openai 7.5.0 → 7.7.0

package/src/internal/auth/x509-transport-registry.ts

@@ -0,0 +1,118 @@
+import { OpenAIError } from '../../core/error';
+import type { NullableHeaders } from '../headers';
+import type { ReadableStream } from '../shim-types';
+import type { MergedRequestInit } from '../types';
+import { findRegisteredX509Transport } from '#x509-transport-state';
+
+const transientX509TransportCodes = new Set([
+  'ECONNRESET',
+  'ECONNREFUSED',
+  'ENETUNREACH',
+  'EHOSTUNREACH',
+  'ENETDOWN',
+  'EPIPE',
+  'ETIMEDOUT',
+  'EAI_AGAIN',
+  'UND_ERR_CONNECT_TIMEOUT',
+  'UND_ERR_HEADERS_TIMEOUT',
+  'UND_ERR_BODY_TIMEOUT',
+  'UND_ERR_SOCKET',
+]);
+
+/** Retries only known temporary failures when neither error layer reports a permanent code. */
+export function isRetryableX509TransportFailure(failure: unknown): boolean {
+  const cause =
+    typeof failure === 'object' && failure !== null
+      ? Object.getOwnPropertyDescriptor(failure, 'cause')?.value
+      : undefined;
+  let retryable = false;
+  for (const candidate of [failure, cause]) {
+    const code =
+      typeof candidate === 'object' && candidate !== null
+        ? Object.getOwnPropertyDescriptor(candidate, 'code')?.value
+        : undefined;
+    if (typeof code === 'string') {
+      if (!transientX509TransportCodes.has(code)) {
+        return false;
+      }
+      retryable = true;
+    }
+  }
+  return retryable;
+}
+
+export const x509TransportBrand: unique symbol = Symbol('X.509 transport capability');
+
+/** Opaque identity of one frozen, caller-owned, explicitly attested X.509 transport. */
+export interface X509Transport {
+  /** Prevents ordinary objects from satisfying the transport capability contract. */
+  readonly [x509TransportBrand]: true;
+}
+
+/** Validated short-lived token exchanged using a registered certificate identity. */
+export interface X509ExchangedToken {
+  /** Header-safe, in-memory OpenAI bearer credential. */
+  accessToken: string;
+
+  /** Issuer-approved positive token lifetime in seconds. */
+  expiresIn: number;
+}
+
+/** One logical certificate-authenticated operation and its immutable starting deadline. */
+export interface X509RequestScope {
+  wallStartedAt: number;
+  monotonicStartedAt: number;
+  deadlineArmed?: boolean;
+  request?: { signal: AbortSignal | null | undefined; timeout: number; fetchOptions: MergedRequestInit };
+  phase?: 'planning' | 'authorizing';
+  effectiveSignal?: AbortSignal;
+  materializedBody?: ReadableStream;
+  owner?: object;
+  requestOwner?: object;
+  apiURL?: string;
+  tenant?: { organization: string | null; project: string | null };
+  defaultHeaders?: NullableHeaders;
+  requestHeaders?: NullableHeaders;
+  token?: string;
+  tokenGeneration?: number;
+  headers?: Headers;
+  authorization?: string | null;
+}
+
+/** Private, peer-independent operations attached to one approved transport generation. */
+export interface RegisteredX509Transport {
+  /** Dispatches one request through the exact frozen certificate capability. */
+  dispatch: (target: URL, options: RequestInit) => Promise<Response>;
+
+  /** Exchanges the same certificate identity for an OpenAI service-account bearer. */
+  exchange: (
+    identityProviderId: string,
+    serviceAccountId: string,
+    signal?: AbortSignal,
+  ) => Promise<X509ExchangedToken>;
+
+  /** Establishes one isolated Node async context without exposing Node dependencies to the root SDK. */
+  run: <T>(operation: () => T) => T;
+
+  /** Resolves only the current logical request's private certificate-authentication scope. */
+  current: () => X509RequestScope | undefined;
+
+  /** Re-enters the original request scope when response parsing resumes outside its promise chain. */
+  resume: <T>(scope: X509RequestScope, operation: () => T) => T;
+
+  /** Waits for retry backoff using an abortable timer that keeps an active request alive. */
+  sleep: (duration: number, signal?: AbortSignal | null) => Promise<void>;
+}
+
+/** Resolves a previously registered opaque capability without importing an optional transport peer. */
+export function resolveX509Transport(value: unknown): RegisteredX509Transport {
+  if (!value || typeof value !== 'object') {
+    throw new OpenAIError('X.509 workload identity requires an approved X.509 transport capability.');
+  }
+
+  const registered: RegisteredX509Transport | undefined = findRegisteredX509Transport(value);
+  if (!registered) {
+    throw new OpenAIError('X.509 workload identity requires an approved X.509 transport capability.');
+  }
+  return registered;
+}

package/src/internal/auth/x509-transport-state-browser.ts

@@ -0,0 +1,36 @@
+/** Browser-safe capability state keeps CommonJS outside the ordinary SDK ESM graph. */
+const registeredX509Transports = new WeakMap();
+const transientX509ConnectionErrors = new WeakSet();
+const retryableX509IssuerErrors = new WeakSet();
+const approvedX509Clients = new WeakSet();
+const approvedX509OAuthErrors = new WeakMap();
+
+/** Looks up an opaque capability without exposing the registry itself. */
+export const findRegisteredX509Transport = WeakMap.prototype.get.bind(registeredX509Transports);
+
+/** Records a capability only after its Node-only factory validates the private dispatcher. */
+export const rememberRegisteredX509Transport = WeakMap.prototype.set.bind(registeredX509Transports);
+
+/** Privately classifies sanitized issuer errors without exposing transport details. */
+export const markTransientX509ConnectionError = WeakSet.prototype.add.bind(transientX509ConnectionErrors);
+
+/** Checks the private transient classification without retaining caller-owned errors. */
+export const isTransientX509ConnectionError = WeakSet.prototype.has.bind(transientX509ConnectionErrors);
+
+/** Privately brands retryable issuer failures without exposing classification state. */
+export const markRetryableX509IssuerError = WeakSet.prototype.add.bind(retryableX509IssuerErrors);
+
+/** Recognizes trusted issuer failures without evaluating caller-controlled properties. */
+export const isRetryableX509IssuerError = WeakSet.prototype.has.bind(retryableX509IssuerErrors);
+
+/** Brands validated clients without exposing their mutable options or authentication fields. */
+export const markApprovedX509Client = WeakSet.prototype.add.bind(approvedX509Clients);
+
+/** Recognizes private client ownership without caller-visible markers. */
+export const isApprovedX509Client = WeakSet.prototype.has.bind(approvedX509Clients);
+
+/** Stores trusted OAuth metadata without exposing it to unrelated callers. */
+export const rememberX509OAuthError = WeakMap.prototype.set.bind(approvedX509OAuthErrors);
+
+/** Retrieves trusted metadata when public OAuth errors cross module formats. */
+export const findX509OAuthError = WeakMap.prototype.get.bind(approvedX509OAuthErrors);

package/src/internal/auth/x509-transport-state.cts

@@ -0,0 +1,36 @@
+/** One lexical capability registry remains authoritative across mixed module formats. */
+const registeredX509Transports = new WeakMap();
+const transientX509ConnectionErrors = new WeakSet();
+const retryableX509IssuerErrors = new WeakSet();
+const approvedX509Clients = new WeakSet();
+const approvedX509OAuthErrors = new WeakMap();
+
+/** Looks up an opaque capability without exposing the registry itself. */
+export const findRegisteredX509Transport = WeakMap.prototype.get.bind(registeredX509Transports);
+
+/** Records a capability only after the Node-only factory verifies its genuine private dispatcher. */
+export const rememberRegisteredX509Transport = WeakMap.prototype.set.bind(registeredX509Transports);
+
+/** Privately brands sanitized connection errors shared across CommonJS and ESM clients. */
+export const markTransientX509ConnectionError = WeakSet.prototype.add.bind(transientX509ConnectionErrors);
+
+/** Recognizes a transient connection without trusting public error properties. */
+export const isTransientX509ConnectionError = WeakSet.prototype.has.bind(transientX509ConnectionErrors);
+
+/** Privately brands issuer-generated retryable HTTP failures across module formats. */
+export const markRetryableX509IssuerError = WeakSet.prototype.add.bind(retryableX509IssuerErrors);
+
+/** Recognizes only retryable HTTP errors produced by the trusted certificate exchange. */
+export const isRetryableX509IssuerError = WeakSet.prototype.has.bind(retryableX509IssuerErrors);
+
+/** Brands only clients whose transport capability was successfully validated. */
+export const markApprovedX509Client = WeakSet.prototype.add.bind(approvedX509Clients);
+
+/** Recognizes immutable client ownership across mixed CommonJS and ESM helpers. */
+export const isApprovedX509Client = WeakSet.prototype.has.bind(approvedX509Clients);
+
+/** Records the sanitized OAuth response without trusting mutable public error properties. */
+export const rememberX509OAuthError = WeakMap.prototype.set.bind(approvedX509OAuthErrors);
+
+/** Retrieves trusted OAuth metadata for public cross-module error normalization. */
+export const findX509OAuthError = WeakMap.prototype.get.bind(approvedX509OAuthErrors);