openai 7.3.0 → 7.5.0

package/_vendor/zod-to-json-schema/zodToJsonSchema.mjs

@@ -1,18 +1,78 @@
 import { parseDef } from "./parseDef.mjs";
 import { getRefs } from "./Refs.mjs";
 import { zodDef, isEmptyObj } from "./util.mjs";
+function ownStrictRootSchema(schema, name, nameStrategy) {
+    if (schema === null || typeof schema !== 'object') {
+        throw new TypeError('Root schema must be a plain JSON-schema record');
+    }
+    const prototype = Object.getPrototypeOf(schema);
+    if (![null, Object.prototype].includes(prototype)) {
+        throw new TypeError('Root schema must be a plain JSON-schema record');
+    }
+    const owned = {};
+    for (const [key, descriptor] of Object.entries(Object.getOwnPropertyDescriptors(schema))) {
+        if (!descriptor.enumerable) {
+            continue;
+        }
+        if (!('value' in descriptor)) {
+            throw new TypeError(`Root schema property '${key}' must be a data property`);
+        }
+        const value = descriptor.value;
+        if (key === 'toJSON' && typeof value === 'function') {
+            throw new TypeError("Root schema cannot contain a callable 'toJSON' property");
+        }
+        if (['undefined', 'function', 'symbol'].includes(typeof value)) {
+            continue;
+        }
+        Object.defineProperty(owned, key, {
+            configurable: true,
+            enumerable: true,
+            value,
+            writable: true,
+        });
+    }
+    const { type, nullable, $ref: reference } = owned;
+    if (!['undefined', 'boolean'].includes(typeof nullable)) {
+        throw new TypeError("Root schema 'nullable' must be a boolean");
+    }
+    if (type !== 'object' || nullable === true) {
+        let actualType;
+        if (typeof type === 'string') {
+            actualType = nullable === true ? `${type},null` : type;
+        }
+        else if (Array.isArray(type)) {
+            actualType = type.join(',');
+        }
+        throw new Error(`Root schema must have type: 'object' but got type: ${actualType ? `'${actualType}'` : 'undefined'}`);
+    }
+    if (reference !== undefined) {
+        throw new Error("Root schema must be a concrete object and cannot contain '$ref'");
+    }
+    if (name !== undefined && nameStrategy !== 'duplicate-ref') {
+        throw new Error("Root schema must have type: 'object' but got type: undefined");
+    }
+    return owned;
+}
 const zodToJsonSchema = (schema, options) => {
     const refs = getRefs(options);
-    const name = typeof options === 'string' ? options
-        : options?.nameStrategy === 'title' ? undefined
-            : options?.name;
-    const main = parseDef(schema._def, name === undefined ? refs : ({
-        ...refs,
-        currentPath: [...refs.basePath, refs.definitionPath, name],
-    }), false) ?? {};
-    const title = typeof options === 'object' && options.name !== undefined && options.nameStrategy === 'title' ?
-        options.name
-        : undefined;
+    if (refs.openaiStrictMode) {
+        refs.definitions = { ...refs.definitions };
+    }
+    let name;
+    if (typeof options === 'string') {
+        name = options;
+    }
+    else if (options?.nameStrategy !== 'title') {
+        name = options?.name;
+    }
+    const parsed = parseDef(schema._def, name === undefined
+        ? refs
+        : {
+            ...refs,
+            currentPath: [...refs.basePath, refs.definitionPath, name],
+        }, refs.openaiStrictMode === true) ?? {};
+    const main = refs.openaiStrictMode ? ownStrictRootSchema(parsed, name, refs.nameStrategy) : parsed;
+    const title = refs.nameStrategy === 'title' ? refs.name : undefined;
     if (title !== undefined) {
         main.title = title;
     }
@@ -29,8 +89,9 @@ const zodToJsonSchema = (schema, options) => {
         // are any bugs that would otherwise result in us iterating indefinitely
         for (let i = 0; i < 500; i++) {
             const newDefinitions = Object.entries(refs.definitions).filter(([key]) => !processedDefinitions.has(key));
-            if (newDefinitions.length === 0)
+            if (newDefinitions.length === 0) {
                 break;
+            }
             for (const [key, schema] of newDefinitions) {
                 definitions[key] =
                     parseDef(zodDef(schema), { ...refs, currentPath: [...refs.basePath, refs.definitionPath, key] }, true) ?? {};
@@ -39,34 +100,39 @@ const zodToJsonSchema = (schema, options) => {
         }
         return definitions;
     })();
-    const combined = name === undefined ?
-        definitions ?
-            {
+    let combined;
+    if (name === undefined) {
+        combined = definitions
+            ? {
                 ...main,
                 [refs.definitionPath]: definitions,
             }
-            : main
-        : refs.nameStrategy === 'duplicate-ref' ?
-            {
-                ...main,
-                ...(definitions || refs.seenRefs.size ?
-                    {
-                        [refs.definitionPath]: {
-                            ...definitions,
-                            // only actually duplicate the schema definition if it was ever referenced
-                            // otherwise the duplication is completely pointless
-                            ...(refs.seenRefs.size ? { [name]: main } : undefined),
-                        },
-                    }
-                    : undefined),
-            }
-            : {
-                $ref: [...(refs.$refStrategy === 'relative' ? [] : refs.basePath), refs.definitionPath, name].join('/'),
-                [refs.definitionPath]: {
-                    ...definitions,
-                    [name]: main,
-                },
-            };
+            : main;
+    }
+    else if (refs.nameStrategy === 'duplicate-ref') {
+        combined = {
+            ...main,
+            ...(definitions || refs.seenRefs.size
+                ? {
+                    [refs.definitionPath]: {
+                        ...definitions,
+                        // only actually duplicate the schema definition if it was ever referenced
+                        // otherwise the duplication is completely pointless
+                        ...(refs.seenRefs.size ? { [name]: main } : undefined),
+                    },
+                }
+                : undefined),
+        };
+    }
+    else {
+        combined = {
+            $ref: [...(refs.$refStrategy === 'relative' ? [] : refs.basePath), refs.definitionPath, name].join('/'),
+            [refs.definitionPath]: {
+                ...definitions,
+                [name]: main,
+            },
+        };
+    }
     if (refs.target === 'jsonSchema7') {
         combined.$schema = 'http://json-schema.org/draft-07/schema#';
     }

package/_vendor/zod-to-json-schema/zodToJsonSchema.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"zodToJsonSchema.mjs","sourceRoot":"","sources":["../../src/_vendor/zod-to-json-schema/zodToJsonSchema.ts"],"names":[],"mappings":"AAEA,OAAO,EAAmB,QAAQ,EAAE,uBAAmB;AACvD,OAAO,EAAE,OAAO,EAAE,mBAAe;AACjC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,mBAAe;AAE5C,MAAM,eAAe,GAAG,CACtB,MAAsB,EACtB,OAA2C,EAQ3C,EAAE;IACF,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE9B,MAAM,IAAI,GACR,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO;QACrC,CAAC,CAAC,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS;YAC/C,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC;IAElB,MAAM,IAAI,GACR,QAAQ,CACN,MAAM,CAAC,IAAI,EACX,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAC1B;QACE,GAAG,IAAI;QACP,WAAW,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC;KAC3D,CACF,EACD,KAAK,CACN,IAAI,EAAE,CAAC;IAEV,MAAM,KAAK,GACT,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,YAAY,KAAK,OAAO,CAAC,CAAC;QAC7F,OAAO,CAAC,IAAI;QACd,CAAC,CAAC,SAAS,CAAC;IAEd,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE;QACxB,IAAI,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACjC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,WAAW,GAAwB,EAAE,CAAC;QAC5C,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAE,CAAC;QAEvC,gFAAgF;QAChF,kFAAkF;QAClF,EAAE;QACF,iFAAiF;QACjF,wEAAwE;QACxE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7B,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,CAC5D,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,CAC1C,CAAC;YACF,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM;YAEvC,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;gBAC3C,WAAW,CAAC,GAAG,CAAC;oBACd,QAAQ,CACN,MAAM,CAAC,MAAM,CAAC,EACd,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,EAAE,EACtE,IAAI,CACL,IAAI,EAAE,CAAC;gBACV,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC,EAAE,CAAC;IAEL,MAAM,QAAQ,GACZ,IAAI,KAAK,SAAS,CAAC,CAAC;QAClB,WAAW,CAAC,CAAC;YACX;gBACE,GAAG,IAAI;gBACP,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,WAAW;aACnC;YACH,CAAC,CAAC,IAAI;QACR,CAAC,CAAC,IAAI,CAAC,YAAY,KAAK,eAAe,CAAC,CAAC;YACvC;gBACE,GAAG,IAAI;gBACP,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;oBACrC;wBACE,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE;4BACrB,GAAG,WAAW;4BACd,0EAA0E;4BAC1E,oDAAoD;4BACpD,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;yBACvD;qBACF;oBACH,CAAC,CAAC,SAAS,CAAC;aACb;YACH,CAAC,CAAC;gBACE,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,IAAI,CAChG,GAAG,CACJ;gBACD,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE;oBACrB,GAAG,WAAW;oBACd,CAAC,IAAI,CAAC,EAAE,IAAI;iBACb;aACF,CAAC;IAEN,IAAI,IAAI,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;QAClC,QAAQ,CAAC,OAAO,GAAG,yCAAyC,CAAC;IAC/D,CAAC;SAAM,IAAI,IAAI,CAAC,MAAM,KAAK,mBAAmB,EAAE,CAAC;QAC/C,QAAQ,CAAC,OAAO,GAAG,+CAA+C,CAAC;IACrE,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAEF,OAAO,EAAE,eAAe,EAAE,CAAC"}
+{"version":3,"file":"zodToJsonSchema.mjs","sourceRoot":"","sources":["../../src/_vendor/zod-to-json-schema/zodToJsonSchema.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,QAAQ,EAAE,uBAAmB;AACtC,OAAO,EAAE,OAAO,EAAE,mBAAe;AACjC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,mBAAe;AAE5C,SAAS,mBAAmB,CAC1B,MAAe,EACf,IAAwB,EACxB,YAAoB;IAEpB,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,MAAM,CAAkB,CAAC;IACjE,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACzF,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;YAC3B,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,SAAS,CAAC,yBAAyB,GAAG,2BAA2B,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,KAAK,GAAY,UAAU,CAAC,KAAK,CAAC;QACxC,IAAI,GAAG,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;YACpD,MAAM,IAAI,SAAS,CAAC,yDAAyD,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;YAC/D,SAAS;QACX,CAAC;QAED,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,GAAG,EAAE;YAChC,YAAY,EAAE,IAAI;YAClB,UAAU,EAAE,IAAI;YAChB,KAAK;YACL,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;IACL,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IAClD,IAAI,CAAC,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,QAAQ,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,SAAS,CAAC,0CAA0C,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC3C,IAAI,UAA8B,CAAC;QACnC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,UAAU,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QACzD,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;QACD,MAAM,IAAI,KAAK,CACb,sDAAsD,UAAU,CAAC,CAAC,CAAC,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CACrG,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IAED,IAAI,IAAI,KAAK,SAAS,IAAI,YAAY,KAAK,eAAe,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IAED,OAAO,KAAwB,CAAC;AAClC,CAAC;AAED,MAAM,eAAe,GAAG,CACtB,MAAsB,EACtB,OAA2C,EAW3C,EAAE;IACF,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC1B,IAAI,CAAC,WAAW,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC7C,CAAC;IAED,IAAI,IAAwB,CAAC;IAC7B,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,IAAI,GAAG,OAAO,CAAC;IACjB,CAAC;SAAM,IAAI,OAAO,EAAE,YAAY,KAAK,OAAO,EAAE,CAAC;QAC7C,IAAI,GAAG,OAAO,EAAE,IAAI,CAAC;IACvB,CAAC;IAED,MAAM,MAAM,GACV,QAAQ,CACN,MAAM,CAAC,IAAI,EACX,IAAI,KAAK,SAAS;QAChB,CAAC,CAAC,IAAI;QACN,CAAC,CAAC;YACE,GAAG,IAAI;YACP,WAAW,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC;SAC3D,EACL,IAAI,CAAC,gBAAgB,KAAK,IAAI,CAC/B,IAAI,EAAE,CAAC;IACV,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAEnG,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAEpE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE;QACxB,IAAI,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACjC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,WAAW,GAAwB,EAAE,CAAC;QAC5C,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAE,CAAC;QAEvC,gFAAgF;QAChF,kFAAkF;QAClF,EAAE;QACF,iFAAiF;QACjF,wEAAwE;QACxE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7B,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,CAC5D,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,CAC1C,CAAC;YACF,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAChC,MAAM;YACR,CAAC;YAED,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;gBAC3C,WAAW,CAAC,GAAG,CAAC;oBACd,QAAQ,CACN,MAAM,CAAC,MAAM,CAAC,EACd,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,EAAE,EACtE,IAAI,CACL,IAAI,EAAE,CAAC;gBACV,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC,EAAE,CAAC;IAEL,IAAI,QAAoD,CAAC;IACzD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,QAAQ,GAAG,WAAW;YACpB,CAAC,CAAC;gBACE,GAAG,IAAI;gBACP,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,WAAW;aACnC;YACH,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;SAAM,IAAI,IAAI,CAAC,YAAY,KAAK,eAAe,EAAE,CAAC;QACjD,QAAQ,GAAG;YACT,GAAG,IAAI;YACP,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI;gBACnC,CAAC,CAAC;oBACE,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE;wBACrB,GAAG,WAAW;wBACd,0EAA0E;wBAC1E,oDAAoD;wBACpD,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;qBACvD;iBACF;gBACH,CAAC,CAAC,SAAS,CAAC;SACf,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG;YACT,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACvG,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE;gBACrB,GAAG,WAAW;gBACd,CAAC,IAAI,CAAC,EAAE,IAAI;aACb;SACF,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;QAClC,QAAQ,CAAC,OAAO,GAAG,yCAAyC,CAAC;IAC/D,CAAC;SAAM,IAAI,IAAI,CAAC,MAAM,KAAK,mBAAmB,EAAE,CAAC;QAC/C,QAAQ,CAAC,OAAO,GAAG,+CAA+C,CAAC;IACrE,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAEF,OAAO,EAAE,eAAe,EAAE,CAAC"}

package/auth/subject-token-providers.d.mts

@@ -1,19 +1,71 @@
 import type { SubjectTokenProvider } from "./types.mjs";
 import type { Fetch } from "../internal/builtin-types.mjs";
+/** Reads the UTF-8 contents of a Kubernetes service-account token file. */
 type ReadFile = (path: string) => Promise<string>;
+/**
+ * Reads a Kubernetes service-account JWT from its mounted token file.
+ *
+ * The file is read again for each token exchange so projected or rotated tokens
+ * are picked up automatically. The default reader requires Node.js filesystem
+ * access; provide `config.readFile` when using another compatible runtime.
+ *
+ * @param tokenPath Path to the token file; defaults to
+ * `/var/run/secrets/kubernetes.io/serviceaccount/token`.
+ * @param config Optional replacement for the default UTF-8 file reader.
+ * @returns A JWT subject-token provider suitable for `workloadIdentity.provider`.
+ * @throws {SubjectTokenProviderError} When the returned provider cannot read the
+ * token file or the file contains no token.
+ */
 export declare function k8sServiceAccountTokenProvider(tokenPath?: string, config?: {
+    /** Reads token-file contents; defaults to Node.js `fs/promises.readFile`. */
     readFile?: ReadFile;
 }): SubjectTokenProvider;
+/**
+ * Retrieves an Azure managed-identity access token from the Instance Metadata Service.
+ *
+ * Run this provider in an Azure-hosted workload that can reach the link-local
+ * metadata endpoint. Select a user-assigned identity with `objectId`, `clientId`,
+ * or `msiResId`; otherwise Azure selects the available managed identity.
+ *
+ * @param resource Azure resource identifier; defaults to
+ * `https://management.azure.com/`.
+ * @param config Managed-identity selection, metadata API version, request
+ * timeout, and optional `fetch` implementation.
+ * @returns A JWT subject-token provider suitable for `workloadIdentity.provider`.
+ * @throws {SubjectTokenProviderError} When the returned provider cannot retrieve
+ * an access token, the metadata response is invalid, or the request times out.
+ */
 export declare function azureManagedIdentityTokenProvider(resource?: string, config?: {
+    /** Object ID of the user-assigned managed identity to request. */
     objectId?: string;
+    /** Client ID of the user-assigned managed identity to request. */
     clientId?: string;
+    /** Azure resource ID of the user-assigned managed identity to request. */
     msiResId?: string;
+    /** Azure Instance Metadata Service API version; defaults to `2018-02-01`. */
     apiVersion?: string;
+    /** Metadata request timeout in milliseconds; defaults to 10,000. */
     timeout?: number;
+    /** Fetch implementation used for metadata requests; defaults to the runtime fetch. */
     fetch?: Fetch;
 }): SubjectTokenProvider;
+/**
+ * Retrieves a Google Cloud identity token from the default service account's metadata endpoint.
+ *
+ * Run this provider in a Google Cloud workload with access to its Compute Engine
+ * metadata server. A fresh identity token is requested for each token exchange.
+ *
+ * @param audience Intended identity-token audience; defaults to
+ * `https://api.openai.com/v1`.
+ * @param config Optional metadata request timeout and `fetch` implementation.
+ * @returns An identity-token subject-token provider for `workloadIdentity.provider`.
+ * @throws {SubjectTokenProviderError} When the returned provider cannot retrieve
+ * a nonempty identity token or the metadata request times out.
+ */
 export declare function gcpIDTokenProvider(audience?: string, config?: {
+    /** Metadata request timeout in milliseconds; defaults to 10,000. */
     timeout?: number;
+    /** Fetch implementation used for metadata requests; defaults to the runtime fetch. */
     fetch?: Fetch;
 }): SubjectTokenProvider;
 export {};

package/auth/subject-token-providers.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"subject-token-providers.d.mts","sourceRoot":"","sources":["../src/auth/subject-token-providers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,oBAAgB;AACpD,OAAO,KAAK,EAAE,KAAK,EAAE,sCAAkC;AAQvD,KAAK,QAAQ,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAclD,wBAAgB,8BAA8B,CAC5C,SAAS,GAAE,MAA8D,EACzE,MAAM,CAAC,EAAE;IACP,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB,GACA,oBAAoB,CAiCtB;AAED,wBAAgB,iCAAiC,CAC/C,QAAQ,GAAE,MAAyB,EACnC,MAAM,CAAC,EAAE;IACP,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,GACA,oBAAoB,CA4DtB;AAED,wBAAgB,kBAAkB,CAChC,QAAQ,GAAE,MAAoC,EAC9C,MAAM,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAE,GAC3C,oBAAoB,CA8CtB"}
+{"version":3,"file":"subject-token-providers.d.mts","sourceRoot":"","sources":["../src/auth/subject-token-providers.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,oBAAgB;AACpD,OAAO,KAAK,EAAE,KAAK,EAAE,sCAAkC;AAQvD,2EAA2E;AAC3E,KAAK,QAAQ,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAclD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,8BAA8B,CAC5C,SAAS,SAAwD,EACjE,MAAM,CAAC,EAAE;IACP,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB,GACA,oBAAoB,CAiCtB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iCAAiC,CAC/C,QAAQ,GAAE,MAAyB,EACnC,MAAM,CAAC,EAAE;IACP,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,sFAAsF;IACtF,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,GACA,oBAAoB,CA4DtB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,SAA8B,EACtC,MAAM,CAAC,EAAE;IACP,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,sFAAsF;IACtF,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,GACA,oBAAoB,CA+CtB"}

package/auth/subject-token-providers.d.ts

@@ -1,19 +1,71 @@
 import type { SubjectTokenProvider } from "./types.js";
 import type { Fetch } from "../internal/builtin-types.js";
+/** Reads the UTF-8 contents of a Kubernetes service-account token file. */
 type ReadFile = (path: string) => Promise<string>;
+/**
+ * Reads a Kubernetes service-account JWT from its mounted token file.
+ *
+ * The file is read again for each token exchange so projected or rotated tokens
+ * are picked up automatically. The default reader requires Node.js filesystem
+ * access; provide `config.readFile` when using another compatible runtime.
+ *
+ * @param tokenPath Path to the token file; defaults to
+ * `/var/run/secrets/kubernetes.io/serviceaccount/token`.
+ * @param config Optional replacement for the default UTF-8 file reader.
+ * @returns A JWT subject-token provider suitable for `workloadIdentity.provider`.
+ * @throws {SubjectTokenProviderError} When the returned provider cannot read the
+ * token file or the file contains no token.
+ */
 export declare function k8sServiceAccountTokenProvider(tokenPath?: string, config?: {
+    /** Reads token-file contents; defaults to Node.js `fs/promises.readFile`. */
     readFile?: ReadFile;
 }): SubjectTokenProvider;
+/**
+ * Retrieves an Azure managed-identity access token from the Instance Metadata Service.
+ *
+ * Run this provider in an Azure-hosted workload that can reach the link-local
+ * metadata endpoint. Select a user-assigned identity with `objectId`, `clientId`,
+ * or `msiResId`; otherwise Azure selects the available managed identity.
+ *
+ * @param resource Azure resource identifier; defaults to
+ * `https://management.azure.com/`.
+ * @param config Managed-identity selection, metadata API version, request
+ * timeout, and optional `fetch` implementation.
+ * @returns A JWT subject-token provider suitable for `workloadIdentity.provider`.
+ * @throws {SubjectTokenProviderError} When the returned provider cannot retrieve
+ * an access token, the metadata response is invalid, or the request times out.
+ */
 export declare function azureManagedIdentityTokenProvider(resource?: string, config?: {
+    /** Object ID of the user-assigned managed identity to request. */
     objectId?: string;
+    /** Client ID of the user-assigned managed identity to request. */
     clientId?: string;
+    /** Azure resource ID of the user-assigned managed identity to request. */
     msiResId?: string;
+    /** Azure Instance Metadata Service API version; defaults to `2018-02-01`. */
     apiVersion?: string;
+    /** Metadata request timeout in milliseconds; defaults to 10,000. */
     timeout?: number;
+    /** Fetch implementation used for metadata requests; defaults to the runtime fetch. */
     fetch?: Fetch;
 }): SubjectTokenProvider;
+/**
+ * Retrieves a Google Cloud identity token from the default service account's metadata endpoint.
+ *
+ * Run this provider in a Google Cloud workload with access to its Compute Engine
+ * metadata server. A fresh identity token is requested for each token exchange.
+ *
+ * @param audience Intended identity-token audience; defaults to
+ * `https://api.openai.com/v1`.
+ * @param config Optional metadata request timeout and `fetch` implementation.
+ * @returns An identity-token subject-token provider for `workloadIdentity.provider`.
+ * @throws {SubjectTokenProviderError} When the returned provider cannot retrieve
+ * a nonempty identity token or the metadata request times out.
+ */
 export declare function gcpIDTokenProvider(audience?: string, config?: {
+    /** Metadata request timeout in milliseconds; defaults to 10,000. */
     timeout?: number;
+    /** Fetch implementation used for metadata requests; defaults to the runtime fetch. */
     fetch?: Fetch;
 }): SubjectTokenProvider;
 export {};

package/auth/subject-token-providers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subject-token-providers.d.ts","sourceRoot":"","sources":["../src/auth/subject-token-providers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,mBAAgB;AACpD,OAAO,KAAK,EAAE,KAAK,EAAE,qCAAkC;AAQvD,KAAK,QAAQ,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAclD,wBAAgB,8BAA8B,CAC5C,SAAS,GAAE,MAA8D,EACzE,MAAM,CAAC,EAAE;IACP,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB,GACA,oBAAoB,CAiCtB;AAED,wBAAgB,iCAAiC,CAC/C,QAAQ,GAAE,MAAyB,EACnC,MAAM,CAAC,EAAE;IACP,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,GACA,oBAAoB,CA4DtB;AAED,wBAAgB,kBAAkB,CAChC,QAAQ,GAAE,MAAoC,EAC9C,MAAM,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAE,GAC3C,oBAAoB,CA8CtB"}
+{"version":3,"file":"subject-token-providers.d.ts","sourceRoot":"","sources":["../src/auth/subject-token-providers.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,mBAAgB;AACpD,OAAO,KAAK,EAAE,KAAK,EAAE,qCAAkC;AAQvD,2EAA2E;AAC3E,KAAK,QAAQ,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAclD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,8BAA8B,CAC5C,SAAS,SAAwD,EACjE,MAAM,CAAC,EAAE;IACP,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB,GACA,oBAAoB,CAiCtB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iCAAiC,CAC/C,QAAQ,GAAE,MAAyB,EACnC,MAAM,CAAC,EAAE;IACP,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,sFAAsF;IACtF,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,GACA,oBAAoB,CA4DtB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,SAA8B,EACtC,MAAM,CAAC,EAAE;IACP,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,sFAAsF;IACtF,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,GACA,oBAAoB,CA+CtB"}

package/auth/subject-token-providers.js

@@ -11,13 +11,27 @@ const DEFAULT_AZURE_API_VERSION = '2018-02-01';
 const AZURE_IMDS_BASE_URL = 'http://169.254.169.254/metadata/identity/oauth2/token';
 let fsPromisesModule;
 async function defaultReadFile(path) {
-    fsPromisesModule ?? (fsPromisesModule = Promise.resolve().then(() => tslib_1.__importStar(require('fs/promises'))).catch((error) => {
+    fsPromisesModule ?? (fsPromisesModule = Promise.resolve().then(() => tslib_1.__importStar(require('node:fs/promises'))).catch((error) => {
         fsPromisesModule = undefined;
         throw error;
     }));
     const { readFile } = await fsPromisesModule;
-    return readFile(path, 'utf8');
+    return readFile(path, 'utf-8');
 }
+/**
+ * Reads a Kubernetes service-account JWT from its mounted token file.
+ *
+ * The file is read again for each token exchange so projected or rotated tokens
+ * are picked up automatically. The default reader requires Node.js filesystem
+ * access; provide `config.readFile` when using another compatible runtime.
+ *
+ * @param tokenPath Path to the token file; defaults to
+ * `/var/run/secrets/kubernetes.io/serviceaccount/token`.
+ * @param config Optional replacement for the default UTF-8 file reader.
+ * @returns A JWT subject-token provider suitable for `workloadIdentity.provider`.
+ * @throws {SubjectTokenProviderError} When the returned provider cannot read the
+ * token file or the file contains no token.
+ */
 function k8sServiceAccountTokenProvider(tokenPath = '/var/run/secrets/kubernetes.io/serviceaccount/token', config) {
     const readFile = config?.readFile ?? defaultReadFile;
     return {
@@ -41,6 +55,21 @@ function k8sServiceAccountTokenProvider(tokenPath = '/var/run/secrets/kubernetes
         },
     };
 }
+/**
+ * Retrieves an Azure managed-identity access token from the Instance Metadata Service.
+ *
+ * Run this provider in an Azure-hosted workload that can reach the link-local
+ * metadata endpoint. Select a user-assigned identity with `objectId`, `clientId`,
+ * or `msiResId`; otherwise Azure selects the available managed identity.
+ *
+ * @param resource Azure resource identifier; defaults to
+ * `https://management.azure.com/`.
+ * @param config Managed-identity selection, metadata API version, request
+ * timeout, and optional `fetch` implementation.
+ * @returns A JWT subject-token provider suitable for `workloadIdentity.provider`.
+ * @throws {SubjectTokenProviderError} When the returned provider cannot retrieve
+ * an access token, the metadata response is invalid, or the request times out.
+ */
 function azureManagedIdentityTokenProvider(resource = DEFAULT_RESOURCE, config) {
     const apiVersion = config?.apiVersion ?? DEFAULT_AZURE_API_VERSION;
     const timeout = config?.timeout ?? 10000;
@@ -89,6 +118,19 @@ function azureManagedIdentityTokenProvider(resource = DEFAULT_RESOURCE, config)
         },
     };
 }
+/**
+ * Retrieves a Google Cloud identity token from the default service account's metadata endpoint.
+ *
+ * Run this provider in a Google Cloud workload with access to its Compute Engine
+ * metadata server. A fresh identity token is requested for each token exchange.
+ *
+ * @param audience Intended identity-token audience; defaults to
+ * `https://api.openai.com/v1`.
+ * @param config Optional metadata request timeout and `fetch` implementation.
+ * @returns An identity-token subject-token provider for `workloadIdentity.provider`.
+ * @throws {SubjectTokenProviderError} When the returned provider cannot retrieve
+ * a nonempty identity token or the metadata request times out.
+ */
 function gcpIDTokenProvider(audience = 'https://api.openai.com/v1', config) {
     const timeout = config?.timeout || 10000;
     return {
@@ -109,7 +151,8 @@ function gcpIDTokenProvider(audience = 'https://api.openai.com/v1', config) {
                     const errorText = await response.text();
                     throw new Error(`GCP Metadata Server returned ${response.status}: ${errorText}`);
                 }
-                const token = (await response.text()).trim();
+                const tokenText = await response.text();
+                const token = tokenText.trim();
                 if (!token) {
                     throw new Error('GCP metadata server returned an empty token');
                 }

package/auth/subject-token-providers.js.map

@@ -1 +1 @@
-{"version":3,"file":"subject-token-providers.js","sourceRoot":"","sources":["../src/auth/subject-token-providers.ts"],"names":[],"mappings":";;AAuBA,wEAsCC;AAED,8EAsEC;AAED,gDAiDC;;AAtLD,oEAA2C;AAC3C,4CAA0D;AAE1D,MAAM,gBAAgB,GAAG,+BAA+B,CAAC;AACzD,MAAM,yBAAyB,GAAG,YAAY,CAAC;AAC/C,MAAM,mBAAmB,GAAG,uDAAuD,CAAC;AAIpF,IAAI,gBAAwE,CAAC;AAE7E,KAAK,UAAU,eAAe,CAAC,IAAY;IACzC,gBAAgB,KAAhB,gBAAgB,GAAK,0DAAO,aAAa,IAAE,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QACzD,gBAAgB,GAAG,SAAS,CAAC;QAC7B,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,EAAC;IAEH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,gBAAgB,CAAC;IAC5C,OAAO,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,SAAgB,8BAA8B,CAC5C,YAAoB,qDAAqD,EACzE,MAEC;IAED,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,eAAe,CAAC;IAErD,OAAO;QACL,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,KAAK,IAAqB,EAAE;YACpC,IAAI,QAAgB,CAAC;YAErB,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;YACvC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,iCAAyB,EAAE,CAAC;oBAC/C,MAAM,KAAK,CAAC;gBACd,CAAC;gBAED,MAAM,IAAI,iCAAyB,CACjC,wDAAwD,SAAS,KAC/D,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,EACF,YAAY,EACZ,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC3C,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;YAE9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,iCAAyB,CAAC,qBAAqB,SAAS,YAAY,EAAE,YAAY,CAAC,CAAC;YAChG,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,iCAAiC,CAC/C,WAAmB,gBAAgB,EACnC,MAOC;IAED,MAAM,UAAU,GAAG,MAAM,EAAE,UAAU,IAAI,yBAAyB,CAAC;IACnE,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC;IAEzC,OAAO;QACL,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,KAAK,IAAqB,EAAE;YACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,CAAC;YACzC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;YAChD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAE3C,IAAI,MAAM,EAAE,QAAQ,EAAE,CAAC;gBACrB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YACrD,CAAC;YACD,IAAI,MAAM,EAAE,QAAQ,EAAE,CAAC;gBACrB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YACrD,CAAC;YACD,IAAI,MAAM,EAAE,QAAQ,EAAE,CAAC;gBACrB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YACtD,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;YAEhE,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;oBAChF,OAAO,EAAE;wBACP,QAAQ,EAAE,MAAM;qBACjB;oBACD,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;gBAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,MAAM,IAAI,iCAAyB,CACjC,iDAAiD,QAAQ,CAAC,MAAM,EAAE,EAClE,YAAY,CACb,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA8B,CAAC;gBAElE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;oBACvB,MAAM,IAAI,iCAAyB,CAAC,4CAA4C,EAAE,YAAY,CAAC,CAAC;gBAClG,CAAC;gBAED,OAAO,IAAI,CAAC,YAAY,CAAC;YAC3B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,iCAAyB,EAAE,CAAC;oBAC/C,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM,IAAI,iCAAyB,CACjC,iCAAiC,EACjC,YAAY,EACZ,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC3C,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,SAAS,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,kBAAkB,CAChC,WAAmB,2BAA2B,EAC9C,MAA4C;IAE5C,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC;IAEzC,OAAO;QACL,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,KAAK,IAAqB,EAAE;YACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CACjB,+FAA+F,CAChG,CAAC;YACF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAE3C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;YAEhE,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;oBAChF,OAAO,EAAE;wBACP,iBAAiB,EAAE,QAAQ;qBAC5B;oBACD,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;gBAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;oBACxC,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC,CAAC;gBACnF,CAAC;gBAED,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;gBACjE,CAAC;gBAED,OAAO,KAAK,CAAC;YACf,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,iCAAyB,CACjC,mDACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,EACF,cAAc,EACd,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC3C,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,SAAS,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"subject-token-providers.js","sourceRoot":"","sources":["../src/auth/subject-token-providers.ts"],"names":[],"mappings":";;AAuCA,wEAuCC;AAiBD,8EAiFC;AAeD,gDAwDC;;AApPD,oEAA2C;AAC3C,4CAA0D;AAE1D,MAAM,gBAAgB,GAAG,+BAA+B,CAAC;AACzD,MAAM,yBAAyB,GAAG,YAAY,CAAC;AAC/C,MAAM,mBAAmB,GAAG,uDAAuD,CAAC;AAKpF,IAAI,gBAAwD,CAAC;AAE7D,KAAK,UAAU,eAAe,CAAC,IAAY;IACzC,gBAAgB,KAAhB,gBAAgB,GAAK,0DAAO,kBAAkB,IAAE,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QAC9D,gBAAgB,GAAG,SAAS,CAAC;QAC7B,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,EAAC;IAEH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,gBAAgB,CAAC;IAC5C,OAAO,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAgB,8BAA8B,CAC5C,SAAS,GAAG,qDAAqD,EACjE,MAGC;IAED,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,eAAe,CAAC;IAErD,OAAO;QACL,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,KAAK,IAAqB,EAAE;YACpC,IAAI,QAAgB,CAAC;YAErB,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;YACvC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,iCAAyB,EAAE,CAAC;oBAC/C,MAAM,KAAK,CAAC;gBACd,CAAC;gBAED,MAAM,IAAI,iCAAyB,CACjC,wDAAwD,SAAS,KAC/D,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,EACF,YAAY,EACZ,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC3C,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;YAE9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,iCAAyB,CAAC,qBAAqB,SAAS,YAAY,EAAE,YAAY,CAAC,CAAC;YAChG,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAgB,iCAAiC,CAC/C,WAAmB,gBAAgB,EACnC,MAkBC;IAED,MAAM,UAAU,GAAG,MAAM,EAAE,UAAU,IAAI,yBAAyB,CAAC;IACnE,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,KAAM,CAAC;IAE1C,OAAO;QACL,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,KAAK,IAAqB,EAAE;YACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,CAAC;YACzC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;YAChD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAE3C,IAAI,MAAM,EAAE,QAAQ,EAAE,CAAC;gBACrB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YACrD,CAAC;YACD,IAAI,MAAM,EAAE,QAAQ,EAAE,CAAC;gBACrB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YACrD,CAAC;YACD,IAAI,MAAM,EAAE,QAAQ,EAAE,CAAC;gBACrB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YACtD,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;YAEhE,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;oBAChF,OAAO,EAAE;wBACP,QAAQ,EAAE,MAAM;qBACjB;oBACD,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;gBAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,MAAM,IAAI,iCAAyB,CACjC,iDAAiD,QAAQ,CAAC,MAAM,EAAE,EAClE,YAAY,CACb,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA8B,CAAC;gBAElE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;oBACvB,MAAM,IAAI,iCAAyB,CAAC,4CAA4C,EAAE,YAAY,CAAC,CAAC;gBAClG,CAAC;gBAED,OAAO,IAAI,CAAC,YAAY,CAAC;YAC3B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,iCAAyB,EAAE,CAAC;oBAC/C,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM,IAAI,iCAAyB,CACjC,iCAAiC,EACjC,YAAY,EACZ,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC3C,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,SAAS,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAgB,kBAAkB,CAChC,QAAQ,GAAG,2BAA2B,EACtC,MAMC;IAED,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,KAAM,CAAC;IAE1C,OAAO;QACL,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,KAAK,IAAqB,EAAE;YACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CACjB,+FAA+F,CAChG,CAAC;YACF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAE3C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;YAEhE,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;oBAChF,OAAO,EAAE;wBACP,iBAAiB,EAAE,QAAQ;qBAC5B;oBACD,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;gBAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;oBACxC,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC,CAAC;gBACnF,CAAC;gBAED,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACxC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;gBAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;gBACjE,CAAC;gBAED,OAAO,KAAK,CAAC;YACf,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,iCAAyB,CACjC,mDACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,EACF,cAAc,EACd,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC3C,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,SAAS,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/auth/subject-token-providers.mjs

@@ -5,13 +5,27 @@ const DEFAULT_AZURE_API_VERSION = '2018-02-01';
 const AZURE_IMDS_BASE_URL = 'http://169.254.169.254/metadata/identity/oauth2/token';
 let fsPromisesModule;
 async function defaultReadFile(path) {
-    fsPromisesModule ?? (fsPromisesModule = import('fs/promises').catch((error) => {
+    fsPromisesModule ?? (fsPromisesModule = import('node:fs/promises').catch((error) => {
         fsPromisesModule = undefined;
         throw error;
     }));
     const { readFile } = await fsPromisesModule;
-    return readFile(path, 'utf8');
+    return readFile(path, 'utf-8');
 }
+/**
+ * Reads a Kubernetes service-account JWT from its mounted token file.
+ *
+ * The file is read again for each token exchange so projected or rotated tokens
+ * are picked up automatically. The default reader requires Node.js filesystem
+ * access; provide `config.readFile` when using another compatible runtime.
+ *
+ * @param tokenPath Path to the token file; defaults to
+ * `/var/run/secrets/kubernetes.io/serviceaccount/token`.
+ * @param config Optional replacement for the default UTF-8 file reader.
+ * @returns A JWT subject-token provider suitable for `workloadIdentity.provider`.
+ * @throws {SubjectTokenProviderError} When the returned provider cannot read the
+ * token file or the file contains no token.
+ */
 export function k8sServiceAccountTokenProvider(tokenPath = '/var/run/secrets/kubernetes.io/serviceaccount/token', config) {
     const readFile = config?.readFile ?? defaultReadFile;
     return {
@@ -35,6 +49,21 @@ export function k8sServiceAccountTokenProvider(tokenPath = '/var/run/secrets/kub
         },
     };
 }
+/**
+ * Retrieves an Azure managed-identity access token from the Instance Metadata Service.
+ *
+ * Run this provider in an Azure-hosted workload that can reach the link-local
+ * metadata endpoint. Select a user-assigned identity with `objectId`, `clientId`,
+ * or `msiResId`; otherwise Azure selects the available managed identity.
+ *
+ * @param resource Azure resource identifier; defaults to
+ * `https://management.azure.com/`.
+ * @param config Managed-identity selection, metadata API version, request
+ * timeout, and optional `fetch` implementation.
+ * @returns A JWT subject-token provider suitable for `workloadIdentity.provider`.
+ * @throws {SubjectTokenProviderError} When the returned provider cannot retrieve
+ * an access token, the metadata response is invalid, or the request times out.
+ */
 export function azureManagedIdentityTokenProvider(resource = DEFAULT_RESOURCE, config) {
     const apiVersion = config?.apiVersion ?? DEFAULT_AZURE_API_VERSION;
     const timeout = config?.timeout ?? 10000;
@@ -83,6 +112,19 @@ export function azureManagedIdentityTokenProvider(resource = DEFAULT_RESOURCE, c
         },
     };
 }
+/**
+ * Retrieves a Google Cloud identity token from the default service account's metadata endpoint.
+ *
+ * Run this provider in a Google Cloud workload with access to its Compute Engine
+ * metadata server. A fresh identity token is requested for each token exchange.
+ *
+ * @param audience Intended identity-token audience; defaults to
+ * `https://api.openai.com/v1`.
+ * @param config Optional metadata request timeout and `fetch` implementation.
+ * @returns An identity-token subject-token provider for `workloadIdentity.provider`.
+ * @throws {SubjectTokenProviderError} When the returned provider cannot retrieve
+ * a nonempty identity token or the metadata request times out.
+ */
 export function gcpIDTokenProvider(audience = 'https://api.openai.com/v1', config) {
     const timeout = config?.timeout || 10000;
     return {
@@ -103,7 +145,8 @@ export function gcpIDTokenProvider(audience = 'https://api.openai.com/v1', confi
                     const errorText = await response.text();
                     throw new Error(`GCP Metadata Server returned ${response.status}: ${errorText}`);
                 }
-                const token = (await response.text()).trim();
+                const tokenText = await response.text();
+                const token = tokenText.trim();
                 if (!token) {
                     throw new Error('GCP metadata server returned an empty token');
                 }

package/auth/subject-token-providers.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"subject-token-providers.mjs","sourceRoot":"","sources":["../src/auth/subject-token-providers.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,KAAK,8BAA0B;AAC3C,OAAO,EAAE,yBAAyB,EAAE,0BAAsB;AAE1D,MAAM,gBAAgB,GAAG,+BAA+B,CAAC;AACzD,MAAM,yBAAyB,GAAG,YAAY,CAAC;AAC/C,MAAM,mBAAmB,GAAG,uDAAuD,CAAC;AAIpF,IAAI,gBAAwE,CAAC;AAE7E,KAAK,UAAU,eAAe,CAAC,IAAY;IACzC,gBAAgB,KAAhB,gBAAgB,GAAK,MAAM,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QACzD,gBAAgB,GAAG,SAAS,CAAC;QAC7B,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,EAAC;IAEH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,gBAAgB,CAAC;IAC5C,OAAO,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,YAAoB,qDAAqD,EACzE,MAEC;IAED,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,eAAe,CAAC;IAErD,OAAO;QACL,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,KAAK,IAAqB,EAAE;YACpC,IAAI,QAAgB,CAAC;YAErB,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;YACvC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,yBAAyB,EAAE,CAAC;oBAC/C,MAAM,KAAK,CAAC;gBACd,CAAC;gBAED,MAAM,IAAI,yBAAyB,CACjC,wDAAwD,SAAS,KAC/D,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,EACF,YAAY,EACZ,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC3C,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;YAE9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,yBAAyB,CAAC,qBAAqB,SAAS,YAAY,EAAE,YAAY,CAAC,CAAC;YAChG,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,WAAmB,gBAAgB,EACnC,MAOC;IAED,MAAM,UAAU,GAAG,MAAM,EAAE,UAAU,IAAI,yBAAyB,CAAC;IACnE,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC;IAEzC,OAAO;QACL,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,KAAK,IAAqB,EAAE;YACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,CAAC;YACzC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;YAChD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAE3C,IAAI,MAAM,EAAE,QAAQ,EAAE,CAAC;gBACrB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YACrD,CAAC;YACD,IAAI,MAAM,EAAE,QAAQ,EAAE,CAAC;gBACrB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YACrD,CAAC;YACD,IAAI,MAAM,EAAE,QAAQ,EAAE,CAAC;gBACrB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YACtD,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;YAEhE,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;oBAChF,OAAO,EAAE;wBACP,QAAQ,EAAE,MAAM;qBACjB;oBACD,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;gBAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,MAAM,IAAI,yBAAyB,CACjC,iDAAiD,QAAQ,CAAC,MAAM,EAAE,EAClE,YAAY,CACb,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA8B,CAAC;gBAElE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;oBACvB,MAAM,IAAI,yBAAyB,CAAC,4CAA4C,EAAE,YAAY,CAAC,CAAC;gBAClG,CAAC;gBAED,OAAO,IAAI,CAAC,YAAY,CAAC;YAC3B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,yBAAyB,EAAE,CAAC;oBAC/C,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM,IAAI,yBAAyB,CACjC,iCAAiC,EACjC,YAAY,EACZ,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC3C,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,SAAS,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,WAAmB,2BAA2B,EAC9C,MAA4C;IAE5C,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC;IAEzC,OAAO;QACL,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,KAAK,IAAqB,EAAE;YACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CACjB,+FAA+F,CAChG,CAAC;YACF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAE3C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;YAEhE,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;oBAChF,OAAO,EAAE;wBACP,iBAAiB,EAAE,QAAQ;qBAC5B;oBACD,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;gBAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;oBACxC,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC,CAAC;gBACnF,CAAC;gBAED,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;gBACjE,CAAC;gBAED,OAAO,KAAK,CAAC;YACf,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,yBAAyB,CACjC,mDACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,EACF,cAAc,EACd,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC3C,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,SAAS,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"subject-token-providers.mjs","sourceRoot":"","sources":["../src/auth/subject-token-providers.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,KAAK,8BAA0B;AAC3C,OAAO,EAAE,yBAAyB,EAAE,0BAAsB;AAE1D,MAAM,gBAAgB,GAAG,+BAA+B,CAAC;AACzD,MAAM,yBAAyB,GAAG,YAAY,CAAC;AAC/C,MAAM,mBAAmB,GAAG,uDAAuD,CAAC;AAKpF,IAAI,gBAAwD,CAAC;AAE7D,KAAK,UAAU,eAAe,CAAC,IAAY;IACzC,gBAAgB,KAAhB,gBAAgB,GAAK,MAAM,CAAC,kBAAkB,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QAC9D,gBAAgB,GAAG,SAAS,CAAC;QAC7B,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,EAAC;IAEH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,gBAAgB,CAAC;IAC5C,OAAO,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,8BAA8B,CAC5C,SAAS,GAAG,qDAAqD,EACjE,MAGC;IAED,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,eAAe,CAAC;IAErD,OAAO;QACL,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,KAAK,IAAqB,EAAE;YACpC,IAAI,QAAgB,CAAC;YAErB,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;YACvC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,yBAAyB,EAAE,CAAC;oBAC/C,MAAM,KAAK,CAAC;gBACd,CAAC;gBAED,MAAM,IAAI,yBAAyB,CACjC,wDAAwD,SAAS,KAC/D,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,EACF,YAAY,EACZ,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC3C,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;YAE9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,yBAAyB,CAAC,qBAAqB,SAAS,YAAY,EAAE,YAAY,CAAC,CAAC;YAChG,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iCAAiC,CAC/C,WAAmB,gBAAgB,EACnC,MAkBC;IAED,MAAM,UAAU,GAAG,MAAM,EAAE,UAAU,IAAI,yBAAyB,CAAC;IACnE,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,KAAM,CAAC;IAE1C,OAAO;QACL,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,KAAK,IAAqB,EAAE;YACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,CAAC;YACzC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;YAChD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAE3C,IAAI,MAAM,EAAE,QAAQ,EAAE,CAAC;gBACrB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YACrD,CAAC;YACD,IAAI,MAAM,EAAE,QAAQ,EAAE,CAAC;gBACrB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YACrD,CAAC;YACD,IAAI,MAAM,EAAE,QAAQ,EAAE,CAAC;gBACrB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YACtD,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;YAEhE,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;oBAChF,OAAO,EAAE;wBACP,QAAQ,EAAE,MAAM;qBACjB;oBACD,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;gBAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,MAAM,IAAI,yBAAyB,CACjC,iDAAiD,QAAQ,CAAC,MAAM,EAAE,EAClE,YAAY,CACb,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA8B,CAAC;gBAElE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;oBACvB,MAAM,IAAI,yBAAyB,CAAC,4CAA4C,EAAE,YAAY,CAAC,CAAC;gBAClG,CAAC;gBAED,OAAO,IAAI,CAAC,YAAY,CAAC;YAC3B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,yBAAyB,EAAE,CAAC;oBAC/C,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM,IAAI,yBAAyB,CACjC,iCAAiC,EACjC,YAAY,EACZ,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC3C,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,SAAS,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAQ,GAAG,2BAA2B,EACtC,MAMC;IAED,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,KAAM,CAAC;IAE1C,OAAO;QACL,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,KAAK,IAAqB,EAAE;YACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CACjB,+FAA+F,CAChG,CAAC;YACF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAE3C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;YAEhE,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;oBAChF,OAAO,EAAE;wBACP,iBAAiB,EAAE,QAAQ;qBAC5B;oBACD,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;gBAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;oBACxC,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC,CAAC;gBACnF,CAAC;gBAED,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACxC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;gBAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;gBACjE,CAAC;gBAED,OAAO,KAAK,CAAC;YACf,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,yBAAyB,CACjC,mDACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,EACF,cAAc,EACd,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC3C,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,SAAS,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/auth/types.d.mts

@@ -1,23 +1,32 @@
+/** Supplies a fresh external identity token for an OpenAI workload-identity exchange. */
 export interface SubjectTokenProvider {
+    /** Whether the provider returns a signed JWT or an OpenID Connect identity token. */
     tokenType: 'jwt' | 'id';
+    /** Returns a fresh subject token whenever the SDK needs to exchange or refresh its access token. */
     getToken: () => Promise<string>;
 }
+/** Configures federation from an external workload identity into an OpenAI service account. */
 export interface WorkloadIdentity {
-    /**Optional client identifier for token exchange compatibility.*/
+    /** Optional OAuth client identifier included in the token-exchange request. */
     clientId?: string;
-    /**Identity provider resource id in WIFAPI.*/
+    /** Identifier of the OpenAI identity-provider resource that trusts the external workload. */
     identityProviderId: string;
-    /**OpenAI Service account id to bind the verified external identity to.*/
+    /** Identifier of the OpenAI service account that receives the verified external identity. */
     serviceAccountId: string;
-    /**The provider configuration for obtaining the subject token.*/
+    /** Provider that obtains the external subject token for each token exchange. */
     provider: SubjectTokenProvider;
-    /**Optional buffer time in seconds to refresh the OpenAI token before it expires. Defaults to 1200 seconds (20 minutes).*/
+    /** Seconds before expiration when access-token refresh begins; defaults to 1,200 seconds. */
     refreshBufferSeconds?: number;
 }
+/** OAuth token-exchange response returned by the OpenAI workload-identity endpoint. */
 export interface TokenExchangeResponse {
+    /** OpenAI access token to use as the request's bearer credential. */
     access_token: string;
+    /** OAuth token-type URN describing the issued access token. */
     issued_token_type: string;
+    /** Authorization scheme associated with the access token, normally `Bearer`. */
     token_type: string;
+    /** Token lifetime in seconds; the SDK assumes 3,600 seconds when omitted. */
     expires_in?: number;
 }
 //# sourceMappingURL=types.d.mts.map

package/auth/types.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.mts","sourceRoot":"","sources":["../src/auth/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,KAAK,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,gBAAgB;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,6CAA6C;IAC7C,kBAAkB,EAAE,MAAM,CAAC;IAE3B,yEAAyE;IACzE,gBAAgB,EAAE,MAAM,CAAC;IAEzB,gEAAgE;IAChE,QAAQ,EAAE,oBAAoB,CAAC;IAE/B,0HAA0H;IAC1H,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB"}
+{"version":3,"file":"types.d.mts","sourceRoot":"","sources":["../src/auth/types.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,MAAM,WAAW,oBAAoB;IACnC,qFAAqF;IACrF,SAAS,EAAE,KAAK,GAAG,IAAI,CAAC;IAExB,oGAAoG;IACpG,QAAQ,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CACjC;AAED,+FAA+F;AAC/F,MAAM,WAAW,gBAAgB;IAC/B,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,6FAA6F;IAC7F,kBAAkB,EAAE,MAAM,CAAC;IAE3B,6FAA6F;IAC7F,gBAAgB,EAAE,MAAM,CAAC;IAEzB,gFAAgF;IAChF,QAAQ,EAAE,oBAAoB,CAAC;IAE/B,6FAA6F;IAC7F,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,uFAAuF;AACvF,MAAM,WAAW,qBAAqB;IACpC,qEAAqE;IACrE,YAAY,EAAE,MAAM,CAAC;IAErB,+DAA+D;IAC/D,iBAAiB,EAAE,MAAM,CAAC;IAE1B,gFAAgF;IAChF,UAAU,EAAE,MAAM,CAAC;IAEnB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB"}