openai 7.5.0 → 7.7.0

package/internal/auth/x509-workload-identity-auth.d.mts

@@ -0,0 +1,128 @@
+import type { WorkloadIdentity, X509WorkloadIdentity } from "../../auth/types.mjs";
+import type { Fetch } from "../builtin-types.mjs";
+import type { HeadersLike, NullableHeaders } from "../headers.mjs";
+import type { FinalRequestOptions } from "../request-options.mjs";
+import type { MergedRequestInit } from "../types.mjs";
+import type { X509Transport } from "./x509-transport-registry.mjs";
+/** Sole API authority approved for OpenAI X.509 workload-identity federation. */
+export declare const X509_API_BASE_URL = "https://mtls.api.openai.com/v1";
+interface X509TokenRequestContext {
+    apiURL: string;
+    defaultHeaders: HeadersLike | undefined;
+    requestHeaders: HeadersLike;
+    signal: AbortSignal | null | undefined;
+    organization: string | null;
+    project: string | null;
+    timeout: number;
+    fetchOptions: MergedRequestInit;
+}
+/** Distinguishes true certificate identities from extensible legacy subject-token identities. */
+export declare function isX509WorkloadIdentity(identity: WorkloadIdentity | X509WorkloadIdentity | undefined): identity is X509WorkloadIdentity;
+/** Rejects unsupported WebSocket authentication before any connection or credential side effect. */
+export declare function assertX509WebSocketSupported(client: unknown): void;
+/** Rejects every destination outside the sole enrolled, global X.509 API authority. */
+export declare function assertX509APIOrigin(value: string | URL): URL;
+/** Prevents caller options from replacing the immutable transport selected at construction. */
+export declare function assertX509FetchOptions(options: MergedRequestInit | RequestInit | undefined): void;
+/** Rejects caller overrides while allowing the SDK-owned fields on the final RequestInit. */
+export declare function assertX509RequestOptions(options: MergedRequestInit | RequestInit | undefined): void;
+/** Validates and snapshots the exact caller options that will reach authenticated dispatch. */
+export declare function snapshotX509RequestOptions(options: MergedRequestInit | undefined): MergedRequestInit;
+/** Bridges certificate authentication into existing OpenAI auth and fetch hooks without optional peers. */
+export declare class X509WorkloadIdentityAuth {
+    #private;
+    /** Captures one registered, immutable certificate identity and its enrolled selectors. */
+    constructor(identity: X509WorkloadIdentity, transport: X509Transport | undefined, organization: string | null, project: string | null);
+    /** Reconstructs the immutable selectors captured before caller-owned identity mutation. */
+    identitySnapshot(): X509WorkloadIdentity;
+    /** Preserves explicitly headerless requests without presenting a certificate to the issuer. */
+    static shouldAuthenticate(options: FinalRequestOptions, defaultHeaders: HeadersLike | undefined, requestHeaders?: HeadersLike): boolean;
+    /** Snapshots each caller-owned header layer once while preserving nulls and precedence. */
+    snapshotHeaders(defaultHeaders: HeadersLike, requestHeaders: HeadersLike): {
+        defaultHeaders: NullableHeaders;
+        requestHeaders: NullableHeaders;
+    };
+    /** Returns the already rendered caller headers without touching mutable inputs again. */
+    headerSnapshots(): {
+        defaultHeaders: NullableHeaders;
+        requestHeaders: NullableHeaders;
+    };
+    /** Captures enrolled public tenant selectors once before certificate presentation. */
+    snapshotTenant(organization: string | null, project: string | null): {
+        organization: string | null;
+        project: string | null;
+    };
+    /** Returns the tenant selectors already approved for this logical request. */
+    tenantSnapshot(): {
+        organization: string | null;
+        project: string | null;
+    };
+    /** Validates and retains the exact destination that authenticated dispatch will use. */
+    snapshotAPIURL(value: string): void;
+    /** Reads the already-approved destination without rerendering caller-owned request options. */
+    requestAPIURL(): string;
+    /** Captures the exact caller settings approved for authenticated dispatch. */
+    snapshotRequest(signal: AbortSignal | null | undefined, timeout: number, fetchOptions: MergedRequestInit): void;
+    /** Returns immutable request settings without invoking caller-owned accessors again. */
+    requestSnapshot(): {
+        signal: AbortSignal | null | undefined;
+        timeout: number;
+        fetchOptions: MergedRequestInit;
+    };
+    /** Begins local request construction without charging protected hook latency to the network. */
+    beginRequestPlanning(): void;
+    /** Arms one absolute network deadline only after all local request preparation completes. */
+    beginRequestNetwork(): void;
+    /** Keeps certificate authentication outside overridable request construction. */
+    isPlanningRequest(): boolean;
+    /** Approves the final overridden destination and transport before minting a bearer. */
+    authorizePlannedRequest(url: string, request: RequestInit, timeout: number, allowHookSignal?: boolean): void;
+    /** Owns only SDK-created iterator adapters until authenticated dispatch takes responsibility. */
+    ownRequestBody(body: unknown, source: unknown): void;
+    /** Recognizes every one-shot upload before issuer authentication or request replay. */
+    static isStreamingRequestBody(body: unknown): boolean;
+    /** Retires abandoned upload adapters without masking or blocking their authentication failure. */
+    retireRequestBody(): void;
+    /** Transfers the dispatched upload while retiring any SDK-owned body replaced by a hook. */
+    releaseRequestBody(body: unknown): void;
+    /** Retains caller-only cancellation separately from SDK-created deadline controllers. */
+    setEffectiveSignal(signal: AbortSignal | undefined): void;
+    /** Uses protected-hook cancellation when an authenticated attempt enters retry backoff. */
+    effectiveSignal(): AbortSignal | null | undefined;
+    /** Establishes an independent scope even when concurrent requests share caller options. */
+    runRequest<T>(operation: () => Promise<T>, requestOwner: object): Promise<T>;
+    /** Reports whether a public request-building call already belongs to an active logical operation. */
+    inRequest(requestOwner: object): boolean;
+    /** Shares a cache only when the complete, privately snapshotted credential identity matches. */
+    matches(other: X509WorkloadIdentityAuth): boolean;
+    /** Binds deferred response parsing to the original logical request and its unchanged deadline. */
+    continuation(): <T>(operation: () => Promise<T>) => Promise<T>;
+    /** Removes dispatched bearer material before settled request promises can retain their scope. */
+    releaseRequestCredentials(): void;
+    /** Returns the original authentication start so response consumption shares its request deadline. */
+    requestStartedAt(_options: FinalRequestOptions): number | undefined;
+    /** Distinguishes issued workload credentials from independent admin or headerless requests. */
+    usedWorkloadToken(_options: FinalRequestOptions): boolean;
+    /** Returns the budget left after certificate authentication without starting another timeout. */
+    remainingTimeout(_options: FinalRequestOptions, timeout: number): number;
+    /** Cancels active retry timers promptly without changing public caller-abort semantics. */
+    waitForRetry(duration: number, signal?: AbortSignal | null): Promise<void>;
+    /** Trusts only issuer or connection failures privately branded by the approved transport. */
+    static isRetryableFailure(error: unknown): boolean;
+    /** Reads safe retry hints only from a privately branded, sanitized issuer response. */
+    static retryHeaders(error: unknown): Headers | undefined;
+    /** Exchanges the exact certificate capability selected for the matching API dispatch. */
+    getToken(options?: FinalRequestOptions, context?: X509TokenRequestContext): Promise<string>;
+    /** Invalidates only the workload-token generation actually rejected by the current request. */
+    invalidateToken(): void;
+    /** Binds the minted credential to the original headers before protected request hooks run. */
+    bindRequest(options: FinalRequestOptions, request: RequestInit, adminAPIKey: string | null): void;
+    /** Rebinds an equivalent protected-hook container without relaxing final dispatch identity checks. */
+    adoptRequestHeaders(request: RequestInit): void;
+    /** Rejects request hooks that replace the selected bearer or its approved header identity. */
+    assertRequest(request: RequestInit): void;
+    /** Returns a guarded final dispatcher while preserving all existing request hook object identities. */
+    fetch(): Fetch;
+}
+export {};
+//# sourceMappingURL=x509-workload-identity-auth.d.mts.map

package/internal/auth/x509-workload-identity-auth.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"x509-workload-identity-auth.d.mts","sourceRoot":"","sources":["../../src/internal/auth/x509-workload-identity-auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,6BAAyB;AAC/E,OAAO,KAAK,EAAE,KAAK,EAAE,6BAAyB;AAE9C,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,uBAAmB;AAC/D,OAAO,KAAK,EAAE,mBAAmB,EAAE,+BAA2B;AAE9D,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAiB;AASlD,OAAO,KAAK,EAIV,aAAa,EACd,sCAAkC;AAEnC,iFAAiF;AACjF,eAAO,MAAM,iBAAiB,mCAAmC,CAAC;AA8ElE,UAAU,uBAAuB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,WAAW,GAAG,SAAS,CAAC;IACxC,cAAc,EAAE,WAAW,CAAC;IAC5B,MAAM,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,CAAC;IACvC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,iBAAiB,CAAC;CACjC;AA0BD,iGAAiG;AACjG,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,gBAAgB,GAAG,oBAAoB,GAAG,SAAS,GAC5D,QAAQ,IAAI,oBAAoB,CA6BlC;AAED,oGAAoG;AACpG,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAQlE;AAED,uFAAuF;AACvF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,GAAG,CAY5D;AAED,+FAA+F;AAC/F,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,iBAAiB,GAAG,WAAW,GAAG,SAAS,GAAG,IAAI,CAcjG;AAED,6FAA6F;AAC7F,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,iBAAiB,GAAG,WAAW,GAAG,SAAS,GAAG,IAAI,CAOnG;AAED,+FAA+F;AAC/F,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,iBAAiB,GAAG,SAAS,GAAG,iBAAiB,CAKpG;AAED,2GAA2G;AAC3G,qBAAa,wBAAwB;;IAYnC,0FAA0F;gBAExF,QAAQ,EAAE,oBAAoB,EAC9B,SAAS,EAAE,aAAa,GAAG,SAAS,EACpC,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,OAAO,EAAE,MAAM,GAAG,IAAI;IAiBxB,2FAA2F;IAC3F,gBAAgB,IAAI,oBAAoB;IAWxC,+FAA+F;IAC/F,MAAM,CAAC,kBAAkB,CACvB,OAAO,EAAE,mBAAmB,EAC5B,cAAc,EAAE,WAAW,GAAG,SAAS,EACvC,cAAc,GAAE,WAA6B,GAC5C,OAAO;IAIV,2FAA2F;IAC3F,eAAe,CACb,cAAc,EAAE,WAAW,EAC3B,cAAc,EAAE,WAAW,GAC1B;QAAE,cAAc,EAAE,eAAe,CAAC;QAAC,cAAc,EAAE,eAAe,CAAA;KAAE;IAOvE,yFAAyF;IACzF,eAAe,IAAI;QAAE,cAAc,EAAE,eAAe,CAAC;QAAC,cAAc,EAAE,eAAe,CAAA;KAAE;IAQvF,sFAAsF;IACtF,cAAc,CACZ,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,OAAO,EAAE,MAAM,GAAG,IAAI,GACrB;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;IAS1D,8EAA8E;IAC9E,cAAc,IAAI;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;IAQzE,wFAAwF;IACxF,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAKnC,+FAA+F;IAC/F,aAAa,IAAI,MAAM;IAQvB,8EAA8E;IAC9E,eAAe,CACb,MAAM,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,EACtC,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,iBAAiB,GAC9B,IAAI;IAIP,wFAAwF;IACxF,eAAe,IAAI;QACjB,MAAM,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,CAAC;QACvC,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,EAAE,iBAAiB,CAAC;KACjC;IAQD,gGAAgG;IAChG,oBAAoB,IAAI,IAAI;IAI5B,6FAA6F;IAC7F,mBAAmB,IAAI,IAAI;IAS3B,iFAAiF;IACjF,iBAAiB,IAAI,OAAO;IAI5B,uFAAuF;IACvF,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,UAAQ,GAAG,IAAI;IAkC1G,iGAAiG;IACjG,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,IAAI;IAMpD,uFAAuF;IACvF,MAAM,CAAC,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO;IAUrD,kGAAkG;IAClG,iBAAiB,IAAI,IAAI;IAiBzB,4FAA4F;IAC5F,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI;IASvC,yFAAyF;IACzF,kBAAkB,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,IAAI;IAQzD,2FAA2F;IAC3F,eAAe,IAAI,WAAW,GAAG,IAAI,GAAG,SAAS;IAKjD,2FAA2F;IAC3F,UAAU,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAmB5E,qGAAqG;IACrG,SAAS,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAKxC,gGAAgG;IAChG,OAAO,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO;IAWjD,kGAAkG;IAClG,YAAY,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC;IAwB9D,iGAAiG;IACjG,yBAAyB,IAAI,IAAI;IAiBjC,qGAAqG;IACrG,gBAAgB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,MAAM,GAAG,SAAS;IAInE,+FAA+F;IAC/F,iBAAiB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO;IAIzD,iGAAiG;IACjG,gBAAgB,CAAC,QAAQ,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM;IAYxE,2FAA2F;IACrF,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAWhF,6FAA6F;IAC7F,MAAM,CAAC,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;IAQlD,uFAAuF;IACvF,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS;IAQxD,yFAAyF;IACnF,QAAQ,CAAC,OAAO,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,MAAM,CAAC;IA0NjG,+FAA+F;IAC/F,eAAe,IAAI,IAAI;IAwBvB,8FAA8F;IAC9F,WAAW,CAAC,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAqBjG,sGAAsG;IACtG,mBAAmB,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI;IAe/C,8FAA8F;IAC9F,aAAa,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI;IAoCzC,uGAAuG;IACvG,KAAK,IAAI,KAAK;CAoBf"}

package/internal/auth/x509-workload-identity-auth.d.ts

@@ -0,0 +1,128 @@
+import type { WorkloadIdentity, X509WorkloadIdentity } from "../../auth/types.js";
+import type { Fetch } from "../builtin-types.js";
+import type { HeadersLike, NullableHeaders } from "../headers.js";
+import type { FinalRequestOptions } from "../request-options.js";
+import type { MergedRequestInit } from "../types.js";
+import type { X509Transport } from "./x509-transport-registry.js";
+/** Sole API authority approved for OpenAI X.509 workload-identity federation. */
+export declare const X509_API_BASE_URL = "https://mtls.api.openai.com/v1";
+interface X509TokenRequestContext {
+    apiURL: string;
+    defaultHeaders: HeadersLike | undefined;
+    requestHeaders: HeadersLike;
+    signal: AbortSignal | null | undefined;
+    organization: string | null;
+    project: string | null;
+    timeout: number;
+    fetchOptions: MergedRequestInit;
+}
+/** Distinguishes true certificate identities from extensible legacy subject-token identities. */
+export declare function isX509WorkloadIdentity(identity: WorkloadIdentity | X509WorkloadIdentity | undefined): identity is X509WorkloadIdentity;
+/** Rejects unsupported WebSocket authentication before any connection or credential side effect. */
+export declare function assertX509WebSocketSupported(client: unknown): void;
+/** Rejects every destination outside the sole enrolled, global X.509 API authority. */
+export declare function assertX509APIOrigin(value: string | URL): URL;
+/** Prevents caller options from replacing the immutable transport selected at construction. */
+export declare function assertX509FetchOptions(options: MergedRequestInit | RequestInit | undefined): void;
+/** Rejects caller overrides while allowing the SDK-owned fields on the final RequestInit. */
+export declare function assertX509RequestOptions(options: MergedRequestInit | RequestInit | undefined): void;
+/** Validates and snapshots the exact caller options that will reach authenticated dispatch. */
+export declare function snapshotX509RequestOptions(options: MergedRequestInit | undefined): MergedRequestInit;
+/** Bridges certificate authentication into existing OpenAI auth and fetch hooks without optional peers. */
+export declare class X509WorkloadIdentityAuth {
+    #private;
+    /** Captures one registered, immutable certificate identity and its enrolled selectors. */
+    constructor(identity: X509WorkloadIdentity, transport: X509Transport | undefined, organization: string | null, project: string | null);
+    /** Reconstructs the immutable selectors captured before caller-owned identity mutation. */
+    identitySnapshot(): X509WorkloadIdentity;
+    /** Preserves explicitly headerless requests without presenting a certificate to the issuer. */
+    static shouldAuthenticate(options: FinalRequestOptions, defaultHeaders: HeadersLike | undefined, requestHeaders?: HeadersLike): boolean;
+    /** Snapshots each caller-owned header layer once while preserving nulls and precedence. */
+    snapshotHeaders(defaultHeaders: HeadersLike, requestHeaders: HeadersLike): {
+        defaultHeaders: NullableHeaders;
+        requestHeaders: NullableHeaders;
+    };
+    /** Returns the already rendered caller headers without touching mutable inputs again. */
+    headerSnapshots(): {
+        defaultHeaders: NullableHeaders;
+        requestHeaders: NullableHeaders;
+    };
+    /** Captures enrolled public tenant selectors once before certificate presentation. */
+    snapshotTenant(organization: string | null, project: string | null): {
+        organization: string | null;
+        project: string | null;
+    };
+    /** Returns the tenant selectors already approved for this logical request. */
+    tenantSnapshot(): {
+        organization: string | null;
+        project: string | null;
+    };
+    /** Validates and retains the exact destination that authenticated dispatch will use. */
+    snapshotAPIURL(value: string): void;
+    /** Reads the already-approved destination without rerendering caller-owned request options. */
+    requestAPIURL(): string;
+    /** Captures the exact caller settings approved for authenticated dispatch. */
+    snapshotRequest(signal: AbortSignal | null | undefined, timeout: number, fetchOptions: MergedRequestInit): void;
+    /** Returns immutable request settings without invoking caller-owned accessors again. */
+    requestSnapshot(): {
+        signal: AbortSignal | null | undefined;
+        timeout: number;
+        fetchOptions: MergedRequestInit;
+    };
+    /** Begins local request construction without charging protected hook latency to the network. */
+    beginRequestPlanning(): void;
+    /** Arms one absolute network deadline only after all local request preparation completes. */
+    beginRequestNetwork(): void;
+    /** Keeps certificate authentication outside overridable request construction. */
+    isPlanningRequest(): boolean;
+    /** Approves the final overridden destination and transport before minting a bearer. */
+    authorizePlannedRequest(url: string, request: RequestInit, timeout: number, allowHookSignal?: boolean): void;
+    /** Owns only SDK-created iterator adapters until authenticated dispatch takes responsibility. */
+    ownRequestBody(body: unknown, source: unknown): void;
+    /** Recognizes every one-shot upload before issuer authentication or request replay. */
+    static isStreamingRequestBody(body: unknown): boolean;
+    /** Retires abandoned upload adapters without masking or blocking their authentication failure. */
+    retireRequestBody(): void;
+    /** Transfers the dispatched upload while retiring any SDK-owned body replaced by a hook. */
+    releaseRequestBody(body: unknown): void;
+    /** Retains caller-only cancellation separately from SDK-created deadline controllers. */
+    setEffectiveSignal(signal: AbortSignal | undefined): void;
+    /** Uses protected-hook cancellation when an authenticated attempt enters retry backoff. */
+    effectiveSignal(): AbortSignal | null | undefined;
+    /** Establishes an independent scope even when concurrent requests share caller options. */
+    runRequest<T>(operation: () => Promise<T>, requestOwner: object): Promise<T>;
+    /** Reports whether a public request-building call already belongs to an active logical operation. */
+    inRequest(requestOwner: object): boolean;
+    /** Shares a cache only when the complete, privately snapshotted credential identity matches. */
+    matches(other: X509WorkloadIdentityAuth): boolean;
+    /** Binds deferred response parsing to the original logical request and its unchanged deadline. */
+    continuation(): <T>(operation: () => Promise<T>) => Promise<T>;
+    /** Removes dispatched bearer material before settled request promises can retain their scope. */
+    releaseRequestCredentials(): void;
+    /** Returns the original authentication start so response consumption shares its request deadline. */
+    requestStartedAt(_options: FinalRequestOptions): number | undefined;
+    /** Distinguishes issued workload credentials from independent admin or headerless requests. */
+    usedWorkloadToken(_options: FinalRequestOptions): boolean;
+    /** Returns the budget left after certificate authentication without starting another timeout. */
+    remainingTimeout(_options: FinalRequestOptions, timeout: number): number;
+    /** Cancels active retry timers promptly without changing public caller-abort semantics. */
+    waitForRetry(duration: number, signal?: AbortSignal | null): Promise<void>;
+    /** Trusts only issuer or connection failures privately branded by the approved transport. */
+    static isRetryableFailure(error: unknown): boolean;
+    /** Reads safe retry hints only from a privately branded, sanitized issuer response. */
+    static retryHeaders(error: unknown): Headers | undefined;
+    /** Exchanges the exact certificate capability selected for the matching API dispatch. */
+    getToken(options?: FinalRequestOptions, context?: X509TokenRequestContext): Promise<string>;
+    /** Invalidates only the workload-token generation actually rejected by the current request. */
+    invalidateToken(): void;
+    /** Binds the minted credential to the original headers before protected request hooks run. */
+    bindRequest(options: FinalRequestOptions, request: RequestInit, adminAPIKey: string | null): void;
+    /** Rebinds an equivalent protected-hook container without relaxing final dispatch identity checks. */
+    adoptRequestHeaders(request: RequestInit): void;
+    /** Rejects request hooks that replace the selected bearer or its approved header identity. */
+    assertRequest(request: RequestInit): void;
+    /** Returns a guarded final dispatcher while preserving all existing request hook object identities. */
+    fetch(): Fetch;
+}
+export {};
+//# sourceMappingURL=x509-workload-identity-auth.d.ts.map

package/internal/auth/x509-workload-identity-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"x509-workload-identity-auth.d.ts","sourceRoot":"","sources":["../../src/internal/auth/x509-workload-identity-auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,4BAAyB;AAC/E,OAAO,KAAK,EAAE,KAAK,EAAE,4BAAyB;AAE9C,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,sBAAmB;AAC/D,OAAO,KAAK,EAAE,mBAAmB,EAAE,8BAA2B;AAE9D,OAAO,KAAK,EAAE,iBAAiB,EAAE,oBAAiB;AASlD,OAAO,KAAK,EAIV,aAAa,EACd,qCAAkC;AAEnC,iFAAiF;AACjF,eAAO,MAAM,iBAAiB,mCAAmC,CAAC;AA8ElE,UAAU,uBAAuB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,WAAW,GAAG,SAAS,CAAC;IACxC,cAAc,EAAE,WAAW,CAAC;IAC5B,MAAM,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,CAAC;IACvC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,iBAAiB,CAAC;CACjC;AA0BD,iGAAiG;AACjG,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,gBAAgB,GAAG,oBAAoB,GAAG,SAAS,GAC5D,QAAQ,IAAI,oBAAoB,CA6BlC;AAED,oGAAoG;AACpG,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAQlE;AAED,uFAAuF;AACvF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,GAAG,CAY5D;AAED,+FAA+F;AAC/F,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,iBAAiB,GAAG,WAAW,GAAG,SAAS,GAAG,IAAI,CAcjG;AAED,6FAA6F;AAC7F,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,iBAAiB,GAAG,WAAW,GAAG,SAAS,GAAG,IAAI,CAOnG;AAED,+FAA+F;AAC/F,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,iBAAiB,GAAG,SAAS,GAAG,iBAAiB,CAKpG;AAED,2GAA2G;AAC3G,qBAAa,wBAAwB;;IAYnC,0FAA0F;gBAExF,QAAQ,EAAE,oBAAoB,EAC9B,SAAS,EAAE,aAAa,GAAG,SAAS,EACpC,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,OAAO,EAAE,MAAM,GAAG,IAAI;IAiBxB,2FAA2F;IAC3F,gBAAgB,IAAI,oBAAoB;IAWxC,+FAA+F;IAC/F,MAAM,CAAC,kBAAkB,CACvB,OAAO,EAAE,mBAAmB,EAC5B,cAAc,EAAE,WAAW,GAAG,SAAS,EACvC,cAAc,GAAE,WAA6B,GAC5C,OAAO;IAIV,2FAA2F;IAC3F,eAAe,CACb,cAAc,EAAE,WAAW,EAC3B,cAAc,EAAE,WAAW,GAC1B;QAAE,cAAc,EAAE,eAAe,CAAC;QAAC,cAAc,EAAE,eAAe,CAAA;KAAE;IAOvE,yFAAyF;IACzF,eAAe,IAAI;QAAE,cAAc,EAAE,eAAe,CAAC;QAAC,cAAc,EAAE,eAAe,CAAA;KAAE;IAQvF,sFAAsF;IACtF,cAAc,CACZ,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,OAAO,EAAE,MAAM,GAAG,IAAI,GACrB;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;IAS1D,8EAA8E;IAC9E,cAAc,IAAI;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;IAQzE,wFAAwF;IACxF,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAKnC,+FAA+F;IAC/F,aAAa,IAAI,MAAM;IAQvB,8EAA8E;IAC9E,eAAe,CACb,MAAM,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,EACtC,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,iBAAiB,GAC9B,IAAI;IAIP,wFAAwF;IACxF,eAAe,IAAI;QACjB,MAAM,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,CAAC;QACvC,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,EAAE,iBAAiB,CAAC;KACjC;IAQD,gGAAgG;IAChG,oBAAoB,IAAI,IAAI;IAI5B,6FAA6F;IAC7F,mBAAmB,IAAI,IAAI;IAS3B,iFAAiF;IACjF,iBAAiB,IAAI,OAAO;IAI5B,uFAAuF;IACvF,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,UAAQ,GAAG,IAAI;IAkC1G,iGAAiG;IACjG,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,IAAI;IAMpD,uFAAuF;IACvF,MAAM,CAAC,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO;IAUrD,kGAAkG;IAClG,iBAAiB,IAAI,IAAI;IAiBzB,4FAA4F;IAC5F,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI;IASvC,yFAAyF;IACzF,kBAAkB,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,IAAI;IAQzD,2FAA2F;IAC3F,eAAe,IAAI,WAAW,GAAG,IAAI,GAAG,SAAS;IAKjD,2FAA2F;IAC3F,UAAU,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAmB5E,qGAAqG;IACrG,SAAS,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAKxC,gGAAgG;IAChG,OAAO,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO;IAWjD,kGAAkG;IAClG,YAAY,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC;IAwB9D,iGAAiG;IACjG,yBAAyB,IAAI,IAAI;IAiBjC,qGAAqG;IACrG,gBAAgB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,MAAM,GAAG,SAAS;IAInE,+FAA+F;IAC/F,iBAAiB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO;IAIzD,iGAAiG;IACjG,gBAAgB,CAAC,QAAQ,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM;IAYxE,2FAA2F;IACrF,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAWhF,6FAA6F;IAC7F,MAAM,CAAC,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;IAQlD,uFAAuF;IACvF,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS;IAQxD,yFAAyF;IACnF,QAAQ,CAAC,OAAO,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,MAAM,CAAC;IA0NjG,+FAA+F;IAC/F,eAAe,IAAI,IAAI;IAwBvB,8FAA8F;IAC9F,WAAW,CAAC,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAqBjG,sGAAsG;IACtG,mBAAmB,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI;IAe/C,8FAA8F;IAC9F,aAAa,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI;IAoCzC,uGAAuG;IACvG,KAAK,IAAI,KAAK;CAoBf"}