@uipath/auth - npm Package Compare versions

Comparing version 1.199.0-preview.108 to 1.200.0-preview.109

dist/index.d.ts

@@ -5,3 +5,3 @@ export * from "./authContext";
 export { type AuthFileConfig, InvalidBaseUrlError, setAuthFileConfig, } from "./config";
-export { AUTH_CANCELLED_ERROR_CODE } from "./constants";
+export { AUTH_CANCELLED_ERROR_CODE, DEFAULT_AUTH_TIMEOUT_MS, } from "./constants";
 export { ENFORCE_ROBOT_AUTH_VAR, ENV_AUTH_ENABLE_VAR, ENV_AUTH_VARS, EnvAuthConfigError, isEnvAuthEnabled, isRobotAuthEnforced, readAuthFromEnv, } from "./envAuth";
@@ -13,2 +13,3 @@ export { FederatedCredentialsAuthenticationError, federatedCredentialsLogin, JWT_BEARER_ASSERTION_TYPE, } from "./federatedCredentials";
 export { clearRefreshBreaker, loadRefreshBreaker, type RefreshBreakerState, refreshTokenFingerprint, saveRefreshBreaker, } from "./refreshCircuitBreaker";
+export { type RobotClientModuleLoader, registerRobotClientLoader, } from "./robotClientFallback";
 export { INVALID_TENANT_CODE, InvalidTenantError, isTenantSelectionError, type SelectFromList, selectTenantWithDeps, TENANT_SELECTION_REQUIRED_CODE, TenantSelectionError, TenantSelectionRequiredError, } from "./selectTenant";
@@ -15,0 +16,0 @@ export { AUTH_TIMEOUT_ERROR_CODE } from "./server";

dist/robotClientFallback.d.ts

 /**
  * Minimal structural view of `@uipath/robot-client` — covers only the two
- * methods we consume. Defined locally so that this file compiles even when
- * the package is absent (it is loaded via dynamic `import()` at runtime).
+ * methods we consume. Defined locally so this file compiles without the
+ * package present: auth never imports robot-client, it only shapes the value
+ * returned by the host-registered loader (see {@link registerRobotClientLoader}).
  */
@@ -45,3 +46,16 @@ interface IInteractiveConnectFlow {
 }
+/** Host-provided loader for `@uipath/robot-client`. See {@link registerRobotClientLoader}. */
+export type RobotClientModuleLoader = () => Promise<unknown>;
 /**
+ * Register the host's loader for `@uipath/robot-client` (a private GitHub
+ * Package Registry package). The CLI host bundles robot-client once and calls
+ * this at startup with `() => import("@uipath/robot-client")`; auth's Robot
+ * credential fallback then loads the module through the host instead of every
+ * tool bundle inlining its own ~720KB copy. When no loader is registered (or it
+ * fails), the fallback resolves to `undefined` and callers degrade to the
+ * standard "Not logged in" path — the same behaviour as when the Robot service
+ * is absent.
+ */
+export declare const registerRobotClientLoader: (loader: RobotClientModuleLoader) => void;
+/**
  * Read credentials from the running UiPath Robot/Assistant via its local IPC.
@@ -56,3 +70,4 @@ *
  *     `options.force === true`
- *   - `@uipath/robot-client` is not installed or fails to load
+ *   - no robot-client loader is registered (see `registerRobotClientLoader`),
+ *     or the registered loader fails
  *   - Robot is not running, or sign-in is disabled
@@ -59,0 +74,0 @@ *   - an IPC call exceeds the timeout

package.json

 {
   "name": "@uipath/auth",
   "license": "MIT",
-  "version": "1.199.0-preview.108",
+  "version": "1.200.0-preview.109",
   "repository": {
@@ -40,3 +40,3 @@ "type": "git",
   ],
-  "gitHead": "171f68daab68809916e8df10ea198c259f688ede"
+  "gitHead": "fcc01cdae81bbd0c25d3d4fc287537a9d19d99f4"
 }

Fixed alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 12 instances

Improved metrics

Number of low supply chain risk alerts

25

-40.48%

Number of medium supply chain risk alerts

18

-5.26%

Worsened metrics

Total package byte prevSize

1162964

-38.72%

Lines of code

25057

-41.67%

No dependency changes