@rebyteai/agent-sdk 0.2.0

package/auth/workload-identity-auth.js

@@ -0,0 +1,247 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WorkloadIdentityAuth = void 0;
+const tslib_1 = require("../internal/tslib.js");
+const Shims = tslib_1.__importStar(require("../internal/shims.js"));
+const error_1 = require("../core/error.js");
+const SUBJECT_TOKEN_TYPES = {
+    jwt: 'urn:ietf:params:oauth:token-type:jwt',
+    id: 'urn:ietf:params:oauth:token-type:id_token',
+};
+const TOKEN_EXCHANGE_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:token-exchange';
+// Cap the refresh buffer at half the actual token lifetime, matching the X.509
+// workload-identity path, so short-lived tokens keep a usable cache window.
+const MAX_REFRESH_BUFFER_FRACTION = 0.5;
+function calculateExpiresAt(expiresIn, exchangeStartedAt) {
+    if (typeof expiresIn !== 'number' || !Number.isFinite(expiresIn) || expiresIn <= 0) {
+        throw new error_1.OpenAIError("Token exchange response has invalid 'expires_in' field");
+    }
+    const now = Date.now();
+    const fullLifetimeDeadline = now + expiresIn * 1000;
+    if (!Number.isSafeInteger(fullLifetimeDeadline) || fullLifetimeDeadline <= now) {
+        throw new error_1.OpenAIError("Token exchange response has invalid 'expires_in' field");
+    }
+    const expiresAt = fullLifetimeDeadline - (performance.now() - exchangeStartedAt);
+    if (expiresAt <= now) {
+        throw new error_1.OpenAIError('Workload identity token expired before its exchange completed.');
+    }
+    return expiresAt;
+}
+function calculateRefreshAt(expiresAt, lifetimeSeconds, refreshBufferSeconds) {
+    const configuredBufferMs = (refreshBufferSeconds ?? 1200) * 1000;
+    const effectiveBufferMs = Math.min(configuredBufferMs, lifetimeSeconds * 1000 * MAX_REFRESH_BUFFER_FRACTION);
+    return expiresAt - effectiveBufferMs;
+}
+const NATIVE_RESPONSE_PROTOTYPE = Response.prototype;
+const READ_NATIVE_RESPONSE_BODY = NATIVE_RESPONSE_PROTOTYPE.arrayBuffer;
+function isResponsePrototype(response, prototype) {
+    const constructor = Object.getOwnPropertyDescriptor(prototype, 'constructor')?.value;
+    if (prototype === response ||
+        typeof constructor !== 'function' ||
+        Object.getOwnPropertyDescriptor(constructor, 'name')?.value !== 'Response' ||
+        Object.getOwnPropertyDescriptor(constructor, 'prototype')?.value !== prototype) {
+        return false;
+    }
+    const tag = Object.getOwnPropertyDescriptor(prototype, Symbol.toStringTag);
+    return ((tag?.value === 'Response' || typeof tag?.get === 'function') &&
+        typeof Object.getOwnPropertyDescriptor(prototype, 'headers')?.get === 'function' &&
+        typeof Object.getOwnPropertyDescriptor(prototype, 'ok')?.get === 'function' &&
+        typeof Object.getOwnPropertyDescriptor(prototype, 'status')?.get === 'function');
+}
+function isResponseBodyPrototype(prototype, responsePrototype) {
+    if (prototype === responsePrototype) {
+        return true;
+    }
+    const constructor = Object.getOwnPropertyDescriptor(prototype, 'constructor')?.value;
+    return (responsePrototype !== null &&
+        Object.getPrototypeOf(responsePrototype) === prototype &&
+        typeof constructor === 'function' &&
+        Object.getOwnPropertyDescriptor(constructor, 'name')?.value === 'Body' &&
+        Object.getOwnPropertyDescriptor(constructor, 'prototype')?.value === prototype);
+}
+function decodeNativeResponseBody(body) {
+    const scope = globalThis;
+    return new TextDecoder('utf-8', { ignoreBOM: typeof scope.Bun?.version === 'string' }).decode(body);
+}
+async function parseOAuthTokenResponse(response) {
+    let readText;
+    let responsePrototype = null;
+    for (let depth = 0, prototype = response; prototype !== null && depth < 16; prototype = Object.getPrototypeOf(prototype), depth += 1) {
+        if (prototype === NATIVE_RESPONSE_PROTOTYPE) {
+            break;
+        }
+        if (isResponsePrototype(response, prototype)) {
+            responsePrototype = prototype;
+        }
+        const parser = Object.getOwnPropertyDescriptor(prototype, 'json');
+        if (!parser) {
+            continue;
+        }
+        if (typeof parser.value !== 'function') {
+            break;
+        }
+        const bodyReader = Object.getOwnPropertyDescriptor(prototype, 'text')?.value;
+        if (typeof bodyReader === 'function' && isResponseBodyPrototype(prototype, responsePrototype)) {
+            readText = bodyReader;
+            break;
+        }
+        // Custom parsers own their results and failures; rejection provenance cannot be inferred.
+        return parser.value.call(response);
+    }
+    const body = readText === undefined
+        ? decodeNativeResponseBody(await READ_NATIVE_RESPONSE_BODY.call(response))
+        : await readText.call(response);
+    try {
+        return JSON.parse(body);
+    }
+    catch {
+        throw new SyntaxError('Token exchange response contains invalid JSON');
+    }
+}
+function isUnsafeAccessToken(accessToken) {
+    const scope = globalThis;
+    if (typeof scope.Bun?.version === 'string') {
+        return /[^\t\u0020-\u007E]|^[\t ]|[\t ]$/u.test(accessToken);
+    }
+    return /[^\t\u0020-\u007E\u0080-\u00FF]|^[\t ]|[\t ]$/u.test(accessToken);
+}
+/**
+ * Exchanges external workload-identity tokens for cached OpenAI access tokens.
+ *
+ * Concurrent token exchanges are shared. Valid cached tokens are returned while
+ * a proactive refresh runs in the background; expired or missing tokens wait
+ * for a successful exchange before they are returned.
+ */
+class WorkloadIdentityAuth {
+    /**
+     * Creates a workload-identity token cache and OAuth token-exchange client.
+     *
+     * @param config External identity provider, OpenAI service account, and refresh settings.
+     * @param fetch Optional fetch implementation for calls to the OpenAI token endpoint.
+     */
+    constructor(config, fetch) {
+        this.cachedToken = null;
+        this.refreshPromise = null;
+        this.tokenGeneration = 0;
+        this.tokenExchangeUrl = 'https://auth.openai.com/oauth/token';
+        const { identityProviderId, serviceAccountId, clientId, refreshBufferSeconds, provider } = config;
+        this.config = {
+            identityProviderId,
+            serviceAccountId,
+            ...(clientId === undefined ? {} : { clientId }),
+            ...(refreshBufferSeconds === undefined ? {} : { refreshBufferSeconds }),
+            provider: {
+                tokenType: provider.tokenType,
+                getToken: provider.getToken.bind(provider),
+            },
+        };
+        this.fetch = fetch ?? Shims.getDefaultFetch();
+    }
+    /**
+     * Returns a valid OpenAI access token, exchanging or refreshing credentials as needed.
+     *
+     * Cached tokens nearing expiration are returned immediately while a background
+     * refresh runs. Concurrent callers share the same in-flight token exchange.
+     *
+     * @throws {OAuthError} When the token endpoint rejects the subject token or identity.
+     * @throws {APIError} When another unsuccessful HTTP response prevents token exchange.
+     * @throws {OpenAIError} When a successful exchange has an invalid access token or expiration.
+     */
+    async getToken() {
+        if (!this.cachedToken || WorkloadIdentityAuth.isTokenExpired(this.cachedToken)) {
+            if (this.refreshPromise) {
+                return await this.refreshPromise;
+            }
+            const refreshPromise = this.refreshToken(this.tokenGeneration);
+            this.refreshPromise = refreshPromise;
+            try {
+                return await refreshPromise;
+            }
+            finally {
+                if (this.refreshPromise === refreshPromise) {
+                    this.refreshPromise = null;
+                }
+            }
+        }
+        if (WorkloadIdentityAuth.needsRefresh(this.cachedToken) && !this.refreshPromise) {
+            const refreshPromise = this.refreshToken(this.tokenGeneration).finally(() => {
+                if (this.refreshPromise === refreshPromise) {
+                    this.refreshPromise = null;
+                }
+            });
+            this.refreshPromise = refreshPromise;
+            void refreshPromise.catch(() => null);
+        }
+        return this.cachedToken.token;
+    }
+    async refreshToken(generation) {
+        const subjectToken = await this.config.provider.getToken();
+        const body = {
+            grant_type: TOKEN_EXCHANGE_GRANT_TYPE,
+            subject_token: subjectToken,
+            subject_token_type: SUBJECT_TOKEN_TYPES[this.config.provider.tokenType],
+            identity_provider_id: this.config.identityProviderId,
+            service_account_id: this.config.serviceAccountId,
+        };
+        if (this.config.clientId) {
+            body['client_id'] = this.config.clientId;
+        }
+        // Exclude provider acquisition and measure delivery time independently of wall-clock changes.
+        const exchangeStartedAt = performance.now();
+        const response = await this.fetch(this.tokenExchangeUrl, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify(body),
+            redirect: 'manual',
+        });
+        if (!response.ok) {
+            const errorText = await response.text();
+            let body = undefined;
+            try {
+                body = JSON.parse(errorText);
+            }
+            catch {
+                // Ignore non-JSON error bodies.
+            }
+            if (response.status === 400 || response.status === 401 || response.status === 403) {
+                throw new error_1.OAuthError(response.status, body, response.headers);
+            }
+            throw error_1.APIError.generate(response.status, body, `Token exchange failed with status ${response.status}`, response.headers);
+        }
+        const tokenResponse = await parseOAuthTokenResponse(response);
+        const accessToken = typeof tokenResponse === 'object' && tokenResponse !== null && 'access_token' in tokenResponse
+            ? tokenResponse.access_token
+            : undefined;
+        if (typeof accessToken !== 'string' ||
+            accessToken.trim().length === 0 ||
+            isUnsafeAccessToken(accessToken)) {
+            throw new error_1.OpenAIError("Token exchange response missing 'access_token' field");
+        }
+        const expiresIn = tokenResponse.expires_in ?? 3600;
+        const expiresAt = calculateExpiresAt(expiresIn, exchangeStartedAt);
+        if (this.tokenGeneration === generation) {
+            this.cachedToken = {
+                token: accessToken,
+                expiresAt,
+                refreshAt: calculateRefreshAt(expiresAt, expiresIn, this.config.refreshBufferSeconds),
+            };
+        }
+        return accessToken;
+    }
+    static isTokenExpired(cachedToken) {
+        return Date.now() >= cachedToken.expiresAt;
+    }
+    static needsRefresh(cachedToken) {
+        return Date.now() >= cachedToken.refreshAt;
+    }
+    /** Discards the cached access token so the next request performs a fresh exchange. */
+    invalidateToken() {
+        this.tokenGeneration += 1;
+        this.cachedToken = null;
+        this.refreshPromise = null;
+    }
+}
+exports.WorkloadIdentityAuth = WorkloadIdentityAuth;
+//# sourceMappingURL=workload-identity-auth.js.map

package/auth/workload-identity-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workload-identity-auth.js","sourceRoot":"","sources":["../src/auth/workload-identity-auth.ts"],"names":[],"mappings":";;;;AAEA,oEAA2C;AAC3C,4CAAkE;AAQlE,MAAM,mBAAmB,GAA8D;IACrF,GAAG,EAAE,sCAAsC;IAC3C,EAAE,EAAE,2CAA2C;CAChD,CAAC;AAEF,MAAM,yBAAyB,GAAG,iDAAiD,CAAC;AACpF,+EAA+E;AAC/E,4EAA4E;AAC5E,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAExC,SAAS,kBAAkB,CAAC,SAAkB,EAAE,iBAAyB;IACvE,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACnF,MAAM,IAAI,mBAAW,CAAC,wDAAwD,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,oBAAoB,GAAG,GAAG,GAAG,SAAS,GAAG,IAAI,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,oBAAoB,CAAC,IAAI,oBAAoB,IAAI,GAAG,EAAE,CAAC;QAC/E,MAAM,IAAI,mBAAW,CAAC,wDAAwD,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,SAAS,GAAG,oBAAoB,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,iBAAiB,CAAC,CAAC;IACjF,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;QACrB,MAAM,IAAI,mBAAW,CAAC,gEAAgE,CAAC,CAAC;IAC1F,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB,CACzB,SAAiB,EACjB,eAAuB,EACvB,oBAAwC;IAExC,MAAM,kBAAkB,GAAG,CAAC,oBAAoB,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC;IACjE,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAChC,kBAAkB,EAClB,eAAe,GAAG,IAAI,GAAG,2BAA2B,CACrD,CAAC;IACF,OAAO,SAAS,GAAG,iBAAiB,CAAC;AACvC,CAAC;AAED,MAAM,yBAAyB,GAAG,QAAQ,CAAC,SAAS,CAAC;AACrD,MAAM,yBAAyB,GAAG,yBAAyB,CAAC,WAAW,CAAC;AAExE,SAAS,mBAAmB,CAAC,QAAkB,EAAE,SAAiB;IAChE,MAAM,WAAW,GAAG,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,KAAK,CAAC;IACrF,IACE,SAAS,KAAK,QAAQ;QACtB,OAAO,WAAW,KAAK,UAAU;QACjC,MAAM,CAAC,wBAAwB,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,KAAK,KAAK,UAAU;QAC1E,MAAM,CAAC,wBAAwB,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,KAAK,KAAK,SAAS,EAC9E,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAC3E,OAAO,CACL,CAAC,GAAG,EAAE,KAAK,KAAK,UAAU,IAAI,OAAO,GAAG,EAAE,GAAG,KAAK,UAAU,CAAC;QAC7D,OAAO,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,GAAG,KAAK,UAAU;QAChF,OAAO,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,GAAG,KAAK,UAAU;QAC3E,OAAO,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,GAAG,KAAK,UAAU,CAChF,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,SAAiB,EAAE,iBAAgC;IAClF,IAAI,SAAS,KAAK,iBAAiB,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,KAAK,CAAC;IACrF,OAAO,CACL,iBAAiB,KAAK,IAAI;QAC1B,MAAM,CAAC,cAAc,CAAC,iBAAiB,CAAC,KAAK,SAAS;QACtD,OAAO,WAAW,KAAK,UAAU;QACjC,MAAM,CAAC,wBAAwB,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,KAAK,KAAK,MAAM;QACtE,MAAM,CAAC,wBAAwB,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,KAAK,KAAK,SAAS,CAC/E,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAiB;IACjD,MAAM,KAAK,GAAG,UAAiE,CAAC;IAChF,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,KAAK,CAAC,GAAG,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACtG,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,QAAkB;IACvD,IAAI,QAA2D,CAAC;IAChE,IAAI,iBAAiB,GAAkB,IAAI,CAAC;IAC5C,KACE,IAAI,KAAK,GAAG,CAAC,EAAE,SAAS,GAAkB,QAAQ,EAClD,SAAS,KAAK,IAAI,IAAI,KAAK,GAAG,EAAE,EAChC,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,KAAK,IAAI,CAAC,EACxD,CAAC;QACD,IAAI,SAAS,KAAK,yBAAyB,EAAE,CAAC;YAC5C,MAAM;QACR,CAAC;QAED,IAAI,mBAAmB,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;YAC7C,iBAAiB,GAAG,SAAS,CAAC;QAChC,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,SAAS;QACX,CAAC;QAED,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YACvC,MAAM;QACR,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC;QAC7E,IAAI,OAAO,UAAU,KAAK,UAAU,IAAI,uBAAuB,CAAC,SAAS,EAAE,iBAAiB,CAAC,EAAE,CAAC;YAC9F,QAAQ,GAAG,UAAU,CAAC;YACtB,MAAM;QACR,CAAC;QAED,0FAA0F;QAC1F,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,IAAI,GACR,QAAQ,KAAK,SAAS;QACpB,CAAC,CAAC,wBAAwB,CAAC,MAAM,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1E,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,CAAC,+CAA+C,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,WAAmB;IAC9C,MAAM,KAAK,GAAG,UAAiE,CAAC;IAChF,IAAI,OAAO,KAAK,CAAC,GAAG,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC3C,OAAO,mCAAmC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,gDAAgD,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,MAAa,oBAAoB;IAQ/B;;;;;OAKG;IACH,YAAY,MAAwB,EAAE,KAAa;QAb3C,gBAAW,GAAuB,IAAI,CAAC;QACvC,mBAAc,GAA2B,IAAI,CAAC;QAC9C,oBAAe,GAAG,CAAC,CAAC;QAEX,qBAAgB,GAAW,qCAAqC,CAAC;QAUhF,MAAM,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,oBAAoB,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;QAClG,IAAI,CAAC,MAAM,GAAG;YACZ,kBAAkB;YAClB,gBAAgB;YAChB,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;YAC/C,GAAG,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC;YACvE,QAAQ,EAAE;gBACR,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;aAC3C;SACF,CAAC;QACF,IAAI,CAAC,KAAK,GAAG,KAAK,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;IAChD,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,oBAAoB,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/E,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;gBACxB,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC;YACnC,CAAC;YAED,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC/D,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;YAErC,IAAI,CAAC;gBACH,OAAO,MAAM,cAAc,CAAC;YAC9B,CAAC;oBAAS,CAAC;gBACT,IAAI,IAAI,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;oBAC3C,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;gBAC7B,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,oBAAoB,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YAChF,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC1E,IAAI,IAAI,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;oBAC3C,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;gBAC7B,CAAC;YACH,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;YACrC,KAAK,cAAc,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;QAED,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,UAAkB;QAC3C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC3D,MAAM,IAAI,GAA2B;YACnC,UAAU,EAAE,yBAAyB;YACrC,aAAa,EAAE,YAAY;YAC3B,kBAAkB,EAAE,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;YACvE,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;YACpD,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;SACjD,CAAC;QAEF,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACzB,IAAI,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC3C,CAAC;QAED,8FAA8F;QAC9F,MAAM,iBAAiB,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,IAAI,GAAQ,SAAS,CAAC;YAE1B,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,gCAAgC;YAClC,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAClF,MAAM,IAAI,kBAAU,CAAC,QAAQ,CAAC,MAAyB,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;YACnF,CAAC;YACD,MAAM,gBAAQ,CAAC,QAAQ,CACrB,QAAQ,CAAC,MAAM,EACf,IAAI,EACJ,qCAAqC,QAAQ,CAAC,MAAM,EAAE,EACtD,QAAQ,CAAC,OAAO,CACjB,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAY,MAAM,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QACvE,MAAM,WAAW,GACf,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,KAAK,IAAI,IAAI,cAAc,IAAI,aAAa;YAC5F,CAAC,CAAC,aAAa,CAAC,YAAY;YAC5B,CAAC,CAAC,SAAS,CAAC;QAChB,IACE,OAAO,WAAW,KAAK,QAAQ;YAC/B,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAC/B,mBAAmB,CAAC,WAAW,CAAC,EAChC,CAAC;YACD,MAAM,IAAI,mBAAW,CAAC,sDAAsD,CAAC,CAAC;QAChF,CAAC;QAED,MAAM,SAAS,GAAI,aAAgD,CAAC,UAAU,IAAI,IAAI,CAAC;QACvF,MAAM,SAAS,GAAG,kBAAkB,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;QAEnE,IAAI,IAAI,CAAC,eAAe,KAAK,UAAU,EAAE,CAAC;YACxC,IAAI,CAAC,WAAW,GAAG;gBACjB,KAAK,EAAE,WAAW;gBAClB,SAAS;gBACT,SAAS,EAAE,kBAAkB,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC;aACtF,CAAC;QACJ,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAEO,MAAM,CAAC,cAAc,CAAC,WAAwB;QACpD,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC,SAAS,CAAC;IAC7C,CAAC;IAEO,MAAM,CAAC,YAAY,CAAC,WAAwB;QAClD,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC,SAAS,CAAC;IAC7C,CAAC;IAED,sFAAsF;IACtF,eAAe;QACb,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;IAC7B,CAAC;CACF;AA7JD,oDA6JC"}

package/auth/workload-identity-auth.mjs

@@ -0,0 +1,242 @@
+import * as Shims from "../internal/shims.mjs";
+import { APIError, OAuthError, OpenAIError } from "../core/error.mjs";
+const SUBJECT_TOKEN_TYPES = {
+    jwt: 'urn:ietf:params:oauth:token-type:jwt',
+    id: 'urn:ietf:params:oauth:token-type:id_token',
+};
+const TOKEN_EXCHANGE_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:token-exchange';
+// Cap the refresh buffer at half the actual token lifetime, matching the X.509
+// workload-identity path, so short-lived tokens keep a usable cache window.
+const MAX_REFRESH_BUFFER_FRACTION = 0.5;
+function calculateExpiresAt(expiresIn, exchangeStartedAt) {
+    if (typeof expiresIn !== 'number' || !Number.isFinite(expiresIn) || expiresIn <= 0) {
+        throw new OpenAIError("Token exchange response has invalid 'expires_in' field");
+    }
+    const now = Date.now();
+    const fullLifetimeDeadline = now + expiresIn * 1000;
+    if (!Number.isSafeInteger(fullLifetimeDeadline) || fullLifetimeDeadline <= now) {
+        throw new OpenAIError("Token exchange response has invalid 'expires_in' field");
+    }
+    const expiresAt = fullLifetimeDeadline - (performance.now() - exchangeStartedAt);
+    if (expiresAt <= now) {
+        throw new OpenAIError('Workload identity token expired before its exchange completed.');
+    }
+    return expiresAt;
+}
+function calculateRefreshAt(expiresAt, lifetimeSeconds, refreshBufferSeconds) {
+    const configuredBufferMs = (refreshBufferSeconds ?? 1200) * 1000;
+    const effectiveBufferMs = Math.min(configuredBufferMs, lifetimeSeconds * 1000 * MAX_REFRESH_BUFFER_FRACTION);
+    return expiresAt - effectiveBufferMs;
+}
+const NATIVE_RESPONSE_PROTOTYPE = Response.prototype;
+const READ_NATIVE_RESPONSE_BODY = NATIVE_RESPONSE_PROTOTYPE.arrayBuffer;
+function isResponsePrototype(response, prototype) {
+    const constructor = Object.getOwnPropertyDescriptor(prototype, 'constructor')?.value;
+    if (prototype === response ||
+        typeof constructor !== 'function' ||
+        Object.getOwnPropertyDescriptor(constructor, 'name')?.value !== 'Response' ||
+        Object.getOwnPropertyDescriptor(constructor, 'prototype')?.value !== prototype) {
+        return false;
+    }
+    const tag = Object.getOwnPropertyDescriptor(prototype, Symbol.toStringTag);
+    return ((tag?.value === 'Response' || typeof tag?.get === 'function') &&
+        typeof Object.getOwnPropertyDescriptor(prototype, 'headers')?.get === 'function' &&
+        typeof Object.getOwnPropertyDescriptor(prototype, 'ok')?.get === 'function' &&
+        typeof Object.getOwnPropertyDescriptor(prototype, 'status')?.get === 'function');
+}
+function isResponseBodyPrototype(prototype, responsePrototype) {
+    if (prototype === responsePrototype) {
+        return true;
+    }
+    const constructor = Object.getOwnPropertyDescriptor(prototype, 'constructor')?.value;
+    return (responsePrototype !== null &&
+        Object.getPrototypeOf(responsePrototype) === prototype &&
+        typeof constructor === 'function' &&
+        Object.getOwnPropertyDescriptor(constructor, 'name')?.value === 'Body' &&
+        Object.getOwnPropertyDescriptor(constructor, 'prototype')?.value === prototype);
+}
+function decodeNativeResponseBody(body) {
+    const scope = globalThis;
+    return new TextDecoder('utf-8', { ignoreBOM: typeof scope.Bun?.version === 'string' }).decode(body);
+}
+async function parseOAuthTokenResponse(response) {
+    let readText;
+    let responsePrototype = null;
+    for (let depth = 0, prototype = response; prototype !== null && depth < 16; prototype = Object.getPrototypeOf(prototype), depth += 1) {
+        if (prototype === NATIVE_RESPONSE_PROTOTYPE) {
+            break;
+        }
+        if (isResponsePrototype(response, prototype)) {
+            responsePrototype = prototype;
+        }
+        const parser = Object.getOwnPropertyDescriptor(prototype, 'json');
+        if (!parser) {
+            continue;
+        }
+        if (typeof parser.value !== 'function') {
+            break;
+        }
+        const bodyReader = Object.getOwnPropertyDescriptor(prototype, 'text')?.value;
+        if (typeof bodyReader === 'function' && isResponseBodyPrototype(prototype, responsePrototype)) {
+            readText = bodyReader;
+            break;
+        }
+        // Custom parsers own their results and failures; rejection provenance cannot be inferred.
+        return parser.value.call(response);
+    }
+    const body = readText === undefined
+        ? decodeNativeResponseBody(await READ_NATIVE_RESPONSE_BODY.call(response))
+        : await readText.call(response);
+    try {
+        return JSON.parse(body);
+    }
+    catch {
+        throw new SyntaxError('Token exchange response contains invalid JSON');
+    }
+}
+function isUnsafeAccessToken(accessToken) {
+    const scope = globalThis;
+    if (typeof scope.Bun?.version === 'string') {
+        return /[^\t\u0020-\u007E]|^[\t ]|[\t ]$/u.test(accessToken);
+    }
+    return /[^\t\u0020-\u007E\u0080-\u00FF]|^[\t ]|[\t ]$/u.test(accessToken);
+}
+/**
+ * Exchanges external workload-identity tokens for cached OpenAI access tokens.
+ *
+ * Concurrent token exchanges are shared. Valid cached tokens are returned while
+ * a proactive refresh runs in the background; expired or missing tokens wait
+ * for a successful exchange before they are returned.
+ */
+export class WorkloadIdentityAuth {
+    /**
+     * Creates a workload-identity token cache and OAuth token-exchange client.
+     *
+     * @param config External identity provider, OpenAI service account, and refresh settings.
+     * @param fetch Optional fetch implementation for calls to the OpenAI token endpoint.
+     */
+    constructor(config, fetch) {
+        this.cachedToken = null;
+        this.refreshPromise = null;
+        this.tokenGeneration = 0;
+        this.tokenExchangeUrl = 'https://auth.openai.com/oauth/token';
+        const { identityProviderId, serviceAccountId, clientId, refreshBufferSeconds, provider } = config;
+        this.config = {
+            identityProviderId,
+            serviceAccountId,
+            ...(clientId === undefined ? {} : { clientId }),
+            ...(refreshBufferSeconds === undefined ? {} : { refreshBufferSeconds }),
+            provider: {
+                tokenType: provider.tokenType,
+                getToken: provider.getToken.bind(provider),
+            },
+        };
+        this.fetch = fetch ?? Shims.getDefaultFetch();
+    }
+    /**
+     * Returns a valid OpenAI access token, exchanging or refreshing credentials as needed.
+     *
+     * Cached tokens nearing expiration are returned immediately while a background
+     * refresh runs. Concurrent callers share the same in-flight token exchange.
+     *
+     * @throws {OAuthError} When the token endpoint rejects the subject token or identity.
+     * @throws {APIError} When another unsuccessful HTTP response prevents token exchange.
+     * @throws {OpenAIError} When a successful exchange has an invalid access token or expiration.
+     */
+    async getToken() {
+        if (!this.cachedToken || WorkloadIdentityAuth.isTokenExpired(this.cachedToken)) {
+            if (this.refreshPromise) {
+                return await this.refreshPromise;
+            }
+            const refreshPromise = this.refreshToken(this.tokenGeneration);
+            this.refreshPromise = refreshPromise;
+            try {
+                return await refreshPromise;
+            }
+            finally {
+                if (this.refreshPromise === refreshPromise) {
+                    this.refreshPromise = null;
+                }
+            }
+        }
+        if (WorkloadIdentityAuth.needsRefresh(this.cachedToken) && !this.refreshPromise) {
+            const refreshPromise = this.refreshToken(this.tokenGeneration).finally(() => {
+                if (this.refreshPromise === refreshPromise) {
+                    this.refreshPromise = null;
+                }
+            });
+            this.refreshPromise = refreshPromise;
+            void refreshPromise.catch(() => null);
+        }
+        return this.cachedToken.token;
+    }
+    async refreshToken(generation) {
+        const subjectToken = await this.config.provider.getToken();
+        const body = {
+            grant_type: TOKEN_EXCHANGE_GRANT_TYPE,
+            subject_token: subjectToken,
+            subject_token_type: SUBJECT_TOKEN_TYPES[this.config.provider.tokenType],
+            identity_provider_id: this.config.identityProviderId,
+            service_account_id: this.config.serviceAccountId,
+        };
+        if (this.config.clientId) {
+            body['client_id'] = this.config.clientId;
+        }
+        // Exclude provider acquisition and measure delivery time independently of wall-clock changes.
+        const exchangeStartedAt = performance.now();
+        const response = await this.fetch(this.tokenExchangeUrl, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify(body),
+            redirect: 'manual',
+        });
+        if (!response.ok) {
+            const errorText = await response.text();
+            let body = undefined;
+            try {
+                body = JSON.parse(errorText);
+            }
+            catch {
+                // Ignore non-JSON error bodies.
+            }
+            if (response.status === 400 || response.status === 401 || response.status === 403) {
+                throw new OAuthError(response.status, body, response.headers);
+            }
+            throw APIError.generate(response.status, body, `Token exchange failed with status ${response.status}`, response.headers);
+        }
+        const tokenResponse = await parseOAuthTokenResponse(response);
+        const accessToken = typeof tokenResponse === 'object' && tokenResponse !== null && 'access_token' in tokenResponse
+            ? tokenResponse.access_token
+            : undefined;
+        if (typeof accessToken !== 'string' ||
+            accessToken.trim().length === 0 ||
+            isUnsafeAccessToken(accessToken)) {
+            throw new OpenAIError("Token exchange response missing 'access_token' field");
+        }
+        const expiresIn = tokenResponse.expires_in ?? 3600;
+        const expiresAt = calculateExpiresAt(expiresIn, exchangeStartedAt);
+        if (this.tokenGeneration === generation) {
+            this.cachedToken = {
+                token: accessToken,
+                expiresAt,
+                refreshAt: calculateRefreshAt(expiresAt, expiresIn, this.config.refreshBufferSeconds),
+            };
+        }
+        return accessToken;
+    }
+    static isTokenExpired(cachedToken) {
+        return Date.now() >= cachedToken.expiresAt;
+    }
+    static needsRefresh(cachedToken) {
+        return Date.now() >= cachedToken.refreshAt;
+    }
+    /** Discards the cached access token so the next request performs a fresh exchange. */
+    invalidateToken() {
+        this.tokenGeneration += 1;
+        this.cachedToken = null;
+        this.refreshPromise = null;
+    }
+}
+//# sourceMappingURL=workload-identity-auth.mjs.map

package/auth/workload-identity-auth.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"workload-identity-auth.mjs","sourceRoot":"","sources":["../src/auth/workload-identity-auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,KAAK,8BAA0B;AAC3C,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,0BAAsB;AAQlE,MAAM,mBAAmB,GAA8D;IACrF,GAAG,EAAE,sCAAsC;IAC3C,EAAE,EAAE,2CAA2C;CAChD,CAAC;AAEF,MAAM,yBAAyB,GAAG,iDAAiD,CAAC;AACpF,+EAA+E;AAC/E,4EAA4E;AAC5E,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAExC,SAAS,kBAAkB,CAAC,SAAkB,EAAE,iBAAyB;IACvE,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACnF,MAAM,IAAI,WAAW,CAAC,wDAAwD,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,oBAAoB,GAAG,GAAG,GAAG,SAAS,GAAG,IAAI,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,oBAAoB,CAAC,IAAI,oBAAoB,IAAI,GAAG,EAAE,CAAC;QAC/E,MAAM,IAAI,WAAW,CAAC,wDAAwD,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,SAAS,GAAG,oBAAoB,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,iBAAiB,CAAC,CAAC;IACjF,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;QACrB,MAAM,IAAI,WAAW,CAAC,gEAAgE,CAAC,CAAC;IAC1F,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB,CACzB,SAAiB,EACjB,eAAuB,EACvB,oBAAwC;IAExC,MAAM,kBAAkB,GAAG,CAAC,oBAAoB,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC;IACjE,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAChC,kBAAkB,EAClB,eAAe,GAAG,IAAI,GAAG,2BAA2B,CACrD,CAAC;IACF,OAAO,SAAS,GAAG,iBAAiB,CAAC;AACvC,CAAC;AAED,MAAM,yBAAyB,GAAG,QAAQ,CAAC,SAAS,CAAC;AACrD,MAAM,yBAAyB,GAAG,yBAAyB,CAAC,WAAW,CAAC;AAExE,SAAS,mBAAmB,CAAC,QAAkB,EAAE,SAAiB;IAChE,MAAM,WAAW,GAAG,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,KAAK,CAAC;IACrF,IACE,SAAS,KAAK,QAAQ;QACtB,OAAO,WAAW,KAAK,UAAU;QACjC,MAAM,CAAC,wBAAwB,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,KAAK,KAAK,UAAU;QAC1E,MAAM,CAAC,wBAAwB,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,KAAK,KAAK,SAAS,EAC9E,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAC3E,OAAO,CACL,CAAC,GAAG,EAAE,KAAK,KAAK,UAAU,IAAI,OAAO,GAAG,EAAE,GAAG,KAAK,UAAU,CAAC;QAC7D,OAAO,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,GAAG,KAAK,UAAU;QAChF,OAAO,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,GAAG,KAAK,UAAU;QAC3E,OAAO,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,GAAG,KAAK,UAAU,CAChF,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,SAAiB,EAAE,iBAAgC;IAClF,IAAI,SAAS,KAAK,iBAAiB,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,KAAK,CAAC;IACrF,OAAO,CACL,iBAAiB,KAAK,IAAI;QAC1B,MAAM,CAAC,cAAc,CAAC,iBAAiB,CAAC,KAAK,SAAS;QACtD,OAAO,WAAW,KAAK,UAAU;QACjC,MAAM,CAAC,wBAAwB,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,KAAK,KAAK,MAAM;QACtE,MAAM,CAAC,wBAAwB,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,KAAK,KAAK,SAAS,CAC/E,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAiB;IACjD,MAAM,KAAK,GAAG,UAAiE,CAAC;IAChF,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,KAAK,CAAC,GAAG,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACtG,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,QAAkB;IACvD,IAAI,QAA2D,CAAC;IAChE,IAAI,iBAAiB,GAAkB,IAAI,CAAC;IAC5C,KACE,IAAI,KAAK,GAAG,CAAC,EAAE,SAAS,GAAkB,QAAQ,EAClD,SAAS,KAAK,IAAI,IAAI,KAAK,GAAG,EAAE,EAChC,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,KAAK,IAAI,CAAC,EACxD,CAAC;QACD,IAAI,SAAS,KAAK,yBAAyB,EAAE,CAAC;YAC5C,MAAM;QACR,CAAC;QAED,IAAI,mBAAmB,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;YAC7C,iBAAiB,GAAG,SAAS,CAAC;QAChC,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,SAAS;QACX,CAAC;QAED,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YACvC,MAAM;QACR,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC;QAC7E,IAAI,OAAO,UAAU,KAAK,UAAU,IAAI,uBAAuB,CAAC,SAAS,EAAE,iBAAiB,CAAC,EAAE,CAAC;YAC9F,QAAQ,GAAG,UAAU,CAAC;YACtB,MAAM;QACR,CAAC;QAED,0FAA0F;QAC1F,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,IAAI,GACR,QAAQ,KAAK,SAAS;QACpB,CAAC,CAAC,wBAAwB,CAAC,MAAM,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1E,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,CAAC,+CAA+C,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,WAAmB;IAC9C,MAAM,KAAK,GAAG,UAAiE,CAAC;IAChF,IAAI,OAAO,KAAK,CAAC,GAAG,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC3C,OAAO,mCAAmC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,gDAAgD,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,oBAAoB;IAQ/B;;;;;OAKG;IACH,YAAY,MAAwB,EAAE,KAAa;QAb3C,gBAAW,GAAuB,IAAI,CAAC;QACvC,mBAAc,GAA2B,IAAI,CAAC;QAC9C,oBAAe,GAAG,CAAC,CAAC;QAEX,qBAAgB,GAAW,qCAAqC,CAAC;QAUhF,MAAM,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,oBAAoB,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;QAClG,IAAI,CAAC,MAAM,GAAG;YACZ,kBAAkB;YAClB,gBAAgB;YAChB,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;YAC/C,GAAG,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC;YACvE,QAAQ,EAAE;gBACR,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;aAC3C;SACF,CAAC;QACF,IAAI,CAAC,KAAK,GAAG,KAAK,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;IAChD,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,oBAAoB,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/E,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;gBACxB,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC;YACnC,CAAC;YAED,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC/D,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;YAErC,IAAI,CAAC;gBACH,OAAO,MAAM,cAAc,CAAC;YAC9B,CAAC;oBAAS,CAAC;gBACT,IAAI,IAAI,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;oBAC3C,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;gBAC7B,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,oBAAoB,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YAChF,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC1E,IAAI,IAAI,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;oBAC3C,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;gBAC7B,CAAC;YACH,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;YACrC,KAAK,cAAc,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;QAED,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,UAAkB;QAC3C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC3D,MAAM,IAAI,GAA2B;YACnC,UAAU,EAAE,yBAAyB;YACrC,aAAa,EAAE,YAAY;YAC3B,kBAAkB,EAAE,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;YACvE,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;YACpD,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;SACjD,CAAC;QAEF,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACzB,IAAI,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC3C,CAAC;QAED,8FAA8F;QAC9F,MAAM,iBAAiB,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,IAAI,GAAQ,SAAS,CAAC;YAE1B,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,gCAAgC;YAClC,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAClF,MAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAyB,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;YACnF,CAAC;YACD,MAAM,QAAQ,CAAC,QAAQ,CACrB,QAAQ,CAAC,MAAM,EACf,IAAI,EACJ,qCAAqC,QAAQ,CAAC,MAAM,EAAE,EACtD,QAAQ,CAAC,OAAO,CACjB,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAY,MAAM,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QACvE,MAAM,WAAW,GACf,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,KAAK,IAAI,IAAI,cAAc,IAAI,aAAa;YAC5F,CAAC,CAAC,aAAa,CAAC,YAAY;YAC5B,CAAC,CAAC,SAAS,CAAC;QAChB,IACE,OAAO,WAAW,KAAK,QAAQ;YAC/B,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAC/B,mBAAmB,CAAC,WAAW,CAAC,EAChC,CAAC;YACD,MAAM,IAAI,WAAW,CAAC,sDAAsD,CAAC,CAAC;QAChF,CAAC;QAED,MAAM,SAAS,GAAI,aAAgD,CAAC,UAAU,IAAI,IAAI,CAAC;QACvF,MAAM,SAAS,GAAG,kBAAkB,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;QAEnE,IAAI,IAAI,CAAC,eAAe,KAAK,UAAU,EAAE,CAAC;YACxC,IAAI,CAAC,WAAW,GAAG;gBACjB,KAAK,EAAE,WAAW;gBAClB,SAAS;gBACT,SAAS,EAAE,kBAAkB,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC;aACtF,CAAC;QACJ,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAEO,MAAM,CAAC,cAAc,CAAC,WAAwB;QACpD,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC,SAAS,CAAC;IAC7C,CAAC;IAEO,MAAM,CAAC,YAAY,CAAC,WAAwB;QAClD,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC,SAAS,CAAC;IAC7C,CAAC;IAED,sFAAsF;IACtF,eAAe;QACb,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;IAC7B,CAAC;CACF"}

package/auth/x509-transport.d.mts

@@ -0,0 +1,40 @@
+import type { X509ProxyMode, X509Transport, X509TransportOptions } from "../internal/auth/x509-transport-capability.mjs";
+import type { X509Credential } from "./types.mjs";
+/** Explicit, separately trusted CONNECT configuration for an SDK-owned X.509 credential. */
+export interface X509CredentialProxyOptions {
+    /** CONNECT proxy endpoint; its protocol must match the selected mode. */
+    url: string | URL;
+    /** Whether the connection to the CONNECT proxy itself is encrypted. */
+    mode: Exclude<X509ProxyMode, 'direct'>;
+    /** Optional private trust roots for the HTTPS proxy; never used for workload TLS. */
+    ca?: string | string[] | undefined;
+}
+/** Private certificate material and enrolled selectors for one SDK-owned workload credential. */
+export interface X509CredentialOptions {
+    /** Leaf client certificate followed by its required PEM intermediate chain. */
+    certificateChain: string;
+    /** PEM private key matching the leaf client certificate. */
+    privateKey: string;
+    /** Existing OpenAI identity-provider resource enrolled for the certificate. */
+    identityProviderId: string;
+    /** OpenAI service account authorized for the verified certificate identity. */
+    serviceAccountId: string;
+    /** Optional private certificate authorities trusted for OpenAI's issuer and API. */
+    ca?: string | string[] | undefined;
+    /** Optional passphrase used to decrypt an encrypted PEM private key. */
+    passphrase?: string | undefined;
+    /** Optional CONNECT proxy with separately scoped target and proxy TLS settings. */
+    proxy?: X509CredentialProxyOptions | undefined;
+    /** Seconds before expiration when access-token refresh begins; defaults to 1,200. */
+    refreshBufferSeconds?: number | undefined;
+}
+/** Creates one frozen, caller-attested Node.js transport for X.509 workload authentication. */
+export declare function createX509Transport(options: X509TransportOptions): X509Transport;
+/** Creates a first-class certificate credential with SDK-owned, verified TLS and CONNECT policy. */
+export declare function fromX509(options: X509CredentialOptions): X509Credential;
+/** Namespaced first-class credential factory, isolated from ordinary browser-safe auth imports. */
+export declare const workloadIdentity: Readonly<{
+    fromX509: typeof fromX509;
+}>;
+export type { X509ProxyMode, X509Transport, X509TransportOptions, } from "../internal/auth/x509-transport-capability.mjs";
+//# sourceMappingURL=x509-transport.d.mts.map

package/auth/x509-transport.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"x509-transport.d.mts","sourceRoot":"","sources":["../src/auth/x509-transport.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,aAAa,EACb,aAAa,EACb,oBAAoB,EACrB,uDAAmD;AAKpD,OAAO,KAAK,EAAE,cAAc,EAAwB,oBAAgB;AAEpE,4FAA4F;AAC5F,MAAM,WAAW,0BAA0B;IACzC,yEAAyE;IACzE,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;IAElB,uEAAuE;IACvE,IAAI,EAAE,OAAO,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAEvC,qFAAqF;IACrF,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;CACpC;AAED,iGAAiG;AACjG,MAAM,WAAW,qBAAqB;IACpC,+EAA+E;IAC/E,gBAAgB,EAAE,MAAM,CAAC;IAEzB,4DAA4D;IAC5D,UAAU,EAAE,MAAM,CAAC;IAEnB,+EAA+E;IAC/E,kBAAkB,EAAE,MAAM,CAAC;IAE3B,+EAA+E;IAC/E,gBAAgB,EAAE,MAAM,CAAC;IAEzB,oFAAoF;IACpF,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;IAEnC,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEhC,mFAAmF;IACnF,KAAK,CAAC,EAAE,0BAA0B,GAAG,SAAS,CAAC;IAE/C,qFAAqF;IACrF,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAgOD,+FAA+F;AAC/F,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,GAAG,aAAa,CA4BhF;AAED,oGAAoG;AACpG,wBAAgB,QAAQ,CAAC,OAAO,EAAE,qBAAqB,GAAG,cAAc,CAkCvE;AAED,mGAAmG;AACnG,eAAO,MAAM,gBAAgB;;EAA8B,CAAC;AAE5D,YAAY,EACV,aAAa,EACb,aAAa,EACb,oBAAoB,GACrB,uDAAmD"}

package/auth/x509-transport.d.ts

@@ -0,0 +1,40 @@
+import type { X509ProxyMode, X509Transport, X509TransportOptions } from "../internal/auth/x509-transport-capability.js";
+import type { X509Credential } from "./types.js";
+/** Explicit, separately trusted CONNECT configuration for an SDK-owned X.509 credential. */
+export interface X509CredentialProxyOptions {
+    /** CONNECT proxy endpoint; its protocol must match the selected mode. */
+    url: string | URL;
+    /** Whether the connection to the CONNECT proxy itself is encrypted. */
+    mode: Exclude<X509ProxyMode, 'direct'>;
+    /** Optional private trust roots for the HTTPS proxy; never used for workload TLS. */
+    ca?: string | string[] | undefined;
+}
+/** Private certificate material and enrolled selectors for one SDK-owned workload credential. */
+export interface X509CredentialOptions {
+    /** Leaf client certificate followed by its required PEM intermediate chain. */
+    certificateChain: string;
+    /** PEM private key matching the leaf client certificate. */
+    privateKey: string;
+    /** Existing OpenAI identity-provider resource enrolled for the certificate. */
+    identityProviderId: string;
+    /** OpenAI service account authorized for the verified certificate identity. */
+    serviceAccountId: string;
+    /** Optional private certificate authorities trusted for OpenAI's issuer and API. */
+    ca?: string | string[] | undefined;
+    /** Optional passphrase used to decrypt an encrypted PEM private key. */
+    passphrase?: string | undefined;
+    /** Optional CONNECT proxy with separately scoped target and proxy TLS settings. */
+    proxy?: X509CredentialProxyOptions | undefined;
+    /** Seconds before expiration when access-token refresh begins; defaults to 1,200. */
+    refreshBufferSeconds?: number | undefined;
+}
+/** Creates one frozen, caller-attested Node.js transport for X.509 workload authentication. */
+export declare function createX509Transport(options: X509TransportOptions): X509Transport;
+/** Creates a first-class certificate credential with SDK-owned, verified TLS and CONNECT policy. */
+export declare function fromX509(options: X509CredentialOptions): X509Credential;
+/** Namespaced first-class credential factory, isolated from ordinary browser-safe auth imports. */
+export declare const workloadIdentity: Readonly<{
+    fromX509: typeof fromX509;
+}>;
+export type { X509ProxyMode, X509Transport, X509TransportOptions, } from "../internal/auth/x509-transport-capability.js";
+//# sourceMappingURL=x509-transport.d.ts.map

package/auth/x509-transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"x509-transport.d.ts","sourceRoot":"","sources":["../src/auth/x509-transport.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,aAAa,EACb,aAAa,EACb,oBAAoB,EACrB,sDAAmD;AAKpD,OAAO,KAAK,EAAE,cAAc,EAAwB,mBAAgB;AAEpE,4FAA4F;AAC5F,MAAM,WAAW,0BAA0B;IACzC,yEAAyE;IACzE,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;IAElB,uEAAuE;IACvE,IAAI,EAAE,OAAO,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAEvC,qFAAqF;IACrF,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;CACpC;AAED,iGAAiG;AACjG,MAAM,WAAW,qBAAqB;IACpC,+EAA+E;IAC/E,gBAAgB,EAAE,MAAM,CAAC;IAEzB,4DAA4D;IAC5D,UAAU,EAAE,MAAM,CAAC;IAEnB,+EAA+E;IAC/E,kBAAkB,EAAE,MAAM,CAAC;IAE3B,+EAA+E;IAC/E,gBAAgB,EAAE,MAAM,CAAC;IAEzB,oFAAoF;IACpF,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;IAEnC,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEhC,mFAAmF;IACnF,KAAK,CAAC,EAAE,0BAA0B,GAAG,SAAS,CAAC;IAE/C,qFAAqF;IACrF,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAgOD,+FAA+F;AAC/F,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,GAAG,aAAa,CA4BhF;AAED,oGAAoG;AACpG,wBAAgB,QAAQ,CAAC,OAAO,EAAE,qBAAqB,GAAG,cAAc,CAkCvE;AAED,mGAAmG;AACnG,eAAO,MAAM,gBAAgB;;EAA8B,CAAC;AAE5D,YAAY,EACV,aAAa,EACb,aAAa,EACb,oBAAoB,GACrB,sDAAmD"}