@nebius/js-sdk 0.1.0

package/dist/cjs/runtime/service_account/credentials_file.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CredentialsFileReader = void 0;
+const fs_1 = require("fs");
+const util_1 = require("util");
+const logging_1 = require("../util/logging");
+const path_1 = require("../util/path");
+const service_account_1 = require("./service_account");
+function validateSubjectCredentials(sc) {
+    const type = sc.type ?? '';
+    if (type !== '' && type !== 'JWT') {
+        throw new Error(`Invalid service account credentials type: '${type}', only 'JWT' is supported.`);
+    }
+    if (sc.alg !== 'RS256') {
+        throw new Error(`Invalid service account algorithm: '${sc.alg}', only 'RS256' is supported.`);
+    }
+    if (sc.iss !== sc.sub) {
+        throw new Error(`Issuer must be the same as subject: '${sc.iss}' != '${sc.sub}'.`);
+    }
+}
+class CredentialsFileReader {
+    logger;
+    $type = 'nebius.sdk.CredentialsFileReader';
+    sc;
+    pem;
+    path;
+    constructor(filename, logger) {
+        this.logger = logger;
+        this.path = (0, path_1.resolveHomeDir)(filename);
+        const raw = (0, fs_1.readFileSync)(this.path, 'utf8');
+        const parsed = JSON.parse(raw);
+        const sc = parsed['subject-credentials'];
+        if (!sc)
+            throw new Error('Missing subject-credentials section');
+        validateSubjectCredentials(sc);
+        this.sc = sc;
+        this.pem = sc['private-key'];
+    }
+    [logging_1.custom]() {
+        return `${this.$type}(path=${this.path}, sa=${(0, util_1.inspect)(this.read())})`;
+    }
+    [logging_1.customJson]() {
+        return {
+            type: this.$type,
+            path: this.path,
+            serviceAccount: (0, logging_1.inspectJson)(this.read()),
+        };
+    }
+    read() {
+        return new service_account_1.ServiceAccount(this.pem, this.sc.kid, this.sc.sub, this.logger);
+    }
+    getExchangeTokenRequest() {
+        return this.read().getExchangeTokenRequest();
+    }
+}
+exports.CredentialsFileReader = CredentialsFileReader;
+//# sourceMappingURL=credentials_file.js.map

package/dist/cjs/runtime/service_account/credentials_file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials_file.js","sourceRoot":"","sources":["../../../../src/runtime/service_account/credentials_file.ts"],"names":[],"mappings":";;;AAAA,2BAAkC;AAClC,+BAA+B;AAE/B,6CAA0E;AAC1E,uCAA8C;AAG9C,uDAAmD;AAenD,SAAS,0BAA0B,CAAC,EAAsB;IACxD,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;IAC3B,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,8CAA8C,IAAI,6BAA6B,CAChF,CAAC;IACJ,CAAC;IACD,IAAI,EAAE,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,uCAAuC,EAAE,CAAC,GAAG,+BAA+B,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,wCAAwC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACrF,CAAC;AACH,CAAC;AAED,MAAa,qBAAqB;IAQtB;IAPM,KAAK,GAAG,kCAAkC,CAAC;IAC1C,EAAE,CAAqB;IACvB,GAAG,CAAS;IACZ,IAAI,CAAS;IAE9B,YACE,QAAgB,EACR,MAAe;QAAf,WAAM,GAAN,MAAM,CAAS;QAEvB,IAAI,CAAC,IAAI,GAAG,IAAA,qBAAc,EAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,IAAA,iBAAY,EAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkC,CAAC;QAChE,MAAM,EAAE,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACzC,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QAChE,0BAA0B,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC;IAC/B,CAAC;IACD,CAAC,gBAAM,CAAC;QACN,OAAO,GAAG,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,IAAI,QAAQ,IAAA,cAAO,EAAC,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC;IACxE,CAAC;IACD,CAAC,oBAAU,CAAC;QACV,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,cAAc,EAAE,IAAA,qBAAW,EAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SACzC,CAAC;IACJ,CAAC;IAED,IAAI;QACF,OAAO,IAAI,gCAAc,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7E,CAAC;IAED,uBAAuB;QACrB,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,uBAAuB,EAAE,CAAC;IAC/C,CAAC;CACF;AArCD,sDAqCC"}

package/dist/cjs/runtime/service_account/federated_credentials.d.ts

@@ -0,0 +1,31 @@
+import { ExchangeTokenRequest } from '../../api/nebius/iam/v1/index';
+import type { TokenRequester } from '../token/exchangeable';
+import { custom, customJson, Logger } from '../util/logging';
+export interface FederatedCredentialsReader {
+    credentials(): string;
+}
+export declare class FederatedCredentialsTokenRequester implements TokenRequester {
+    [custom]: () => string;
+    readonly serviceAccountId: string;
+    readonly credentials: FederatedCredentialsReader;
+    private logger?;
+    readonly $type = "nebius.sdk.FederatedCredentialsTokenRequester";
+    constructor(serviceAccountId: string, credentials: FederatedCredentialsReader, logger?: Logger | undefined);
+    [customJson](): object;
+    getExchangeTokenRequest(): ExchangeTokenRequest;
+}
+export declare class StaticFederatedCredentials implements FederatedCredentialsReader {
+    [custom]: () => string;
+    private readonly _credentials;
+    constructor(_credentials: string);
+    [customJson](): object;
+    credentials(): string;
+}
+export declare class FileFederatedCredentials implements FederatedCredentialsReader {
+    [custom]: () => string;
+    readonly filePath: string;
+    constructor(filePath: string);
+    [customJson](): object;
+    credentials(): string;
+}
+//# sourceMappingURL=federated_credentials.d.ts.map

package/dist/cjs/runtime/service_account/federated_credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"federated_credentials.d.ts","sourceRoot":"","sources":["../../../../src/runtime/service_account/federated_credentials.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE5D,OAAO,EAAE,MAAM,EAAE,UAAU,EAAe,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAG1E,MAAM,WAAW,0BAA0B;IACzC,WAAW,IAAI,MAAM,CAAC;CACvB;AAED,qBAAa,kCAAmC,YAAW,cAAc;IAOvE,CAAC,MAAM,CAAC,QAAI,MAAM;aAJA,gBAAgB,EAAE,MAAM;aACxB,WAAW,EAAE,0BAA0B;IACvD,OAAO,CAAC,MAAM,CAAC;IAJjB,SAAgB,KAAK,mDAAmD;gBAEtD,gBAAgB,EAAE,MAAM,EACxB,WAAW,EAAE,0BAA0B,EAC/C,MAAM,CAAC,EAAE,MAAM,YAAA;IAKzB,CAAC,UAAU,CAAC,IAAI,MAAM;IAQtB,uBAAuB,IAAI,oBAAoB;CAmBhD;AAED,qBAAa,0BAA2B,YAAW,0BAA0B;IAG3E,CAAC,MAAM,CAAC,QAAI,MAAM;IAFN,OAAO,CAAC,QAAQ,CAAC,YAAY;gBAAZ,YAAY,EAAE,MAAM;IAMjD,CAAC,UAAU,CAAC,IAAI,MAAM;IAQtB,WAAW,IAAI,MAAM;CAGtB;AAED,qBAAa,wBAAyB,YAAW,0BAA0B;IAGzE,CAAC,MAAM,CAAC,QAAI,MAAM;aAFU,QAAQ,EAAE,MAAM;gBAAhB,QAAQ,EAAE,MAAM;IAK5C,CAAC,UAAU,CAAC,IAAI,MAAM;IAOtB,WAAW,IAAI,MAAM;CAItB"}

package/dist/cjs/runtime/service_account/federated_credentials.js

@@ -0,0 +1,95 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FileFederatedCredentials = exports.StaticFederatedCredentials = exports.FederatedCredentialsTokenRequester = void 0;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_util_1 = require("node:util");
+const index_1 = require("../../api/nebius/iam/v1/index");
+const token_sanitizer_1 = require("../token_sanitizer");
+const logging_1 = require("../util/logging");
+const path_1 = require("../util/path");
+class FederatedCredentialsTokenRequester {
+    serviceAccountId;
+    credentials;
+    logger;
+    $type = 'nebius.sdk.FederatedCredentialsTokenRequester';
+    constructor(serviceAccountId, credentials, logger) {
+        this.serviceAccountId = serviceAccountId;
+        this.credentials = credentials;
+        this.logger = logger;
+    }
+    [logging_1.custom]() {
+        return `${this.$type}(serviceAccountId=${this.serviceAccountId}, credentials=${(0, node_util_1.inspect)(this.credentials)})`;
+    }
+    [logging_1.customJson]() {
+        return {
+            type: this.$type,
+            serviceAccountId: this.serviceAccountId,
+            credentials: (0, logging_1.inspectJson)(this.credentials),
+        };
+    }
+    getExchangeTokenRequest() {
+        const credentials = this.credentials.credentials();
+        const sanitizedCredentials = token_sanitizer_1.TokenSanitizer.credentialsSanitizer().sanitize(credentials);
+        this.logger?.trace('creating ExchangeTokenRequest using federated credentials', {
+            serviceAccountId: this.serviceAccountId,
+            credentials: sanitizedCredentials,
+        });
+        return index_1.ExchangeTokenRequest.create({
+            grantType: 'urn:ietf:params:oauth:grant-type:token-exchange',
+            requestedTokenType: 'urn:ietf:params:oauth:token-type:access_token',
+            subjectToken: this.serviceAccountId,
+            subjectTokenType: 'urn:nebius:params:oauth:token-type:subject_identifier',
+            actorTokenType: 'urn:ietf:params:oauth:token-type:jwt',
+            actorToken: credentials,
+            scopes: [],
+            audience: '',
+            resource: [],
+        });
+    }
+}
+exports.FederatedCredentialsTokenRequester = FederatedCredentialsTokenRequester;
+class StaticFederatedCredentials {
+    _credentials;
+    constructor(_credentials) {
+        this._credentials = _credentials;
+    }
+    [logging_1.custom]() {
+        const sanitizedCredentials = token_sanitizer_1.TokenSanitizer.credentialsSanitizer().sanitize(this._credentials);
+        return `StaticFederatedCredentials(credentials=${sanitizedCredentials})`;
+    }
+    [logging_1.customJson]() {
+        const sanitizer = token_sanitizer_1.TokenSanitizer.credentialsSanitizer();
+        return {
+            type: 'StaticFederatedCredentials',
+            credentials: sanitizer.sanitize(this._credentials),
+        };
+    }
+    credentials() {
+        return this._credentials;
+    }
+}
+exports.StaticFederatedCredentials = StaticFederatedCredentials;
+class FileFederatedCredentials {
+    filePath;
+    constructor(filePath) {
+        this.filePath = filePath;
+    }
+    [logging_1.custom]() {
+        return `FileFederatedCredentials(filePath=${this.filePath})`;
+    }
+    [logging_1.customJson]() {
+        return {
+            type: 'FileFederatedCredentials',
+            filePath: this.filePath,
+        };
+    }
+    credentials() {
+        const resolvedPath = (0, path_1.resolveHomeDir)(this.filePath);
+        return node_fs_1.default.readFileSync(resolvedPath, { encoding: 'utf8' }).trim();
+    }
+}
+exports.FileFederatedCredentials = FileFederatedCredentials;
+//# sourceMappingURL=federated_credentials.js.map

package/dist/cjs/runtime/service_account/federated_credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"federated_credentials.js","sourceRoot":"","sources":["../../../../src/runtime/service_account/federated_credentials.ts"],"names":[],"mappings":";;;;;;AAAA,sDAAyB;AACzB,yCAAoC;AAEpC,yDAAqE;AAErE,wDAAoD;AACpD,6CAA0E;AAC1E,uCAA8C;AAM9C,MAAa,kCAAkC;IAG3B;IACA;IACR;IAJM,KAAK,GAAG,+CAA+C,CAAC;IACxE,YACkB,gBAAwB,EACxB,WAAuC,EAC/C,MAAe;QAFP,qBAAgB,GAAhB,gBAAgB,CAAQ;QACxB,gBAAW,GAAX,WAAW,CAA4B;QAC/C,WAAM,GAAN,MAAM,CAAS;IACtB,CAAC;IACJ,CAAC,gBAAM,CAAC;QACN,OAAO,GAAG,IAAI,CAAC,KAAK,qBAAqB,IAAI,CAAC,gBAAgB,iBAAiB,IAAA,mBAAO,EAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;IAC9G,CAAC;IACD,CAAC,oBAAU,CAAC;QACV,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,WAAW,EAAE,IAAA,qBAAW,EAAC,IAAI,CAAC,WAAW,CAAC;SAC3C,CAAC;IACJ,CAAC;IAED,uBAAuB;QACrB,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC;QACnD,MAAM,oBAAoB,GAAG,gCAAc,CAAC,oBAAoB,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACzF,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,2DAA2D,EAAE;YAC9E,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,WAAW,EAAE,oBAAoB;SAClC,CAAC,CAAC;QACH,OAAO,4BAAoB,CAAC,MAAM,CAAC;YACjC,SAAS,EAAE,iDAAiD;YAC5D,kBAAkB,EAAE,+CAA+C;YACnE,YAAY,EAAE,IAAI,CAAC,gBAAgB;YACnC,gBAAgB,EAAE,uDAAuD;YACzE,cAAc,EAAE,sCAAsC;YACtD,UAAU,EAAE,WAAW;YACvB,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,EAAE;SACb,CAAC,CAAC;IACL,CAAC;CACF;AArCD,gFAqCC;AAED,MAAa,0BAA0B;IACR;IAA7B,YAA6B,YAAoB;QAApB,iBAAY,GAAZ,YAAY,CAAQ;IAAG,CAAC;IAErD,CAAC,gBAAM,CAAC;QACN,MAAM,oBAAoB,GAAG,gCAAc,CAAC,oBAAoB,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC/F,OAAO,0CAA0C,oBAAoB,GAAG,CAAC;IAC3E,CAAC;IACD,CAAC,oBAAU,CAAC;QACV,MAAM,SAAS,GAAG,gCAAc,CAAC,oBAAoB,EAAE,CAAC;QACxD,OAAO;YACL,IAAI,EAAE,4BAA4B;YAClC,WAAW,EAAE,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC;SACnD,CAAC;IACJ,CAAC;IAED,WAAW;QACT,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;CACF;AAlBD,gEAkBC;AAED,MAAa,wBAAwB;IACP;IAA5B,YAA4B,QAAgB;QAAhB,aAAQ,GAAR,QAAQ,CAAQ;IAAG,CAAC;IAEhD,CAAC,gBAAM,CAAC;QACN,OAAO,qCAAqC,IAAI,CAAC,QAAQ,GAAG,CAAC;IAC/D,CAAC;IACD,CAAC,oBAAU,CAAC;QACV,OAAO;YACL,IAAI,EAAE,0BAA0B;YAChC,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC;IACJ,CAAC;IAED,WAAW;QACT,MAAM,YAAY,GAAG,IAAA,qBAAc,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnD,OAAO,iBAAE,CAAC,YAAY,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpE,CAAC;CACF;AAjBD,4DAiBC"}

package/dist/cjs/runtime/service_account/pk_file.d.ts

@@ -0,0 +1,18 @@
+import { custom, customJson, Logger } from '../util/logging';
+import type { Reader } from './service_account';
+import { ServiceAccount } from './service_account';
+export declare class WrongKeyTypeError extends Error {
+}
+export declare class PkFileReader implements Reader {
+    [custom]: () => string;
+    private logger?;
+    readonly $type = "nebius.sdk.PkFileReader";
+    private readonly kid;
+    private readonly said;
+    private readonly filePath;
+    constructor(filename: string, publicKeyId: string, serviceAccountId: string, logger?: Logger | undefined);
+    [customJson](): object;
+    read(): ServiceAccount;
+    getExchangeTokenRequest(): import("../../api/nebius/iam/v1").ExchangeTokenRequest;
+}
+//# sourceMappingURL=pk_file.d.ts.map

package/dist/cjs/runtime/service_account/pk_file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pk_file.d.ts","sourceRoot":"","sources":["../../../../src/runtime/service_account/pk_file.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAG7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,qBAAa,iBAAkB,SAAQ,KAAK;CAAG;AAE/C,qBAAa,YAAa,YAAW,MAAM;IAgBzC,CAAC,MAAM,CAAC,QAAI,MAAM;IANhB,OAAO,CAAC,MAAM,CAAC;IATjB,SAAgB,KAAK,6BAA6B;IAClD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;gBAGhC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,gBAAgB,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,MAAM,YAAA;IASzB,CAAC,UAAU,CAAC,IAAI,MAAM;IAStB,IAAI,IAAI,cAAc;IAKtB,uBAAuB;CAGxB"}

package/dist/cjs/runtime/service_account/pk_file.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PkFileReader = exports.WrongKeyTypeError = void 0;
+const fs_1 = require("fs");
+const logging_1 = require("../util/logging");
+const path_1 = require("../util/path");
+const service_account_1 = require("./service_account");
+class WrongKeyTypeError extends Error {
+}
+exports.WrongKeyTypeError = WrongKeyTypeError;
+class PkFileReader {
+    logger;
+    $type = 'nebius.sdk.PkFileReader';
+    kid;
+    said;
+    filePath;
+    constructor(filename, publicKeyId, serviceAccountId, logger) {
+        this.logger = logger;
+        this.filePath = (0, path_1.resolveHomeDir)(filename);
+        this.kid = publicKeyId;
+        this.said = serviceAccountId;
+    }
+    [logging_1.custom]() {
+        return `${this.$type}(filePath=${this.filePath}, serviceAccountId=${this.said}, publicKeyId=${this.kid})`;
+    }
+    [logging_1.customJson]() {
+        return {
+            type: this.$type,
+            filePath: this.filePath,
+            publicKeyId: this.kid,
+            serviceAccountId: this.said,
+        };
+    }
+    read() {
+        const pem = (0, fs_1.readFileSync)(this.filePath, 'utf8');
+        return new service_account_1.ServiceAccount(pem, this.kid, this.said, this.logger);
+    }
+    getExchangeTokenRequest() {
+        return this.read().getExchangeTokenRequest();
+    }
+}
+exports.PkFileReader = PkFileReader;
+//# sourceMappingURL=pk_file.js.map

package/dist/cjs/runtime/service_account/pk_file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pk_file.js","sourceRoot":"","sources":["../../../../src/runtime/service_account/pk_file.ts"],"names":[],"mappings":";;;AAAA,2BAAkC;AAElC,6CAA6D;AAC7D,uCAA8C;AAG9C,uDAAmD;AAEnD,MAAa,iBAAkB,SAAQ,KAAK;CAAG;AAA/C,8CAA+C;AAE/C,MAAa,YAAY;IAUb;IATM,KAAK,GAAG,yBAAyB,CAAC;IACjC,GAAG,CAAS;IACZ,IAAI,CAAS;IACb,QAAQ,CAAS;IAElC,YACE,QAAgB,EAChB,WAAmB,EACnB,gBAAwB,EAChB,MAAe;QAAf,WAAM,GAAN,MAAM,CAAS;QAEvB,IAAI,CAAC,QAAQ,GAAG,IAAA,qBAAc,EAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,CAAC,GAAG,GAAG,WAAW,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;IACD,CAAC,gBAAM,CAAC;QACN,OAAO,GAAG,IAAI,CAAC,KAAK,aAAa,IAAI,CAAC,QAAQ,sBAAsB,IAAI,CAAC,IAAI,iBAAiB,IAAI,CAAC,GAAG,GAAG,CAAC;IAC5G,CAAC;IACD,CAAC,oBAAU,CAAC;QACV,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI,CAAC,GAAG;YACrB,gBAAgB,EAAE,IAAI,CAAC,IAAI;SAC5B,CAAC;IACJ,CAAC;IAED,IAAI;QACF,MAAM,GAAG,GAAG,IAAA,iBAAY,EAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAChD,OAAO,IAAI,gCAAc,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACnE,CAAC;IAED,uBAAuB;QACrB,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,uBAAuB,EAAE,CAAC;IAC/C,CAAC;CACF;AApCD,oCAoCC"}

package/dist/cjs/runtime/service_account/service_account.d.ts

@@ -0,0 +1,22 @@
+import { ExchangeTokenRequest } from '../../api/nebius/iam/v1/index';
+import { TokenRequester } from '../token/exchangeable';
+import { custom, customJson, Logger } from '../util/logging';
+export interface ServiceAccountLike extends TokenRequester {
+    readonly privateKeyPem: string;
+    readonly publicKeyId: string;
+    readonly serviceAccountId: string;
+}
+export declare class ServiceAccount implements ServiceAccountLike {
+    [custom]: () => string;
+    readonly privateKeyPem: string;
+    readonly publicKeyId: string;
+    readonly serviceAccountId: string;
+    readonly logger?: Logger | undefined;
+    constructor(privateKeyPem: string, publicKeyId: string, serviceAccountId: string, logger?: Logger | undefined);
+    [customJson](): object;
+    getExchangeTokenRequest(): ExchangeTokenRequest;
+}
+export interface Reader extends TokenRequester {
+    read(): ServiceAccount;
+}
+//# sourceMappingURL=service_account.d.ts.map

package/dist/cjs/runtime/service_account/service_account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service_account.d.ts","sourceRoot":"","sources":["../../../../src/runtime/service_account/service_account.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAE7D,MAAM,WAAW,kBAAmB,SAAQ,cAAc;IACxD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAOD,qBAAa,cAAe,YAAW,kBAAkB;IAQvD,CAAC,MAAM,CAAC,QAAI,MAAM;aANA,aAAa,EAAE,MAAM;aACrB,WAAW,EAAE,MAAM;aACnB,gBAAgB,EAAE,MAAM;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM;gBAHR,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,EACnB,gBAAgB,EAAE,MAAM,EAC/B,MAAM,CAAC,EAAE,MAAM,YAAA;IAM1B,CAAC,UAAU,CAAC,IAAI,MAAM;IAOtB,uBAAuB,IAAI,oBAAoB;CA0ChD;AAED,MAAM,WAAW,MAAO,SAAQ,cAAc;IAC5C,IAAI,IAAI,cAAc,CAAC;CACxB"}

package/dist/cjs/runtime/service_account/service_account.js

@@ -0,0 +1,70 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ServiceAccount = void 0;
+const crypto_1 = require("crypto");
+const index_1 = require("../../api/nebius/iam/v1/index");
+const logging_1 = require("../util/logging");
+function b64url(data) {
+    const buf = Buffer.isBuffer(data) ? data : Buffer.from(data, 'utf8');
+    return buf.toString('base64').replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
+}
+class ServiceAccount {
+    privateKeyPem;
+    publicKeyId;
+    serviceAccountId;
+    logger;
+    constructor(privateKeyPem, publicKeyId, serviceAccountId, logger) {
+        this.privateKeyPem = privateKeyPem;
+        this.publicKeyId = publicKeyId;
+        this.serviceAccountId = serviceAccountId;
+        this.logger = logger;
+    }
+    [logging_1.custom]() {
+        return `ServiceAccount(id=${this.serviceAccountId}, kid=${this.publicKeyId})`;
+    }
+    [logging_1.customJson]() {
+        return {
+            service_account_id: this.serviceAccountId,
+            public_key_id: this.publicKeyId,
+        };
+    }
+    getExchangeTokenRequest() {
+        const nowSec = Math.floor(Date.now() / 1000);
+        const expSec = nowSec + 60; // 1 minute TTL
+        const logger = this.logger?.withFields({
+            serviceAccountId: this.serviceAccountId,
+            publicKeyId: this.publicKeyId,
+        });
+        logger?.trace('creating JWT for ExchangeTokenRequest', { iat: nowSec, exp: expSec });
+        const header = { alg: 'RS256', kid: this.publicKeyId, typ: 'JWT' };
+        const payload = {
+            iss: this.serviceAccountId,
+            sub: this.serviceAccountId,
+            aud: 'token-service.iam.new.nebiuscloud.net',
+            exp: expSec,
+            iat: nowSec,
+        };
+        const encodedHeader = b64url(JSON.stringify(header));
+        const encodedPayload = b64url(JSON.stringify(payload));
+        const signingInput = `${encodedHeader}.${encodedPayload}`;
+        const signer = (0, crypto_1.createSign)('RSA-SHA256');
+        signer.update(signingInput);
+        signer.end();
+        const signature = signer.sign(this.privateKeyPem);
+        const encodedSignature = b64url(signature);
+        const subjectToken = `${signingInput}.${encodedSignature}`;
+        return index_1.ExchangeTokenRequest.create({
+            grantType: 'urn:ietf:params:oauth:grant-type:token-exchange',
+            requestedTokenType: 'urn:ietf:params:oauth:token-type:access_token',
+            subjectToken,
+            subjectTokenType: 'urn:ietf:params:oauth:token-type:jwt',
+            scopes: [],
+            audience: '',
+            actorToken: '',
+            actorTokenType: '',
+            resource: [],
+        });
+    }
+}
+exports.ServiceAccount = ServiceAccount;
+//# sourceMappingURL=service_account.js.map

package/dist/cjs/runtime/service_account/service_account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service_account.js","sourceRoot":"","sources":["../../../../src/runtime/service_account/service_account.ts"],"names":[],"mappings":";;;AAAA,mCAAoC;AAEpC,yDAAqE;AAErE,6CAA6D;AAQ7D,SAAS,MAAM,CAAC,IAAqB;IACnC,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrE,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAC1F,CAAC;AAED,MAAa,cAAc;IAEP;IACA;IACA;IACP;IAJX,YACkB,aAAqB,EACrB,WAAmB,EACnB,gBAAwB,EAC/B,MAAe;QAHR,kBAAa,GAAb,aAAa,CAAQ;QACrB,gBAAW,GAAX,WAAW,CAAQ;QACnB,qBAAgB,GAAhB,gBAAgB,CAAQ;QAC/B,WAAM,GAAN,MAAM,CAAS;IACvB,CAAC;IAEJ,CAAC,gBAAM,CAAC;QACN,OAAO,qBAAqB,IAAI,CAAC,gBAAgB,SAAS,IAAI,CAAC,WAAW,GAAG,CAAC;IAChF,CAAC;IACD,CAAC,oBAAU,CAAC;QACV,OAAO;YACL,kBAAkB,EAAE,IAAI,CAAC,gBAAgB;YACzC,aAAa,EAAE,IAAI,CAAC,WAAW;SAChC,CAAC;IACJ,CAAC;IAED,uBAAuB;QACrB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,GAAG,EAAE,CAAC,CAAC,eAAe;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC;YACrC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC;QACH,MAAM,EAAE,KAAK,CAAC,uCAAuC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QAErF,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,KAAK,EAAW,CAAC;QAC5E,MAAM,OAAO,GAAG;YACd,GAAG,EAAE,IAAI,CAAC,gBAAgB;YAC1B,GAAG,EAAE,IAAI,CAAC,gBAAgB;YAC1B,GAAG,EAAE,uCAAuC;YAC5C,GAAG,EAAE,MAAM;YACX,GAAG,EAAE,MAAM;SACH,CAAC;QAEX,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACrD,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QACvD,MAAM,YAAY,GAAG,GAAG,aAAa,IAAI,cAAc,EAAE,CAAC;QAE1D,MAAM,MAAM,GAAG,IAAA,mBAAU,EAAC,YAAY,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC5B,MAAM,CAAC,GAAG,EAAE,CAAC;QACb,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAClD,MAAM,gBAAgB,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QAE3C,MAAM,YAAY,GAAG,GAAG,YAAY,IAAI,gBAAgB,EAAE,CAAC;QAE3D,OAAO,4BAAoB,CAAC,MAAM,CAAC;YACjC,SAAS,EAAE,iDAAiD;YAC5D,kBAAkB,EAAE,+CAA+C;YACnE,YAAY;YACZ,gBAAgB,EAAE,sCAAsC;YACxD,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,EAAE;YACZ,UAAU,EAAE,EAAE;YACd,cAAc,EAAE,EAAE;YAClB,QAAQ,EAAE,EAAE;SACb,CAAC,CAAC;IACL,CAAC;CACF;AA5DD,wCA4DC"}

package/dist/cjs/runtime/service_account/static.d.ts

@@ -0,0 +1,13 @@
+import { custom, customJson } from '../util/logging';
+import type { Reader } from './service_account';
+import { ServiceAccount } from './service_account';
+export declare class StaticReader implements Reader {
+    [custom]: () => string;
+    private readonly sa;
+    readonly $type = "nebius.sdk.StaticReader";
+    constructor(sa: ServiceAccount);
+    [customJson](): unknown;
+    read(): ServiceAccount;
+    getExchangeTokenRequest(): import("../../api/nebius/iam/v1").ExchangeTokenRequest;
+}
+//# sourceMappingURL=static.d.ts.map

package/dist/cjs/runtime/service_account/static.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"static.d.ts","sourceRoot":"","sources":["../../../../src/runtime/service_account/static.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAe,MAAM,iBAAiB,CAAC;AAElE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,qBAAa,YAAa,YAAW,MAAM;IAGzC,CAAC,MAAM,CAAC,QAAI,MAAM;IADN,OAAO,CAAC,QAAQ,CAAC,EAAE;IAD/B,SAAgB,KAAK,6BAA6B;gBACrB,EAAE,EAAE,cAAc;IAI/C,CAAC,UAAU,CAAC,IAAI,OAAO;IAMvB,IAAI,IAAI,cAAc;IAGtB,uBAAuB;CAGxB"}

package/dist/cjs/runtime/service_account/static.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StaticReader = void 0;
+const util_1 = require("util");
+const logging_1 = require("../util/logging");
+class StaticReader {
+    sa;
+    $type = 'nebius.sdk.StaticReader';
+    constructor(sa) {
+        this.sa = sa;
+    }
+    [logging_1.custom]() {
+        return `Static(${(0, util_1.inspect)(this.sa)})`;
+    }
+    [logging_1.customJson]() {
+        return {
+            type: this.$type,
+            serviceAccount: (0, logging_1.inspectJson)(this.sa),
+        };
+    }
+    read() {
+        return this.sa;
+    }
+    getExchangeTokenRequest() {
+        return this.read().getExchangeTokenRequest();
+    }
+}
+exports.StaticReader = StaticReader;
+//# sourceMappingURL=static.js.map

package/dist/cjs/runtime/service_account/static.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"static.js","sourceRoot":"","sources":["../../../../src/runtime/service_account/static.ts"],"names":[],"mappings":";;;AAAA,+BAA+B;AAE/B,6CAAkE;AAKlE,MAAa,YAAY;IAEM;IADb,KAAK,GAAG,yBAAyB,CAAC;IAClD,YAA6B,EAAkB;QAAlB,OAAE,GAAF,EAAE,CAAgB;IAAG,CAAC;IACnD,CAAC,gBAAM,CAAC;QACN,OAAO,UAAU,IAAA,cAAO,EAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC;IACvC,CAAC;IACD,CAAC,oBAAU,CAAC;QACV,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,cAAc,EAAE,IAAA,qBAAW,EAAC,IAAI,CAAC,EAAE,CAAC;SACrC,CAAC;IACJ,CAAC;IACD,IAAI;QACF,OAAO,IAAI,CAAC,EAAE,CAAC;IACjB,CAAC;IACD,uBAAuB;QACrB,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,uBAAuB,EAAE,CAAC;IAC/C,CAAC;CACF;AAlBD,oCAkBC"}

package/dist/cjs/runtime/tls/system_certs.d.ts

@@ -0,0 +1,15 @@
+import { Logger } from '../util/logging';
+/**
+ * Best-effort loading of system root CAs from common locations.
+ * Also respects NODE_EXTRA_CA_CERTS and SSL_CERT_FILE if set.
+ * Returns a PEM bundle Buffer or undefined if none found.
+ */
+export declare function getSystemRootCAs(logger: Logger): Buffer | undefined;
+/**
+ * Normalize user-provided roots:
+ * - Buffer: returned as-is
+ * - string: treated as path to PEM bundle
+ * - string[]: each treated as path; concatenated in order
+ */
+export declare function normalizeRootCAs(input?: Buffer | string | string[]): Buffer | undefined;
+//# sourceMappingURL=system_certs.d.ts.map

package/dist/cjs/runtime/tls/system_certs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"system_certs.d.ts","sourceRoot":"","sources":["../../../../src/runtime/tls/system_certs.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAczC;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAmDnE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAYvF"}

package/dist/cjs/runtime/tls/system_certs.js

@@ -0,0 +1,99 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getSystemRootCAs = getSystemRootCAs;
+exports.normalizeRootCAs = normalizeRootCAs;
+const fs_1 = require("fs");
+const path_1 = require("path");
+function readIfExists(filePath) {
+    try {
+        const p = (0, path_1.resolve)(filePath);
+        if (!(0, fs_1.existsSync)(p))
+            return undefined;
+        const st = (0, fs_1.statSync)(p);
+        if (!st.isFile() || st.size === 0)
+            return undefined;
+        return (0, fs_1.readFileSync)(p);
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Best-effort loading of system root CAs from common locations.
+ * Also respects NODE_EXTRA_CA_CERTS and SSL_CERT_FILE if set.
+ * Returns a PEM bundle Buffer or undefined if none found.
+ */
+function getSystemRootCAs(logger) {
+    const chunks = [];
+    // Environment-provided CA bundle path
+    const envVars = ['NODE_EXTRA_CA_CERTS', 'SSL_CERT_FILE'];
+    for (const varName of envVars) {
+        const f = process.env[varName];
+        if (!f)
+            continue;
+        logger.trace('Checking environment-provided CA bundle', {
+            file: f,
+            env: varName,
+        });
+        const buf = readIfExists(f);
+        if (buf && buf.length > 0) {
+            chunks.push(buf);
+            logger.debug('Loaded environment-provided CA bundle', {
+                file: f,
+                env: varName,
+                size: buf.length,
+            });
+        }
+    }
+    // Common distro paths
+    const candidates = [
+        // Debian/Ubuntu
+        '/etc/ssl/certs/ca-certificates.crt',
+        // RHEL/CentOS/Fedora/Amazon Linux
+        '/etc/pki/tls/certs/ca-bundle.crt',
+        '/etc/ssl/certs/ca-bundle.crt',
+        '/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem',
+        // SUSE
+        '/etc/ssl/ca-bundle.pem',
+        // Alpine, macOS (macOS path may not exist on Linux but harmless to try)
+        '/etc/ssl/cert.pem',
+    ];
+    for (const p of candidates) {
+        logger.trace('Checking common CA bundle path', { file: p });
+        const buf = readIfExists(p);
+        if (buf && buf.length > 0) {
+            chunks.push(buf);
+            logger.debug('Loaded system CA bundle', { file: p, size: buf.length });
+            break; // first hit is enough (bundles already aggregate)
+        }
+    }
+    if (chunks.length === 0) {
+        logger.debug('No system root CA bundles found');
+        return undefined;
+    }
+    return Buffer.concat(chunks);
+}
+/**
+ * Normalize user-provided roots:
+ * - Buffer: returned as-is
+ * - string: treated as path to PEM bundle
+ * - string[]: each treated as path; concatenated in order
+ */
+function normalizeRootCAs(input) {
+    if (!input)
+        return undefined;
+    if (Buffer.isBuffer(input))
+        return input;
+    if (typeof input === 'string')
+        return readIfExists(input);
+    if (Array.isArray(input)) {
+        const bufs = input
+            .map((p) => (typeof p === 'string' ? readIfExists(p) : undefined))
+            .filter((b) => !!b && b.length > 0);
+        if (bufs.length === 0)
+            return undefined;
+        return Buffer.concat(bufs);
+    }
+    return undefined;
+}
+//# sourceMappingURL=system_certs.js.map

package/dist/cjs/runtime/tls/system_certs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"system_certs.js","sourceRoot":"","sources":["../../../../src/runtime/tls/system_certs.ts"],"names":[],"mappings":";;AAsBA,4CAmDC;AAQD,4CAYC;AA7FD,2BAAwD;AACxD,+BAA+B;AAI/B,SAAS,YAAY,CAAC,QAAgB;IACpC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAA,cAAO,EAAC,QAAQ,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAA,eAAU,EAAC,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QACrC,MAAM,EAAE,GAAG,IAAA,aAAQ,EAAC,CAAC,CAAC,CAAC;QACvB,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACpD,OAAO,IAAA,iBAAY,EAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,gBAAgB,CAAC,MAAc;IAC7C,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,sCAAsC;IACtC,MAAM,OAAO,GAAa,CAAC,qBAAqB,EAAE,eAAe,CAAC,CAAC;IACnE,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,CAAC,KAAK,CAAC,yCAAyC,EAAE;YACtD,IAAI,EAAE,CAAC;YACP,GAAG,EAAE,OAAO;SACb,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACjB,MAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE;gBACpD,IAAI,EAAE,CAAC;gBACP,GAAG,EAAE,OAAO;gBACZ,IAAI,EAAE,GAAG,CAAC,MAAM;aACjB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,sBAAsB;IACtB,MAAM,UAAU,GAAG;QACjB,gBAAgB;QAChB,oCAAoC;QACpC,kCAAkC;QAClC,kCAAkC;QAClC,8BAA8B;QAC9B,mDAAmD;QACnD,OAAO;QACP,wBAAwB;QACxB,wEAAwE;QACxE,mBAAmB;KACpB,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5D,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACjB,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACvE,MAAM,CAAC,kDAAkD;QAC3D,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAChD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH,SAAgB,gBAAgB,CAAC,KAAkC;IACjE,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAC1D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,KAAK;aACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;aACjE,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACnD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACxC,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/cjs/runtime/token/exchangeable.d.ts

@@ -0,0 +1,26 @@
+import { ExchangeTokenRequest } from '../../api/nebius/iam/v1/index';
+import type { SDKInterface } from '../../sdk';
+import { Bearer, Receiver } from '../token';
+import { custom, customJson, Logger } from '../util/logging';
+export declare class UnsupportedResponseError extends Error {
+    constructor(expected: string, got: unknown);
+}
+export declare class UnsupportedTokenTypeError extends Error {
+    constructor(tokenType: string);
+}
+export declare class ExchangeableBearer extends Bearer {
+    [custom]: () => string;
+    private readonly requester;
+    private readonly maxRetries;
+    private readonly logger?;
+    readonly $type = "nebius.sdk.ExchangeableBearer";
+    private svc;
+    constructor(requester: TokenRequester, sdk: SDKInterface | Promise<SDKInterface> | null, maxRetries?: number, logger?: Logger | undefined);
+    [customJson](): unknown;
+    setSDK(sdk: SDKInterface | Promise<SDKInterface> | null): void;
+    receiver(): Receiver;
+}
+export interface TokenRequester {
+    getExchangeTokenRequest(): ExchangeTokenRequest;
+}
+//# sourceMappingURL=exchangeable.d.ts.map

package/dist/cjs/runtime/token/exchangeable.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exchangeable.d.ts","sourceRoot":"","sources":["../../../../src/runtime/token/exchangeable.ts"],"names":[],"mappings":"AAKA,OAAO,EAEL,oBAAoB,EACrB,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAE9C,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAS,MAAM,UAAU,CAAC;AAEnD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAe,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAE1E,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO;CAI3C;AAED,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,SAAS,EAAE,MAAM;CAI9B;AAiGD,qBAAa,kBAAmB,SAAQ,MAAM;IAc5C,CAAC,MAAM,CAAC,QAAI,MAAM;IAThB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAE1B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAP1B,SAAgB,KAAK,mCAAmC;IACxD,OAAO,CAAC,GAAG,CAAmD;gBAG3C,SAAS,EAAE,cAAc,EAC1C,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,GAAG,IAAI,EAC/B,UAAU,GAAE,MAAU,EACtB,MAAM,CAAC,EAAE,MAAM,YAAA;IASlC,CAAC,UAAU,CAAC,IAAI,OAAO;IAQvB,MAAM,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,GAAG,IAAI,GAAG,IAAI;IAmB9D,QAAQ,IAAI,QAAQ;CAIrB;AAED,MAAM,WAAW,cAAc;IAC7B,uBAAuB,IAAI,oBAAoB,CAAC;CACjD"}