@omnicross/core 0.1.0 → 0.1.2

package/dist/pipeline/AuthSource.cjs

@@ -0,0 +1 @@
+"use strict";

package/dist/pipeline/AuthSource.d.cts

@@ -0,0 +1,101 @@
+/**
+ * AuthSource — unified outbound-authentication strategy for the provider
+ * request pipeline.
+ *
+ * Phase 2 of the `provider-request-pipeline` OpenSpec change (design D3).
+ *
+ * The three consumer paths (the wire-format proxy handler, the host engine
+ * adapter, TransformerHandler) each authenticate differently:
+ *
+ *   - provider-key (+ ApiKeyPool failover)  — LLM-config provider rows
+ *   - subscription `AuthStrategy` (+ 401 refresh + fallback) — code-cli OAuth
+ *   - OAuth pass-through                     — SDK forwards its own Bearer
+ *
+ * `AuthSource` is the single contract that unifies these. THIS PHASE ONLY
+ * DEFINES the interface and provides three behavior-preserving WRAPPERS
+ * (`LlmConfigProviderAuth`, `SubscriptionAuthSource`, `OAuthPassThroughAuth`)
+ * around the existing logic. NO caller is routed through it yet — the core
+ * (`executeProviderCall`) is NOT changed to consume `ctx.auth`, and
+ * the host handler's branch structure is UNCHANGED. Wiring (and
+ * the `onResult` pool-rotation integration) is Phase 3.
+ *
+ * @module pipeline/AuthSource
+ */
+/**
+ * Hints an `AuthSource` may need to vary header formatting per request.
+ *
+ * Mirrors the subscription-side `AuthApplyHints` (which uses optional
+ * `upstreamUrl` / `resolvedModel`) but with REQUIRED fields, since the
+ * pipeline always knows both at the point it applies headers. Adapters that
+ * wrap the looser subscription shape map these across at the boundary.
+ */
+interface AuthApplyHints {
+    /** Resolved upstream URL the request will be sent to. */
+    upstreamUrl: string;
+    /** Resolved model id for the request. */
+    model: string;
+}
+/**
+ * Result of {@link AuthSource.onResult}.
+ *
+ * `rebound` is `true` when the auth source rotated to a different credential
+ * (e.g. ApiKeyPool re-bound the session to a new key after a 429). `newKey`
+ * carries the freshly-resolved key string when a rotation produced one, so a
+ * caller MAY retry the same call once with it. Mirrors the
+ * `{ newKey | null }` contract of `ApiKeyPoolService.reportError` lifted into
+ * a structured shape.
+ */
+interface AuthResultOutcome {
+    /** Whether the credential was rotated/re-bound as a result of this status. */
+    rebound: boolean;
+    /** The new resolved key when a rotation produced one; omitted otherwise. */
+    newKey?: string;
+}
+/**
+ * A pluggable outbound-authentication source for one provider request.
+ *
+ * Implementations OWN exactly the auth concern: which headers carry the
+ * credential, how to recover from a 401, where the request should be sent
+ * (when the credential dictates the endpoint), and how to react to a final
+ * HTTP status (pool rotation / refresh). The pipeline core composes the rest.
+ */
+interface AuthSource {
+    /**
+     * Inject the authentication headers for this request, mutating `headers`
+     * in place. Implementations MAY refresh expiring tokens here.
+     *
+     * NOTE (Phase 2 boundary, see report): exactly WHAT this owns vs what the
+     * ingress assembles (content-type, OpenRouter app headers, proxy auth
+     * stripping) is intentionally left to the caller this phase. The wrappers
+     * preserve their source's CURRENT header behavior verbatim.
+     */
+    applyHeaders(headers: Record<string, string>, hints: AuthApplyHints): Promise<void> | void;
+    /**
+     * Called when the upstream returns 401. Return `true` to ask the caller to
+     * retry once with freshly-applied headers; `false` to surface the 401.
+     * Optional — sources without a refresh notion omit it.
+     */
+    onUnauthorized?(): Promise<boolean>;
+    /**
+     * Resolve the upstream URL the request should target, when the credential
+     * dictates it (e.g. a subscription profile's per-model endpoint). Returns
+     * `undefined` when the source does not override the URL (the ingress keeps
+     * its own URL logic). Optional.
+     */
+    resolveUpstreamUrl?(model: string): string | undefined;
+    /**
+     * React to a final HTTP status (pool participation seam — design D5).
+     *
+     * For the provider-key source this reports the status to the
+     * `ApiKeyPoolService` (cooldown / disable / re-bind) and returns whether it
+     * rotated plus any new key. THIS PHASE ONLY: `onResult` is implemented and
+     * unit-tested in isolation; NO caller invokes it yet. Phase 3 wires it into
+     * `fetchWithRetry`. Optional.
+     *
+     * @param status The final HTTP status, or `null` for non-HTTP failures
+     *   (e.g. network errors). Non-reportable statuses no-op.
+     */
+    onResult?(status: number | null): Promise<AuthResultOutcome>;
+}
+
+export type { AuthApplyHints, AuthResultOutcome, AuthSource };

package/dist/pipeline/AuthSource.d.ts

@@ -0,0 +1,101 @@
+/**
+ * AuthSource — unified outbound-authentication strategy for the provider
+ * request pipeline.
+ *
+ * Phase 2 of the `provider-request-pipeline` OpenSpec change (design D3).
+ *
+ * The three consumer paths (the wire-format proxy handler, the host engine
+ * adapter, TransformerHandler) each authenticate differently:
+ *
+ *   - provider-key (+ ApiKeyPool failover)  — LLM-config provider rows
+ *   - subscription `AuthStrategy` (+ 401 refresh + fallback) — code-cli OAuth
+ *   - OAuth pass-through                     — SDK forwards its own Bearer
+ *
+ * `AuthSource` is the single contract that unifies these. THIS PHASE ONLY
+ * DEFINES the interface and provides three behavior-preserving WRAPPERS
+ * (`LlmConfigProviderAuth`, `SubscriptionAuthSource`, `OAuthPassThroughAuth`)
+ * around the existing logic. NO caller is routed through it yet — the core
+ * (`executeProviderCall`) is NOT changed to consume `ctx.auth`, and
+ * the host handler's branch structure is UNCHANGED. Wiring (and
+ * the `onResult` pool-rotation integration) is Phase 3.
+ *
+ * @module pipeline/AuthSource
+ */
+/**
+ * Hints an `AuthSource` may need to vary header formatting per request.
+ *
+ * Mirrors the subscription-side `AuthApplyHints` (which uses optional
+ * `upstreamUrl` / `resolvedModel`) but with REQUIRED fields, since the
+ * pipeline always knows both at the point it applies headers. Adapters that
+ * wrap the looser subscription shape map these across at the boundary.
+ */
+interface AuthApplyHints {
+    /** Resolved upstream URL the request will be sent to. */
+    upstreamUrl: string;
+    /** Resolved model id for the request. */
+    model: string;
+}
+/**
+ * Result of {@link AuthSource.onResult}.
+ *
+ * `rebound` is `true` when the auth source rotated to a different credential
+ * (e.g. ApiKeyPool re-bound the session to a new key after a 429). `newKey`
+ * carries the freshly-resolved key string when a rotation produced one, so a
+ * caller MAY retry the same call once with it. Mirrors the
+ * `{ newKey | null }` contract of `ApiKeyPoolService.reportError` lifted into
+ * a structured shape.
+ */
+interface AuthResultOutcome {
+    /** Whether the credential was rotated/re-bound as a result of this status. */
+    rebound: boolean;
+    /** The new resolved key when a rotation produced one; omitted otherwise. */
+    newKey?: string;
+}
+/**
+ * A pluggable outbound-authentication source for one provider request.
+ *
+ * Implementations OWN exactly the auth concern: which headers carry the
+ * credential, how to recover from a 401, where the request should be sent
+ * (when the credential dictates the endpoint), and how to react to a final
+ * HTTP status (pool rotation / refresh). The pipeline core composes the rest.
+ */
+interface AuthSource {
+    /**
+     * Inject the authentication headers for this request, mutating `headers`
+     * in place. Implementations MAY refresh expiring tokens here.
+     *
+     * NOTE (Phase 2 boundary, see report): exactly WHAT this owns vs what the
+     * ingress assembles (content-type, OpenRouter app headers, proxy auth
+     * stripping) is intentionally left to the caller this phase. The wrappers
+     * preserve their source's CURRENT header behavior verbatim.
+     */
+    applyHeaders(headers: Record<string, string>, hints: AuthApplyHints): Promise<void> | void;
+    /**
+     * Called when the upstream returns 401. Return `true` to ask the caller to
+     * retry once with freshly-applied headers; `false` to surface the 401.
+     * Optional — sources without a refresh notion omit it.
+     */
+    onUnauthorized?(): Promise<boolean>;
+    /**
+     * Resolve the upstream URL the request should target, when the credential
+     * dictates it (e.g. a subscription profile's per-model endpoint). Returns
+     * `undefined` when the source does not override the URL (the ingress keeps
+     * its own URL logic). Optional.
+     */
+    resolveUpstreamUrl?(model: string): string | undefined;
+    /**
+     * React to a final HTTP status (pool participation seam — design D5).
+     *
+     * For the provider-key source this reports the status to the
+     * `ApiKeyPoolService` (cooldown / disable / re-bind) and returns whether it
+     * rotated plus any new key. THIS PHASE ONLY: `onResult` is implemented and
+     * unit-tested in isolation; NO caller invokes it yet. Phase 3 wires it into
+     * `fetchWithRetry`. Optional.
+     *
+     * @param status The final HTTP status, or `null` for non-HTTP failures
+     *   (e.g. network errors). Non-reportable statuses no-op.
+     */
+    onResult?(status: number | null): Promise<AuthResultOutcome>;
+}
+
+export type { AuthApplyHints, AuthResultOutcome, AuthSource };

package/dist/pipeline/LlmConfigProviderAuth.cjs

@@ -0,0 +1,8 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+var _chunkLKZJEL6Ecjs = require('../chunk-LKZJEL6E.cjs');
+require('../chunk-A2YMUCBT.cjs');
+require('../chunk-6VIXXLMX.cjs');
+
+
+exports.LlmConfigProviderAuth = _chunkLKZJEL6Ecjs.LlmConfigProviderAuth;

package/dist/pipeline/LlmConfigProviderAuth.d.cts

@@ -0,0 +1,87 @@
+import { LLMProvider } from '@omnicross/contracts/llm-config';
+import { ApiKeyPoolService } from '../completion/ApiKeyPoolService.cjs';
+import { AuthSource, AuthApplyHints, AuthResultOutcome } from './AuthSource.cjs';
+import '../logger-4GvQNzhE.cjs';
+
+/**
+ * LlmConfigProviderAuth — `AuthSource` for LLM-config provider rows.
+ *
+ * Phase 2 of the `provider-request-pipeline` OpenSpec change (design D3, task 4.2).
+ *
+ * Wraps the two pieces that authenticate a normal (non-subscription) provider
+ * request today:
+ *
+ *   - `getProviderHeaders(provider, apiKey)` — the format-specific auth
+ *     headers (x-api-key / Authorization Bearer / x-goog-api-key / api-key)
+ *     plus content-type and the OpenRouter app-attribution headers. `applyHeaders`
+ *     merges these into the caller's header object VERBATIM (same output as a
+ *     direct `getProviderHeaders` call).
+ *   - `ApiKeyPoolService` — session-affine key selection + 429/529/401/403
+ *     rotation. `onResult` reproduces the reportable-status branch of
+ *     the host engine adapter's `callWithPoolReporting` (report → re-bind →
+ *     return the new key) and the success branch (`reportSuccess`).
+ *
+ * IMPORTANT (Phase 2 scope): this class is DEFINED + unit-tested in isolation
+ * only. NO caller routes through it yet — `executeProviderCall` is unchanged
+ * and the rotation INTEGRATION is Phase 3 (D5). Do not wire `onResult` into a
+ * fetch loop in this phase.
+ *
+ * @module pipeline/LlmConfigProviderAuth
+ */
+
+interface LlmConfigProviderAuthOptions {
+    /** Provider row whose auth format + key drives header assembly. */
+    provider: LLMProvider;
+    /** Resolved API key string to authenticate with (post env-ref resolution). */
+    apiKey: string;
+    /**
+     * Pool service for rotation, when this request is pool-backed. Omit (or pass
+     * `null`) for legacy single-key requests — `onResult` then never touches the
+     * pool (matching `fromPool === false`).
+     */
+    apiKeyPool?: ApiKeyPoolService | null;
+    /** Provider id the pool should report/select against (the ACTUAL provider
+     *  whose key was resolved, post-routing). Required for pool participation. */
+    providerId?: string;
+    /** Session id for pool affinity + rebind. Required for pool participation. */
+    sessionId?: string | null;
+}
+declare class LlmConfigProviderAuth implements AuthSource {
+    private readonly provider;
+    private readonly apiKeyPool;
+    private readonly providerId;
+    private readonly sessionId;
+    /**
+     * The current resolved key. Mutable so a Phase-3 caller can read the
+     * rotated key after `onResult`; this phase it is only set at construction
+     * and updated inside `onResult` (mirroring the inline re-point in
+     * `callWithPoolReporting`).
+     */
+    apiKey: string;
+    constructor(opts: LlmConfigProviderAuthOptions);
+    /**
+     * Merge the provider auth headers (and content-type / OpenRouter app
+     * headers) into `headers`, exactly as a direct `getProviderHeaders` call
+     * would produce them. `hints` are accepted for contract symmetry but the
+     * provider-key path does not vary headers by URL/model.
+     */
+    applyHeaders(headers: Record<string, string>, _hints: AuthApplyHints): void;
+    /**
+     * React to the final HTTP status — the pool-rotation seam (design D5).
+     *
+     * Reproduces `callWithPoolReporting`'s reportable + success branches:
+     *  - reportable status (429/529/401/403) on a pool-backed request →
+     *    `reportError(providerId, sessionId, status)`; when it hands back a
+     *    `newKey` the session was re-bound, so we adopt it (`this.apiKey`) and
+     *    return `{ rebound: true, newKey }`. When no key is available it returns
+     *    `{ rebound: false }` (the session is still cooled/disabled by the report).
+     *  - success / any 2xx → `reportSuccess(sessionId)`; `{ rebound: false }`.
+     *  - non-reportable, non-success, or non-pool request → no-op
+     *    `{ rebound: false }`.
+     *
+     * NOTE: no caller invokes this in Phase 2; it is unit-tested in isolation.
+     */
+    onResult(status: number | null): Promise<AuthResultOutcome>;
+}
+
+export { LlmConfigProviderAuth, type LlmConfigProviderAuthOptions };

package/dist/pipeline/LlmConfigProviderAuth.d.ts

@@ -0,0 +1,87 @@
+import { LLMProvider } from '@omnicross/contracts/llm-config';
+import { ApiKeyPoolService } from '../completion/ApiKeyPoolService.js';
+import { AuthSource, AuthApplyHints, AuthResultOutcome } from './AuthSource.js';
+import '../logger-4GvQNzhE.js';
+
+/**
+ * LlmConfigProviderAuth — `AuthSource` for LLM-config provider rows.
+ *
+ * Phase 2 of the `provider-request-pipeline` OpenSpec change (design D3, task 4.2).
+ *
+ * Wraps the two pieces that authenticate a normal (non-subscription) provider
+ * request today:
+ *
+ *   - `getProviderHeaders(provider, apiKey)` — the format-specific auth
+ *     headers (x-api-key / Authorization Bearer / x-goog-api-key / api-key)
+ *     plus content-type and the OpenRouter app-attribution headers. `applyHeaders`
+ *     merges these into the caller's header object VERBATIM (same output as a
+ *     direct `getProviderHeaders` call).
+ *   - `ApiKeyPoolService` — session-affine key selection + 429/529/401/403
+ *     rotation. `onResult` reproduces the reportable-status branch of
+ *     the host engine adapter's `callWithPoolReporting` (report → re-bind →
+ *     return the new key) and the success branch (`reportSuccess`).
+ *
+ * IMPORTANT (Phase 2 scope): this class is DEFINED + unit-tested in isolation
+ * only. NO caller routes through it yet — `executeProviderCall` is unchanged
+ * and the rotation INTEGRATION is Phase 3 (D5). Do not wire `onResult` into a
+ * fetch loop in this phase.
+ *
+ * @module pipeline/LlmConfigProviderAuth
+ */
+
+interface LlmConfigProviderAuthOptions {
+    /** Provider row whose auth format + key drives header assembly. */
+    provider: LLMProvider;
+    /** Resolved API key string to authenticate with (post env-ref resolution). */
+    apiKey: string;
+    /**
+     * Pool service for rotation, when this request is pool-backed. Omit (or pass
+     * `null`) for legacy single-key requests — `onResult` then never touches the
+     * pool (matching `fromPool === false`).
+     */
+    apiKeyPool?: ApiKeyPoolService | null;
+    /** Provider id the pool should report/select against (the ACTUAL provider
+     *  whose key was resolved, post-routing). Required for pool participation. */
+    providerId?: string;
+    /** Session id for pool affinity + rebind. Required for pool participation. */
+    sessionId?: string | null;
+}
+declare class LlmConfigProviderAuth implements AuthSource {
+    private readonly provider;
+    private readonly apiKeyPool;
+    private readonly providerId;
+    private readonly sessionId;
+    /**
+     * The current resolved key. Mutable so a Phase-3 caller can read the
+     * rotated key after `onResult`; this phase it is only set at construction
+     * and updated inside `onResult` (mirroring the inline re-point in
+     * `callWithPoolReporting`).
+     */
+    apiKey: string;
+    constructor(opts: LlmConfigProviderAuthOptions);
+    /**
+     * Merge the provider auth headers (and content-type / OpenRouter app
+     * headers) into `headers`, exactly as a direct `getProviderHeaders` call
+     * would produce them. `hints` are accepted for contract symmetry but the
+     * provider-key path does not vary headers by URL/model.
+     */
+    applyHeaders(headers: Record<string, string>, _hints: AuthApplyHints): void;
+    /**
+     * React to the final HTTP status — the pool-rotation seam (design D5).
+     *
+     * Reproduces `callWithPoolReporting`'s reportable + success branches:
+     *  - reportable status (429/529/401/403) on a pool-backed request →
+     *    `reportError(providerId, sessionId, status)`; when it hands back a
+     *    `newKey` the session was re-bound, so we adopt it (`this.apiKey`) and
+     *    return `{ rebound: true, newKey }`. When no key is available it returns
+     *    `{ rebound: false }` (the session is still cooled/disabled by the report).
+     *  - success / any 2xx → `reportSuccess(sessionId)`; `{ rebound: false }`.
+     *  - non-reportable, non-success, or non-pool request → no-op
+     *    `{ rebound: false }`.
+     *
+     * NOTE: no caller invokes this in Phase 2; it is unit-tested in isolation.
+     */
+    onResult(status: number | null): Promise<AuthResultOutcome>;
+}
+
+export { LlmConfigProviderAuth, type LlmConfigProviderAuthOptions };

package/dist/pipeline/LlmConfigProviderAuth.js

@@ -0,0 +1,8 @@
+import {
+  LlmConfigProviderAuth
+} from "../chunk-PXUJF5HS.js";
+import "../chunk-H5JUT3KV.js";
+import "../chunk-E3WHL7CO.js";
+export {
+  LlmConfigProviderAuth
+};

package/dist/pipeline/SubscriptionAuthSource.cjs

@@ -1,131 +1,9 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
 
-// src/pipeline/SubscriptionAuthSource.ts
-var SubscriptionAuthSource_exports = {};
-__export(SubscriptionAuthSource_exports, {
-  SubscriptionAuthSource: () => SubscriptionAuthSource,
-  stripAuthHeaders: () => stripAuthHeaders
-});
-module.exports = __toCommonJS(SubscriptionAuthSource_exports);
 
-// src/serializeError.ts
-function serializeError(err) {
-  if (err == null) return "Unknown error (null)";
-  if (err instanceof Error) {
-    let msg = err.message || err.name || "Error";
-    if (err.cause) {
-      msg += ` [cause: ${serializeError(err.cause)}]`;
-    }
-    const anyErr = err;
-    if (anyErr.status != null) msg += ` (status: ${anyErr.status})`;
-    else if (anyErr.code != null) msg += ` (code: ${anyErr.code})`;
-    return msg;
-  }
-  if (typeof err === "string") return err || "Empty error string";
-  if (typeof err !== "object") return String(err);
-  const obj = err;
-  if (typeof obj.message === "string" && obj.message) {
-    let msg = obj.message;
-    if (obj.status != null) msg += ` (status: ${obj.status})`;
-    else if (obj.code != null) msg += ` (code: ${obj.code})`;
-    if (typeof obj.type === "string") msg += ` [type: ${obj.type}]`;
-    return msg;
-  }
-  if (typeof obj.error === "string" && obj.error) {
-    return obj.error;
-  }
-  if (obj.error && typeof obj.error === "object") {
-    const inner = obj.error;
-    if (typeof inner.message === "string" && inner.message) {
-      let msg = inner.message;
-      if (typeof inner.type === "string") msg += ` [type: ${inner.type}]`;
-      return msg;
-    }
-  }
-  try {
-    const json = JSON.stringify(err, getCircularReplacer(), 2);
-    if (json && json.length > 1e3) {
-      return json.slice(0, 1e3) + "... (truncated)";
-    }
-    return json || "Unserializable error";
-  } catch {
-    return `Unserializable error: ${Object.prototype.toString.call(err)}`;
-  }
-}
-function getCircularReplacer() {
-  const seen = /* @__PURE__ */ new WeakSet();
-  return (_key, value) => {
-    if (typeof value === "object" && value !== null) {
-      if (seen.has(value)) return "[Circular]";
-      seen.add(value);
-    }
-    return value;
-  };
-}
+var _chunkN3V2J5ZOcjs = require('../chunk-N3V2J5ZO.cjs');
+require('../chunk-SVNDB62D.cjs');
 
-// src/pipeline/SubscriptionAuthSource.ts
-function stripAuthHeaders(headers) {
-  delete headers.authorization;
-  delete headers.Authorization;
-  delete headers["x-api-key"];
-  delete headers["X-Api-Key"];
-  delete headers["x-goog-api-key"];
-  delete headers["X-Goog-Api-Key"];
-}
-var SubscriptionAuthSource = class {
-  constructor(profile) {
-    this.profile = profile;
-  }
-  profile;
-  /**
-   * Strip any transformer-set auth headers, then delegate to the bound
-   * strategy. Mirrors `SubscriptionDispatcher`'s
-   * `stripAuthHeaders(...)` + `applyHeadersWithRetry(...)` sequence, including
-   * the best-effort swallow-and-warn around a throwing `applyHeaders`.
-   *
-   * The strategy's looser `AuthApplyHints` (optional `upstreamUrl` /
-   * `resolvedModel`) is fed from the pipeline's required `{ upstreamUrl,
-   * model }` at the boundary.
-   */
-  async applyHeaders(headers, hints) {
-    stripAuthHeaders(headers);
-    try {
-      await this.profile.authStrategy.applyHeaders(headers, {
-        upstreamUrl: hints.upstreamUrl,
-        resolvedModel: hints.model
-      });
-    } catch (err) {
-      console.warn("[SubscriptionAuthSource] authStrategy.applyHeaders threw:", serializeError(err));
-    }
-  }
-  /** Delegate the 401-refresh decision to the bound strategy. */
-  async onUnauthorized() {
-    return this.profile.authStrategy.onUnauthorized();
-  }
-  /** Resolve the upstream URL from the profile, when it provides one. */
-  resolveUpstreamUrl(model) {
-    return this.profile.resolveUpstreamUrl?.(model);
-  }
-};
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  SubscriptionAuthSource,
-  stripAuthHeaders
-});
+
+
+exports.SubscriptionAuthSource = _chunkN3V2J5ZOcjs.SubscriptionAuthSource; exports.stripAuthHeaders = _chunkN3V2J5ZOcjs.stripAuthHeaders;