openai 7.5.0 → 7.7.0

package/internal/auth/x509-transport-capability.mjs

@@ -0,0 +1,164 @@
+var _NodeX509Transport_dispatcher;
+import { __classPrivateFieldGet, __classPrivateFieldIn, __classPrivateFieldSet } from "../tslib.mjs";
+import { types } from 'node:util';
+import { Agent, ProxyAgent, Request, fetch } from 'undici';
+import { OpenAIError } from "../../core/error.mjs";
+import { x509TransportBrand } from "./x509-transport-registry.mjs";
+import { findRegisteredX509Transport, rememberRegisteredX509Transport } from '#x509-transport-state';
+const allowedOptionNames = new Set(['runtime', 'dispatcher', 'certificateIdentity', 'proxy']);
+const transportBrand = x509TransportBrand;
+class NodeX509Transport {
+    constructor(dispatcher) {
+        _NodeX509Transport_dispatcher.set(this, void 0);
+        __classPrivateFieldSet(this, _NodeX509Transport_dispatcher, dispatcher, "f");
+        Object.freeze(this);
+    }
+    static dispatcher(value) {
+        return __classPrivateFieldIn(_NodeX509Transport_dispatcher, value) ? __classPrivateFieldGet(value, _NodeX509Transport_dispatcher, "f") : undefined;
+    }
+}
+_NodeX509Transport_dispatcher = new WeakMap();
+/** Registers only a genuine frozen capability whose JavaScript private dispatcher cannot be forged. */
+export function registerX509Transport(transport, registered) {
+    if (!transport ||
+        typeof transport !== 'object' ||
+        types.isProxy(transport) ||
+        !Object.isFrozen(transport) ||
+        !NodeX509Transport.dispatcher(transport)) {
+        throw new OpenAIError('Only a genuine frozen X.509 transport capability can be registered.');
+    }
+    if (findRegisteredX509Transport(transport)) {
+        throw new OpenAIError('An approved X.509 transport capability cannot be registered more than once.');
+    }
+    rememberRegisteredX509Transport(transport, Object.freeze(registered));
+}
+function dataOption(options, name) {
+    const descriptor = Object.getOwnPropertyDescriptor(options, name);
+    if (!descriptor || !('value' in descriptor)) {
+        throw new Error(`X.509 transport option \`${name}\` must be an own plain data property.`);
+    }
+    return descriptor.value;
+}
+function assertNodeRuntime() {
+    if (typeof process === 'undefined' ||
+        process.release.name !== 'node' ||
+        'bun' in process.versions ||
+        'Bun' in globalThis ||
+        'Deno' in globalThis) {
+        throw new Error('X.509 transport requires a genuine Node.js runtime.');
+    }
+}
+function attestedDispatcher(options) {
+    const dispatcher = dataOption(options, 'dispatcher');
+    if (!dispatcher || typeof dispatcher !== 'object') {
+        throw new Error('X.509 transport requires a caller-owned Undici Agent or ProxyAgent.');
+    }
+    if (types.isProxy(dispatcher)) {
+        throw new Error('X.509 transport does not accept a dispatcher proxy.');
+    }
+    const isDirect = dispatcher instanceof Agent;
+    const isConnect = dispatcher instanceof ProxyAgent;
+    if (!isDirect && !isConnect) {
+        throw new Error('X.509 transport requires a caller-owned Undici Agent or ProxyAgent.');
+    }
+    const proxy = dataOption(options, 'proxy');
+    if (proxy !== 'direct' && proxy !== 'http-connect' && proxy !== 'https-connect') {
+        throw new Error('X.509 transport requires an explicitly supported proxy mode.');
+    }
+    if ((proxy === 'direct') !== isDirect) {
+        throw new Error('An X.509 CONNECT proxy requires an Undici ProxyAgent.');
+    }
+    return dispatcher;
+}
+function assertRequestDispatcherSupport(dispatcher) {
+    let observesRequestDispatcher = false;
+    // about:blank never reaches the network; the getter checks the actual fetch contract.
+    void Promise.allSettled([
+        fetch('about:blank', {
+            get dispatcher() {
+                observesRequestDispatcher = true;
+                return dispatcher;
+            },
+        }),
+    ]);
+    if (!observesRequestDispatcher) {
+        throw new Error('X.509 transport requires Undici 5.2.0 or later with per-request dispatcher support.');
+    }
+}
+function assertConnectProxySupport() {
+    const targetOrigin = 'https://127.0.0.1:65535';
+    let routedOrigin;
+    const probe = new ProxyAgent({
+        uri: 'http://127.0.0.1:1',
+        factory(origin) {
+            routedOrigin = String(origin);
+            throw new Error('X.509 CONNECT capability probe');
+        },
+    });
+    // The throwing factory reveals the actual routing decision before any socket opens.
+    const request = fetch(targetOrigin, { dispatcher: probe });
+    void Promise.allSettled([request, probe.close()]);
+    if (routedOrigin !== targetOrigin) {
+        throw new Error('X.509 CONNECT proxy requires Undici 5.5.1 or later with target TLS tunneling.');
+    }
+}
+/**
+ * Creates a frozen, opaque capability for one caller-owned Undici transport.
+ *
+ * `certificateIdentity: 'static'` is an application attestation: the SDK does
+ * not inspect certificates, private dispatcher internals, callbacks, or TLS
+ * options and cannot cryptographically prove certificate selection. Configure
+ * one static identity without custom dispatcher factories. For HTTPS CONNECT,
+ * independently configure `proxyTls` and `requestTls` so workload credentials
+ * never reach the proxy. Rotation requires creating a fresh dispatcher and
+ * capability; the application remains responsible for draining the old one.
+ *
+ * This Node-only preview entrypoint requires the optional `undici` peer at
+ * version 5.2.0 or later. CONNECT proxy modes require version 5.5.1 or
+ * later; ordinary SDK clients retain broader compatibility.
+ */
+export function createX509Transport(options) {
+    assertNodeRuntime();
+    if (!options || typeof options !== 'object' || types.isProxy(options)) {
+        throw new Error('X.509 transport configuration must be a non-proxy object.');
+    }
+    for (const name of Reflect.ownKeys(options)) {
+        if (typeof name !== 'string' || !allowedOptionNames.has(name)) {
+            throw new Error(`Unsupported X.509 transport option: \`${String(name)}\`.`);
+        }
+    }
+    if (dataOption(options, 'runtime') !== 'node') {
+        throw new Error('X.509 transport requires an explicitly attested Node.js runtime.');
+    }
+    if (dataOption(options, 'certificateIdentity') !== 'static') {
+        throw new Error('X.509 transport requires an explicitly attested static client certificate.');
+    }
+    const dispatcher = attestedDispatcher(options);
+    assertRequestDispatcherSupport(dispatcher);
+    if (dispatcher instanceof ProxyAgent) {
+        assertConnectProxySupport();
+    }
+    return new NodeX509Transport(dispatcher);
+}
+/** Dispatches through the opaque attested transport without accepting replacement dispatchers. */
+export async function sendX509Request(transport, target, options) {
+    if (!transport || typeof transport !== 'object' || types.isProxy(transport)) {
+        throw new Error('Invalid X.509 transport capability.');
+    }
+    const dispatcher = NodeX509Transport.dispatcher(transport);
+    if (!dispatcher) {
+        throw new Error('Invalid X.509 transport capability.');
+    }
+    const normalizedTarget = new URL(target.href);
+    if (normalizedTarget.protocol !== 'https:') {
+        throw new Error('X.509 transport requires an HTTPS destination.');
+    }
+    if (Object.getOwnPropertyDescriptor(options, 'dispatcher')) {
+        throw new Error('X.509 transport does not allow a per-request dispatcher override.');
+    }
+    const requestOptions = options;
+    const request = new Request(normalizedTarget, requestOptions);
+    const response = await fetch(request, { dispatcher, redirect: 'manual' });
+    return response;
+}
+//# sourceMappingURL=x509-transport-capability.mjs.map

package/internal/auth/x509-transport-capability.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"x509-transport-capability.mjs","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-capability.ts"],"names":[],"mappings":";;AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,6BAAyB;AAC/C,OAAO,EAAE,kBAAkB,EAAE,sCAAkC;AAE/D,OAAO,EAAE,2BAA2B,EAAE,+BAA+B,EAAE,MAAM,uBAAuB,CAAC;AAsBrG,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,qBAAqB,EAAE,OAAO,CAAC,CAAC,CAAC;AAC9F,MAAM,cAAc,GAA8B,kBAAkB,CAAC;AAErE,MAAM,iBAAiB;IAKrB,YAAY,UAA8B;QAFjC,gDAAgC;QAGvC,uBAAA,IAAI,iCAAe,UAAU,MAAA,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAED,MAAM,CAAC,UAAU,CAAC,KAAa;QAC7B,OAAO,qDAAe,KAAK,EAAC,CAAC,CAAC,uBAAA,KAAK,qCAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,CAAC;CACF;;AAED,uGAAuG;AACvG,MAAM,UAAU,qBAAqB,CAAC,SAAwB,EAAE,UAAmC;IACjG,IACE,CAAC,SAAS;QACV,OAAO,SAAS,KAAK,QAAQ;QAC7B,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QACxB,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC3B,CAAC,iBAAiB,CAAC,UAAU,CAAC,SAAS,CAAC,EACxC,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,qEAAqE,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,2BAA2B,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,WAAW,CAAC,6EAA6E,CAAC,CAAC;IACvG,CAAC;IACD,+BAA+B,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,UAAU,CAAC,OAA6B,EAAE,IAAgC;IACjF,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAClE,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,wCAAwC,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,UAAU,CAAC,KAAK,CAAC;AAC1B,CAAC;AAED,SAAS,iBAAiB;IACxB,IACE,OAAO,OAAO,KAAK,WAAW;QAC9B,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM;QAC/B,KAAK,IAAI,OAAO,CAAC,QAAQ;QACzB,KAAK,IAAI,UAAU;QACnB,MAAM,IAAI,UAAU,EACpB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,OAA6B;IACvD,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACrD,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,YAAY,KAAK,CAAC;IAC7C,MAAM,SAAS,GAAG,UAAU,YAAY,UAAU,CAAC;IACnD,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,cAAc,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,8BAA8B,CAAC,UAA8B;IACpE,IAAI,yBAAyB,GAAG,KAAK,CAAC;IAEtC,sFAAsF;IACtF,KAAK,OAAO,CAAC,UAAU,CAAC;QACtB,KAAK,CAAC,aAAa,EAAE;YACnB,IAAI,UAAU;gBACZ,yBAAyB,GAAG,IAAI,CAAC;gBACjC,OAAO,UAAU,CAAC;YACpB,CAAC;SACF,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,yBAAyB,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;IACzG,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB;IAChC,MAAM,YAAY,GAAG,yBAAyB,CAAC;IAC/C,IAAI,YAAgC,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC;QAC3B,GAAG,EAAE,oBAAoB;QACzB,OAAO,CAAC,MAAM;YACZ,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;KACF,CAAC,CAAC;IAEH,oFAAoF;IACpF,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAElD,IAAI,YAAY,KAAK,YAAY,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;IACnG,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAA6B;IAC/D,iBAAiB,EAAE,CAAC;IAEpB,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,yCAAyC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAED,IAAI,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,MAAM,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IAED,IAAI,UAAU,CAAC,OAAO,EAAE,qBAAqB,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,CAAC;IAED,MAAM,UAAU,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC/C,8BAA8B,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,UAAU,YAAY,UAAU,EAAE,CAAC;QACrC,yBAAyB,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,iBAAiB,CAAC,UAAU,CAAC,CAAC;AAC3C,CAAC;AAED,kGAAkG;AAClG,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,SAAwB,EACxB,MAAW,EACX,OAAoB;IAEpB,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,UAAU,GAAG,iBAAiB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IAC3D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,gBAAgB,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,MAAM,CAAC,wBAAwB,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,cAAc,GAAoC,OAAO,CAAC;IAChE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC1E,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/internal/auth/x509-transport-registry.d.mts

@@ -0,0 +1,63 @@
+import type { NullableHeaders } from "../headers.mjs";
+import type { ReadableStream } from "../shim-types.mjs";
+import type { MergedRequestInit } from "../types.mjs";
+/** Retries only known temporary failures when neither error layer reports a permanent code. */
+export declare function isRetryableX509TransportFailure(failure: unknown): boolean;
+export declare const x509TransportBrand: unique symbol;
+/** Opaque identity of one frozen, caller-owned, explicitly attested X.509 transport. */
+export interface X509Transport {
+    /** Prevents ordinary objects from satisfying the transport capability contract. */
+    readonly [x509TransportBrand]: true;
+}
+/** Validated short-lived token exchanged using a registered certificate identity. */
+export interface X509ExchangedToken {
+    /** Header-safe, in-memory OpenAI bearer credential. */
+    accessToken: string;
+    /** Issuer-approved positive token lifetime in seconds. */
+    expiresIn: number;
+}
+/** One logical certificate-authenticated operation and its immutable starting deadline. */
+export interface X509RequestScope {
+    wallStartedAt: number;
+    monotonicStartedAt: number;
+    deadlineArmed?: boolean;
+    request?: {
+        signal: AbortSignal | null | undefined;
+        timeout: number;
+        fetchOptions: MergedRequestInit;
+    };
+    phase?: 'planning' | 'authorizing';
+    effectiveSignal?: AbortSignal;
+    materializedBody?: ReadableStream;
+    owner?: object;
+    requestOwner?: object;
+    apiURL?: string;
+    tenant?: {
+        organization: string | null;
+        project: string | null;
+    };
+    defaultHeaders?: NullableHeaders;
+    requestHeaders?: NullableHeaders;
+    token?: string;
+    tokenGeneration?: number;
+    headers?: Headers;
+    authorization?: string | null;
+}
+/** Private, peer-independent operations attached to one approved transport generation. */
+export interface RegisteredX509Transport {
+    /** Dispatches one request through the exact frozen certificate capability. */
+    dispatch: (target: URL, options: RequestInit) => Promise<Response>;
+    /** Exchanges the same certificate identity for an OpenAI service-account bearer. */
+    exchange: (identityProviderId: string, serviceAccountId: string, signal?: AbortSignal) => Promise<X509ExchangedToken>;
+    /** Establishes one isolated Node async context without exposing Node dependencies to the root SDK. */
+    run: <T>(operation: () => T) => T;
+    /** Resolves only the current logical request's private certificate-authentication scope. */
+    current: () => X509RequestScope | undefined;
+    /** Re-enters the original request scope when response parsing resumes outside its promise chain. */
+    resume: <T>(scope: X509RequestScope, operation: () => T) => T;
+    /** Waits for retry backoff using an abortable timer that keeps an active request alive. */
+    sleep: (duration: number, signal?: AbortSignal | null) => Promise<void>;
+}
+/** Resolves a previously registered opaque capability without importing an optional transport peer. */
+export declare function resolveX509Transport(value: unknown): RegisteredX509Transport;
+//# sourceMappingURL=x509-transport-registry.d.mts.map

package/internal/auth/x509-transport-registry.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"x509-transport-registry.d.mts","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-registry.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,uBAAmB;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,0BAAsB;AACpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAiB;AAkBlD,+FAA+F;AAC/F,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAmBzE;AAED,eAAO,MAAM,kBAAkB,EAAE,OAAO,MAA6C,CAAC;AAEtF,wFAAwF;AACxF,MAAM,WAAW,aAAa;IAC5B,mFAAmF;IACnF,QAAQ,CAAC,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAC;CACrC;AAED,qFAAqF;AACrF,MAAM,WAAW,kBAAkB;IACjC,uDAAuD;IACvD,WAAW,EAAE,MAAM,CAAC;IAEpB,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,2FAA2F;AAC3F,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,OAAO,CAAC,EAAE;QAAE,MAAM,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,iBAAiB,CAAA;KAAE,CAAC;IACvG,KAAK,CAAC,EAAE,UAAU,GAAG,aAAa,CAAC;IACnC,eAAe,CAAC,EAAE,WAAW,CAAC;IAC9B,gBAAgB,CAAC,EAAE,cAAc,CAAC;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACjE,cAAc,CAAC,EAAE,eAAe,CAAC;IACjC,cAAc,CAAC,EAAE,eAAe,CAAC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,0FAA0F;AAC1F,MAAM,WAAW,uBAAuB;IACtC,8EAA8E;IAC9E,QAAQ,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEnE,oFAAoF;IACpF,QAAQ,EAAE,CACR,kBAAkB,EAAE,MAAM,EAC1B,gBAAgB,EAAE,MAAM,EACxB,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAEjC,sGAAsG;IACtG,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAElC,4FAA4F;IAC5F,OAAO,EAAE,MAAM,gBAAgB,GAAG,SAAS,CAAC;IAE5C,oGAAoG;IACpG,MAAM,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAE9D,2FAA2F;IAC3F,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACzE;AAED,uGAAuG;AACvG,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,uBAAuB,CAU5E"}

package/internal/auth/x509-transport-registry.d.ts

@@ -0,0 +1,63 @@
+import type { NullableHeaders } from "../headers.js";
+import type { ReadableStream } from "../shim-types.js";
+import type { MergedRequestInit } from "../types.js";
+/** Retries only known temporary failures when neither error layer reports a permanent code. */
+export declare function isRetryableX509TransportFailure(failure: unknown): boolean;
+export declare const x509TransportBrand: unique symbol;
+/** Opaque identity of one frozen, caller-owned, explicitly attested X.509 transport. */
+export interface X509Transport {
+    /** Prevents ordinary objects from satisfying the transport capability contract. */
+    readonly [x509TransportBrand]: true;
+}
+/** Validated short-lived token exchanged using a registered certificate identity. */
+export interface X509ExchangedToken {
+    /** Header-safe, in-memory OpenAI bearer credential. */
+    accessToken: string;
+    /** Issuer-approved positive token lifetime in seconds. */
+    expiresIn: number;
+}
+/** One logical certificate-authenticated operation and its immutable starting deadline. */
+export interface X509RequestScope {
+    wallStartedAt: number;
+    monotonicStartedAt: number;
+    deadlineArmed?: boolean;
+    request?: {
+        signal: AbortSignal | null | undefined;
+        timeout: number;
+        fetchOptions: MergedRequestInit;
+    };
+    phase?: 'planning' | 'authorizing';
+    effectiveSignal?: AbortSignal;
+    materializedBody?: ReadableStream;
+    owner?: object;
+    requestOwner?: object;
+    apiURL?: string;
+    tenant?: {
+        organization: string | null;
+        project: string | null;
+    };
+    defaultHeaders?: NullableHeaders;
+    requestHeaders?: NullableHeaders;
+    token?: string;
+    tokenGeneration?: number;
+    headers?: Headers;
+    authorization?: string | null;
+}
+/** Private, peer-independent operations attached to one approved transport generation. */
+export interface RegisteredX509Transport {
+    /** Dispatches one request through the exact frozen certificate capability. */
+    dispatch: (target: URL, options: RequestInit) => Promise<Response>;
+    /** Exchanges the same certificate identity for an OpenAI service-account bearer. */
+    exchange: (identityProviderId: string, serviceAccountId: string, signal?: AbortSignal) => Promise<X509ExchangedToken>;
+    /** Establishes one isolated Node async context without exposing Node dependencies to the root SDK. */
+    run: <T>(operation: () => T) => T;
+    /** Resolves only the current logical request's private certificate-authentication scope. */
+    current: () => X509RequestScope | undefined;
+    /** Re-enters the original request scope when response parsing resumes outside its promise chain. */
+    resume: <T>(scope: X509RequestScope, operation: () => T) => T;
+    /** Waits for retry backoff using an abortable timer that keeps an active request alive. */
+    sleep: (duration: number, signal?: AbortSignal | null) => Promise<void>;
+}
+/** Resolves a previously registered opaque capability without importing an optional transport peer. */
+export declare function resolveX509Transport(value: unknown): RegisteredX509Transport;
+//# sourceMappingURL=x509-transport-registry.d.ts.map

package/internal/auth/x509-transport-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"x509-transport-registry.d.ts","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-registry.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,sBAAmB;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,yBAAsB;AACpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,oBAAiB;AAkBlD,+FAA+F;AAC/F,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAmBzE;AAED,eAAO,MAAM,kBAAkB,EAAE,OAAO,MAA6C,CAAC;AAEtF,wFAAwF;AACxF,MAAM,WAAW,aAAa;IAC5B,mFAAmF;IACnF,QAAQ,CAAC,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAC;CACrC;AAED,qFAAqF;AACrF,MAAM,WAAW,kBAAkB;IACjC,uDAAuD;IACvD,WAAW,EAAE,MAAM,CAAC;IAEpB,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,2FAA2F;AAC3F,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,OAAO,CAAC,EAAE;QAAE,MAAM,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,iBAAiB,CAAA;KAAE,CAAC;IACvG,KAAK,CAAC,EAAE,UAAU,GAAG,aAAa,CAAC;IACnC,eAAe,CAAC,EAAE,WAAW,CAAC;IAC9B,gBAAgB,CAAC,EAAE,cAAc,CAAC;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACjE,cAAc,CAAC,EAAE,eAAe,CAAC;IACjC,cAAc,CAAC,EAAE,eAAe,CAAC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,0FAA0F;AAC1F,MAAM,WAAW,uBAAuB;IACtC,8EAA8E;IAC9E,QAAQ,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEnE,oFAAoF;IACpF,QAAQ,EAAE,CACR,kBAAkB,EAAE,MAAM,EAC1B,gBAAgB,EAAE,MAAM,EACxB,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAEjC,sGAAsG;IACtG,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAElC,4FAA4F;IAC5F,OAAO,EAAE,MAAM,gBAAgB,GAAG,SAAS,CAAC;IAE5C,oGAAoG;IACpG,MAAM,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAE9D,2FAA2F;IAC3F,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACzE;AAED,uGAAuG;AACvG,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,uBAAuB,CAU5E"}

package/internal/auth/x509-transport-registry.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.x509TransportBrand = void 0;
+exports.isRetryableX509TransportFailure = isRetryableX509TransportFailure;
+exports.resolveX509Transport = resolveX509Transport;
+const error_1 = require("../../core/error.js");
+const _x509_transport_state_1 = require("#x509-transport-state");
+const transientX509TransportCodes = new Set([
+    'ECONNRESET',
+    'ECONNREFUSED',
+    'ENETUNREACH',
+    'EHOSTUNREACH',
+    'ENETDOWN',
+    'EPIPE',
+    'ETIMEDOUT',
+    'EAI_AGAIN',
+    'UND_ERR_CONNECT_TIMEOUT',
+    'UND_ERR_HEADERS_TIMEOUT',
+    'UND_ERR_BODY_TIMEOUT',
+    'UND_ERR_SOCKET',
+]);
+/** Retries only known temporary failures when neither error layer reports a permanent code. */
+function isRetryableX509TransportFailure(failure) {
+    const cause = typeof failure === 'object' && failure !== null
+        ? Object.getOwnPropertyDescriptor(failure, 'cause')?.value
+        : undefined;
+    let retryable = false;
+    for (const candidate of [failure, cause]) {
+        const code = typeof candidate === 'object' && candidate !== null
+            ? Object.getOwnPropertyDescriptor(candidate, 'code')?.value
+            : undefined;
+        if (typeof code === 'string') {
+            if (!transientX509TransportCodes.has(code)) {
+                return false;
+            }
+            retryable = true;
+        }
+    }
+    return retryable;
+}
+exports.x509TransportBrand = Symbol('X.509 transport capability');
+/** Resolves a previously registered opaque capability without importing an optional transport peer. */
+function resolveX509Transport(value) {
+    if (!value || typeof value !== 'object') {
+        throw new error_1.OpenAIError('X.509 workload identity requires an approved X.509 transport capability.');
+    }
+    const registered = (0, _x509_transport_state_1.findRegisteredX509Transport)(value);
+    if (!registered) {
+        throw new error_1.OpenAIError('X.509 workload identity requires an approved X.509 transport capability.');
+    }
+    return registered;
+}
+//# sourceMappingURL=x509-transport-registry.js.map

package/internal/auth/x509-transport-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"x509-transport-registry.js","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-registry.ts"],"names":[],"mappings":";;;AAsBA,0EAmBC;AAkED,oDAUC;AArHD,+CAA+C;AAI/C,iEAAoE;AAEpE,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC;IAC1C,YAAY;IACZ,cAAc;IACd,aAAa;IACb,cAAc;IACd,UAAU;IACV,OAAO;IACP,WAAW;IACX,WAAW;IACX,yBAAyB;IACzB,yBAAyB;IACzB,sBAAsB;IACtB,gBAAgB;CACjB,CAAC,CAAC;AAEH,+FAA+F;AAC/F,SAAgB,+BAA+B,CAAC,OAAgB;IAC9D,MAAM,KAAK,GACT,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QAC7C,CAAC,CAAC,MAAM,CAAC,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,KAAK;QAC1D,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,MAAM,SAAS,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,GACR,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI;YACjD,CAAC,CAAC,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,KAAK;YAC3D,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3C,OAAO,KAAK,CAAC;YACf,CAAC;YACD,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAEY,QAAA,kBAAkB,GAAkB,MAAM,CAAC,4BAA4B,CAAC,CAAC;AA+DtF,uGAAuG;AACvG,SAAgB,oBAAoB,CAAC,KAAc;IACjD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,mBAAW,CAAC,0EAA0E,CAAC,CAAC;IACpG,CAAC;IAED,MAAM,UAAU,GAAwC,IAAA,mDAA2B,EAAC,KAAK,CAAC,CAAC;IAC3F,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAW,CAAC,0EAA0E,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/internal/auth/x509-transport-registry.mjs

@@ -0,0 +1,48 @@
+import { OpenAIError } from "../../core/error.mjs";
+import { findRegisteredX509Transport } from '#x509-transport-state';
+const transientX509TransportCodes = new Set([
+    'ECONNRESET',
+    'ECONNREFUSED',
+    'ENETUNREACH',
+    'EHOSTUNREACH',
+    'ENETDOWN',
+    'EPIPE',
+    'ETIMEDOUT',
+    'EAI_AGAIN',
+    'UND_ERR_CONNECT_TIMEOUT',
+    'UND_ERR_HEADERS_TIMEOUT',
+    'UND_ERR_BODY_TIMEOUT',
+    'UND_ERR_SOCKET',
+]);
+/** Retries only known temporary failures when neither error layer reports a permanent code. */
+export function isRetryableX509TransportFailure(failure) {
+    const cause = typeof failure === 'object' && failure !== null
+        ? Object.getOwnPropertyDescriptor(failure, 'cause')?.value
+        : undefined;
+    let retryable = false;
+    for (const candidate of [failure, cause]) {
+        const code = typeof candidate === 'object' && candidate !== null
+            ? Object.getOwnPropertyDescriptor(candidate, 'code')?.value
+            : undefined;
+        if (typeof code === 'string') {
+            if (!transientX509TransportCodes.has(code)) {
+                return false;
+            }
+            retryable = true;
+        }
+    }
+    return retryable;
+}
+export const x509TransportBrand = Symbol('X.509 transport capability');
+/** Resolves a previously registered opaque capability without importing an optional transport peer. */
+export function resolveX509Transport(value) {
+    if (!value || typeof value !== 'object') {
+        throw new OpenAIError('X.509 workload identity requires an approved X.509 transport capability.');
+    }
+    const registered = findRegisteredX509Transport(value);
+    if (!registered) {
+        throw new OpenAIError('X.509 workload identity requires an approved X.509 transport capability.');
+    }
+    return registered;
+}
+//# sourceMappingURL=x509-transport-registry.mjs.map

package/internal/auth/x509-transport-registry.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"x509-transport-registry.mjs","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,6BAAyB;AAI/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAEpE,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC;IAC1C,YAAY;IACZ,cAAc;IACd,aAAa;IACb,cAAc;IACd,UAAU;IACV,OAAO;IACP,WAAW;IACX,WAAW;IACX,yBAAyB;IACzB,yBAAyB;IACzB,sBAAsB;IACtB,gBAAgB;CACjB,CAAC,CAAC;AAEH,+FAA+F;AAC/F,MAAM,UAAU,+BAA+B,CAAC,OAAgB;IAC9D,MAAM,KAAK,GACT,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QAC7C,CAAC,CAAC,MAAM,CAAC,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,KAAK;QAC1D,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,MAAM,SAAS,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,GACR,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI;YACjD,CAAC,CAAC,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,KAAK;YAC3D,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3C,OAAO,KAAK,CAAC;YACf,CAAC;YACD,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAkB,MAAM,CAAC,4BAA4B,CAAC,CAAC;AA+DtF,uGAAuG;AACvG,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,WAAW,CAAC,0EAA0E,CAAC,CAAC;IACpG,CAAC;IAED,MAAM,UAAU,GAAwC,2BAA2B,CAAC,KAAK,CAAC,CAAC;IAC3F,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,WAAW,CAAC,0EAA0E,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/internal/auth/x509-transport-state-browser.d.mts

@@ -0,0 +1,21 @@
+/** Looks up an opaque capability without exposing the registry itself. */
+export declare const findRegisteredX509Transport: (key: object) => any;
+/** Records a capability only after its Node-only factory validates the private dispatcher. */
+export declare const rememberRegisteredX509Transport: (key: object, value: any) => WeakMap<object, any>;
+/** Privately classifies sanitized issuer errors without exposing transport details. */
+export declare const markTransientX509ConnectionError: (value: object) => WeakSet<object>;
+/** Checks the private transient classification without retaining caller-owned errors. */
+export declare const isTransientX509ConnectionError: (value: object) => boolean;
+/** Privately brands retryable issuer failures without exposing classification state. */
+export declare const markRetryableX509IssuerError: (value: object) => WeakSet<object>;
+/** Recognizes trusted issuer failures without evaluating caller-controlled properties. */
+export declare const isRetryableX509IssuerError: (value: object) => boolean;
+/** Brands validated clients without exposing their mutable options or authentication fields. */
+export declare const markApprovedX509Client: (value: object) => WeakSet<object>;
+/** Recognizes private client ownership without caller-visible markers. */
+export declare const isApprovedX509Client: (value: object) => boolean;
+/** Stores trusted OAuth metadata without exposing it to unrelated callers. */
+export declare const rememberX509OAuthError: (key: object, value: any) => WeakMap<object, any>;
+/** Retrieves trusted metadata when public OAuth errors cross module formats. */
+export declare const findX509OAuthError: (key: object) => any;
+//# sourceMappingURL=x509-transport-state-browser.d.mts.map

package/internal/auth/x509-transport-state-browser.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"x509-transport-state-browser.d.mts","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-state-browser.ts"],"names":[],"mappings":"AAOA,0EAA0E;AAC1E,eAAO,MAAM,2BAA2B,sBAAuD,CAAC;AAEhG,8FAA8F;AAC9F,eAAO,MAAM,+BAA+B,mDAAuD,CAAC;AAEpG,uFAAuF;AACvF,eAAO,MAAM,gCAAgC,oCAA4D,CAAC;AAE1G,yFAAyF;AACzF,eAAO,MAAM,8BAA8B,4BAA4D,CAAC;AAExG,wFAAwF;AACxF,eAAO,MAAM,4BAA4B,oCAAwD,CAAC;AAElG,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B,4BAAwD,CAAC;AAEhG,gGAAgG;AAChG,eAAO,MAAM,sBAAsB,oCAAkD,CAAC;AAEtF,0EAA0E;AAC1E,eAAO,MAAM,oBAAoB,4BAAkD,CAAC;AAEpF,8EAA8E;AAC9E,eAAO,MAAM,sBAAsB,mDAAsD,CAAC;AAE1F,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,sBAAsD,CAAC"}

package/internal/auth/x509-transport-state-browser.d.ts

@@ -0,0 +1,21 @@
+/** Looks up an opaque capability without exposing the registry itself. */
+export declare const findRegisteredX509Transport: (key: object) => any;
+/** Records a capability only after its Node-only factory validates the private dispatcher. */
+export declare const rememberRegisteredX509Transport: (key: object, value: any) => WeakMap<object, any>;
+/** Privately classifies sanitized issuer errors without exposing transport details. */
+export declare const markTransientX509ConnectionError: (value: object) => WeakSet<object>;
+/** Checks the private transient classification without retaining caller-owned errors. */
+export declare const isTransientX509ConnectionError: (value: object) => boolean;
+/** Privately brands retryable issuer failures without exposing classification state. */
+export declare const markRetryableX509IssuerError: (value: object) => WeakSet<object>;
+/** Recognizes trusted issuer failures without evaluating caller-controlled properties. */
+export declare const isRetryableX509IssuerError: (value: object) => boolean;
+/** Brands validated clients without exposing their mutable options or authentication fields. */
+export declare const markApprovedX509Client: (value: object) => WeakSet<object>;
+/** Recognizes private client ownership without caller-visible markers. */
+export declare const isApprovedX509Client: (value: object) => boolean;
+/** Stores trusted OAuth metadata without exposing it to unrelated callers. */
+export declare const rememberX509OAuthError: (key: object, value: any) => WeakMap<object, any>;
+/** Retrieves trusted metadata when public OAuth errors cross module formats. */
+export declare const findX509OAuthError: (key: object) => any;
+//# sourceMappingURL=x509-transport-state-browser.d.ts.map

package/internal/auth/x509-transport-state-browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"x509-transport-state-browser.d.ts","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-state-browser.ts"],"names":[],"mappings":"AAOA,0EAA0E;AAC1E,eAAO,MAAM,2BAA2B,sBAAuD,CAAC;AAEhG,8FAA8F;AAC9F,eAAO,MAAM,+BAA+B,mDAAuD,CAAC;AAEpG,uFAAuF;AACvF,eAAO,MAAM,gCAAgC,oCAA4D,CAAC;AAE1G,yFAAyF;AACzF,eAAO,MAAM,8BAA8B,4BAA4D,CAAC;AAExG,wFAAwF;AACxF,eAAO,MAAM,4BAA4B,oCAAwD,CAAC;AAElG,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B,4BAAwD,CAAC;AAEhG,gGAAgG;AAChG,eAAO,MAAM,sBAAsB,oCAAkD,CAAC;AAEtF,0EAA0E;AAC1E,eAAO,MAAM,oBAAoB,4BAAkD,CAAC;AAEpF,8EAA8E;AAC9E,eAAO,MAAM,sBAAsB,mDAAsD,CAAC;AAE1F,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,sBAAsD,CAAC"}

package/internal/auth/x509-transport-state-browser.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findX509OAuthError = exports.rememberX509OAuthError = exports.isApprovedX509Client = exports.markApprovedX509Client = exports.isRetryableX509IssuerError = exports.markRetryableX509IssuerError = exports.isTransientX509ConnectionError = exports.markTransientX509ConnectionError = exports.rememberRegisteredX509Transport = exports.findRegisteredX509Transport = void 0;
+/** Browser-safe capability state keeps CommonJS outside the ordinary SDK ESM graph. */
+const registeredX509Transports = new WeakMap();
+const transientX509ConnectionErrors = new WeakSet();
+const retryableX509IssuerErrors = new WeakSet();
+const approvedX509Clients = new WeakSet();
+const approvedX509OAuthErrors = new WeakMap();
+/** Looks up an opaque capability without exposing the registry itself. */
+exports.findRegisteredX509Transport = WeakMap.prototype.get.bind(registeredX509Transports);
+/** Records a capability only after its Node-only factory validates the private dispatcher. */
+exports.rememberRegisteredX509Transport = WeakMap.prototype.set.bind(registeredX509Transports);
+/** Privately classifies sanitized issuer errors without exposing transport details. */
+exports.markTransientX509ConnectionError = WeakSet.prototype.add.bind(transientX509ConnectionErrors);
+/** Checks the private transient classification without retaining caller-owned errors. */
+exports.isTransientX509ConnectionError = WeakSet.prototype.has.bind(transientX509ConnectionErrors);
+/** Privately brands retryable issuer failures without exposing classification state. */
+exports.markRetryableX509IssuerError = WeakSet.prototype.add.bind(retryableX509IssuerErrors);
+/** Recognizes trusted issuer failures without evaluating caller-controlled properties. */
+exports.isRetryableX509IssuerError = WeakSet.prototype.has.bind(retryableX509IssuerErrors);
+/** Brands validated clients without exposing their mutable options or authentication fields. */
+exports.markApprovedX509Client = WeakSet.prototype.add.bind(approvedX509Clients);
+/** Recognizes private client ownership without caller-visible markers. */
+exports.isApprovedX509Client = WeakSet.prototype.has.bind(approvedX509Clients);
+/** Stores trusted OAuth metadata without exposing it to unrelated callers. */
+exports.rememberX509OAuthError = WeakMap.prototype.set.bind(approvedX509OAuthErrors);
+/** Retrieves trusted metadata when public OAuth errors cross module formats. */
+exports.findX509OAuthError = WeakMap.prototype.get.bind(approvedX509OAuthErrors);
+//# sourceMappingURL=x509-transport-state-browser.js.map

package/internal/auth/x509-transport-state-browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"x509-transport-state-browser.js","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-state-browser.ts"],"names":[],"mappings":";;;AAAA,uFAAuF;AACvF,MAAM,wBAAwB,GAAG,IAAI,OAAO,EAAE,CAAC;AAC/C,MAAM,6BAA6B,GAAG,IAAI,OAAO,EAAE,CAAC;AACpD,MAAM,yBAAyB,GAAG,IAAI,OAAO,EAAE,CAAC;AAChD,MAAM,mBAAmB,GAAG,IAAI,OAAO,EAAE,CAAC;AAC1C,MAAM,uBAAuB,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9C,0EAA0E;AAC7D,QAAA,2BAA2B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;AAEhG,8FAA8F;AACjF,QAAA,+BAA+B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;AAEpG,uFAAuF;AAC1E,QAAA,gCAAgC,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;AAE1G,yFAAyF;AAC5E,QAAA,8BAA8B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;AAExG,wFAAwF;AAC3E,QAAA,4BAA4B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;AAElG,0FAA0F;AAC7E,QAAA,0BAA0B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;AAEhG,gGAAgG;AACnF,QAAA,sBAAsB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;AAEtF,0EAA0E;AAC7D,QAAA,oBAAoB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;AAEpF,8EAA8E;AACjE,QAAA,sBAAsB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;AAE1F,gFAAgF;AACnE,QAAA,kBAAkB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC"}

package/internal/auth/x509-transport-state-browser.mjs

@@ -0,0 +1,27 @@
+/** Browser-safe capability state keeps CommonJS outside the ordinary SDK ESM graph. */
+const registeredX509Transports = new WeakMap();
+const transientX509ConnectionErrors = new WeakSet();
+const retryableX509IssuerErrors = new WeakSet();
+const approvedX509Clients = new WeakSet();
+const approvedX509OAuthErrors = new WeakMap();
+/** Looks up an opaque capability without exposing the registry itself. */
+export const findRegisteredX509Transport = WeakMap.prototype.get.bind(registeredX509Transports);
+/** Records a capability only after its Node-only factory validates the private dispatcher. */
+export const rememberRegisteredX509Transport = WeakMap.prototype.set.bind(registeredX509Transports);
+/** Privately classifies sanitized issuer errors without exposing transport details. */
+export const markTransientX509ConnectionError = WeakSet.prototype.add.bind(transientX509ConnectionErrors);
+/** Checks the private transient classification without retaining caller-owned errors. */
+export const isTransientX509ConnectionError = WeakSet.prototype.has.bind(transientX509ConnectionErrors);
+/** Privately brands retryable issuer failures without exposing classification state. */
+export const markRetryableX509IssuerError = WeakSet.prototype.add.bind(retryableX509IssuerErrors);
+/** Recognizes trusted issuer failures without evaluating caller-controlled properties. */
+export const isRetryableX509IssuerError = WeakSet.prototype.has.bind(retryableX509IssuerErrors);
+/** Brands validated clients without exposing their mutable options or authentication fields. */
+export const markApprovedX509Client = WeakSet.prototype.add.bind(approvedX509Clients);
+/** Recognizes private client ownership without caller-visible markers. */
+export const isApprovedX509Client = WeakSet.prototype.has.bind(approvedX509Clients);
+/** Stores trusted OAuth metadata without exposing it to unrelated callers. */
+export const rememberX509OAuthError = WeakMap.prototype.set.bind(approvedX509OAuthErrors);
+/** Retrieves trusted metadata when public OAuth errors cross module formats. */
+export const findX509OAuthError = WeakMap.prototype.get.bind(approvedX509OAuthErrors);
+//# sourceMappingURL=x509-transport-state-browser.mjs.map

package/internal/auth/x509-transport-state-browser.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"x509-transport-state-browser.mjs","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-state-browser.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,MAAM,wBAAwB,GAAG,IAAI,OAAO,EAAE,CAAC;AAC/C,MAAM,6BAA6B,GAAG,IAAI,OAAO,EAAE,CAAC;AACpD,MAAM,yBAAyB,GAAG,IAAI,OAAO,EAAE,CAAC;AAChD,MAAM,mBAAmB,GAAG,IAAI,OAAO,EAAE,CAAC;AAC1C,MAAM,uBAAuB,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9C,0EAA0E;AAC1E,MAAM,CAAC,MAAM,2BAA2B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;AAEhG,8FAA8F;AAC9F,MAAM,CAAC,MAAM,+BAA+B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;AAEpG,uFAAuF;AACvF,MAAM,CAAC,MAAM,gCAAgC,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;AAE1G,yFAAyF;AACzF,MAAM,CAAC,MAAM,8BAA8B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;AAExG,wFAAwF;AACxF,MAAM,CAAC,MAAM,4BAA4B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;AAElG,0FAA0F;AAC1F,MAAM,CAAC,MAAM,0BAA0B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;AAEhG,gGAAgG;AAChG,MAAM,CAAC,MAAM,sBAAsB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;AAEtF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,oBAAoB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;AAEpF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,sBAAsB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;AAE1F,gFAAgF;AAChF,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC"}

package/internal/auth/x509-transport-state.cjs

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findX509OAuthError = exports.rememberX509OAuthError = exports.isApprovedX509Client = exports.markApprovedX509Client = exports.isRetryableX509IssuerError = exports.markRetryableX509IssuerError = exports.isTransientX509ConnectionError = exports.markTransientX509ConnectionError = exports.rememberRegisteredX509Transport = exports.findRegisteredX509Transport = void 0;
+/** One lexical capability registry remains authoritative across mixed module formats. */
+const registeredX509Transports = new WeakMap();
+const transientX509ConnectionErrors = new WeakSet();
+const retryableX509IssuerErrors = new WeakSet();
+const approvedX509Clients = new WeakSet();
+const approvedX509OAuthErrors = new WeakMap();
+/** Looks up an opaque capability without exposing the registry itself. */
+exports.findRegisteredX509Transport = WeakMap.prototype.get.bind(registeredX509Transports);
+/** Records a capability only after the Node-only factory verifies its genuine private dispatcher. */
+exports.rememberRegisteredX509Transport = WeakMap.prototype.set.bind(registeredX509Transports);
+/** Privately brands sanitized connection errors shared across CommonJS and ESM clients. */
+exports.markTransientX509ConnectionError = WeakSet.prototype.add.bind(transientX509ConnectionErrors);
+/** Recognizes a transient connection without trusting public error properties. */
+exports.isTransientX509ConnectionError = WeakSet.prototype.has.bind(transientX509ConnectionErrors);
+/** Privately brands issuer-generated retryable HTTP failures across module formats. */
+exports.markRetryableX509IssuerError = WeakSet.prototype.add.bind(retryableX509IssuerErrors);
+/** Recognizes only retryable HTTP errors produced by the trusted certificate exchange. */
+exports.isRetryableX509IssuerError = WeakSet.prototype.has.bind(retryableX509IssuerErrors);
+/** Brands only clients whose transport capability was successfully validated. */
+exports.markApprovedX509Client = WeakSet.prototype.add.bind(approvedX509Clients);
+/** Recognizes immutable client ownership across mixed CommonJS and ESM helpers. */
+exports.isApprovedX509Client = WeakSet.prototype.has.bind(approvedX509Clients);
+/** Records the sanitized OAuth response without trusting mutable public error properties. */
+exports.rememberX509OAuthError = WeakMap.prototype.set.bind(approvedX509OAuthErrors);
+/** Retrieves trusted OAuth metadata for public cross-module error normalization. */
+exports.findX509OAuthError = WeakMap.prototype.get.bind(approvedX509OAuthErrors);
+//# sourceMappingURL=x509-transport-state.cjs.map

package/internal/auth/x509-transport-state.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"x509-transport-state.cjs","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-state.cts"],"names":[],"mappings":";;;AAAA,yFAAyF;AACzF,MAAM,wBAAwB,GAAG,IAAI,OAAO,EAAE,CAAC;AAC/C,MAAM,6BAA6B,GAAG,IAAI,OAAO,EAAE,CAAC;AACpD,MAAM,yBAAyB,GAAG,IAAI,OAAO,EAAE,CAAC;AAChD,MAAM,mBAAmB,GAAG,IAAI,OAAO,EAAE,CAAC;AAC1C,MAAM,uBAAuB,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9C,0EAA0E;AAC7D,QAAA,2BAA2B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;AAEhG,qGAAqG;AACxF,QAAA,+BAA+B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;AAEpG,2FAA2F;AAC9E,QAAA,gCAAgC,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;AAE1G,kFAAkF;AACrE,QAAA,8BAA8B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;AAExG,uFAAuF;AAC1E,QAAA,4BAA4B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;AAElG,0FAA0F;AAC7E,QAAA,0BAA0B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;AAEhG,iFAAiF;AACpE,QAAA,sBAAsB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;AAEtF,mFAAmF;AACtE,QAAA,oBAAoB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;AAEpF,6FAA6F;AAChF,QAAA,sBAAsB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;AAE1F,oFAAoF;AACvE,QAAA,kBAAkB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC"}

package/internal/auth/x509-transport-state.d.cts

@@ -0,0 +1,21 @@
+/** Looks up an opaque capability without exposing the registry itself. */
+export declare const findRegisteredX509Transport: (key: object) => any;
+/** Records a capability only after the Node-only factory verifies its genuine private dispatcher. */
+export declare const rememberRegisteredX509Transport: (key: object, value: any) => WeakMap<object, any>;
+/** Privately brands sanitized connection errors shared across CommonJS and ESM clients. */
+export declare const markTransientX509ConnectionError: (value: object) => WeakSet<object>;
+/** Recognizes a transient connection without trusting public error properties. */
+export declare const isTransientX509ConnectionError: (value: object) => boolean;
+/** Privately brands issuer-generated retryable HTTP failures across module formats. */
+export declare const markRetryableX509IssuerError: (value: object) => WeakSet<object>;
+/** Recognizes only retryable HTTP errors produced by the trusted certificate exchange. */
+export declare const isRetryableX509IssuerError: (value: object) => boolean;
+/** Brands only clients whose transport capability was successfully validated. */
+export declare const markApprovedX509Client: (value: object) => WeakSet<object>;
+/** Recognizes immutable client ownership across mixed CommonJS and ESM helpers. */
+export declare const isApprovedX509Client: (value: object) => boolean;
+/** Records the sanitized OAuth response without trusting mutable public error properties. */
+export declare const rememberX509OAuthError: (key: object, value: any) => WeakMap<object, any>;
+/** Retrieves trusted OAuth metadata for public cross-module error normalization. */
+export declare const findX509OAuthError: (key: object) => any;
+//# sourceMappingURL=x509-transport-state.d.cts.map

package/internal/auth/x509-transport-state.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"x509-transport-state.d.cts","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-state.cts"],"names":[],"mappings":"AAOA,0EAA0E;AAC1E,eAAO,MAAM,2BAA2B,sBAAuD,CAAC;AAEhG,qGAAqG;AACrG,eAAO,MAAM,+BAA+B,mDAAuD,CAAC;AAEpG,2FAA2F;AAC3F,eAAO,MAAM,gCAAgC,oCAA4D,CAAC;AAE1G,kFAAkF;AAClF,eAAO,MAAM,8BAA8B,4BAA4D,CAAC;AAExG,uFAAuF;AACvF,eAAO,MAAM,4BAA4B,oCAAwD,CAAC;AAElG,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B,4BAAwD,CAAC;AAEhG,iFAAiF;AACjF,eAAO,MAAM,sBAAsB,oCAAkD,CAAC;AAEtF,mFAAmF;AACnF,eAAO,MAAM,oBAAoB,4BAAkD,CAAC;AAEpF,6FAA6F;AAC7F,eAAO,MAAM,sBAAsB,mDAAsD,CAAC;AAE1F,oFAAoF;AACpF,eAAO,MAAM,kBAAkB,sBAAsD,CAAC"}