openai 7.5.0 → 7.7.0

package/internal/auth/x509-token-exchange.mjs

@@ -0,0 +1,243 @@
+import { APIConnectionError, APIConnectionTimeoutError, APIError, OAuthError, OpenAIError, } from "../../core/error.mjs";
+import { hasOwn } from "../utils/values.mjs";
+import { sendX509Request } from "./x509-transport-capability.mjs";
+import { isRetryableX509TransportFailure } from "./x509-transport-registry.mjs";
+import { isTransientX509ConnectionError, markRetryableX509IssuerError, markTransientX509ConnectionError, rememberX509OAuthError, } from '#x509-transport-state';
+const TOKEN_EXCHANGE_URL = new URL('https://mtls.auth.openai.com/oauth/token');
+const TOKEN_EXCHANGE_GRANT = 'urn:ietf:params:oauth:grant-type:token-exchange';
+const X509_SUBJECT_TOKEN = 'urn:openai:params:oauth:token-type:x509';
+const ACCESS_TOKEN_TYPE = 'urn:ietf:params:oauth:token-type:access_token';
+const SAFE_ACCESS_TOKEN = /^[A-Za-z0-9._~+/-]+=*$/u;
+const SAFE_OAUTH_ERRORS = new Set(['invalid_grant', 'invalid_subject_token', 'token_exchange_server_error']);
+const SAFE_RESPONSE_HEADERS = ['retry-after', 'retry-after-ms', 'x-should-retry', 'x-request-id'];
+const MAX_TOKEN_EXCHANGE_DURATION_MS = 5000;
+function transientConnectionError(message, failure) {
+    const error = new APIConnectionError({ message });
+    if (isRetryableX509TransportFailure(failure)) {
+        markTransientX509ConnectionError(error);
+    }
+    return error;
+}
+async function cancelReader(reader, reason) {
+    try {
+        await reader.cancel(reason);
+    }
+    catch {
+        // Response retirement is best-effort and must never replace the sanitized exchange result.
+    }
+}
+function cancelResponseBody(response) {
+    if (!response.body) {
+        return;
+    }
+    const reader = response.body.getReader();
+    try {
+        void cancelReader(reader);
+    }
+    finally {
+        reader.releaseLock();
+    }
+}
+async function readResponseBody(response, signal) {
+    if (!response.body) {
+        throw new OpenAIError('X.509 workload identity token exchange returned invalid JSON.');
+    }
+    const reader = response.body.getReader();
+    const chunks = [];
+    let totalBytes = 0;
+    const cancel = () => {
+        void cancelReader(reader, signal?.reason);
+    };
+    signal?.addEventListener('abort', cancel, { once: true });
+    try {
+        while (true) {
+            signal?.throwIfAborted();
+            // oxlint-disable-next-line no-await-in-loop -- Token-response chunks must be consumed in wire order.
+            const chunk = await reader.read();
+            signal?.throwIfAborted();
+            if (chunk.done) {
+                break;
+            }
+            chunks.push(chunk.value);
+            totalBytes += chunk.value.byteLength;
+        }
+    }
+    catch (error) {
+        cancel();
+        if (signal?.aborted) {
+            signal.throwIfAborted();
+        }
+        throw transientConnectionError('X.509 workload identity token response could not be read.', error);
+    }
+    finally {
+        signal?.removeEventListener('abort', cancel);
+        reader.releaseLock();
+    }
+    const bytes = new Uint8Array(totalBytes);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    try {
+        return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+    }
+    catch {
+        throw new OpenAIError('X.509 workload identity token exchange returned invalid JSON.');
+    }
+}
+function validateTokenResponse(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        throw new OpenAIError('X.509 workload identity token exchange returned an invalid token response.');
+    }
+    const response = value;
+    if (!hasOwn(response, 'access_token') ||
+        typeof response['access_token'] !== 'string' ||
+        !SAFE_ACCESS_TOKEN.test(response['access_token'])) {
+        throw new OpenAIError('X.509 workload identity token exchange returned an invalid access token.');
+    }
+    if (!hasOwn(response, 'token_type') || !hasOwn(response, 'issued_token_type')) {
+        throw new OpenAIError('X.509 workload identity token exchange returned an invalid token type.');
+    }
+    const tokenType = response['token_type'];
+    if (typeof tokenType !== 'string' ||
+        tokenType.toLowerCase() !== 'bearer' ||
+        response['issued_token_type'] !== ACCESS_TOKEN_TYPE) {
+        throw new OpenAIError('X.509 workload identity token exchange returned an invalid token type.');
+    }
+    if (!hasOwn(response, 'expires_in')) {
+        throw new OpenAIError('X.509 workload identity token exchange returned an invalid token lifetime.');
+    }
+    const expiresIn = response['expires_in'];
+    if (typeof expiresIn !== 'number' || !Number.isFinite(expiresIn) || expiresIn <= 0 || expiresIn > 3600) {
+        throw new OpenAIError('X.509 workload identity token exchange returned an invalid token lifetime.');
+    }
+    return { accessToken: response['access_token'], expiresIn };
+}
+function safeResponseHeaders(response, includeRetryHints = false) {
+    const headers = new Headers();
+    for (const name of SAFE_RESPONSE_HEADERS) {
+        if (name !== 'x-request-id' && !includeRetryHints) {
+            continue;
+        }
+        const value = response.headers.get(name);
+        if (value !== null) {
+            headers.set(name, value);
+        }
+    }
+    return headers;
+}
+function readOAuthErrorCode(value) {
+    if (typeof value === 'string') {
+        return value;
+    }
+    if (typeof value === 'object' && value !== null && hasOwn(value, 'code')) {
+        const code = Object.getOwnPropertyDescriptor(value, 'code')?.value;
+        return typeof code === 'string' ? code : undefined;
+    }
+    return undefined;
+}
+async function oauthError(response, signal, callerSignal) {
+    let errorCode;
+    try {
+        const parsed = await readResponseBody(response, signal);
+        if (typeof parsed === 'object' && parsed !== null && hasOwn(parsed, 'error')) {
+            const code = readOAuthErrorCode(Object.getOwnPropertyDescriptor(parsed, 'error')?.value);
+            if (code !== undefined && SAFE_OAUTH_ERRORS.has(code)) {
+                errorCode = { error: code };
+            }
+        }
+    }
+    catch {
+        callerSignal?.throwIfAborted();
+        if (signal?.aborted &&
+            !(signal.reason instanceof APIConnectionTimeoutError && isTransientX509ConnectionError(signal.reason))) {
+            signal.throwIfAborted();
+        }
+    }
+    const { status } = response;
+    if (status !== 400 && status !== 401 && status !== 403) {
+        throw new OpenAIError('X.509 workload identity received an invalid OAuth error status.');
+    }
+    const headers = safeResponseHeaders(response);
+    const error = new OAuthError(status, errorCode, headers);
+    rememberX509OAuthError(error, { status, error: errorCode, headers });
+    return error;
+}
+/** Exchanges one enrolled client certificate for a validated OpenAI workload access token. */
+export async function exchangeX509Token(options) {
+    const { signal: callerSignal } = options;
+    callerSignal?.throwIfAborted();
+    const { identityProviderId, serviceAccountId, transport } = options;
+    if (typeof identityProviderId !== 'string' ||
+        identityProviderId.trim().length === 0 ||
+        typeof serviceAccountId !== 'string' ||
+        serviceAccountId.trim().length === 0) {
+        throw new OpenAIError('X.509 workload identity requires nonempty provider and service-account identifiers.');
+    }
+    const timeoutController = new AbortController();
+    const signal = callerSignal
+        ? AbortSignal.any([callerSignal, timeoutController.signal])
+        : timeoutController.signal;
+    const timeout = setTimeout(() => {
+        const error = new APIConnectionTimeoutError({
+            message: 'X.509 workload identity token exchange timed out.',
+        });
+        markTransientX509ConnectionError(error);
+        timeoutController.abort(error);
+    }, MAX_TOKEN_EXCHANGE_DURATION_MS);
+    timeout.unref();
+    try {
+        const body = JSON.stringify({
+            grant_type: TOKEN_EXCHANGE_GRANT,
+            subject_token_type: X509_SUBJECT_TOKEN,
+            identity_provider_id: identityProviderId,
+            service_account_id: serviceAccountId,
+        });
+        let response;
+        try {
+            response = await sendX509Request(transport, TOKEN_EXCHANGE_URL, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body,
+                redirect: 'manual',
+                signal,
+            });
+        }
+        catch (error) {
+            signal.throwIfAborted();
+            throw transientConnectionError('X.509 workload identity token exchange connection failed.', error);
+        }
+        signal.throwIfAborted();
+        if (response.ok) {
+            try {
+                return validateTokenResponse(await readResponseBody(response, signal));
+            }
+            catch (error) {
+                signal.throwIfAborted();
+                if (error instanceof APIConnectionError) {
+                    throw error;
+                }
+                if (error instanceof OpenAIError) {
+                    throw APIError.generate(response.status, undefined, error.message, safeResponseHeaders(response));
+                }
+                throw error;
+            }
+        }
+        if (response.status === 400 || response.status === 401 || response.status === 403) {
+            throw await oauthError(response, signal, callerSignal);
+        }
+        cancelResponseBody(response);
+        const retryableStatus = response.status === 408 || response.status === 409 || response.status === 429 || response.status >= 500;
+        const headers = safeResponseHeaders(response, retryableStatus);
+        const error = APIError.generate(response.status, undefined, 'X.509 workload identity token exchange failed.', headers);
+        if (retryableStatus && headers.get('x-should-retry') !== 'false') {
+            markRetryableX509IssuerError(error);
+        }
+        throw error;
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+//# sourceMappingURL=x509-token-exchange.mjs.map

package/internal/auth/x509-token-exchange.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"x509-token-exchange.mjs","sourceRoot":"","sources":["../../src/internal/auth/x509-token-exchange.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,QAAQ,EACR,UAAU,EACV,WAAW,GACZ,6BAAyB;AAC1B,OAAO,EAAE,MAAM,EAAE,4BAAwB;AACzC,OAAO,EAAE,eAAe,EAAE,wCAAoC;AAC9D,OAAO,EAAE,+BAA+B,EAAE,sCAAkC;AAC5E,OAAO,EACL,8BAA8B,EAC9B,4BAA4B,EAC5B,gCAAgC,EAChC,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAK/B,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,0CAA0C,CAAC,CAAC;AAC/E,MAAM,oBAAoB,GAAG,iDAAiD,CAAC;AAC/E,MAAM,kBAAkB,GAAG,yCAAyC,CAAC;AACrE,MAAM,iBAAiB,GAAG,+CAA+C,CAAC;AAC1E,MAAM,iBAAiB,GAAG,yBAAyB,CAAC;AACpD,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,uBAAuB,EAAE,6BAA6B,CAAC,CAAC,CAAC;AAC7G,MAAM,qBAAqB,GAAG,CAAC,aAAa,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAAC;AAClG,MAAM,8BAA8B,GAAG,IAAI,CAAC;AAE5C,SAAS,wBAAwB,CAAC,OAAe,EAAE,OAAgB;IACjE,MAAM,KAAK,GAAG,IAAI,kBAAkB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAClD,IAAI,+BAA+B,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,gCAAgC,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAiBD,KAAK,UAAU,YAAY,CACzB,MAA+C,EAC/C,MAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,2FAA2F;IAC7F,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAkB;IAC5C,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,KAAK,YAAY,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,QAAkB,EAAE,MAAoB;IACtE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,WAAW,CAAC,+DAA+D,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,MAAM,MAAM,GAAG,GAAG,EAAE;QAClB,KAAK,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC,CAAC;IACF,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAE1D,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,qGAAqG;YACrG,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAClC,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;gBACf,MAAM;YACR,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACzB,UAAU,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;QACvC,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,EAAE,CAAC;QACT,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,CAAC;QACD,MAAM,wBAAwB,CAAC,2DAA2D,EAAE,KAAK,CAAC,CAAC;IACrG,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;IAC7B,CAAC;IAED,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,CAAC,+DAA+D,CAAC,CAAC;IACzF,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,WAAW,CAAC,4EAA4E,CAAC,CAAC;IACtG,CAAC;IAED,MAAM,QAAQ,GAAG,KAAgC,CAAC;IAClD,IACE,CAAC,MAAM,CAAC,QAAQ,EAAE,cAAc,CAAC;QACjC,OAAO,QAAQ,CAAC,cAAc,CAAC,KAAK,QAAQ;QAC5C,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,EACjD,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,0EAA0E,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,mBAAmB,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,WAAW,CAAC,wEAAwE,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;IACzC,IACE,OAAO,SAAS,KAAK,QAAQ;QAC7B,SAAS,CAAC,WAAW,EAAE,KAAK,QAAQ;QACpC,QAAQ,CAAC,mBAAmB,CAAC,KAAK,iBAAiB,EACnD,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,wEAAwE,CAAC,CAAC;IAClG,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,WAAW,CAAC,4EAA4E,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,IAAI,SAAS,GAAG,IAAI,EAAE,CAAC;QACvG,MAAM,IAAI,WAAW,CAAC,4EAA4E,CAAC,CAAC;IACtG,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,EAAE,CAAC;AAC9D,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAkB,EAAE,iBAAiB,GAAG,KAAK;IACxE,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,qBAAqB,EAAE,CAAC;QACzC,IAAI,IAAI,KAAK,cAAc,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAClD,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,GAAY,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC;QAC5E,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACrD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,QAAkB,EAClB,MAAoB,EACpB,YAA0B;IAE1B,IAAI,SAAwC,CAAC;IAE7C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACxD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;YAC7E,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAC,wBAAwB,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;YACzF,IAAI,IAAI,KAAK,SAAS,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtD,SAAS,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,YAAY,EAAE,cAAc,EAAE,CAAC;QAC/B,IACE,MAAM,EAAE,OAAO;YACf,CAAC,CAAC,MAAM,CAAC,MAAM,YAAY,yBAAyB,IAAI,8BAA8B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EACtG,CAAC;YACD,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;IAC5B,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACvD,MAAM,IAAI,WAAW,CAAC,iEAAiE,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACzD,sBAAsB,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;IACrE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAiC;IACvE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;IACzC,YAAY,EAAE,cAAc,EAAE,CAAC;IAC/B,MAAM,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IACpE,IACE,OAAO,kBAAkB,KAAK,QAAQ;QACtC,kBAAkB,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QACtC,OAAO,gBAAgB,KAAK,QAAQ;QACpC,gBAAgB,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EACpC,CAAC;QACD,MAAM,IAAI,WAAW,CACnB,qFAAqF,CACtF,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,GAAG,IAAI,eAAe,EAAE,CAAC;IAChD,MAAM,MAAM,GAAG,YAAY;QACzB,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC3D,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC;IAC7B,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;QAC9B,MAAM,KAAK,GAAG,IAAI,yBAAyB,CAAC;YAC1C,OAAO,EAAE,mDAAmD;SAC7D,CAAC,CAAC;QACH,gCAAgC,CAAC,KAAK,CAAC,CAAC;QACxC,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC,EAAE,8BAA8B,CAAC,CAAC;IACnC,OAAO,CAAC,KAAK,EAAE,CAAC;IAEhB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;YAC1B,UAAU,EAAE,oBAAoB;YAChC,kBAAkB,EAAE,kBAAkB;YACtC,oBAAoB,EAAE,kBAAkB;YACxC,kBAAkB,EAAE,gBAAgB;SACrC,CAAC,CAAC;QAEH,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,kBAAkB,EAAE;gBAC9D,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI;gBACJ,QAAQ,EAAE,QAAQ;gBAClB,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,wBAAwB,CAAC,2DAA2D,EAAE,KAAK,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,CAAC,cAAc,EAAE,CAAC;QAExB,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,OAAO,qBAAqB,CAAC,MAAM,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;YACzE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,cAAc,EAAE,CAAC;gBACxB,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;oBACxC,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;oBACjC,MAAM,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACpG,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAClF,MAAM,MAAM,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;QACzD,CAAC;QAED,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAC7B,MAAM,eAAe,GACnB,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,CAAC;QAC1G,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QAC/D,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAC7B,QAAQ,CAAC,MAAM,EACf,SAAS,EACT,gDAAgD,EAChD,OAAO,CACR,CAAC;QACF,IAAI,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,KAAK,OAAO,EAAE,CAAC;YACjE,4BAA4B,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;AACH,CAAC"}

package/internal/auth/x509-transport-capability.d.mts

@@ -0,0 +1,37 @@
+import { Agent, ProxyAgent } from 'undici';
+import type { RegisteredX509Transport, X509Transport } from "./x509-transport-registry.mjs";
+export type { X509Transport } from "./x509-transport-registry.mjs";
+/** Explicitly supported, application-owned Undici proxy configurations. */
+export type X509ProxyMode = 'direct' | 'http-connect' | 'https-connect';
+/** Application attestation for one caller-owned static-certificate Undici transport. */
+export interface X509TransportOptions {
+    /** X.509 transport currently supports genuine Node.js runtimes only. */
+    runtime: 'node';
+    /** Caller-owned Undici Agent or ProxyAgent; the SDK never closes or inspects it. */
+    dispatcher: Agent | ProxyAgent;
+    /** Attests that the dispatcher uses one static workload-certificate identity. */
+    certificateIdentity: 'static';
+    /** Attests that proxy TLS and CONNECT credentials are independently configured. */
+    proxy: X509ProxyMode;
+}
+/** Registers only a genuine frozen capability whose JavaScript private dispatcher cannot be forged. */
+export declare function registerX509Transport(transport: X509Transport, registered: RegisteredX509Transport): void;
+/**
+ * Creates a frozen, opaque capability for one caller-owned Undici transport.
+ *
+ * `certificateIdentity: 'static'` is an application attestation: the SDK does
+ * not inspect certificates, private dispatcher internals, callbacks, or TLS
+ * options and cannot cryptographically prove certificate selection. Configure
+ * one static identity without custom dispatcher factories. For HTTPS CONNECT,
+ * independently configure `proxyTls` and `requestTls` so workload credentials
+ * never reach the proxy. Rotation requires creating a fresh dispatcher and
+ * capability; the application remains responsible for draining the old one.
+ *
+ * This Node-only preview entrypoint requires the optional `undici` peer at
+ * version 5.2.0 or later. CONNECT proxy modes require version 5.5.1 or
+ * later; ordinary SDK clients retain broader compatibility.
+ */
+export declare function createX509Transport(options: X509TransportOptions): X509Transport;
+/** Dispatches through the opaque attested transport without accepting replacement dispatchers. */
+export declare function sendX509Request(transport: X509Transport, target: URL, options: RequestInit): Promise<Response>;
+//# sourceMappingURL=x509-transport-capability.d.mts.map

package/internal/auth/x509-transport-capability.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"x509-transport-capability.d.mts","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-capability.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,UAAU,EAAkB,MAAM,QAAQ,CAAC;AAG3D,OAAO,KAAK,EAAE,uBAAuB,EAAE,aAAa,EAAE,sCAAkC;AAGxF,YAAY,EAAE,aAAa,EAAE,sCAAkC;AAE/D,2EAA2E;AAC3E,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,cAAc,GAAG,eAAe,CAAC;AAExE,wFAAwF;AACxF,MAAM,WAAW,oBAAoB;IACnC,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAEhB,oFAAoF;IACpF,UAAU,EAAE,KAAK,GAAG,UAAU,CAAC;IAE/B,iFAAiF;IACjF,mBAAmB,EAAE,QAAQ,CAAC;IAE9B,mFAAmF;IACnF,KAAK,EAAE,aAAa,CAAC;CACtB;AAoBD,uGAAuG;AACvG,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,uBAAuB,GAAG,IAAI,CAczG;AAsFD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,GAAG,aAAa,CA2BhF;AAED,kGAAkG;AAClG,wBAAsB,eAAe,CACnC,SAAS,EAAE,aAAa,EACxB,MAAM,EAAE,GAAG,EACX,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,QAAQ,CAAC,CAuBnB"}

package/internal/auth/x509-transport-capability.d.ts

@@ -0,0 +1,37 @@
+import { Agent, ProxyAgent } from 'undici';
+import type { RegisteredX509Transport, X509Transport } from "./x509-transport-registry.js";
+export type { X509Transport } from "./x509-transport-registry.js";
+/** Explicitly supported, application-owned Undici proxy configurations. */
+export type X509ProxyMode = 'direct' | 'http-connect' | 'https-connect';
+/** Application attestation for one caller-owned static-certificate Undici transport. */
+export interface X509TransportOptions {
+    /** X.509 transport currently supports genuine Node.js runtimes only. */
+    runtime: 'node';
+    /** Caller-owned Undici Agent or ProxyAgent; the SDK never closes or inspects it. */
+    dispatcher: Agent | ProxyAgent;
+    /** Attests that the dispatcher uses one static workload-certificate identity. */
+    certificateIdentity: 'static';
+    /** Attests that proxy TLS and CONNECT credentials are independently configured. */
+    proxy: X509ProxyMode;
+}
+/** Registers only a genuine frozen capability whose JavaScript private dispatcher cannot be forged. */
+export declare function registerX509Transport(transport: X509Transport, registered: RegisteredX509Transport): void;
+/**
+ * Creates a frozen, opaque capability for one caller-owned Undici transport.
+ *
+ * `certificateIdentity: 'static'` is an application attestation: the SDK does
+ * not inspect certificates, private dispatcher internals, callbacks, or TLS
+ * options and cannot cryptographically prove certificate selection. Configure
+ * one static identity without custom dispatcher factories. For HTTPS CONNECT,
+ * independently configure `proxyTls` and `requestTls` so workload credentials
+ * never reach the proxy. Rotation requires creating a fresh dispatcher and
+ * capability; the application remains responsible for draining the old one.
+ *
+ * This Node-only preview entrypoint requires the optional `undici` peer at
+ * version 5.2.0 or later. CONNECT proxy modes require version 5.5.1 or
+ * later; ordinary SDK clients retain broader compatibility.
+ */
+export declare function createX509Transport(options: X509TransportOptions): X509Transport;
+/** Dispatches through the opaque attested transport without accepting replacement dispatchers. */
+export declare function sendX509Request(transport: X509Transport, target: URL, options: RequestInit): Promise<Response>;
+//# sourceMappingURL=x509-transport-capability.d.ts.map

package/internal/auth/x509-transport-capability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"x509-transport-capability.d.ts","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-capability.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,UAAU,EAAkB,MAAM,QAAQ,CAAC;AAG3D,OAAO,KAAK,EAAE,uBAAuB,EAAE,aAAa,EAAE,qCAAkC;AAGxF,YAAY,EAAE,aAAa,EAAE,qCAAkC;AAE/D,2EAA2E;AAC3E,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,cAAc,GAAG,eAAe,CAAC;AAExE,wFAAwF;AACxF,MAAM,WAAW,oBAAoB;IACnC,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAEhB,oFAAoF;IACpF,UAAU,EAAE,KAAK,GAAG,UAAU,CAAC;IAE/B,iFAAiF;IACjF,mBAAmB,EAAE,QAAQ,CAAC;IAE9B,mFAAmF;IACnF,KAAK,EAAE,aAAa,CAAC;CACtB;AAoBD,uGAAuG;AACvG,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,uBAAuB,GAAG,IAAI,CAczG;AAsFD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,GAAG,aAAa,CA2BhF;AAED,kGAAkG;AAClG,wBAAsB,eAAe,CACnC,SAAS,EAAE,aAAa,EACxB,MAAM,EAAE,GAAG,EACX,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,QAAQ,CAAC,CAuBnB"}

package/internal/auth/x509-transport-capability.js

@@ -0,0 +1,169 @@
+"use strict";
+var _NodeX509Transport_dispatcher;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerX509Transport = registerX509Transport;
+exports.createX509Transport = createX509Transport;
+exports.sendX509Request = sendX509Request;
+const tslib_1 = require("../tslib.js");
+const node_util_1 = require("node:util");
+const undici_1 = require("undici");
+const error_1 = require("../../core/error.js");
+const x509_transport_registry_1 = require("./x509-transport-registry.js");
+const _x509_transport_state_1 = require("#x509-transport-state");
+const allowedOptionNames = new Set(['runtime', 'dispatcher', 'certificateIdentity', 'proxy']);
+const transportBrand = x509_transport_registry_1.x509TransportBrand;
+class NodeX509Transport {
+    constructor(dispatcher) {
+        _NodeX509Transport_dispatcher.set(this, void 0);
+        tslib_1.__classPrivateFieldSet(this, _NodeX509Transport_dispatcher, dispatcher, "f");
+        Object.freeze(this);
+    }
+    static dispatcher(value) {
+        return tslib_1.__classPrivateFieldIn(_NodeX509Transport_dispatcher, value) ? tslib_1.__classPrivateFieldGet(value, _NodeX509Transport_dispatcher, "f") : undefined;
+    }
+}
+_NodeX509Transport_dispatcher = new WeakMap();
+/** Registers only a genuine frozen capability whose JavaScript private dispatcher cannot be forged. */
+function registerX509Transport(transport, registered) {
+    if (!transport ||
+        typeof transport !== 'object' ||
+        node_util_1.types.isProxy(transport) ||
+        !Object.isFrozen(transport) ||
+        !NodeX509Transport.dispatcher(transport)) {
+        throw new error_1.OpenAIError('Only a genuine frozen X.509 transport capability can be registered.');
+    }
+    if ((0, _x509_transport_state_1.findRegisteredX509Transport)(transport)) {
+        throw new error_1.OpenAIError('An approved X.509 transport capability cannot be registered more than once.');
+    }
+    (0, _x509_transport_state_1.rememberRegisteredX509Transport)(transport, Object.freeze(registered));
+}
+function dataOption(options, name) {
+    const descriptor = Object.getOwnPropertyDescriptor(options, name);
+    if (!descriptor || !('value' in descriptor)) {
+        throw new Error(`X.509 transport option \`${name}\` must be an own plain data property.`);
+    }
+    return descriptor.value;
+}
+function assertNodeRuntime() {
+    if (typeof process === 'undefined' ||
+        process.release.name !== 'node' ||
+        'bun' in process.versions ||
+        'Bun' in globalThis ||
+        'Deno' in globalThis) {
+        throw new Error('X.509 transport requires a genuine Node.js runtime.');
+    }
+}
+function attestedDispatcher(options) {
+    const dispatcher = dataOption(options, 'dispatcher');
+    if (!dispatcher || typeof dispatcher !== 'object') {
+        throw new Error('X.509 transport requires a caller-owned Undici Agent or ProxyAgent.');
+    }
+    if (node_util_1.types.isProxy(dispatcher)) {
+        throw new Error('X.509 transport does not accept a dispatcher proxy.');
+    }
+    const isDirect = dispatcher instanceof undici_1.Agent;
+    const isConnect = dispatcher instanceof undici_1.ProxyAgent;
+    if (!isDirect && !isConnect) {
+        throw new Error('X.509 transport requires a caller-owned Undici Agent or ProxyAgent.');
+    }
+    const proxy = dataOption(options, 'proxy');
+    if (proxy !== 'direct' && proxy !== 'http-connect' && proxy !== 'https-connect') {
+        throw new Error('X.509 transport requires an explicitly supported proxy mode.');
+    }
+    if ((proxy === 'direct') !== isDirect) {
+        throw new Error('An X.509 CONNECT proxy requires an Undici ProxyAgent.');
+    }
+    return dispatcher;
+}
+function assertRequestDispatcherSupport(dispatcher) {
+    let observesRequestDispatcher = false;
+    // about:blank never reaches the network; the getter checks the actual fetch contract.
+    void Promise.allSettled([
+        (0, undici_1.fetch)('about:blank', {
+            get dispatcher() {
+                observesRequestDispatcher = true;
+                return dispatcher;
+            },
+        }),
+    ]);
+    if (!observesRequestDispatcher) {
+        throw new Error('X.509 transport requires Undici 5.2.0 or later with per-request dispatcher support.');
+    }
+}
+function assertConnectProxySupport() {
+    const targetOrigin = 'https://127.0.0.1:65535';
+    let routedOrigin;
+    const probe = new undici_1.ProxyAgent({
+        uri: 'http://127.0.0.1:1',
+        factory(origin) {
+            routedOrigin = String(origin);
+            throw new Error('X.509 CONNECT capability probe');
+        },
+    });
+    // The throwing factory reveals the actual routing decision before any socket opens.
+    const request = (0, undici_1.fetch)(targetOrigin, { dispatcher: probe });
+    void Promise.allSettled([request, probe.close()]);
+    if (routedOrigin !== targetOrigin) {
+        throw new Error('X.509 CONNECT proxy requires Undici 5.5.1 or later with target TLS tunneling.');
+    }
+}
+/**
+ * Creates a frozen, opaque capability for one caller-owned Undici transport.
+ *
+ * `certificateIdentity: 'static'` is an application attestation: the SDK does
+ * not inspect certificates, private dispatcher internals, callbacks, or TLS
+ * options and cannot cryptographically prove certificate selection. Configure
+ * one static identity without custom dispatcher factories. For HTTPS CONNECT,
+ * independently configure `proxyTls` and `requestTls` so workload credentials
+ * never reach the proxy. Rotation requires creating a fresh dispatcher and
+ * capability; the application remains responsible for draining the old one.
+ *
+ * This Node-only preview entrypoint requires the optional `undici` peer at
+ * version 5.2.0 or later. CONNECT proxy modes require version 5.5.1 or
+ * later; ordinary SDK clients retain broader compatibility.
+ */
+function createX509Transport(options) {
+    assertNodeRuntime();
+    if (!options || typeof options !== 'object' || node_util_1.types.isProxy(options)) {
+        throw new Error('X.509 transport configuration must be a non-proxy object.');
+    }
+    for (const name of Reflect.ownKeys(options)) {
+        if (typeof name !== 'string' || !allowedOptionNames.has(name)) {
+            throw new Error(`Unsupported X.509 transport option: \`${String(name)}\`.`);
+        }
+    }
+    if (dataOption(options, 'runtime') !== 'node') {
+        throw new Error('X.509 transport requires an explicitly attested Node.js runtime.');
+    }
+    if (dataOption(options, 'certificateIdentity') !== 'static') {
+        throw new Error('X.509 transport requires an explicitly attested static client certificate.');
+    }
+    const dispatcher = attestedDispatcher(options);
+    assertRequestDispatcherSupport(dispatcher);
+    if (dispatcher instanceof undici_1.ProxyAgent) {
+        assertConnectProxySupport();
+    }
+    return new NodeX509Transport(dispatcher);
+}
+/** Dispatches through the opaque attested transport without accepting replacement dispatchers. */
+async function sendX509Request(transport, target, options) {
+    if (!transport || typeof transport !== 'object' || node_util_1.types.isProxy(transport)) {
+        throw new Error('Invalid X.509 transport capability.');
+    }
+    const dispatcher = NodeX509Transport.dispatcher(transport);
+    if (!dispatcher) {
+        throw new Error('Invalid X.509 transport capability.');
+    }
+    const normalizedTarget = new URL(target.href);
+    if (normalizedTarget.protocol !== 'https:') {
+        throw new Error('X.509 transport requires an HTTPS destination.');
+    }
+    if (Object.getOwnPropertyDescriptor(options, 'dispatcher')) {
+        throw new Error('X.509 transport does not allow a per-request dispatcher override.');
+    }
+    const requestOptions = options;
+    const request = new undici_1.Request(normalizedTarget, requestOptions);
+    const response = await (0, undici_1.fetch)(request, { dispatcher, redirect: 'manual' });
+    return response;
+}
+//# sourceMappingURL=x509-transport-capability.js.map

package/internal/auth/x509-transport-capability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"x509-transport-capability.js","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-capability.ts"],"names":[],"mappings":";;;AA8CA,sDAcC;AAqGD,kDA2BC;AAGD,0CA2BC;;AA1ND,yCAAkC;AAClC,mCAA2D;AAC3D,+CAA+C;AAC/C,0EAA+D;AAE/D,iEAAqG;AAsBrG,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,qBAAqB,EAAE,OAAO,CAAC,CAAC,CAAC;AAC9F,MAAM,cAAc,GAA8B,4CAAkB,CAAC;AAErE,MAAM,iBAAiB;IAKrB,YAAY,UAA8B;QAFjC,gDAAgC;QAGvC,+BAAA,IAAI,iCAAe,UAAU,MAAA,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAED,MAAM,CAAC,UAAU,CAAC,KAAa;QAC7B,OAAO,6DAAe,KAAK,EAAC,CAAC,CAAC,+BAAA,KAAK,qCAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,CAAC;CACF;;AAED,uGAAuG;AACvG,SAAgB,qBAAqB,CAAC,SAAwB,EAAE,UAAmC;IACjG,IACE,CAAC,SAAS;QACV,OAAO,SAAS,KAAK,QAAQ;QAC7B,iBAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QACxB,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC3B,CAAC,iBAAiB,CAAC,UAAU,CAAC,SAAS,CAAC,EACxC,CAAC;QACD,MAAM,IAAI,mBAAW,CAAC,qEAAqE,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,IAAA,mDAA2B,EAAC,SAAS,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,mBAAW,CAAC,6EAA6E,CAAC,CAAC;IACvG,CAAC;IACD,IAAA,uDAA+B,EAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,UAAU,CAAC,OAA6B,EAAE,IAAgC;IACjF,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAClE,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,wCAAwC,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,UAAU,CAAC,KAAK,CAAC;AAC1B,CAAC;AAED,SAAS,iBAAiB;IACxB,IACE,OAAO,OAAO,KAAK,WAAW;QAC9B,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM;QAC/B,KAAK,IAAI,OAAO,CAAC,QAAQ;QACzB,KAAK,IAAI,UAAU;QACnB,MAAM,IAAI,UAAU,EACpB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,OAA6B;IACvD,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACrD,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,iBAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,YAAY,cAAK,CAAC;IAC7C,MAAM,SAAS,GAAG,UAAU,YAAY,mBAAU,CAAC;IACnD,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,cAAc,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,8BAA8B,CAAC,UAA8B;IACpE,IAAI,yBAAyB,GAAG,KAAK,CAAC;IAEtC,sFAAsF;IACtF,KAAK,OAAO,CAAC,UAAU,CAAC;QACtB,IAAA,cAAK,EAAC,aAAa,EAAE;YACnB,IAAI,UAAU;gBACZ,yBAAyB,GAAG,IAAI,CAAC;gBACjC,OAAO,UAAU,CAAC;YACpB,CAAC;SACF,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,yBAAyB,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;IACzG,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB;IAChC,MAAM,YAAY,GAAG,yBAAyB,CAAC;IAC/C,IAAI,YAAgC,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI,mBAAU,CAAC;QAC3B,GAAG,EAAE,oBAAoB;QACzB,OAAO,CAAC,MAAM;YACZ,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;KACF,CAAC,CAAC;IAEH,oFAAoF;IACpF,MAAM,OAAO,GAAG,IAAA,cAAK,EAAC,YAAY,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAElD,IAAI,YAAY,KAAK,YAAY,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;IACnG,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAgB,mBAAmB,CAAC,OAA6B;IAC/D,iBAAiB,EAAE,CAAC;IAEpB,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,iBAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,yCAAyC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAED,IAAI,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,MAAM,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IAED,IAAI,UAAU,CAAC,OAAO,EAAE,qBAAqB,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,CAAC;IAED,MAAM,UAAU,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC/C,8BAA8B,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,UAAU,YAAY,mBAAU,EAAE,CAAC;QACrC,yBAAyB,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,iBAAiB,CAAC,UAAU,CAAC,CAAC;AAC3C,CAAC;AAED,kGAAkG;AAC3F,KAAK,UAAU,eAAe,CACnC,SAAwB,EACxB,MAAW,EACX,OAAoB;IAEpB,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,iBAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,UAAU,GAAG,iBAAiB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IAC3D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,gBAAgB,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,MAAM,CAAC,wBAAwB,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,cAAc,GAAoC,OAAO,CAAC;IAChE,MAAM,OAAO,GAAG,IAAI,gBAAO,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,MAAM,IAAA,cAAK,EAAC,OAAO,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC1E,OAAO,QAAQ,CAAC;AAClB,CAAC"}