@rebyteai/agent-sdk 0.2.0

package/internal/auth/x509-transport-state-browser.d.mts

@@ -0,0 +1,25 @@
+/** Looks up an opaque capability without exposing the registry itself. */
+export declare const findRegisteredX509Transport: (key: object) => any;
+/** Records a capability only after its Node-only factory validates the private dispatcher. */
+export declare const rememberRegisteredX509Transport: (key: object, value: any) => WeakMap<object, any>;
+/** Privately classifies sanitized issuer errors without exposing transport details. */
+export declare const markTransientX509ConnectionError: (value: object) => WeakSet<object>;
+/** Checks the private transient classification without retaining caller-owned errors. */
+export declare const isTransientX509ConnectionError: (value: object) => boolean;
+/** Privately brands retryable issuer failures without exposing classification state. */
+export declare const markRetryableX509IssuerError: (value: object) => WeakSet<object>;
+/** Recognizes trusted issuer failures without evaluating caller-controlled properties. */
+export declare const isRetryableX509IssuerError: (value: object) => boolean;
+/** Brands validated clients without exposing their mutable options or authentication fields. */
+export declare const markApprovedX509Client: (value: object) => WeakSet<object>;
+/** Recognizes private client ownership without caller-visible markers. */
+export declare const isApprovedX509Client: (value: object) => boolean;
+/** Stores trusted OAuth metadata without exposing it to unrelated callers. */
+export declare const rememberX509OAuthError: (key: object, value: any) => WeakMap<object, any>;
+/** Retrieves trusted metadata when public OAuth errors cross module formats. */
+export declare const findX509OAuthError: (key: object) => any;
+/** Privately binds SDK-owned credentials without importing Node or optional transport peers. */
+export declare const rememberX509Credential: (key: object, value: any) => WeakMap<object, any>;
+/** Resolves only credentials registered by the optional Node authentication helper. */
+export declare const findX509Credential: (key: object) => any;
+//# sourceMappingURL=x509-transport-state-browser.d.mts.map

package/internal/auth/x509-transport-state-browser.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"x509-transport-state-browser.d.mts","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-state-browser.ts"],"names":[],"mappings":"AAQA,0EAA0E;AAC1E,eAAO,MAAM,2BAA2B,sBAAuD,CAAC;AAEhG,8FAA8F;AAC9F,eAAO,MAAM,+BAA+B,mDAAuD,CAAC;AAEpG,uFAAuF;AACvF,eAAO,MAAM,gCAAgC,oCAA4D,CAAC;AAE1G,yFAAyF;AACzF,eAAO,MAAM,8BAA8B,4BAA4D,CAAC;AAExG,wFAAwF;AACxF,eAAO,MAAM,4BAA4B,oCAAwD,CAAC;AAElG,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B,4BAAwD,CAAC;AAEhG,gGAAgG;AAChG,eAAO,MAAM,sBAAsB,oCAAkD,CAAC;AAEtF,0EAA0E;AAC1E,eAAO,MAAM,oBAAoB,4BAAkD,CAAC;AAEpF,8EAA8E;AAC9E,eAAO,MAAM,sBAAsB,mDAAsD,CAAC;AAE1F,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,sBAAsD,CAAC;AAEtF,gGAAgG;AAChG,eAAO,MAAM,sBAAsB,mDAAsD,CAAC;AAE1F,uFAAuF;AACvF,eAAO,MAAM,kBAAkB,sBAAsD,CAAC"}

package/internal/auth/x509-transport-state-browser.d.ts

@@ -0,0 +1,25 @@
+/** Looks up an opaque capability without exposing the registry itself. */
+export declare const findRegisteredX509Transport: (key: object) => any;
+/** Records a capability only after its Node-only factory validates the private dispatcher. */
+export declare const rememberRegisteredX509Transport: (key: object, value: any) => WeakMap<object, any>;
+/** Privately classifies sanitized issuer errors without exposing transport details. */
+export declare const markTransientX509ConnectionError: (value: object) => WeakSet<object>;
+/** Checks the private transient classification without retaining caller-owned errors. */
+export declare const isTransientX509ConnectionError: (value: object) => boolean;
+/** Privately brands retryable issuer failures without exposing classification state. */
+export declare const markRetryableX509IssuerError: (value: object) => WeakSet<object>;
+/** Recognizes trusted issuer failures without evaluating caller-controlled properties. */
+export declare const isRetryableX509IssuerError: (value: object) => boolean;
+/** Brands validated clients without exposing their mutable options or authentication fields. */
+export declare const markApprovedX509Client: (value: object) => WeakSet<object>;
+/** Recognizes private client ownership without caller-visible markers. */
+export declare const isApprovedX509Client: (value: object) => boolean;
+/** Stores trusted OAuth metadata without exposing it to unrelated callers. */
+export declare const rememberX509OAuthError: (key: object, value: any) => WeakMap<object, any>;
+/** Retrieves trusted metadata when public OAuth errors cross module formats. */
+export declare const findX509OAuthError: (key: object) => any;
+/** Privately binds SDK-owned credentials without importing Node or optional transport peers. */
+export declare const rememberX509Credential: (key: object, value: any) => WeakMap<object, any>;
+/** Resolves only credentials registered by the optional Node authentication helper. */
+export declare const findX509Credential: (key: object) => any;
+//# sourceMappingURL=x509-transport-state-browser.d.ts.map

package/internal/auth/x509-transport-state-browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"x509-transport-state-browser.d.ts","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-state-browser.ts"],"names":[],"mappings":"AAQA,0EAA0E;AAC1E,eAAO,MAAM,2BAA2B,sBAAuD,CAAC;AAEhG,8FAA8F;AAC9F,eAAO,MAAM,+BAA+B,mDAAuD,CAAC;AAEpG,uFAAuF;AACvF,eAAO,MAAM,gCAAgC,oCAA4D,CAAC;AAE1G,yFAAyF;AACzF,eAAO,MAAM,8BAA8B,4BAA4D,CAAC;AAExG,wFAAwF;AACxF,eAAO,MAAM,4BAA4B,oCAAwD,CAAC;AAElG,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B,4BAAwD,CAAC;AAEhG,gGAAgG;AAChG,eAAO,MAAM,sBAAsB,oCAAkD,CAAC;AAEtF,0EAA0E;AAC1E,eAAO,MAAM,oBAAoB,4BAAkD,CAAC;AAEpF,8EAA8E;AAC9E,eAAO,MAAM,sBAAsB,mDAAsD,CAAC;AAE1F,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,sBAAsD,CAAC;AAEtF,gGAAgG;AAChG,eAAO,MAAM,sBAAsB,mDAAsD,CAAC;AAE1F,uFAAuF;AACvF,eAAO,MAAM,kBAAkB,sBAAsD,CAAC"}

package/internal/auth/x509-transport-state-browser.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findX509Credential = exports.rememberX509Credential = exports.findX509OAuthError = exports.rememberX509OAuthError = exports.isApprovedX509Client = exports.markApprovedX509Client = exports.isRetryableX509IssuerError = exports.markRetryableX509IssuerError = exports.isTransientX509ConnectionError = exports.markTransientX509ConnectionError = exports.rememberRegisteredX509Transport = exports.findRegisteredX509Transport = void 0;
+/** Browser-safe capability state keeps CommonJS outside the ordinary SDK ESM graph. */
+const registeredX509Transports = new WeakMap();
+const transientX509ConnectionErrors = new WeakSet();
+const retryableX509IssuerErrors = new WeakSet();
+const approvedX509Clients = new WeakSet();
+const approvedX509OAuthErrors = new WeakMap();
+const approvedX509Credentials = new WeakMap();
+/** Looks up an opaque capability without exposing the registry itself. */
+exports.findRegisteredX509Transport = WeakMap.prototype.get.bind(registeredX509Transports);
+/** Records a capability only after its Node-only factory validates the private dispatcher. */
+exports.rememberRegisteredX509Transport = WeakMap.prototype.set.bind(registeredX509Transports);
+/** Privately classifies sanitized issuer errors without exposing transport details. */
+exports.markTransientX509ConnectionError = WeakSet.prototype.add.bind(transientX509ConnectionErrors);
+/** Checks the private transient classification without retaining caller-owned errors. */
+exports.isTransientX509ConnectionError = WeakSet.prototype.has.bind(transientX509ConnectionErrors);
+/** Privately brands retryable issuer failures without exposing classification state. */
+exports.markRetryableX509IssuerError = WeakSet.prototype.add.bind(retryableX509IssuerErrors);
+/** Recognizes trusted issuer failures without evaluating caller-controlled properties. */
+exports.isRetryableX509IssuerError = WeakSet.prototype.has.bind(retryableX509IssuerErrors);
+/** Brands validated clients without exposing their mutable options or authentication fields. */
+exports.markApprovedX509Client = WeakSet.prototype.add.bind(approvedX509Clients);
+/** Recognizes private client ownership without caller-visible markers. */
+exports.isApprovedX509Client = WeakSet.prototype.has.bind(approvedX509Clients);
+/** Stores trusted OAuth metadata without exposing it to unrelated callers. */
+exports.rememberX509OAuthError = WeakMap.prototype.set.bind(approvedX509OAuthErrors);
+/** Retrieves trusted metadata when public OAuth errors cross module formats. */
+exports.findX509OAuthError = WeakMap.prototype.get.bind(approvedX509OAuthErrors);
+/** Privately binds SDK-owned credentials without importing Node or optional transport peers. */
+exports.rememberX509Credential = WeakMap.prototype.set.bind(approvedX509Credentials);
+/** Resolves only credentials registered by the optional Node authentication helper. */
+exports.findX509Credential = WeakMap.prototype.get.bind(approvedX509Credentials);
+//# sourceMappingURL=x509-transport-state-browser.js.map

package/internal/auth/x509-transport-state-browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"x509-transport-state-browser.js","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-state-browser.ts"],"names":[],"mappings":";;;AAAA,uFAAuF;AACvF,MAAM,wBAAwB,GAAG,IAAI,OAAO,EAAE,CAAC;AAC/C,MAAM,6BAA6B,GAAG,IAAI,OAAO,EAAE,CAAC;AACpD,MAAM,yBAAyB,GAAG,IAAI,OAAO,EAAE,CAAC;AAChD,MAAM,mBAAmB,GAAG,IAAI,OAAO,EAAE,CAAC;AAC1C,MAAM,uBAAuB,GAAG,IAAI,OAAO,EAAE,CAAC;AAC9C,MAAM,uBAAuB,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9C,0EAA0E;AAC7D,QAAA,2BAA2B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;AAEhG,8FAA8F;AACjF,QAAA,+BAA+B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;AAEpG,uFAAuF;AAC1E,QAAA,gCAAgC,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;AAE1G,yFAAyF;AAC5E,QAAA,8BAA8B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;AAExG,wFAAwF;AAC3E,QAAA,4BAA4B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;AAElG,0FAA0F;AAC7E,QAAA,0BAA0B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;AAEhG,gGAAgG;AACnF,QAAA,sBAAsB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;AAEtF,0EAA0E;AAC7D,QAAA,oBAAoB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;AAEpF,8EAA8E;AACjE,QAAA,sBAAsB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;AAE1F,gFAAgF;AACnE,QAAA,kBAAkB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;AAEtF,gGAAgG;AACnF,QAAA,sBAAsB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;AAE1F,uFAAuF;AAC1E,QAAA,kBAAkB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC"}

package/internal/auth/x509-transport-state-browser.mjs

@@ -0,0 +1,32 @@
+/** Browser-safe capability state keeps CommonJS outside the ordinary SDK ESM graph. */
+const registeredX509Transports = new WeakMap();
+const transientX509ConnectionErrors = new WeakSet();
+const retryableX509IssuerErrors = new WeakSet();
+const approvedX509Clients = new WeakSet();
+const approvedX509OAuthErrors = new WeakMap();
+const approvedX509Credentials = new WeakMap();
+/** Looks up an opaque capability without exposing the registry itself. */
+export const findRegisteredX509Transport = WeakMap.prototype.get.bind(registeredX509Transports);
+/** Records a capability only after its Node-only factory validates the private dispatcher. */
+export const rememberRegisteredX509Transport = WeakMap.prototype.set.bind(registeredX509Transports);
+/** Privately classifies sanitized issuer errors without exposing transport details. */
+export const markTransientX509ConnectionError = WeakSet.prototype.add.bind(transientX509ConnectionErrors);
+/** Checks the private transient classification without retaining caller-owned errors. */
+export const isTransientX509ConnectionError = WeakSet.prototype.has.bind(transientX509ConnectionErrors);
+/** Privately brands retryable issuer failures without exposing classification state. */
+export const markRetryableX509IssuerError = WeakSet.prototype.add.bind(retryableX509IssuerErrors);
+/** Recognizes trusted issuer failures without evaluating caller-controlled properties. */
+export const isRetryableX509IssuerError = WeakSet.prototype.has.bind(retryableX509IssuerErrors);
+/** Brands validated clients without exposing their mutable options or authentication fields. */
+export const markApprovedX509Client = WeakSet.prototype.add.bind(approvedX509Clients);
+/** Recognizes private client ownership without caller-visible markers. */
+export const isApprovedX509Client = WeakSet.prototype.has.bind(approvedX509Clients);
+/** Stores trusted OAuth metadata without exposing it to unrelated callers. */
+export const rememberX509OAuthError = WeakMap.prototype.set.bind(approvedX509OAuthErrors);
+/** Retrieves trusted metadata when public OAuth errors cross module formats. */
+export const findX509OAuthError = WeakMap.prototype.get.bind(approvedX509OAuthErrors);
+/** Privately binds SDK-owned credentials without importing Node or optional transport peers. */
+export const rememberX509Credential = WeakMap.prototype.set.bind(approvedX509Credentials);
+/** Resolves only credentials registered by the optional Node authentication helper. */
+export const findX509Credential = WeakMap.prototype.get.bind(approvedX509Credentials);
+//# sourceMappingURL=x509-transport-state-browser.mjs.map

package/internal/auth/x509-transport-state-browser.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"x509-transport-state-browser.mjs","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-state-browser.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,MAAM,wBAAwB,GAAG,IAAI,OAAO,EAAE,CAAC;AAC/C,MAAM,6BAA6B,GAAG,IAAI,OAAO,EAAE,CAAC;AACpD,MAAM,yBAAyB,GAAG,IAAI,OAAO,EAAE,CAAC;AAChD,MAAM,mBAAmB,GAAG,IAAI,OAAO,EAAE,CAAC;AAC1C,MAAM,uBAAuB,GAAG,IAAI,OAAO,EAAE,CAAC;AAC9C,MAAM,uBAAuB,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9C,0EAA0E;AAC1E,MAAM,CAAC,MAAM,2BAA2B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;AAEhG,8FAA8F;AAC9F,MAAM,CAAC,MAAM,+BAA+B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;AAEpG,uFAAuF;AACvF,MAAM,CAAC,MAAM,gCAAgC,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;AAE1G,yFAAyF;AACzF,MAAM,CAAC,MAAM,8BAA8B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;AAExG,wFAAwF;AACxF,MAAM,CAAC,MAAM,4BAA4B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;AAElG,0FAA0F;AAC1F,MAAM,CAAC,MAAM,0BAA0B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;AAEhG,gGAAgG;AAChG,MAAM,CAAC,MAAM,sBAAsB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;AAEtF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,oBAAoB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;AAEpF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,sBAAsB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;AAE1F,gFAAgF;AAChF,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;AAEtF,gGAAgG;AAChG,MAAM,CAAC,MAAM,sBAAsB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;AAE1F,uFAAuF;AACvF,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC"}

package/internal/auth/x509-transport-state.cjs

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findX509Credential = exports.rememberX509Credential = exports.findX509OAuthError = exports.rememberX509OAuthError = exports.isApprovedX509Client = exports.markApprovedX509Client = exports.isRetryableX509IssuerError = exports.markRetryableX509IssuerError = exports.isTransientX509ConnectionError = exports.markTransientX509ConnectionError = exports.rememberRegisteredX509Transport = exports.findRegisteredX509Transport = void 0;
+/** One lexical capability registry remains authoritative across mixed module formats. */
+const registeredX509Transports = new WeakMap();
+const transientX509ConnectionErrors = new WeakSet();
+const retryableX509IssuerErrors = new WeakSet();
+const approvedX509Clients = new WeakSet();
+const approvedX509OAuthErrors = new WeakMap();
+const approvedX509Credentials = new WeakMap();
+/** Looks up an opaque capability without exposing the registry itself. */
+exports.findRegisteredX509Transport = WeakMap.prototype.get.bind(registeredX509Transports);
+/** Records a capability only after the Node-only factory verifies its genuine private dispatcher. */
+exports.rememberRegisteredX509Transport = WeakMap.prototype.set.bind(registeredX509Transports);
+/** Privately brands sanitized connection errors shared across CommonJS and ESM clients. */
+exports.markTransientX509ConnectionError = WeakSet.prototype.add.bind(transientX509ConnectionErrors);
+/** Recognizes a transient connection without trusting public error properties. */
+exports.isTransientX509ConnectionError = WeakSet.prototype.has.bind(transientX509ConnectionErrors);
+/** Privately brands issuer-generated retryable HTTP failures across module formats. */
+exports.markRetryableX509IssuerError = WeakSet.prototype.add.bind(retryableX509IssuerErrors);
+/** Recognizes only retryable HTTP errors produced by the trusted certificate exchange. */
+exports.isRetryableX509IssuerError = WeakSet.prototype.has.bind(retryableX509IssuerErrors);
+/** Brands only clients whose transport capability was successfully validated. */
+exports.markApprovedX509Client = WeakSet.prototype.add.bind(approvedX509Clients);
+/** Recognizes immutable client ownership across mixed CommonJS and ESM helpers. */
+exports.isApprovedX509Client = WeakSet.prototype.has.bind(approvedX509Clients);
+/** Records the sanitized OAuth response without trusting mutable public error properties. */
+exports.rememberX509OAuthError = WeakMap.prototype.set.bind(approvedX509OAuthErrors);
+/** Retrieves trusted OAuth metadata for public cross-module error normalization. */
+exports.findX509OAuthError = WeakMap.prototype.get.bind(approvedX509OAuthErrors);
+/** Privately binds SDK-owned credentials to their immutable identity and approved transport. */
+exports.rememberX509Credential = WeakMap.prototype.set.bind(approvedX509Credentials);
+/** Resolves only first-class credentials created by the optional Node transport helper. */
+exports.findX509Credential = WeakMap.prototype.get.bind(approvedX509Credentials);
+//# sourceMappingURL=x509-transport-state.cjs.map

package/internal/auth/x509-transport-state.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"x509-transport-state.cjs","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-state.cts"],"names":[],"mappings":";;;AAAA,yFAAyF;AACzF,MAAM,wBAAwB,GAAG,IAAI,OAAO,EAAE,CAAC;AAC/C,MAAM,6BAA6B,GAAG,IAAI,OAAO,EAAE,CAAC;AACpD,MAAM,yBAAyB,GAAG,IAAI,OAAO,EAAE,CAAC;AAChD,MAAM,mBAAmB,GAAG,IAAI,OAAO,EAAE,CAAC;AAC1C,MAAM,uBAAuB,GAAG,IAAI,OAAO,EAAE,CAAC;AAC9C,MAAM,uBAAuB,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9C,0EAA0E;AAC7D,QAAA,2BAA2B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;AAEhG,qGAAqG;AACxF,QAAA,+BAA+B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;AAEpG,2FAA2F;AAC9E,QAAA,gCAAgC,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;AAE1G,kFAAkF;AACrE,QAAA,8BAA8B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;AAExG,uFAAuF;AAC1E,QAAA,4BAA4B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;AAElG,0FAA0F;AAC7E,QAAA,0BAA0B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;AAEhG,iFAAiF;AACpE,QAAA,sBAAsB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;AAEtF,mFAAmF;AACtE,QAAA,oBAAoB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;AAEpF,6FAA6F;AAChF,QAAA,sBAAsB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;AAE1F,oFAAoF;AACvE,QAAA,kBAAkB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;AAEtF,gGAAgG;AACnF,QAAA,sBAAsB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;AAE1F,2FAA2F;AAC9E,QAAA,kBAAkB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC"}

package/internal/auth/x509-transport-state.d.cts

@@ -0,0 +1,25 @@
+/** Looks up an opaque capability without exposing the registry itself. */
+export declare const findRegisteredX509Transport: (key: object) => any;
+/** Records a capability only after the Node-only factory verifies its genuine private dispatcher. */
+export declare const rememberRegisteredX509Transport: (key: object, value: any) => WeakMap<object, any>;
+/** Privately brands sanitized connection errors shared across CommonJS and ESM clients. */
+export declare const markTransientX509ConnectionError: (value: object) => WeakSet<object>;
+/** Recognizes a transient connection without trusting public error properties. */
+export declare const isTransientX509ConnectionError: (value: object) => boolean;
+/** Privately brands issuer-generated retryable HTTP failures across module formats. */
+export declare const markRetryableX509IssuerError: (value: object) => WeakSet<object>;
+/** Recognizes only retryable HTTP errors produced by the trusted certificate exchange. */
+export declare const isRetryableX509IssuerError: (value: object) => boolean;
+/** Brands only clients whose transport capability was successfully validated. */
+export declare const markApprovedX509Client: (value: object) => WeakSet<object>;
+/** Recognizes immutable client ownership across mixed CommonJS and ESM helpers. */
+export declare const isApprovedX509Client: (value: object) => boolean;
+/** Records the sanitized OAuth response without trusting mutable public error properties. */
+export declare const rememberX509OAuthError: (key: object, value: any) => WeakMap<object, any>;
+/** Retrieves trusted OAuth metadata for public cross-module error normalization. */
+export declare const findX509OAuthError: (key: object) => any;
+/** Privately binds SDK-owned credentials to their immutable identity and approved transport. */
+export declare const rememberX509Credential: (key: object, value: any) => WeakMap<object, any>;
+/** Resolves only first-class credentials created by the optional Node transport helper. */
+export declare const findX509Credential: (key: object) => any;
+//# sourceMappingURL=x509-transport-state.d.cts.map

package/internal/auth/x509-transport-state.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"x509-transport-state.d.cts","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-state.cts"],"names":[],"mappings":"AAQA,0EAA0E;AAC1E,eAAO,MAAM,2BAA2B,sBAAuD,CAAC;AAEhG,qGAAqG;AACrG,eAAO,MAAM,+BAA+B,mDAAuD,CAAC;AAEpG,2FAA2F;AAC3F,eAAO,MAAM,gCAAgC,oCAA4D,CAAC;AAE1G,kFAAkF;AAClF,eAAO,MAAM,8BAA8B,4BAA4D,CAAC;AAExG,uFAAuF;AACvF,eAAO,MAAM,4BAA4B,oCAAwD,CAAC;AAElG,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B,4BAAwD,CAAC;AAEhG,iFAAiF;AACjF,eAAO,MAAM,sBAAsB,oCAAkD,CAAC;AAEtF,mFAAmF;AACnF,eAAO,MAAM,oBAAoB,4BAAkD,CAAC;AAEpF,6FAA6F;AAC7F,eAAO,MAAM,sBAAsB,mDAAsD,CAAC;AAE1F,oFAAoF;AACpF,eAAO,MAAM,kBAAkB,sBAAsD,CAAC;AAEtF,gGAAgG;AAChG,eAAO,MAAM,sBAAsB,mDAAsD,CAAC;AAE1F,2FAA2F;AAC3F,eAAO,MAAM,kBAAkB,sBAAsD,CAAC"}

package/internal/auth/x509-transport-state.js

@@ -0,0 +1,36 @@
+"use strict"; if (typeof module !== 'undefined' && module !== globalThis.module && typeof exports !== 'undefined' && module.exports === exports) {
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findX509Credential = exports.rememberX509Credential = exports.findX509OAuthError = exports.rememberX509OAuthError = exports.isApprovedX509Client = exports.markApprovedX509Client = exports.isRetryableX509IssuerError = exports.markRetryableX509IssuerError = exports.isTransientX509ConnectionError = exports.markTransientX509ConnectionError = exports.rememberRegisteredX509Transport = exports.findRegisteredX509Transport = void 0;
+/** One lexical capability registry remains authoritative across mixed module formats. */
+const registeredX509Transports = new WeakMap();
+const transientX509ConnectionErrors = new WeakSet();
+const retryableX509IssuerErrors = new WeakSet();
+const approvedX509Clients = new WeakSet();
+const approvedX509OAuthErrors = new WeakMap();
+const approvedX509Credentials = new WeakMap();
+/** Looks up an opaque capability without exposing the registry itself. */
+exports.findRegisteredX509Transport = WeakMap.prototype.get.bind(registeredX509Transports);
+/** Records a capability only after the Node-only factory verifies its genuine private dispatcher. */
+exports.rememberRegisteredX509Transport = WeakMap.prototype.set.bind(registeredX509Transports);
+/** Privately brands sanitized connection errors shared across CommonJS and ESM clients. */
+exports.markTransientX509ConnectionError = WeakSet.prototype.add.bind(transientX509ConnectionErrors);
+/** Recognizes a transient connection without trusting public error properties. */
+exports.isTransientX509ConnectionError = WeakSet.prototype.has.bind(transientX509ConnectionErrors);
+/** Privately brands issuer-generated retryable HTTP failures across module formats. */
+exports.markRetryableX509IssuerError = WeakSet.prototype.add.bind(retryableX509IssuerErrors);
+/** Recognizes only retryable HTTP errors produced by the trusted certificate exchange. */
+exports.isRetryableX509IssuerError = WeakSet.prototype.has.bind(retryableX509IssuerErrors);
+/** Brands only clients whose transport capability was successfully validated. */
+exports.markApprovedX509Client = WeakSet.prototype.add.bind(approvedX509Clients);
+/** Recognizes immutable client ownership across mixed CommonJS and ESM helpers. */
+exports.isApprovedX509Client = WeakSet.prototype.has.bind(approvedX509Clients);
+/** Records the sanitized OAuth response without trusting mutable public error properties. */
+exports.rememberX509OAuthError = WeakMap.prototype.set.bind(approvedX509OAuthErrors);
+/** Retrieves trusted OAuth metadata for public cross-module error normalization. */
+exports.findX509OAuthError = WeakMap.prototype.get.bind(approvedX509OAuthErrors);
+/** Privately binds SDK-owned credentials to their immutable identity and approved transport. */
+exports.rememberX509Credential = WeakMap.prototype.set.bind(approvedX509Credentials);
+/** Resolves only first-class credentials created by the optional Node transport helper. */
+exports.findX509Credential = WeakMap.prototype.get.bind(approvedX509Credentials);
+}
+//# sourceMappingURL=x509-transport-state.cjs.map

package/internal/auth/x509-transport-state.mjs

@@ -0,0 +1,19 @@
+import * as browserState from './x509-transport-state-browser.mjs';
+import * as nodeState from './x509-transport-state.js';
+
+const state = typeof nodeState.findRegisteredX509Transport === 'function' ? nodeState : browserState;
+
+export const {
+  findRegisteredX509Transport,
+  rememberRegisteredX509Transport,
+  markTransientX509ConnectionError,
+  isTransientX509ConnectionError,
+  markRetryableX509IssuerError,
+  isRetryableX509IssuerError,
+  markApprovedX509Client,
+  isApprovedX509Client,
+  rememberX509OAuthError,
+  findX509OAuthError,
+  rememberX509Credential,
+  findX509Credential,
+} = state;

package/internal/auth/x509-workload-identity-auth.d.mts

@@ -0,0 +1,126 @@
+import type { WorkloadIdentity, X509WorkloadIdentity } from "../../auth/types.mjs";
+import type { Fetch } from "../builtin-types.mjs";
+import type { HeadersLike, NullableHeaders } from "../headers.mjs";
+import type { FinalRequestOptions } from "../request-options.mjs";
+import type { MergedRequestInit } from "../types.mjs";
+import type { X509Transport } from "./x509-transport-registry.mjs";
+interface X509TokenRequestContext {
+    apiURL: string;
+    defaultHeaders: HeadersLike | undefined;
+    requestHeaders: HeadersLike;
+    signal: AbortSignal | null | undefined;
+    organization: string | null;
+    project: string | null;
+    timeout: number;
+    fetchOptions: MergedRequestInit;
+}
+/** Distinguishes true certificate identities from extensible legacy subject-token identities. */
+export declare function isX509WorkloadIdentity(identity: WorkloadIdentity | X509WorkloadIdentity | undefined): identity is X509WorkloadIdentity;
+/** Rejects unsupported WebSocket authentication before any connection or credential side effect. */
+export declare function assertX509WebSocketSupported(client: unknown): void;
+/** Prevents caller options from replacing the immutable transport selected at construction. */
+export declare function assertX509FetchOptions(options: MergedRequestInit | RequestInit | undefined): void;
+/** Rejects caller overrides while allowing the SDK-owned fields on the final RequestInit. */
+export declare function assertX509RequestOptions(options: MergedRequestInit | RequestInit | undefined): void;
+/** Validates and snapshots the exact caller options that will reach authenticated dispatch. */
+export declare function snapshotX509RequestOptions(options: MergedRequestInit | undefined): MergedRequestInit;
+/** Bridges certificate authentication into existing OpenAI auth and fetch hooks without optional peers. */
+export declare class X509WorkloadIdentityAuth {
+    #private;
+    /** Captures one registered, immutable certificate identity and its enrolled selectors. */
+    constructor(identity: X509WorkloadIdentity, transport: X509Transport | undefined, organization: string | null, project: string | null);
+    /** Reconstructs the immutable selectors captured before caller-owned identity mutation. */
+    identitySnapshot(): X509WorkloadIdentity;
+    /** Preserves explicitly headerless requests without presenting a certificate to the issuer. */
+    static shouldAuthenticate(options: FinalRequestOptions, defaultHeaders: HeadersLike | undefined, requestHeaders?: HeadersLike): boolean;
+    /** Snapshots each caller-owned header layer once while preserving nulls and precedence. */
+    snapshotHeaders(defaultHeaders: HeadersLike, requestHeaders: HeadersLike): {
+        defaultHeaders: NullableHeaders;
+        requestHeaders: NullableHeaders;
+    };
+    /** Returns the already rendered caller headers without touching mutable inputs again. */
+    headerSnapshots(): {
+        defaultHeaders: NullableHeaders;
+        requestHeaders: NullableHeaders;
+    };
+    /** Captures enrolled public tenant selectors once before certificate presentation. */
+    snapshotTenant(organization: string | null, project: string | null): {
+        organization: string | null;
+        project: string | null;
+    };
+    /** Returns the tenant selectors already approved for this logical request. */
+    tenantSnapshot(): {
+        organization: string | null;
+        project: string | null;
+    };
+    /** Validates and retains the exact destination that authenticated dispatch will use. */
+    snapshotAPIURL(value: string): void;
+    /** Reads the already-approved destination without rerendering caller-owned request options. */
+    requestAPIURL(): string;
+    /** Captures the exact caller settings approved for authenticated dispatch. */
+    snapshotRequest(signal: AbortSignal | null | undefined, timeout: number, fetchOptions: MergedRequestInit): void;
+    /** Returns immutable request settings without invoking caller-owned accessors again. */
+    requestSnapshot(): {
+        signal: AbortSignal | null | undefined;
+        timeout: number;
+        fetchOptions: MergedRequestInit;
+    };
+    /** Suspends an already-running network budget during retry-local asynchronous preparation. */
+    beginRequestPreparation(): void;
+    /** Begins local request construction without charging protected hook latency to the network. */
+    beginRequestPlanning(): void;
+    /** Arms one absolute network deadline only after all local request preparation completes. */
+    beginRequestNetwork(): void;
+    /** Keeps certificate authentication outside overridable request construction. */
+    isPlanningRequest(): boolean;
+    /** Approves the final overridden destination and transport before minting a bearer. */
+    authorizePlannedRequest(url: string, request: RequestInit, timeout: number, allowHookSignal?: boolean): void;
+    /** Owns only SDK-created iterator adapters until authenticated dispatch takes responsibility. */
+    ownRequestBody(body: unknown, source: unknown): void;
+    /** Recognizes every one-shot upload before issuer authentication or request replay. */
+    static isStreamingRequestBody(body: unknown): boolean;
+    /** Retires abandoned upload adapters without masking or blocking their authentication failure. */
+    retireRequestBody(): void;
+    /** Transfers the dispatched upload while retiring any SDK-owned body replaced by a hook. */
+    releaseRequestBody(body: unknown): void;
+    /** Retains caller-only cancellation separately from SDK-created deadline controllers. */
+    setEffectiveSignal(signal: AbortSignal | undefined): void;
+    /** Uses protected-hook cancellation when an authenticated attempt enters retry backoff. */
+    effectiveSignal(): AbortSignal | null | undefined;
+    /** Establishes an independent scope even when concurrent requests share caller options. */
+    runRequest<T>(operation: () => Promise<T>, requestOwner: object): Promise<T>;
+    /** Reports whether a public request-building call already belongs to an active logical operation. */
+    inRequest(requestOwner: object): boolean;
+    /** Shares a cache only when the complete, privately snapshotted credential identity matches. */
+    matches(other: X509WorkloadIdentityAuth): boolean;
+    /** Binds deferred response parsing to the original logical request and its unchanged deadline. */
+    continuation(): <T>(operation: () => Promise<T>) => Promise<T>;
+    /** Removes dispatched bearer material before settled request promises can retain their scope. */
+    releaseRequestCredentials(): void;
+    /** Returns the original authentication start so response consumption shares its request deadline. */
+    requestStartedAt(_options: FinalRequestOptions): number | undefined;
+    /** Distinguishes issued workload credentials from independent admin or headerless requests. */
+    usedWorkloadToken(_options: FinalRequestOptions): boolean;
+    /** Returns the budget left after certificate authentication without starting another timeout. */
+    remainingTimeout(_options: FinalRequestOptions, timeout: number): number;
+    /** Cancels active retry timers promptly without changing public caller-abort semantics. */
+    waitForRetry(duration: number, signal?: AbortSignal | null): Promise<void>;
+    /** Trusts only issuer or connection failures privately branded by the approved transport. */
+    static isRetryableFailure(error: unknown): boolean;
+    /** Reads safe retry hints only from a privately branded, sanitized issuer response. */
+    static retryHeaders(error: unknown): Headers | undefined;
+    /** Exchanges the exact certificate capability selected for the matching API dispatch. */
+    getToken(options?: FinalRequestOptions, context?: X509TokenRequestContext): Promise<string>;
+    /** Invalidates only the workload-token generation actually rejected by the current request. */
+    invalidateToken(): void;
+    /** Binds the minted credential to the original headers before protected request hooks run. */
+    bindRequest(options: FinalRequestOptions, request: RequestInit, adminAPIKey: string | null): void;
+    /** Rebinds an equivalent protected-hook container without relaxing final dispatch identity checks. */
+    adoptRequestHeaders(request: RequestInit): void;
+    /** Rejects request hooks that replace the selected bearer or its approved header identity. */
+    assertRequest(request: RequestInit): void;
+    /** Returns a guarded final dispatcher while preserving all existing request hook object identities. */
+    fetch(): Fetch;
+}
+export {};
+//# sourceMappingURL=x509-workload-identity-auth.d.mts.map

package/internal/auth/x509-workload-identity-auth.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"x509-workload-identity-auth.d.mts","sourceRoot":"","sources":["../../src/internal/auth/x509-workload-identity-auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,6BAAyB;AAC/E,OAAO,KAAK,EAAE,KAAK,EAAE,6BAAyB;AAE9C,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,uBAAmB;AAC/D,OAAO,KAAK,EAAE,mBAAmB,EAAE,+BAA2B;AAE9D,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAiB;AAWlD,OAAO,KAAK,EAIV,aAAa,EACd,sCAAkC;AAwEnC,UAAU,uBAAuB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,WAAW,GAAG,SAAS,CAAC;IACxC,cAAc,EAAE,WAAW,CAAC;IAC5B,MAAM,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,CAAC;IACvC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,iBAAiB,CAAC;CACjC;AA0BD,iGAAiG;AACjG,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,gBAAgB,GAAG,oBAAoB,GAAG,SAAS,GAC5D,QAAQ,IAAI,oBAAoB,CA6BlC;AAED,oGAAoG;AACpG,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAQlE;AAED,+FAA+F;AAC/F,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,iBAAiB,GAAG,WAAW,GAAG,SAAS,GAAG,IAAI,CAcjG;AAED,6FAA6F;AAC7F,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,iBAAiB,GAAG,WAAW,GAAG,SAAS,GAAG,IAAI,CAOnG;AAED,+FAA+F;AAC/F,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,iBAAiB,GAAG,SAAS,GAAG,iBAAiB,CAKpG;AAED,2GAA2G;AAC3G,qBAAa,wBAAwB;;IAanC,0FAA0F;gBAExF,QAAQ,EAAE,oBAAoB,EAC9B,SAAS,EAAE,aAAa,GAAG,SAAS,EACpC,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,OAAO,EAAE,MAAM,GAAG,IAAI;IAkCxB,2FAA2F;IAC3F,gBAAgB,IAAI,oBAAoB;IAcxC,+FAA+F;IAC/F,MAAM,CAAC,kBAAkB,CACvB,OAAO,EAAE,mBAAmB,EAC5B,cAAc,EAAE,WAAW,GAAG,SAAS,EACvC,cAAc,GAAE,WAA6B,GAC5C,OAAO;IAIV,2FAA2F;IAC3F,eAAe,CACb,cAAc,EAAE,WAAW,EAC3B,cAAc,EAAE,WAAW,GAC1B;QAAE,cAAc,EAAE,eAAe,CAAC;QAAC,cAAc,EAAE,eAAe,CAAA;KAAE;IAOvE,yFAAyF;IACzF,eAAe,IAAI;QAAE,cAAc,EAAE,eAAe,CAAC;QAAC,cAAc,EAAE,eAAe,CAAA;KAAE;IAQvF,sFAAsF;IACtF,cAAc,CACZ,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,OAAO,EAAE,MAAM,GAAG,IAAI,GACrB;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;IAS1D,8EAA8E;IAC9E,cAAc,IAAI;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;IAQzE,wFAAwF;IACxF,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAKnC,+FAA+F;IAC/F,aAAa,IAAI,MAAM;IAQvB,8EAA8E;IAC9E,eAAe,CACb,MAAM,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,EACtC,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,iBAAiB,GAC9B,IAAI;IAIP,wFAAwF;IACxF,eAAe,IAAI;QACjB,MAAM,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,CAAC;QACvC,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,EAAE,iBAAiB,CAAC;KACjC;IAQD,8FAA8F;IAC9F,uBAAuB,IAAI,IAAI;IAQ/B,gGAAgG;IAChG,oBAAoB,IAAI,IAAI;IAI5B,6FAA6F;IAC7F,mBAAmB,IAAI,IAAI;IAc3B,iFAAiF;IACjF,iBAAiB,IAAI,OAAO;IAI5B,uFAAuF;IACvF,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,UAAQ,GAAG,IAAI;IAkC1G,iGAAiG;IACjG,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,IAAI;IAMpD,uFAAuF;IACvF,MAAM,CAAC,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO;IAUrD,kGAAkG;IAClG,iBAAiB,IAAI,IAAI;IAiBzB,4FAA4F;IAC5F,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI;IASvC,yFAAyF;IACzF,kBAAkB,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,IAAI;IAQzD,2FAA2F;IAC3F,eAAe,IAAI,WAAW,GAAG,IAAI,GAAG,SAAS;IAKjD,2FAA2F;IAC3F,UAAU,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAmB5E,qGAAqG;IACrG,SAAS,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAKxC,gGAAgG;IAChG,OAAO,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO;IAWjD,kGAAkG;IAClG,YAAY,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC;IAwB9D,iGAAiG;IACjG,yBAAyB,IAAI,IAAI;IAmBjC,qGAAqG;IACrG,gBAAgB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,MAAM,GAAG,SAAS;IAInE,+FAA+F;IAC/F,iBAAiB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO;IAIzD,iGAAiG;IACjG,gBAAgB,CAAC,QAAQ,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM;IAYxE,2FAA2F;IACrF,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAWhF,6FAA6F;IAC7F,MAAM,CAAC,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;IAQlD,uFAAuF;IACvF,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS;IAQxD,yFAAyF;IACnF,QAAQ,CAAC,OAAO,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,MAAM,CAAC;IAoNjG,+FAA+F;IAC/F,eAAe,IAAI,IAAI;IAwBvB,8FAA8F;IAC9F,WAAW,CAAC,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAqBjG,sGAAsG;IACtG,mBAAmB,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI;IAe/C,8FAA8F;IAC9F,aAAa,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI;IAoCzC,uGAAuG;IACvG,KAAK,IAAI,KAAK;CAoBf"}

package/internal/auth/x509-workload-identity-auth.d.ts

@@ -0,0 +1,126 @@
+import type { WorkloadIdentity, X509WorkloadIdentity } from "../../auth/types.js";
+import type { Fetch } from "../builtin-types.js";
+import type { HeadersLike, NullableHeaders } from "../headers.js";
+import type { FinalRequestOptions } from "../request-options.js";
+import type { MergedRequestInit } from "../types.js";
+import type { X509Transport } from "./x509-transport-registry.js";
+interface X509TokenRequestContext {
+    apiURL: string;
+    defaultHeaders: HeadersLike | undefined;
+    requestHeaders: HeadersLike;
+    signal: AbortSignal | null | undefined;
+    organization: string | null;
+    project: string | null;
+    timeout: number;
+    fetchOptions: MergedRequestInit;
+}
+/** Distinguishes true certificate identities from extensible legacy subject-token identities. */
+export declare function isX509WorkloadIdentity(identity: WorkloadIdentity | X509WorkloadIdentity | undefined): identity is X509WorkloadIdentity;
+/** Rejects unsupported WebSocket authentication before any connection or credential side effect. */
+export declare function assertX509WebSocketSupported(client: unknown): void;
+/** Prevents caller options from replacing the immutable transport selected at construction. */
+export declare function assertX509FetchOptions(options: MergedRequestInit | RequestInit | undefined): void;
+/** Rejects caller overrides while allowing the SDK-owned fields on the final RequestInit. */
+export declare function assertX509RequestOptions(options: MergedRequestInit | RequestInit | undefined): void;
+/** Validates and snapshots the exact caller options that will reach authenticated dispatch. */
+export declare function snapshotX509RequestOptions(options: MergedRequestInit | undefined): MergedRequestInit;
+/** Bridges certificate authentication into existing OpenAI auth and fetch hooks without optional peers. */
+export declare class X509WorkloadIdentityAuth {
+    #private;
+    /** Captures one registered, immutable certificate identity and its enrolled selectors. */
+    constructor(identity: X509WorkloadIdentity, transport: X509Transport | undefined, organization: string | null, project: string | null);
+    /** Reconstructs the immutable selectors captured before caller-owned identity mutation. */
+    identitySnapshot(): X509WorkloadIdentity;
+    /** Preserves explicitly headerless requests without presenting a certificate to the issuer. */
+    static shouldAuthenticate(options: FinalRequestOptions, defaultHeaders: HeadersLike | undefined, requestHeaders?: HeadersLike): boolean;
+    /** Snapshots each caller-owned header layer once while preserving nulls and precedence. */
+    snapshotHeaders(defaultHeaders: HeadersLike, requestHeaders: HeadersLike): {
+        defaultHeaders: NullableHeaders;
+        requestHeaders: NullableHeaders;
+    };
+    /** Returns the already rendered caller headers without touching mutable inputs again. */
+    headerSnapshots(): {
+        defaultHeaders: NullableHeaders;
+        requestHeaders: NullableHeaders;
+    };
+    /** Captures enrolled public tenant selectors once before certificate presentation. */
+    snapshotTenant(organization: string | null, project: string | null): {
+        organization: string | null;
+        project: string | null;
+    };
+    /** Returns the tenant selectors already approved for this logical request. */
+    tenantSnapshot(): {
+        organization: string | null;
+        project: string | null;
+    };
+    /** Validates and retains the exact destination that authenticated dispatch will use. */
+    snapshotAPIURL(value: string): void;
+    /** Reads the already-approved destination without rerendering caller-owned request options. */
+    requestAPIURL(): string;
+    /** Captures the exact caller settings approved for authenticated dispatch. */
+    snapshotRequest(signal: AbortSignal | null | undefined, timeout: number, fetchOptions: MergedRequestInit): void;
+    /** Returns immutable request settings without invoking caller-owned accessors again. */
+    requestSnapshot(): {
+        signal: AbortSignal | null | undefined;
+        timeout: number;
+        fetchOptions: MergedRequestInit;
+    };
+    /** Suspends an already-running network budget during retry-local asynchronous preparation. */
+    beginRequestPreparation(): void;
+    /** Begins local request construction without charging protected hook latency to the network. */
+    beginRequestPlanning(): void;
+    /** Arms one absolute network deadline only after all local request preparation completes. */
+    beginRequestNetwork(): void;
+    /** Keeps certificate authentication outside overridable request construction. */
+    isPlanningRequest(): boolean;
+    /** Approves the final overridden destination and transport before minting a bearer. */
+    authorizePlannedRequest(url: string, request: RequestInit, timeout: number, allowHookSignal?: boolean): void;
+    /** Owns only SDK-created iterator adapters until authenticated dispatch takes responsibility. */
+    ownRequestBody(body: unknown, source: unknown): void;
+    /** Recognizes every one-shot upload before issuer authentication or request replay. */
+    static isStreamingRequestBody(body: unknown): boolean;
+    /** Retires abandoned upload adapters without masking or blocking their authentication failure. */
+    retireRequestBody(): void;
+    /** Transfers the dispatched upload while retiring any SDK-owned body replaced by a hook. */
+    releaseRequestBody(body: unknown): void;
+    /** Retains caller-only cancellation separately from SDK-created deadline controllers. */
+    setEffectiveSignal(signal: AbortSignal | undefined): void;
+    /** Uses protected-hook cancellation when an authenticated attempt enters retry backoff. */
+    effectiveSignal(): AbortSignal | null | undefined;
+    /** Establishes an independent scope even when concurrent requests share caller options. */
+    runRequest<T>(operation: () => Promise<T>, requestOwner: object): Promise<T>;
+    /** Reports whether a public request-building call already belongs to an active logical operation. */
+    inRequest(requestOwner: object): boolean;
+    /** Shares a cache only when the complete, privately snapshotted credential identity matches. */
+    matches(other: X509WorkloadIdentityAuth): boolean;
+    /** Binds deferred response parsing to the original logical request and its unchanged deadline. */
+    continuation(): <T>(operation: () => Promise<T>) => Promise<T>;
+    /** Removes dispatched bearer material before settled request promises can retain their scope. */
+    releaseRequestCredentials(): void;
+    /** Returns the original authentication start so response consumption shares its request deadline. */
+    requestStartedAt(_options: FinalRequestOptions): number | undefined;
+    /** Distinguishes issued workload credentials from independent admin or headerless requests. */
+    usedWorkloadToken(_options: FinalRequestOptions): boolean;
+    /** Returns the budget left after certificate authentication without starting another timeout. */
+    remainingTimeout(_options: FinalRequestOptions, timeout: number): number;
+    /** Cancels active retry timers promptly without changing public caller-abort semantics. */
+    waitForRetry(duration: number, signal?: AbortSignal | null): Promise<void>;
+    /** Trusts only issuer or connection failures privately branded by the approved transport. */
+    static isRetryableFailure(error: unknown): boolean;
+    /** Reads safe retry hints only from a privately branded, sanitized issuer response. */
+    static retryHeaders(error: unknown): Headers | undefined;
+    /** Exchanges the exact certificate capability selected for the matching API dispatch. */
+    getToken(options?: FinalRequestOptions, context?: X509TokenRequestContext): Promise<string>;
+    /** Invalidates only the workload-token generation actually rejected by the current request. */
+    invalidateToken(): void;
+    /** Binds the minted credential to the original headers before protected request hooks run. */
+    bindRequest(options: FinalRequestOptions, request: RequestInit, adminAPIKey: string | null): void;
+    /** Rebinds an equivalent protected-hook container without relaxing final dispatch identity checks. */
+    adoptRequestHeaders(request: RequestInit): void;
+    /** Rejects request hooks that replace the selected bearer or its approved header identity. */
+    assertRequest(request: RequestInit): void;
+    /** Returns a guarded final dispatcher while preserving all existing request hook object identities. */
+    fetch(): Fetch;
+}
+export {};
+//# sourceMappingURL=x509-workload-identity-auth.d.ts.map

package/internal/auth/x509-workload-identity-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"x509-workload-identity-auth.d.ts","sourceRoot":"","sources":["../../src/internal/auth/x509-workload-identity-auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,4BAAyB;AAC/E,OAAO,KAAK,EAAE,KAAK,EAAE,4BAAyB;AAE9C,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,sBAAmB;AAC/D,OAAO,KAAK,EAAE,mBAAmB,EAAE,8BAA2B;AAE9D,OAAO,KAAK,EAAE,iBAAiB,EAAE,oBAAiB;AAWlD,OAAO,KAAK,EAIV,aAAa,EACd,qCAAkC;AAwEnC,UAAU,uBAAuB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,WAAW,GAAG,SAAS,CAAC;IACxC,cAAc,EAAE,WAAW,CAAC;IAC5B,MAAM,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,CAAC;IACvC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,iBAAiB,CAAC;CACjC;AA0BD,iGAAiG;AACjG,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,gBAAgB,GAAG,oBAAoB,GAAG,SAAS,GAC5D,QAAQ,IAAI,oBAAoB,CA6BlC;AAED,oGAAoG;AACpG,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAQlE;AAED,+FAA+F;AAC/F,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,iBAAiB,GAAG,WAAW,GAAG,SAAS,GAAG,IAAI,CAcjG;AAED,6FAA6F;AAC7F,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,iBAAiB,GAAG,WAAW,GAAG,SAAS,GAAG,IAAI,CAOnG;AAED,+FAA+F;AAC/F,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,iBAAiB,GAAG,SAAS,GAAG,iBAAiB,CAKpG;AAED,2GAA2G;AAC3G,qBAAa,wBAAwB;;IAanC,0FAA0F;gBAExF,QAAQ,EAAE,oBAAoB,EAC9B,SAAS,EAAE,aAAa,GAAG,SAAS,EACpC,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,OAAO,EAAE,MAAM,GAAG,IAAI;IAkCxB,2FAA2F;IAC3F,gBAAgB,IAAI,oBAAoB;IAcxC,+FAA+F;IAC/F,MAAM,CAAC,kBAAkB,CACvB,OAAO,EAAE,mBAAmB,EAC5B,cAAc,EAAE,WAAW,GAAG,SAAS,EACvC,cAAc,GAAE,WAA6B,GAC5C,OAAO;IAIV,2FAA2F;IAC3F,eAAe,CACb,cAAc,EAAE,WAAW,EAC3B,cAAc,EAAE,WAAW,GAC1B;QAAE,cAAc,EAAE,eAAe,CAAC;QAAC,cAAc,EAAE,eAAe,CAAA;KAAE;IAOvE,yFAAyF;IACzF,eAAe,IAAI;QAAE,cAAc,EAAE,eAAe,CAAC;QAAC,cAAc,EAAE,eAAe,CAAA;KAAE;IAQvF,sFAAsF;IACtF,cAAc,CACZ,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,OAAO,EAAE,MAAM,GAAG,IAAI,GACrB;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;IAS1D,8EAA8E;IAC9E,cAAc,IAAI;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;IAQzE,wFAAwF;IACxF,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAKnC,+FAA+F;IAC/F,aAAa,IAAI,MAAM;IAQvB,8EAA8E;IAC9E,eAAe,CACb,MAAM,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,EACtC,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,iBAAiB,GAC9B,IAAI;IAIP,wFAAwF;IACxF,eAAe,IAAI;QACjB,MAAM,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,CAAC;QACvC,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,EAAE,iBAAiB,CAAC;KACjC;IAQD,8FAA8F;IAC9F,uBAAuB,IAAI,IAAI;IAQ/B,gGAAgG;IAChG,oBAAoB,IAAI,IAAI;IAI5B,6FAA6F;IAC7F,mBAAmB,IAAI,IAAI;IAc3B,iFAAiF;IACjF,iBAAiB,IAAI,OAAO;IAI5B,uFAAuF;IACvF,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,UAAQ,GAAG,IAAI;IAkC1G,iGAAiG;IACjG,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,IAAI;IAMpD,uFAAuF;IACvF,MAAM,CAAC,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO;IAUrD,kGAAkG;IAClG,iBAAiB,IAAI,IAAI;IAiBzB,4FAA4F;IAC5F,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI;IASvC,yFAAyF;IACzF,kBAAkB,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,IAAI;IAQzD,2FAA2F;IAC3F,eAAe,IAAI,WAAW,GAAG,IAAI,GAAG,SAAS;IAKjD,2FAA2F;IAC3F,UAAU,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAmB5E,qGAAqG;IACrG,SAAS,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAKxC,gGAAgG;IAChG,OAAO,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO;IAWjD,kGAAkG;IAClG,YAAY,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC;IAwB9D,iGAAiG;IACjG,yBAAyB,IAAI,IAAI;IAmBjC,qGAAqG;IACrG,gBAAgB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,MAAM,GAAG,SAAS;IAInE,+FAA+F;IAC/F,iBAAiB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO;IAIzD,iGAAiG;IACjG,gBAAgB,CAAC,QAAQ,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM;IAYxE,2FAA2F;IACrF,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAWhF,6FAA6F;IAC7F,MAAM,CAAC,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;IAQlD,uFAAuF;IACvF,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS;IAQxD,yFAAyF;IACnF,QAAQ,CAAC,OAAO,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,MAAM,CAAC;IAoNjG,+FAA+F;IAC/F,eAAe,IAAI,IAAI;IAwBvB,8FAA8F;IAC9F,WAAW,CAAC,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAqBjG,sGAAsG;IACtG,mBAAmB,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI;IAe/C,8FAA8F;IAC9F,aAAa,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI;IAoCzC,uGAAuG;IACvG,KAAK,IAAI,KAAK;CAoBf"}