openai 7.7.0 → 7.8.0

package/internal/auth/x509-credential-options.js

@@ -0,0 +1,122 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeX509CredentialOptions = normalizeX509CredentialOptions;
+exports.prepareX509ClientClone = prepareX509ClientClone;
+const error_1 = require("../../core/error.js");
+const values_1 = require("../utils/values.js");
+const x509_workload_identity_auth_1 = require("./x509-workload-identity-auth.js");
+const _x509_transport_state_1 = require("#x509-transport-state");
+/** Validates one privately registered credential and suppresses ambient legacy authentication. */
+function normalizeX509CredentialOptions(options) {
+    const { credential } = options;
+    if (credential === undefined) {
+        return { credential, options };
+    }
+    const registered = (0, _x509_transport_state_1.findX509Credential)(credential);
+    if (!registered) {
+        throw new error_1.OpenAIError('An X.509 credential must be created by the SDK authentication helper.');
+    }
+    const conflicting = ['apiKey', 'adminAPIKey', 'workloadIdentity', 'x509Transport'].filter((name) => {
+        const value = options[name];
+        return value !== null && value !== undefined;
+    });
+    if (conflicting.length > 0) {
+        throw new error_1.OpenAIError(`The \`credential\` option cannot be combined with ${conflicting.map((name) => `\`${name}\``).join(', ')}.`);
+    }
+    return {
+        credential,
+        options: {
+            ...options,
+            apiKey: null,
+            adminAPIKey: null,
+            baseURL: options.baseURL ?? null,
+            organization: options.organization ?? null,
+            project: options.project ?? null,
+            workloadIdentity: registered.identity,
+            x509Transport: registered.transport,
+        },
+    };
+}
+/** Distinguishes explicitly supplied ordinary credentials from nullish inheritance. */
+function overridesOrdinaryAuthentication({ apiKey, adminAPIKey }) {
+    return (apiKey !== null && apiKey !== undefined) || (adminAPIKey !== null && adminAPIKey !== undefined);
+}
+/** Keeps origin-bound configuration with its owning provider during a client clone. */
+function prepareProviderClone(inherited, overrides) {
+    const inheritedProvider = inherited.provider;
+    const replacingProvider = overrides.credential ?? overrides.workloadIdentity;
+    const provider = overrides.provider ?? (replacingProvider ? undefined : inheritedProvider);
+    if (provider !== inheritedProvider) {
+        delete inherited.baseURL;
+        delete inherited.organization;
+        delete inherited.project;
+        delete inherited.defaultHeaders;
+        delete inherited.defaultQuery;
+        delete inherited.fetchOptions;
+        delete inherited.fetch;
+    }
+    if (provider) {
+        delete inherited.apiKey;
+        delete inherited.adminAPIKey;
+        delete inherited.credential;
+        delete inherited.workloadIdentity;
+        delete inherited.x509Transport;
+        delete inherited.baseURL;
+    }
+    return provider;
+}
+/** Reconciles one client's credential and provider ownership before cloning its options. */
+function prepareX509ClientClone(inherited, overrides, credential, currentlyX509) {
+    const nextIdentity = (0, values_1.hasOwn)(overrides, 'workloadIdentity')
+        ? overrides.workloadIdentity
+        : inherited.workloadIdentity;
+    const dropping = credential !== undefined &&
+        ((overridesOrdinaryAuthentication(overrides) && overrides.workloadIdentity === undefined) ||
+            overrides.provider !== undefined);
+    if (credential !== undefined && (0, values_1.hasOwn)(overrides, 'workloadIdentity')) {
+        delete inherited.x509Transport;
+    }
+    const inheritedCredential = credential !== undefined &&
+        !dropping &&
+        overrides.credential === undefined &&
+        !(0, values_1.hasOwn)(overrides, 'workloadIdentity') &&
+        !(0, values_1.hasOwn)(overrides, 'x509Transport')
+        ? credential
+        : undefined;
+    const nextCredential = overrides.credential === undefined ? inheritedCredential : overrides.credential;
+    const nextX509 = nextCredential !== undefined || (!dropping && (0, x509_workload_identity_auth_1.isX509WorkloadIdentity)(nextIdentity));
+    if (currentlyX509 !== nextX509) {
+        delete inherited.fetch;
+        delete inherited.baseURL;
+        delete inherited.organization;
+        delete inherited.project;
+        delete inherited.defaultHeaders;
+        delete inherited.defaultQuery;
+        delete inherited.fetchOptions;
+        if (nextX509) {
+            inherited.apiKey = null;
+        }
+        else {
+            delete inherited.x509Transport;
+            if (dropping) {
+                delete inherited.workloadIdentity;
+            }
+        }
+    }
+    if (nextCredential !== undefined) {
+        delete inherited.apiKey;
+        delete inherited.adminAPIKey;
+        delete inherited.workloadIdentity;
+        delete inherited.x509Transport;
+        inherited.credential = nextCredential;
+        if (overrides.credential !== undefined) {
+            delete inherited.organization;
+            delete inherited.project;
+            delete inherited.defaultHeaders;
+            delete inherited.defaultQuery;
+            delete inherited.fetchOptions;
+        }
+    }
+    return { credential: nextCredential, provider: prepareProviderClone(inherited, overrides) };
+}
+//# sourceMappingURL=x509-credential-options.js.map

package/internal/auth/x509-credential-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"x509-credential-options.js","sourceRoot":"","sources":["../../src/internal/auth/x509-credential-options.ts"],"names":[],"mappings":";;AASA,wEAsCC;AAqCD,wDA6DC;AAjJD,+CAA+C;AAG/C,+CAAyC;AACzC,kFAAuE;AAEvE,iEAA2D;AAE3D,kGAAkG;AAClG,SAAgB,8BAA8B,CAAC,OAAsB;IAInE,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IAC/B,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,UAAU,GAAyC,IAAA,0CAAkB,EAAC,UAAU,CAAC,CAAC;IACxF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAW,CAAC,uEAAuE,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,WAAW,GAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,kBAAkB,EAAE,eAAe,CAAW,CAAC,MAAM,CAClG,CAAC,IAAI,EAAE,EAAE;QACP,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,CAAC;IAC/C,CAAC,CACF,CAAC;IACF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,mBAAW,CACnB,qDAAqD,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC5G,CAAC;IACJ,CAAC;IAED,OAAO;QACL,UAAU;QACV,OAAO,EAAE;YACP,GAAG,OAAO;YACV,MAAM,EAAE,IAAI;YACZ,WAAW,EAAE,IAAI;YACjB,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,IAAI;YAChC,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI;YAC1C,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,IAAI;YAChC,gBAAgB,EAAE,UAAU,CAAC,QAAQ;YACrC,aAAa,EAAE,UAAU,CAAC,SAAS;SACpC;KACF,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,SAAS,+BAA+B,CAAC,EAAE,MAAM,EAAE,WAAW,EAA0B;IACtF,OAAO,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,CAAC,IAAI,CAAC,WAAW,KAAK,IAAI,IAAI,WAAW,KAAK,SAAS,CAAC,CAAC;AAC1G,CAAC;AAED,uFAAuF;AACvF,SAAS,oBAAoB,CAC3B,SAAwB,EACxB,SAAiC;IAEjC,MAAM,iBAAiB,GAAG,SAAS,CAAC,QAAQ,CAAC;IAC7C,MAAM,iBAAiB,GAAG,SAAS,CAAC,UAAU,IAAI,SAAS,CAAC,gBAAgB,CAAC;IAC7E,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAE3F,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;QACnC,OAAO,SAAS,CAAC,OAAO,CAAC;QACzB,OAAO,SAAS,CAAC,YAAY,CAAC;QAC9B,OAAO,SAAS,CAAC,OAAO,CAAC;QACzB,OAAO,SAAS,CAAC,cAAc,CAAC;QAChC,OAAO,SAAS,CAAC,YAAY,CAAC;QAC9B,OAAO,SAAS,CAAC,YAAY,CAAC;QAC9B,OAAO,SAAS,CAAC,KAAK,CAAC;IACzB,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,SAAS,CAAC,MAAM,CAAC;QACxB,OAAO,SAAS,CAAC,WAAW,CAAC;QAC7B,OAAO,SAAS,CAAC,UAAU,CAAC;QAC5B,OAAO,SAAS,CAAC,gBAAgB,CAAC;QAClC,OAAO,SAAS,CAAC,aAAa,CAAC;QAC/B,OAAO,SAAS,CAAC,OAAO,CAAC;IAC3B,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,4FAA4F;AAC5F,SAAgB,sBAAsB,CACpC,SAAwB,EACxB,SAAiC,EACjC,UAAsC,EACtC,aAAsB;IAEtB,MAAM,YAAY,GAAG,IAAA,eAAM,EAAC,SAAS,EAAE,kBAAkB,CAAC;QACxD,CAAC,CAAC,SAAS,CAAC,gBAAgB;QAC5B,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC;IAC/B,MAAM,QAAQ,GACZ,UAAU,KAAK,SAAS;QACxB,CAAC,CAAC,+BAA+B,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,gBAAgB,KAAK,SAAS,CAAC;YACvF,SAAS,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;IACtC,IAAI,UAAU,KAAK,SAAS,IAAI,IAAA,eAAM,EAAC,SAAS,EAAE,kBAAkB,CAAC,EAAE,CAAC;QACtE,OAAO,SAAS,CAAC,aAAa,CAAC;IACjC,CAAC;IACD,MAAM,mBAAmB,GACvB,UAAU,KAAK,SAAS;QACxB,CAAC,QAAQ;QACT,SAAS,CAAC,UAAU,KAAK,SAAS;QAClC,CAAC,IAAA,eAAM,EAAC,SAAS,EAAE,kBAAkB,CAAC;QACtC,CAAC,IAAA,eAAM,EAAC,SAAS,EAAE,eAAe,CAAC;QACjC,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,cAAc,GAAG,SAAS,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC;IACvG,MAAM,QAAQ,GAAG,cAAc,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,IAAI,IAAA,oDAAsB,EAAC,YAAY,CAAC,CAAC,CAAC;IAErG,IAAI,aAAa,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAC,KAAK,CAAC;QACvB,OAAO,SAAS,CAAC,OAAO,CAAC;QACzB,OAAO,SAAS,CAAC,YAAY,CAAC;QAC9B,OAAO,SAAS,CAAC,OAAO,CAAC;QACzB,OAAO,SAAS,CAAC,cAAc,CAAC;QAChC,OAAO,SAAS,CAAC,YAAY,CAAC;QAC9B,OAAO,SAAS,CAAC,YAAY,CAAC;QAC9B,IAAI,QAAQ,EAAE,CAAC;YACb,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,OAAO,SAAS,CAAC,aAAa,CAAC;YAC/B,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,SAAS,CAAC,gBAAgB,CAAC;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,SAAS,CAAC,MAAM,CAAC;QACxB,OAAO,SAAS,CAAC,WAAW,CAAC;QAC7B,OAAO,SAAS,CAAC,gBAAgB,CAAC;QAClC,OAAO,SAAS,CAAC,aAAa,CAAC;QAC/B,SAAS,CAAC,UAAU,GAAG,cAAc,CAAC;QACtC,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACvC,OAAO,SAAS,CAAC,YAAY,CAAC;YAC9B,OAAO,SAAS,CAAC,OAAO,CAAC;YACzB,OAAO,SAAS,CAAC,cAAc,CAAC;YAChC,OAAO,SAAS,CAAC,YAAY,CAAC;YAC9B,OAAO,SAAS,CAAC,YAAY,CAAC;QAChC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,QAAQ,EAAE,oBAAoB,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;AAC9F,CAAC"}

package/internal/auth/x509-credential-options.mjs

@@ -0,0 +1,118 @@
+import { OpenAIError } from "../../core/error.mjs";
+import { hasOwn } from "../utils/values.mjs";
+import { isX509WorkloadIdentity } from "./x509-workload-identity-auth.mjs";
+import { findX509Credential } from './x509-transport-state.mjs';
+/** Validates one privately registered credential and suppresses ambient legacy authentication. */
+export function normalizeX509CredentialOptions(options) {
+    const { credential } = options;
+    if (credential === undefined) {
+        return { credential, options };
+    }
+    const registered = findX509Credential(credential);
+    if (!registered) {
+        throw new OpenAIError('An X.509 credential must be created by the SDK authentication helper.');
+    }
+    const conflicting = ['apiKey', 'adminAPIKey', 'workloadIdentity', 'x509Transport'].filter((name) => {
+        const value = options[name];
+        return value !== null && value !== undefined;
+    });
+    if (conflicting.length > 0) {
+        throw new OpenAIError(`The \`credential\` option cannot be combined with ${conflicting.map((name) => `\`${name}\``).join(', ')}.`);
+    }
+    return {
+        credential,
+        options: {
+            ...options,
+            apiKey: null,
+            adminAPIKey: null,
+            baseURL: options.baseURL ?? null,
+            organization: options.organization ?? null,
+            project: options.project ?? null,
+            workloadIdentity: registered.identity,
+            x509Transport: registered.transport,
+        },
+    };
+}
+/** Distinguishes explicitly supplied ordinary credentials from nullish inheritance. */
+function overridesOrdinaryAuthentication({ apiKey, adminAPIKey }) {
+    return (apiKey !== null && apiKey !== undefined) || (adminAPIKey !== null && adminAPIKey !== undefined);
+}
+/** Keeps origin-bound configuration with its owning provider during a client clone. */
+function prepareProviderClone(inherited, overrides) {
+    const inheritedProvider = inherited.provider;
+    const replacingProvider = overrides.credential ?? overrides.workloadIdentity;
+    const provider = overrides.provider ?? (replacingProvider ? undefined : inheritedProvider);
+    if (provider !== inheritedProvider) {
+        delete inherited.baseURL;
+        delete inherited.organization;
+        delete inherited.project;
+        delete inherited.defaultHeaders;
+        delete inherited.defaultQuery;
+        delete inherited.fetchOptions;
+        delete inherited.fetch;
+    }
+    if (provider) {
+        delete inherited.apiKey;
+        delete inherited.adminAPIKey;
+        delete inherited.credential;
+        delete inherited.workloadIdentity;
+        delete inherited.x509Transport;
+        delete inherited.baseURL;
+    }
+    return provider;
+}
+/** Reconciles one client's credential and provider ownership before cloning its options. */
+export function prepareX509ClientClone(inherited, overrides, credential, currentlyX509) {
+    const nextIdentity = hasOwn(overrides, 'workloadIdentity')
+        ? overrides.workloadIdentity
+        : inherited.workloadIdentity;
+    const dropping = credential !== undefined &&
+        ((overridesOrdinaryAuthentication(overrides) && overrides.workloadIdentity === undefined) ||
+            overrides.provider !== undefined);
+    if (credential !== undefined && hasOwn(overrides, 'workloadIdentity')) {
+        delete inherited.x509Transport;
+    }
+    const inheritedCredential = credential !== undefined &&
+        !dropping &&
+        overrides.credential === undefined &&
+        !hasOwn(overrides, 'workloadIdentity') &&
+        !hasOwn(overrides, 'x509Transport')
+        ? credential
+        : undefined;
+    const nextCredential = overrides.credential === undefined ? inheritedCredential : overrides.credential;
+    const nextX509 = nextCredential !== undefined || (!dropping && isX509WorkloadIdentity(nextIdentity));
+    if (currentlyX509 !== nextX509) {
+        delete inherited.fetch;
+        delete inherited.baseURL;
+        delete inherited.organization;
+        delete inherited.project;
+        delete inherited.defaultHeaders;
+        delete inherited.defaultQuery;
+        delete inherited.fetchOptions;
+        if (nextX509) {
+            inherited.apiKey = null;
+        }
+        else {
+            delete inherited.x509Transport;
+            if (dropping) {
+                delete inherited.workloadIdentity;
+            }
+        }
+    }
+    if (nextCredential !== undefined) {
+        delete inherited.apiKey;
+        delete inherited.adminAPIKey;
+        delete inherited.workloadIdentity;
+        delete inherited.x509Transport;
+        inherited.credential = nextCredential;
+        if (overrides.credential !== undefined) {
+            delete inherited.organization;
+            delete inherited.project;
+            delete inherited.defaultHeaders;
+            delete inherited.defaultQuery;
+            delete inherited.fetchOptions;
+        }
+    }
+    return { credential: nextCredential, provider: prepareProviderClone(inherited, overrides) };
+}
+//# sourceMappingURL=x509-credential-options.mjs.map

package/internal/auth/x509-credential-options.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"x509-credential-options.mjs","sourceRoot":"","sources":["../../src/internal/auth/x509-credential-options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,6BAAyB;AAG/C,OAAO,EAAE,MAAM,EAAE,4BAAwB;AACzC,OAAO,EAAE,sBAAsB,EAAE,0CAAsC;AAEvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D,kGAAkG;AAClG,MAAM,UAAU,8BAA8B,CAAC,OAAsB;IAInE,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IAC/B,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,UAAU,GAAyC,kBAAkB,CAAC,UAAU,CAAC,CAAC;IACxF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,WAAW,CAAC,uEAAuE,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,WAAW,GAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,kBAAkB,EAAE,eAAe,CAAW,CAAC,MAAM,CAClG,CAAC,IAAI,EAAE,EAAE;QACP,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,CAAC;IAC/C,CAAC,CACF,CAAC;IACF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,WAAW,CACnB,qDAAqD,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC5G,CAAC;IACJ,CAAC;IAED,OAAO;QACL,UAAU;QACV,OAAO,EAAE;YACP,GAAG,OAAO;YACV,MAAM,EAAE,IAAI;YACZ,WAAW,EAAE,IAAI;YACjB,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,IAAI;YAChC,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI;YAC1C,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,IAAI;YAChC,gBAAgB,EAAE,UAAU,CAAC,QAAQ;YACrC,aAAa,EAAE,UAAU,CAAC,SAAS;SACpC;KACF,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,SAAS,+BAA+B,CAAC,EAAE,MAAM,EAAE,WAAW,EAA0B;IACtF,OAAO,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,CAAC,IAAI,CAAC,WAAW,KAAK,IAAI,IAAI,WAAW,KAAK,SAAS,CAAC,CAAC;AAC1G,CAAC;AAED,uFAAuF;AACvF,SAAS,oBAAoB,CAC3B,SAAwB,EACxB,SAAiC;IAEjC,MAAM,iBAAiB,GAAG,SAAS,CAAC,QAAQ,CAAC;IAC7C,MAAM,iBAAiB,GAAG,SAAS,CAAC,UAAU,IAAI,SAAS,CAAC,gBAAgB,CAAC;IAC7E,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAE3F,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;QACnC,OAAO,SAAS,CAAC,OAAO,CAAC;QACzB,OAAO,SAAS,CAAC,YAAY,CAAC;QAC9B,OAAO,SAAS,CAAC,OAAO,CAAC;QACzB,OAAO,SAAS,CAAC,cAAc,CAAC;QAChC,OAAO,SAAS,CAAC,YAAY,CAAC;QAC9B,OAAO,SAAS,CAAC,YAAY,CAAC;QAC9B,OAAO,SAAS,CAAC,KAAK,CAAC;IACzB,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,SAAS,CAAC,MAAM,CAAC;QACxB,OAAO,SAAS,CAAC,WAAW,CAAC;QAC7B,OAAO,SAAS,CAAC,UAAU,CAAC;QAC5B,OAAO,SAAS,CAAC,gBAAgB,CAAC;QAClC,OAAO,SAAS,CAAC,aAAa,CAAC;QAC/B,OAAO,SAAS,CAAC,OAAO,CAAC;IAC3B,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,sBAAsB,CACpC,SAAwB,EACxB,SAAiC,EACjC,UAAsC,EACtC,aAAsB;IAEtB,MAAM,YAAY,GAAG,MAAM,CAAC,SAAS,EAAE,kBAAkB,CAAC;QACxD,CAAC,CAAC,SAAS,CAAC,gBAAgB;QAC5B,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC;IAC/B,MAAM,QAAQ,GACZ,UAAU,KAAK,SAAS;QACxB,CAAC,CAAC,+BAA+B,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,gBAAgB,KAAK,SAAS,CAAC;YACvF,SAAS,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;IACtC,IAAI,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,EAAE,kBAAkB,CAAC,EAAE,CAAC;QACtE,OAAO,SAAS,CAAC,aAAa,CAAC;IACjC,CAAC;IACD,MAAM,mBAAmB,GACvB,UAAU,KAAK,SAAS;QACxB,CAAC,QAAQ;QACT,SAAS,CAAC,UAAU,KAAK,SAAS;QAClC,CAAC,MAAM,CAAC,SAAS,EAAE,kBAAkB,CAAC;QACtC,CAAC,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC;QACjC,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,cAAc,GAAG,SAAS,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC;IACvG,MAAM,QAAQ,GAAG,cAAc,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,IAAI,sBAAsB,CAAC,YAAY,CAAC,CAAC,CAAC;IAErG,IAAI,aAAa,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAC,KAAK,CAAC;QACvB,OAAO,SAAS,CAAC,OAAO,CAAC;QACzB,OAAO,SAAS,CAAC,YAAY,CAAC;QAC9B,OAAO,SAAS,CAAC,OAAO,CAAC;QACzB,OAAO,SAAS,CAAC,cAAc,CAAC;QAChC,OAAO,SAAS,CAAC,YAAY,CAAC;QAC9B,OAAO,SAAS,CAAC,YAAY,CAAC;QAC9B,IAAI,QAAQ,EAAE,CAAC;YACb,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,OAAO,SAAS,CAAC,aAAa,CAAC;YAC/B,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,SAAS,CAAC,gBAAgB,CAAC;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,SAAS,CAAC,MAAM,CAAC;QACxB,OAAO,SAAS,CAAC,WAAW,CAAC;QAC7B,OAAO,SAAS,CAAC,gBAAgB,CAAC;QAClC,OAAO,SAAS,CAAC,aAAa,CAAC;QAC/B,SAAS,CAAC,UAAU,GAAG,cAAc,CAAC;QACtC,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACvC,OAAO,SAAS,CAAC,YAAY,CAAC;YAC9B,OAAO,SAAS,CAAC,OAAO,CAAC;YACzB,OAAO,SAAS,CAAC,cAAc,CAAC;YAChC,OAAO,SAAS,CAAC,YAAY,CAAC;YAC9B,OAAO,SAAS,CAAC,YAAY,CAAC;QAChC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,QAAQ,EAAE,oBAAoB,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;AAC9F,CAAC"}

package/internal/auth/x509-token-exchange.mjs

@@ -2,7 +2,7 @@ import { APIConnectionError, APIConnectionTimeoutError, APIError, OAuthError, Op
 import { hasOwn } from "../utils/values.mjs";
 import { sendX509Request } from "./x509-transport-capability.mjs";
 import { isRetryableX509TransportFailure } from "./x509-transport-registry.mjs";
-import { isTransientX509ConnectionError, markRetryableX509IssuerError, markTransientX509ConnectionError, rememberX509OAuthError, } from '#x509-transport-state';
+import { isTransientX509ConnectionError, markRetryableX509IssuerError, markTransientX509ConnectionError, rememberX509OAuthError, } from './x509-transport-state.mjs';
 const TOKEN_EXCHANGE_URL = new URL('https://mtls.auth.openai.com/oauth/token');
 const TOKEN_EXCHANGE_GRANT = 'urn:ietf:params:oauth:grant-type:token-exchange';
 const X509_SUBJECT_TOKEN = 'urn:openai:params:oauth:token-type:x509';

package/internal/auth/x509-transport-capability.d.mts

@@ -7,7 +7,13 @@ export type X509ProxyMode = 'direct' | 'http-connect' | 'https-connect';
 export interface X509TransportOptions {
     /** X.509 transport currently supports genuine Node.js runtimes only. */
     runtime: 'node';
-    /** Caller-owned Undici Agent or ProxyAgent; the SDK never closes or inspects it. */
+    /**
+     * Caller-owned Undici Agent or ProxyAgent; the SDK never closes or inspects it.
+     *
+     * The application attests that its dispatcher, factories, TLS verification,
+     * certificate selection, and CONNECT proxy configuration are trustworthy.
+     * Use `fromX509` when the SDK should own and enforce transport configuration.
+     */
     dispatcher: Agent | ProxyAgent;
     /** Attests that the dispatcher uses one static workload-certificate identity. */
     certificateIdentity: 'static';
@@ -22,10 +28,11 @@ export declare function registerX509Transport(transport: X509Transport, register
  * `certificateIdentity: 'static'` is an application attestation: the SDK does
  * not inspect certificates, private dispatcher internals, callbacks, or TLS
  * options and cannot cryptographically prove certificate selection. Configure
- * one static identity without custom dispatcher factories. For HTTPS CONNECT,
- * independently configure `proxyTls` and `requestTls` so workload credentials
- * never reach the proxy. Rotation requires creating a fresh dispatcher and
- * capability; the application remains responsible for draining the old one.
+ * trusted dispatcher factories, verified target and proxy TLS, one static
+ * certificate identity, and independently scoped CONNECT credentials.
+ * Prefer the SDK-owned `fromX509` credential when these guarantees should be
+ * enforced at construction. Rotation requires a fresh caller-owned dispatcher
+ * and capability; the application remains responsible for draining it.
  *
  * This Node-only preview entrypoint requires the optional `undici` peer at
  * version 5.2.0 or later. CONNECT proxy modes require version 5.5.1 or

package/internal/auth/x509-transport-capability.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"x509-transport-capability.d.mts","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-capability.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,UAAU,EAAkB,MAAM,QAAQ,CAAC;AAG3D,OAAO,KAAK,EAAE,uBAAuB,EAAE,aAAa,EAAE,sCAAkC;AAGxF,YAAY,EAAE,aAAa,EAAE,sCAAkC;AAE/D,2EAA2E;AAC3E,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,cAAc,GAAG,eAAe,CAAC;AAExE,wFAAwF;AACxF,MAAM,WAAW,oBAAoB;IACnC,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAEhB,oFAAoF;IACpF,UAAU,EAAE,KAAK,GAAG,UAAU,CAAC;IAE/B,iFAAiF;IACjF,mBAAmB,EAAE,QAAQ,CAAC;IAE9B,mFAAmF;IACnF,KAAK,EAAE,aAAa,CAAC;CACtB;AAoBD,uGAAuG;AACvG,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,uBAAuB,GAAG,IAAI,CAczG;AAsFD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,GAAG,aAAa,CA2BhF;AAED,kGAAkG;AAClG,wBAAsB,eAAe,CACnC,SAAS,EAAE,aAAa,EACxB,MAAM,EAAE,GAAG,EACX,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,QAAQ,CAAC,CAuBnB"}
+{"version":3,"file":"x509-transport-capability.d.mts","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-capability.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,UAAU,EAAkB,MAAM,QAAQ,CAAC;AAG3D,OAAO,KAAK,EAAE,uBAAuB,EAAE,aAAa,EAAE,sCAAkC;AAGxF,YAAY,EAAE,aAAa,EAAE,sCAAkC;AAE/D,2EAA2E;AAC3E,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,cAAc,GAAG,eAAe,CAAC;AAExE,wFAAwF;AACxF,MAAM,WAAW,oBAAoB;IACnC,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAEhB;;;;;;OAMG;IACH,UAAU,EAAE,KAAK,GAAG,UAAU,CAAC;IAE/B,iFAAiF;IACjF,mBAAmB,EAAE,QAAQ,CAAC;IAE9B,mFAAmF;IACnF,KAAK,EAAE,aAAa,CAAC;CACtB;AAoBD,uGAAuG;AACvG,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,uBAAuB,GAAG,IAAI,CAczG;AAsFD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,GAAG,aAAa,CA2BhF;AAED,kGAAkG;AAClG,wBAAsB,eAAe,CACnC,SAAS,EAAE,aAAa,EACxB,MAAM,EAAE,GAAG,EACX,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,QAAQ,CAAC,CAuBnB"}

package/internal/auth/x509-transport-capability.d.ts

@@ -7,7 +7,13 @@ export type X509ProxyMode = 'direct' | 'http-connect' | 'https-connect';
 export interface X509TransportOptions {
     /** X.509 transport currently supports genuine Node.js runtimes only. */
     runtime: 'node';
-    /** Caller-owned Undici Agent or ProxyAgent; the SDK never closes or inspects it. */
+    /**
+     * Caller-owned Undici Agent or ProxyAgent; the SDK never closes or inspects it.
+     *
+     * The application attests that its dispatcher, factories, TLS verification,
+     * certificate selection, and CONNECT proxy configuration are trustworthy.
+     * Use `fromX509` when the SDK should own and enforce transport configuration.
+     */
     dispatcher: Agent | ProxyAgent;
     /** Attests that the dispatcher uses one static workload-certificate identity. */
     certificateIdentity: 'static';
@@ -22,10 +28,11 @@ export declare function registerX509Transport(transport: X509Transport, register
  * `certificateIdentity: 'static'` is an application attestation: the SDK does
  * not inspect certificates, private dispatcher internals, callbacks, or TLS
  * options and cannot cryptographically prove certificate selection. Configure
- * one static identity without custom dispatcher factories. For HTTPS CONNECT,
- * independently configure `proxyTls` and `requestTls` so workload credentials
- * never reach the proxy. Rotation requires creating a fresh dispatcher and
- * capability; the application remains responsible for draining the old one.
+ * trusted dispatcher factories, verified target and proxy TLS, one static
+ * certificate identity, and independently scoped CONNECT credentials.
+ * Prefer the SDK-owned `fromX509` credential when these guarantees should be
+ * enforced at construction. Rotation requires a fresh caller-owned dispatcher
+ * and capability; the application remains responsible for draining it.
  *
  * This Node-only preview entrypoint requires the optional `undici` peer at
  * version 5.2.0 or later. CONNECT proxy modes require version 5.5.1 or

package/internal/auth/x509-transport-capability.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"x509-transport-capability.d.ts","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-capability.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,UAAU,EAAkB,MAAM,QAAQ,CAAC;AAG3D,OAAO,KAAK,EAAE,uBAAuB,EAAE,aAAa,EAAE,qCAAkC;AAGxF,YAAY,EAAE,aAAa,EAAE,qCAAkC;AAE/D,2EAA2E;AAC3E,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,cAAc,GAAG,eAAe,CAAC;AAExE,wFAAwF;AACxF,MAAM,WAAW,oBAAoB;IACnC,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAEhB,oFAAoF;IACpF,UAAU,EAAE,KAAK,GAAG,UAAU,CAAC;IAE/B,iFAAiF;IACjF,mBAAmB,EAAE,QAAQ,CAAC;IAE9B,mFAAmF;IACnF,KAAK,EAAE,aAAa,CAAC;CACtB;AAoBD,uGAAuG;AACvG,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,uBAAuB,GAAG,IAAI,CAczG;AAsFD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,GAAG,aAAa,CA2BhF;AAED,kGAAkG;AAClG,wBAAsB,eAAe,CACnC,SAAS,EAAE,aAAa,EACxB,MAAM,EAAE,GAAG,EACX,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,QAAQ,CAAC,CAuBnB"}
+{"version":3,"file":"x509-transport-capability.d.ts","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-capability.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,UAAU,EAAkB,MAAM,QAAQ,CAAC;AAG3D,OAAO,KAAK,EAAE,uBAAuB,EAAE,aAAa,EAAE,qCAAkC;AAGxF,YAAY,EAAE,aAAa,EAAE,qCAAkC;AAE/D,2EAA2E;AAC3E,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,cAAc,GAAG,eAAe,CAAC;AAExE,wFAAwF;AACxF,MAAM,WAAW,oBAAoB;IACnC,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAEhB;;;;;;OAMG;IACH,UAAU,EAAE,KAAK,GAAG,UAAU,CAAC;IAE/B,iFAAiF;IACjF,mBAAmB,EAAE,QAAQ,CAAC;IAE9B,mFAAmF;IACnF,KAAK,EAAE,aAAa,CAAC;CACtB;AAoBD,uGAAuG;AACvG,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,uBAAuB,GAAG,IAAI,CAczG;AAsFD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,GAAG,aAAa,CA2BhF;AAED,kGAAkG;AAClG,wBAAsB,eAAe,CACnC,SAAS,EAAE,aAAa,EACxB,MAAM,EAAE,GAAG,EACX,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,QAAQ,CAAC,CAuBnB"}

package/internal/auth/x509-transport-capability.js

@@ -113,10 +113,11 @@ function assertConnectProxySupport() {
  * `certificateIdentity: 'static'` is an application attestation: the SDK does
  * not inspect certificates, private dispatcher internals, callbacks, or TLS
  * options and cannot cryptographically prove certificate selection. Configure
- * one static identity without custom dispatcher factories. For HTTPS CONNECT,
- * independently configure `proxyTls` and `requestTls` so workload credentials
- * never reach the proxy. Rotation requires creating a fresh dispatcher and
- * capability; the application remains responsible for draining the old one.
+ * trusted dispatcher factories, verified target and proxy TLS, one static
+ * certificate identity, and independently scoped CONNECT credentials.
+ * Prefer the SDK-owned `fromX509` credential when these guarantees should be
+ * enforced at construction. Rotation requires a fresh caller-owned dispatcher
+ * and capability; the application remains responsible for draining it.
  *
  * This Node-only preview entrypoint requires the optional `undici` peer at
  * version 5.2.0 or later. CONNECT proxy modes require version 5.5.1 or

package/internal/auth/x509-transport-capability.js.map

@@ -1 +1 @@
-{"version":3,"file":"x509-transport-capability.js","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-capability.ts"],"names":[],"mappings":";;;AA8CA,sDAcC;AAqGD,kDA2BC;AAGD,0CA2BC;;AA1ND,yCAAkC;AAClC,mCAA2D;AAC3D,+CAA+C;AAC/C,0EAA+D;AAE/D,iEAAqG;AAsBrG,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,qBAAqB,EAAE,OAAO,CAAC,CAAC,CAAC;AAC9F,MAAM,cAAc,GAA8B,4CAAkB,CAAC;AAErE,MAAM,iBAAiB;IAKrB,YAAY,UAA8B;QAFjC,gDAAgC;QAGvC,+BAAA,IAAI,iCAAe,UAAU,MAAA,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAED,MAAM,CAAC,UAAU,CAAC,KAAa;QAC7B,OAAO,6DAAe,KAAK,EAAC,CAAC,CAAC,+BAAA,KAAK,qCAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,CAAC;CACF;;AAED,uGAAuG;AACvG,SAAgB,qBAAqB,CAAC,SAAwB,EAAE,UAAmC;IACjG,IACE,CAAC,SAAS;QACV,OAAO,SAAS,KAAK,QAAQ;QAC7B,iBAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QACxB,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC3B,CAAC,iBAAiB,CAAC,UAAU,CAAC,SAAS,CAAC,EACxC,CAAC;QACD,MAAM,IAAI,mBAAW,CAAC,qEAAqE,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,IAAA,mDAA2B,EAAC,SAAS,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,mBAAW,CAAC,6EAA6E,CAAC,CAAC;IACvG,CAAC;IACD,IAAA,uDAA+B,EAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,UAAU,CAAC,OAA6B,EAAE,IAAgC;IACjF,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAClE,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,wCAAwC,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,UAAU,CAAC,KAAK,CAAC;AAC1B,CAAC;AAED,SAAS,iBAAiB;IACxB,IACE,OAAO,OAAO,KAAK,WAAW;QAC9B,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM;QAC/B,KAAK,IAAI,OAAO,CAAC,QAAQ;QACzB,KAAK,IAAI,UAAU;QACnB,MAAM,IAAI,UAAU,EACpB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,OAA6B;IACvD,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACrD,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,iBAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,YAAY,cAAK,CAAC;IAC7C,MAAM,SAAS,GAAG,UAAU,YAAY,mBAAU,CAAC;IACnD,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,cAAc,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,8BAA8B,CAAC,UAA8B;IACpE,IAAI,yBAAyB,GAAG,KAAK,CAAC;IAEtC,sFAAsF;IACtF,KAAK,OAAO,CAAC,UAAU,CAAC;QACtB,IAAA,cAAK,EAAC,aAAa,EAAE;YACnB,IAAI,UAAU;gBACZ,yBAAyB,GAAG,IAAI,CAAC;gBACjC,OAAO,UAAU,CAAC;YACpB,CAAC;SACF,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,yBAAyB,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;IACzG,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB;IAChC,MAAM,YAAY,GAAG,yBAAyB,CAAC;IAC/C,IAAI,YAAgC,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI,mBAAU,CAAC;QAC3B,GAAG,EAAE,oBAAoB;QACzB,OAAO,CAAC,MAAM;YACZ,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;KACF,CAAC,CAAC;IAEH,oFAAoF;IACpF,MAAM,OAAO,GAAG,IAAA,cAAK,EAAC,YAAY,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAElD,IAAI,YAAY,KAAK,YAAY,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;IACnG,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAgB,mBAAmB,CAAC,OAA6B;IAC/D,iBAAiB,EAAE,CAAC;IAEpB,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,iBAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,yCAAyC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAED,IAAI,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,MAAM,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IAED,IAAI,UAAU,CAAC,OAAO,EAAE,qBAAqB,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,CAAC;IAED,MAAM,UAAU,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC/C,8BAA8B,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,UAAU,YAAY,mBAAU,EAAE,CAAC;QACrC,yBAAyB,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,iBAAiB,CAAC,UAAU,CAAC,CAAC;AAC3C,CAAC;AAED,kGAAkG;AAC3F,KAAK,UAAU,eAAe,CACnC,SAAwB,EACxB,MAAW,EACX,OAAoB;IAEpB,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,iBAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,UAAU,GAAG,iBAAiB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IAC3D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,gBAAgB,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,MAAM,CAAC,wBAAwB,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,cAAc,GAAoC,OAAO,CAAC;IAChE,MAAM,OAAO,GAAG,IAAI,gBAAO,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,MAAM,IAAA,cAAK,EAAC,OAAO,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC1E,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"x509-transport-capability.js","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-capability.ts"],"names":[],"mappings":";;;AAoDA,sDAcC;AAsGD,kDA2BC;AAGD,0CA2BC;;AAjOD,yCAAkC;AAClC,mCAA2D;AAC3D,+CAA+C;AAC/C,0EAA+D;AAE/D,iEAAqG;AA4BrG,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,qBAAqB,EAAE,OAAO,CAAC,CAAC,CAAC;AAC9F,MAAM,cAAc,GAA8B,4CAAkB,CAAC;AAErE,MAAM,iBAAiB;IAKrB,YAAY,UAA8B;QAFjC,gDAAgC;QAGvC,+BAAA,IAAI,iCAAe,UAAU,MAAA,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAED,MAAM,CAAC,UAAU,CAAC,KAAa;QAC7B,OAAO,6DAAe,KAAK,EAAC,CAAC,CAAC,+BAAA,KAAK,qCAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,CAAC;CACF;;AAED,uGAAuG;AACvG,SAAgB,qBAAqB,CAAC,SAAwB,EAAE,UAAmC;IACjG,IACE,CAAC,SAAS;QACV,OAAO,SAAS,KAAK,QAAQ;QAC7B,iBAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QACxB,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC3B,CAAC,iBAAiB,CAAC,UAAU,CAAC,SAAS,CAAC,EACxC,CAAC;QACD,MAAM,IAAI,mBAAW,CAAC,qEAAqE,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,IAAA,mDAA2B,EAAC,SAAS,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,mBAAW,CAAC,6EAA6E,CAAC,CAAC;IACvG,CAAC;IACD,IAAA,uDAA+B,EAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,UAAU,CAAC,OAA6B,EAAE,IAAgC;IACjF,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAClE,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,wCAAwC,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,UAAU,CAAC,KAAK,CAAC;AAC1B,CAAC;AAED,SAAS,iBAAiB;IACxB,IACE,OAAO,OAAO,KAAK,WAAW;QAC9B,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM;QAC/B,KAAK,IAAI,OAAO,CAAC,QAAQ;QACzB,KAAK,IAAI,UAAU;QACnB,MAAM,IAAI,UAAU,EACpB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,OAA6B;IACvD,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACrD,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,iBAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,YAAY,cAAK,CAAC;IAC7C,MAAM,SAAS,GAAG,UAAU,YAAY,mBAAU,CAAC;IACnD,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,cAAc,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,8BAA8B,CAAC,UAA8B;IACpE,IAAI,yBAAyB,GAAG,KAAK,CAAC;IAEtC,sFAAsF;IACtF,KAAK,OAAO,CAAC,UAAU,CAAC;QACtB,IAAA,cAAK,EAAC,aAAa,EAAE;YACnB,IAAI,UAAU;gBACZ,yBAAyB,GAAG,IAAI,CAAC;gBACjC,OAAO,UAAU,CAAC;YACpB,CAAC;SACF,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,yBAAyB,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;IACzG,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB;IAChC,MAAM,YAAY,GAAG,yBAAyB,CAAC;IAC/C,IAAI,YAAgC,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI,mBAAU,CAAC;QAC3B,GAAG,EAAE,oBAAoB;QACzB,OAAO,CAAC,MAAM;YACZ,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;KACF,CAAC,CAAC;IAEH,oFAAoF;IACpF,MAAM,OAAO,GAAG,IAAA,cAAK,EAAC,YAAY,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAElD,IAAI,YAAY,KAAK,YAAY,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;IACnG,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,mBAAmB,CAAC,OAA6B;IAC/D,iBAAiB,EAAE,CAAC;IAEpB,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,iBAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,yCAAyC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAED,IAAI,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,MAAM,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IAED,IAAI,UAAU,CAAC,OAAO,EAAE,qBAAqB,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,CAAC;IAED,MAAM,UAAU,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC/C,8BAA8B,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,UAAU,YAAY,mBAAU,EAAE,CAAC;QACrC,yBAAyB,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,iBAAiB,CAAC,UAAU,CAAC,CAAC;AAC3C,CAAC;AAED,kGAAkG;AAC3F,KAAK,UAAU,eAAe,CACnC,SAAwB,EACxB,MAAW,EACX,OAAoB;IAEpB,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,iBAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,UAAU,GAAG,iBAAiB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IAC3D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,gBAAgB,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,MAAM,CAAC,wBAAwB,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,cAAc,GAAoC,OAAO,CAAC;IAChE,MAAM,OAAO,GAAG,IAAI,gBAAO,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,MAAM,IAAA,cAAK,EAAC,OAAO,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC1E,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/internal/auth/x509-transport-capability.mjs

@@ -4,7 +4,7 @@ import { types } from 'node:util';
 import { Agent, ProxyAgent, Request, fetch } from 'undici';
 import { OpenAIError } from "../../core/error.mjs";
 import { x509TransportBrand } from "./x509-transport-registry.mjs";
-import { findRegisteredX509Transport, rememberRegisteredX509Transport } from '#x509-transport-state';
+import { findRegisteredX509Transport, rememberRegisteredX509Transport } from './x509-transport-state.mjs';
 const allowedOptionNames = new Set(['runtime', 'dispatcher', 'certificateIdentity', 'proxy']);
 const transportBrand = x509TransportBrand;
 class NodeX509Transport {
@@ -108,10 +108,11 @@ function assertConnectProxySupport() {
  * `certificateIdentity: 'static'` is an application attestation: the SDK does
  * not inspect certificates, private dispatcher internals, callbacks, or TLS
  * options and cannot cryptographically prove certificate selection. Configure
- * one static identity without custom dispatcher factories. For HTTPS CONNECT,
- * independently configure `proxyTls` and `requestTls` so workload credentials
- * never reach the proxy. Rotation requires creating a fresh dispatcher and
- * capability; the application remains responsible for draining the old one.
+ * trusted dispatcher factories, verified target and proxy TLS, one static
+ * certificate identity, and independently scoped CONNECT credentials.
+ * Prefer the SDK-owned `fromX509` credential when these guarantees should be
+ * enforced at construction. Rotation requires a fresh caller-owned dispatcher
+ * and capability; the application remains responsible for draining it.
  *
  * This Node-only preview entrypoint requires the optional `undici` peer at
  * version 5.2.0 or later. CONNECT proxy modes require version 5.5.1 or

package/internal/auth/x509-transport-capability.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"x509-transport-capability.mjs","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-capability.ts"],"names":[],"mappings":";;AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,6BAAyB;AAC/C,OAAO,EAAE,kBAAkB,EAAE,sCAAkC;AAE/D,OAAO,EAAE,2BAA2B,EAAE,+BAA+B,EAAE,MAAM,uBAAuB,CAAC;AAsBrG,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,qBAAqB,EAAE,OAAO,CAAC,CAAC,CAAC;AAC9F,MAAM,cAAc,GAA8B,kBAAkB,CAAC;AAErE,MAAM,iBAAiB;IAKrB,YAAY,UAA8B;QAFjC,gDAAgC;QAGvC,uBAAA,IAAI,iCAAe,UAAU,MAAA,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAED,MAAM,CAAC,UAAU,CAAC,KAAa;QAC7B,OAAO,qDAAe,KAAK,EAAC,CAAC,CAAC,uBAAA,KAAK,qCAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,CAAC;CACF;;AAED,uGAAuG;AACvG,MAAM,UAAU,qBAAqB,CAAC,SAAwB,EAAE,UAAmC;IACjG,IACE,CAAC,SAAS;QACV,OAAO,SAAS,KAAK,QAAQ;QAC7B,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QACxB,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC3B,CAAC,iBAAiB,CAAC,UAAU,CAAC,SAAS,CAAC,EACxC,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,qEAAqE,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,2BAA2B,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,WAAW,CAAC,6EAA6E,CAAC,CAAC;IACvG,CAAC;IACD,+BAA+B,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,UAAU,CAAC,OAA6B,EAAE,IAAgC;IACjF,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAClE,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,wCAAwC,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,UAAU,CAAC,KAAK,CAAC;AAC1B,CAAC;AAED,SAAS,iBAAiB;IACxB,IACE,OAAO,OAAO,KAAK,WAAW;QAC9B,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM;QAC/B,KAAK,IAAI,OAAO,CAAC,QAAQ;QACzB,KAAK,IAAI,UAAU;QACnB,MAAM,IAAI,UAAU,EACpB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,OAA6B;IACvD,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACrD,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,YAAY,KAAK,CAAC;IAC7C,MAAM,SAAS,GAAG,UAAU,YAAY,UAAU,CAAC;IACnD,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,cAAc,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,8BAA8B,CAAC,UAA8B;IACpE,IAAI,yBAAyB,GAAG,KAAK,CAAC;IAEtC,sFAAsF;IACtF,KAAK,OAAO,CAAC,UAAU,CAAC;QACtB,KAAK,CAAC,aAAa,EAAE;YACnB,IAAI,UAAU;gBACZ,yBAAyB,GAAG,IAAI,CAAC;gBACjC,OAAO,UAAU,CAAC;YACpB,CAAC;SACF,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,yBAAyB,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;IACzG,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB;IAChC,MAAM,YAAY,GAAG,yBAAyB,CAAC;IAC/C,IAAI,YAAgC,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC;QAC3B,GAAG,EAAE,oBAAoB;QACzB,OAAO,CAAC,MAAM;YACZ,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;KACF,CAAC,CAAC;IAEH,oFAAoF;IACpF,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAElD,IAAI,YAAY,KAAK,YAAY,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;IACnG,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAA6B;IAC/D,iBAAiB,EAAE,CAAC;IAEpB,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,yCAAyC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAED,IAAI,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,MAAM,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IAED,IAAI,UAAU,CAAC,OAAO,EAAE,qBAAqB,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,CAAC;IAED,MAAM,UAAU,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC/C,8BAA8B,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,UAAU,YAAY,UAAU,EAAE,CAAC;QACrC,yBAAyB,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,iBAAiB,CAAC,UAAU,CAAC,CAAC;AAC3C,CAAC;AAED,kGAAkG;AAClG,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,SAAwB,EACxB,MAAW,EACX,OAAoB;IAEpB,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,UAAU,GAAG,iBAAiB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IAC3D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,gBAAgB,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,MAAM,CAAC,wBAAwB,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,cAAc,GAAoC,OAAO,CAAC;IAChE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC1E,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"x509-transport-capability.mjs","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-capability.ts"],"names":[],"mappings":";;AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,6BAAyB;AAC/C,OAAO,EAAE,kBAAkB,EAAE,sCAAkC;AAE/D,OAAO,EAAE,2BAA2B,EAAE,+BAA+B,EAAE,MAAM,uBAAuB,CAAC;AA4BrG,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,qBAAqB,EAAE,OAAO,CAAC,CAAC,CAAC;AAC9F,MAAM,cAAc,GAA8B,kBAAkB,CAAC;AAErE,MAAM,iBAAiB;IAKrB,YAAY,UAA8B;QAFjC,gDAAgC;QAGvC,uBAAA,IAAI,iCAAe,UAAU,MAAA,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAED,MAAM,CAAC,UAAU,CAAC,KAAa;QAC7B,OAAO,qDAAe,KAAK,EAAC,CAAC,CAAC,uBAAA,KAAK,qCAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,CAAC;CACF;;AAED,uGAAuG;AACvG,MAAM,UAAU,qBAAqB,CAAC,SAAwB,EAAE,UAAmC;IACjG,IACE,CAAC,SAAS;QACV,OAAO,SAAS,KAAK,QAAQ;QAC7B,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QACxB,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC3B,CAAC,iBAAiB,CAAC,UAAU,CAAC,SAAS,CAAC,EACxC,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,qEAAqE,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,2BAA2B,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,WAAW,CAAC,6EAA6E,CAAC,CAAC;IACvG,CAAC;IACD,+BAA+B,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,UAAU,CAAC,OAA6B,EAAE,IAAgC;IACjF,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAClE,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,wCAAwC,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,UAAU,CAAC,KAAK,CAAC;AAC1B,CAAC;AAED,SAAS,iBAAiB;IACxB,IACE,OAAO,OAAO,KAAK,WAAW;QAC9B,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM;QAC/B,KAAK,IAAI,OAAO,CAAC,QAAQ;QACzB,KAAK,IAAI,UAAU;QACnB,MAAM,IAAI,UAAU,EACpB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,OAA6B;IACvD,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACrD,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,YAAY,KAAK,CAAC;IAC7C,MAAM,SAAS,GAAG,UAAU,YAAY,UAAU,CAAC;IACnD,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,cAAc,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,8BAA8B,CAAC,UAA8B;IACpE,IAAI,yBAAyB,GAAG,KAAK,CAAC;IAEtC,sFAAsF;IACtF,KAAK,OAAO,CAAC,UAAU,CAAC;QACtB,KAAK,CAAC,aAAa,EAAE;YACnB,IAAI,UAAU;gBACZ,yBAAyB,GAAG,IAAI,CAAC;gBACjC,OAAO,UAAU,CAAC;YACpB,CAAC;SACF,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,yBAAyB,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;IACzG,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB;IAChC,MAAM,YAAY,GAAG,yBAAyB,CAAC;IAC/C,IAAI,YAAgC,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC;QAC3B,GAAG,EAAE,oBAAoB;QACzB,OAAO,CAAC,MAAM;YACZ,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;KACF,CAAC,CAAC;IAEH,oFAAoF;IACpF,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAElD,IAAI,YAAY,KAAK,YAAY,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;IACnG,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAA6B;IAC/D,iBAAiB,EAAE,CAAC;IAEpB,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,yCAAyC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAED,IAAI,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,MAAM,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IAED,IAAI,UAAU,CAAC,OAAO,EAAE,qBAAqB,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,CAAC;IAED,MAAM,UAAU,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC/C,8BAA8B,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,UAAU,YAAY,UAAU,EAAE,CAAC;QACrC,yBAAyB,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,iBAAiB,CAAC,UAAU,CAAC,CAAC;AAC3C,CAAC;AAED,kGAAkG;AAClG,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,SAAwB,EACxB,MAAW,EACX,OAAoB;IAEpB,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,UAAU,GAAG,iBAAiB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IAC3D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,gBAAgB,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,MAAM,CAAC,wBAAwB,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,cAAc,GAAoC,OAAO,CAAC;IAChE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC1E,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/internal/auth/x509-transport-registry.d.mts

@@ -1,4 +1,5 @@
 import type { NullableHeaders } from "../headers.mjs";
+import type { X509WorkloadIdentity } from "../../auth/types.mjs";
 import type { ReadableStream } from "../shim-types.mjs";
 import type { MergedRequestInit } from "../types.mjs";
 /** Retries only known temporary failures when neither error layer reports a permanent code. */
@@ -9,6 +10,11 @@ export interface X509Transport {
     /** Prevents ordinary objects from satisfying the transport capability contract. */
     readonly [x509TransportBrand]: true;
 }
+/** Immutable selectors and transport privately registered for an SDK-owned credential. */
+export interface RegisteredX509Credential {
+    readonly identity: X509WorkloadIdentity;
+    readonly transport: X509Transport;
+}
 /** Validated short-lived token exchanged using a registered certificate identity. */
 export interface X509ExchangedToken {
     /** Header-safe, in-memory OpenAI bearer credential. */
@@ -21,6 +27,8 @@ export interface X509RequestScope {
     wallStartedAt: number;
     monotonicStartedAt: number;
     deadlineArmed?: boolean;
+    preparationStartedAt?: number;
+    preparationWallStartedAt?: number;
     request?: {
         signal: AbortSignal | null | undefined;
         timeout: number;

package/internal/auth/x509-transport-registry.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"x509-transport-registry.d.mts","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-registry.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,uBAAmB;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,0BAAsB;AACpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAiB;AAkBlD,+FAA+F;AAC/F,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAmBzE;AAED,eAAO,MAAM,kBAAkB,EAAE,OAAO,MAA6C,CAAC;AAEtF,wFAAwF;AACxF,MAAM,WAAW,aAAa;IAC5B,mFAAmF;IACnF,QAAQ,CAAC,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAC;CACrC;AAED,qFAAqF;AACrF,MAAM,WAAW,kBAAkB;IACjC,uDAAuD;IACvD,WAAW,EAAE,MAAM,CAAC;IAEpB,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,2FAA2F;AAC3F,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,OAAO,CAAC,EAAE;QAAE,MAAM,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,iBAAiB,CAAA;KAAE,CAAC;IACvG,KAAK,CAAC,EAAE,UAAU,GAAG,aAAa,CAAC;IACnC,eAAe,CAAC,EAAE,WAAW,CAAC;IAC9B,gBAAgB,CAAC,EAAE,cAAc,CAAC;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACjE,cAAc,CAAC,EAAE,eAAe,CAAC;IACjC,cAAc,CAAC,EAAE,eAAe,CAAC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,0FAA0F;AAC1F,MAAM,WAAW,uBAAuB;IACtC,8EAA8E;IAC9E,QAAQ,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEnE,oFAAoF;IACpF,QAAQ,EAAE,CACR,kBAAkB,EAAE,MAAM,EAC1B,gBAAgB,EAAE,MAAM,EACxB,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAEjC,sGAAsG;IACtG,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAElC,4FAA4F;IAC5F,OAAO,EAAE,MAAM,gBAAgB,GAAG,SAAS,CAAC;IAE5C,oGAAoG;IACpG,MAAM,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAE9D,2FAA2F;IAC3F,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACzE;AAED,uGAAuG;AACvG,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,uBAAuB,CAU5E"}
+{"version":3,"file":"x509-transport-registry.d.mts","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-registry.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,uBAAmB;AAClD,OAAO,KAAK,EAAE,oBAAoB,EAAE,6BAAyB;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,0BAAsB;AACpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAiB;AAkBlD,+FAA+F;AAC/F,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAmBzE;AAED,eAAO,MAAM,kBAAkB,EAAE,OAAO,MAA6C,CAAC;AAEtF,wFAAwF;AACxF,MAAM,WAAW,aAAa;IAC5B,mFAAmF;IACnF,QAAQ,CAAC,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAC;CACrC;AAED,0FAA0F;AAC1F,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC;CACnC;AAED,qFAAqF;AACrF,MAAM,WAAW,kBAAkB;IACjC,uDAAuD;IACvD,WAAW,EAAE,MAAM,CAAC;IAEpB,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,2FAA2F;AAC3F,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,OAAO,CAAC,EAAE;QAAE,MAAM,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,iBAAiB,CAAA;KAAE,CAAC;IACvG,KAAK,CAAC,EAAE,UAAU,GAAG,aAAa,CAAC;IACnC,eAAe,CAAC,EAAE,WAAW,CAAC;IAC9B,gBAAgB,CAAC,EAAE,cAAc,CAAC;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACjE,cAAc,CAAC,EAAE,eAAe,CAAC;IACjC,cAAc,CAAC,EAAE,eAAe,CAAC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,0FAA0F;AAC1F,MAAM,WAAW,uBAAuB;IACtC,8EAA8E;IAC9E,QAAQ,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEnE,oFAAoF;IACpF,QAAQ,EAAE,CACR,kBAAkB,EAAE,MAAM,EAC1B,gBAAgB,EAAE,MAAM,EACxB,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAEjC,sGAAsG;IACtG,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAElC,4FAA4F;IAC5F,OAAO,EAAE,MAAM,gBAAgB,GAAG,SAAS,CAAC;IAE5C,oGAAoG;IACpG,MAAM,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAE9D,2FAA2F;IAC3F,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACzE;AAED,uGAAuG;AACvG,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,uBAAuB,CAU5E"}

package/internal/auth/x509-transport-registry.d.ts

@@ -1,4 +1,5 @@
 import type { NullableHeaders } from "../headers.js";
+import type { X509WorkloadIdentity } from "../../auth/types.js";
 import type { ReadableStream } from "../shim-types.js";
 import type { MergedRequestInit } from "../types.js";
 /** Retries only known temporary failures when neither error layer reports a permanent code. */
@@ -9,6 +10,11 @@ export interface X509Transport {
     /** Prevents ordinary objects from satisfying the transport capability contract. */
     readonly [x509TransportBrand]: true;
 }
+/** Immutable selectors and transport privately registered for an SDK-owned credential. */
+export interface RegisteredX509Credential {
+    readonly identity: X509WorkloadIdentity;
+    readonly transport: X509Transport;
+}
 /** Validated short-lived token exchanged using a registered certificate identity. */
 export interface X509ExchangedToken {
     /** Header-safe, in-memory OpenAI bearer credential. */
@@ -21,6 +27,8 @@ export interface X509RequestScope {
     wallStartedAt: number;
     monotonicStartedAt: number;
     deadlineArmed?: boolean;
+    preparationStartedAt?: number;
+    preparationWallStartedAt?: number;
     request?: {
         signal: AbortSignal | null | undefined;
         timeout: number;

package/internal/auth/x509-transport-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"x509-transport-registry.d.ts","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-registry.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,sBAAmB;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,yBAAsB;AACpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,oBAAiB;AAkBlD,+FAA+F;AAC/F,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAmBzE;AAED,eAAO,MAAM,kBAAkB,EAAE,OAAO,MAA6C,CAAC;AAEtF,wFAAwF;AACxF,MAAM,WAAW,aAAa;IAC5B,mFAAmF;IACnF,QAAQ,CAAC,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAC;CACrC;AAED,qFAAqF;AACrF,MAAM,WAAW,kBAAkB;IACjC,uDAAuD;IACvD,WAAW,EAAE,MAAM,CAAC;IAEpB,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,2FAA2F;AAC3F,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,OAAO,CAAC,EAAE;QAAE,MAAM,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,iBAAiB,CAAA;KAAE,CAAC;IACvG,KAAK,CAAC,EAAE,UAAU,GAAG,aAAa,CAAC;IACnC,eAAe,CAAC,EAAE,WAAW,CAAC;IAC9B,gBAAgB,CAAC,EAAE,cAAc,CAAC;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACjE,cAAc,CAAC,EAAE,eAAe,CAAC;IACjC,cAAc,CAAC,EAAE,eAAe,CAAC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,0FAA0F;AAC1F,MAAM,WAAW,uBAAuB;IACtC,8EAA8E;IAC9E,QAAQ,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEnE,oFAAoF;IACpF,QAAQ,EAAE,CACR,kBAAkB,EAAE,MAAM,EAC1B,gBAAgB,EAAE,MAAM,EACxB,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAEjC,sGAAsG;IACtG,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAElC,4FAA4F;IAC5F,OAAO,EAAE,MAAM,gBAAgB,GAAG,SAAS,CAAC;IAE5C,oGAAoG;IACpG,MAAM,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAE9D,2FAA2F;IAC3F,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACzE;AAED,uGAAuG;AACvG,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,uBAAuB,CAU5E"}
+{"version":3,"file":"x509-transport-registry.d.ts","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-registry.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,sBAAmB;AAClD,OAAO,KAAK,EAAE,oBAAoB,EAAE,4BAAyB;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,yBAAsB;AACpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,oBAAiB;AAkBlD,+FAA+F;AAC/F,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAmBzE;AAED,eAAO,MAAM,kBAAkB,EAAE,OAAO,MAA6C,CAAC;AAEtF,wFAAwF;AACxF,MAAM,WAAW,aAAa;IAC5B,mFAAmF;IACnF,QAAQ,CAAC,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAC;CACrC;AAED,0FAA0F;AAC1F,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC;CACnC;AAED,qFAAqF;AACrF,MAAM,WAAW,kBAAkB;IACjC,uDAAuD;IACvD,WAAW,EAAE,MAAM,CAAC;IAEpB,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,2FAA2F;AAC3F,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,OAAO,CAAC,EAAE;QAAE,MAAM,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,iBAAiB,CAAA;KAAE,CAAC;IACvG,KAAK,CAAC,EAAE,UAAU,GAAG,aAAa,CAAC;IACnC,eAAe,CAAC,EAAE,WAAW,CAAC;IAC9B,gBAAgB,CAAC,EAAE,cAAc,CAAC;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACjE,cAAc,CAAC,EAAE,eAAe,CAAC;IACjC,cAAc,CAAC,EAAE,eAAe,CAAC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,0FAA0F;AAC1F,MAAM,WAAW,uBAAuB;IACtC,8EAA8E;IAC9E,QAAQ,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEnE,oFAAoF;IACpF,QAAQ,EAAE,CACR,kBAAkB,EAAE,MAAM,EAC1B,gBAAgB,EAAE,MAAM,EACxB,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAEjC,sGAAsG;IACtG,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAElC,4FAA4F;IAC5F,OAAO,EAAE,MAAM,gBAAgB,GAAG,SAAS,CAAC;IAE5C,oGAAoG;IACpG,MAAM,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAE9D,2FAA2F;IAC3F,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACzE;AAED,uGAAuG;AACvG,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,uBAAuB,CAU5E"}

package/internal/auth/x509-transport-registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"x509-transport-registry.js","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-registry.ts"],"names":[],"mappings":";;;AAsBA,0EAmBC;AAkED,oDAUC;AArHD,+CAA+C;AAI/C,iEAAoE;AAEpE,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC;IAC1C,YAAY;IACZ,cAAc;IACd,aAAa;IACb,cAAc;IACd,UAAU;IACV,OAAO;IACP,WAAW;IACX,WAAW;IACX,yBAAyB;IACzB,yBAAyB;IACzB,sBAAsB;IACtB,gBAAgB;CACjB,CAAC,CAAC;AAEH,+FAA+F;AAC/F,SAAgB,+BAA+B,CAAC,OAAgB;IAC9D,MAAM,KAAK,GACT,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QAC7C,CAAC,CAAC,MAAM,CAAC,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,KAAK;QAC1D,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,MAAM,SAAS,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,GACR,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI;YACjD,CAAC,CAAC,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,KAAK;YAC3D,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3C,OAAO,KAAK,CAAC;YACf,CAAC;YACD,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAEY,QAAA,kBAAkB,GAAkB,MAAM,CAAC,4BAA4B,CAAC,CAAC;AA+DtF,uGAAuG;AACvG,SAAgB,oBAAoB,CAAC,KAAc;IACjD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,mBAAW,CAAC,0EAA0E,CAAC,CAAC;IACpG,CAAC;IAED,MAAM,UAAU,GAAwC,IAAA,mDAA2B,EAAC,KAAK,CAAC,CAAC;IAC3F,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAW,CAAC,0EAA0E,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC"}
+{"version":3,"file":"x509-transport-registry.js","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-registry.ts"],"names":[],"mappings":";;;AAuBA,0EAmBC;AA0ED,oDAUC;AA9HD,+CAA+C;AAK/C,iEAAoE;AAEpE,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC;IAC1C,YAAY;IACZ,cAAc;IACd,aAAa;IACb,cAAc;IACd,UAAU;IACV,OAAO;IACP,WAAW;IACX,WAAW;IACX,yBAAyB;IACzB,yBAAyB;IACzB,sBAAsB;IACtB,gBAAgB;CACjB,CAAC,CAAC;AAEH,+FAA+F;AAC/F,SAAgB,+BAA+B,CAAC,OAAgB;IAC9D,MAAM,KAAK,GACT,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QAC7C,CAAC,CAAC,MAAM,CAAC,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,KAAK;QAC1D,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,MAAM,SAAS,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,GACR,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI;YACjD,CAAC,CAAC,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,KAAK;YAC3D,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3C,OAAO,KAAK,CAAC;YACf,CAAC;YACD,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAEY,QAAA,kBAAkB,GAAkB,MAAM,CAAC,4BAA4B,CAAC,CAAC;AAuEtF,uGAAuG;AACvG,SAAgB,oBAAoB,CAAC,KAAc;IACjD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,mBAAW,CAAC,0EAA0E,CAAC,CAAC;IACpG,CAAC;IAED,MAAM,UAAU,GAAwC,IAAA,mDAA2B,EAAC,KAAK,CAAC,CAAC;IAC3F,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAW,CAAC,0EAA0E,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/internal/auth/x509-transport-registry.mjs

@@ -1,5 +1,5 @@
 import { OpenAIError } from "../../core/error.mjs";
-import { findRegisteredX509Transport } from '#x509-transport-state';
+import { findRegisteredX509Transport } from './x509-transport-state.mjs';
 const transientX509TransportCodes = new Set([
     'ECONNRESET',
     'ECONNREFUSED',

package/internal/auth/x509-transport-registry.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"x509-transport-registry.mjs","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,6BAAyB;AAI/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAEpE,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC;IAC1C,YAAY;IACZ,cAAc;IACd,aAAa;IACb,cAAc;IACd,UAAU;IACV,OAAO;IACP,WAAW;IACX,WAAW;IACX,yBAAyB;IACzB,yBAAyB;IACzB,sBAAsB;IACtB,gBAAgB;CACjB,CAAC,CAAC;AAEH,+FAA+F;AAC/F,MAAM,UAAU,+BAA+B,CAAC,OAAgB;IAC9D,MAAM,KAAK,GACT,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QAC7C,CAAC,CAAC,MAAM,CAAC,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,KAAK;QAC1D,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,MAAM,SAAS,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,GACR,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI;YACjD,CAAC,CAAC,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,KAAK;YAC3D,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3C,OAAO,KAAK,CAAC;YACf,CAAC;YACD,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAkB,MAAM,CAAC,4BAA4B,CAAC,CAAC;AA+DtF,uGAAuG;AACvG,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,WAAW,CAAC,0EAA0E,CAAC,CAAC;IACpG,CAAC;IAED,MAAM,UAAU,GAAwC,2BAA2B,CAAC,KAAK,CAAC,CAAC;IAC3F,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,WAAW,CAAC,0EAA0E,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC"}
+{"version":3,"file":"x509-transport-registry.mjs","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,6BAAyB;AAK/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAEpE,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC;IAC1C,YAAY;IACZ,cAAc;IACd,aAAa;IACb,cAAc;IACd,UAAU;IACV,OAAO;IACP,WAAW;IACX,WAAW;IACX,yBAAyB;IACzB,yBAAyB;IACzB,sBAAsB;IACtB,gBAAgB;CACjB,CAAC,CAAC;AAEH,+FAA+F;AAC/F,MAAM,UAAU,+BAA+B,CAAC,OAAgB;IAC9D,MAAM,KAAK,GACT,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QAC7C,CAAC,CAAC,MAAM,CAAC,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,KAAK;QAC1D,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,MAAM,SAAS,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,GACR,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI;YACjD,CAAC,CAAC,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,KAAK;YAC3D,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3C,OAAO,KAAK,CAAC;YACf,CAAC;YACD,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAkB,MAAM,CAAC,4BAA4B,CAAC,CAAC;AAuEtF,uGAAuG;AACvG,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,WAAW,CAAC,0EAA0E,CAAC,CAAC;IACpG,CAAC;IAED,MAAM,UAAU,GAAwC,2BAA2B,CAAC,KAAK,CAAC,CAAC;IAC3F,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,WAAW,CAAC,0EAA0E,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/internal/auth/x509-transport-state-browser.d.mts

@@ -18,4 +18,8 @@ export declare const isApprovedX509Client: (value: object) => boolean;
 export declare const rememberX509OAuthError: (key: object, value: any) => WeakMap<object, any>;
 /** Retrieves trusted metadata when public OAuth errors cross module formats. */
 export declare const findX509OAuthError: (key: object) => any;
+/** Privately binds SDK-owned credentials without importing Node or optional transport peers. */
+export declare const rememberX509Credential: (key: object, value: any) => WeakMap<object, any>;
+/** Resolves only credentials registered by the optional Node authentication helper. */
+export declare const findX509Credential: (key: object) => any;
 //# sourceMappingURL=x509-transport-state-browser.d.mts.map

package/internal/auth/x509-transport-state-browser.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"x509-transport-state-browser.d.mts","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-state-browser.ts"],"names":[],"mappings":"AAOA,0EAA0E;AAC1E,eAAO,MAAM,2BAA2B,sBAAuD,CAAC;AAEhG,8FAA8F;AAC9F,eAAO,MAAM,+BAA+B,mDAAuD,CAAC;AAEpG,uFAAuF;AACvF,eAAO,MAAM,gCAAgC,oCAA4D,CAAC;AAE1G,yFAAyF;AACzF,eAAO,MAAM,8BAA8B,4BAA4D,CAAC;AAExG,wFAAwF;AACxF,eAAO,MAAM,4BAA4B,oCAAwD,CAAC;AAElG,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B,4BAAwD,CAAC;AAEhG,gGAAgG;AAChG,eAAO,MAAM,sBAAsB,oCAAkD,CAAC;AAEtF,0EAA0E;AAC1E,eAAO,MAAM,oBAAoB,4BAAkD,CAAC;AAEpF,8EAA8E;AAC9E,eAAO,MAAM,sBAAsB,mDAAsD,CAAC;AAE1F,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,sBAAsD,CAAC"}
+{"version":3,"file":"x509-transport-state-browser.d.mts","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-state-browser.ts"],"names":[],"mappings":"AAQA,0EAA0E;AAC1E,eAAO,MAAM,2BAA2B,sBAAuD,CAAC;AAEhG,8FAA8F;AAC9F,eAAO,MAAM,+BAA+B,mDAAuD,CAAC;AAEpG,uFAAuF;AACvF,eAAO,MAAM,gCAAgC,oCAA4D,CAAC;AAE1G,yFAAyF;AACzF,eAAO,MAAM,8BAA8B,4BAA4D,CAAC;AAExG,wFAAwF;AACxF,eAAO,MAAM,4BAA4B,oCAAwD,CAAC;AAElG,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B,4BAAwD,CAAC;AAEhG,gGAAgG;AAChG,eAAO,MAAM,sBAAsB,oCAAkD,CAAC;AAEtF,0EAA0E;AAC1E,eAAO,MAAM,oBAAoB,4BAAkD,CAAC;AAEpF,8EAA8E;AAC9E,eAAO,MAAM,sBAAsB,mDAAsD,CAAC;AAE1F,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,sBAAsD,CAAC;AAEtF,gGAAgG;AAChG,eAAO,MAAM,sBAAsB,mDAAsD,CAAC;AAE1F,uFAAuF;AACvF,eAAO,MAAM,kBAAkB,sBAAsD,CAAC"}

package/internal/auth/x509-transport-state-browser.d.ts

@@ -18,4 +18,8 @@ export declare const isApprovedX509Client: (value: object) => boolean;
 export declare const rememberX509OAuthError: (key: object, value: any) => WeakMap<object, any>;
 /** Retrieves trusted metadata when public OAuth errors cross module formats. */
 export declare const findX509OAuthError: (key: object) => any;
+/** Privately binds SDK-owned credentials without importing Node or optional transport peers. */
+export declare const rememberX509Credential: (key: object, value: any) => WeakMap<object, any>;
+/** Resolves only credentials registered by the optional Node authentication helper. */
+export declare const findX509Credential: (key: object) => any;
 //# sourceMappingURL=x509-transport-state-browser.d.ts.map

package/internal/auth/x509-transport-state-browser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"x509-transport-state-browser.d.ts","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-state-browser.ts"],"names":[],"mappings":"AAOA,0EAA0E;AAC1E,eAAO,MAAM,2BAA2B,sBAAuD,CAAC;AAEhG,8FAA8F;AAC9F,eAAO,MAAM,+BAA+B,mDAAuD,CAAC;AAEpG,uFAAuF;AACvF,eAAO,MAAM,gCAAgC,oCAA4D,CAAC;AAE1G,yFAAyF;AACzF,eAAO,MAAM,8BAA8B,4BAA4D,CAAC;AAExG,wFAAwF;AACxF,eAAO,MAAM,4BAA4B,oCAAwD,CAAC;AAElG,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B,4BAAwD,CAAC;AAEhG,gGAAgG;AAChG,eAAO,MAAM,sBAAsB,oCAAkD,CAAC;AAEtF,0EAA0E;AAC1E,eAAO,MAAM,oBAAoB,4BAAkD,CAAC;AAEpF,8EAA8E;AAC9E,eAAO,MAAM,sBAAsB,mDAAsD,CAAC;AAE1F,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,sBAAsD,CAAC"}
+{"version":3,"file":"x509-transport-state-browser.d.ts","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-state-browser.ts"],"names":[],"mappings":"AAQA,0EAA0E;AAC1E,eAAO,MAAM,2BAA2B,sBAAuD,CAAC;AAEhG,8FAA8F;AAC9F,eAAO,MAAM,+BAA+B,mDAAuD,CAAC;AAEpG,uFAAuF;AACvF,eAAO,MAAM,gCAAgC,oCAA4D,CAAC;AAE1G,yFAAyF;AACzF,eAAO,MAAM,8BAA8B,4BAA4D,CAAC;AAExG,wFAAwF;AACxF,eAAO,MAAM,4BAA4B,oCAAwD,CAAC;AAElG,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B,4BAAwD,CAAC;AAEhG,gGAAgG;AAChG,eAAO,MAAM,sBAAsB,oCAAkD,CAAC;AAEtF,0EAA0E;AAC1E,eAAO,MAAM,oBAAoB,4BAAkD,CAAC;AAEpF,8EAA8E;AAC9E,eAAO,MAAM,sBAAsB,mDAAsD,CAAC;AAE1F,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,sBAAsD,CAAC;AAEtF,gGAAgG;AAChG,eAAO,MAAM,sBAAsB,mDAAsD,CAAC;AAE1F,uFAAuF;AACvF,eAAO,MAAM,kBAAkB,sBAAsD,CAAC"}