auth0 7.5.0 → 7.6.0

package/dist/esm/management/core/fetcher/getErrorResponseBody.mjs

@@ -8,13 +8,29 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 import { fromJson } from "../json.mjs";
-import { getResponseBody } from "./getResponseBody.mjs";
+import { getResponseBody, isResponseBodyError } from "./getResponseBody.mjs";
+/** Parses a JSON error body, falling back to the raw text so the status and body are never lost. */
+function parseJsonErrorBody(text) {
+    if (text.length === 0) {
+        return undefined;
+    }
+    try {
+        return fromJson(text);
+    }
+    catch (_a) {
+        return text;
+    }
+}
 export function getErrorResponseBody(response) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a, _b, _c;
         let contentType = (_a = response.headers.get("Content-Type")) === null || _a === void 0 ? void 0 : _a.toLowerCase();
         if (contentType == null || contentType.length === 0) {
-            return getResponseBody(response);
+            const body = yield getResponseBody(response);
+            if (isResponseBodyError(body)) {
+                return body.error.reason === "non-json" ? body.error.rawBody : undefined;
+            }
+            return body;
         }
         if (contentType.indexOf(";") !== -1) {
             contentType = (_c = (_b = contentType.split(";")[0]) === null || _b === void 0 ? void 0 : _b.trim()) !== null && _c !== void 0 ? _c : "";
@@ -25,14 +41,11 @@ export function getErrorResponseBody(response) {
             case "application/ld+json":
             case "application/problem+json":
             case "application/vnd.api+json":
-            case "text/json": {
-                const text = yield response.text();
-                return text.length > 0 ? fromJson(text) : undefined;
-            }
+            case "text/json":
+                return parseJsonErrorBody(yield response.text());
             default:
                 if (contentType.startsWith("application/vnd.") && contentType.endsWith("+json")) {
-                    const text = yield response.text();
-                    return text.length > 0 ? fromJson(text) : undefined;
+                    return parseJsonErrorBody(yield response.text());
                 }
                 // Fallback to plain text if content type is not recognized
                 // Even if no body is present, the response will be an empty string

package/dist/esm/management/core/fetcher/getResponseBody.d.mts

@@ -1 +1,17 @@
+export type ResponseBodyError = {
+    ok: false;
+    error: {
+        reason: "non-json";
+        statusCode: number;
+        rawBody: string;
+    } | {
+        reason: "body-is-null";
+        statusCode: number;
+    };
+};
+/**
+ * Returns true when `value` is a failure record created by `getResponseBody` (for example malformed JSON),
+ * as opposed to a parsed JSON body that happens to have the same shape.
+ */
+export declare function isResponseBodyError(value: unknown): value is ResponseBodyError;
 export declare function getResponseBody(response: Response, responseType?: string): Promise<unknown>;

package/dist/esm/management/core/fetcher/getResponseBody.mjs

@@ -18,6 +18,19 @@ function retainResponse(target, response) {
         writable: false,
     });
 }
+const responseBodyErrors = new WeakSet();
+function responseBodyError(error) {
+    const record = { ok: false, error };
+    responseBodyErrors.add(record);
+    return record;
+}
+/**
+ * Returns true when `value` is a failure record created by `getResponseBody` (for example malformed JSON),
+ * as opposed to a parsed JSON body that happens to have the same shape.
+ */
+export function isResponseBodyError(value) {
+    return typeof value === "object" && value != null && responseBodyErrors.has(value);
+}
 export function getResponseBody(response, responseType) {
     return __awaiter(this, void 0, void 0, function* () {
         switch (responseType) {
@@ -29,25 +42,19 @@ export function getResponseBody(response, responseType) {
                 return yield response.arrayBuffer();
             case "sse":
                 if (response.body == null) {
-                    return {
-                        ok: false,
-                        error: {
-                            reason: "body-is-null",
-                            statusCode: response.status,
-                        },
-                    };
+                    return responseBodyError({
+                        reason: "body-is-null",
+                        statusCode: response.status,
+                    });
                 }
                 retainResponse(response.body, response);
                 return response.body;
             case "streaming":
                 if (response.body == null) {
-                    return {
-                        ok: false,
-                        error: {
-                            reason: "body-is-null",
-                            statusCode: response.status,
-                        },
-                    };
+                    return responseBodyError({
+                        reason: "body-is-null",
+                        statusCode: response.status,
+                    });
                 }
                 retainResponse(response.body, response);
                 return response.body;
@@ -62,14 +69,11 @@ export function getResponseBody(response, responseType) {
                 return responseBody;
             }
             catch (_err) {
-                return {
-                    ok: false,
-                    error: {
-                        reason: "non-json",
-                        statusCode: response.status,
-                        rawBody: text,
-                    },
-                };
+                return responseBodyError({
+                    reason: "non-json",
+                    statusCode: response.status,
+                    rawBody: text,
+                });
             }
         }
         return undefined;

package/dist/esm/management/core/fetcher/makePassthroughRequest.mjs

@@ -12,7 +12,9 @@ import { join } from "../url/join.mjs";
 import { EndpointSupplier } from "./EndpointSupplier.mjs";
 import { getFetchFn } from "./getFetchFn.mjs";
 import { makeRequest } from "./makeRequest.mjs";
+import { redactUrl } from "./redactUrl.mjs";
 import { requestWithRetries } from "./requestWithRetries.mjs";
+import { TIMEOUT } from "./signals.mjs";
 import { Supplier } from "./Supplier.mjs";
 /**
  * Makes a passthrough HTTP request using the SDK's configuration (auth, retry, logging, etc.)
@@ -76,8 +78,10 @@ export function makePassthroughRequest(input, init, clientOptions, requestOption
                 }
             }
         }
-        // Apply auth headers
-        if (clientOptions.getAuthHeaders != null) {
+        // Apply auth headers, but only when the resolved URL targets the configured base URL.
+        // This prevents the SDK's credentials from leaking to an unrelated host when a caller
+        // passes an absolute cross-origin URL into the passthrough fetch escape hatch.
+        if (clientOptions.getAuthHeaders != null && targetsBaseUrl(fullUrl, baseUrl)) {
             const authHeaders = yield clientOptions.getAuthHeaders();
             for (const [key, value] of Object.entries(authHeaders)) {
                 mergedHeaders[key.toLowerCase()] = value;
@@ -112,21 +116,55 @@ export function makePassthroughRequest(input, init, clientOptions, requestOption
         if (logger.isDebug()) {
             logger.debug("Making passthrough HTTP request", {
                 method,
-                url: fullUrl,
+                url: redactUrl(fullUrl),
                 hasBody: body != null,
             });
         }
-        const response = yield requestWithRetries(() => __awaiter(this, void 0, void 0, function* () {
-            return makeRequest(fetchFn, fullUrl, method, mergedHeaders, body !== null && body !== void 0 ? body : undefined, timeoutMs, abortSignal, (effectiveInit === null || effectiveInit === void 0 ? void 0 : effectiveInit.credentials) === "include", undefined, // duplex
-            false);
-        }), maxRetries);
+        let response;
+        try {
+            response = yield requestWithRetries(() => __awaiter(this, void 0, void 0, function* () {
+                return makeRequest(fetchFn, fullUrl, method, mergedHeaders, body !== null && body !== void 0 ? body : undefined, timeoutMs, abortSignal, (effectiveInit === null || effectiveInit === void 0 ? void 0 : effectiveInit.credentials) === "include", undefined, // duplex
+                false);
+            }), maxRetries, abortSignal);
+        }
+        catch (error) {
+            // Match `fetch`: a timeout rejects with an Error named "TimeoutError", not the bare abort reason.
+            if (error === TIMEOUT) {
+                throw createTimeoutError();
+            }
+            throw error;
+        }
         if (logger.isDebug()) {
             logger.debug("Passthrough HTTP request completed", {
                 method,
-                url: fullUrl,
+                url: redactUrl(fullUrl),
                 statusCode: response.status,
             });
         }
         return response;
     });
 }
+function createTimeoutError() {
+    const error = new Error("The request timed out.");
+    error.name = "TimeoutError";
+    return error;
+}
+/**
+ * Returns true when the resolved request URL points at the same origin as the
+ * configured base URL. Relative paths are always joined onto the base URL, so
+ * they resolve to the base origin and return true. Absolute URLs only match when
+ * their origin equals the base origin. When there is no base URL to compare
+ * against, or either value is not a parseable absolute URL, this returns false so
+ * auth headers are not attached.
+ */
+function targetsBaseUrl(fullUrl, baseUrl) {
+    if (baseUrl == null) {
+        return false;
+    }
+    try {
+        return new URL(fullUrl).origin === new URL(baseUrl).origin;
+    }
+    catch (_a) {
+        return false;
+    }
+}

package/dist/esm/management/core/fetcher/makeRequest.d.mts

@@ -3,4 +3,9 @@ export declare function isCacheNoStoreSupported(): boolean;
  * Reset the cached result of `isCacheNoStoreSupported`. Exposed for testing only.
  */
 export declare function resetCacheNoStoreSupported(): void;
-export declare const makeRequest: (fetchFn: (url: string, init: RequestInit) => Promise<Response>, url: string, method: string, headers: Headers | Record<string, string>, requestBody: BodyInit | undefined, timeoutMs?: number, abortSignal?: AbortSignal, withCredentials?: boolean, duplex?: "half", disableCache?: boolean) => Promise<Response>;
+/**
+ * Clears the timeout that `makeRequest` kept running (with `keepTimeoutUntilBodyRead`) so that it also
+ * covered reading the response body.
+ */
+export declare function clearResponseTimeout(response: Response): void;
+export declare const makeRequest: (fetchFn: (url: string, init: RequestInit) => Promise<Response>, url: string, method: string, headers: Headers | Record<string, string>, requestBody: BodyInit | undefined, timeoutMs?: number, abortSignal?: AbortSignal, withCredentials?: boolean, duplex?: "half", disableCache?: boolean, keepTimeoutUntilBodyRead?: boolean) => Promise<Response>;

package/dist/esm/management/core/fetcher/makeRequest.mjs

@@ -7,7 +7,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
-import { anySignal, getTimeoutSignal } from "./signals.mjs";
+import { anySignal, getTimeoutSignal, TIMEOUT } from "./signals.mjs";
 /**
  * Cached result of checking whether the current runtime supports
  * the `cache` option in `Request`. Some runtimes (e.g. Cloudflare Workers)
@@ -33,23 +33,55 @@ export function isCacheNoStoreSupported() {
 export function resetCacheNoStoreSupported() {
     _cacheNoStoreSupported = undefined;
 }
-export const makeRequest = (fetchFn, url, method, headers, requestBody, timeoutMs, abortSignal, withCredentials, duplex, disableCache) => __awaiter(void 0, void 0, void 0, function* () {
+const responseTimeouts = new WeakMap();
+/**
+ * Clears the timeout that `makeRequest` kept running (with `keepTimeoutUntilBodyRead`) so that it also
+ * covered reading the response body.
+ */
+export function clearResponseTimeout(response) {
+    const timeoutId = responseTimeouts.get(response);
+    if (timeoutId != null) {
+        clearTimeout(timeoutId);
+        responseTimeouts.delete(response);
+    }
+}
+export const makeRequest = (fetchFn, url, method, headers, requestBody, timeoutMs, abortSignal, withCredentials, duplex, disableCache, keepTimeoutUntilBodyRead) => __awaiter(void 0, void 0, void 0, function* () {
     const signals = [];
     let timeoutAbortId;
+    let timeoutSignal;
     if (timeoutMs != null) {
         const { signal, abortId } = getTimeoutSignal(timeoutMs);
         timeoutAbortId = abortId;
+        timeoutSignal = signal;
         signals.push(signal);
     }
     if (abortSignal != null) {
         signals.push(abortSignal);
     }
     const newSignals = anySignal(signals);
-    const response = yield fetchFn(url, Object.assign({ method: method, headers, body: requestBody, signal: newSignals, credentials: withCredentials ? "include" : undefined, 
-        // @ts-ignore
-        duplex }, (disableCache && isCacheNoStoreSupported() ? { cache: "no-store" } : {})));
+    let response;
+    try {
+        response = yield fetchFn(url, Object.assign({ method: method, headers, body: requestBody, signal: newSignals, credentials: withCredentials ? "include" : undefined, 
+            // @ts-ignore
+            duplex }, (disableCache && isCacheNoStoreSupported() ? { cache: "no-store" } : {})));
+    }
+    catch (error) {
+        if (timeoutAbortId != null) {
+            clearTimeout(timeoutAbortId);
+        }
+        // Some runtimes (e.g. Node 18) reject with their own error instead of the abort reason.
+        if ((timeoutSignal === null || timeoutSignal === void 0 ? void 0 : timeoutSignal.aborted) && !(abortSignal === null || abortSignal === void 0 ? void 0 : abortSignal.aborted)) {
+            throw TIMEOUT;
+        }
+        throw error;
+    }
     if (timeoutAbortId != null) {
-        clearTimeout(timeoutAbortId);
+        if (keepTimeoutUntilBodyRead) {
+            responseTimeouts.set(response, timeoutAbortId);
+        }
+        else {
+            clearTimeout(timeoutAbortId);
+        }
     }
     return response;
 });

package/dist/esm/management/core/fetcher/redactUrl.d.mts

@@ -0,0 +1,2 @@
+export declare const SENSITIVE_QUERY_PARAMS: Set<string>;
+export declare function redactUrl(url: string): string;

package/dist/esm/management/core/fetcher/redactUrl.mjs

@@ -0,0 +1,84 @@
+export const SENSITIVE_QUERY_PARAMS = new Set([
+    "api_key",
+    "api-key",
+    "apikey",
+    "token",
+    "access_token",
+    "access-token",
+    "auth_token",
+    "auth-token",
+    "password",
+    "passwd",
+    "secret",
+    "api_secret",
+    "api-secret",
+    "apisecret",
+    "key",
+    "session",
+    "session_id",
+    "session-id",
+]);
+export function redactUrl(url) {
+    const protocolIndex = url.indexOf("://");
+    if (protocolIndex === -1)
+        return url;
+    const afterProtocol = protocolIndex + 3;
+    // Find the first delimiter that marks the end of the authority section
+    const pathStart = url.indexOf("/", afterProtocol);
+    let queryStart = url.indexOf("?", afterProtocol);
+    let fragmentStart = url.indexOf("#", afterProtocol);
+    const firstDelimiter = Math.min(pathStart === -1 ? url.length : pathStart, queryStart === -1 ? url.length : queryStart, fragmentStart === -1 ? url.length : fragmentStart);
+    // Find the LAST @ before the delimiter (handles multiple @ in credentials)
+    let atIndex = -1;
+    for (let i = afterProtocol; i < firstDelimiter; i++) {
+        if (url[i] === "@") {
+            atIndex = i;
+        }
+    }
+    if (atIndex !== -1) {
+        url = `${url.slice(0, afterProtocol)}[REDACTED]@${url.slice(atIndex + 1)}`;
+    }
+    // Recalculate queryStart since url might have changed
+    queryStart = url.indexOf("?");
+    if (queryStart === -1)
+        return url;
+    fragmentStart = url.indexOf("#", queryStart);
+    const queryEnd = fragmentStart !== -1 ? fragmentStart : url.length;
+    const queryString = url.slice(queryStart + 1, queryEnd);
+    if (queryString.length === 0)
+        return url;
+    // FAST PATH: Quick check if any sensitive keywords present
+    // Using indexOf is faster than regex for simple substring matching
+    const lower = queryString.toLowerCase();
+    const hasSensitive = lower.includes("token") ||
+        lower.includes("key") ||
+        lower.includes("password") ||
+        lower.includes("passwd") ||
+        lower.includes("secret") ||
+        lower.includes("session") ||
+        lower.includes("auth");
+    if (!hasSensitive) {
+        return url;
+    }
+    // SLOW PATH: Parse and redact
+    const redactedParams = [];
+    const params = queryString.split("&");
+    for (const param of params) {
+        const equalIndex = param.indexOf("=");
+        if (equalIndex === -1) {
+            redactedParams.push(param);
+            continue;
+        }
+        const key = param.slice(0, equalIndex);
+        let shouldRedact = SENSITIVE_QUERY_PARAMS.has(key.toLowerCase());
+        if (!shouldRedact && key.includes("%")) {
+            try {
+                const decodedKey = decodeURIComponent(key);
+                shouldRedact = SENSITIVE_QUERY_PARAMS.has(decodedKey.toLowerCase());
+            }
+            catch (_a) { }
+        }
+        redactedParams.push(shouldRedact ? `${key}=[REDACTED]` : param);
+    }
+    return url.slice(0, queryStart + 1) + redactedParams.join("&") + url.slice(queryEnd);
+}

package/dist/esm/management/core/fetcher/requestWithRetries.d.mts

@@ -1 +1 @@
-export declare function requestWithRetries(requestFn: () => Promise<Response>, maxRetries?: number): Promise<Response>;
+export declare function requestWithRetries(requestFn: () => Promise<Response>, maxRetries?: number, abortSignal?: AbortSignal): Promise<Response>;

package/dist/esm/management/core/fetcher/requestWithRetries.mjs

@@ -49,13 +49,34 @@ function getRetryDelayFromHeaders(response, retryAttempt) {
     }
     return addSymmetricJitter(Math.min(INITIAL_RETRY_DELAY * Math.pow(2, retryAttempt), MAX_RETRY_DELAY));
 }
+/**
+ * Waits `ms` milliseconds, or rejects as soon as `abortSignal` aborts. The timer and
+ * the abort listener are always removed, so a cancelled wait never keeps the process alive.
+ */
+function sleep(ms, abortSignal) {
+    return new Promise((resolve, reject) => {
+        if (abortSignal === null || abortSignal === void 0 ? void 0 : abortSignal.aborted) {
+            reject(abortSignal.reason);
+            return;
+        }
+        const onAbort = () => {
+            clearTimeout(timeoutId);
+            reject(abortSignal === null || abortSignal === void 0 ? void 0 : abortSignal.reason);
+        };
+        const timeoutId = setTimeout(() => {
+            abortSignal === null || abortSignal === void 0 ? void 0 : abortSignal.removeEventListener("abort", onAbort);
+            resolve();
+        }, ms);
+        abortSignal === null || abortSignal === void 0 ? void 0 : abortSignal.addEventListener("abort", onAbort, { once: true });
+    });
+}
 export function requestWithRetries(requestFn_1) {
-    return __awaiter(this, arguments, void 0, function* (requestFn, maxRetries = DEFAULT_MAX_RETRIES) {
+    return __awaiter(this, arguments, void 0, function* (requestFn, maxRetries = DEFAULT_MAX_RETRIES, abortSignal) {
         let response = yield requestFn();
         for (let i = 0; i < maxRetries; ++i) {
             if (isRetryableStatusCode(response.status)) {
                 const delay = getRetryDelayFromHeaders(response, i);
-                yield new Promise((resolve) => setTimeout(resolve, delay));
+                yield sleep(delay, abortSignal);
                 response = yield requestFn();
             }
             else {

package/dist/esm/management/core/fetcher/signals.d.mts

@@ -1,3 +1,4 @@
+export declare const TIMEOUT = "timeout";
 export declare function getTimeoutSignal(timeoutMs: number): {
     signal: AbortSignal;
     abortId: ReturnType<typeof setTimeout>;

package/dist/esm/management/core/fetcher/signals.mjs

@@ -1,4 +1,4 @@
-const TIMEOUT = "timeout";
+export const TIMEOUT = "timeout";
 export function getTimeoutSignal(timeoutMs) {
     const controller = new AbortController();
     const abortId = setTimeout(() => controller.abort(TIMEOUT), timeoutMs);

package/dist/esm/management/core/file/file.mjs

@@ -41,6 +41,9 @@ export function toMultipartDataPart(file) {
 function getFileWithMetadata(file_1) {
     return __awaiter(this, arguments, void 0, function* (file, { noSniffFileSize } = {}) {
         var _a, _b, _c, _d, _e;
+        if (file == null) {
+            throw new Error(`Expected file to be a Blob, Buffer, ReadableStream, or an object with a "path" or "data" property, but received ${file === null ? "null" : "undefined"}.`);
+        }
         if (isFileLike(file)) {
             return getFileWithMetadata({
                 data: file,

package/dist/esm/management/core/form-data-utils/FormDataWrapper.mjs

@@ -36,6 +36,9 @@ export class FormDataWrapper {
     }
     appendFile(key, value) {
         return __awaiter(this, void 0, void 0, function* () {
+            if (value == null) {
+                throw new Error(`File upload for "${key}" received ${value === null ? "null" : "undefined"}. The generated code should not call appendFile with null/undefined — check that optional file fields are guarded before this call.`);
+            }
             const { data, filename, contentType } = yield toMultipartDataPart(value);
             const blob = yield convertToBlob(data, contentType);
             if (filename) {

package/dist/esm/management/core/requestBody.d.mts

@@ -0,0 +1,12 @@
+/**
+ * Spreads caller-supplied `additionalBodyParameters` (from `requestOptions.additionalBodyParameters`)
+ * on top of the request body. Caller-supplied properties win over the endpoint body. When no
+ * additional body parameters are provided, the original body is returned unchanged so serialization
+ * is unaffected.
+ *
+ * The merge only applies to plain-object (JSON object) bodies. When the body is `null`/`undefined`
+ * the additional parameters become the body; when the body is an array or a primitive JSON value it
+ * is returned unchanged, since object properties cannot be spread into it. This mirrors the Python
+ * SDK, which only merges additional body parameters into mapping bodies.
+ */
+export declare function mergeAdditionalBodyParameters(body: unknown, additionalBodyParameters: Record<string, unknown> | undefined): unknown;

package/dist/esm/management/core/requestBody.mjs

@@ -0,0 +1,23 @@
+/**
+ * Spreads caller-supplied `additionalBodyParameters` (from `requestOptions.additionalBodyParameters`)
+ * on top of the request body. Caller-supplied properties win over the endpoint body. When no
+ * additional body parameters are provided, the original body is returned unchanged so serialization
+ * is unaffected.
+ *
+ * The merge only applies to plain-object (JSON object) bodies. When the body is `null`/`undefined`
+ * the additional parameters become the body; when the body is an array or a primitive JSON value it
+ * is returned unchanged, since object properties cannot be spread into it. This mirrors the Python
+ * SDK, which only merges additional body parameters into mapping bodies.
+ */
+export function mergeAdditionalBodyParameters(body, additionalBodyParameters) {
+    if (additionalBodyParameters == null) {
+        return body;
+    }
+    if (body == null) {
+        return Object.assign({}, additionalBodyParameters);
+    }
+    if (typeof body === "object" && !Array.isArray(body)) {
+        return Object.assign(Object.assign({}, body), additionalBodyParameters);
+    }
+    return body;
+}

package/dist/esm/management/core/runtime/index.d.mts

@@ -1 +1 @@
-export { RUNTIME } from "./runtime.mjs";
+export { RUNTIME, getUserAgent } from "./runtime.mjs";

package/dist/esm/management/core/runtime/index.mjs

@@ -1 +1 @@
-export { RUNTIME } from "./runtime.mjs";
+export { RUNTIME, getUserAgent } from "./runtime.mjs";

package/dist/esm/management/core/runtime/runtime.d.mts

@@ -6,4 +6,23 @@ export interface Runtime {
     type: "browser" | "web-worker" | "deno" | "bun" | "node" | "react-native" | "unknown" | "workerd" | "edge-runtime";
     version?: string;
     parsedVersion?: number;
+    /**
+     * The operating system the SDK is running on, when it can be determined
+     * (e.g. "linux", "darwin", "win32" on server runtimes). Undefined in
+     * environments where the OS is not observable (e.g. browsers).
+     */
+    os?: string;
+    /**
+     * The CPU architecture the SDK is running on, when it can be determined
+     * (e.g. "x64", "arm64" on server runtimes). Undefined in environments where
+     * the architecture is not observable (e.g. browsers).
+     */
+    arch?: string;
 }
+/**
+ * Builds a structured User-Agent string of the form
+ *   `{sdkName}/{sdkVersion} ({os}; {arch}) {runtime}/{runtimeVersion}`
+ * where the platform group and runtime segment are omitted gracefully when the
+ * underlying values cannot be determined (e.g. in a browser).
+ */
+export declare function getUserAgent(sdkName: string, sdkVersion: string): string;

package/dist/esm/management/core/runtime/runtime.mjs

@@ -3,7 +3,7 @@
  */
 export const RUNTIME = evaluateRuntime();
 function evaluateRuntime() {
-    var _a, _b, _c, _d, _e;
+    var _a, _b, _c, _d, _e, _f, _g;
     /**
      * A constant that indicates whether the environment the code is running is a Web Browser.
      */
@@ -56,6 +56,8 @@ function evaluateRuntime() {
         return {
             type: "deno",
             version: Deno.version.deno,
+            os: (_e = Deno.build) === null || _e === void 0 ? void 0 : _e.os,
+            arch: (_f = Deno.build) === null || _f === void 0 ? void 0 : _f.arch,
         };
     }
     /**
@@ -66,6 +68,8 @@ function evaluateRuntime() {
         return {
             type: "bun",
             version: Bun.version,
+            os: typeof process !== "undefined" ? process.platform : undefined,
+            arch: typeof process !== "undefined" ? process.arch : undefined,
         };
     }
     /**
@@ -87,15 +91,82 @@ function evaluateRuntime() {
      * Edge Runtime warns about Node.js APIs even when they are guarded).
      */
     const _process = typeof process !== "undefined" ? process : undefined;
-    const isNode = typeof _process !== "undefined" && typeof ((_e = _process.versions) === null || _e === void 0 ? void 0 : _e.node) === "string";
+    const isNode = typeof _process !== "undefined" && typeof ((_g = _process.versions) === null || _g === void 0 ? void 0 : _g.node) === "string";
     if (isNode) {
         return {
             type: "node",
             version: _process.versions.node,
             parsedVersion: Number(_process.versions.node.split(".")[0]),
+            os: _process.platform,
+            arch: _process.arch,
         };
     }
     return {
         type: "unknown",
     };
 }
+/**
+ * Display names for the language runtimes whose version is meaningful to encode
+ * in a User-Agent. Environments where a version string is not useful (e.g.
+ * browsers, where `version` is the full navigator UA) are intentionally mapped
+ * to `undefined` so they are omitted from the User-Agent.
+ */
+const RUNTIME_DISPLAY_NAMES = {
+    node: "Node",
+    deno: "Deno",
+    bun: "Bun",
+    browser: undefined,
+    "web-worker": undefined,
+    "react-native": undefined,
+    workerd: undefined,
+    "edge-runtime": undefined,
+    unknown: undefined,
+};
+/**
+ * CPU architecture aliases that all refer to 64-bit x86. They are normalized to
+ * the single canonical token `x86_64` so the User-Agent architecture label is
+ * consistent regardless of which runtime reports it (Node reports `x64`, others
+ * report `amd64` or `x86_64`).
+ */
+const X86_64_ARCH_ALIASES = new Set(["x64", "amd64", "x86_64"]);
+/**
+ * Normalizes a CPU architecture token, collapsing the 64-bit x86 aliases
+ * (`x64`, `amd64`, `x86_64`) to `x86_64`. Other architectures are returned
+ * unchanged.
+ */
+function normalizeArch(arch) {
+    if (arch == null) {
+        return arch;
+    }
+    return X86_64_ARCH_ALIASES.has(arch.toLowerCase()) ? "x86_64" : arch;
+}
+/**
+ * Percent-encodes the `@` and `/` characters in an npm package name so the
+ * User-Agent product token stays within the RFC 7230 token grammar. The
+ * original scoped package name can be recovered by URL-decoding (e.g.
+ * `@dummy/sdk` becomes `%40dummy%2Fsdk`).
+ */
+function encodeProductName(sdkName) {
+    return sdkName.replace(/@/g, "%40").replace(/\//g, "%2F");
+}
+/**
+ * Builds a structured User-Agent string of the form
+ *   `{sdkName}/{sdkVersion} ({os}; {arch}) {runtime}/{runtimeVersion}`
+ * where the platform group and runtime segment are omitted gracefully when the
+ * underlying values cannot be determined (e.g. in a browser).
+ */
+export function getUserAgent(sdkName, sdkVersion) {
+    let userAgent = `${encodeProductName(sdkName)}/${sdkVersion}`;
+    const platform = [RUNTIME.os, normalizeArch(RUNTIME.arch)].filter((part) => part != null && part.length > 0);
+    if (platform.length > 0) {
+        userAgent += ` (${platform.join("; ")})`;
+    }
+    const runtimeName = RUNTIME_DISPLAY_NAMES[RUNTIME.type];
+    if (runtimeName != null) {
+        userAgent += ` ${runtimeName}`;
+        if (RUNTIME.version != null && RUNTIME.version.length > 0) {
+            userAgent += `/${RUNTIME.version}`;
+        }
+    }
+    return userAgent;
+}