openai 7.7.0 → 7.9.0

package/internal/auth/x509-transport-state-browser.d.ts

@@ -18,4 +18,8 @@ export declare const isApprovedX509Client: (value: object) => boolean;
 export declare const rememberX509OAuthError: (key: object, value: any) => WeakMap<object, any>;
 /** Retrieves trusted metadata when public OAuth errors cross module formats. */
 export declare const findX509OAuthError: (key: object) => any;
+/** Privately binds SDK-owned credentials without importing Node or optional transport peers. */
+export declare const rememberX509Credential: (key: object, value: any) => WeakMap<object, any>;
+/** Resolves only credentials registered by the optional Node authentication helper. */
+export declare const findX509Credential: (key: object) => any;
 //# sourceMappingURL=x509-transport-state-browser.d.ts.map

package/internal/auth/x509-transport-state-browser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"x509-transport-state-browser.d.ts","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-state-browser.ts"],"names":[],"mappings":"AAOA,0EAA0E;AAC1E,eAAO,MAAM,2BAA2B,sBAAuD,CAAC;AAEhG,8FAA8F;AAC9F,eAAO,MAAM,+BAA+B,mDAAuD,CAAC;AAEpG,uFAAuF;AACvF,eAAO,MAAM,gCAAgC,oCAA4D,CAAC;AAE1G,yFAAyF;AACzF,eAAO,MAAM,8BAA8B,4BAA4D,CAAC;AAExG,wFAAwF;AACxF,eAAO,MAAM,4BAA4B,oCAAwD,CAAC;AAElG,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B,4BAAwD,CAAC;AAEhG,gGAAgG;AAChG,eAAO,MAAM,sBAAsB,oCAAkD,CAAC;AAEtF,0EAA0E;AAC1E,eAAO,MAAM,oBAAoB,4BAAkD,CAAC;AAEpF,8EAA8E;AAC9E,eAAO,MAAM,sBAAsB,mDAAsD,CAAC;AAE1F,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,sBAAsD,CAAC"}
+{"version":3,"file":"x509-transport-state-browser.d.ts","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-state-browser.ts"],"names":[],"mappings":"AAQA,0EAA0E;AAC1E,eAAO,MAAM,2BAA2B,sBAAuD,CAAC;AAEhG,8FAA8F;AAC9F,eAAO,MAAM,+BAA+B,mDAAuD,CAAC;AAEpG,uFAAuF;AACvF,eAAO,MAAM,gCAAgC,oCAA4D,CAAC;AAE1G,yFAAyF;AACzF,eAAO,MAAM,8BAA8B,4BAA4D,CAAC;AAExG,wFAAwF;AACxF,eAAO,MAAM,4BAA4B,oCAAwD,CAAC;AAElG,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B,4BAAwD,CAAC;AAEhG,gGAAgG;AAChG,eAAO,MAAM,sBAAsB,oCAAkD,CAAC;AAEtF,0EAA0E;AAC1E,eAAO,MAAM,oBAAoB,4BAAkD,CAAC;AAEpF,8EAA8E;AAC9E,eAAO,MAAM,sBAAsB,mDAAsD,CAAC;AAE1F,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,sBAAsD,CAAC;AAEtF,gGAAgG;AAChG,eAAO,MAAM,sBAAsB,mDAAsD,CAAC;AAE1F,uFAAuF;AACvF,eAAO,MAAM,kBAAkB,sBAAsD,CAAC"}

package/internal/auth/x509-transport-state-browser.js

@@ -1,12 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.findX509OAuthError = exports.rememberX509OAuthError = exports.isApprovedX509Client = exports.markApprovedX509Client = exports.isRetryableX509IssuerError = exports.markRetryableX509IssuerError = exports.isTransientX509ConnectionError = exports.markTransientX509ConnectionError = exports.rememberRegisteredX509Transport = exports.findRegisteredX509Transport = void 0;
+exports.findX509Credential = exports.rememberX509Credential = exports.findX509OAuthError = exports.rememberX509OAuthError = exports.isApprovedX509Client = exports.markApprovedX509Client = exports.isRetryableX509IssuerError = exports.markRetryableX509IssuerError = exports.isTransientX509ConnectionError = exports.markTransientX509ConnectionError = exports.rememberRegisteredX509Transport = exports.findRegisteredX509Transport = void 0;
 /** Browser-safe capability state keeps CommonJS outside the ordinary SDK ESM graph. */
 const registeredX509Transports = new WeakMap();
 const transientX509ConnectionErrors = new WeakSet();
 const retryableX509IssuerErrors = new WeakSet();
 const approvedX509Clients = new WeakSet();
 const approvedX509OAuthErrors = new WeakMap();
+const approvedX509Credentials = new WeakMap();
 /** Looks up an opaque capability without exposing the registry itself. */
 exports.findRegisteredX509Transport = WeakMap.prototype.get.bind(registeredX509Transports);
 /** Records a capability only after its Node-only factory validates the private dispatcher. */
@@ -27,4 +28,8 @@ exports.isApprovedX509Client = WeakSet.prototype.has.bind(approvedX509Clients);
 exports.rememberX509OAuthError = WeakMap.prototype.set.bind(approvedX509OAuthErrors);
 /** Retrieves trusted metadata when public OAuth errors cross module formats. */
 exports.findX509OAuthError = WeakMap.prototype.get.bind(approvedX509OAuthErrors);
+/** Privately binds SDK-owned credentials without importing Node or optional transport peers. */
+exports.rememberX509Credential = WeakMap.prototype.set.bind(approvedX509Credentials);
+/** Resolves only credentials registered by the optional Node authentication helper. */
+exports.findX509Credential = WeakMap.prototype.get.bind(approvedX509Credentials);
 //# sourceMappingURL=x509-transport-state-browser.js.map

package/internal/auth/x509-transport-state-browser.js.map

@@ -1 +1 @@
-{"version":3,"file":"x509-transport-state-browser.js","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-state-browser.ts"],"names":[],"mappings":";;;AAAA,uFAAuF;AACvF,MAAM,wBAAwB,GAAG,IAAI,OAAO,EAAE,CAAC;AAC/C,MAAM,6BAA6B,GAAG,IAAI,OAAO,EAAE,CAAC;AACpD,MAAM,yBAAyB,GAAG,IAAI,OAAO,EAAE,CAAC;AAChD,MAAM,mBAAmB,GAAG,IAAI,OAAO,EAAE,CAAC;AAC1C,MAAM,uBAAuB,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9C,0EAA0E;AAC7D,QAAA,2BAA2B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;AAEhG,8FAA8F;AACjF,QAAA,+BAA+B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;AAEpG,uFAAuF;AAC1E,QAAA,gCAAgC,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;AAE1G,yFAAyF;AAC5E,QAAA,8BAA8B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;AAExG,wFAAwF;AAC3E,QAAA,4BAA4B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;AAElG,0FAA0F;AAC7E,QAAA,0BAA0B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;AAEhG,gGAAgG;AACnF,QAAA,sBAAsB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;AAEtF,0EAA0E;AAC7D,QAAA,oBAAoB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;AAEpF,8EAA8E;AACjE,QAAA,sBAAsB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;AAE1F,gFAAgF;AACnE,QAAA,kBAAkB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC"}
+{"version":3,"file":"x509-transport-state-browser.js","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-state-browser.ts"],"names":[],"mappings":";;;AAAA,uFAAuF;AACvF,MAAM,wBAAwB,GAAG,IAAI,OAAO,EAAE,CAAC;AAC/C,MAAM,6BAA6B,GAAG,IAAI,OAAO,EAAE,CAAC;AACpD,MAAM,yBAAyB,GAAG,IAAI,OAAO,EAAE,CAAC;AAChD,MAAM,mBAAmB,GAAG,IAAI,OAAO,EAAE,CAAC;AAC1C,MAAM,uBAAuB,GAAG,IAAI,OAAO,EAAE,CAAC;AAC9C,MAAM,uBAAuB,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9C,0EAA0E;AAC7D,QAAA,2BAA2B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;AAEhG,8FAA8F;AACjF,QAAA,+BAA+B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;AAEpG,uFAAuF;AAC1E,QAAA,gCAAgC,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;AAE1G,yFAAyF;AAC5E,QAAA,8BAA8B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;AAExG,wFAAwF;AAC3E,QAAA,4BAA4B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;AAElG,0FAA0F;AAC7E,QAAA,0BAA0B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;AAEhG,gGAAgG;AACnF,QAAA,sBAAsB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;AAEtF,0EAA0E;AAC7D,QAAA,oBAAoB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;AAEpF,8EAA8E;AACjE,QAAA,sBAAsB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;AAE1F,gFAAgF;AACnE,QAAA,kBAAkB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;AAEtF,gGAAgG;AACnF,QAAA,sBAAsB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;AAE1F,uFAAuF;AAC1E,QAAA,kBAAkB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC"}

package/internal/auth/x509-transport-state-browser.mjs

@@ -4,6 +4,7 @@ const transientX509ConnectionErrors = new WeakSet();
 const retryableX509IssuerErrors = new WeakSet();
 const approvedX509Clients = new WeakSet();
 const approvedX509OAuthErrors = new WeakMap();
+const approvedX509Credentials = new WeakMap();
 /** Looks up an opaque capability without exposing the registry itself. */
 export const findRegisteredX509Transport = WeakMap.prototype.get.bind(registeredX509Transports);
 /** Records a capability only after its Node-only factory validates the private dispatcher. */
@@ -24,4 +25,8 @@ export const isApprovedX509Client = WeakSet.prototype.has.bind(approvedX509Clien
 export const rememberX509OAuthError = WeakMap.prototype.set.bind(approvedX509OAuthErrors);
 /** Retrieves trusted metadata when public OAuth errors cross module formats. */
 export const findX509OAuthError = WeakMap.prototype.get.bind(approvedX509OAuthErrors);
+/** Privately binds SDK-owned credentials without importing Node or optional transport peers. */
+export const rememberX509Credential = WeakMap.prototype.set.bind(approvedX509Credentials);
+/** Resolves only credentials registered by the optional Node authentication helper. */
+export const findX509Credential = WeakMap.prototype.get.bind(approvedX509Credentials);
 //# sourceMappingURL=x509-transport-state-browser.mjs.map

package/internal/auth/x509-transport-state-browser.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"x509-transport-state-browser.mjs","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-state-browser.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,MAAM,wBAAwB,GAAG,IAAI,OAAO,EAAE,CAAC;AAC/C,MAAM,6BAA6B,GAAG,IAAI,OAAO,EAAE,CAAC;AACpD,MAAM,yBAAyB,GAAG,IAAI,OAAO,EAAE,CAAC;AAChD,MAAM,mBAAmB,GAAG,IAAI,OAAO,EAAE,CAAC;AAC1C,MAAM,uBAAuB,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9C,0EAA0E;AAC1E,MAAM,CAAC,MAAM,2BAA2B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;AAEhG,8FAA8F;AAC9F,MAAM,CAAC,MAAM,+BAA+B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;AAEpG,uFAAuF;AACvF,MAAM,CAAC,MAAM,gCAAgC,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;AAE1G,yFAAyF;AACzF,MAAM,CAAC,MAAM,8BAA8B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;AAExG,wFAAwF;AACxF,MAAM,CAAC,MAAM,4BAA4B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;AAElG,0FAA0F;AAC1F,MAAM,CAAC,MAAM,0BAA0B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;AAEhG,gGAAgG;AAChG,MAAM,CAAC,MAAM,sBAAsB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;AAEtF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,oBAAoB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;AAEpF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,sBAAsB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;AAE1F,gFAAgF;AAChF,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC"}
+{"version":3,"file":"x509-transport-state-browser.mjs","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-state-browser.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,MAAM,wBAAwB,GAAG,IAAI,OAAO,EAAE,CAAC;AAC/C,MAAM,6BAA6B,GAAG,IAAI,OAAO,EAAE,CAAC;AACpD,MAAM,yBAAyB,GAAG,IAAI,OAAO,EAAE,CAAC;AAChD,MAAM,mBAAmB,GAAG,IAAI,OAAO,EAAE,CAAC;AAC1C,MAAM,uBAAuB,GAAG,IAAI,OAAO,EAAE,CAAC;AAC9C,MAAM,uBAAuB,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9C,0EAA0E;AAC1E,MAAM,CAAC,MAAM,2BAA2B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;AAEhG,8FAA8F;AAC9F,MAAM,CAAC,MAAM,+BAA+B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;AAEpG,uFAAuF;AACvF,MAAM,CAAC,MAAM,gCAAgC,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;AAE1G,yFAAyF;AACzF,MAAM,CAAC,MAAM,8BAA8B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;AAExG,wFAAwF;AACxF,MAAM,CAAC,MAAM,4BAA4B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;AAElG,0FAA0F;AAC1F,MAAM,CAAC,MAAM,0BAA0B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;AAEhG,gGAAgG;AAChG,MAAM,CAAC,MAAM,sBAAsB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;AAEtF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,oBAAoB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;AAEpF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,sBAAsB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;AAE1F,gFAAgF;AAChF,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;AAEtF,gGAAgG;AAChG,MAAM,CAAC,MAAM,sBAAsB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;AAE1F,uFAAuF;AACvF,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC"}

package/internal/auth/x509-transport-state.cjs

@@ -1,12 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.findX509OAuthError = exports.rememberX509OAuthError = exports.isApprovedX509Client = exports.markApprovedX509Client = exports.isRetryableX509IssuerError = exports.markRetryableX509IssuerError = exports.isTransientX509ConnectionError = exports.markTransientX509ConnectionError = exports.rememberRegisteredX509Transport = exports.findRegisteredX509Transport = void 0;
+exports.findX509Credential = exports.rememberX509Credential = exports.findX509OAuthError = exports.rememberX509OAuthError = exports.isApprovedX509Client = exports.markApprovedX509Client = exports.isRetryableX509IssuerError = exports.markRetryableX509IssuerError = exports.isTransientX509ConnectionError = exports.markTransientX509ConnectionError = exports.rememberRegisteredX509Transport = exports.findRegisteredX509Transport = void 0;
 /** One lexical capability registry remains authoritative across mixed module formats. */
 const registeredX509Transports = new WeakMap();
 const transientX509ConnectionErrors = new WeakSet();
 const retryableX509IssuerErrors = new WeakSet();
 const approvedX509Clients = new WeakSet();
 const approvedX509OAuthErrors = new WeakMap();
+const approvedX509Credentials = new WeakMap();
 /** Looks up an opaque capability without exposing the registry itself. */
 exports.findRegisteredX509Transport = WeakMap.prototype.get.bind(registeredX509Transports);
 /** Records a capability only after the Node-only factory verifies its genuine private dispatcher. */
@@ -27,4 +28,8 @@ exports.isApprovedX509Client = WeakSet.prototype.has.bind(approvedX509Clients);
 exports.rememberX509OAuthError = WeakMap.prototype.set.bind(approvedX509OAuthErrors);
 /** Retrieves trusted OAuth metadata for public cross-module error normalization. */
 exports.findX509OAuthError = WeakMap.prototype.get.bind(approvedX509OAuthErrors);
+/** Privately binds SDK-owned credentials to their immutable identity and approved transport. */
+exports.rememberX509Credential = WeakMap.prototype.set.bind(approvedX509Credentials);
+/** Resolves only first-class credentials created by the optional Node transport helper. */
+exports.findX509Credential = WeakMap.prototype.get.bind(approvedX509Credentials);
 //# sourceMappingURL=x509-transport-state.cjs.map

package/internal/auth/x509-transport-state.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"x509-transport-state.cjs","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-state.cts"],"names":[],"mappings":";;;AAAA,yFAAyF;AACzF,MAAM,wBAAwB,GAAG,IAAI,OAAO,EAAE,CAAC;AAC/C,MAAM,6BAA6B,GAAG,IAAI,OAAO,EAAE,CAAC;AACpD,MAAM,yBAAyB,GAAG,IAAI,OAAO,EAAE,CAAC;AAChD,MAAM,mBAAmB,GAAG,IAAI,OAAO,EAAE,CAAC;AAC1C,MAAM,uBAAuB,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9C,0EAA0E;AAC7D,QAAA,2BAA2B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;AAEhG,qGAAqG;AACxF,QAAA,+BAA+B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;AAEpG,2FAA2F;AAC9E,QAAA,gCAAgC,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;AAE1G,kFAAkF;AACrE,QAAA,8BAA8B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;AAExG,uFAAuF;AAC1E,QAAA,4BAA4B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;AAElG,0FAA0F;AAC7E,QAAA,0BAA0B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;AAEhG,iFAAiF;AACpE,QAAA,sBAAsB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;AAEtF,mFAAmF;AACtE,QAAA,oBAAoB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;AAEpF,6FAA6F;AAChF,QAAA,sBAAsB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;AAE1F,oFAAoF;AACvE,QAAA,kBAAkB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC"}
+{"version":3,"file":"x509-transport-state.cjs","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-state.cts"],"names":[],"mappings":";;;AAAA,yFAAyF;AACzF,MAAM,wBAAwB,GAAG,IAAI,OAAO,EAAE,CAAC;AAC/C,MAAM,6BAA6B,GAAG,IAAI,OAAO,EAAE,CAAC;AACpD,MAAM,yBAAyB,GAAG,IAAI,OAAO,EAAE,CAAC;AAChD,MAAM,mBAAmB,GAAG,IAAI,OAAO,EAAE,CAAC;AAC1C,MAAM,uBAAuB,GAAG,IAAI,OAAO,EAAE,CAAC;AAC9C,MAAM,uBAAuB,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9C,0EAA0E;AAC7D,QAAA,2BAA2B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;AAEhG,qGAAqG;AACxF,QAAA,+BAA+B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;AAEpG,2FAA2F;AAC9E,QAAA,gCAAgC,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;AAE1G,kFAAkF;AACrE,QAAA,8BAA8B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;AAExG,uFAAuF;AAC1E,QAAA,4BAA4B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;AAElG,0FAA0F;AAC7E,QAAA,0BAA0B,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;AAEhG,iFAAiF;AACpE,QAAA,sBAAsB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;AAEtF,mFAAmF;AACtE,QAAA,oBAAoB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;AAEpF,6FAA6F;AAChF,QAAA,sBAAsB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;AAE1F,oFAAoF;AACvE,QAAA,kBAAkB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;AAEtF,gGAAgG;AACnF,QAAA,sBAAsB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;AAE1F,2FAA2F;AAC9E,QAAA,kBAAkB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC"}

package/internal/auth/x509-transport-state.d.cts

@@ -18,4 +18,8 @@ export declare const isApprovedX509Client: (value: object) => boolean;
 export declare const rememberX509OAuthError: (key: object, value: any) => WeakMap<object, any>;
 /** Retrieves trusted OAuth metadata for public cross-module error normalization. */
 export declare const findX509OAuthError: (key: object) => any;
+/** Privately binds SDK-owned credentials to their immutable identity and approved transport. */
+export declare const rememberX509Credential: (key: object, value: any) => WeakMap<object, any>;
+/** Resolves only first-class credentials created by the optional Node transport helper. */
+export declare const findX509Credential: (key: object) => any;
 //# sourceMappingURL=x509-transport-state.d.cts.map

package/internal/auth/x509-transport-state.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"x509-transport-state.d.cts","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-state.cts"],"names":[],"mappings":"AAOA,0EAA0E;AAC1E,eAAO,MAAM,2BAA2B,sBAAuD,CAAC;AAEhG,qGAAqG;AACrG,eAAO,MAAM,+BAA+B,mDAAuD,CAAC;AAEpG,2FAA2F;AAC3F,eAAO,MAAM,gCAAgC,oCAA4D,CAAC;AAE1G,kFAAkF;AAClF,eAAO,MAAM,8BAA8B,4BAA4D,CAAC;AAExG,uFAAuF;AACvF,eAAO,MAAM,4BAA4B,oCAAwD,CAAC;AAElG,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B,4BAAwD,CAAC;AAEhG,iFAAiF;AACjF,eAAO,MAAM,sBAAsB,oCAAkD,CAAC;AAEtF,mFAAmF;AACnF,eAAO,MAAM,oBAAoB,4BAAkD,CAAC;AAEpF,6FAA6F;AAC7F,eAAO,MAAM,sBAAsB,mDAAsD,CAAC;AAE1F,oFAAoF;AACpF,eAAO,MAAM,kBAAkB,sBAAsD,CAAC"}
+{"version":3,"file":"x509-transport-state.d.cts","sourceRoot":"","sources":["../../src/internal/auth/x509-transport-state.cts"],"names":[],"mappings":"AAQA,0EAA0E;AAC1E,eAAO,MAAM,2BAA2B,sBAAuD,CAAC;AAEhG,qGAAqG;AACrG,eAAO,MAAM,+BAA+B,mDAAuD,CAAC;AAEpG,2FAA2F;AAC3F,eAAO,MAAM,gCAAgC,oCAA4D,CAAC;AAE1G,kFAAkF;AAClF,eAAO,MAAM,8BAA8B,4BAA4D,CAAC;AAExG,uFAAuF;AACvF,eAAO,MAAM,4BAA4B,oCAAwD,CAAC;AAElG,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B,4BAAwD,CAAC;AAEhG,iFAAiF;AACjF,eAAO,MAAM,sBAAsB,oCAAkD,CAAC;AAEtF,mFAAmF;AACnF,eAAO,MAAM,oBAAoB,4BAAkD,CAAC;AAEpF,6FAA6F;AAC7F,eAAO,MAAM,sBAAsB,mDAAsD,CAAC;AAE1F,oFAAoF;AACpF,eAAO,MAAM,kBAAkB,sBAAsD,CAAC;AAEtF,gGAAgG;AAChG,eAAO,MAAM,sBAAsB,mDAAsD,CAAC;AAE1F,2FAA2F;AAC3F,eAAO,MAAM,kBAAkB,sBAAsD,CAAC"}

package/internal/auth/x509-transport-state.js

@@ -0,0 +1,36 @@
+"use strict"; if (typeof module !== 'undefined' && module !== globalThis.module && typeof exports !== 'undefined' && module.exports === exports) {
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findX509Credential = exports.rememberX509Credential = exports.findX509OAuthError = exports.rememberX509OAuthError = exports.isApprovedX509Client = exports.markApprovedX509Client = exports.isRetryableX509IssuerError = exports.markRetryableX509IssuerError = exports.isTransientX509ConnectionError = exports.markTransientX509ConnectionError = exports.rememberRegisteredX509Transport = exports.findRegisteredX509Transport = void 0;
+/** One lexical capability registry remains authoritative across mixed module formats. */
+const registeredX509Transports = new WeakMap();
+const transientX509ConnectionErrors = new WeakSet();
+const retryableX509IssuerErrors = new WeakSet();
+const approvedX509Clients = new WeakSet();
+const approvedX509OAuthErrors = new WeakMap();
+const approvedX509Credentials = new WeakMap();
+/** Looks up an opaque capability without exposing the registry itself. */
+exports.findRegisteredX509Transport = WeakMap.prototype.get.bind(registeredX509Transports);
+/** Records a capability only after the Node-only factory verifies its genuine private dispatcher. */
+exports.rememberRegisteredX509Transport = WeakMap.prototype.set.bind(registeredX509Transports);
+/** Privately brands sanitized connection errors shared across CommonJS and ESM clients. */
+exports.markTransientX509ConnectionError = WeakSet.prototype.add.bind(transientX509ConnectionErrors);
+/** Recognizes a transient connection without trusting public error properties. */
+exports.isTransientX509ConnectionError = WeakSet.prototype.has.bind(transientX509ConnectionErrors);
+/** Privately brands issuer-generated retryable HTTP failures across module formats. */
+exports.markRetryableX509IssuerError = WeakSet.prototype.add.bind(retryableX509IssuerErrors);
+/** Recognizes only retryable HTTP errors produced by the trusted certificate exchange. */
+exports.isRetryableX509IssuerError = WeakSet.prototype.has.bind(retryableX509IssuerErrors);
+/** Brands only clients whose transport capability was successfully validated. */
+exports.markApprovedX509Client = WeakSet.prototype.add.bind(approvedX509Clients);
+/** Recognizes immutable client ownership across mixed CommonJS and ESM helpers. */
+exports.isApprovedX509Client = WeakSet.prototype.has.bind(approvedX509Clients);
+/** Records the sanitized OAuth response without trusting mutable public error properties. */
+exports.rememberX509OAuthError = WeakMap.prototype.set.bind(approvedX509OAuthErrors);
+/** Retrieves trusted OAuth metadata for public cross-module error normalization. */
+exports.findX509OAuthError = WeakMap.prototype.get.bind(approvedX509OAuthErrors);
+/** Privately binds SDK-owned credentials to their immutable identity and approved transport. */
+exports.rememberX509Credential = WeakMap.prototype.set.bind(approvedX509Credentials);
+/** Resolves only first-class credentials created by the optional Node transport helper. */
+exports.findX509Credential = WeakMap.prototype.get.bind(approvedX509Credentials);
+}
+//# sourceMappingURL=x509-transport-state.cjs.map

package/internal/auth/x509-transport-state.mjs

@@ -0,0 +1,19 @@
+import * as browserState from './x509-transport-state-browser.mjs';
+import * as nodeState from './x509-transport-state.js';
+
+const state = typeof nodeState.findRegisteredX509Transport === 'function' ? nodeState : browserState;
+
+export const {
+  findRegisteredX509Transport,
+  rememberRegisteredX509Transport,
+  markTransientX509ConnectionError,
+  isTransientX509ConnectionError,
+  markRetryableX509IssuerError,
+  isRetryableX509IssuerError,
+  markApprovedX509Client,
+  isApprovedX509Client,
+  rememberX509OAuthError,
+  findX509OAuthError,
+  rememberX509Credential,
+  findX509Credential,
+} = state;

package/internal/auth/x509-workload-identity-auth.d.mts

@@ -4,8 +4,6 @@ import type { HeadersLike, NullableHeaders } from "../headers.mjs";
 import type { FinalRequestOptions } from "../request-options.mjs";
 import type { MergedRequestInit } from "../types.mjs";
 import type { X509Transport } from "./x509-transport-registry.mjs";
-/** Sole API authority approved for OpenAI X.509 workload-identity federation. */
-export declare const X509_API_BASE_URL = "https://mtls.api.openai.com/v1";
 interface X509TokenRequestContext {
     apiURL: string;
     defaultHeaders: HeadersLike | undefined;
@@ -20,8 +18,6 @@ interface X509TokenRequestContext {
 export declare function isX509WorkloadIdentity(identity: WorkloadIdentity | X509WorkloadIdentity | undefined): identity is X509WorkloadIdentity;
 /** Rejects unsupported WebSocket authentication before any connection or credential side effect. */
 export declare function assertX509WebSocketSupported(client: unknown): void;
-/** Rejects every destination outside the sole enrolled, global X.509 API authority. */
-export declare function assertX509APIOrigin(value: string | URL): URL;
 /** Prevents caller options from replacing the immutable transport selected at construction. */
 export declare function assertX509FetchOptions(options: MergedRequestInit | RequestInit | undefined): void;
 /** Rejects caller overrides while allowing the SDK-owned fields on the final RequestInit. */
@@ -69,6 +65,8 @@ export declare class X509WorkloadIdentityAuth {
         timeout: number;
         fetchOptions: MergedRequestInit;
     };
+    /** Suspends an already-running network budget during retry-local asynchronous preparation. */
+    beginRequestPreparation(): void;
     /** Begins local request construction without charging protected hook latency to the network. */
     beginRequestPlanning(): void;
     /** Arms one absolute network deadline only after all local request preparation completes. */

package/internal/auth/x509-workload-identity-auth.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"x509-workload-identity-auth.d.mts","sourceRoot":"","sources":["../../src/internal/auth/x509-workload-identity-auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,6BAAyB;AAC/E,OAAO,KAAK,EAAE,KAAK,EAAE,6BAAyB;AAE9C,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,uBAAmB;AAC/D,OAAO,KAAK,EAAE,mBAAmB,EAAE,+BAA2B;AAE9D,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAiB;AASlD,OAAO,KAAK,EAIV,aAAa,EACd,sCAAkC;AAEnC,iFAAiF;AACjF,eAAO,MAAM,iBAAiB,mCAAmC,CAAC;AA8ElE,UAAU,uBAAuB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,WAAW,GAAG,SAAS,CAAC;IACxC,cAAc,EAAE,WAAW,CAAC;IAC5B,MAAM,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,CAAC;IACvC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,iBAAiB,CAAC;CACjC;AA0BD,iGAAiG;AACjG,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,gBAAgB,GAAG,oBAAoB,GAAG,SAAS,GAC5D,QAAQ,IAAI,oBAAoB,CA6BlC;AAED,oGAAoG;AACpG,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAQlE;AAED,uFAAuF;AACvF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,GAAG,CAY5D;AAED,+FAA+F;AAC/F,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,iBAAiB,GAAG,WAAW,GAAG,SAAS,GAAG,IAAI,CAcjG;AAED,6FAA6F;AAC7F,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,iBAAiB,GAAG,WAAW,GAAG,SAAS,GAAG,IAAI,CAOnG;AAED,+FAA+F;AAC/F,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,iBAAiB,GAAG,SAAS,GAAG,iBAAiB,CAKpG;AAED,2GAA2G;AAC3G,qBAAa,wBAAwB;;IAYnC,0FAA0F;gBAExF,QAAQ,EAAE,oBAAoB,EAC9B,SAAS,EAAE,aAAa,GAAG,SAAS,EACpC,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,OAAO,EAAE,MAAM,GAAG,IAAI;IAiBxB,2FAA2F;IAC3F,gBAAgB,IAAI,oBAAoB;IAWxC,+FAA+F;IAC/F,MAAM,CAAC,kBAAkB,CACvB,OAAO,EAAE,mBAAmB,EAC5B,cAAc,EAAE,WAAW,GAAG,SAAS,EACvC,cAAc,GAAE,WAA6B,GAC5C,OAAO;IAIV,2FAA2F;IAC3F,eAAe,CACb,cAAc,EAAE,WAAW,EAC3B,cAAc,EAAE,WAAW,GAC1B;QAAE,cAAc,EAAE,eAAe,CAAC;QAAC,cAAc,EAAE,eAAe,CAAA;KAAE;IAOvE,yFAAyF;IACzF,eAAe,IAAI;QAAE,cAAc,EAAE,eAAe,CAAC;QAAC,cAAc,EAAE,eAAe,CAAA;KAAE;IAQvF,sFAAsF;IACtF,cAAc,CACZ,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,OAAO,EAAE,MAAM,GAAG,IAAI,GACrB;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;IAS1D,8EAA8E;IAC9E,cAAc,IAAI;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;IAQzE,wFAAwF;IACxF,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAKnC,+FAA+F;IAC/F,aAAa,IAAI,MAAM;IAQvB,8EAA8E;IAC9E,eAAe,CACb,MAAM,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,EACtC,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,iBAAiB,GAC9B,IAAI;IAIP,wFAAwF;IACxF,eAAe,IAAI;QACjB,MAAM,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,CAAC;QACvC,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,EAAE,iBAAiB,CAAC;KACjC;IAQD,gGAAgG;IAChG,oBAAoB,IAAI,IAAI;IAI5B,6FAA6F;IAC7F,mBAAmB,IAAI,IAAI;IAS3B,iFAAiF;IACjF,iBAAiB,IAAI,OAAO;IAI5B,uFAAuF;IACvF,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,UAAQ,GAAG,IAAI;IAkC1G,iGAAiG;IACjG,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,IAAI;IAMpD,uFAAuF;IACvF,MAAM,CAAC,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO;IAUrD,kGAAkG;IAClG,iBAAiB,IAAI,IAAI;IAiBzB,4FAA4F;IAC5F,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI;IASvC,yFAAyF;IACzF,kBAAkB,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,IAAI;IAQzD,2FAA2F;IAC3F,eAAe,IAAI,WAAW,GAAG,IAAI,GAAG,SAAS;IAKjD,2FAA2F;IAC3F,UAAU,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAmB5E,qGAAqG;IACrG,SAAS,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAKxC,gGAAgG;IAChG,OAAO,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO;IAWjD,kGAAkG;IAClG,YAAY,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC;IAwB9D,iGAAiG;IACjG,yBAAyB,IAAI,IAAI;IAiBjC,qGAAqG;IACrG,gBAAgB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,MAAM,GAAG,SAAS;IAInE,+FAA+F;IAC/F,iBAAiB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO;IAIzD,iGAAiG;IACjG,gBAAgB,CAAC,QAAQ,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM;IAYxE,2FAA2F;IACrF,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAWhF,6FAA6F;IAC7F,MAAM,CAAC,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;IAQlD,uFAAuF;IACvF,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS;IAQxD,yFAAyF;IACnF,QAAQ,CAAC,OAAO,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,MAAM,CAAC;IA0NjG,+FAA+F;IAC/F,eAAe,IAAI,IAAI;IAwBvB,8FAA8F;IAC9F,WAAW,CAAC,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAqBjG,sGAAsG;IACtG,mBAAmB,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI;IAe/C,8FAA8F;IAC9F,aAAa,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI;IAoCzC,uGAAuG;IACvG,KAAK,IAAI,KAAK;CAoBf"}
+{"version":3,"file":"x509-workload-identity-auth.d.mts","sourceRoot":"","sources":["../../src/internal/auth/x509-workload-identity-auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,6BAAyB;AAC/E,OAAO,KAAK,EAAE,KAAK,EAAE,6BAAyB;AAE9C,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,uBAAmB;AAC/D,OAAO,KAAK,EAAE,mBAAmB,EAAE,+BAA2B;AAE9D,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAiB;AAWlD,OAAO,KAAK,EAIV,aAAa,EACd,sCAAkC;AAwEnC,UAAU,uBAAuB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,WAAW,GAAG,SAAS,CAAC;IACxC,cAAc,EAAE,WAAW,CAAC;IAC5B,MAAM,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,CAAC;IACvC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,iBAAiB,CAAC;CACjC;AA0BD,iGAAiG;AACjG,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,gBAAgB,GAAG,oBAAoB,GAAG,SAAS,GAC5D,QAAQ,IAAI,oBAAoB,CA6BlC;AAED,oGAAoG;AACpG,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAQlE;AAED,+FAA+F;AAC/F,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,iBAAiB,GAAG,WAAW,GAAG,SAAS,GAAG,IAAI,CAcjG;AAED,6FAA6F;AAC7F,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,iBAAiB,GAAG,WAAW,GAAG,SAAS,GAAG,IAAI,CAOnG;AAED,+FAA+F;AAC/F,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,iBAAiB,GAAG,SAAS,GAAG,iBAAiB,CAKpG;AAED,2GAA2G;AAC3G,qBAAa,wBAAwB;;IAanC,0FAA0F;gBAExF,QAAQ,EAAE,oBAAoB,EAC9B,SAAS,EAAE,aAAa,GAAG,SAAS,EACpC,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,OAAO,EAAE,MAAM,GAAG,IAAI;IAkCxB,2FAA2F;IAC3F,gBAAgB,IAAI,oBAAoB;IAcxC,+FAA+F;IAC/F,MAAM,CAAC,kBAAkB,CACvB,OAAO,EAAE,mBAAmB,EAC5B,cAAc,EAAE,WAAW,GAAG,SAAS,EACvC,cAAc,GAAE,WAA6B,GAC5C,OAAO;IAIV,2FAA2F;IAC3F,eAAe,CACb,cAAc,EAAE,WAAW,EAC3B,cAAc,EAAE,WAAW,GAC1B;QAAE,cAAc,EAAE,eAAe,CAAC;QAAC,cAAc,EAAE,eAAe,CAAA;KAAE;IAOvE,yFAAyF;IACzF,eAAe,IAAI;QAAE,cAAc,EAAE,eAAe,CAAC;QAAC,cAAc,EAAE,eAAe,CAAA;KAAE;IAQvF,sFAAsF;IACtF,cAAc,CACZ,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,OAAO,EAAE,MAAM,GAAG,IAAI,GACrB;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;IAS1D,8EAA8E;IAC9E,cAAc,IAAI;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;IAQzE,wFAAwF;IACxF,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAKnC,+FAA+F;IAC/F,aAAa,IAAI,MAAM;IAQvB,8EAA8E;IAC9E,eAAe,CACb,MAAM,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,EACtC,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,iBAAiB,GAC9B,IAAI;IAIP,wFAAwF;IACxF,eAAe,IAAI;QACjB,MAAM,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,CAAC;QACvC,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,EAAE,iBAAiB,CAAC;KACjC;IAQD,8FAA8F;IAC9F,uBAAuB,IAAI,IAAI;IAQ/B,gGAAgG;IAChG,oBAAoB,IAAI,IAAI;IAI5B,6FAA6F;IAC7F,mBAAmB,IAAI,IAAI;IAc3B,iFAAiF;IACjF,iBAAiB,IAAI,OAAO;IAI5B,uFAAuF;IACvF,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,UAAQ,GAAG,IAAI;IAkC1G,iGAAiG;IACjG,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,IAAI;IAMpD,uFAAuF;IACvF,MAAM,CAAC,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO;IAUrD,kGAAkG;IAClG,iBAAiB,IAAI,IAAI;IAiBzB,4FAA4F;IAC5F,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI;IASvC,yFAAyF;IACzF,kBAAkB,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,IAAI;IAQzD,2FAA2F;IAC3F,eAAe,IAAI,WAAW,GAAG,IAAI,GAAG,SAAS;IAKjD,2FAA2F;IAC3F,UAAU,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAmB5E,qGAAqG;IACrG,SAAS,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAKxC,gGAAgG;IAChG,OAAO,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO;IAWjD,kGAAkG;IAClG,YAAY,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC;IAwB9D,iGAAiG;IACjG,yBAAyB,IAAI,IAAI;IAmBjC,qGAAqG;IACrG,gBAAgB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,MAAM,GAAG,SAAS;IAInE,+FAA+F;IAC/F,iBAAiB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO;IAIzD,iGAAiG;IACjG,gBAAgB,CAAC,QAAQ,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM;IAYxE,2FAA2F;IACrF,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAWhF,6FAA6F;IAC7F,MAAM,CAAC,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;IAQlD,uFAAuF;IACvF,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS;IAQxD,yFAAyF;IACnF,QAAQ,CAAC,OAAO,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,MAAM,CAAC;IAoNjG,+FAA+F;IAC/F,eAAe,IAAI,IAAI;IAwBvB,8FAA8F;IAC9F,WAAW,CAAC,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAqBjG,sGAAsG;IACtG,mBAAmB,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI;IAe/C,8FAA8F;IAC9F,aAAa,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI;IAoCzC,uGAAuG;IACvG,KAAK,IAAI,KAAK;CAoBf"}

package/internal/auth/x509-workload-identity-auth.d.ts

@@ -4,8 +4,6 @@ import type { HeadersLike, NullableHeaders } from "../headers.js";
 import type { FinalRequestOptions } from "../request-options.js";
 import type { MergedRequestInit } from "../types.js";
 import type { X509Transport } from "./x509-transport-registry.js";
-/** Sole API authority approved for OpenAI X.509 workload-identity federation. */
-export declare const X509_API_BASE_URL = "https://mtls.api.openai.com/v1";
 interface X509TokenRequestContext {
     apiURL: string;
     defaultHeaders: HeadersLike | undefined;
@@ -20,8 +18,6 @@ interface X509TokenRequestContext {
 export declare function isX509WorkloadIdentity(identity: WorkloadIdentity | X509WorkloadIdentity | undefined): identity is X509WorkloadIdentity;
 /** Rejects unsupported WebSocket authentication before any connection or credential side effect. */
 export declare function assertX509WebSocketSupported(client: unknown): void;
-/** Rejects every destination outside the sole enrolled, global X.509 API authority. */
-export declare function assertX509APIOrigin(value: string | URL): URL;
 /** Prevents caller options from replacing the immutable transport selected at construction. */
 export declare function assertX509FetchOptions(options: MergedRequestInit | RequestInit | undefined): void;
 /** Rejects caller overrides while allowing the SDK-owned fields on the final RequestInit. */
@@ -69,6 +65,8 @@ export declare class X509WorkloadIdentityAuth {
         timeout: number;
         fetchOptions: MergedRequestInit;
     };
+    /** Suspends an already-running network budget during retry-local asynchronous preparation. */
+    beginRequestPreparation(): void;
     /** Begins local request construction without charging protected hook latency to the network. */
     beginRequestPlanning(): void;
     /** Arms one absolute network deadline only after all local request preparation completes. */

package/internal/auth/x509-workload-identity-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"x509-workload-identity-auth.d.ts","sourceRoot":"","sources":["../../src/internal/auth/x509-workload-identity-auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,4BAAyB;AAC/E,OAAO,KAAK,EAAE,KAAK,EAAE,4BAAyB;AAE9C,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,sBAAmB;AAC/D,OAAO,KAAK,EAAE,mBAAmB,EAAE,8BAA2B;AAE9D,OAAO,KAAK,EAAE,iBAAiB,EAAE,oBAAiB;AASlD,OAAO,KAAK,EAIV,aAAa,EACd,qCAAkC;AAEnC,iFAAiF;AACjF,eAAO,MAAM,iBAAiB,mCAAmC,CAAC;AA8ElE,UAAU,uBAAuB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,WAAW,GAAG,SAAS,CAAC;IACxC,cAAc,EAAE,WAAW,CAAC;IAC5B,MAAM,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,CAAC;IACvC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,iBAAiB,CAAC;CACjC;AA0BD,iGAAiG;AACjG,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,gBAAgB,GAAG,oBAAoB,GAAG,SAAS,GAC5D,QAAQ,IAAI,oBAAoB,CA6BlC;AAED,oGAAoG;AACpG,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAQlE;AAED,uFAAuF;AACvF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,GAAG,CAY5D;AAED,+FAA+F;AAC/F,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,iBAAiB,GAAG,WAAW,GAAG,SAAS,GAAG,IAAI,CAcjG;AAED,6FAA6F;AAC7F,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,iBAAiB,GAAG,WAAW,GAAG,SAAS,GAAG,IAAI,CAOnG;AAED,+FAA+F;AAC/F,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,iBAAiB,GAAG,SAAS,GAAG,iBAAiB,CAKpG;AAED,2GAA2G;AAC3G,qBAAa,wBAAwB;;IAYnC,0FAA0F;gBAExF,QAAQ,EAAE,oBAAoB,EAC9B,SAAS,EAAE,aAAa,GAAG,SAAS,EACpC,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,OAAO,EAAE,MAAM,GAAG,IAAI;IAiBxB,2FAA2F;IAC3F,gBAAgB,IAAI,oBAAoB;IAWxC,+FAA+F;IAC/F,MAAM,CAAC,kBAAkB,CACvB,OAAO,EAAE,mBAAmB,EAC5B,cAAc,EAAE,WAAW,GAAG,SAAS,EACvC,cAAc,GAAE,WAA6B,GAC5C,OAAO;IAIV,2FAA2F;IAC3F,eAAe,CACb,cAAc,EAAE,WAAW,EAC3B,cAAc,EAAE,WAAW,GAC1B;QAAE,cAAc,EAAE,eAAe,CAAC;QAAC,cAAc,EAAE,eAAe,CAAA;KAAE;IAOvE,yFAAyF;IACzF,eAAe,IAAI;QAAE,cAAc,EAAE,eAAe,CAAC;QAAC,cAAc,EAAE,eAAe,CAAA;KAAE;IAQvF,sFAAsF;IACtF,cAAc,CACZ,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,OAAO,EAAE,MAAM,GAAG,IAAI,GACrB;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;IAS1D,8EAA8E;IAC9E,cAAc,IAAI;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;IAQzE,wFAAwF;IACxF,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAKnC,+FAA+F;IAC/F,aAAa,IAAI,MAAM;IAQvB,8EAA8E;IAC9E,eAAe,CACb,MAAM,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,EACtC,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,iBAAiB,GAC9B,IAAI;IAIP,wFAAwF;IACxF,eAAe,IAAI;QACjB,MAAM,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,CAAC;QACvC,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,EAAE,iBAAiB,CAAC;KACjC;IAQD,gGAAgG;IAChG,oBAAoB,IAAI,IAAI;IAI5B,6FAA6F;IAC7F,mBAAmB,IAAI,IAAI;IAS3B,iFAAiF;IACjF,iBAAiB,IAAI,OAAO;IAI5B,uFAAuF;IACvF,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,UAAQ,GAAG,IAAI;IAkC1G,iGAAiG;IACjG,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,IAAI;IAMpD,uFAAuF;IACvF,MAAM,CAAC,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO;IAUrD,kGAAkG;IAClG,iBAAiB,IAAI,IAAI;IAiBzB,4FAA4F;IAC5F,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI;IASvC,yFAAyF;IACzF,kBAAkB,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,IAAI;IAQzD,2FAA2F;IAC3F,eAAe,IAAI,WAAW,GAAG,IAAI,GAAG,SAAS;IAKjD,2FAA2F;IAC3F,UAAU,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAmB5E,qGAAqG;IACrG,SAAS,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAKxC,gGAAgG;IAChG,OAAO,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO;IAWjD,kGAAkG;IAClG,YAAY,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC;IAwB9D,iGAAiG;IACjG,yBAAyB,IAAI,IAAI;IAiBjC,qGAAqG;IACrG,gBAAgB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,MAAM,GAAG,SAAS;IAInE,+FAA+F;IAC/F,iBAAiB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO;IAIzD,iGAAiG;IACjG,gBAAgB,CAAC,QAAQ,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM;IAYxE,2FAA2F;IACrF,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAWhF,6FAA6F;IAC7F,MAAM,CAAC,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;IAQlD,uFAAuF;IACvF,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS;IAQxD,yFAAyF;IACnF,QAAQ,CAAC,OAAO,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,MAAM,CAAC;IA0NjG,+FAA+F;IAC/F,eAAe,IAAI,IAAI;IAwBvB,8FAA8F;IAC9F,WAAW,CAAC,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAqBjG,sGAAsG;IACtG,mBAAmB,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI;IAe/C,8FAA8F;IAC9F,aAAa,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI;IAoCzC,uGAAuG;IACvG,KAAK,IAAI,KAAK;CAoBf"}
+{"version":3,"file":"x509-workload-identity-auth.d.ts","sourceRoot":"","sources":["../../src/internal/auth/x509-workload-identity-auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,4BAAyB;AAC/E,OAAO,KAAK,EAAE,KAAK,EAAE,4BAAyB;AAE9C,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,sBAAmB;AAC/D,OAAO,KAAK,EAAE,mBAAmB,EAAE,8BAA2B;AAE9D,OAAO,KAAK,EAAE,iBAAiB,EAAE,oBAAiB;AAWlD,OAAO,KAAK,EAIV,aAAa,EACd,qCAAkC;AAwEnC,UAAU,uBAAuB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,WAAW,GAAG,SAAS,CAAC;IACxC,cAAc,EAAE,WAAW,CAAC;IAC5B,MAAM,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,CAAC;IACvC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,iBAAiB,CAAC;CACjC;AA0BD,iGAAiG;AACjG,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,gBAAgB,GAAG,oBAAoB,GAAG,SAAS,GAC5D,QAAQ,IAAI,oBAAoB,CA6BlC;AAED,oGAAoG;AACpG,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAQlE;AAED,+FAA+F;AAC/F,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,iBAAiB,GAAG,WAAW,GAAG,SAAS,GAAG,IAAI,CAcjG;AAED,6FAA6F;AAC7F,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,iBAAiB,GAAG,WAAW,GAAG,SAAS,GAAG,IAAI,CAOnG;AAED,+FAA+F;AAC/F,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,iBAAiB,GAAG,SAAS,GAAG,iBAAiB,CAKpG;AAED,2GAA2G;AAC3G,qBAAa,wBAAwB;;IAanC,0FAA0F;gBAExF,QAAQ,EAAE,oBAAoB,EAC9B,SAAS,EAAE,aAAa,GAAG,SAAS,EACpC,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,OAAO,EAAE,MAAM,GAAG,IAAI;IAkCxB,2FAA2F;IAC3F,gBAAgB,IAAI,oBAAoB;IAcxC,+FAA+F;IAC/F,MAAM,CAAC,kBAAkB,CACvB,OAAO,EAAE,mBAAmB,EAC5B,cAAc,EAAE,WAAW,GAAG,SAAS,EACvC,cAAc,GAAE,WAA6B,GAC5C,OAAO;IAIV,2FAA2F;IAC3F,eAAe,CACb,cAAc,EAAE,WAAW,EAC3B,cAAc,EAAE,WAAW,GAC1B;QAAE,cAAc,EAAE,eAAe,CAAC;QAAC,cAAc,EAAE,eAAe,CAAA;KAAE;IAOvE,yFAAyF;IACzF,eAAe,IAAI;QAAE,cAAc,EAAE,eAAe,CAAC;QAAC,cAAc,EAAE,eAAe,CAAA;KAAE;IAQvF,sFAAsF;IACtF,cAAc,CACZ,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,OAAO,EAAE,MAAM,GAAG,IAAI,GACrB;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;IAS1D,8EAA8E;IAC9E,cAAc,IAAI;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;IAQzE,wFAAwF;IACxF,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAKnC,+FAA+F;IAC/F,aAAa,IAAI,MAAM;IAQvB,8EAA8E;IAC9E,eAAe,CACb,MAAM,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,EACtC,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,iBAAiB,GAC9B,IAAI;IAIP,wFAAwF;IACxF,eAAe,IAAI;QACjB,MAAM,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,CAAC;QACvC,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,EAAE,iBAAiB,CAAC;KACjC;IAQD,8FAA8F;IAC9F,uBAAuB,IAAI,IAAI;IAQ/B,gGAAgG;IAChG,oBAAoB,IAAI,IAAI;IAI5B,6FAA6F;IAC7F,mBAAmB,IAAI,IAAI;IAc3B,iFAAiF;IACjF,iBAAiB,IAAI,OAAO;IAI5B,uFAAuF;IACvF,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,UAAQ,GAAG,IAAI;IAkC1G,iGAAiG;IACjG,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,IAAI;IAMpD,uFAAuF;IACvF,MAAM,CAAC,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO;IAUrD,kGAAkG;IAClG,iBAAiB,IAAI,IAAI;IAiBzB,4FAA4F;IAC5F,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI;IASvC,yFAAyF;IACzF,kBAAkB,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,IAAI;IAQzD,2FAA2F;IAC3F,eAAe,IAAI,WAAW,GAAG,IAAI,GAAG,SAAS;IAKjD,2FAA2F;IAC3F,UAAU,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAmB5E,qGAAqG;IACrG,SAAS,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAKxC,gGAAgG;IAChG,OAAO,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO;IAWjD,kGAAkG;IAClG,YAAY,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC;IAwB9D,iGAAiG;IACjG,yBAAyB,IAAI,IAAI;IAmBjC,qGAAqG;IACrG,gBAAgB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,MAAM,GAAG,SAAS;IAInE,+FAA+F;IAC/F,iBAAiB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO;IAIzD,iGAAiG;IACjG,gBAAgB,CAAC,QAAQ,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM;IAYxE,2FAA2F;IACrF,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAWhF,6FAA6F;IAC7F,MAAM,CAAC,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;IAQlD,uFAAuF;IACvF,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS;IAQxD,yFAAyF;IACnF,QAAQ,CAAC,OAAO,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,MAAM,CAAC;IAoNjG,+FAA+F;IAC/F,eAAe,IAAI,IAAI;IAwBvB,8FAA8F;IAC9F,WAAW,CAAC,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAqBjG,sGAAsG;IACtG,mBAAmB,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI;IAe/C,8FAA8F;IAC9F,aAAa,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI;IAoCzC,uGAAuG;IACvG,KAAK,IAAI,KAAK;CAoBf"}

package/internal/auth/x509-workload-identity-auth.js

@@ -1,10 +1,9 @@
 "use strict";
-var _X509WorkloadIdentityAuth_instances, _a, _X509WorkloadIdentityAuth_identityProviderId, _X509WorkloadIdentityAuth_serviceAccountId, _X509WorkloadIdentityAuth_configuredRefreshBufferMs, _X509WorkloadIdentityAuth_organization, _X509WorkloadIdentityAuth_project, _X509WorkloadIdentityAuth_transport, _X509WorkloadIdentityAuth_refreshBufferMs, _X509WorkloadIdentityAuth_cachedToken, _X509WorkloadIdentityAuth_refresh, _X509WorkloadIdentityAuth_tokenGeneration, _X509WorkloadIdentityAuth_cancelRequestBody, _X509WorkloadIdentityAuth_assignToken, _X509WorkloadIdentityAuth_recoverRefreshFailure, _X509WorkloadIdentityAuth_fallbackToken, _X509WorkloadIdentityAuth_retireRefresh, _X509WorkloadIdentityAuth_beginRefresh, _X509WorkloadIdentityAuth_refreshToken, _X509WorkloadIdentityAuth_preflight, _X509WorkloadIdentityAuth_scope, _X509WorkloadIdentityAuth_assertTenantHeaders;
+var _X509WorkloadIdentityAuth_instances, _a, _X509WorkloadIdentityAuth_identityProviderId, _X509WorkloadIdentityAuth_serviceAccountId, _X509WorkloadIdentityAuth_configuredRefreshBufferMs, _X509WorkloadIdentityAuth_configuredRefreshBufferSeconds, _X509WorkloadIdentityAuth_organization, _X509WorkloadIdentityAuth_project, _X509WorkloadIdentityAuth_transport, _X509WorkloadIdentityAuth_refreshBufferMs, _X509WorkloadIdentityAuth_cachedToken, _X509WorkloadIdentityAuth_refresh, _X509WorkloadIdentityAuth_tokenGeneration, _X509WorkloadIdentityAuth_cancelRequestBody, _X509WorkloadIdentityAuth_assignToken, _X509WorkloadIdentityAuth_recoverRefreshFailure, _X509WorkloadIdentityAuth_fallbackToken, _X509WorkloadIdentityAuth_retireRefresh, _X509WorkloadIdentityAuth_beginRefresh, _X509WorkloadIdentityAuth_refreshToken, _X509WorkloadIdentityAuth_preflight, _X509WorkloadIdentityAuth_scope, _X509WorkloadIdentityAuth_assertTenantHeaders;
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.X509WorkloadIdentityAuth = exports.X509_API_BASE_URL = void 0;
+exports.X509WorkloadIdentityAuth = void 0;
 exports.isX509WorkloadIdentity = isX509WorkloadIdentity;
 exports.assertX509WebSocketSupported = assertX509WebSocketSupported;
-exports.assertX509APIOrigin = assertX509APIOrigin;
 exports.assertX509FetchOptions = assertX509FetchOptions;
 exports.assertX509RequestOptions = assertX509RequestOptions;
 exports.snapshotX509RequestOptions = snapshotX509RequestOptions;
@@ -12,12 +11,11 @@ const tslib_1 = require("../tslib.js");
 const error_1 = require("../../core/error.js");
 const headers_1 = require("../headers.js");
 const shims_1 = require("../shims.js");
+const log_1 = require("../utils/log.js");
 const values_1 = require("../utils/values.js");
+const x509_api_origin_1 = require("./x509-api-origin.js");
 const x509_transport_registry_1 = require("./x509-transport-registry.js");
-const _x509_transport_state_1 = require("#x509-transport-state");
-/** Sole API authority approved for OpenAI X.509 workload-identity federation. */
-exports.X509_API_BASE_URL = 'https://mtls.api.openai.com/v1';
-const X509_API_ORIGIN = 'https://mtls.api.openai.com';
+const _x509_transport_state_1 = require('./x509-transport-state.js');
 const FORBIDDEN_TRANSPORT_OPTIONS = ['dispatcher', 'agent', 'client', 'tls', 'proxy'];
 const headerValue = (headers, name) => Headers.prototype.get.call(headers, name);
 const DEFAULT_REFRESH_BUFFER_MS = 20 * 60 * 1000;
@@ -30,10 +28,7 @@ const userAbortError = (signal) => {
 function assertSafeHeaders(headers) {
     for (const name of Headers.prototype.keys.call(headers)) {
         const canonical = name.toLowerCase().split('_').join('-');
-        if (canonical === 'api-key' ||
-            canonical === 'x-api-key' ||
-            canonical === 'proxy-authorization' ||
-            canonical === 'host') {
+        if ((canonical !== 'authorization' && (0, log_1.isSensitiveHeader)(canonical)) || canonical === 'host') {
             throw new error_1.OpenAIError('X.509 workload identity cannot send conflicting authentication credentials.');
         }
     }
@@ -123,20 +118,6 @@ function assertX509WebSocketSupported(client) {
         throw new error_1.OpenAIError('X.509 workload identity does not support WebSocket connections.');
     }
 }
-/** Rejects every destination outside the sole enrolled, global X.509 API authority. */
-function assertX509APIOrigin(value) {
-    let target;
-    try {
-        target = new URL(value);
-    }
-    catch {
-        throw new error_1.OpenAIError('X.509 workload identity requires the approved global mTLS API origin.');
-    }
-    if (target.origin !== X509_API_ORIGIN || target.username || target.password) {
-        throw new error_1.OpenAIError('X.509 workload identity requires the approved global mTLS API origin.');
-    }
-    return target;
-}
 /** Prevents caller options from replacing the immutable transport selected at construction. */
 function assertX509FetchOptions(options) {
     if (!options) {
@@ -174,6 +155,7 @@ class X509WorkloadIdentityAuth {
         _X509WorkloadIdentityAuth_identityProviderId.set(this, void 0);
         _X509WorkloadIdentityAuth_serviceAccountId.set(this, void 0);
         _X509WorkloadIdentityAuth_configuredRefreshBufferMs.set(this, void 0);
+        _X509WorkloadIdentityAuth_configuredRefreshBufferSeconds.set(this, void 0);
         _X509WorkloadIdentityAuth_organization.set(this, void 0);
         _X509WorkloadIdentityAuth_project.set(this, void 0);
         _X509WorkloadIdentityAuth_transport.set(this, void 0);
@@ -185,13 +167,25 @@ class X509WorkloadIdentityAuth {
         tslib_1.__classPrivateFieldSet(this, _X509WorkloadIdentityAuth_identityProviderId, identity.identityProviderId, "f");
         tslib_1.__classPrivateFieldSet(this, _X509WorkloadIdentityAuth_serviceAccountId, identity.serviceAccountId, "f");
         tslib_1.__classPrivateFieldSet(this, _X509WorkloadIdentityAuth_configuredRefreshBufferMs, identity.refreshBufferMs, "f");
+        tslib_1.__classPrivateFieldSet(this, _X509WorkloadIdentityAuth_configuredRefreshBufferSeconds, identity.refreshBufferSeconds, "f");
         tslib_1.__classPrivateFieldSet(this, _X509WorkloadIdentityAuth_organization, organization, "f");
         tslib_1.__classPrivateFieldSet(this, _X509WorkloadIdentityAuth_project, project, "f");
+        if (tslib_1.__classPrivateFieldGet(this, _X509WorkloadIdentityAuth_configuredRefreshBufferMs, "f") !== undefined && tslib_1.__classPrivateFieldGet(this, _X509WorkloadIdentityAuth_configuredRefreshBufferSeconds, "f") !== undefined) {
+            throw new error_1.OpenAIError('X.509 workload identity cannot combine refreshBufferSeconds and refreshBufferMs.');
+        }
         if (tslib_1.__classPrivateFieldGet(this, _X509WorkloadIdentityAuth_configuredRefreshBufferMs, "f") !== undefined &&
             (!Number.isSafeInteger(tslib_1.__classPrivateFieldGet(this, _X509WorkloadIdentityAuth_configuredRefreshBufferMs, "f")) || tslib_1.__classPrivateFieldGet(this, _X509WorkloadIdentityAuth_configuredRefreshBufferMs, "f") < 0)) {
             throw new error_1.OpenAIError('X.509 workload identity requires a nonnegative integer refreshBufferMs.');
         }
-        tslib_1.__classPrivateFieldSet(this, _X509WorkloadIdentityAuth_refreshBufferMs, tslib_1.__classPrivateFieldGet(this, _X509WorkloadIdentityAuth_configuredRefreshBufferMs, "f") ?? DEFAULT_REFRESH_BUFFER_MS, "f");
+        if (tslib_1.__classPrivateFieldGet(this, _X509WorkloadIdentityAuth_configuredRefreshBufferSeconds, "f") !== undefined &&
+            (!Number.isSafeInteger(tslib_1.__classPrivateFieldGet(this, _X509WorkloadIdentityAuth_configuredRefreshBufferSeconds, "f")) ||
+                tslib_1.__classPrivateFieldGet(this, _X509WorkloadIdentityAuth_configuredRefreshBufferSeconds, "f") < 0 ||
+                !Number.isSafeInteger(tslib_1.__classPrivateFieldGet(this, _X509WorkloadIdentityAuth_configuredRefreshBufferSeconds, "f") * 1000))) {
+            throw new error_1.OpenAIError('X.509 workload identity requires a nonnegative integer refreshBufferSeconds.');
+        }
+        tslib_1.__classPrivateFieldSet(this, _X509WorkloadIdentityAuth_refreshBufferMs, tslib_1.__classPrivateFieldGet(this, _X509WorkloadIdentityAuth_configuredRefreshBufferSeconds, "f") === undefined
+            ? (tslib_1.__classPrivateFieldGet(this, _X509WorkloadIdentityAuth_configuredRefreshBufferMs, "f") ?? DEFAULT_REFRESH_BUFFER_MS)
+            : tslib_1.__classPrivateFieldGet(this, _X509WorkloadIdentityAuth_configuredRefreshBufferSeconds, "f") * 1000, "f");
     }
     /** Reconstructs the immutable selectors captured before caller-owned identity mutation. */
     identitySnapshot() {
@@ -202,6 +196,9 @@ class X509WorkloadIdentityAuth {
             ...(tslib_1.__classPrivateFieldGet(this, _X509WorkloadIdentityAuth_configuredRefreshBufferMs, "f") === undefined
                 ? {}
                 : { refreshBufferMs: tslib_1.__classPrivateFieldGet(this, _X509WorkloadIdentityAuth_configuredRefreshBufferMs, "f") }),
+            ...(tslib_1.__classPrivateFieldGet(this, _X509WorkloadIdentityAuth_configuredRefreshBufferSeconds, "f") === undefined
+                ? {}
+                : { refreshBufferSeconds: tslib_1.__classPrivateFieldGet(this, _X509WorkloadIdentityAuth_configuredRefreshBufferSeconds, "f") }),
         };
     }
     /** Preserves explicitly headerless requests without presenting a certificate to the issuer. */
@@ -242,7 +239,7 @@ class X509WorkloadIdentityAuth {
     }
     /** Validates and retains the exact destination that authenticated dispatch will use. */
     snapshotAPIURL(value) {
-        assertX509APIOrigin(value);
+        (0, x509_api_origin_1.assertX509APIOrigin)(value);
         tslib_1.__classPrivateFieldGet(this, _X509WorkloadIdentityAuth_instances, "m", _X509WorkloadIdentityAuth_scope).call(this).apiURL = value;
     }
     /** Reads the already-approved destination without rerendering caller-owned request options. */
@@ -266,6 +263,14 @@ class X509WorkloadIdentityAuth {
         }
         return request;
     }
+    /** Suspends an already-running network budget during retry-local asynchronous preparation. */
+    beginRequestPreparation() {
+        const scope = tslib_1.__classPrivateFieldGet(this, _X509WorkloadIdentityAuth_instances, "m", _X509WorkloadIdentityAuth_scope).call(this);
+        if (scope.deadlineArmed && scope.preparationStartedAt === undefined) {
+            scope.preparationStartedAt = performance.now();
+            scope.preparationWallStartedAt = Date.now();
+        }
+    }
     /** Begins local request construction without charging protected hook latency to the network. */
     beginRequestPlanning() {
         tslib_1.__classPrivateFieldGet(this, _X509WorkloadIdentityAuth_instances, "m", _X509WorkloadIdentityAuth_scope).call(this).phase = 'planning';
@@ -278,6 +283,12 @@ class X509WorkloadIdentityAuth {
             scope.monotonicStartedAt = performance.now();
             scope.deadlineArmed = true;
         }
+        else if (scope.preparationStartedAt !== undefined) {
+            scope.monotonicStartedAt += performance.now() - scope.preparationStartedAt;
+            scope.wallStartedAt += Date.now() - (scope.preparationWallStartedAt ?? Date.now());
+            delete scope.preparationStartedAt;
+            delete scope.preparationWallStartedAt;
+        }
     }
     /** Keeps certificate authentication outside overridable request construction. */
     isPlanningRequest() {
@@ -426,6 +437,8 @@ class X509WorkloadIdentityAuth {
         delete scope.request;
         delete scope.phase;
         delete scope.deadlineArmed;
+        delete scope.preparationStartedAt;
+        delete scope.preparationWallStartedAt;
         delete scope.effectiveSignal;
         delete scope.materializedBody;
         delete scope.apiURL;
@@ -593,7 +606,7 @@ class X509WorkloadIdentityAuth {
     /** Returns a guarded final dispatcher while preserving all existing request hook object identities. */
     fetch() {
         return async (input, init = {}) => {
-            const target = assertX509APIOrigin(typeof input === 'string' || input instanceof URL ? input : input.url);
+            const target = (0, x509_api_origin_1.assertX509APIOrigin)(typeof input === 'string' || input instanceof URL ? input : input.url);
             assertX509FetchOptions(init);
             this.assertRequest(init);
             const approved = init.headers;
@@ -609,7 +622,7 @@ class X509WorkloadIdentityAuth {
     }
 }
 exports.X509WorkloadIdentityAuth = X509WorkloadIdentityAuth;
-_a = X509WorkloadIdentityAuth, _X509WorkloadIdentityAuth_identityProviderId = new WeakMap(), _X509WorkloadIdentityAuth_serviceAccountId = new WeakMap(), _X509WorkloadIdentityAuth_configuredRefreshBufferMs = new WeakMap(), _X509WorkloadIdentityAuth_organization = new WeakMap(), _X509WorkloadIdentityAuth_project = new WeakMap(), _X509WorkloadIdentityAuth_transport = new WeakMap(), _X509WorkloadIdentityAuth_refreshBufferMs = new WeakMap(), _X509WorkloadIdentityAuth_cachedToken = new WeakMap(), _X509WorkloadIdentityAuth_refresh = new WeakMap(), _X509WorkloadIdentityAuth_tokenGeneration = new WeakMap(), _X509WorkloadIdentityAuth_instances = new WeakSet(), _X509WorkloadIdentityAuth_cancelRequestBody = async function _X509WorkloadIdentityAuth_cancelRequestBody(body) {
+_a = X509WorkloadIdentityAuth, _X509WorkloadIdentityAuth_identityProviderId = new WeakMap(), _X509WorkloadIdentityAuth_serviceAccountId = new WeakMap(), _X509WorkloadIdentityAuth_configuredRefreshBufferMs = new WeakMap(), _X509WorkloadIdentityAuth_configuredRefreshBufferSeconds = new WeakMap(), _X509WorkloadIdentityAuth_organization = new WeakMap(), _X509WorkloadIdentityAuth_project = new WeakMap(), _X509WorkloadIdentityAuth_transport = new WeakMap(), _X509WorkloadIdentityAuth_refreshBufferMs = new WeakMap(), _X509WorkloadIdentityAuth_cachedToken = new WeakMap(), _X509WorkloadIdentityAuth_refresh = new WeakMap(), _X509WorkloadIdentityAuth_tokenGeneration = new WeakMap(), _X509WorkloadIdentityAuth_instances = new WeakSet(), _X509WorkloadIdentityAuth_cancelRequestBody = async function _X509WorkloadIdentityAuth_cancelRequestBody(body) {
     try {
         await (0, shims_1.CancelReadableStream)(body);
     }
@@ -724,7 +737,7 @@ _a = X509WorkloadIdentityAuth, _X509WorkloadIdentityAuth_identityProviderId = ne
     if (context.organization !== tslib_1.__classPrivateFieldGet(this, _X509WorkloadIdentityAuth_organization, "f") || context.project !== tslib_1.__classPrivateFieldGet(this, _X509WorkloadIdentityAuth_project, "f")) {
         throw new error_1.OpenAIError('X.509 workload identity cannot override its enrolled organization or project.');
     }
-    assertX509APIOrigin(context.apiURL);
+    (0, x509_api_origin_1.assertX509APIOrigin)(context.apiURL);
     const supplied = (0, headers_1.buildHeaders)([context.defaultHeaders, context.requestHeaders]);
     if ((tslib_1.__classPrivateFieldGet(this, _X509WorkloadIdentityAuth_organization, "f") !== null && supplied.nulls.has('openai-organization')) ||
         (tslib_1.__classPrivateFieldGet(this, _X509WorkloadIdentityAuth_project, "f") !== null && supplied.nulls.has('openai-project'))) {
@@ -738,11 +751,7 @@ _a = X509WorkloadIdentityAuth, _X509WorkloadIdentityAuth_identityProviderId = ne
                     (canonical === 'openai-organization' ? context.organization : context.project))) {
             throw new error_1.OpenAIError('X.509 workload identity cannot override its enrolled organization or project.');
         }
-        if (canonical === 'authorization' ||
-            canonical === 'api-key' ||
-            canonical === 'x-api-key' ||
-            canonical === 'proxy-authorization' ||
-            canonical === 'host') {
+        if ((0, log_1.isSensitiveHeader)(canonical) || canonical === 'host') {
             throw new error_1.OpenAIError('X.509 workload identity cannot use caller-supplied authentication credentials.');
         }
     }