subpath bundle (`assets`, `feedback`, `tasks`, …).
-const sdkClient = getOrCreateClient(CLOUD_ROLE_NAME);
-const track = createTrack(sdkClient);
-const trackEvent = createTrackEvent(sdkClient);
-const telemetryClient = {
-    initialize(context) {
-        sdkClient.initialize({
-            sdkVersion: SDK_VERSION,
-            serviceName: SDK_SERVICE_NAME,
-            cloudRoleName: CLOUD_ROLE_NAME,
-            loggerName: SDK_LOGGER_NAME,
-            defaultEventName: SDK_RUN_EVENT,
-            context,
-        });
-    },
-};
-
 /**
  * SDK Internals Registry - Internal registry for SDK instances
  *
@@ -5453,7 +5768,7 @@ function loadFromMetaTags() {
     return hasAnyValue ? config : null;
 }
 
-var _UiPath_instances, _UiPath_config, _UiPath_authService, _UiPath_initialized, _UiPath_partialConfig, _UiPath_multiLogin, _UiPath_metaFolderKey, _UiPath_initializeWithConfig, _UiPath_loadConfig;
+var _UiPath_instances, _UiPath_config, _UiPath_authService, _UiPath_initialized, _UiPath_partialConfig, _UiPath_multiLogin, _UiPath_metaFolderKey, _UiPath_metaOrgId, _UiPath_metaTenantId, _UiPath_initializeWithConfig, _UiPath_loadConfig;
 /**
  * UiPath - Core SDK class for authentication and configuration management.
  *
@@ -5498,9 +5813,18 @@ class UiPath {
         // deployments). Not accepted via the public constructor; lives here so the
         // SDK can flow it through to BaseService.config without polluting BaseConfig.
         _UiPath_metaFolderKey.set(this, void 0);
+        // Org/tenant ids captured from the meta tags before the constructor config
+        // is merged in. The `uipath:org-name`/`uipath:tenant-name` meta tags always
+        // carry org/tenant *ids* in coded-app deployments, whereas a
+        // constructor-supplied `orgName`/`tenantName` may be actual names — so the
+        // telemetry ids must be read from the meta tags.
+        _UiPath_metaOrgId.set(this, void 0);
+        _UiPath_metaTenantId.set(this, void 0);
         // Load configuration from meta tags
         const configFromMetaTags = loadFromMetaTags();
         __classPrivateFieldSet(this, _UiPath_metaFolderKey, configFromMetaTags?.folderKey, "f");
+        __classPrivateFieldSet(this, _UiPath_metaOrgId, configFromMetaTags?.orgName, "f");
+        __classPrivateFieldSet(this, _UiPath_metaTenantId, configFromMetaTags?.tenantName, "f");
         // Merge configuration: constructor config overrides meta tags
         const mergedConfig = config ? { ...configFromMetaTags, ...config } : configFromMetaTags;
         if (mergedConfig && isCompleteConfig(mergedConfig)) {
@@ -5607,6 +5931,13 @@ class UiPath {
     getToken() {
         return __classPrivateFieldGet(this, _UiPath_authService, "f")?.getToken();
     }
+    /**
+     * Releases resources held by this SDK instance.
+     * Cancels any in-flight token-refresh request. Call this when the coded app is unmounted.
+     */
+    destroy() {
+        __classPrivateFieldGet(this, _UiPath_authService, "f")?.getTokenManager()?.destroy();
+    }
     /**
      * Logout from the SDK, clearing all authentication state.
      * After calling this method, the user will need to re-initialize to authenticate again.
@@ -5629,7 +5960,7 @@ class UiPath {
         __classPrivateFieldGet(this, _UiPath_authService, "f")?.updateToken(tokenInfo);
     }
 }
-_UiPath_config = new WeakMap(), _UiPath_authService = new WeakMap(), _UiPath_initialized = new WeakMap(), _UiPath_partialConfig = new WeakMap(), _UiPath_multiLogin = new WeakMap(), _UiPath_metaFolderKey = new WeakMap(), _UiPath_instances = new WeakSet(), _UiPath_initializeWithConfig = function _UiPath_initializeWithConfig(config) {
+_UiPath_config = new WeakMap(), _UiPath_authService = new WeakMap(), _UiPath_initialized = new WeakMap(), _UiPath_partialConfig = new WeakMap(), _UiPath_multiLogin = new WeakMap(), _UiPath_metaFolderKey = new WeakMap(), _UiPath_metaOrgId = new WeakMap(), _UiPath_metaTenantId = new WeakMap(), _UiPath_instances = new WeakSet(), _UiPath_initializeWithConfig = function _UiPath_initializeWithConfig(config) {
     // Validate and normalize the configuration
     validateConfig(config);
     const hasSecretAuth = hasSecretConfig(config);
@@ -5665,9 +5996,11 @@ _UiPath_config = new WeakMap(), _UiPath_authService = new WeakMap(), _UiPath_ini
         orgName: internalConfig.orgName,
         tenantName: internalConfig.tenantName
     };
-    // Initialize telemetry with SDK configuration
+    // Initialize telemetry with SDK configuration.
     telemetryClient.initialize({
         baseUrl: config.baseUrl,
+        orgId: __classPrivateFieldGet(this, _UiPath_metaOrgId, "f"),
+        tenantId: __classPrivateFieldGet(this, _UiPath_metaTenantId, "f"),
         orgName: config.orgName,
         tenantName: config.tenantName,
         clientId: hasOAuthAuth ? config.clientId : undefined,
@@ -5675,10 +6008,12 @@ _UiPath_config = new WeakMap(), _UiPath_authService = new WeakMap(), _UiPath_ini
     });
     // Track SDK initialization
     trackEvent('Sdk.Auth');
-    /** Auto-initialize for secret-based auth
-     * When viewed in Action Center, initialize tokenInfo with empty token. When an sdk call is made Action Center passes the token to sdk.
+    /** Auto-initialize for secret-based auth, Action Center, and generic host-embedded apps.
+     * When viewed in Action Center or embedded in a UiPath host frame via the UIP protocol,
+     * initialize tokenInfo with an empty token so getValidToken() can bootstrap via postMessage.
+     * When an sdk call is made, the host passes the token to the sdk.
      */
-    if (hasSecretAuth || isInActionCenter) {
+    if (hasSecretAuth || isInActionCenter || trustedEmbeddingOrigin) {
         __classPrivateFieldGet(this, _UiPath_authService, "f").authenticateWithSecret(config.secret ?? '');
         __classPrivateFieldSet(this, _UiPath_initialized, true, "f");
     }
@@ -5686,6 +6021,8 @@ _UiPath_config = new WeakMap(), _UiPath_authService = new WeakMap(), _UiPath_ini
     // Load from meta tags
     const metaConfig = loadFromMetaTags();
     __classPrivateFieldSet(this, _UiPath_metaFolderKey, metaConfig?.folderKey, "f");
+    __classPrivateFieldSet(this, _UiPath_metaOrgId, metaConfig?.orgName, "f");
+    __classPrivateFieldSet(this, _UiPath_metaTenantId, metaConfig?.tenantName, "f");
     // Merge with any partial config from constructor (constructor overrides meta tags)
     const merged = { ...metaConfig, ...__classPrivateFieldGet(this, _UiPath_partialConfig, "f") };
     if (!isCompleteConfig(merged)) {