@depup/openai 7.7.0-depup.0 → 7.8.0-depup.0

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## [7.8.0](https://github.com/openai/openai-node/compare/v7.7.0...v7.8.0) (2026-08-27)
+
+
+### Features
+
+* **api:** add compute_units to Responses and Chat Completions usage ([#2505](https://github.com/openai/openai-node/issues/2505)) ([f9b1313](https://github.com/openai/openai-node/commit/f9b131388a270451eec7242aa0d302e2135b1d3e))
+* **api:** add default WebSocket User-Agent and audit log events ([#2504](https://github.com/openai/openai-node/issues/2504)) ([9b2f089](https://github.com/openai/openai-node/commit/9b2f0892c9fde399163bea59d4aa9bc4ba0ae03e))
+
+
+### Bug Fixes
+
+* **auth:** clamp the workload-identity refresh buffer to the token lifetime ([#2490](https://github.com/openai/openai-node/issues/2490)) ([76b73a9](https://github.com/openai/openai-node/commit/76b73a9c73aafe11c60a425a82898705f1db966d))
+* **auth:** secure first-class X.509 workload credentials ([#2479](https://github.com/openai/openai-node/issues/2479)) ([1b36c19](https://github.com/openai/openai-node/commit/1b36c19c011bcb9775a5cecb0d8a1bd072b74cd6))
+* **deps:** harden dependency and release boundaries ([#2484](https://github.com/openai/openai-node/issues/2484)) ([b21ff45](https://github.com/openai/openai-node/commit/b21ff456e7bd578547c456e5f7abd1d494a02090))
+* **events:** settle WebSocket waiters when listeners throw ([#2491](https://github.com/openai/openai-node/issues/2491)) ([b5a13a7](https://github.com/openai/openai-node/commit/b5a13a7dc8c95669440ec87662bcae8227b398d9))
+* restore native browser ESM imports ([#2495](https://github.com/openai/openai-node/issues/2495)) ([c8cab1e](https://github.com/openai/openai-node/commit/c8cab1e90eb5daf05d17d5c90492e6728afa91b7))
+* **uploads:** detect multipart bodies from own properties only ([#2492](https://github.com/openai/openai-node/issues/2492)) ([559ffc8](https://github.com/openai/openai-node/commit/559ffc8079d0ae716bbf7915305e7db6ecc016a1))
+
 ## [7.7.0](https://github.com/openai/openai-node/compare/v7.6.0...v7.7.0) (2026-08-26)
 
 

package/README.md

@@ -13,7 +13,7 @@ npm install @depup/openai
 
 | Field | Value |
 |-------|-------|
-| Original | [openai](https://www.npmjs.com/package/openai) @ 7.7.0 |
+| Original | [openai](https://www.npmjs.com/package/openai) @ 7.8.0 |
 | Processed | 2026-08-27 |
 | Smoke test | passed |
 | Deps updated | 0 |

package/auth/index.d.mts

@@ -1,4 +1,4 @@
-export type { WorkloadIdentity, X509WorkloadIdentity, SubjectTokenProvider, TokenExchangeResponse, } from "./types.mjs";
+export type { WorkloadIdentity, X509WorkloadIdentity, X509Credential, SubjectTokenProvider, TokenExchangeResponse, } from "./types.mjs";
 export { k8sServiceAccountTokenProvider, azureManagedIdentityTokenProvider, gcpIDTokenProvider, } from "./subject-token-providers.mjs";
 export { OAuthError, SubjectTokenProviderError } from "../core/error.mjs";
 //# sourceMappingURL=index.d.mts.map

package/auth/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../src/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,GACtB,oBAAgB;AAEjB,OAAO,EACL,8BAA8B,EAC9B,iCAAiC,EACjC,kBAAkB,GACnB,sCAAkC;AAEnC,OAAO,EAAE,UAAU,EAAE,yBAAyB,EAAE,0BAAsB"}
+{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../src/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,cAAc,EACd,oBAAoB,EACpB,qBAAqB,GACtB,oBAAgB;AAEjB,OAAO,EACL,8BAA8B,EAC9B,iCAAiC,EACjC,kBAAkB,GACnB,sCAAkC;AAEnC,OAAO,EAAE,UAAU,EAAE,yBAAyB,EAAE,0BAAsB"}

package/auth/index.d.ts

@@ -1,4 +1,4 @@
-export type { WorkloadIdentity, X509WorkloadIdentity, SubjectTokenProvider, TokenExchangeResponse, } from "./types.js";
+export type { WorkloadIdentity, X509WorkloadIdentity, X509Credential, SubjectTokenProvider, TokenExchangeResponse, } from "./types.js";
 export { k8sServiceAccountTokenProvider, azureManagedIdentityTokenProvider, gcpIDTokenProvider, } from "./subject-token-providers.js";
 export { OAuthError, SubjectTokenProviderError } from "../core/error.js";
 //# sourceMappingURL=index.d.ts.map

package/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,GACtB,mBAAgB;AAEjB,OAAO,EACL,8BAA8B,EAC9B,iCAAiC,EACjC,kBAAkB,GACnB,qCAAkC;AAEnC,OAAO,EAAE,UAAU,EAAE,yBAAyB,EAAE,yBAAsB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,cAAc,EACd,oBAAoB,EACpB,qBAAqB,GACtB,mBAAgB;AAEjB,OAAO,EACL,8BAA8B,EAC9B,iCAAiC,EACjC,kBAAkB,GACnB,qCAAkC;AAEnC,OAAO,EAAE,UAAU,EAAE,yBAAyB,EAAE,yBAAsB"}

package/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/auth/index.ts"],"names":[],"mappings":";;;AAOA,wEAImC;AAHjC,yIAAA,8BAA8B,OAAA;AAC9B,4IAAA,iCAAiC,OAAA;AACjC,6HAAA,kBAAkB,OAAA;AAGpB,0CAAsE;AAA7D,mGAAA,UAAU,OAAA;AAAE,kHAAA,yBAAyB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/auth/index.ts"],"names":[],"mappings":";;;AAQA,wEAImC;AAHjC,yIAAA,8BAA8B,OAAA;AAC9B,4IAAA,iCAAiC,OAAA;AACjC,6HAAA,kBAAkB,OAAA;AAGpB,0CAAsE;AAA7D,mGAAA,UAAU,OAAA;AAAE,kHAAA,yBAAyB,OAAA"}

package/auth/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","sourceRoot":"","sources":["../src/auth/index.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,8BAA8B,EAC9B,iCAAiC,EACjC,kBAAkB,GACnB,sCAAkC;AAEnC,OAAO,EAAE,UAAU,EAAE,yBAAyB,EAAE,0BAAsB"}
+{"version":3,"file":"index.mjs","sourceRoot":"","sources":["../src/auth/index.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,8BAA8B,EAC9B,iCAAiC,EACjC,kBAAkB,GACnB,sCAAkC;AAEnC,OAAO,EAAE,UAAU,EAAE,yBAAyB,EAAE,0BAAsB"}

package/auth/types.d.mts

@@ -15,7 +15,7 @@ export interface WorkloadIdentity {
     serviceAccountId: string;
     /** Provider that obtains the external subject token for each token exchange. */
     provider: SubjectTokenProvider;
-    /** Seconds before expiration when access-token refresh begins; defaults to 1,200 seconds. */
+    /** Seconds before expiration when access-token refresh begins; defaults to 1,200 seconds and is capped at half of the actual token lifetime. */
     refreshBufferSeconds?: number;
 }
 /** Configures OpenAI-only federation from an explicitly attested X.509 client certificate. */
@@ -26,14 +26,19 @@ export interface X509WorkloadIdentity {
     identityProviderId: string;
     /** OpenAI service account authorized for the verified certificate identity. */
     serviceAccountId: string;
-    /** Optional milliseconds before expiry when the certificate-backed token should refresh. */
+    /** Seconds before expiration when access-token refresh begins; defaults to 1,200 seconds. */
+    refreshBufferSeconds?: number;
+    /** @deprecated Use refreshBufferSeconds to match other workload-identity credentials. */
     refreshBufferMs?: number;
     /** X.509 federation proves certificate possession instead of supplying a subject token. */
     provider?: never;
     /** X.509 federation does not send an OAuth client identifier. */
     clientId?: never;
-    /** X.509 federation does not accept subject-token refresh configuration. */
-    refreshBufferSeconds?: never;
+}
+/** An SDK-owned certificate credential created by the Node-only X.509 authentication helper. */
+export interface X509Credential {
+    /** Closes the credential's owned certificate transport after requests have finished. */
+    close: () => Promise<void>;
 }
 /** OAuth token-exchange response returned by the OpenAI workload-identity endpoint. */
 export interface TokenExchangeResponse {

package/auth/types.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.mts","sourceRoot":"","sources":["../src/auth/types.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,MAAM,WAAW,oBAAoB;IACnC,qFAAqF;IACrF,SAAS,EAAE,KAAK,GAAG,IAAI,CAAC;IAExB,oGAAoG;IACpG,QAAQ,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CACjC;AAED,+FAA+F;AAC/F,MAAM,WAAW,gBAAgB;IAC/B,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,6FAA6F;IAC7F,kBAAkB,EAAE,MAAM,CAAC;IAE3B,6FAA6F;IAC7F,gBAAgB,EAAE,MAAM,CAAC;IAEzB,gFAAgF;IAChF,QAAQ,EAAE,oBAAoB,CAAC;IAE/B,6FAA6F;IAC7F,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,8FAA8F;AAC9F,MAAM,WAAW,oBAAoB;IACnC,4FAA4F;IAC5F,IAAI,EAAE,MAAM,CAAC;IAEb,mFAAmF;IACnF,kBAAkB,EAAE,MAAM,CAAC;IAE3B,+EAA+E;IAC/E,gBAAgB,EAAE,MAAM,CAAC;IAEzB,4FAA4F;IAC5F,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB,2FAA2F;IAC3F,QAAQ,CAAC,EAAE,KAAK,CAAC;IAEjB,iEAAiE;IACjE,QAAQ,CAAC,EAAE,KAAK,CAAC;IAEjB,4EAA4E;IAC5E,oBAAoB,CAAC,EAAE,KAAK,CAAC;CAC9B;AAED,uFAAuF;AACvF,MAAM,WAAW,qBAAqB;IACpC,qEAAqE;IACrE,YAAY,EAAE,MAAM,CAAC;IAErB,+DAA+D;IAC/D,iBAAiB,EAAE,MAAM,CAAC;IAE1B,gFAAgF;IAChF,UAAU,EAAE,MAAM,CAAC;IAEnB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB"}
+{"version":3,"file":"types.d.mts","sourceRoot":"","sources":["../src/auth/types.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,MAAM,WAAW,oBAAoB;IACnC,qFAAqF;IACrF,SAAS,EAAE,KAAK,GAAG,IAAI,CAAC;IAExB,oGAAoG;IACpG,QAAQ,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CACjC;AAED,+FAA+F;AAC/F,MAAM,WAAW,gBAAgB;IAC/B,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,6FAA6F;IAC7F,kBAAkB,EAAE,MAAM,CAAC;IAE3B,6FAA6F;IAC7F,gBAAgB,EAAE,MAAM,CAAC;IAEzB,gFAAgF;IAChF,QAAQ,EAAE,oBAAoB,CAAC;IAE/B,gJAAgJ;IAChJ,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,8FAA8F;AAC9F,MAAM,WAAW,oBAAoB;IACnC,4FAA4F;IAC5F,IAAI,EAAE,MAAM,CAAC;IAEb,mFAAmF;IACnF,kBAAkB,EAAE,MAAM,CAAC;IAE3B,+EAA+E;IAC/E,gBAAgB,EAAE,MAAM,CAAC;IAEzB,6FAA6F;IAC7F,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B,yFAAyF;IACzF,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB,2FAA2F;IAC3F,QAAQ,CAAC,EAAE,KAAK,CAAC;IAEjB,iEAAiE;IACjE,QAAQ,CAAC,EAAE,KAAK,CAAC;CAClB;AAED,gGAAgG;AAChG,MAAM,WAAW,cAAc;IAC7B,wFAAwF;IACxF,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B;AAED,uFAAuF;AACvF,MAAM,WAAW,qBAAqB;IACpC,qEAAqE;IACrE,YAAY,EAAE,MAAM,CAAC;IAErB,+DAA+D;IAC/D,iBAAiB,EAAE,MAAM,CAAC;IAE1B,gFAAgF;IAChF,UAAU,EAAE,MAAM,CAAC;IAEnB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB"}

package/auth/types.d.ts

@@ -15,7 +15,7 @@ export interface WorkloadIdentity {
     serviceAccountId: string;
     /** Provider that obtains the external subject token for each token exchange. */
     provider: SubjectTokenProvider;
-    /** Seconds before expiration when access-token refresh begins; defaults to 1,200 seconds. */
+    /** Seconds before expiration when access-token refresh begins; defaults to 1,200 seconds and is capped at half of the actual token lifetime. */
     refreshBufferSeconds?: number;
 }
 /** Configures OpenAI-only federation from an explicitly attested X.509 client certificate. */
@@ -26,14 +26,19 @@ export interface X509WorkloadIdentity {
     identityProviderId: string;
     /** OpenAI service account authorized for the verified certificate identity. */
     serviceAccountId: string;
-    /** Optional milliseconds before expiry when the certificate-backed token should refresh. */
+    /** Seconds before expiration when access-token refresh begins; defaults to 1,200 seconds. */
+    refreshBufferSeconds?: number;
+    /** @deprecated Use refreshBufferSeconds to match other workload-identity credentials. */
     refreshBufferMs?: number;
     /** X.509 federation proves certificate possession instead of supplying a subject token. */
     provider?: never;
     /** X.509 federation does not send an OAuth client identifier. */
     clientId?: never;
-    /** X.509 federation does not accept subject-token refresh configuration. */
-    refreshBufferSeconds?: never;
+}
+/** An SDK-owned certificate credential created by the Node-only X.509 authentication helper. */
+export interface X509Credential {
+    /** Closes the credential's owned certificate transport after requests have finished. */
+    close: () => Promise<void>;
 }
 /** OAuth token-exchange response returned by the OpenAI workload-identity endpoint. */
 export interface TokenExchangeResponse {

package/auth/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/auth/types.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,MAAM,WAAW,oBAAoB;IACnC,qFAAqF;IACrF,SAAS,EAAE,KAAK,GAAG,IAAI,CAAC;IAExB,oGAAoG;IACpG,QAAQ,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CACjC;AAED,+FAA+F;AAC/F,MAAM,WAAW,gBAAgB;IAC/B,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,6FAA6F;IAC7F,kBAAkB,EAAE,MAAM,CAAC;IAE3B,6FAA6F;IAC7F,gBAAgB,EAAE,MAAM,CAAC;IAEzB,gFAAgF;IAChF,QAAQ,EAAE,oBAAoB,CAAC;IAE/B,6FAA6F;IAC7F,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,8FAA8F;AAC9F,MAAM,WAAW,oBAAoB;IACnC,4FAA4F;IAC5F,IAAI,EAAE,MAAM,CAAC;IAEb,mFAAmF;IACnF,kBAAkB,EAAE,MAAM,CAAC;IAE3B,+EAA+E;IAC/E,gBAAgB,EAAE,MAAM,CAAC;IAEzB,4FAA4F;IAC5F,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB,2FAA2F;IAC3F,QAAQ,CAAC,EAAE,KAAK,CAAC;IAEjB,iEAAiE;IACjE,QAAQ,CAAC,EAAE,KAAK,CAAC;IAEjB,4EAA4E;IAC5E,oBAAoB,CAAC,EAAE,KAAK,CAAC;CAC9B;AAED,uFAAuF;AACvF,MAAM,WAAW,qBAAqB;IACpC,qEAAqE;IACrE,YAAY,EAAE,MAAM,CAAC;IAErB,+DAA+D;IAC/D,iBAAiB,EAAE,MAAM,CAAC;IAE1B,gFAAgF;IAChF,UAAU,EAAE,MAAM,CAAC;IAEnB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/auth/types.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,MAAM,WAAW,oBAAoB;IACnC,qFAAqF;IACrF,SAAS,EAAE,KAAK,GAAG,IAAI,CAAC;IAExB,oGAAoG;IACpG,QAAQ,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CACjC;AAED,+FAA+F;AAC/F,MAAM,WAAW,gBAAgB;IAC/B,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,6FAA6F;IAC7F,kBAAkB,EAAE,MAAM,CAAC;IAE3B,6FAA6F;IAC7F,gBAAgB,EAAE,MAAM,CAAC;IAEzB,gFAAgF;IAChF,QAAQ,EAAE,oBAAoB,CAAC;IAE/B,gJAAgJ;IAChJ,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,8FAA8F;AAC9F,MAAM,WAAW,oBAAoB;IACnC,4FAA4F;IAC5F,IAAI,EAAE,MAAM,CAAC;IAEb,mFAAmF;IACnF,kBAAkB,EAAE,MAAM,CAAC;IAE3B,+EAA+E;IAC/E,gBAAgB,EAAE,MAAM,CAAC;IAEzB,6FAA6F;IAC7F,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B,yFAAyF;IACzF,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB,2FAA2F;IAC3F,QAAQ,CAAC,EAAE,KAAK,CAAC;IAEjB,iEAAiE;IACjE,QAAQ,CAAC,EAAE,KAAK,CAAC;CAClB;AAED,gGAAgG;AAChG,MAAM,WAAW,cAAc;IAC7B,wFAAwF;IACxF,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B;AAED,uFAAuF;AACvF,MAAM,WAAW,qBAAqB;IACpC,qEAAqE;IACrE,YAAY,EAAE,MAAM,CAAC;IAErB,+DAA+D;IAC/D,iBAAiB,EAAE,MAAM,CAAC;IAE1B,gFAAgF;IAChF,UAAU,EAAE,MAAM,CAAC;IAEnB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB"}

package/auth/workload-identity-auth.d.mts

@@ -34,7 +34,7 @@ export declare class WorkloadIdentityAuth {
     getToken(): Promise<string>;
     private refreshToken;
     private static isTokenExpired;
-    private needsRefresh;
+    private static needsRefresh;
     /** Discards the cached access token so the next request performs a fresh exchange. */
     invalidateToken(): void;
 }

package/auth/workload-identity-auth.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"workload-identity-auth.d.mts","sourceRoot":"","sources":["../src/auth/workload-identity-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAyB,oBAAgB;AACvE,OAAO,KAAK,EAAE,KAAK,EAAE,sCAAkC;AAgHvD;;;;;;GAMG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,WAAW,CAA4B;IAC/C,OAAO,CAAC,cAAc,CAAgC;IACtD,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmB;IAC1C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAiD;IAClF,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAE9B;;;;;OAKG;gBACS,MAAM,EAAE,gBAAgB,EAAE,KAAK,CAAC,EAAE,KAAK;IAKnD;;;;;;;;;OASG;IACG,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC;YA+BnB,YAAY;IA8E1B,OAAO,CAAC,MAAM,CAAC,cAAc;IAI7B,OAAO,CAAC,YAAY;IAMpB,sFAAsF;IACtF,eAAe,IAAI,IAAI;CAKxB"}
+{"version":3,"file":"workload-identity-auth.d.mts","sourceRoot":"","sources":["../src/auth/workload-identity-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAyB,oBAAgB;AACvE,OAAO,KAAK,EAAE,KAAK,EAAE,sCAAkC;AA+HvD;;;;;;GAMG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,WAAW,CAA4B;IAC/C,OAAO,CAAC,cAAc,CAAgC;IACtD,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmB;IAC1C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAiD;IAClF,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAE9B;;;;;OAKG;gBACS,MAAM,EAAE,gBAAgB,EAAE,KAAK,CAAC,EAAE,KAAK;IAenD;;;;;;;;;OASG;IACG,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC;YA+BnB,YAAY;IA+E1B,OAAO,CAAC,MAAM,CAAC,cAAc;IAI7B,OAAO,CAAC,MAAM,CAAC,YAAY;IAI3B,sFAAsF;IACtF,eAAe,IAAI,IAAI;CAKxB"}

package/auth/workload-identity-auth.d.ts

@@ -34,7 +34,7 @@ export declare class WorkloadIdentityAuth {
     getToken(): Promise<string>;
     private refreshToken;
     private static isTokenExpired;
-    private needsRefresh;
+    private static needsRefresh;
     /** Discards the cached access token so the next request performs a fresh exchange. */
     invalidateToken(): void;
 }

package/auth/workload-identity-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workload-identity-auth.d.ts","sourceRoot":"","sources":["../src/auth/workload-identity-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAyB,mBAAgB;AACvE,OAAO,KAAK,EAAE,KAAK,EAAE,qCAAkC;AAgHvD;;;;;;GAMG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,WAAW,CAA4B;IAC/C,OAAO,CAAC,cAAc,CAAgC;IACtD,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmB;IAC1C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAiD;IAClF,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAE9B;;;;;OAKG;gBACS,MAAM,EAAE,gBAAgB,EAAE,KAAK,CAAC,EAAE,KAAK;IAKnD;;;;;;;;;OASG;IACG,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC;YA+BnB,YAAY;IA8E1B,OAAO,CAAC,MAAM,CAAC,cAAc;IAI7B,OAAO,CAAC,YAAY;IAMpB,sFAAsF;IACtF,eAAe,IAAI,IAAI;CAKxB"}
+{"version":3,"file":"workload-identity-auth.d.ts","sourceRoot":"","sources":["../src/auth/workload-identity-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAyB,mBAAgB;AACvE,OAAO,KAAK,EAAE,KAAK,EAAE,qCAAkC;AA+HvD;;;;;;GAMG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,WAAW,CAA4B;IAC/C,OAAO,CAAC,cAAc,CAAgC;IACtD,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmB;IAC1C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAiD;IAClF,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAE9B;;;;;OAKG;gBACS,MAAM,EAAE,gBAAgB,EAAE,KAAK,CAAC,EAAE,KAAK;IAenD;;;;;;;;;OASG;IACG,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC;YA+BnB,YAAY;IA+E1B,OAAO,CAAC,MAAM,CAAC,cAAc;IAI7B,OAAO,CAAC,MAAM,CAAC,YAAY;IAI3B,sFAAsF;IACtF,eAAe,IAAI,IAAI;CAKxB"}

package/auth/workload-identity-auth.js

@@ -9,6 +9,14 @@ const SUBJECT_TOKEN_TYPES = {
     id: 'urn:ietf:params:oauth:token-type:id_token',
 };
 const TOKEN_EXCHANGE_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:token-exchange';
+// Cap the refresh buffer at half the actual token lifetime, matching the X.509
+// workload-identity path, so short-lived tokens keep a usable cache window.
+const MAX_REFRESH_BUFFER_FRACTION = 0.5;
+function calculateRefreshAt(expiresAt, now, refreshBufferSeconds) {
+    const configuredBufferMs = (refreshBufferSeconds ?? 1200) * 1000;
+    const effectiveBufferMs = Math.min(configuredBufferMs, (expiresAt - now) * MAX_REFRESH_BUFFER_FRACTION);
+    return expiresAt - effectiveBufferMs;
+}
 const NATIVE_RESPONSE_PROTOTYPE = Response.prototype;
 const READ_NATIVE_RESPONSE_BODY = NATIVE_RESPONSE_PROTOTYPE.arrayBuffer;
 function isResponsePrototype(response, prototype) {
@@ -101,7 +109,17 @@ class WorkloadIdentityAuth {
         this.refreshPromise = null;
         this.tokenGeneration = 0;
         this.tokenExchangeUrl = 'https://auth.openai.com/oauth/token';
-        this.config = config;
+        const { identityProviderId, serviceAccountId, clientId, refreshBufferSeconds, provider } = config;
+        this.config = {
+            identityProviderId,
+            serviceAccountId,
+            ...(clientId === undefined ? {} : { clientId }),
+            ...(refreshBufferSeconds === undefined ? {} : { refreshBufferSeconds }),
+            provider: {
+                tokenType: provider.tokenType,
+                getToken: provider.getToken.bind(provider),
+            },
+        };
         this.fetch = fetch ?? Shims.getDefaultFetch();
     }
     /**
@@ -130,7 +148,7 @@ class WorkloadIdentityAuth {
                 }
             }
         }
-        if (this.needsRefresh(this.cachedToken) && !this.refreshPromise) {
+        if (WorkloadIdentityAuth.needsRefresh(this.cachedToken) && !this.refreshPromise) {
             const refreshPromise = this.refreshToken(this.tokenGeneration).finally(() => {
                 if (this.refreshPromise === refreshPromise) {
                     this.refreshPromise = null;
@@ -197,6 +215,7 @@ class WorkloadIdentityAuth {
             this.cachedToken = {
                 token: accessToken,
                 expiresAt,
+                refreshAt: calculateRefreshAt(expiresAt, now, this.config.refreshBufferSeconds),
             };
         }
         return accessToken;
@@ -204,10 +223,8 @@ class WorkloadIdentityAuth {
     static isTokenExpired(cachedToken) {
         return Date.now() >= cachedToken.expiresAt;
     }
-    needsRefresh(cachedToken) {
-        const bufferSeconds = this.config.refreshBufferSeconds ?? 1200;
-        const bufferMs = bufferSeconds * 1000;
-        return Date.now() >= cachedToken.expiresAt - bufferMs;
+    static needsRefresh(cachedToken) {
+        return Date.now() >= cachedToken.refreshAt;
     }
     /** Discards the cached access token so the next request performs a fresh exchange. */
     invalidateToken() {

package/auth/workload-identity-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"workload-identity-auth.js","sourceRoot":"","sources":["../src/auth/workload-identity-auth.ts"],"names":[],"mappings":";;;;AAEA,oEAA2C;AAC3C,4CAAkE;AAOlE,MAAM,mBAAmB,GAA8D;IACrF,GAAG,EAAE,sCAAsC;IAC3C,EAAE,EAAE,2CAA2C;CAChD,CAAC;AAEF,MAAM,yBAAyB,GAAG,iDAAiD,CAAC;AACpF,MAAM,yBAAyB,GAAG,QAAQ,CAAC,SAAS,CAAC;AACrD,MAAM,yBAAyB,GAAG,yBAAyB,CAAC,WAAW,CAAC;AAExE,SAAS,mBAAmB,CAAC,QAAkB,EAAE,SAAiB;IAChE,MAAM,WAAW,GAAG,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,KAAK,CAAC;IACrF,IACE,SAAS,KAAK,QAAQ;QACtB,OAAO,WAAW,KAAK,UAAU;QACjC,MAAM,CAAC,wBAAwB,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,KAAK,KAAK,UAAU;QAC1E,MAAM,CAAC,wBAAwB,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,KAAK,KAAK,SAAS,EAC9E,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAC3E,OAAO,CACL,CAAC,GAAG,EAAE,KAAK,KAAK,UAAU,IAAI,OAAO,GAAG,EAAE,GAAG,KAAK,UAAU,CAAC;QAC7D,OAAO,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,GAAG,KAAK,UAAU;QAChF,OAAO,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,GAAG,KAAK,UAAU;QAC3E,OAAO,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,GAAG,KAAK,UAAU,CAChF,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,SAAiB,EAAE,iBAAgC;IAClF,IAAI,SAAS,KAAK,iBAAiB,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,KAAK,CAAC;IACrF,OAAO,CACL,iBAAiB,KAAK,IAAI;QAC1B,MAAM,CAAC,cAAc,CAAC,iBAAiB,CAAC,KAAK,SAAS;QACtD,OAAO,WAAW,KAAK,UAAU;QACjC,MAAM,CAAC,wBAAwB,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,KAAK,KAAK,MAAM;QACtE,MAAM,CAAC,wBAAwB,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,KAAK,KAAK,SAAS,CAC/E,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAiB;IACjD,MAAM,KAAK,GAAG,UAAiE,CAAC;IAChF,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,KAAK,CAAC,GAAG,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACtG,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,QAAkB;IACvD,IAAI,QAA2D,CAAC;IAChE,IAAI,iBAAiB,GAAkB,IAAI,CAAC;IAC5C,KACE,IAAI,KAAK,GAAG,CAAC,EAAE,SAAS,GAAkB,QAAQ,EAClD,SAAS,KAAK,IAAI,IAAI,KAAK,GAAG,EAAE,EAChC,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,KAAK,IAAI,CAAC,EACxD,CAAC;QACD,IAAI,SAAS,KAAK,yBAAyB,EAAE,CAAC;YAC5C,MAAM;QACR,CAAC;QAED,IAAI,mBAAmB,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;YAC7C,iBAAiB,GAAG,SAAS,CAAC;QAChC,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,SAAS;QACX,CAAC;QAED,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YACvC,MAAM;QACR,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC;QAC7E,IAAI,OAAO,UAAU,KAAK,UAAU,IAAI,uBAAuB,CAAC,SAAS,EAAE,iBAAiB,CAAC,EAAE,CAAC;YAC9F,QAAQ,GAAG,UAAU,CAAC;YACtB,MAAM;QACR,CAAC;QAED,0FAA0F;QAC1F,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,IAAI,GACR,QAAQ,KAAK,SAAS;QACpB,CAAC,CAAC,wBAAwB,CAAC,MAAM,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1E,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,CAAC,+CAA+C,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,WAAmB;IAC9C,MAAM,KAAK,GAAG,UAAiE,CAAC;IAChF,IAAI,OAAO,KAAK,CAAC,GAAG,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC3C,OAAO,mCAAmC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,gDAAgD,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,MAAa,oBAAoB;IAQ/B;;;;;OAKG;IACH,YAAY,MAAwB,EAAE,KAAa;QAb3C,gBAAW,GAAuB,IAAI,CAAC;QACvC,mBAAc,GAA2B,IAAI,CAAC;QAC9C,oBAAe,GAAG,CAAC,CAAC;QAEX,qBAAgB,GAAW,qCAAqC,CAAC;QAUhF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,KAAK,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;IAChD,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,oBAAoB,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/E,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;gBACxB,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC;YACnC,CAAC;YAED,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC/D,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;YAErC,IAAI,CAAC;gBACH,OAAO,MAAM,cAAc,CAAC;YAC9B,CAAC;oBAAS,CAAC;gBACT,IAAI,IAAI,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;oBAC3C,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;gBAC7B,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YAChE,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC1E,IAAI,IAAI,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;oBAC3C,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;gBAC7B,CAAC;YACH,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;YACrC,KAAK,cAAc,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;QAED,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,UAAkB;QAC3C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC3D,MAAM,IAAI,GAA2B;YACnC,UAAU,EAAE,yBAAyB;YACrC,aAAa,EAAE,YAAY;YAC3B,kBAAkB,EAAE,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;YACvE,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;YACpD,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;SACjD,CAAC;QAEF,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACzB,IAAI,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC3C,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,IAAI,GAAQ,SAAS,CAAC;YAE1B,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,gCAAgC;YAClC,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAClF,MAAM,IAAI,kBAAU,CAAC,QAAQ,CAAC,MAAyB,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;YACnF,CAAC;YACD,MAAM,gBAAQ,CAAC,QAAQ,CACrB,QAAQ,CAAC,MAAM,EACf,IAAI,EACJ,qCAAqC,QAAQ,CAAC,MAAM,EAAE,EACtD,QAAQ,CAAC,OAAO,CACjB,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAY,MAAM,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QACvE,MAAM,WAAW,GACf,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,KAAK,IAAI,IAAI,cAAc,IAAI,aAAa;YAC5F,CAAC,CAAC,aAAa,CAAC,YAAY;YAC5B,CAAC,CAAC,SAAS,CAAC;QAChB,IACE,OAAO,WAAW,KAAK,QAAQ;YAC/B,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAC/B,mBAAmB,CAAC,WAAW,CAAC,EAChC,CAAC;YACD,MAAM,IAAI,mBAAW,CAAC,sDAAsD,CAAC,CAAC;QAChF,CAAC;QAED,MAAM,SAAS,GAAI,aAAgD,CAAC,UAAU,IAAI,IAAI,CAAC;QACvF,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACnF,MAAM,IAAI,mBAAW,CAAC,wDAAwD,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,GAAG,GAAG,SAAS,GAAG,IAAI,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;YACzD,MAAM,IAAI,mBAAW,CAAC,wDAAwD,CAAC,CAAC;QAClF,CAAC;QAED,IAAI,IAAI,CAAC,eAAe,KAAK,UAAU,EAAE,CAAC;YACxC,IAAI,CAAC,WAAW,GAAG;gBACjB,KAAK,EAAE,WAAW;gBAClB,SAAS;aACV,CAAC;QACJ,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAEO,MAAM,CAAC,cAAc,CAAC,WAAwB;QACpD,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC,SAAS,CAAC;IAC7C,CAAC;IAEO,YAAY,CAAC,WAAwB;QAC3C,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,oBAAoB,IAAI,IAAI,CAAC;QAC/D,MAAM,QAAQ,GAAG,aAAa,GAAG,IAAI,CAAC;QACtC,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC,SAAS,GAAG,QAAQ,CAAC;IACxD,CAAC;IAED,sFAAsF;IACtF,eAAe;QACb,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;IAC7B,CAAC;CACF;AA1JD,oDA0JC"}
+{"version":3,"file":"workload-identity-auth.js","sourceRoot":"","sources":["../src/auth/workload-identity-auth.ts"],"names":[],"mappings":";;;;AAEA,oEAA2C;AAC3C,4CAAkE;AAQlE,MAAM,mBAAmB,GAA8D;IACrF,GAAG,EAAE,sCAAsC;IAC3C,EAAE,EAAE,2CAA2C;CAChD,CAAC;AAEF,MAAM,yBAAyB,GAAG,iDAAiD,CAAC;AACpF,+EAA+E;AAC/E,4EAA4E;AAC5E,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAExC,SAAS,kBAAkB,CACzB,SAAiB,EACjB,GAAW,EACX,oBAAwC;IAExC,MAAM,kBAAkB,GAAG,CAAC,oBAAoB,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC;IACjE,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,2BAA2B,CAAC,CAAC;IACxG,OAAO,SAAS,GAAG,iBAAiB,CAAC;AACvC,CAAC;AAED,MAAM,yBAAyB,GAAG,QAAQ,CAAC,SAAS,CAAC;AACrD,MAAM,yBAAyB,GAAG,yBAAyB,CAAC,WAAW,CAAC;AAExE,SAAS,mBAAmB,CAAC,QAAkB,EAAE,SAAiB;IAChE,MAAM,WAAW,GAAG,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,KAAK,CAAC;IACrF,IACE,SAAS,KAAK,QAAQ;QACtB,OAAO,WAAW,KAAK,UAAU;QACjC,MAAM,CAAC,wBAAwB,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,KAAK,KAAK,UAAU;QAC1E,MAAM,CAAC,wBAAwB,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,KAAK,KAAK,SAAS,EAC9E,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAC3E,OAAO,CACL,CAAC,GAAG,EAAE,KAAK,KAAK,UAAU,IAAI,OAAO,GAAG,EAAE,GAAG,KAAK,UAAU,CAAC;QAC7D,OAAO,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,GAAG,KAAK,UAAU;QAChF,OAAO,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,GAAG,KAAK,UAAU;QAC3E,OAAO,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,GAAG,KAAK,UAAU,CAChF,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,SAAiB,EAAE,iBAAgC;IAClF,IAAI,SAAS,KAAK,iBAAiB,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,KAAK,CAAC;IACrF,OAAO,CACL,iBAAiB,KAAK,IAAI;QAC1B,MAAM,CAAC,cAAc,CAAC,iBAAiB,CAAC,KAAK,SAAS;QACtD,OAAO,WAAW,KAAK,UAAU;QACjC,MAAM,CAAC,wBAAwB,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,KAAK,KAAK,MAAM;QACtE,MAAM,CAAC,wBAAwB,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,KAAK,KAAK,SAAS,CAC/E,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAiB;IACjD,MAAM,KAAK,GAAG,UAAiE,CAAC;IAChF,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,KAAK,CAAC,GAAG,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACtG,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,QAAkB;IACvD,IAAI,QAA2D,CAAC;IAChE,IAAI,iBAAiB,GAAkB,IAAI,CAAC;IAC5C,KACE,IAAI,KAAK,GAAG,CAAC,EAAE,SAAS,GAAkB,QAAQ,EAClD,SAAS,KAAK,IAAI,IAAI,KAAK,GAAG,EAAE,EAChC,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,KAAK,IAAI,CAAC,EACxD,CAAC;QACD,IAAI,SAAS,KAAK,yBAAyB,EAAE,CAAC;YAC5C,MAAM;QACR,CAAC;QAED,IAAI,mBAAmB,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;YAC7C,iBAAiB,GAAG,SAAS,CAAC;QAChC,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,SAAS;QACX,CAAC;QAED,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YACvC,MAAM;QACR,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC;QAC7E,IAAI,OAAO,UAAU,KAAK,UAAU,IAAI,uBAAuB,CAAC,SAAS,EAAE,iBAAiB,CAAC,EAAE,CAAC;YAC9F,QAAQ,GAAG,UAAU,CAAC;YACtB,MAAM;QACR,CAAC;QAED,0FAA0F;QAC1F,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,IAAI,GACR,QAAQ,KAAK,SAAS;QACpB,CAAC,CAAC,wBAAwB,CAAC,MAAM,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1E,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,CAAC,+CAA+C,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,WAAmB;IAC9C,MAAM,KAAK,GAAG,UAAiE,CAAC;IAChF,IAAI,OAAO,KAAK,CAAC,GAAG,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC3C,OAAO,mCAAmC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,gDAAgD,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,MAAa,oBAAoB;IAQ/B;;;;;OAKG;IACH,YAAY,MAAwB,EAAE,KAAa;QAb3C,gBAAW,GAAuB,IAAI,CAAC;QACvC,mBAAc,GAA2B,IAAI,CAAC;QAC9C,oBAAe,GAAG,CAAC,CAAC;QAEX,qBAAgB,GAAW,qCAAqC,CAAC;QAUhF,MAAM,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,oBAAoB,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;QAClG,IAAI,CAAC,MAAM,GAAG;YACZ,kBAAkB;YAClB,gBAAgB;YAChB,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;YAC/C,GAAG,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC;YACvE,QAAQ,EAAE;gBACR,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;aAC3C;SACF,CAAC;QACF,IAAI,CAAC,KAAK,GAAG,KAAK,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;IAChD,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,oBAAoB,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/E,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;gBACxB,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC;YACnC,CAAC;YAED,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC/D,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;YAErC,IAAI,CAAC;gBACH,OAAO,MAAM,cAAc,CAAC;YAC9B,CAAC;oBAAS,CAAC;gBACT,IAAI,IAAI,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;oBAC3C,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;gBAC7B,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,oBAAoB,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YAChF,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC1E,IAAI,IAAI,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;oBAC3C,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;gBAC7B,CAAC;YACH,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;YACrC,KAAK,cAAc,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;QAED,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,UAAkB;QAC3C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC3D,MAAM,IAAI,GAA2B;YACnC,UAAU,EAAE,yBAAyB;YACrC,aAAa,EAAE,YAAY;YAC3B,kBAAkB,EAAE,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;YACvE,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;YACpD,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;SACjD,CAAC;QAEF,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACzB,IAAI,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC3C,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,IAAI,GAAQ,SAAS,CAAC;YAE1B,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,gCAAgC;YAClC,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAClF,MAAM,IAAI,kBAAU,CAAC,QAAQ,CAAC,MAAyB,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;YACnF,CAAC;YACD,MAAM,gBAAQ,CAAC,QAAQ,CACrB,QAAQ,CAAC,MAAM,EACf,IAAI,EACJ,qCAAqC,QAAQ,CAAC,MAAM,EAAE,EACtD,QAAQ,CAAC,OAAO,CACjB,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAY,MAAM,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QACvE,MAAM,WAAW,GACf,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,KAAK,IAAI,IAAI,cAAc,IAAI,aAAa;YAC5F,CAAC,CAAC,aAAa,CAAC,YAAY;YAC5B,CAAC,CAAC,SAAS,CAAC;QAChB,IACE,OAAO,WAAW,KAAK,QAAQ;YAC/B,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAC/B,mBAAmB,CAAC,WAAW,CAAC,EAChC,CAAC;YACD,MAAM,IAAI,mBAAW,CAAC,sDAAsD,CAAC,CAAC;QAChF,CAAC;QAED,MAAM,SAAS,GAAI,aAAgD,CAAC,UAAU,IAAI,IAAI,CAAC;QACvF,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACnF,MAAM,IAAI,mBAAW,CAAC,wDAAwD,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,GAAG,GAAG,SAAS,GAAG,IAAI,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;YACzD,MAAM,IAAI,mBAAW,CAAC,wDAAwD,CAAC,CAAC;QAClF,CAAC;QAED,IAAI,IAAI,CAAC,eAAe,KAAK,UAAU,EAAE,CAAC;YACxC,IAAI,CAAC,WAAW,GAAG;gBACjB,KAAK,EAAE,WAAW;gBAClB,SAAS;gBACT,SAAS,EAAE,kBAAkB,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC;aAChF,CAAC;QACJ,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAEO,MAAM,CAAC,cAAc,CAAC,WAAwB;QACpD,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC,SAAS,CAAC;IAC7C,CAAC;IAEO,MAAM,CAAC,YAAY,CAAC,WAAwB;QAClD,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC,SAAS,CAAC;IAC7C,CAAC;IAED,sFAAsF;IACtF,eAAe;QACb,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;IAC7B,CAAC;CACF;AAnKD,oDAmKC"}

package/auth/workload-identity-auth.mjs

@@ -5,6 +5,14 @@ const SUBJECT_TOKEN_TYPES = {
     id: 'urn:ietf:params:oauth:token-type:id_token',
 };
 const TOKEN_EXCHANGE_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:token-exchange';
+// Cap the refresh buffer at half the actual token lifetime, matching the X.509
+// workload-identity path, so short-lived tokens keep a usable cache window.
+const MAX_REFRESH_BUFFER_FRACTION = 0.5;
+function calculateRefreshAt(expiresAt, now, refreshBufferSeconds) {
+    const configuredBufferMs = (refreshBufferSeconds ?? 1200) * 1000;
+    const effectiveBufferMs = Math.min(configuredBufferMs, (expiresAt - now) * MAX_REFRESH_BUFFER_FRACTION);
+    return expiresAt - effectiveBufferMs;
+}
 const NATIVE_RESPONSE_PROTOTYPE = Response.prototype;
 const READ_NATIVE_RESPONSE_BODY = NATIVE_RESPONSE_PROTOTYPE.arrayBuffer;
 function isResponsePrototype(response, prototype) {
@@ -97,7 +105,17 @@ export class WorkloadIdentityAuth {
         this.refreshPromise = null;
         this.tokenGeneration = 0;
         this.tokenExchangeUrl = 'https://auth.openai.com/oauth/token';
-        this.config = config;
+        const { identityProviderId, serviceAccountId, clientId, refreshBufferSeconds, provider } = config;
+        this.config = {
+            identityProviderId,
+            serviceAccountId,
+            ...(clientId === undefined ? {} : { clientId }),
+            ...(refreshBufferSeconds === undefined ? {} : { refreshBufferSeconds }),
+            provider: {
+                tokenType: provider.tokenType,
+                getToken: provider.getToken.bind(provider),
+            },
+        };
         this.fetch = fetch ?? Shims.getDefaultFetch();
     }
     /**
@@ -126,7 +144,7 @@ export class WorkloadIdentityAuth {
                 }
             }
         }
-        if (this.needsRefresh(this.cachedToken) && !this.refreshPromise) {
+        if (WorkloadIdentityAuth.needsRefresh(this.cachedToken) && !this.refreshPromise) {
             const refreshPromise = this.refreshToken(this.tokenGeneration).finally(() => {
                 if (this.refreshPromise === refreshPromise) {
                     this.refreshPromise = null;
@@ -193,6 +211,7 @@ export class WorkloadIdentityAuth {
             this.cachedToken = {
                 token: accessToken,
                 expiresAt,
+                refreshAt: calculateRefreshAt(expiresAt, now, this.config.refreshBufferSeconds),
             };
         }
         return accessToken;
@@ -200,10 +219,8 @@ export class WorkloadIdentityAuth {
     static isTokenExpired(cachedToken) {
         return Date.now() >= cachedToken.expiresAt;
     }
-    needsRefresh(cachedToken) {
-        const bufferSeconds = this.config.refreshBufferSeconds ?? 1200;
-        const bufferMs = bufferSeconds * 1000;
-        return Date.now() >= cachedToken.expiresAt - bufferMs;
+    static needsRefresh(cachedToken) {
+        return Date.now() >= cachedToken.refreshAt;
     }
     /** Discards the cached access token so the next request performs a fresh exchange. */
     invalidateToken() {

package/auth/workload-identity-auth.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"workload-identity-auth.mjs","sourceRoot":"","sources":["../src/auth/workload-identity-auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,KAAK,8BAA0B;AAC3C,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,0BAAsB;AAOlE,MAAM,mBAAmB,GAA8D;IACrF,GAAG,EAAE,sCAAsC;IAC3C,EAAE,EAAE,2CAA2C;CAChD,CAAC;AAEF,MAAM,yBAAyB,GAAG,iDAAiD,CAAC;AACpF,MAAM,yBAAyB,GAAG,QAAQ,CAAC,SAAS,CAAC;AACrD,MAAM,yBAAyB,GAAG,yBAAyB,CAAC,WAAW,CAAC;AAExE,SAAS,mBAAmB,CAAC,QAAkB,EAAE,SAAiB;IAChE,MAAM,WAAW,GAAG,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,KAAK,CAAC;IACrF,IACE,SAAS,KAAK,QAAQ;QACtB,OAAO,WAAW,KAAK,UAAU;QACjC,MAAM,CAAC,wBAAwB,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,KAAK,KAAK,UAAU;QAC1E,MAAM,CAAC,wBAAwB,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,KAAK,KAAK,SAAS,EAC9E,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAC3E,OAAO,CACL,CAAC,GAAG,EAAE,KAAK,KAAK,UAAU,IAAI,OAAO,GAAG,EAAE,GAAG,KAAK,UAAU,CAAC;QAC7D,OAAO,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,GAAG,KAAK,UAAU;QAChF,OAAO,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,GAAG,KAAK,UAAU;QAC3E,OAAO,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,GAAG,KAAK,UAAU,CAChF,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,SAAiB,EAAE,iBAAgC;IAClF,IAAI,SAAS,KAAK,iBAAiB,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,KAAK,CAAC;IACrF,OAAO,CACL,iBAAiB,KAAK,IAAI;QAC1B,MAAM,CAAC,cAAc,CAAC,iBAAiB,CAAC,KAAK,SAAS;QACtD,OAAO,WAAW,KAAK,UAAU;QACjC,MAAM,CAAC,wBAAwB,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,KAAK,KAAK,MAAM;QACtE,MAAM,CAAC,wBAAwB,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,KAAK,KAAK,SAAS,CAC/E,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAiB;IACjD,MAAM,KAAK,GAAG,UAAiE,CAAC;IAChF,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,KAAK,CAAC,GAAG,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACtG,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,QAAkB;IACvD,IAAI,QAA2D,CAAC;IAChE,IAAI,iBAAiB,GAAkB,IAAI,CAAC;IAC5C,KACE,IAAI,KAAK,GAAG,CAAC,EAAE,SAAS,GAAkB,QAAQ,EAClD,SAAS,KAAK,IAAI,IAAI,KAAK,GAAG,EAAE,EAChC,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,KAAK,IAAI,CAAC,EACxD,CAAC;QACD,IAAI,SAAS,KAAK,yBAAyB,EAAE,CAAC;YAC5C,MAAM;QACR,CAAC;QAED,IAAI,mBAAmB,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;YAC7C,iBAAiB,GAAG,SAAS,CAAC;QAChC,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,SAAS;QACX,CAAC;QAED,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YACvC,MAAM;QACR,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC;QAC7E,IAAI,OAAO,UAAU,KAAK,UAAU,IAAI,uBAAuB,CAAC,SAAS,EAAE,iBAAiB,CAAC,EAAE,CAAC;YAC9F,QAAQ,GAAG,UAAU,CAAC;YACtB,MAAM;QACR,CAAC;QAED,0FAA0F;QAC1F,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,IAAI,GACR,QAAQ,KAAK,SAAS;QACpB,CAAC,CAAC,wBAAwB,CAAC,MAAM,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1E,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,CAAC,+CAA+C,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,WAAmB;IAC9C,MAAM,KAAK,GAAG,UAAiE,CAAC;IAChF,IAAI,OAAO,KAAK,CAAC,GAAG,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC3C,OAAO,mCAAmC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,gDAAgD,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,oBAAoB;IAQ/B;;;;;OAKG;IACH,YAAY,MAAwB,EAAE,KAAa;QAb3C,gBAAW,GAAuB,IAAI,CAAC;QACvC,mBAAc,GAA2B,IAAI,CAAC;QAC9C,oBAAe,GAAG,CAAC,CAAC;QAEX,qBAAgB,GAAW,qCAAqC,CAAC;QAUhF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,KAAK,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;IAChD,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,oBAAoB,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/E,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;gBACxB,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC;YACnC,CAAC;YAED,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC/D,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;YAErC,IAAI,CAAC;gBACH,OAAO,MAAM,cAAc,CAAC;YAC9B,CAAC;oBAAS,CAAC;gBACT,IAAI,IAAI,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;oBAC3C,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;gBAC7B,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YAChE,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC1E,IAAI,IAAI,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;oBAC3C,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;gBAC7B,CAAC;YACH,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;YACrC,KAAK,cAAc,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;QAED,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,UAAkB;QAC3C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC3D,MAAM,IAAI,GAA2B;YACnC,UAAU,EAAE,yBAAyB;YACrC,aAAa,EAAE,YAAY;YAC3B,kBAAkB,EAAE,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;YACvE,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;YACpD,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;SACjD,CAAC;QAEF,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACzB,IAAI,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC3C,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,IAAI,GAAQ,SAAS,CAAC;YAE1B,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,gCAAgC;YAClC,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAClF,MAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAyB,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;YACnF,CAAC;YACD,MAAM,QAAQ,CAAC,QAAQ,CACrB,QAAQ,CAAC,MAAM,EACf,IAAI,EACJ,qCAAqC,QAAQ,CAAC,MAAM,EAAE,EACtD,QAAQ,CAAC,OAAO,CACjB,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAY,MAAM,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QACvE,MAAM,WAAW,GACf,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,KAAK,IAAI,IAAI,cAAc,IAAI,aAAa;YAC5F,CAAC,CAAC,aAAa,CAAC,YAAY;YAC5B,CAAC,CAAC,SAAS,CAAC;QAChB,IACE,OAAO,WAAW,KAAK,QAAQ;YAC/B,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAC/B,mBAAmB,CAAC,WAAW,CAAC,EAChC,CAAC;YACD,MAAM,IAAI,WAAW,CAAC,sDAAsD,CAAC,CAAC;QAChF,CAAC;QAED,MAAM,SAAS,GAAI,aAAgD,CAAC,UAAU,IAAI,IAAI,CAAC;QACvF,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACnF,MAAM,IAAI,WAAW,CAAC,wDAAwD,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,GAAG,GAAG,SAAS,GAAG,IAAI,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;YACzD,MAAM,IAAI,WAAW,CAAC,wDAAwD,CAAC,CAAC;QAClF,CAAC;QAED,IAAI,IAAI,CAAC,eAAe,KAAK,UAAU,EAAE,CAAC;YACxC,IAAI,CAAC,WAAW,GAAG;gBACjB,KAAK,EAAE,WAAW;gBAClB,SAAS;aACV,CAAC;QACJ,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAEO,MAAM,CAAC,cAAc,CAAC,WAAwB;QACpD,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC,SAAS,CAAC;IAC7C,CAAC;IAEO,YAAY,CAAC,WAAwB;QAC3C,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,oBAAoB,IAAI,IAAI,CAAC;QAC/D,MAAM,QAAQ,GAAG,aAAa,GAAG,IAAI,CAAC;QACtC,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC,SAAS,GAAG,QAAQ,CAAC;IACxD,CAAC;IAED,sFAAsF;IACtF,eAAe;QACb,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;IAC7B,CAAC;CACF"}
+{"version":3,"file":"workload-identity-auth.mjs","sourceRoot":"","sources":["../src/auth/workload-identity-auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,KAAK,8BAA0B;AAC3C,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,0BAAsB;AAQlE,MAAM,mBAAmB,GAA8D;IACrF,GAAG,EAAE,sCAAsC;IAC3C,EAAE,EAAE,2CAA2C;CAChD,CAAC;AAEF,MAAM,yBAAyB,GAAG,iDAAiD,CAAC;AACpF,+EAA+E;AAC/E,4EAA4E;AAC5E,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAExC,SAAS,kBAAkB,CACzB,SAAiB,EACjB,GAAW,EACX,oBAAwC;IAExC,MAAM,kBAAkB,GAAG,CAAC,oBAAoB,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC;IACjE,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,2BAA2B,CAAC,CAAC;IACxG,OAAO,SAAS,GAAG,iBAAiB,CAAC;AACvC,CAAC;AAED,MAAM,yBAAyB,GAAG,QAAQ,CAAC,SAAS,CAAC;AACrD,MAAM,yBAAyB,GAAG,yBAAyB,CAAC,WAAW,CAAC;AAExE,SAAS,mBAAmB,CAAC,QAAkB,EAAE,SAAiB;IAChE,MAAM,WAAW,GAAG,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,KAAK,CAAC;IACrF,IACE,SAAS,KAAK,QAAQ;QACtB,OAAO,WAAW,KAAK,UAAU;QACjC,MAAM,CAAC,wBAAwB,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,KAAK,KAAK,UAAU;QAC1E,MAAM,CAAC,wBAAwB,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,KAAK,KAAK,SAAS,EAC9E,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAC3E,OAAO,CACL,CAAC,GAAG,EAAE,KAAK,KAAK,UAAU,IAAI,OAAO,GAAG,EAAE,GAAG,KAAK,UAAU,CAAC;QAC7D,OAAO,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,GAAG,KAAK,UAAU;QAChF,OAAO,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,GAAG,KAAK,UAAU;QAC3E,OAAO,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,GAAG,KAAK,UAAU,CAChF,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,SAAiB,EAAE,iBAAgC;IAClF,IAAI,SAAS,KAAK,iBAAiB,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,KAAK,CAAC;IACrF,OAAO,CACL,iBAAiB,KAAK,IAAI;QAC1B,MAAM,CAAC,cAAc,CAAC,iBAAiB,CAAC,KAAK,SAAS;QACtD,OAAO,WAAW,KAAK,UAAU;QACjC,MAAM,CAAC,wBAAwB,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,KAAK,KAAK,MAAM;QACtE,MAAM,CAAC,wBAAwB,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,KAAK,KAAK,SAAS,CAC/E,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAiB;IACjD,MAAM,KAAK,GAAG,UAAiE,CAAC;IAChF,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,KAAK,CAAC,GAAG,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACtG,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,QAAkB;IACvD,IAAI,QAA2D,CAAC;IAChE,IAAI,iBAAiB,GAAkB,IAAI,CAAC;IAC5C,KACE,IAAI,KAAK,GAAG,CAAC,EAAE,SAAS,GAAkB,QAAQ,EAClD,SAAS,KAAK,IAAI,IAAI,KAAK,GAAG,EAAE,EAChC,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,KAAK,IAAI,CAAC,EACxD,CAAC;QACD,IAAI,SAAS,KAAK,yBAAyB,EAAE,CAAC;YAC5C,MAAM;QACR,CAAC;QAED,IAAI,mBAAmB,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;YAC7C,iBAAiB,GAAG,SAAS,CAAC;QAChC,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,SAAS;QACX,CAAC;QAED,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YACvC,MAAM;QACR,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC;QAC7E,IAAI,OAAO,UAAU,KAAK,UAAU,IAAI,uBAAuB,CAAC,SAAS,EAAE,iBAAiB,CAAC,EAAE,CAAC;YAC9F,QAAQ,GAAG,UAAU,CAAC;YACtB,MAAM;QACR,CAAC;QAED,0FAA0F;QAC1F,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,IAAI,GACR,QAAQ,KAAK,SAAS;QACpB,CAAC,CAAC,wBAAwB,CAAC,MAAM,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1E,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,CAAC,+CAA+C,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,WAAmB;IAC9C,MAAM,KAAK,GAAG,UAAiE,CAAC;IAChF,IAAI,OAAO,KAAK,CAAC,GAAG,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC3C,OAAO,mCAAmC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,gDAAgD,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,oBAAoB;IAQ/B;;;;;OAKG;IACH,YAAY,MAAwB,EAAE,KAAa;QAb3C,gBAAW,GAAuB,IAAI,CAAC;QACvC,mBAAc,GAA2B,IAAI,CAAC;QAC9C,oBAAe,GAAG,CAAC,CAAC;QAEX,qBAAgB,GAAW,qCAAqC,CAAC;QAUhF,MAAM,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,oBAAoB,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;QAClG,IAAI,CAAC,MAAM,GAAG;YACZ,kBAAkB;YAClB,gBAAgB;YAChB,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;YAC/C,GAAG,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC;YACvE,QAAQ,EAAE;gBACR,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;aAC3C;SACF,CAAC;QACF,IAAI,CAAC,KAAK,GAAG,KAAK,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;IAChD,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,oBAAoB,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/E,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;gBACxB,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC;YACnC,CAAC;YAED,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC/D,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;YAErC,IAAI,CAAC;gBACH,OAAO,MAAM,cAAc,CAAC;YAC9B,CAAC;oBAAS,CAAC;gBACT,IAAI,IAAI,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;oBAC3C,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;gBAC7B,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,oBAAoB,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YAChF,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC1E,IAAI,IAAI,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;oBAC3C,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;gBAC7B,CAAC;YACH,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;YACrC,KAAK,cAAc,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;QAED,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,UAAkB;QAC3C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC3D,MAAM,IAAI,GAA2B;YACnC,UAAU,EAAE,yBAAyB;YACrC,aAAa,EAAE,YAAY;YAC3B,kBAAkB,EAAE,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;YACvE,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;YACpD,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;SACjD,CAAC;QAEF,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACzB,IAAI,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC3C,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,IAAI,GAAQ,SAAS,CAAC;YAE1B,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,gCAAgC;YAClC,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAClF,MAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAyB,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;YACnF,CAAC;YACD,MAAM,QAAQ,CAAC,QAAQ,CACrB,QAAQ,CAAC,MAAM,EACf,IAAI,EACJ,qCAAqC,QAAQ,CAAC,MAAM,EAAE,EACtD,QAAQ,CAAC,OAAO,CACjB,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAY,MAAM,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QACvE,MAAM,WAAW,GACf,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,KAAK,IAAI,IAAI,cAAc,IAAI,aAAa;YAC5F,CAAC,CAAC,aAAa,CAAC,YAAY;YAC5B,CAAC,CAAC,SAAS,CAAC;QAChB,IACE,OAAO,WAAW,KAAK,QAAQ;YAC/B,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAC/B,mBAAmB,CAAC,WAAW,CAAC,EAChC,CAAC;YACD,MAAM,IAAI,WAAW,CAAC,sDAAsD,CAAC,CAAC;QAChF,CAAC;QAED,MAAM,SAAS,GAAI,aAAgD,CAAC,UAAU,IAAI,IAAI,CAAC;QACvF,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACnF,MAAM,IAAI,WAAW,CAAC,wDAAwD,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,GAAG,GAAG,SAAS,GAAG,IAAI,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;YACzD,MAAM,IAAI,WAAW,CAAC,wDAAwD,CAAC,CAAC;QAClF,CAAC;QAED,IAAI,IAAI,CAAC,eAAe,KAAK,UAAU,EAAE,CAAC;YACxC,IAAI,CAAC,WAAW,GAAG;gBACjB,KAAK,EAAE,WAAW;gBAClB,SAAS;gBACT,SAAS,EAAE,kBAAkB,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC;aAChF,CAAC;QACJ,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAEO,MAAM,CAAC,cAAc,CAAC,WAAwB;QACpD,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC,SAAS,CAAC;IAC7C,CAAC;IAEO,MAAM,CAAC,YAAY,CAAC,WAAwB;QAClD,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC,SAAS,CAAC;IAC7C,CAAC;IAED,sFAAsF;IACtF,eAAe;QACb,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;IAC7B,CAAC;CACF"}

package/auth/x509-transport.d.mts

@@ -1,5 +1,40 @@
-import type { X509Transport, X509TransportOptions } from "../internal/auth/x509-transport-capability.mjs";
+import type { X509ProxyMode, X509Transport, X509TransportOptions } from "../internal/auth/x509-transport-capability.mjs";
+import type { X509Credential } from "./types.mjs";
+/** Explicit, separately trusted CONNECT configuration for an SDK-owned X.509 credential. */
+export interface X509CredentialProxyOptions {
+    /** CONNECT proxy endpoint; its protocol must match the selected mode. */
+    url: string | URL;
+    /** Whether the connection to the CONNECT proxy itself is encrypted. */
+    mode: Exclude<X509ProxyMode, 'direct'>;
+    /** Optional private trust roots for the HTTPS proxy; never used for workload TLS. */
+    ca?: string | string[] | undefined;
+}
+/** Private certificate material and enrolled selectors for one SDK-owned workload credential. */
+export interface X509CredentialOptions {
+    /** Leaf client certificate followed by its required PEM intermediate chain. */
+    certificateChain: string;
+    /** PEM private key matching the leaf client certificate. */
+    privateKey: string;
+    /** Existing OpenAI identity-provider resource enrolled for the certificate. */
+    identityProviderId: string;
+    /** OpenAI service account authorized for the verified certificate identity. */
+    serviceAccountId: string;
+    /** Optional private certificate authorities trusted for OpenAI's issuer and API. */
+    ca?: string | string[] | undefined;
+    /** Optional passphrase used to decrypt an encrypted PEM private key. */
+    passphrase?: string | undefined;
+    /** Optional CONNECT proxy with separately scoped target and proxy TLS settings. */
+    proxy?: X509CredentialProxyOptions | undefined;
+    /** Seconds before expiration when access-token refresh begins; defaults to 1,200. */
+    refreshBufferSeconds?: number | undefined;
+}
 /** Creates one frozen, caller-attested Node.js transport for X.509 workload authentication. */
 export declare function createX509Transport(options: X509TransportOptions): X509Transport;
+/** Creates a first-class certificate credential with SDK-owned, verified TLS and CONNECT policy. */
+export declare function fromX509(options: X509CredentialOptions): X509Credential;
+/** Namespaced first-class credential factory, isolated from ordinary browser-safe auth imports. */
+export declare const workloadIdentity: Readonly<{
+    fromX509: typeof fromX509;
+}>;
 export type { X509ProxyMode, X509Transport, X509TransportOptions, } from "../internal/auth/x509-transport-capability.mjs";
 //# sourceMappingURL=x509-transport.d.mts.map

package/auth/x509-transport.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"x509-transport.d.mts","sourceRoot":"","sources":["../src/auth/x509-transport.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,oBAAoB,EAAE,uDAAmD;AAMtG,+FAA+F;AAC/F,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,GAAG,aAAa,CA4BhF;AAED,YAAY,EACV,aAAa,EACb,aAAa,EACb,oBAAoB,GACrB,uDAAmD"}
+{"version":3,"file":"x509-transport.d.mts","sourceRoot":"","sources":["../src/auth/x509-transport.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,aAAa,EACb,aAAa,EACb,oBAAoB,EACrB,uDAAmD;AAKpD,OAAO,KAAK,EAAE,cAAc,EAAwB,oBAAgB;AAEpE,4FAA4F;AAC5F,MAAM,WAAW,0BAA0B;IACzC,yEAAyE;IACzE,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;IAElB,uEAAuE;IACvE,IAAI,EAAE,OAAO,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAEvC,qFAAqF;IACrF,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;CACpC;AAED,iGAAiG;AACjG,MAAM,WAAW,qBAAqB;IACpC,+EAA+E;IAC/E,gBAAgB,EAAE,MAAM,CAAC;IAEzB,4DAA4D;IAC5D,UAAU,EAAE,MAAM,CAAC;IAEnB,+EAA+E;IAC/E,kBAAkB,EAAE,MAAM,CAAC;IAE3B,+EAA+E;IAC/E,gBAAgB,EAAE,MAAM,CAAC;IAEzB,oFAAoF;IACpF,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;IAEnC,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEhC,mFAAmF;IACnF,KAAK,CAAC,EAAE,0BAA0B,GAAG,SAAS,CAAC;IAE/C,qFAAqF;IACrF,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAgOD,+FAA+F;AAC/F,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,GAAG,aAAa,CA4BhF;AAED,oGAAoG;AACpG,wBAAgB,QAAQ,CAAC,OAAO,EAAE,qBAAqB,GAAG,cAAc,CAkCvE;AAED,mGAAmG;AACnG,eAAO,MAAM,gBAAgB;;EAA8B,CAAC;AAE5D,YAAY,EACV,aAAa,EACb,aAAa,EACb,oBAAoB,GACrB,uDAAmD"}

package/auth/x509-transport.d.ts

@@ -1,5 +1,40 @@
-import type { X509Transport, X509TransportOptions } from "../internal/auth/x509-transport-capability.js";
+import type { X509ProxyMode, X509Transport, X509TransportOptions } from "../internal/auth/x509-transport-capability.js";
+import type { X509Credential } from "./types.js";
+/** Explicit, separately trusted CONNECT configuration for an SDK-owned X.509 credential. */
+export interface X509CredentialProxyOptions {
+    /** CONNECT proxy endpoint; its protocol must match the selected mode. */
+    url: string | URL;
+    /** Whether the connection to the CONNECT proxy itself is encrypted. */
+    mode: Exclude<X509ProxyMode, 'direct'>;
+    /** Optional private trust roots for the HTTPS proxy; never used for workload TLS. */
+    ca?: string | string[] | undefined;
+}
+/** Private certificate material and enrolled selectors for one SDK-owned workload credential. */
+export interface X509CredentialOptions {
+    /** Leaf client certificate followed by its required PEM intermediate chain. */
+    certificateChain: string;
+    /** PEM private key matching the leaf client certificate. */
+    privateKey: string;
+    /** Existing OpenAI identity-provider resource enrolled for the certificate. */
+    identityProviderId: string;
+    /** OpenAI service account authorized for the verified certificate identity. */
+    serviceAccountId: string;
+    /** Optional private certificate authorities trusted for OpenAI's issuer and API. */
+    ca?: string | string[] | undefined;
+    /** Optional passphrase used to decrypt an encrypted PEM private key. */
+    passphrase?: string | undefined;
+    /** Optional CONNECT proxy with separately scoped target and proxy TLS settings. */
+    proxy?: X509CredentialProxyOptions | undefined;
+    /** Seconds before expiration when access-token refresh begins; defaults to 1,200. */
+    refreshBufferSeconds?: number | undefined;
+}
 /** Creates one frozen, caller-attested Node.js transport for X.509 workload authentication. */
 export declare function createX509Transport(options: X509TransportOptions): X509Transport;
+/** Creates a first-class certificate credential with SDK-owned, verified TLS and CONNECT policy. */
+export declare function fromX509(options: X509CredentialOptions): X509Credential;
+/** Namespaced first-class credential factory, isolated from ordinary browser-safe auth imports. */
+export declare const workloadIdentity: Readonly<{
+    fromX509: typeof fromX509;
+}>;
 export type { X509ProxyMode, X509Transport, X509TransportOptions, } from "../internal/auth/x509-transport-capability.js";
 //# sourceMappingURL=x509-transport.d.ts.map

package/auth/x509-transport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"x509-transport.d.ts","sourceRoot":"","sources":["../src/auth/x509-transport.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,oBAAoB,EAAE,sDAAmD;AAMtG,+FAA+F;AAC/F,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,GAAG,aAAa,CA4BhF;AAED,YAAY,EACV,aAAa,EACb,aAAa,EACb,oBAAoB,GACrB,sDAAmD"}
+{"version":3,"file":"x509-transport.d.ts","sourceRoot":"","sources":["../src/auth/x509-transport.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,aAAa,EACb,aAAa,EACb,oBAAoB,EACrB,sDAAmD;AAKpD,OAAO,KAAK,EAAE,cAAc,EAAwB,mBAAgB;AAEpE,4FAA4F;AAC5F,MAAM,WAAW,0BAA0B;IACzC,yEAAyE;IACzE,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;IAElB,uEAAuE;IACvE,IAAI,EAAE,OAAO,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAEvC,qFAAqF;IACrF,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;CACpC;AAED,iGAAiG;AACjG,MAAM,WAAW,qBAAqB;IACpC,+EAA+E;IAC/E,gBAAgB,EAAE,MAAM,CAAC;IAEzB,4DAA4D;IAC5D,UAAU,EAAE,MAAM,CAAC;IAEnB,+EAA+E;IAC/E,kBAAkB,EAAE,MAAM,CAAC;IAE3B,+EAA+E;IAC/E,gBAAgB,EAAE,MAAM,CAAC;IAEzB,oFAAoF;IACpF,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;IAEnC,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEhC,mFAAmF;IACnF,KAAK,CAAC,EAAE,0BAA0B,GAAG,SAAS,CAAC;IAE/C,qFAAqF;IACrF,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAgOD,+FAA+F;AAC/F,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,GAAG,aAAa,CA4BhF;AAED,oGAAoG;AACpG,wBAAgB,QAAQ,CAAC,OAAO,EAAE,qBAAqB,GAAG,cAAc,CAkCvE;AAED,mGAAmG;AACnG,eAAO,MAAM,gBAAgB;;EAA8B,CAAC;AAE5D,YAAY,EACV,aAAa,EACb,aAAa,EACb,oBAAoB,GACrB,sDAAmD"}