@discomedia/utils 1.0.65 → 1.0.67

package/dist/index.cjs

@@ -4,7 +4,7 @@ var require$$0$3 = require('events');
 var require$$1 = require('https');
 var require$$2 = require('http');
 var require$$3$1 = require('net');
-var require$$4$1 = require('tls');
+var require$$4 = require('tls');
 var require$$3 = require('crypto');
 var require$$0$2 = require('stream');
 var require$$7 = require('url');
@@ -1565,6 +1565,37 @@ class InvalidWebhookSignatureError extends Error {
         super(message);
     }
 }
+/**
+ * Error thrown by the API server during OAuth token exchange.
+ * Can have status codes 400, 401, or 403.
+ * Other status codes from OAuth endpoints are raised as normal APIError types.
+ */
+class OAuthError extends APIError {
+    constructor(status, error, headers) {
+        let finalMessage = 'OAuth2 authentication error';
+        let error_code = undefined;
+        if (error && typeof error === 'object') {
+            const errorData = error;
+            error_code = errorData['error'];
+            const description = errorData['error_description'];
+            if (description && typeof description === 'string') {
+                finalMessage = description;
+            }
+            else if (error_code) {
+                finalMessage = error_code;
+            }
+        }
+        super(status, error, finalMessage, headers);
+        this.error_code = error_code;
+    }
+}
+class SubjectTokenProviderError extends OpenAIError {
+    constructor(message, provider, cause) {
+        super(message);
+        this.provider = provider;
+        this.cause = cause;
+    }
+}
 
 // File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 // https://url.spec.whatwg.org/#url-scheme-string
@@ -1617,7 +1648,7 @@ const safeJSON = (text) => {
 // File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 
-const VERSION = '6.32.0'; // x-release-please-version
+const VERSION = '6.34.0'; // x-release-please-version
 
 // File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 const isRunningInBrowser = () => {
@@ -2998,6 +3029,91 @@ class ConversationCursorPage extends AbstractPage {
     }
 }
 
+const SUBJECT_TOKEN_TYPES = {
+    jwt: 'urn:ietf:params:oauth:token-type:jwt',
+    id: 'urn:ietf:params:oauth:token-type:id_token',
+};
+const TOKEN_EXCHANGE_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:token-exchange';
+class WorkloadIdentityAuth {
+    constructor(config, fetch) {
+        this.cachedToken = null;
+        this.refreshPromise = null;
+        this.tokenExchangeUrl = 'https://auth.openai.com/oauth/token';
+        this.config = config;
+        this.fetch = fetch ?? getDefaultFetch();
+    }
+    async getToken() {
+        if (!this.cachedToken || this.isTokenExpired(this.cachedToken)) {
+            if (this.refreshPromise) {
+                return await this.refreshPromise;
+            }
+            this.refreshPromise = this.refreshToken();
+            try {
+                const token = await this.refreshPromise;
+                return token;
+            }
+            finally {
+                this.refreshPromise = null;
+            }
+        }
+        if (this.needsRefresh(this.cachedToken) && !this.refreshPromise) {
+            this.refreshPromise = this.refreshToken().finally(() => {
+                this.refreshPromise = null;
+            });
+        }
+        return this.cachedToken.token;
+    }
+    async refreshToken() {
+        const subjectToken = await this.config.provider.getToken();
+        const response = await this.fetch(this.tokenExchangeUrl, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+                grant_type: TOKEN_EXCHANGE_GRANT_TYPE,
+                client_id: this.config.clientId,
+                subject_token: subjectToken,
+                subject_token_type: SUBJECT_TOKEN_TYPES[this.config.provider.tokenType],
+                identity_provider_id: this.config.identityProviderId,
+                service_account_id: this.config.serviceAccountId,
+            }),
+        });
+        if (!response.ok) {
+            const errorText = await response.text();
+            let body = undefined;
+            try {
+                body = JSON.parse(errorText);
+            }
+            catch { }
+            if (response.status === 400 || response.status === 401 || response.status === 403) {
+                throw new OAuthError(response.status, body, response.headers);
+            }
+            throw APIError.generate(response.status, body, `Token exchange failed with status ${response.status}`, response.headers);
+        }
+        const tokenResponse = (await response.json());
+        const expiresIn = tokenResponse.expires_in || 3600;
+        const expiresAt = Date.now() + expiresIn * 1000;
+        this.cachedToken = {
+            token: tokenResponse.access_token,
+            expiresAt,
+        };
+        return tokenResponse.access_token;
+    }
+    isTokenExpired(cachedToken) {
+        return Date.now() >= cachedToken.expiresAt;
+    }
+    needsRefresh(cachedToken) {
+        const bufferSeconds = this.config.refreshBufferSeconds ?? 1200;
+        const bufferMs = bufferSeconds * 1000;
+        return Date.now() >= cachedToken.expiresAt - bufferMs;
+    }
+    invalidateToken() {
+        this.cachedToken = null;
+        this.refreshPromise = null;
+    }
+}
+
 const checkFileSupport = () => {
     if (typeof File === 'undefined') {
         const { process } = globalThis;
@@ -8303,6 +8419,7 @@ _Webhooks_instances = new WeakSet(), _Webhooks_validateSecret = function _Webhoo
 
 // File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 var _OpenAI_instances, _a$1, _OpenAI_encoder, _OpenAI_baseURLOverridden;
+const WORKLOAD_IDENTITY_API_KEY_PLACEHOLDER = 'workload-identity-auth';
 /**
  * API Client for interfacing with the OpenAI API.
  */
@@ -8323,7 +8440,7 @@ class OpenAI {
      * @param {Record<string, string | undefined>} opts.defaultQuery - Default query parameters to include with every request to the API.
      * @param {boolean} [opts.dangerouslyAllowBrowser=false] - By default, client-side use of this library is not allowed, as it risks exposing your secret API credentials to attackers.
      */
-    constructor({ baseURL = readEnv('OPENAI_BASE_URL'), apiKey = readEnv('OPENAI_API_KEY'), organization = readEnv('OPENAI_ORG_ID') ?? null, project = readEnv('OPENAI_PROJECT_ID') ?? null, webhookSecret = readEnv('OPENAI_WEBHOOK_SECRET') ?? null, ...opts } = {}) {
+    constructor({ baseURL = readEnv('OPENAI_BASE_URL'), apiKey = readEnv('OPENAI_API_KEY'), organization = readEnv('OPENAI_ORG_ID') ?? null, project = readEnv('OPENAI_PROJECT_ID') ?? null, webhookSecret = readEnv('OPENAI_WEBHOOK_SECRET') ?? null, workloadIdentity, ...opts } = {}) {
         _OpenAI_instances.add(this);
         _OpenAI_encoder.set(this, void 0);
         /**
@@ -8378,14 +8495,21 @@ class OpenAI {
         this.containers = new Containers(this);
         this.skills = new Skills(this);
         this.videos = new Videos(this);
-        if (apiKey === undefined) {
-            throw new OpenAIError('Missing credentials. Please pass an `apiKey`, or set the `OPENAI_API_KEY` environment variable.');
+        if (workloadIdentity) {
+            if (apiKey && apiKey !== WORKLOAD_IDENTITY_API_KEY_PLACEHOLDER) {
+                throw new OpenAIError('The `apiKey` and `workloadIdentity` arguments are mutually exclusive; only one can be passed at a time.');
+            }
+            apiKey = WORKLOAD_IDENTITY_API_KEY_PLACEHOLDER;
+        }
+        else if (apiKey === undefined) {
+            throw new OpenAIError('Missing credentials. Please pass an `apiKey`, `workloadIdentity`, or set the `OPENAI_API_KEY` environment variable.');
         }
         const options = {
             apiKey,
             organization,
             project,
             webhookSecret,
+            workloadIdentity,
             ...opts,
             baseURL: baseURL || `https://api.openai.com/v1`,
         };
@@ -8407,6 +8531,9 @@ class OpenAI {
         this.fetch = options.fetch ?? getDefaultFetch();
         __classPrivateFieldSet(this, _OpenAI_encoder, FallbackEncoder);
         this._options = options;
+        if (workloadIdentity) {
+            this._workloadIdentityAuth = new WorkloadIdentityAuth(workloadIdentity, this.fetch);
+        }
         this.apiKey = typeof apiKey === 'string' ? apiKey : 'Missing Key';
         this.organization = organization;
         this.project = project;
@@ -8426,6 +8553,7 @@ class OpenAI {
             fetch: this.fetch,
             fetchOptions: this.fetchOptions,
             apiKey: this.apiKey,
+            workloadIdentity: this._options.workloadIdentity,
             organization: this.organization,
             project: this.project,
             webhookSecret: this.webhookSecret,
@@ -8552,7 +8680,7 @@ class OpenAI {
             throw new APIUserAbortError();
         }
         const controller = new AbortController();
-        const response = await this.fetchWithTimeout(url, req, timeout, controller).catch(castToError);
+        const response = await this.fetchWithAuth(url, req, timeout, controller).catch(castToError);
         const headersTime = Date.now();
         if (response instanceof globalThis.Error) {
             const retryMessage = `retrying, ${retriesRemaining} attempts remaining`;
@@ -8582,6 +8710,9 @@ class OpenAI {
                 durationMs: headersTime - startTime,
                 message: response.message,
             }));
+            if (response instanceof OAuthError || response instanceof SubjectTokenProviderError) {
+                throw response;
+            }
             if (isTimeout) {
                 throw new APIConnectionTimeoutError();
             }
@@ -8593,6 +8724,20 @@ class OpenAI {
             .join('');
         const responseInfo = `[${requestLogID}${retryLogStr}${specialHeaders}] ${req.method} ${url} ${response.ok ? 'succeeded' : 'failed'} with status ${response.status} in ${headersTime - startTime}ms`;
         if (!response.ok) {
+            if (response.status === 401 &&
+                this._workloadIdentityAuth &&
+                !options.__metadata?.['hasStreamingBody'] &&
+                !options.__metadata?.['workloadIdentityTokenRefreshed']) {
+                await CancelReadableStream(response.body);
+                this._workloadIdentityAuth.invalidateToken();
+                return this.makeRequest({
+                    ...options,
+                    __metadata: {
+                        ...options.__metadata,
+                        workloadIdentityTokenRefreshed: true,
+                    },
+                }, retriesRemaining, retryOfRequestLogID ?? requestLogID);
+            }
             const shouldRetry = await this.shouldRetry(response);
             if (retriesRemaining && shouldRetry) {
                 const retryMessage = `retrying, ${retriesRemaining} attempts remaining`;
@@ -8643,6 +8788,18 @@ class OpenAI {
         const request = this.makeRequest(options, null, undefined);
         return new PagePromise(this, request, Page);
     }
+    async fetchWithAuth(url, init, timeout, controller) {
+        if (this._workloadIdentityAuth) {
+            const headers = init.headers;
+            const authHeader = headers.get('Authorization');
+            if (!authHeader || authHeader === `Bearer ${WORKLOAD_IDENTITY_API_KEY_PLACEHOLDER}`) {
+                const token = await this._workloadIdentityAuth.getToken();
+                headers.set('Authorization', `Bearer ${token}`);
+            }
+        }
+        const response = await this.fetchWithTimeout(url, init, timeout, controller);
+        return response;
+    }
     async fetchWithTimeout(url, init, ms, controller) {
         const { signal, method, ...options } = init || {};
         const abort = this._makeAbort(controller);
@@ -8739,7 +8896,13 @@ class OpenAI {
         if ('timeout' in options)
             validatePositiveInteger('timeout', options.timeout);
         options.timeout = options.timeout ?? this.timeout;
-        const { bodyHeaders, body } = this.buildBody({ options });
+        const { bodyHeaders, body, isStreamingBody } = this.buildBody({ options });
+        if (isStreamingBody) {
+            inputOptions.__metadata = {
+                ...inputOptions.__metadata,
+                hasStreamingBody: true,
+            };
+        }
         const reqHeaders = await this.buildHeaders({ options: inputOptions, method, bodyHeaders, retryCount });
         const req = {
             method,
@@ -8786,9 +8949,18 @@ class OpenAI {
     }
     buildBody({ options: { body, headers: rawHeaders } }) {
         if (!body) {
-            return { bodyHeaders: undefined, body: undefined };
+            return { bodyHeaders: undefined, body: undefined, isStreamingBody: false };
         }
         const headers = buildHeaders([rawHeaders]);
+        const isReadableStream = typeof globalThis.ReadableStream !== 'undefined' &&
+            body instanceof globalThis.ReadableStream;
+        const isRetryableBody = !isReadableStream &&
+            (typeof body === 'string' ||
+                body instanceof ArrayBuffer ||
+                ArrayBuffer.isView(body) ||
+                (typeof globalThis.Blob !== 'undefined' && body instanceof globalThis.Blob) ||
+                body instanceof URLSearchParams ||
+                body instanceof FormData);
         if (
         // Pass raw type verbatim
         ArrayBuffer.isView(body) ||
@@ -8804,23 +8976,28 @@ class OpenAI {
             // `URLSearchParams` -> `application/x-www-form-urlencoded`
             body instanceof URLSearchParams ||
             // Send chunked stream (each chunk has own `length`)
-            (globalThis.ReadableStream && body instanceof globalThis.ReadableStream)) {
-            return { bodyHeaders: undefined, body: body };
+            isReadableStream) {
+            return { bodyHeaders: undefined, body: body, isStreamingBody: !isRetryableBody };
         }
         else if (typeof body === 'object' &&
             (Symbol.asyncIterator in body ||
                 (Symbol.iterator in body && 'next' in body && typeof body.next === 'function'))) {
-            return { bodyHeaders: undefined, body: ReadableStreamFrom(body) };
+            return {
+                bodyHeaders: undefined,
+                body: ReadableStreamFrom(body),
+                isStreamingBody: true,
+            };
         }
         else if (typeof body === 'object' &&
             headers.values.get('content-type') === 'application/x-www-form-urlencoded') {
             return {
                 bodyHeaders: { 'content-type': 'application/x-www-form-urlencoded' },
                 body: this.stringifyQuery(body),
+                isStreamingBody: false,
             };
         }
         else {
-            return __classPrivateFieldGet(this, _OpenAI_encoder, "f").call(this, { body, headers });
+            return { ...__classPrivateFieldGet(this, _OpenAI_encoder, "f").call(this, { body, headers }), isStreamingBody: false };
         }
     }
 }
@@ -13509,6 +13686,9 @@ function requirePermessageDeflate () {
 	   *     acknowledge disabling of client context takeover
 	   * @param {Number} [options.concurrencyLimit=10] The number of concurrent
 	   *     calls to zlib
+	   * @param {Boolean} [options.isServer=false] Create the instance in either
+	   *     server or client mode
+	   * @param {Number} [options.maxPayload=0] The maximum allowed message length
 	   * @param {(Boolean|Number)} [options.serverMaxWindowBits] Request/confirm the
 	   *     use of a custom server window size
 	   * @param {Boolean} [options.serverNoContextTakeover=false] Request/accept
@@ -13519,16 +13699,13 @@ function requirePermessageDeflate () {
 	   *     deflate
 	   * @param {Object} [options.zlibInflateOptions] Options to pass to zlib on
 	   *     inflate
-	   * @param {Boolean} [isServer=false] Create the instance in either server or
-	   *     client mode
-	   * @param {Number} [maxPayload=0] The maximum allowed message length
 	   */
-	  constructor(options, isServer, maxPayload) {
-	    this._maxPayload = maxPayload | 0;
+	  constructor(options) {
 	    this._options = options || {};
 	    this._threshold =
 	      this._options.threshold !== undefined ? this._options.threshold : 1024;
-	    this._isServer = !!isServer;
+	    this._maxPayload = this._options.maxPayload | 0;
+	    this._isServer = !!this._options.isServer;
 	    this._deflate = null;
 	    this._inflate = null;
 
@@ -16010,7 +16187,7 @@ function requireWebsocket () {
 	const https = require$$1;
 	const http = require$$2;
 	const net = require$$3$1;
-	const tls = require$$4$1;
+	const tls = require$$4;
 	const { randomBytes, createHash } = require$$3;
 	const { Duplex, Readable } = require$$0$2;
 	const { URL } = require$$7;
@@ -16697,7 +16874,7 @@ function requireWebsocket () {
 	  } else {
 	    try {
 	      parsedUrl = new URL(address);
-	    } catch (e) {
+	    } catch {
 	      throw new SyntaxError(`Invalid URL: ${address}`);
 	    }
 	  }
@@ -16759,11 +16936,11 @@ function requireWebsocket () {
 	  opts.timeout = opts.handshakeTimeout;
 
 	  if (opts.perMessageDeflate) {
-	    perMessageDeflate = new PerMessageDeflate(
-	      opts.perMessageDeflate !== true ? opts.perMessageDeflate : {},
-	      false,
-	      opts.maxPayload
-	    );
+	    perMessageDeflate = new PerMessageDeflate({
+	      ...opts.perMessageDeflate,
+	      isServer: false,
+	      maxPayload: opts.maxPayload
+	    });
 	    opts.headers['Sec-WebSocket-Extensions'] = format({
 	      [PerMessageDeflate.extensionName]: perMessageDeflate.offer()
 	    });
@@ -17570,13 +17747,14 @@ function requireStream () {
 
 requireStream();
 
+requireExtension();
+
+requirePermessageDeflate();
+
 requireReceiver();
 
 requireSender();
 
-var websocketExports = requireWebsocket();
-var WebSocket = /*@__PURE__*/getDefaultExportFromCjs(websocketExports);
-
 var subprotocol;
 var hasRequiredSubprotocol;
 
@@ -17647,6 +17825,11 @@ function requireSubprotocol () {
 	return subprotocol;
 }
 
+requireSubprotocol();
+
+var websocketExports = requireWebsocket();
+var WebSocket = /*@__PURE__*/getDefaultExportFromCjs(websocketExports);
+
 /* eslint no-unused-vars: ["error", { "varsIgnorePattern": "^Duplex$", "caughtErrors": "none" }] */
 
 var websocketServer;
@@ -17947,11 +18130,11 @@ function requireWebsocketServer () {
 	      this.options.perMessageDeflate &&
 	      secWebSocketExtensions !== undefined
 	    ) {
-	      const perMessageDeflate = new PerMessageDeflate(
-	        this.options.perMessageDeflate,
-	        true,
-	        this.options.maxPayload
-	      );
+	      const perMessageDeflate = new PerMessageDeflate({
+	        ...this.options.perMessageDeflate,
+	        isServer: true,
+	        maxPayload: this.options.maxPayload
+	      });
 
 	      try {
 	        const offers = extension.parse(secWebSocketExtensions);
@@ -18215,10 +18398,6 @@ var config = {};
 
 var main = {exports: {}};
 
-var version = "17.3.1";
-var require$$4 = {
-	version: version};
-
 var hasRequiredMain;
 
 function requireMain () {
@@ -18228,25 +18407,17 @@ function requireMain () {
 	const path = require$$1$1;
 	const os = require$$2$1;
 	const crypto = require$$3;
-	const packageJson = require$$4;
-
-	const version = packageJson.version;
 
 	// Array of tips to display randomly
 	const TIPS = [
-	  '🔐 encrypt with Dotenvx: https://dotenvx.com',
-	  '🔐 prevent committing .env to code: https://dotenvx.com/precommit',
-	  '🔐 prevent building .env in docker: https://dotenvx.com/prebuild',
-	  '🤖 agentic secret storage: https://dotenvx.com/as2',
-	  '⚡️ secrets for agents: https://dotenvx.com/as2',
-	  '🛡️ auth for agents: https://vestauth.com',
-	  '🛠️  run anywhere with `dotenvx run -- yourcommand`',
-	  '⚙️  specify custom .env file path with { path: \'/custom/path/.env\' }',
-	  '⚙️  enable debug logging with { debug: true }',
-	  '⚙️  override existing env vars with { override: true }',
-	  '⚙️  suppress all logs with { quiet: true }',
-	  '⚙️  write to custom object with { processEnv: myObject }',
-	  '⚙️  load multiple .env files with { path: [\'.env.local\', \'.env\'] }'
+	  '◈ encrypted .env [www.dotenvx.com]',
+	  '◈ secrets for agents [www.dotenvx.com]',
+	  '⌁ auth for agents [www.vestauth.com]',
+	  '⌘ custom filepath { path: \'/custom/path/.env\' }',
+	  '⌘ enable debugging { debug: true }',
+	  '⌘ override existing { override: true }',
+	  '⌘ suppress logs { quiet: true }',
+	  '⌘ multiple files { path: [\'.env.local\', \'.env\'] }'
 	];
 
 	// Get a random tip from the tips array
@@ -18354,15 +18525,15 @@ function requireMain () {
 	}
 
 	function _warn (message) {
-	  console.error(`[dotenv@${version}][WARN] ${message}`);
+	  console.error(`⚠ ${message}`);
 	}
 
 	function _debug (message) {
-	  console.log(`[dotenv@${version}][DEBUG] ${message}`);
+	  console.log(`┆ ${message}`);
 	}
 
 	function _log (message) {
-	  console.log(`[dotenv@${version}] ${message}`);
+	  console.log(`◇ ${message}`);
 	}
 
 	function _dotenvKey (options) {
@@ -18456,7 +18627,7 @@ function requireMain () {
 	  const quiet = parseBoolean(process.env.DOTENV_CONFIG_QUIET || (options && options.quiet));
 
 	  if (debug || !quiet) {
-	    _log('Loading env from encrypted .env.vault');
+	    _log('loading env from encrypted .env.vault');
 	  }
 
 	  const parsed = DotenvModule._parseVault(options);
@@ -18485,7 +18656,7 @@ function requireMain () {
 	    encoding = options.encoding;
 	  } else {
 	    if (debug) {
-	      _debug('No encoding is specified. UTF-8 is used by default');
+	      _debug('no encoding is specified (UTF-8 is used by default)');
 	    }
 	  }
 
@@ -18513,7 +18684,7 @@ function requireMain () {
 	      DotenvModule.populate(parsedAll, parsed, options);
 	    } catch (e) {
 	      if (debug) {
-	        _debug(`Failed to load ${path} ${e.message}`);
+	        _debug(`failed to load ${path} ${e.message}`);
 	      }
 	      lastError = e;
 	    }
@@ -18534,13 +18705,13 @@ function requireMain () {
 	        shortPaths.push(relative);
 	      } catch (e) {
 	        if (debug) {
-	          _debug(`Failed to load ${filePath} ${e.message}`);
+	          _debug(`failed to load ${filePath} ${e.message}`);
 	        }
 	        lastError = e;
 	      }
 	    }
 
-	    _log(`injecting env (${keysCount}) from ${shortPaths.join(',')} ${dim(`-- tip: ${_getRandomTip()}`)}`);
+	    _log(`injected env (${keysCount}) from ${shortPaths.join(',')} ${dim(`// tip: ${_getRandomTip()}`)}`);
 	  }
 
 	  if (lastError) {
@@ -18561,7 +18732,7 @@ function requireMain () {
 
 	  // dotenvKey exists but .env.vault file does not exist
 	  if (!vaultPath) {
-	    _warn(`You set DOTENV_KEY but you are missing a .env.vault file at ${vaultPath}. Did you forget to build it?`);
+	    _warn(`you set DOTENV_KEY but you are missing a .env.vault file at ${vaultPath}`);
 
 	    return DotenvModule.configDotenv(options)
 	  }
@@ -19091,7 +19262,7 @@ class AlpacaMarketDataAPI extends require$$0$3.EventEmitter {
             pageCount++;
             const requestParams = {
                 ...params,
-                adjustment: DEFAULT_ADJUSTMENT,
+                adjustment: params.adjustment ?? DEFAULT_ADJUSTMENT,
                 feed: DEFAULT_FEED,
                 ...(pageToken && { page_token: pageToken }),
             };