openai 7.4.0 → 7.6.0

package/auth/subject-token-providers.js

@@ -9,15 +9,149 @@ const error_1 = require("../core/error.js");
 const DEFAULT_RESOURCE = 'https://management.azure.com/';
 const DEFAULT_AZURE_API_VERSION = '2018-02-01';
 const AZURE_IMDS_BASE_URL = 'http://169.254.169.254/metadata/identity/oauth2/token';
+const MAX_AZURE_IMDS_JSON_ERROR_CAUSES = 32;
+const getOwnErrorDescriptor = Object.getOwnPropertyDescriptor;
+const getErrorPrototype = Object.getPrototypeOf;
+const errorObjectToString = Object.prototype.toString;
+const errorFunctionToString = Function.prototype.toString;
+const nativeErrorSource = errorFunctionToString.call(Error);
+const nativeSyntaxErrorSource = errorFunctionToString.call(SyntaxError);
+const nativeErrorBrandDescriptor = getOwnErrorDescriptor(Error, 'isError');
+const nativeErrorBrand = nativeErrorBrandDescriptor &&
+    'value' in nativeErrorBrandDescriptor &&
+    typeof nativeErrorBrandDescriptor.value === 'function'
+    ? nativeErrorBrandDescriptor.value
+    : undefined;
+function hasNativeErrorPrototype(prototype, kind) {
+    const name = getOwnErrorDescriptor(prototype, 'name');
+    const constructor = getOwnErrorDescriptor(prototype, 'constructor');
+    if (!name ||
+        !('value' in name) ||
+        name.value !== kind ||
+        !constructor ||
+        !('value' in constructor) ||
+        typeof constructor.value !== 'function') {
+        return false;
+    }
+    const originalPrototype = getOwnErrorDescriptor(constructor.value, 'prototype');
+    const nativeSource = kind === 'Error' ? nativeErrorSource : nativeSyntaxErrorSource;
+    return Boolean(originalPrototype &&
+        'value' in originalPrototype &&
+        originalPrototype.value === prototype &&
+        errorFunctionToString.call(constructor.value) === nativeSource);
+}
+function classifyCrossRealmAzureError(error) {
+    try {
+        const prototypes = [];
+        let tagged = false;
+        for (let prototype = error; prototype !== null; prototype = getErrorPrototype(prototype)) {
+            if (prototypes.length >= MAX_AZURE_IMDS_JSON_ERROR_CAUSES) {
+                return 'unsafe';
+            }
+            prototypes.push(prototype);
+            if (!nativeErrorBrand && getOwnErrorDescriptor(prototype, Symbol.toStringTag)) {
+                tagged = true;
+            }
+        }
+        if (nativeErrorBrand
+            ? !nativeErrorBrand(error)
+            : !tagged && errorObjectToString.call(error) !== '[object Error]') {
+            return 'unknown';
+        }
+        let genericErrorPrototype = false;
+        for (let index = 1; index < prototypes.length; index += 1) {
+            const prototype = prototypes[index];
+            if (!prototype) {
+                return 'unsafe';
+            }
+            if (hasNativeErrorPrototype(prototype, 'SyntaxError')) {
+                return tagged ? 'unsafe' : 'syntax';
+            }
+            if (tagged && hasNativeErrorPrototype(prototype, 'Error')) {
+                genericErrorPrototype = true;
+            }
+        }
+        if (!tagged) {
+            return 'error';
+        }
+        return genericErrorPrototype ? 'tagged-wrapper' : 'unknown';
+    }
+    catch {
+        return 'unsafe';
+    }
+}
+function inspectAzureJSONErrorCause(error) {
+    const visited = new Set();
+    let current = error;
+    for (let depth = 0; depth < MAX_AZURE_IMDS_JSON_ERROR_CAUSES; depth += 1) {
+        if (current instanceof SyntaxError) {
+            return true;
+        }
+        if (typeof current !== 'object' || current === null) {
+            return false;
+        }
+        const kind = current instanceof Error ? 'error' : classifyCrossRealmAzureError(current);
+        if (kind === 'syntax' || kind === 'unsafe') {
+            return true;
+        }
+        if (kind !== 'error' && kind !== 'tagged-wrapper') {
+            return false;
+        }
+        if (kind === 'error') {
+            const parserType = getOwnErrorDescriptor(current, 'type');
+            if (parserType && 'value' in parserType && parserType.value === 'invalid-json') {
+                return true;
+            }
+        }
+        if (visited.has(current)) {
+            return true;
+        }
+        visited.add(current);
+        let cause;
+        try {
+            cause = getOwnErrorDescriptor(current, 'cause');
+        }
+        catch {
+            return true;
+        }
+        if (!cause || !('value' in cause)) {
+            return false;
+        }
+        current = cause.value;
+    }
+    return true;
+}
+function isMalformedAzureJSONError(error) {
+    try {
+        return inspectAzureJSONErrorCause(error);
+    }
+    catch {
+        return true;
+    }
+}
 let fsPromisesModule;
 async function defaultReadFile(path) {
-    fsPromisesModule ?? (fsPromisesModule = Promise.resolve().then(() => tslib_1.__importStar(require('fs/promises'))).catch((error) => {
+    fsPromisesModule ?? (fsPromisesModule = Promise.resolve().then(() => tslib_1.__importStar(require('node:fs/promises'))).catch((error) => {
         fsPromisesModule = undefined;
         throw error;
     }));
     const { readFile } = await fsPromisesModule;
-    return readFile(path, 'utf8');
+    return readFile(path, 'utf-8');
 }
+/**
+ * Reads a Kubernetes service-account JWT from its mounted token file.
+ *
+ * The file is read again for each token exchange so projected or rotated tokens
+ * are picked up automatically. The default reader requires Node.js filesystem
+ * access; provide `config.readFile` when using another compatible runtime.
+ *
+ * @param tokenPath Path to the token file; defaults to
+ * `/var/run/secrets/kubernetes.io/serviceaccount/token`.
+ * @param config Optional replacement for the default UTF-8 file reader.
+ * @returns A JWT subject-token provider suitable for `workloadIdentity.provider`.
+ * @throws {SubjectTokenProviderError} When the returned provider cannot read the
+ * token file or the file contains no token.
+ */
 function k8sServiceAccountTokenProvider(tokenPath = '/var/run/secrets/kubernetes.io/serviceaccount/token', config) {
     const readFile = config?.readFile ?? defaultReadFile;
     return {
@@ -41,6 +175,21 @@ function k8sServiceAccountTokenProvider(tokenPath = '/var/run/secrets/kubernetes
         },
     };
 }
+/**
+ * Retrieves an Azure managed-identity access token from the Instance Metadata Service.
+ *
+ * Run this provider in an Azure-hosted workload that can reach the link-local
+ * metadata endpoint. Select a user-assigned identity with `objectId`, `clientId`,
+ * or `msiResId`; otherwise Azure selects the available managed identity.
+ *
+ * @param resource Azure resource identifier; defaults to
+ * `https://management.azure.com/`.
+ * @param config Managed-identity selection, metadata API version, request
+ * timeout, and optional `fetch` implementation.
+ * @returns A JWT subject-token provider suitable for `workloadIdentity.provider`.
+ * @throws {SubjectTokenProviderError} When the returned provider cannot retrieve
+ * an access token, the metadata response is invalid, or the request times out.
+ */
 function azureManagedIdentityTokenProvider(resource = DEFAULT_RESOURCE, config) {
     const apiVersion = config?.apiVersion ?? DEFAULT_AZURE_API_VERSION;
     const timeout = config?.timeout ?? 10000;
@@ -69,9 +218,40 @@ function azureManagedIdentityTokenProvider(resource = DEFAULT_RESOURCE, config)
                     signal: controller.signal,
                 });
                 if (!response.ok) {
+                    let abortListener;
+                    try {
+                        // oxlint-disable-next-line promise/avoid-new -- AbortSignal is callback-only across supported runtimes.
+                        const requestAborted = new Promise((resolve) => {
+                            abortListener = () => resolve();
+                            if (controller.signal.aborted) {
+                                abortListener();
+                            }
+                            else {
+                                controller.signal.addEventListener('abort', abortListener, { once: true });
+                            }
+                        });
+                        await Promise.race([Shims.CancelReadableStream(response.body), requestAborted]);
+                    }
+                    catch {
+                        controller.abort();
+                    }
+                    finally {
+                        if (abortListener) {
+                            controller.signal.removeEventListener('abort', abortListener);
+                        }
+                    }
                     throw new error_1.SubjectTokenProviderError(`Failed to fetch token from Azure IMDS: status ${response.status}`, 'azure-imds');
                 }
-                const data = (await response.json());
+                let data;
+                try {
+                    data = (await response.json());
+                }
+                catch (error) {
+                    if (isMalformedAzureJSONError(error)) {
+                        throw new SyntaxError('IMDS response contains invalid JSON');
+                    }
+                    throw error;
+                }
                 if (!data.access_token) {
                     throw new error_1.SubjectTokenProviderError("IMDS response missing 'access_token' field", 'azure-imds');
                 }
@@ -89,8 +269,21 @@ function azureManagedIdentityTokenProvider(resource = DEFAULT_RESOURCE, config)
         },
     };
 }
+/**
+ * Retrieves a Google Cloud identity token from the default service account's metadata endpoint.
+ *
+ * Run this provider in a Google Cloud workload with access to its Compute Engine
+ * metadata server. A fresh identity token is requested for each token exchange.
+ *
+ * @param audience Intended identity-token audience; defaults to
+ * `https://api.openai.com/v1`.
+ * @param config Optional metadata request timeout and `fetch` implementation.
+ * @returns An identity-token subject-token provider for `workloadIdentity.provider`.
+ * @throws {SubjectTokenProviderError} When the returned provider cannot retrieve
+ * a nonempty identity token or the metadata request times out.
+ */
 function gcpIDTokenProvider(audience = 'https://api.openai.com/v1', config) {
-    const timeout = config?.timeout || 10000;
+    const timeout = config?.timeout ?? 10000;
     return {
         tokenType: 'id',
         getToken: async () => {
@@ -106,10 +299,32 @@ function gcpIDTokenProvider(audience = 'https://api.openai.com/v1', config) {
                     signal: controller.signal,
                 });
                 if (!response.ok) {
-                    const errorText = await response.text();
-                    throw new Error(`GCP Metadata Server returned ${response.status}: ${errorText}`);
+                    let abortListener;
+                    try {
+                        // oxlint-disable-next-line promise/avoid-new -- AbortSignal is callback-only across supported runtimes.
+                        const requestAborted = new Promise((resolve) => {
+                            abortListener = () => resolve();
+                            if (controller.signal.aborted) {
+                                abortListener();
+                            }
+                            else {
+                                controller.signal.addEventListener('abort', abortListener, { once: true });
+                            }
+                        });
+                        await Promise.race([Shims.CancelReadableStream(response.body), requestAborted]);
+                    }
+                    catch {
+                        controller.abort();
+                    }
+                    finally {
+                        if (abortListener) {
+                            controller.signal.removeEventListener('abort', abortListener);
+                        }
+                    }
+                    throw new Error(`GCP Metadata Server returned ${response.status}`);
                 }
-                const token = (await response.text()).trim();
+                const tokenText = await response.text();
+                const token = tokenText.trim();
                 if (!token) {
                     throw new Error('GCP metadata server returned an empty token');
                 }

package/auth/subject-token-providers.js.map

@@ -1 +1 @@
-{"version":3,"file":"subject-token-providers.js","sourceRoot":"","sources":["../src/auth/subject-token-providers.ts"],"names":[],"mappings":";;AAuBA,wEAsCC;AAED,8EAsEC;AAED,gDAiDC;;AAtLD,oEAA2C;AAC3C,4CAA0D;AAE1D,MAAM,gBAAgB,GAAG,+BAA+B,CAAC;AACzD,MAAM,yBAAyB,GAAG,YAAY,CAAC;AAC/C,MAAM,mBAAmB,GAAG,uDAAuD,CAAC;AAIpF,IAAI,gBAAwE,CAAC;AAE7E,KAAK,UAAU,eAAe,CAAC,IAAY;IACzC,gBAAgB,KAAhB,gBAAgB,GAAK,0DAAO,aAAa,IAAE,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QACzD,gBAAgB,GAAG,SAAS,CAAC;QAC7B,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,EAAC;IAEH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,gBAAgB,CAAC;IAC5C,OAAO,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,SAAgB,8BAA8B,CAC5C,YAAoB,qDAAqD,EACzE,MAEC;IAED,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,eAAe,CAAC;IAErD,OAAO;QACL,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,KAAK,IAAqB,EAAE;YACpC,IAAI,QAAgB,CAAC;YAErB,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;YACvC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,iCAAyB,EAAE,CAAC;oBAC/C,MAAM,KAAK,CAAC;gBACd,CAAC;gBAED,MAAM,IAAI,iCAAyB,CACjC,wDAAwD,SAAS,KAC/D,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,EACF,YAAY,EACZ,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC3C,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;YAE9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,iCAAyB,CAAC,qBAAqB,SAAS,YAAY,EAAE,YAAY,CAAC,CAAC;YAChG,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,iCAAiC,CAC/C,WAAmB,gBAAgB,EACnC,MAOC;IAED,MAAM,UAAU,GAAG,MAAM,EAAE,UAAU,IAAI,yBAAyB,CAAC;IACnE,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC;IAEzC,OAAO;QACL,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,KAAK,IAAqB,EAAE;YACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,CAAC;YACzC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;YAChD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAE3C,IAAI,MAAM,EAAE,QAAQ,EAAE,CAAC;gBACrB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YACrD,CAAC;YACD,IAAI,MAAM,EAAE,QAAQ,EAAE,CAAC;gBACrB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YACrD,CAAC;YACD,IAAI,MAAM,EAAE,QAAQ,EAAE,CAAC;gBACrB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YACtD,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;YAEhE,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;oBAChF,OAAO,EAAE;wBACP,QAAQ,EAAE,MAAM;qBACjB;oBACD,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;gBAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,MAAM,IAAI,iCAAyB,CACjC,iDAAiD,QAAQ,CAAC,MAAM,EAAE,EAClE,YAAY,CACb,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA8B,CAAC;gBAElE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;oBACvB,MAAM,IAAI,iCAAyB,CAAC,4CAA4C,EAAE,YAAY,CAAC,CAAC;gBAClG,CAAC;gBAED,OAAO,IAAI,CAAC,YAAY,CAAC;YAC3B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,iCAAyB,EAAE,CAAC;oBAC/C,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM,IAAI,iCAAyB,CACjC,iCAAiC,EACjC,YAAY,EACZ,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC3C,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,SAAS,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,kBAAkB,CAChC,WAAmB,2BAA2B,EAC9C,MAA4C;IAE5C,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC;IAEzC,OAAO;QACL,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,KAAK,IAAqB,EAAE;YACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CACjB,+FAA+F,CAChG,CAAC;YACF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAE3C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;YAEhE,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;oBAChF,OAAO,EAAE;wBACP,iBAAiB,EAAE,QAAQ;qBAC5B;oBACD,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;gBAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;oBACxC,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC,CAAC;gBACnF,CAAC;gBAED,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;gBACjE,CAAC;gBAED,OAAO,KAAK,CAAC;YACf,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,iCAAyB,CACjC,mDACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,EACF,cAAc,EACd,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC3C,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,SAAS,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"subject-token-providers.js","sourceRoot":"","sources":["../src/auth/subject-token-providers.ts"],"names":[],"mappings":";;AAoLA,wEAuCC;AAiBD,8EA+GC;AAeD,gDA6EC;;AApbD,oEAA2C;AAC3C,4CAA0D;AAE1D,MAAM,gBAAgB,GAAG,+BAA+B,CAAC;AACzD,MAAM,yBAAyB,GAAG,YAAY,CAAC;AAC/C,MAAM,mBAAmB,GAAG,uDAAuD,CAAC;AACpF,MAAM,gCAAgC,GAAG,EAAE,CAAC;AAC5C,MAAM,qBAAqB,GAAG,MAAM,CAAC,wBAAwB,CAAC;AAC9D,MAAM,iBAAiB,GAAG,MAAM,CAAC,cAAc,CAAC;AAChD,MAAM,mBAAmB,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC;AACtD,MAAM,qBAAqB,GAAG,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC;AAC1D,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5D,MAAM,uBAAuB,GAAG,qBAAqB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AACxE,MAAM,0BAA0B,GAAG,qBAAqB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;AAC3E,MAAM,gBAAgB,GACpB,0BAA0B;IAC1B,OAAO,IAAI,0BAA0B;IACrC,OAAO,0BAA0B,CAAC,KAAK,KAAK,UAAU;IACpD,CAAC,CAAE,0BAA0B,CAAC,KAAoC;IAClE,CAAC,CAAC,SAAS,CAAC;AAIhB,SAAS,uBAAuB,CAAC,SAAiB,EAAE,IAA6B;IAC/E,MAAM,IAAI,GAAG,qBAAqB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,qBAAqB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IACpE,IACE,CAAC,IAAI;QACL,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC;QAClB,IAAI,CAAC,KAAK,KAAK,IAAI;QACnB,CAAC,WAAW;QACZ,CAAC,CAAC,OAAO,IAAI,WAAW,CAAC;QACzB,OAAO,WAAW,CAAC,KAAK,KAAK,UAAU,EACvC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAChF,MAAM,YAAY,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,uBAAuB,CAAC;IACpF,OAAO,OAAO,CACZ,iBAAiB;QACjB,OAAO,IAAI,iBAAiB;QAC5B,iBAAiB,CAAC,KAAK,KAAK,SAAS;QACrC,qBAAqB,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,YAAY,CAC/D,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,KAAa;IACjD,IAAI,CAAC;QACH,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,KACE,IAAI,SAAS,GAAkB,KAAK,EACpC,SAAS,KAAK,IAAI,EAClB,SAAS,GAAG,iBAAiB,CAAC,SAAS,CAAkB,EACzD,CAAC;YACD,IAAI,UAAU,CAAC,MAAM,IAAI,gCAAgC,EAAE,CAAC;gBAC1D,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC3B,IAAI,CAAC,gBAAgB,IAAI,qBAAqB,CAAC,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC9E,MAAM,GAAG,IAAI,CAAC;YAChB,CAAC;QACH,CAAC;QAED,IACE,gBAAgB;YACd,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC;YAC1B,CAAC,CAAC,CAAC,MAAM,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,gBAAgB,EACnE,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,qBAAqB,GAAG,KAAK,CAAC;QAClC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YAC1D,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,IAAI,uBAAuB,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,CAAC;gBACtD,OAAO,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;YACtC,CAAC;YACD,IAAI,MAAM,IAAI,uBAAuB,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;gBAC1D,qBAAqB,GAAG,IAAI,CAAC;YAC/B,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,OAAO,qBAAqB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAc;IAChD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,gCAAgC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACzE,IAAI,OAAO,YAAY,WAAW,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACpD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,4BAA4B,CAAC,OAAO,CAAC,CAAC;QACxF,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;YAClD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,MAAM,UAAU,GAAG,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC1D,IAAI,UAAU,IAAI,OAAO,IAAI,UAAU,IAAI,UAAU,CAAC,KAAK,KAAK,cAAc,EAAE,CAAC;gBAC/E,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAErB,IAAI,KAAqC,CAAC;QAC1C,IAAI,CAAC;YACH,KAAK,GAAG,qBAAqB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC,EAAE,CAAC;YAClC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC;IACxB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAc;IAC/C,IAAI,CAAC;QACH,OAAO,0BAA0B,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAKD,IAAI,gBAAwD,CAAC;AAE7D,KAAK,UAAU,eAAe,CAAC,IAAY;IACzC,gBAAgB,KAAhB,gBAAgB,GAAK,0DAAO,kBAAkB,IAAE,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QAC9D,gBAAgB,GAAG,SAAS,CAAC;QAC7B,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,EAAC;IAEH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,gBAAgB,CAAC;IAC5C,OAAO,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAgB,8BAA8B,CAC5C,SAAS,GAAG,qDAAqD,EACjE,MAGC;IAED,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,eAAe,CAAC;IAErD,OAAO;QACL,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,KAAK,IAAqB,EAAE;YACpC,IAAI,QAAgB,CAAC;YAErB,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;YACvC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,iCAAyB,EAAE,CAAC;oBAC/C,MAAM,KAAK,CAAC;gBACd,CAAC;gBAED,MAAM,IAAI,iCAAyB,CACjC,wDAAwD,SAAS,KAC/D,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,EACF,YAAY,EACZ,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC3C,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;YAE9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,iCAAyB,CAAC,qBAAqB,SAAS,YAAY,EAAE,YAAY,CAAC,CAAC;YAChG,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAgB,iCAAiC,CAC/C,WAAmB,gBAAgB,EACnC,MAkBC;IAED,MAAM,UAAU,GAAG,MAAM,EAAE,UAAU,IAAI,yBAAyB,CAAC;IACnE,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,KAAM,CAAC;IAE1C,OAAO;QACL,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,KAAK,IAAqB,EAAE;YACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,CAAC;YACzC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;YAChD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAE3C,IAAI,MAAM,EAAE,QAAQ,EAAE,CAAC;gBACrB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YACrD,CAAC;YACD,IAAI,MAAM,EAAE,QAAQ,EAAE,CAAC;gBACrB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YACrD,CAAC;YACD,IAAI,MAAM,EAAE,QAAQ,EAAE,CAAC;gBACrB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YACtD,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;YAEhE,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;oBAChF,OAAO,EAAE;wBACP,QAAQ,EAAE,MAAM;qBACjB;oBACD,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;gBAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,IAAI,aAAuC,CAAC;oBAE5C,IAAI,CAAC;wBACH,wGAAwG;wBACxG,MAAM,cAAc,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;4BACnD,aAAa,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;4BAChC,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gCAC9B,aAAa,EAAE,CAAC;4BAClB,CAAC;iCAAM,CAAC;gCACN,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;4BAC7E,CAAC;wBACH,CAAC,CAAC,CAAC;wBAEH,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC;oBAClF,CAAC;oBAAC,MAAM,CAAC;wBACP,UAAU,CAAC,KAAK,EAAE,CAAC;oBACrB,CAAC;4BAAS,CAAC;wBACT,IAAI,aAAa,EAAE,CAAC;4BAClB,UAAU,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;wBAChE,CAAC;oBACH,CAAC;oBAED,MAAM,IAAI,iCAAyB,CACjC,iDAAiD,QAAQ,CAAC,MAAM,EAAE,EAClE,YAAY,CACb,CAAC;gBACJ,CAAC;gBAED,IAAI,IAA+B,CAAC;gBACpC,IAAI,CAAC;oBACH,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA8B,CAAC;gBAC9D,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;wBACrC,MAAM,IAAI,WAAW,CAAC,qCAAqC,CAAC,CAAC;oBAC/D,CAAC;oBACD,MAAM,KAAK,CAAC;gBACd,CAAC;gBAED,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;oBACvB,MAAM,IAAI,iCAAyB,CAAC,4CAA4C,EAAE,YAAY,CAAC,CAAC;gBAClG,CAAC;gBAED,OAAO,IAAI,CAAC,YAAY,CAAC;YAC3B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,iCAAyB,EAAE,CAAC;oBAC/C,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM,IAAI,iCAAyB,CACjC,iCAAiC,EACjC,YAAY,EACZ,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC3C,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,SAAS,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAgB,kBAAkB,CAChC,QAAQ,GAAG,2BAA2B,EACtC,MAMC;IAED,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,KAAM,CAAC;IAE1C,OAAO;QACL,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,KAAK,IAAqB,EAAE;YACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CACjB,+FAA+F,CAChG,CAAC;YACF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAE3C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;YAEhE,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;oBAChF,OAAO,EAAE;wBACP,iBAAiB,EAAE,QAAQ;qBAC5B;oBACD,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;gBAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,IAAI,aAAuC,CAAC;oBAE5C,IAAI,CAAC;wBACH,wGAAwG;wBACxG,MAAM,cAAc,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;4BACnD,aAAa,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;4BAChC,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gCAC9B,aAAa,EAAE,CAAC;4BAClB,CAAC;iCAAM,CAAC;gCACN,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;4BAC7E,CAAC;wBACH,CAAC,CAAC,CAAC;wBAEH,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC;oBAClF,CAAC;oBAAC,MAAM,CAAC;wBACP,UAAU,CAAC,KAAK,EAAE,CAAC;oBACrB,CAAC;4BAAS,CAAC;wBACT,IAAI,aAAa,EAAE,CAAC;4BAClB,UAAU,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;wBAChE,CAAC;oBACH,CAAC;oBAED,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;gBACrE,CAAC;gBAED,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACxC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;gBAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;gBACjE,CAAC;gBAED,OAAO,KAAK,CAAC;YACf,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,iCAAyB,CACjC,mDACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,EACF,cAAc,EACd,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC3C,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,SAAS,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/auth/subject-token-providers.mjs

@@ -3,15 +3,149 @@ import { SubjectTokenProviderError } from "../core/error.mjs";
 const DEFAULT_RESOURCE = 'https://management.azure.com/';
 const DEFAULT_AZURE_API_VERSION = '2018-02-01';
 const AZURE_IMDS_BASE_URL = 'http://169.254.169.254/metadata/identity/oauth2/token';
+const MAX_AZURE_IMDS_JSON_ERROR_CAUSES = 32;
+const getOwnErrorDescriptor = Object.getOwnPropertyDescriptor;
+const getErrorPrototype = Object.getPrototypeOf;
+const errorObjectToString = Object.prototype.toString;
+const errorFunctionToString = Function.prototype.toString;
+const nativeErrorSource = errorFunctionToString.call(Error);
+const nativeSyntaxErrorSource = errorFunctionToString.call(SyntaxError);
+const nativeErrorBrandDescriptor = getOwnErrorDescriptor(Error, 'isError');
+const nativeErrorBrand = nativeErrorBrandDescriptor &&
+    'value' in nativeErrorBrandDescriptor &&
+    typeof nativeErrorBrandDescriptor.value === 'function'
+    ? nativeErrorBrandDescriptor.value
+    : undefined;
+function hasNativeErrorPrototype(prototype, kind) {
+    const name = getOwnErrorDescriptor(prototype, 'name');
+    const constructor = getOwnErrorDescriptor(prototype, 'constructor');
+    if (!name ||
+        !('value' in name) ||
+        name.value !== kind ||
+        !constructor ||
+        !('value' in constructor) ||
+        typeof constructor.value !== 'function') {
+        return false;
+    }
+    const originalPrototype = getOwnErrorDescriptor(constructor.value, 'prototype');
+    const nativeSource = kind === 'Error' ? nativeErrorSource : nativeSyntaxErrorSource;
+    return Boolean(originalPrototype &&
+        'value' in originalPrototype &&
+        originalPrototype.value === prototype &&
+        errorFunctionToString.call(constructor.value) === nativeSource);
+}
+function classifyCrossRealmAzureError(error) {
+    try {
+        const prototypes = [];
+        let tagged = false;
+        for (let prototype = error; prototype !== null; prototype = getErrorPrototype(prototype)) {
+            if (prototypes.length >= MAX_AZURE_IMDS_JSON_ERROR_CAUSES) {
+                return 'unsafe';
+            }
+            prototypes.push(prototype);
+            if (!nativeErrorBrand && getOwnErrorDescriptor(prototype, Symbol.toStringTag)) {
+                tagged = true;
+            }
+        }
+        if (nativeErrorBrand
+            ? !nativeErrorBrand(error)
+            : !tagged && errorObjectToString.call(error) !== '[object Error]') {
+            return 'unknown';
+        }
+        let genericErrorPrototype = false;
+        for (let index = 1; index < prototypes.length; index += 1) {
+            const prototype = prototypes[index];
+            if (!prototype) {
+                return 'unsafe';
+            }
+            if (hasNativeErrorPrototype(prototype, 'SyntaxError')) {
+                return tagged ? 'unsafe' : 'syntax';
+            }
+            if (tagged && hasNativeErrorPrototype(prototype, 'Error')) {
+                genericErrorPrototype = true;
+            }
+        }
+        if (!tagged) {
+            return 'error';
+        }
+        return genericErrorPrototype ? 'tagged-wrapper' : 'unknown';
+    }
+    catch {
+        return 'unsafe';
+    }
+}
+function inspectAzureJSONErrorCause(error) {
+    const visited = new Set();
+    let current = error;
+    for (let depth = 0; depth < MAX_AZURE_IMDS_JSON_ERROR_CAUSES; depth += 1) {
+        if (current instanceof SyntaxError) {
+            return true;
+        }
+        if (typeof current !== 'object' || current === null) {
+            return false;
+        }
+        const kind = current instanceof Error ? 'error' : classifyCrossRealmAzureError(current);
+        if (kind === 'syntax' || kind === 'unsafe') {
+            return true;
+        }
+        if (kind !== 'error' && kind !== 'tagged-wrapper') {
+            return false;
+        }
+        if (kind === 'error') {
+            const parserType = getOwnErrorDescriptor(current, 'type');
+            if (parserType && 'value' in parserType && parserType.value === 'invalid-json') {
+                return true;
+            }
+        }
+        if (visited.has(current)) {
+            return true;
+        }
+        visited.add(current);
+        let cause;
+        try {
+            cause = getOwnErrorDescriptor(current, 'cause');
+        }
+        catch {
+            return true;
+        }
+        if (!cause || !('value' in cause)) {
+            return false;
+        }
+        current = cause.value;
+    }
+    return true;
+}
+function isMalformedAzureJSONError(error) {
+    try {
+        return inspectAzureJSONErrorCause(error);
+    }
+    catch {
+        return true;
+    }
+}
 let fsPromisesModule;
 async function defaultReadFile(path) {
-    fsPromisesModule ?? (fsPromisesModule = import('fs/promises').catch((error) => {
+    fsPromisesModule ?? (fsPromisesModule = import('node:fs/promises').catch((error) => {
         fsPromisesModule = undefined;
         throw error;
     }));
     const { readFile } = await fsPromisesModule;
-    return readFile(path, 'utf8');
+    return readFile(path, 'utf-8');
 }
+/**
+ * Reads a Kubernetes service-account JWT from its mounted token file.
+ *
+ * The file is read again for each token exchange so projected or rotated tokens
+ * are picked up automatically. The default reader requires Node.js filesystem
+ * access; provide `config.readFile` when using another compatible runtime.
+ *
+ * @param tokenPath Path to the token file; defaults to
+ * `/var/run/secrets/kubernetes.io/serviceaccount/token`.
+ * @param config Optional replacement for the default UTF-8 file reader.
+ * @returns A JWT subject-token provider suitable for `workloadIdentity.provider`.
+ * @throws {SubjectTokenProviderError} When the returned provider cannot read the
+ * token file or the file contains no token.
+ */
 export function k8sServiceAccountTokenProvider(tokenPath = '/var/run/secrets/kubernetes.io/serviceaccount/token', config) {
     const readFile = config?.readFile ?? defaultReadFile;
     return {
@@ -35,6 +169,21 @@ export function k8sServiceAccountTokenProvider(tokenPath = '/var/run/secrets/kub
         },
     };
 }
+/**
+ * Retrieves an Azure managed-identity access token from the Instance Metadata Service.
+ *
+ * Run this provider in an Azure-hosted workload that can reach the link-local
+ * metadata endpoint. Select a user-assigned identity with `objectId`, `clientId`,
+ * or `msiResId`; otherwise Azure selects the available managed identity.
+ *
+ * @param resource Azure resource identifier; defaults to
+ * `https://management.azure.com/`.
+ * @param config Managed-identity selection, metadata API version, request
+ * timeout, and optional `fetch` implementation.
+ * @returns A JWT subject-token provider suitable for `workloadIdentity.provider`.
+ * @throws {SubjectTokenProviderError} When the returned provider cannot retrieve
+ * an access token, the metadata response is invalid, or the request times out.
+ */
 export function azureManagedIdentityTokenProvider(resource = DEFAULT_RESOURCE, config) {
     const apiVersion = config?.apiVersion ?? DEFAULT_AZURE_API_VERSION;
     const timeout = config?.timeout ?? 10000;
@@ -63,9 +212,40 @@ export function azureManagedIdentityTokenProvider(resource = DEFAULT_RESOURCE, c
                     signal: controller.signal,
                 });
                 if (!response.ok) {
+                    let abortListener;
+                    try {
+                        // oxlint-disable-next-line promise/avoid-new -- AbortSignal is callback-only across supported runtimes.
+                        const requestAborted = new Promise((resolve) => {
+                            abortListener = () => resolve();
+                            if (controller.signal.aborted) {
+                                abortListener();
+                            }
+                            else {
+                                controller.signal.addEventListener('abort', abortListener, { once: true });
+                            }
+                        });
+                        await Promise.race([Shims.CancelReadableStream(response.body), requestAborted]);
+                    }
+                    catch {
+                        controller.abort();
+                    }
+                    finally {
+                        if (abortListener) {
+                            controller.signal.removeEventListener('abort', abortListener);
+                        }
+                    }
                     throw new SubjectTokenProviderError(`Failed to fetch token from Azure IMDS: status ${response.status}`, 'azure-imds');
                 }
-                const data = (await response.json());
+                let data;
+                try {
+                    data = (await response.json());
+                }
+                catch (error) {
+                    if (isMalformedAzureJSONError(error)) {
+                        throw new SyntaxError('IMDS response contains invalid JSON');
+                    }
+                    throw error;
+                }
                 if (!data.access_token) {
                     throw new SubjectTokenProviderError("IMDS response missing 'access_token' field", 'azure-imds');
                 }
@@ -83,8 +263,21 @@ export function azureManagedIdentityTokenProvider(resource = DEFAULT_RESOURCE, c
         },
     };
 }
+/**
+ * Retrieves a Google Cloud identity token from the default service account's metadata endpoint.
+ *
+ * Run this provider in a Google Cloud workload with access to its Compute Engine
+ * metadata server. A fresh identity token is requested for each token exchange.
+ *
+ * @param audience Intended identity-token audience; defaults to
+ * `https://api.openai.com/v1`.
+ * @param config Optional metadata request timeout and `fetch` implementation.
+ * @returns An identity-token subject-token provider for `workloadIdentity.provider`.
+ * @throws {SubjectTokenProviderError} When the returned provider cannot retrieve
+ * a nonempty identity token or the metadata request times out.
+ */
 export function gcpIDTokenProvider(audience = 'https://api.openai.com/v1', config) {
-    const timeout = config?.timeout || 10000;
+    const timeout = config?.timeout ?? 10000;
     return {
         tokenType: 'id',
         getToken: async () => {
@@ -100,10 +293,32 @@ export function gcpIDTokenProvider(audience = 'https://api.openai.com/v1', confi
                     signal: controller.signal,
                 });
                 if (!response.ok) {
-                    const errorText = await response.text();
-                    throw new Error(`GCP Metadata Server returned ${response.status}: ${errorText}`);
+                    let abortListener;
+                    try {
+                        // oxlint-disable-next-line promise/avoid-new -- AbortSignal is callback-only across supported runtimes.
+                        const requestAborted = new Promise((resolve) => {
+                            abortListener = () => resolve();
+                            if (controller.signal.aborted) {
+                                abortListener();
+                            }
+                            else {
+                                controller.signal.addEventListener('abort', abortListener, { once: true });
+                            }
+                        });
+                        await Promise.race([Shims.CancelReadableStream(response.body), requestAborted]);
+                    }
+                    catch {
+                        controller.abort();
+                    }
+                    finally {
+                        if (abortListener) {
+                            controller.signal.removeEventListener('abort', abortListener);
+                        }
+                    }
+                    throw new Error(`GCP Metadata Server returned ${response.status}`);
                 }
-                const token = (await response.text()).trim();
+                const tokenText = await response.text();
+                const token = tokenText.trim();
                 if (!token) {
                     throw new Error('GCP metadata server returned an empty token');
                 }

package/auth/subject-token-providers.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"subject-token-providers.mjs","sourceRoot":"","sources":["../src/auth/subject-token-providers.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,KAAK,8BAA0B;AAC3C,OAAO,EAAE,yBAAyB,EAAE,0BAAsB;AAE1D,MAAM,gBAAgB,GAAG,+BAA+B,CAAC;AACzD,MAAM,yBAAyB,GAAG,YAAY,CAAC;AAC/C,MAAM,mBAAmB,GAAG,uDAAuD,CAAC;AAIpF,IAAI,gBAAwE,CAAC;AAE7E,KAAK,UAAU,eAAe,CAAC,IAAY;IACzC,gBAAgB,KAAhB,gBAAgB,GAAK,MAAM,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QACzD,gBAAgB,GAAG,SAAS,CAAC;QAC7B,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,EAAC;IAEH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,gBAAgB,CAAC;IAC5C,OAAO,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,YAAoB,qDAAqD,EACzE,MAEC;IAED,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,eAAe,CAAC;IAErD,OAAO;QACL,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,KAAK,IAAqB,EAAE;YACpC,IAAI,QAAgB,CAAC;YAErB,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;YACvC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,yBAAyB,EAAE,CAAC;oBAC/C,MAAM,KAAK,CAAC;gBACd,CAAC;gBAED,MAAM,IAAI,yBAAyB,CACjC,wDAAwD,SAAS,KAC/D,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,EACF,YAAY,EACZ,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC3C,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;YAE9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,yBAAyB,CAAC,qBAAqB,SAAS,YAAY,EAAE,YAAY,CAAC,CAAC;YAChG,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,WAAmB,gBAAgB,EACnC,MAOC;IAED,MAAM,UAAU,GAAG,MAAM,EAAE,UAAU,IAAI,yBAAyB,CAAC;IACnE,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC;IAEzC,OAAO;QACL,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,KAAK,IAAqB,EAAE;YACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,CAAC;YACzC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;YAChD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAE3C,IAAI,MAAM,EAAE,QAAQ,EAAE,CAAC;gBACrB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YACrD,CAAC;YACD,IAAI,MAAM,EAAE,QAAQ,EAAE,CAAC;gBACrB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YACrD,CAAC;YACD,IAAI,MAAM,EAAE,QAAQ,EAAE,CAAC;gBACrB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YACtD,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;YAEhE,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;oBAChF,OAAO,EAAE;wBACP,QAAQ,EAAE,MAAM;qBACjB;oBACD,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;gBAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,MAAM,IAAI,yBAAyB,CACjC,iDAAiD,QAAQ,CAAC,MAAM,EAAE,EAClE,YAAY,CACb,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA8B,CAAC;gBAElE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;oBACvB,MAAM,IAAI,yBAAyB,CAAC,4CAA4C,EAAE,YAAY,CAAC,CAAC;gBAClG,CAAC;gBAED,OAAO,IAAI,CAAC,YAAY,CAAC;YAC3B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,yBAAyB,EAAE,CAAC;oBAC/C,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM,IAAI,yBAAyB,CACjC,iCAAiC,EACjC,YAAY,EACZ,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC3C,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,SAAS,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,WAAmB,2BAA2B,EAC9C,MAA4C;IAE5C,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC;IAEzC,OAAO;QACL,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,KAAK,IAAqB,EAAE;YACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CACjB,+FAA+F,CAChG,CAAC;YACF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAE3C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;YAEhE,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;oBAChF,OAAO,EAAE;wBACP,iBAAiB,EAAE,QAAQ;qBAC5B;oBACD,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;gBAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;oBACxC,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC,CAAC;gBACnF,CAAC;gBAED,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;gBACjE,CAAC;gBAED,OAAO,KAAK,CAAC;YACf,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,yBAAyB,CACjC,mDACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,EACF,cAAc,EACd,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC3C,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,SAAS,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"subject-token-providers.mjs","sourceRoot":"","sources":["../src/auth/subject-token-providers.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,KAAK,8BAA0B;AAC3C,OAAO,EAAE,yBAAyB,EAAE,0BAAsB;AAE1D,MAAM,gBAAgB,GAAG,+BAA+B,CAAC;AACzD,MAAM,yBAAyB,GAAG,YAAY,CAAC;AAC/C,MAAM,mBAAmB,GAAG,uDAAuD,CAAC;AACpF,MAAM,gCAAgC,GAAG,EAAE,CAAC;AAC5C,MAAM,qBAAqB,GAAG,MAAM,CAAC,wBAAwB,CAAC;AAC9D,MAAM,iBAAiB,GAAG,MAAM,CAAC,cAAc,CAAC;AAChD,MAAM,mBAAmB,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC;AACtD,MAAM,qBAAqB,GAAG,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC;AAC1D,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5D,MAAM,uBAAuB,GAAG,qBAAqB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AACxE,MAAM,0BAA0B,GAAG,qBAAqB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;AAC3E,MAAM,gBAAgB,GACpB,0BAA0B;IAC1B,OAAO,IAAI,0BAA0B;IACrC,OAAO,0BAA0B,CAAC,KAAK,KAAK,UAAU;IACpD,CAAC,CAAE,0BAA0B,CAAC,KAAoC;IAClE,CAAC,CAAC,SAAS,CAAC;AAIhB,SAAS,uBAAuB,CAAC,SAAiB,EAAE,IAA6B;IAC/E,MAAM,IAAI,GAAG,qBAAqB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,qBAAqB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IACpE,IACE,CAAC,IAAI;QACL,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC;QAClB,IAAI,CAAC,KAAK,KAAK,IAAI;QACnB,CAAC,WAAW;QACZ,CAAC,CAAC,OAAO,IAAI,WAAW,CAAC;QACzB,OAAO,WAAW,CAAC,KAAK,KAAK,UAAU,EACvC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAChF,MAAM,YAAY,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,uBAAuB,CAAC;IACpF,OAAO,OAAO,CACZ,iBAAiB;QACjB,OAAO,IAAI,iBAAiB;QAC5B,iBAAiB,CAAC,KAAK,KAAK,SAAS;QACrC,qBAAqB,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,YAAY,CAC/D,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,KAAa;IACjD,IAAI,CAAC;QACH,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,KACE,IAAI,SAAS,GAAkB,KAAK,EACpC,SAAS,KAAK,IAAI,EAClB,SAAS,GAAG,iBAAiB,CAAC,SAAS,CAAkB,EACzD,CAAC;YACD,IAAI,UAAU,CAAC,MAAM,IAAI,gCAAgC,EAAE,CAAC;gBAC1D,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC3B,IAAI,CAAC,gBAAgB,IAAI,qBAAqB,CAAC,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC9E,MAAM,GAAG,IAAI,CAAC;YAChB,CAAC;QACH,CAAC;QAED,IACE,gBAAgB;YACd,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC;YAC1B,CAAC,CAAC,CAAC,MAAM,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,gBAAgB,EACnE,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,qBAAqB,GAAG,KAAK,CAAC;QAClC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YAC1D,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,IAAI,uBAAuB,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,CAAC;gBACtD,OAAO,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;YACtC,CAAC;YACD,IAAI,MAAM,IAAI,uBAAuB,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;gBAC1D,qBAAqB,GAAG,IAAI,CAAC;YAC/B,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,OAAO,qBAAqB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAc;IAChD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,gCAAgC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACzE,IAAI,OAAO,YAAY,WAAW,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACpD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,4BAA4B,CAAC,OAAO,CAAC,CAAC;QACxF,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;YAClD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,MAAM,UAAU,GAAG,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC1D,IAAI,UAAU,IAAI,OAAO,IAAI,UAAU,IAAI,UAAU,CAAC,KAAK,KAAK,cAAc,EAAE,CAAC;gBAC/E,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAErB,IAAI,KAAqC,CAAC;QAC1C,IAAI,CAAC;YACH,KAAK,GAAG,qBAAqB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC,EAAE,CAAC;YAClC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC;IACxB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAc;IAC/C,IAAI,CAAC;QACH,OAAO,0BAA0B,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAKD,IAAI,gBAAwD,CAAC;AAE7D,KAAK,UAAU,eAAe,CAAC,IAAY;IACzC,gBAAgB,KAAhB,gBAAgB,GAAK,MAAM,CAAC,kBAAkB,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QAC9D,gBAAgB,GAAG,SAAS,CAAC;QAC7B,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,EAAC;IAEH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,gBAAgB,CAAC;IAC5C,OAAO,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,8BAA8B,CAC5C,SAAS,GAAG,qDAAqD,EACjE,MAGC;IAED,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,eAAe,CAAC;IAErD,OAAO;QACL,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,KAAK,IAAqB,EAAE;YACpC,IAAI,QAAgB,CAAC;YAErB,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;YACvC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,yBAAyB,EAAE,CAAC;oBAC/C,MAAM,KAAK,CAAC;gBACd,CAAC;gBAED,MAAM,IAAI,yBAAyB,CACjC,wDAAwD,SAAS,KAC/D,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,EACF,YAAY,EACZ,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC3C,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;YAE9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,yBAAyB,CAAC,qBAAqB,SAAS,YAAY,EAAE,YAAY,CAAC,CAAC;YAChG,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iCAAiC,CAC/C,WAAmB,gBAAgB,EACnC,MAkBC;IAED,MAAM,UAAU,GAAG,MAAM,EAAE,UAAU,IAAI,yBAAyB,CAAC;IACnE,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,KAAM,CAAC;IAE1C,OAAO;QACL,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,KAAK,IAAqB,EAAE;YACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,CAAC;YACzC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;YAChD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAE3C,IAAI,MAAM,EAAE,QAAQ,EAAE,CAAC;gBACrB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YACrD,CAAC;YACD,IAAI,MAAM,EAAE,QAAQ,EAAE,CAAC;gBACrB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YACrD,CAAC;YACD,IAAI,MAAM,EAAE,QAAQ,EAAE,CAAC;gBACrB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YACtD,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;YAEhE,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;oBAChF,OAAO,EAAE;wBACP,QAAQ,EAAE,MAAM;qBACjB;oBACD,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;gBAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,IAAI,aAAuC,CAAC;oBAE5C,IAAI,CAAC;wBACH,wGAAwG;wBACxG,MAAM,cAAc,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;4BACnD,aAAa,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;4BAChC,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gCAC9B,aAAa,EAAE,CAAC;4BAClB,CAAC;iCAAM,CAAC;gCACN,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;4BAC7E,CAAC;wBACH,CAAC,CAAC,CAAC;wBAEH,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC;oBAClF,CAAC;oBAAC,MAAM,CAAC;wBACP,UAAU,CAAC,KAAK,EAAE,CAAC;oBACrB,CAAC;4BAAS,CAAC;wBACT,IAAI,aAAa,EAAE,CAAC;4BAClB,UAAU,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;wBAChE,CAAC;oBACH,CAAC;oBAED,MAAM,IAAI,yBAAyB,CACjC,iDAAiD,QAAQ,CAAC,MAAM,EAAE,EAClE,YAAY,CACb,CAAC;gBACJ,CAAC;gBAED,IAAI,IAA+B,CAAC;gBACpC,IAAI,CAAC;oBACH,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA8B,CAAC;gBAC9D,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;wBACrC,MAAM,IAAI,WAAW,CAAC,qCAAqC,CAAC,CAAC;oBAC/D,CAAC;oBACD,MAAM,KAAK,CAAC;gBACd,CAAC;gBAED,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;oBACvB,MAAM,IAAI,yBAAyB,CAAC,4CAA4C,EAAE,YAAY,CAAC,CAAC;gBAClG,CAAC;gBAED,OAAO,IAAI,CAAC,YAAY,CAAC;YAC3B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,yBAAyB,EAAE,CAAC;oBAC/C,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM,IAAI,yBAAyB,CACjC,iCAAiC,EACjC,YAAY,EACZ,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC3C,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,SAAS,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAQ,GAAG,2BAA2B,EACtC,MAMC;IAED,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,KAAM,CAAC;IAE1C,OAAO;QACL,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,KAAK,IAAqB,EAAE;YACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CACjB,+FAA+F,CAChG,CAAC;YACF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAE3C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;YAEhE,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;oBAChF,OAAO,EAAE;wBACP,iBAAiB,EAAE,QAAQ;qBAC5B;oBACD,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;gBAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,IAAI,aAAuC,CAAC;oBAE5C,IAAI,CAAC;wBACH,wGAAwG;wBACxG,MAAM,cAAc,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;4BACnD,aAAa,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;4BAChC,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gCAC9B,aAAa,EAAE,CAAC;4BAClB,CAAC;iCAAM,CAAC;gCACN,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;4BAC7E,CAAC;wBACH,CAAC,CAAC,CAAC;wBAEH,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC;oBAClF,CAAC;oBAAC,MAAM,CAAC;wBACP,UAAU,CAAC,KAAK,EAAE,CAAC;oBACrB,CAAC;4BAAS,CAAC;wBACT,IAAI,aAAa,EAAE,CAAC;4BAClB,UAAU,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;wBAChE,CAAC;oBACH,CAAC;oBAED,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;gBACrE,CAAC;gBAED,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACxC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;gBAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;gBACjE,CAAC;gBAED,OAAO,KAAK,CAAC;YACf,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,yBAAyB,CACjC,mDACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,EACF,cAAc,EACd,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC3C,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,SAAS,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}