openai 7.4.0 → 7.6.0

package/internal/assistant-stream-delta.mjs

@@ -0,0 +1,301 @@
+import { OpenAIError } from "../error.mjs";
+import { hasOwn, isObj } from "./utils.mjs";
+const MAX_ASSISTANT_STREAM_ARRAY_GROWTH = 1024;
+const MAX_EXTERNALLY_MUTABLE_ASSISTANT_STREAM_ARRAY_LENGTH = 65536;
+function getAssistantStreamDiagnosticProperty(property) {
+    switch (property) {
+        case 'value':
+        case 'arguments':
+        case 'input':
+        case 'text':
+        case 'content':
+        case 'annotations':
+        case 'metadata':
+        case 'name':
+        case 'role':
+        case 'status':
+        case 'tool_calls':
+        case 'step_details': {
+            return property;
+        }
+        default: {
+            return 'unknown';
+        }
+    }
+}
+const assistantStreamArrayStates = new WeakMap();
+const externallyMutableAssistantStreamValues = new WeakSet();
+function createAssistantStreamDeltaProjection(cacheArrays) {
+    return { arrays: new Map(), cacheArrays, records: new WeakMap() };
+}
+function commitAssistantStreamArrayProjection(projection) {
+    for (const [array, projected] of projection.arrays) {
+        if (projected.cacheable && !externallyMutableAssistantStreamValues.has(array)) {
+            assistantStreamArrayStates.set(array, {
+                length: projected.length,
+                ownEntryCount: projected.ownEntryCount,
+            });
+        }
+        else {
+            assistantStreamArrayStates.delete(array);
+        }
+    }
+}
+function isPrimitiveAssistantStreamValue(value) {
+    return typeof value === 'string' || typeof value === 'number';
+}
+function isPrimitiveAssistantStreamArrayDelta(accumulator, delta) {
+    return delta.every(isPrimitiveAssistantStreamValue) && accumulator.every(isPrimitiveAssistantStreamValue);
+}
+function countOwnAssistantStreamArrayEntries(accumulator) {
+    let count = 0;
+    for (const key of Object.keys(accumulator)) {
+        const index = Number(key);
+        if (Number.isSafeInteger(index) && index >= 0 && index < accumulator.length && String(index) === key) {
+            count += 1;
+        }
+    }
+    return count;
+}
+function getAssistantStreamArrayOwnEntryCount(accumulator, enforceSparseHoleBudget, cachedState) {
+    if (!enforceSparseHoleBudget) {
+        return 0;
+    }
+    if (cachedState?.length === accumulator.length) {
+        return cachedState.ownEntryCount;
+    }
+    return countOwnAssistantStreamArrayEntries(accumulator);
+}
+function getAssistantStreamDeltaIndex(deltaEntry, kind, baselineLength) {
+    const { index } = deltaEntry;
+    if (kind === 'array' && (index === null || index === undefined)) {
+        throw new Error('Expected array delta entry to have an `index` property');
+    }
+    if (kind === 'array' && typeof index !== 'number') {
+        throw new TypeError('Expected array delta entry `index` property to be a number but got an invalid value');
+    }
+    if (!Number.isSafeInteger(index) ||
+        index < 0 ||
+        index >= baselineLength + MAX_ASSISTANT_STREAM_ARRAY_GROWTH ||
+        index >= MAX_EXTERNALLY_MUTABLE_ASSISTANT_STREAM_ARRAY_LENGTH) {
+        const safeIndex = typeof index === 'number' ? index : 'unknown';
+        throw new OpenAIError(`Assistant stream delta contains an invalid ${kind} index: ${safeIndex}`);
+    }
+    return index;
+}
+function assertValidAssistantStreamArrayDelta(accumulator, delta, kind, projection, validateRecord) {
+    let projectedArray = projection.arrays.get(accumulator);
+    if (!projectedArray) {
+        const enforceSparseHoleBudget = projection.cacheArrays && !externallyMutableAssistantStreamValues.has(accumulator);
+        const cachedState = enforceSparseHoleBudget ? assistantStreamArrayStates.get(accumulator) : undefined;
+        projectedArray = {
+            baselineLength: accumulator.length,
+            cacheable: enforceSparseHoleBudget,
+            enforceSparseHoleBudget,
+            entries: new Map(),
+            length: accumulator.length,
+            ownEntryCount: getAssistantStreamArrayOwnEntryCount(accumulator, enforceSparseHoleBudget, cachedState),
+        };
+        projection.arrays.set(accumulator, projectedArray);
+    }
+    for (const deltaEntry of delta) {
+        if (!isObj(deltaEntry)) {
+            throw new Error('Expected array delta entry to be an object but got an invalid value');
+        }
+        const validatedIndex = getAssistantStreamDeltaIndex(deltaEntry, kind, projectedArray.baselineLength);
+        let accumulatedEntry;
+        if (projectedArray.entries.has(validatedIndex)) {
+            accumulatedEntry = projectedArray.entries.get(validatedIndex);
+        }
+        else if (hasOwn(accumulator, validatedIndex)) {
+            accumulatedEntry = accumulator[validatedIndex];
+            if (accumulatedEntry === null || accumulatedEntry === undefined) {
+                projectedArray.entries.set(validatedIndex, deltaEntry);
+            }
+        }
+        else {
+            projectedArray.entries.set(validatedIndex, deltaEntry);
+            projectedArray.ownEntryCount += 1;
+        }
+        const projectedLength = Math.max(projectedArray.length, validatedIndex + 1);
+        if (projectedArray.enforceSparseHoleBudget &&
+            projectedLength - projectedArray.ownEntryCount > MAX_ASSISTANT_STREAM_ARRAY_GROWTH) {
+            throw new OpenAIError(`Assistant stream delta contains an invalid ${kind} index: ${validatedIndex}`);
+        }
+        if (isObj(accumulatedEntry)) {
+            validateRecord(accumulatedEntry, deltaEntry, projection);
+        }
+        projectedArray.length = projectedLength;
+    }
+}
+function assertValidAssistantStreamDeltaIndices(accumulator, delta, projection) {
+    let projectedValues = projection.records.get(accumulator);
+    for (const [key, deltaValue] of Object.entries(delta)) {
+        if (key === 'index' || key === 'type') {
+            continue;
+        }
+        let accumulatedValue;
+        if (projectedValues?.has(key)) {
+            accumulatedValue = projectedValues.get(key);
+        }
+        else if (hasOwn(accumulator, key)) {
+            accumulatedValue = accumulator[key];
+        }
+        if (accumulatedValue === null || accumulatedValue === undefined) {
+            if (!projectedValues) {
+                projectedValues = new Map();
+                projection.records.set(accumulator, projectedValues);
+            }
+            projectedValues.set(key, deltaValue);
+            continue;
+        }
+        if (isObj(accumulatedValue) && isObj(deltaValue)) {
+            assertValidAssistantStreamDeltaIndices(accumulatedValue, deltaValue, projection);
+        }
+        else if (Array.isArray(accumulatedValue) &&
+            Array.isArray(deltaValue) &&
+            !isPrimitiveAssistantStreamArrayDelta(accumulatedValue, deltaValue)) {
+            assertValidAssistantStreamArrayDelta(accumulatedValue, deltaValue, 'array', projection, assertValidAssistantStreamDeltaIndices);
+        }
+    }
+}
+export function isAssistantStreamValueExternallyMutable(value) {
+    return (isObj(value) || Array.isArray(value)) && externallyMutableAssistantStreamValues.has(value);
+}
+export function markAssistantStreamValueExternallyMutable(value) {
+    if ((!isObj(value) && !Array.isArray(value)) || externallyMutableAssistantStreamValues.has(value)) {
+        return;
+    }
+    externallyMutableAssistantStreamValues.add(value);
+    if (Array.isArray(value)) {
+        assistantStreamArrayStates.delete(value);
+    }
+    for (const key of Reflect.ownKeys(value)) {
+        const descriptor = Object.getOwnPropertyDescriptor(value, key);
+        if (descriptor && 'value' in descriptor) {
+            markAssistantStreamValueExternallyMutable(descriptor.value);
+        }
+    }
+}
+export function defineAssistantStreamArrayEntry(accumulator, index, value) {
+    if (externallyMutableAssistantStreamValues.has(accumulator)) {
+        markAssistantStreamValueExternallyMutable(value);
+    }
+    Object.defineProperty(accumulator, index, {
+        configurable: true,
+        enumerable: true,
+        value,
+        writable: true,
+    });
+}
+function getRequiredAssistantStreamArrayIndex(deltaEntry) {
+    const { index } = deltaEntry;
+    if (index === null || index === undefined) {
+        throw new Error('Expected array delta entry to have an `index` property');
+    }
+    if (typeof index !== 'number') {
+        throw new TypeError('Expected array delta entry `index` property to be a number but got an invalid value');
+    }
+    return index;
+}
+function applyAssistantStreamArrayDelta(accumulator, delta, applyRecord) {
+    if (isPrimitiveAssistantStreamArrayDelta(accumulator, delta)) {
+        accumulator.push(...delta);
+        assistantStreamArrayStates.delete(accumulator);
+        return;
+    }
+    for (const deltaEntry of delta) {
+        if (!isObj(deltaEntry)) {
+            throw new Error('Expected array delta entry to be an object but got an invalid value');
+        }
+        const index = getRequiredAssistantStreamArrayIndex(deltaEntry);
+        if (hasOwn(accumulator, index)) {
+            const accumulatedEntry = accumulator[index];
+            if (accumulatedEntry === null || accumulatedEntry === undefined) {
+                if (externallyMutableAssistantStreamValues.has(accumulator)) {
+                    markAssistantStreamValueExternallyMutable(deltaEntry);
+                }
+                accumulator[index] = deltaEntry;
+            }
+            else {
+                accumulator[index] = applyRecord(accumulatedEntry, deltaEntry);
+            }
+        }
+        else {
+            defineAssistantStreamArrayEntry(accumulator, index, deltaEntry);
+        }
+    }
+}
+function applyAssistantStreamDelta(accumulator, delta) {
+    const externallyMutable = externallyMutableAssistantStreamValues.has(accumulator);
+    for (const [key, deltaValue] of Object.entries(delta)) {
+        if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+            throw new OpenAIError(`Assistant stream delta contains an unsafe property: ${key}`);
+        }
+        if (!hasOwn(accumulator, key)) {
+            if (externallyMutable) {
+                markAssistantStreamValueExternallyMutable(deltaValue);
+            }
+            accumulator[key] = deltaValue;
+            continue;
+        }
+        let accumulatedValue = accumulator[key];
+        if (accumulatedValue === null || accumulatedValue === undefined) {
+            if (externallyMutable) {
+                markAssistantStreamValueExternallyMutable(deltaValue);
+            }
+            accumulator[key] = deltaValue;
+            continue;
+        }
+        if (key === 'index' || key === 'type') {
+            accumulator[key] = deltaValue;
+            continue;
+        }
+        if (typeof accumulatedValue === 'string' && typeof deltaValue === 'string') {
+            accumulatedValue += deltaValue;
+        }
+        else if (typeof accumulatedValue === 'number' && typeof deltaValue === 'number') {
+            accumulatedValue += deltaValue;
+        }
+        else if (isObj(accumulatedValue) && isObj(deltaValue)) {
+            accumulatedValue = applyAssistantStreamDelta(accumulatedValue, deltaValue);
+        }
+        else if (Array.isArray(accumulatedValue) && Array.isArray(deltaValue)) {
+            applyAssistantStreamArrayDelta(accumulatedValue, deltaValue, applyAssistantStreamDelta);
+            continue;
+        }
+        else {
+            throw new TypeError(`Unhandled record type: ${getAssistantStreamDiagnosticProperty(key)}`);
+        }
+        accumulator[key] = accumulatedValue;
+    }
+    return accumulator;
+}
+export function assertSafeAssistantStreamDelta(value) {
+    if (!isObj(value) && !Array.isArray(value)) {
+        return;
+    }
+    for (const [key, nestedValue] of Object.entries(value)) {
+        if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+            throw new OpenAIError(`Assistant stream delta contains an unsafe property: ${key}`);
+        }
+        assertSafeAssistantStreamDelta(nestedValue);
+    }
+}
+export function accumulateAssistantStreamDelta(accumulator, delta, cacheArrays = false) {
+    assertSafeAssistantStreamDelta(delta);
+    const accumulatorRecord = accumulator;
+    const deltaRecord = delta;
+    const projection = createAssistantStreamDeltaProjection(cacheArrays && !isAssistantStreamValueExternallyMutable(accumulator));
+    assertValidAssistantStreamDeltaIndices(accumulatorRecord, deltaRecord, projection);
+    applyAssistantStreamDelta(accumulatorRecord, deltaRecord);
+    commitAssistantStreamArrayProjection(projection);
+    return accumulator;
+}
+export function createAssistantStreamArrayDeltaCommit(accumulator, delta, kind, cacheArrays = true) {
+    assertSafeAssistantStreamDelta(delta);
+    const projection = createAssistantStreamDeltaProjection(cacheArrays && !isAssistantStreamValueExternallyMutable(accumulator));
+    assertValidAssistantStreamArrayDelta(accumulator, delta, kind, projection, assertValidAssistantStreamDeltaIndices);
+    return () => commitAssistantStreamArrayProjection(projection);
+}
+//# sourceMappingURL=assistant-stream-delta.mjs.map

package/internal/assistant-stream-delta.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"assistant-stream-delta.mjs","sourceRoot":"","sources":["../src/internal/assistant-stream-delta.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,qBAAiB;AACvC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAgB;AAExC,MAAM,iCAAiC,GAAG,IAAI,CAAC;AAC/C,MAAM,oDAAoD,GAAG,KAAM,CAAC;AAIpE,SAAS,oCAAoC,CAAC,QAAgB;IAC5D,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,OAAO,CAAC;QACb,KAAK,WAAW,CAAC;QACjB,KAAK,OAAO,CAAC;QACb,KAAK,MAAM,CAAC;QACZ,KAAK,SAAS,CAAC;QACf,KAAK,aAAa,CAAC;QACnB,KAAK,UAAU,CAAC;QAChB,KAAK,MAAM,CAAC;QACZ,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ,CAAC;QACd,KAAK,YAAY,CAAC;QAClB,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;AACH,CAAC;AAsBD,MAAM,0BAA0B,GAAG,IAAI,OAAO,EAAwC,CAAC;AACvF,MAAM,sCAAsC,GAAG,IAAI,OAAO,EAAU,CAAC;AAErE,SAAS,oCAAoC,CAAC,WAAoB;IAChE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,OAAO,EAAE,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,oCAAoC,CAAC,UAA0C;IACtF,KAAK,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;QACnD,IAAI,SAAS,CAAC,SAAS,IAAI,CAAC,sCAAsC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9E,0BAA0B,CAAC,GAAG,CAAC,KAAK,EAAE;gBACpC,MAAM,EAAE,SAAS,CAAC,MAAM;gBACxB,aAAa,EAAE,SAAS,CAAC,aAAa;aACvC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,0BAA0B,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,+BAA+B,CAAC,KAAc;IACrD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC;AAChE,CAAC;AAED,SAAS,oCAAoC,CAAC,WAAsB,EAAE,KAAgB;IACpF,OAAO,KAAK,CAAC,KAAK,CAAC,+BAA+B,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;AAC5G,CAAC;AAED,SAAS,mCAAmC,CAAC,WAAsB;IACjE,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,GAAG,WAAW,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;YACrG,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,oCAAoC,CAC3C,WAAsB,EACtB,uBAAgC,EAChC,WAAkD;IAElD,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC7B,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,WAAW,EAAE,MAAM,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;QAC/C,OAAO,WAAW,CAAC,aAAa,CAAC;IACnC,CAAC;IACD,OAAO,mCAAmC,CAAC,WAAW,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,4BAA4B,CACnC,UAAiC,EACjC,IAAyB,EACzB,cAAsB;IAEtB,MAAM,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC;IAE7B,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IAED,IAAI,IAAI,KAAK,OAAO,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,SAAS,CACjB,qFAAqF,CACtF,CAAC;IACJ,CAAC;IAED,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;QAC3B,KAAgB,GAAG,CAAC;QACpB,KAAgB,IAAI,cAAc,GAAG,iCAAiC;QACtE,KAAgB,IAAI,oDAAoD,EACzE,CAAC;QACD,MAAM,SAAS,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,MAAM,IAAI,WAAW,CAAC,8CAA8C,IAAI,WAAW,SAAS,EAAE,CAAC,CAAC;IAClG,CAAC;IAED,OAAO,KAAe,CAAC;AACzB,CAAC;AAQD,SAAS,oCAAoC,CAC3C,WAAsB,EACtB,KAAgB,EAChB,IAAyB,EACzB,UAA0C,EAC1C,cAA6C;IAE7C,IAAI,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAExD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,uBAAuB,GAC3B,UAAU,CAAC,WAAW,IAAI,CAAC,sCAAsC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrF,MAAM,WAAW,GAAG,uBAAuB,CAAC,CAAC,CAAC,0BAA0B,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtG,cAAc,GAAG;YACf,cAAc,EAAE,WAAW,CAAC,MAAM;YAClC,SAAS,EAAE,uBAAuB;YAClC,uBAAuB;YACvB,OAAO,EAAE,IAAI,GAAG,EAAE;YAClB,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,aAAa,EAAE,oCAAoC,CAAC,WAAW,EAAE,uBAAuB,EAAE,WAAW,CAAC;SACvG,CAAC;QACF,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,MAAM,UAAU,IAAI,KAAK,EAAE,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,cAAc,GAAG,4BAA4B,CAAC,UAAU,EAAE,IAAI,EAAE,cAAc,CAAC,cAAc,CAAC,CAAC;QACrG,IAAI,gBAAyB,CAAC;QAE9B,IAAI,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YAC/C,gBAAgB,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAChE,CAAC;aAAM,IAAI,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,CAAC;YAC/C,gBAAgB,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC;YAE/C,IAAI,gBAAgB,KAAK,IAAI,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;gBAChE,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;aAAM,CAAC;YACN,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;YACvD,cAAc,CAAC,aAAa,IAAI,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,EAAE,cAAc,GAAG,CAAC,CAAC,CAAC;QAC5E,IACE,cAAc,CAAC,uBAAuB;YACtC,eAAe,GAAG,cAAc,CAAC,aAAa,GAAG,iCAAiC,EAClF,CAAC;YACD,MAAM,IAAI,WAAW,CAAC,8CAA8C,IAAI,WAAW,cAAc,EAAE,CAAC,CAAC;QACvG,CAAC;QAED,IAAI,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC5B,cAAc,CAAC,gBAAgB,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;QAC3D,CAAC;QAED,cAAc,CAAC,MAAM,GAAG,eAAe,CAAC;IAC1C,CAAC;AACH,CAAC;AAED,SAAS,sCAAsC,CAC7C,WAAkC,EAClC,KAA4B,EAC5B,UAA0C;IAE1C,IAAI,eAAe,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAE1D,KAAK,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YACtC,SAAS;QACX,CAAC;QAED,IAAI,gBAAyB,CAAC;QAE9B,IAAI,eAAe,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,gBAAgB,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9C,CAAC;aAAM,IAAI,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC;YACpC,gBAAgB,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC;QAED,IAAI,gBAAgB,KAAK,IAAI,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YAChE,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,eAAe,GAAG,IAAI,GAAG,EAAE,CAAC;gBAC5B,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;YACvD,CAAC;YAED,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACrC,SAAS;QACX,CAAC;QAED,IAAI,KAAK,CAAC,gBAAgB,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YACjD,sCAAsC,CAAC,gBAAgB,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;QACnF,CAAC;aAAM,IACL,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC;YAC/B,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;YACzB,CAAC,oCAAoC,CAAC,gBAAgB,EAAE,UAAU,CAAC,EACnE,CAAC;YACD,oCAAoC,CAClC,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,UAAU,EACV,sCAAsC,CACvC,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uCAAuC,CAAC,KAAc;IACpE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,sCAAsC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACrG,CAAC;AAED,MAAM,UAAU,yCAAyC,CAAC,KAAc;IACtE,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,sCAAsC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAClG,OAAO;IACT,CAAC;IAED,sCAAsC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,0BAA0B,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC/D,IAAI,UAAU,IAAI,OAAO,IAAI,UAAU,EAAE,CAAC;YACxC,yCAAyC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,WAAsB,EAAE,KAAa,EAAE,KAAc;IACnG,IAAI,sCAAsC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5D,yCAAyC,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,KAAK,EAAE;QACxC,YAAY,EAAE,IAAI;QAClB,UAAU,EAAE,IAAI;QAChB,KAAK;QACL,QAAQ,EAAE,IAAI;KACf,CAAC,CAAC;AACL,CAAC;AAED,SAAS,oCAAoC,CAAC,UAAiC;IAC7E,MAAM,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC;IAC7B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,SAAS,CACjB,qFAAqF,CACtF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAOD,SAAS,8BAA8B,CACrC,WAAsB,EACtB,KAAgB,EAChB,WAAuC;IAEvC,IAAI,oCAAoC,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC;QAC7D,WAAW,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;QAC3B,0BAA0B,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC/C,OAAO;IACT,CAAC;IAED,KAAK,MAAM,UAAU,IAAI,KAAK,EAAE,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,KAAK,GAAG,oCAAoC,CAAC,UAAU,CAAC,CAAC;QAC/D,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,gBAAgB,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;YAC5C,IAAI,gBAAgB,KAAK,IAAI,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;gBAChE,IAAI,sCAAsC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC5D,yCAAyC,CAAC,UAAU,CAAC,CAAC;gBACxD,CAAC;gBACD,WAAW,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC;YAClC,CAAC;iBAAM,CAAC;gBACN,WAAW,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,gBAAyC,EAAE,UAAU,CAAC,CAAC;YAC1F,CAAC;QACH,CAAC;aAAM,CAAC;YACN,+BAA+B,CAAC,WAAW,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAChC,WAAkC,EAClC,KAA4B;IAE5B,MAAM,iBAAiB,GAAG,sCAAsC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAElF,KAAK,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YACxE,MAAM,IAAI,WAAW,CAAC,uDAAuD,GAAG,EAAE,CAAC,CAAC;QACtF,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC;YAC9B,IAAI,iBAAiB,EAAE,CAAC;gBACtB,yCAAyC,CAAC,UAAU,CAAC,CAAC;YACxD,CAAC;YACD,WAAW,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC;YAC9B,SAAS;QACX,CAAC;QAED,IAAI,gBAAgB,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,gBAAgB,KAAK,IAAI,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YAChE,IAAI,iBAAiB,EAAE,CAAC;gBACtB,yCAAyC,CAAC,UAAU,CAAC,CAAC;YACxD,CAAC;YACD,WAAW,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC;YAC9B,SAAS;QACX,CAAC;QAED,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YACtC,WAAW,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC;YAC9B,SAAS;QACX,CAAC;QAED,IAAI,OAAO,gBAAgB,KAAK,QAAQ,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC3E,gBAAgB,IAAI,UAAU,CAAC;QACjC,CAAC;aAAM,IAAI,OAAO,gBAAgB,KAAK,QAAQ,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YAClF,gBAAgB,IAAI,UAAU,CAAC;QACjC,CAAC;aAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YACxD,gBAAgB,GAAG,yBAAyB,CAAC,gBAAgB,EAAE,UAAU,CAAC,CAAC;QAC7E,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACxE,8BAA8B,CAAC,gBAAgB,EAAE,UAAU,EAAE,yBAAyB,CAAC,CAAC;YACxF,SAAS;QACX,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,SAAS,CAAC,0BAA0B,oCAAoC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,WAAW,CAAC,GAAG,CAAC,GAAG,gBAAgB,CAAC;IACtC,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,KAAc;IAC3D,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,OAAO;IACT,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YACxE,MAAM,IAAI,WAAW,CAAC,uDAAuD,GAAG,EAAE,CAAC,CAAC;QACtF,CAAC;QAED,8BAA8B,CAAC,WAAW,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,WAAwB,EACxB,KAAa,EACb,WAAW,GAAG,KAAK;IAEnB,8BAA8B,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,iBAAiB,GAAG,WAAoC,CAAC;IAC/D,MAAM,WAAW,GAAG,KAA8B,CAAC;IACnD,MAAM,UAAU,GAAG,oCAAoC,CACrD,WAAW,IAAI,CAAC,uCAAuC,CAAC,WAAW,CAAC,CACrE,CAAC;IACF,sCAAsC,CAAC,iBAAiB,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;IACnF,yBAAyB,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;IAC1D,oCAAoC,CAAC,UAAU,CAAC,CAAC;IACjD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,qCAAqC,CACnD,WAAsB,EACtB,KAAgB,EAChB,IAAyB,EACzB,WAAW,GAAG,IAAI;IAElB,8BAA8B,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,oCAAoC,CACrD,WAAW,IAAI,CAAC,uCAAuC,CAAC,WAAW,CAAC,CACrE,CAAC;IACF,oCAAoC,CAClC,WAAW,EACX,KAAK,EACL,IAAI,EACJ,UAAU,EACV,sCAAsC,CACvC,CAAC;IACF,OAAO,GAAG,EAAE,CAAC,oCAAoC,CAAC,UAAU,CAAC,CAAC;AAChE,CAAC"}

package/internal/auth/x509-token-exchange.d.mts

@@ -0,0 +1,16 @@
+import type { X509ExchangedToken, X509Transport } from "./x509-transport-registry.mjs";
+export type { X509ExchangedToken } from "./x509-transport-registry.mjs";
+/** Parameters for one certificate-authenticated OAuth exchange. */
+export interface X509TokenExchangeOptions {
+    /** Frozen, caller-owned certificate transport shared with the eventual API request. */
+    transport: X509Transport;
+    /** Identity provider enrolled for the workload certificate. */
+    identityProviderId: string;
+    /** OpenAI service account selected for the verified certificate identity. */
+    serviceAccountId: string;
+    /** Optional caller cancellation propagated through request and response consumption. */
+    signal?: AbortSignal | undefined;
+}
+/** Exchanges one enrolled client certificate for a validated OpenAI workload access token. */
+export declare function exchangeX509Token(options: X509TokenExchangeOptions): Promise<X509ExchangedToken>;
+//# sourceMappingURL=x509-token-exchange.d.mts.map

package/internal/auth/x509-token-exchange.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"x509-token-exchange.d.mts","sourceRoot":"","sources":["../../src/internal/auth/x509-token-exchange.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,sCAAkC;AAEnF,YAAY,EAAE,kBAAkB,EAAE,sCAAkC;AAmBpE,mEAAmE;AACnE,MAAM,WAAW,wBAAwB;IACvC,uFAAuF;IACvF,SAAS,EAAE,aAAa,CAAC;IAEzB,+DAA+D;IAC/D,kBAAkB,EAAE,MAAM,CAAC;IAE3B,6EAA6E;IAC7E,gBAAgB,EAAE,MAAM,CAAC;IAEzB,wFAAwF;IACxF,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;CAClC;AA4KD,8FAA8F;AAC9F,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAsFtG"}

package/internal/auth/x509-token-exchange.d.ts

@@ -0,0 +1,16 @@
+import type { X509ExchangedToken, X509Transport } from "./x509-transport-registry.js";
+export type { X509ExchangedToken } from "./x509-transport-registry.js";
+/** Parameters for one certificate-authenticated OAuth exchange. */
+export interface X509TokenExchangeOptions {
+    /** Frozen, caller-owned certificate transport shared with the eventual API request. */
+    transport: X509Transport;
+    /** Identity provider enrolled for the workload certificate. */
+    identityProviderId: string;
+    /** OpenAI service account selected for the verified certificate identity. */
+    serviceAccountId: string;
+    /** Optional caller cancellation propagated through request and response consumption. */
+    signal?: AbortSignal | undefined;
+}
+/** Exchanges one enrolled client certificate for a validated OpenAI workload access token. */
+export declare function exchangeX509Token(options: X509TokenExchangeOptions): Promise<X509ExchangedToken>;
+//# sourceMappingURL=x509-token-exchange.d.ts.map

package/internal/auth/x509-token-exchange.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"x509-token-exchange.d.ts","sourceRoot":"","sources":["../../src/internal/auth/x509-token-exchange.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,qCAAkC;AAEnF,YAAY,EAAE,kBAAkB,EAAE,qCAAkC;AAmBpE,mEAAmE;AACnE,MAAM,WAAW,wBAAwB;IACvC,uFAAuF;IACvF,SAAS,EAAE,aAAa,CAAC;IAEzB,+DAA+D;IAC/D,kBAAkB,EAAE,MAAM,CAAC;IAE3B,6EAA6E;IAC7E,gBAAgB,EAAE,MAAM,CAAC;IAEzB,wFAAwF;IACxF,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;CAClC;AA4KD,8FAA8F;AAC9F,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAsFtG"}

package/internal/auth/x509-token-exchange.js

@@ -0,0 +1,246 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.exchangeX509Token = exchangeX509Token;
+const error_1 = require("../../core/error.js");
+const values_1 = require("../utils/values.js");
+const x509_transport_capability_1 = require("./x509-transport-capability.js");
+const x509_transport_registry_1 = require("./x509-transport-registry.js");
+const _x509_transport_state_1 = require("#x509-transport-state");
+const TOKEN_EXCHANGE_URL = new URL('https://mtls.auth.openai.com/oauth/token');
+const TOKEN_EXCHANGE_GRANT = 'urn:ietf:params:oauth:grant-type:token-exchange';
+const X509_SUBJECT_TOKEN = 'urn:openai:params:oauth:token-type:x509';
+const ACCESS_TOKEN_TYPE = 'urn:ietf:params:oauth:token-type:access_token';
+const SAFE_ACCESS_TOKEN = /^[A-Za-z0-9._~+/-]+=*$/u;
+const SAFE_OAUTH_ERRORS = new Set(['invalid_grant', 'invalid_subject_token', 'token_exchange_server_error']);
+const SAFE_RESPONSE_HEADERS = ['retry-after', 'retry-after-ms', 'x-should-retry', 'x-request-id'];
+const MAX_TOKEN_EXCHANGE_DURATION_MS = 5000;
+function transientConnectionError(message, failure) {
+    const error = new error_1.APIConnectionError({ message });
+    if ((0, x509_transport_registry_1.isRetryableX509TransportFailure)(failure)) {
+        (0, _x509_transport_state_1.markTransientX509ConnectionError)(error);
+    }
+    return error;
+}
+async function cancelReader(reader, reason) {
+    try {
+        await reader.cancel(reason);
+    }
+    catch {
+        // Response retirement is best-effort and must never replace the sanitized exchange result.
+    }
+}
+function cancelResponseBody(response) {
+    if (!response.body) {
+        return;
+    }
+    const reader = response.body.getReader();
+    try {
+        void cancelReader(reader);
+    }
+    finally {
+        reader.releaseLock();
+    }
+}
+async function readResponseBody(response, signal) {
+    if (!response.body) {
+        throw new error_1.OpenAIError('X.509 workload identity token exchange returned invalid JSON.');
+    }
+    const reader = response.body.getReader();
+    const chunks = [];
+    let totalBytes = 0;
+    const cancel = () => {
+        void cancelReader(reader, signal?.reason);
+    };
+    signal?.addEventListener('abort', cancel, { once: true });
+    try {
+        while (true) {
+            signal?.throwIfAborted();
+            // oxlint-disable-next-line no-await-in-loop -- Token-response chunks must be consumed in wire order.
+            const chunk = await reader.read();
+            signal?.throwIfAborted();
+            if (chunk.done) {
+                break;
+            }
+            chunks.push(chunk.value);
+            totalBytes += chunk.value.byteLength;
+        }
+    }
+    catch (error) {
+        cancel();
+        if (signal?.aborted) {
+            signal.throwIfAborted();
+        }
+        throw transientConnectionError('X.509 workload identity token response could not be read.', error);
+    }
+    finally {
+        signal?.removeEventListener('abort', cancel);
+        reader.releaseLock();
+    }
+    const bytes = new Uint8Array(totalBytes);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    try {
+        return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+    }
+    catch {
+        throw new error_1.OpenAIError('X.509 workload identity token exchange returned invalid JSON.');
+    }
+}
+function validateTokenResponse(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        throw new error_1.OpenAIError('X.509 workload identity token exchange returned an invalid token response.');
+    }
+    const response = value;
+    if (!(0, values_1.hasOwn)(response, 'access_token') ||
+        typeof response['access_token'] !== 'string' ||
+        !SAFE_ACCESS_TOKEN.test(response['access_token'])) {
+        throw new error_1.OpenAIError('X.509 workload identity token exchange returned an invalid access token.');
+    }
+    if (!(0, values_1.hasOwn)(response, 'token_type') || !(0, values_1.hasOwn)(response, 'issued_token_type')) {
+        throw new error_1.OpenAIError('X.509 workload identity token exchange returned an invalid token type.');
+    }
+    const tokenType = response['token_type'];
+    if (typeof tokenType !== 'string' ||
+        tokenType.toLowerCase() !== 'bearer' ||
+        response['issued_token_type'] !== ACCESS_TOKEN_TYPE) {
+        throw new error_1.OpenAIError('X.509 workload identity token exchange returned an invalid token type.');
+    }
+    if (!(0, values_1.hasOwn)(response, 'expires_in')) {
+        throw new error_1.OpenAIError('X.509 workload identity token exchange returned an invalid token lifetime.');
+    }
+    const expiresIn = response['expires_in'];
+    if (typeof expiresIn !== 'number' || !Number.isFinite(expiresIn) || expiresIn <= 0 || expiresIn > 3600) {
+        throw new error_1.OpenAIError('X.509 workload identity token exchange returned an invalid token lifetime.');
+    }
+    return { accessToken: response['access_token'], expiresIn };
+}
+function safeResponseHeaders(response, includeRetryHints = false) {
+    const headers = new Headers();
+    for (const name of SAFE_RESPONSE_HEADERS) {
+        if (name !== 'x-request-id' && !includeRetryHints) {
+            continue;
+        }
+        const value = response.headers.get(name);
+        if (value !== null) {
+            headers.set(name, value);
+        }
+    }
+    return headers;
+}
+function readOAuthErrorCode(value) {
+    if (typeof value === 'string') {
+        return value;
+    }
+    if (typeof value === 'object' && value !== null && (0, values_1.hasOwn)(value, 'code')) {
+        const code = Object.getOwnPropertyDescriptor(value, 'code')?.value;
+        return typeof code === 'string' ? code : undefined;
+    }
+    return undefined;
+}
+async function oauthError(response, signal, callerSignal) {
+    let errorCode;
+    try {
+        const parsed = await readResponseBody(response, signal);
+        if (typeof parsed === 'object' && parsed !== null && (0, values_1.hasOwn)(parsed, 'error')) {
+            const code = readOAuthErrorCode(Object.getOwnPropertyDescriptor(parsed, 'error')?.value);
+            if (code !== undefined && SAFE_OAUTH_ERRORS.has(code)) {
+                errorCode = { error: code };
+            }
+        }
+    }
+    catch {
+        callerSignal?.throwIfAborted();
+        if (signal?.aborted &&
+            !(signal.reason instanceof error_1.APIConnectionTimeoutError && (0, _x509_transport_state_1.isTransientX509ConnectionError)(signal.reason))) {
+            signal.throwIfAborted();
+        }
+    }
+    const { status } = response;
+    if (status !== 400 && status !== 401 && status !== 403) {
+        throw new error_1.OpenAIError('X.509 workload identity received an invalid OAuth error status.');
+    }
+    const headers = safeResponseHeaders(response);
+    const error = new error_1.OAuthError(status, errorCode, headers);
+    (0, _x509_transport_state_1.rememberX509OAuthError)(error, { status, error: errorCode, headers });
+    return error;
+}
+/** Exchanges one enrolled client certificate for a validated OpenAI workload access token. */
+async function exchangeX509Token(options) {
+    const { signal: callerSignal } = options;
+    callerSignal?.throwIfAborted();
+    const { identityProviderId, serviceAccountId, transport } = options;
+    if (typeof identityProviderId !== 'string' ||
+        identityProviderId.trim().length === 0 ||
+        typeof serviceAccountId !== 'string' ||
+        serviceAccountId.trim().length === 0) {
+        throw new error_1.OpenAIError('X.509 workload identity requires nonempty provider and service-account identifiers.');
+    }
+    const timeoutController = new AbortController();
+    const signal = callerSignal
+        ? AbortSignal.any([callerSignal, timeoutController.signal])
+        : timeoutController.signal;
+    const timeout = setTimeout(() => {
+        const error = new error_1.APIConnectionTimeoutError({
+            message: 'X.509 workload identity token exchange timed out.',
+        });
+        (0, _x509_transport_state_1.markTransientX509ConnectionError)(error);
+        timeoutController.abort(error);
+    }, MAX_TOKEN_EXCHANGE_DURATION_MS);
+    timeout.unref();
+    try {
+        const body = JSON.stringify({
+            grant_type: TOKEN_EXCHANGE_GRANT,
+            subject_token_type: X509_SUBJECT_TOKEN,
+            identity_provider_id: identityProviderId,
+            service_account_id: serviceAccountId,
+        });
+        let response;
+        try {
+            response = await (0, x509_transport_capability_1.sendX509Request)(transport, TOKEN_EXCHANGE_URL, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body,
+                redirect: 'manual',
+                signal,
+            });
+        }
+        catch (error) {
+            signal.throwIfAborted();
+            throw transientConnectionError('X.509 workload identity token exchange connection failed.', error);
+        }
+        signal.throwIfAborted();
+        if (response.ok) {
+            try {
+                return validateTokenResponse(await readResponseBody(response, signal));
+            }
+            catch (error) {
+                signal.throwIfAborted();
+                if (error instanceof error_1.APIConnectionError) {
+                    throw error;
+                }
+                if (error instanceof error_1.OpenAIError) {
+                    throw error_1.APIError.generate(response.status, undefined, error.message, safeResponseHeaders(response));
+                }
+                throw error;
+            }
+        }
+        if (response.status === 400 || response.status === 401 || response.status === 403) {
+            throw await oauthError(response, signal, callerSignal);
+        }
+        cancelResponseBody(response);
+        const retryableStatus = response.status === 408 || response.status === 409 || response.status === 429 || response.status >= 500;
+        const headers = safeResponseHeaders(response, retryableStatus);
+        const error = error_1.APIError.generate(response.status, undefined, 'X.509 workload identity token exchange failed.', headers);
+        if (retryableStatus && headers.get('x-should-retry') !== 'false') {
+            (0, _x509_transport_state_1.markRetryableX509IssuerError)(error);
+        }
+        throw error;
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+//# sourceMappingURL=x509-token-exchange.js.map

package/internal/auth/x509-token-exchange.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"x509-token-exchange.js","sourceRoot":"","sources":["../../src/internal/auth/x509-token-exchange.ts"],"names":[],"mappings":";;AA+NA,8CAsFC;AArTD,+CAM0B;AAC1B,+CAAyC;AACzC,8EAA8D;AAC9D,0EAA4E;AAC5E,iEAK+B;AAK/B,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,0CAA0C,CAAC,CAAC;AAC/E,MAAM,oBAAoB,GAAG,iDAAiD,CAAC;AAC/E,MAAM,kBAAkB,GAAG,yCAAyC,CAAC;AACrE,MAAM,iBAAiB,GAAG,+CAA+C,CAAC;AAC1E,MAAM,iBAAiB,GAAG,yBAAyB,CAAC;AACpD,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,uBAAuB,EAAE,6BAA6B,CAAC,CAAC,CAAC;AAC7G,MAAM,qBAAqB,GAAG,CAAC,aAAa,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAAC;AAClG,MAAM,8BAA8B,GAAG,IAAI,CAAC;AAE5C,SAAS,wBAAwB,CAAC,OAAe,EAAE,OAAgB;IACjE,MAAM,KAAK,GAAG,IAAI,0BAAkB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAClD,IAAI,IAAA,yDAA+B,EAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,IAAA,wDAAgC,EAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAiBD,KAAK,UAAU,YAAY,CACzB,MAA+C,EAC/C,MAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,2FAA2F;IAC7F,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAkB;IAC5C,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,KAAK,YAAY,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,QAAkB,EAAE,MAAoB;IACtE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,mBAAW,CAAC,+DAA+D,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,MAAM,MAAM,GAAG,GAAG,EAAE;QAClB,KAAK,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC,CAAC;IACF,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAE1D,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,qGAAqG;YACrG,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAClC,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;gBACf,MAAM;YACR,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACzB,UAAU,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;QACvC,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,EAAE,CAAC;QACT,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,CAAC;QACD,MAAM,wBAAwB,CAAC,2DAA2D,EAAE,KAAK,CAAC,CAAC;IACrG,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;IAC7B,CAAC;IAED,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,mBAAW,CAAC,+DAA+D,CAAC,CAAC;IACzF,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,mBAAW,CAAC,4EAA4E,CAAC,CAAC;IACtG,CAAC;IAED,MAAM,QAAQ,GAAG,KAAgC,CAAC;IAClD,IACE,CAAC,IAAA,eAAM,EAAC,QAAQ,EAAE,cAAc,CAAC;QACjC,OAAO,QAAQ,CAAC,cAAc,CAAC,KAAK,QAAQ;QAC5C,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,EACjD,CAAC;QACD,MAAM,IAAI,mBAAW,CAAC,0EAA0E,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,CAAC,IAAA,eAAM,EAAC,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,IAAA,eAAM,EAAC,QAAQ,EAAE,mBAAmB,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,mBAAW,CAAC,wEAAwE,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;IACzC,IACE,OAAO,SAAS,KAAK,QAAQ;QAC7B,SAAS,CAAC,WAAW,EAAE,KAAK,QAAQ;QACpC,QAAQ,CAAC,mBAAmB,CAAC,KAAK,iBAAiB,EACnD,CAAC;QACD,MAAM,IAAI,mBAAW,CAAC,wEAAwE,CAAC,CAAC;IAClG,CAAC;IAED,IAAI,CAAC,IAAA,eAAM,EAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,mBAAW,CAAC,4EAA4E,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,IAAI,SAAS,GAAG,IAAI,EAAE,CAAC;QACvG,MAAM,IAAI,mBAAW,CAAC,4EAA4E,CAAC,CAAC;IACtG,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,EAAE,CAAC;AAC9D,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAkB,EAAE,iBAAiB,GAAG,KAAK;IACxE,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,qBAAqB,EAAE,CAAC;QACzC,IAAI,IAAI,KAAK,cAAc,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAClD,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,IAAA,eAAM,EAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,GAAY,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC;QAC5E,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACrD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,QAAkB,EAClB,MAAoB,EACpB,YAA0B;IAE1B,IAAI,SAAwC,CAAC;IAE7C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACxD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,IAAA,eAAM,EAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;YAC7E,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAC,wBAAwB,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;YACzF,IAAI,IAAI,KAAK,SAAS,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtD,SAAS,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,YAAY,EAAE,cAAc,EAAE,CAAC;QAC/B,IACE,MAAM,EAAE,OAAO;YACf,CAAC,CAAC,MAAM,CAAC,MAAM,YAAY,iCAAyB,IAAI,IAAA,sDAA8B,EAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EACtG,CAAC;YACD,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;IAC5B,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACvD,MAAM,IAAI,mBAAW,CAAC,iEAAiE,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,IAAI,kBAAU,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACzD,IAAA,8CAAsB,EAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;IACrE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8FAA8F;AACvF,KAAK,UAAU,iBAAiB,CAAC,OAAiC;IACvE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;IACzC,YAAY,EAAE,cAAc,EAAE,CAAC;IAC/B,MAAM,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IACpE,IACE,OAAO,kBAAkB,KAAK,QAAQ;QACtC,kBAAkB,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QACtC,OAAO,gBAAgB,KAAK,QAAQ;QACpC,gBAAgB,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EACpC,CAAC;QACD,MAAM,IAAI,mBAAW,CACnB,qFAAqF,CACtF,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,GAAG,IAAI,eAAe,EAAE,CAAC;IAChD,MAAM,MAAM,GAAG,YAAY;QACzB,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC3D,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC;IAC7B,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;QAC9B,MAAM,KAAK,GAAG,IAAI,iCAAyB,CAAC;YAC1C,OAAO,EAAE,mDAAmD;SAC7D,CAAC,CAAC;QACH,IAAA,wDAAgC,EAAC,KAAK,CAAC,CAAC;QACxC,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC,EAAE,8BAA8B,CAAC,CAAC;IACnC,OAAO,CAAC,KAAK,EAAE,CAAC;IAEhB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;YAC1B,UAAU,EAAE,oBAAoB;YAChC,kBAAkB,EAAE,kBAAkB;YACtC,oBAAoB,EAAE,kBAAkB;YACxC,kBAAkB,EAAE,gBAAgB;SACrC,CAAC,CAAC;QAEH,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAA,2CAAe,EAAC,SAAS,EAAE,kBAAkB,EAAE;gBAC9D,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI;gBACJ,QAAQ,EAAE,QAAQ;gBAClB,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,wBAAwB,CAAC,2DAA2D,EAAE,KAAK,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,CAAC,cAAc,EAAE,CAAC;QAExB,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,OAAO,qBAAqB,CAAC,MAAM,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;YACzE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,cAAc,EAAE,CAAC;gBACxB,IAAI,KAAK,YAAY,0BAAkB,EAAE,CAAC;oBACxC,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,IAAI,KAAK,YAAY,mBAAW,EAAE,CAAC;oBACjC,MAAM,gBAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACpG,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAClF,MAAM,MAAM,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;QACzD,CAAC;QAED,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAC7B,MAAM,eAAe,GACnB,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,CAAC;QAC1G,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QAC/D,MAAM,KAAK,GAAG,gBAAQ,CAAC,QAAQ,CAC7B,QAAQ,CAAC,MAAM,EACf,SAAS,EACT,gDAAgD,EAChD,OAAO,CACR,CAAC;QACF,IAAI,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,KAAK,OAAO,EAAE,CAAC;YACjE,IAAA,oDAA4B,EAAC,KAAK,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;AACH,CAAC"}