spiffe/dist/index.cjs

Node.js SPIFFE Workload API client

"use strict";
var __create = Object.create;
var __defProp = Object.defineProperty;
var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
var __getOwnPropNames = Object.getOwnPropertyNames;
var __getProtoOf = Object.getPrototypeOf;
var __hasOwnProp = Object.prototype.hasOwnProperty;
var __export = (target, all) => {
  for (var name in all)
    __defProp(target, name, { get: all[name], enumerable: true });
};
var __copyProps = (to, from, except, desc) => {
  if (from && typeof from === "object" || typeof from === "function") {
    for (let key of __getOwnPropNames(from))
      if (!__hasOwnProp.call(to, key) && key !== except)
        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
  }
  return to;
};
var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
  // If the importer is in node compatibility mode or this is not an ESM
  // file that has been converted to a CommonJS file using a Babel-
  // compatible transform (i.e. "__esModule" has not been set), then set
  // "default" to the CommonJS "module.exports" for node compatibility.
  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
  mod
));
var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);

// src/index.ts
var src_exports = {};
__export(src_exports, {
  JWTBundlesRequest: () => JWTBundlesRequest,
  JWTBundlesResponse: () => JWTBundlesResponse,
  JWTSVID: () => JWTSVID,
  JWTSVIDRequest: () => JWTSVIDRequest,
  JWTSVIDResponse: () => JWTSVIDResponse,
  ListValue: () => ListValue,
  NullValue: () => NullValue,
  SpiffeWorkloadAPI: () => SpiffeWorkloadAPI,
  SpiffeWorkloadAPIClient: () => SpiffeWorkloadAPIClient,
  Struct: () => Struct,
  ValidateJWTSVIDRequest: () => ValidateJWTSVIDRequest,
  ValidateJWTSVIDResponse: () => ValidateJWTSVIDResponse,
  Value: () => Value,
  X509BundlesRequest: () => X509BundlesRequest,
  X509BundlesResponse: () => X509BundlesResponse,
  X509SVID: () => X509SVID,
  X509SVIDRequest: () => X509SVIDRequest,
  X509SVIDResponse: () => X509SVIDResponse,
  createClient: () => createClient,
  parseCertificate: () => parseCertificate,
  parseCertificateBundle: () => parseCertificateBundle
});
module.exports = __toCommonJS(src_exports);
var import_grpc_js = require("@grpc/grpc-js");
var import_webcrypto = require("@peculiar/webcrypto");
var x509 = __toESM(require("@peculiar/x509"), 1);
var import_grpc_transport = require("@protobuf-ts/grpc-transport");

// src/proto/spiffe/workload/workload.client.ts
var import_runtime_rpc2 = require("@protobuf-ts/runtime-rpc");

// src/proto/spiffe/workload/workload.ts
var import_runtime2 = require("@protobuf-ts/runtime");
var import_runtime_rpc = require("@protobuf-ts/runtime-rpc");

// src/proto/google/protobuf/struct.ts
var import_runtime = require("@protobuf-ts/runtime");
var NullValue = /* @__PURE__ */ ((NullValue2) => {
  NullValue2[NullValue2["NULL_VALUE"] = 0] = "NULL_VALUE";
  return NullValue2;
})(NullValue || {});
var Struct$Type = class extends import_runtime.MessageType {
  constructor() {
    super("google.protobuf.Struct", [
      { no: 1, name: "fields", kind: "map", K: 9, V: { kind: "message", T: () => Value } }
    ]);
  }
  /**
   * Encode `Struct` to JSON object.
   */
  internalJsonWrite(message, options) {
    let json = {};
    for (let [k, v] of Object.entries(message.fields)) {
      json[k] = Value.toJson(v);
    }
    return json;
  }
  /**
   * Decode `Struct` from JSON object.
   */
  internalJsonRead(json, options, target) {
    if (!(0, import_runtime.isJsonObject)(json))
      throw new globalThis.Error(
        "Unable to parse message " + this.typeName + " from JSON " + (0, import_runtime.typeofJsonValue)(json) + "."
      );
    if (!target)
      target = this.create();
    for (let [k, v] of globalThis.Object.entries(json)) {
      target.fields[k] = Value.fromJson(v);
    }
    return target;
  }
  create(value) {
    const message = { fields: {} };
    globalThis.Object.defineProperty(message, import_runtime.MESSAGE_TYPE, { enumerable: false, value: this });
    if (value !== void 0)
      (0, import_runtime.reflectionMergePartial)(this, message, value);
    return message;
  }
  internalBinaryRead(reader, length, options, target) {
    let message = target ?? this.create(), end = reader.pos + length;
    while (reader.pos < end) {
      let [fieldNo, wireType] = reader.tag();
      switch (fieldNo) {
        case /* map<string, google.protobuf.Value> fields */
        1:
          this.binaryReadMap1(message.fields, reader, options);
          break;
        default:
          let u = options.readUnknownField;
          if (u === "throw")
            throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
          let d = reader.skip(wireType);
          if (u !== false)
            (u === true ? import_runtime.UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
      }
    }
    return message;
  }
  binaryReadMap1(map, reader, options) {
    let len = reader.uint32(), end = reader.pos + len, key, val;
    while (reader.pos < end) {
      let [fieldNo, wireType] = reader.tag();
      switch (fieldNo) {
        case 1:
          key = reader.string();
          break;
        case 2:
          val = Value.internalBinaryRead(reader, reader.uint32(), options);
          break;
        default:
          throw new globalThis.Error("unknown map entry field for field google.protobuf.Struct.fields");
      }
    }
    map[key ?? ""] = val ?? Value.create();
  }
  internalBinaryWrite(message, writer, options) {
    for (let k of Object.keys(message.fields)) {
      writer.tag(1, import_runtime.WireType.LengthDelimited).fork().tag(1, import_runtime.WireType.LengthDelimited).string(k);
      writer.tag(2, import_runtime.WireType.LengthDelimited).fork();
      Value.internalBinaryWrite(message.fields[k], writer, options);
      writer.join().join();
    }
    let u = options.writeUnknownFields;
    if (u !== false)
      (u == true ? import_runtime.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
    return writer;
  }
};
var Struct = new Struct$Type();
var Value$Type = class extends import_runtime.MessageType {
  constructor() {
    super("google.protobuf.Value", [
      { no: 1, name: "null_value", kind: "enum", oneof: "kind", T: () => ["google.protobuf.NullValue", NullValue] },
      {
        no: 2,
        name: "number_value",
        kind: "scalar",
        oneof: "kind",
        T: 1
        /*ScalarType.DOUBLE*/
      },
      {
        no: 3,
        name: "string_value",
        kind: "scalar",
        oneof: "kind",
        T: 9
        /*ScalarType.STRING*/
      },
      {
        no: 4,
        name: "bool_value",
        kind: "scalar",
        oneof: "kind",
        T: 8
        /*ScalarType.BOOL*/
      },
      { no: 5, name: "struct_value", kind: "message", oneof: "kind", T: () => Struct },
      { no: 6, name: "list_value", kind: "message", oneof: "kind", T: () => ListValue }
    ]);
  }
  /**
   * Encode `Value` to JSON value.
   */
  internalJsonWrite(message, options) {
    if (message.kind.oneofKind === void 0)
      throw new globalThis.Error();
    switch (message.kind.oneofKind) {
      case void 0:
        throw new globalThis.Error();
      case "boolValue":
        return message.kind.boolValue;
      case "nullValue":
        return null;
      case "numberValue":
        let numberValue = message.kind.numberValue;
        if (typeof numberValue == "number" && !Number.isFinite(numberValue))
          throw new globalThis.Error();
        return numberValue;
      case "stringValue":
        return message.kind.stringValue;
      case "listValue":
        let listValueField = this.fields.find((f) => f.no === 6);
        if (listValueField?.kind !== "message")
          throw new globalThis.Error();
        return listValueField.T().toJson(message.kind.listValue);
      case "structValue":
        let structValueField = this.fields.find((f) => f.no === 5);
        if (structValueField?.kind !== "message")
          throw new globalThis.Error();
        return structValueField.T().toJson(message.kind.structValue);
    }
  }
  /**
   * Decode `Value` from JSON value.
   */
  internalJsonRead(json, options, target) {
    if (!target)
      target = this.create();
    switch (typeof json) {
      case "number":
        target.kind = { oneofKind: "numberValue", numberValue: json };
        break;
      case "string":
        target.kind = { oneofKind: "stringValue", stringValue: json };
        break;
      case "boolean":
        target.kind = { oneofKind: "boolValue", boolValue: json };
        break;
      case "object":
        if (json === null) {
          target.kind = { oneofKind: "nullValue", nullValue: 0 /* NULL_VALUE */ };
        } else if (globalThis.Array.isArray(json)) {
          target.kind = { oneofKind: "listValue", listValue: ListValue.fromJson(json) };
        } else {
          target.kind = { oneofKind: "structValue", structValue: Struct.fromJson(json) };
        }
        break;
      default:
        throw new globalThis.Error("Unable to parse " + this.typeName + " from JSON " + (0, import_runtime.typeofJsonValue)(json));
    }
    return target;
  }
  create(value) {
    const message = { kind: { oneofKind: void 0 } };
    globalThis.Object.defineProperty(message, import_runtime.MESSAGE_TYPE, { enumerable: false, value: this });
    if (value !== void 0)
      (0, import_runtime.reflectionMergePartial)(this, message, value);
    return message;
  }
  internalBinaryRead(reader, length, options, target) {
    let message = target ?? this.create(), end = reader.pos + length;
    while (reader.pos < end) {
      let [fieldNo, wireType] = reader.tag();
      switch (fieldNo) {
        case /* google.protobuf.NullValue null_value */
        1:
          message.kind = {
            oneofKind: "nullValue",
            nullValue: reader.int32()
          };
          break;
        case /* double number_value */
        2:
          message.kind = {
            oneofKind: "numberValue",
            numberValue: reader.double()
          };
          break;
        case /* string string_value */
        3:
          message.kind = {
            oneofKind: "stringValue",
            stringValue: reader.string()
          };
          break;
        case /* bool bool_value */
        4:
          message.kind = {
            oneofKind: "boolValue",
            boolValue: reader.bool()
          };
          break;
        case /* google.protobuf.Struct struct_value */
        5:
          message.kind = {
            oneofKind: "structValue",
            structValue: Struct.internalBinaryRead(reader, reader.uint32(), options, message.kind.structValue)
          };
          break;
        case /* google.protobuf.ListValue list_value */
        6:
          message.kind = {
            oneofKind: "listValue",
            listValue: ListValue.internalBinaryRead(reader, reader.uint32(), options, message.kind.listValue)
          };
          break;
        default:
          let u = options.readUnknownField;
          if (u === "throw")
            throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
          let d = reader.skip(wireType);
          if (u !== false)
            (u === true ? import_runtime.UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
      }
    }
    return message;
  }
  internalBinaryWrite(message, writer, options) {
    if (message.kind.oneofKind === "nullValue")
      writer.tag(1, import_runtime.WireType.Varint).int32(message.kind.nullValue);
    if (message.kind.oneofKind === "numberValue")
      writer.tag(2, import_runtime.WireType.Bit64).double(message.kind.numberValue);
    if (message.kind.oneofKind === "stringValue")
      writer.tag(3, import_runtime.WireType.LengthDelimited).string(message.kind.stringValue);
    if (message.kind.oneofKind === "boolValue")
      writer.tag(4, import_runtime.WireType.Varint).bool(message.kind.boolValue);
    if (message.kind.oneofKind === "structValue")
      Struct.internalBinaryWrite(
        message.kind.structValue,
        writer.tag(5, import_runtime.WireType.LengthDelimited).fork(),
        options
      ).join();
    if (message.kind.oneofKind === "listValue")
      ListValue.internalBinaryWrite(
        message.kind.listValue,
        writer.tag(6, import_runtime.WireType.LengthDelimited).fork(),
        options
      ).join();
    let u = options.writeUnknownFields;
    if (u !== false)
      (u == true ? import_runtime.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
    return writer;
  }
};
var Value = new Value$Type();
var ListValue$Type = class extends import_runtime.MessageType {
  constructor() {
    super("google.protobuf.ListValue", [
      { no: 1, name: "values", kind: "message", repeat: 1, T: () => Value }
    ]);
  }
  /**
   * Encode `ListValue` to JSON array.
   */
  internalJsonWrite(message, options) {
    return message.values.map((v) => Value.toJson(v));
  }
  /**
   * Decode `ListValue` from JSON array.
   */
  internalJsonRead(json, options, target) {
    if (!globalThis.Array.isArray(json))
      throw new globalThis.Error("Unable to parse " + this.typeName + " from JSON " + (0, import_runtime.typeofJsonValue)(json));
    if (!target)
      target = this.create();
    let values = json.map((v) => Value.fromJson(v));
    target.values.push(...values);
    return target;
  }
  create(value) {
    const message = { values: [] };
    globalThis.Object.defineProperty(message, import_runtime.MESSAGE_TYPE, { enumerable: false, value: this });
    if (value !== void 0)
      (0, import_runtime.reflectionMergePartial)(this, message, value);
    return message;
  }
  internalBinaryRead(reader, length, options, target) {
    let message = target ?? this.create(), end = reader.pos + length;
    while (reader.pos < end) {
      let [fieldNo, wireType] = reader.tag();
      switch (fieldNo) {
        case /* repeated google.protobuf.Value values */
        1:
          message.values.push(Value.internalBinaryRead(reader, reader.uint32(), options));
          break;
        default:
          let u = options.readUnknownField;
          if (u === "throw")
            throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
          let d = reader.skip(wireType);
          if (u !== false)
            (u === true ? import_runtime.UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
      }
    }
    return message;
  }
  internalBinaryWrite(message, writer, options) {
    for (let i = 0; i < message.values.length; i++)
      Value.internalBinaryWrite(message.values[i], writer.tag(1, import_runtime.WireType.LengthDelimited).fork(), options).join();
    let u = options.writeUnknownFields;
    if (u !== false)
      (u == true ? import_runtime.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
    return writer;
  }
};
var ListValue = new ListValue$Type();

// src/proto/spiffe/workload/workload.ts
var X509SVIDRequest$Type = class extends import_runtime2.MessageType {
  constructor() {
    super("X509SVIDRequest", []);
  }
  create(value) {
    const message = {};
    globalThis.Object.defineProperty(message, import_runtime2.MESSAGE_TYPE, { enumerable: false, value: this });
    if (value !== void 0)
      (0, import_runtime2.reflectionMergePartial)(this, message, value);
    return message;
  }
  internalBinaryRead(reader, length, options, target) {
    return target ?? this.create();
  }
  internalBinaryWrite(message, writer, options) {
    let u = options.writeUnknownFields;
    if (u !== false)
      (u == true ? import_runtime2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
    return writer;
  }
};
var X509SVIDRequest = new X509SVIDRequest$Type();
var X509SVIDResponse$Type = class extends import_runtime2.MessageType {
  constructor() {
    super("X509SVIDResponse", [
      { no: 1, name: "svids", kind: "message", repeat: 1, T: () => X509SVID },
      {
        no: 2,
        name: "crl",
        kind: "scalar",
        repeat: 2,
        T: 12
        /*ScalarType.BYTES*/
      },
      {
        no: 3,
        name: "federated_bundles",
        kind: "map",
        K: 9,
        V: {
          kind: "scalar",
          T: 12
          /*ScalarType.BYTES*/
        }
      }
    ]);
  }
  create(value) {
    const message = { svids: [], crl: [], federatedBundles: {} };
    globalThis.Object.defineProperty(message, import_runtime2.MESSAGE_TYPE, { enumerable: false, value: this });
    if (value !== void 0)
      (0, import_runtime2.reflectionMergePartial)(this, message, value);
    return message;
  }
  internalBinaryRead(reader, length, options, target) {
    let message = target ?? this.create(), end = reader.pos + length;
    while (reader.pos < end) {
      let [fieldNo, wireType] = reader.tag();
      switch (fieldNo) {
        case /* repeated X509SVID svids */
        1:
          message.svids.push(X509SVID.internalBinaryRead(reader, reader.uint32(), options));
          break;
        case /* repeated bytes crl */
        2:
          message.crl.push(reader.bytes());
          break;
        case /* map<string, bytes> federated_bundles */
        3:
          this.binaryReadMap3(message.federatedBundles, reader, options);
          break;
        default:
          let u = options.readUnknownField;
          if (u === "throw")
            throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
          let d = reader.skip(wireType);
          if (u !== false)
            (u === true ? import_runtime2.UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
      }
    }
    return message;
  }
  binaryReadMap3(map, reader, options) {
    let len = reader.uint32(), end = reader.pos + len, key, val;
    while (reader.pos < end) {
      let [fieldNo, wireType] = reader.tag();
      switch (fieldNo) {
        case 1:
          key = reader.string();
          break;
        case 2:
          val = reader.bytes();
          break;
        default:
          throw new globalThis.Error("unknown map entry field for field X509SVIDResponse.federated_bundles");
      }
    }
    map[key ?? ""] = val ?? new Uint8Array(0);
  }
  internalBinaryWrite(message, writer, options) {
    for (let i = 0; i < message.svids.length; i++)
      X509SVID.internalBinaryWrite(message.svids[i], writer.tag(1, import_runtime2.WireType.LengthDelimited).fork(), options).join();
    for (let i = 0; i < message.crl.length; i++)
      writer.tag(2, import_runtime2.WireType.LengthDelimited).bytes(message.crl[i]);
    for (let k of Object.keys(message.federatedBundles))
      writer.tag(3, import_runtime2.WireType.LengthDelimited).fork().tag(1, import_runtime2.WireType.LengthDelimited).string(k).tag(2, import_runtime2.WireType.LengthDelimited).bytes(message.federatedBundles[k]).join();
    let u = options.writeUnknownFields;
    if (u !== false)
      (u == true ? import_runtime2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
    return writer;
  }
};
var X509SVIDResponse = new X509SVIDResponse$Type();
var X509SVID$Type = class extends import_runtime2.MessageType {
  constructor() {
    super("X509SVID", [
      {
        no: 1,
        name: "spiffe_id",
        kind: "scalar",
        T: 9
        /*ScalarType.STRING*/
      },
      {
        no: 2,
        name: "x509_svid",
        kind: "scalar",
        T: 12
        /*ScalarType.BYTES*/
      },
      {
        no: 3,
        name: "x509_svid_key",
        kind: "scalar",
        T: 12
        /*ScalarType.BYTES*/
      },
      {
        no: 4,
        name: "bundle",
        kind: "scalar",
        T: 12
        /*ScalarType.BYTES*/
      },
      {
        no: 5,
        name: "hint",
        kind: "scalar",
        T: 9
        /*ScalarType.STRING*/
      }
    ]);
  }
  create(value) {
    const message = {
      spiffeId: "",
      x509Svid: new Uint8Array(0),
      x509SvidKey: new Uint8Array(0),
      bundle: new Uint8Array(0),
      hint: ""
    };
    globalThis.Object.defineProperty(message, import_runtime2.MESSAGE_TYPE, { enumerable: false, value: this });
    if (value !== void 0)
      (0, import_runtime2.reflectionMergePartial)(this, message, value);
    return message;
  }
  internalBinaryRead(reader, length, options, target) {
    let message = target ?? this.create(), end = reader.pos + length;
    while (reader.pos < end) {
      let [fieldNo, wireType] = reader.tag();
      switch (fieldNo) {
        case /* string spiffe_id */
        1:
          message.spiffeId = reader.string();
          break;
        case /* bytes x509_svid */
        2:
          message.x509Svid = reader.bytes();
          break;
        case /* bytes x509_svid_key */
        3:
          message.x509SvidKey = reader.bytes();
          break;
        case /* bytes bundle */
        4:
          message.bundle = reader.bytes();
          break;
        case /* string hint */
        5:
          message.hint = reader.string();
          break;
        default:
          let u = options.readUnknownField;
          if (u === "throw")
            throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
          let d = reader.skip(wireType);
          if (u !== false)
            (u === true ? import_runtime2.UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
      }
    }
    return message;
  }
  internalBinaryWrite(message, writer, options) {
    if (message.spiffeId !== "")
      writer.tag(1, import_runtime2.WireType.LengthDelimited).string(message.spiffeId);
    if (message.x509Svid.length)
      writer.tag(2, import_runtime2.WireType.LengthDelimited).bytes(message.x509Svid);
    if (message.x509SvidKey.length)
      writer.tag(3, import_runtime2.WireType.LengthDelimited).bytes(message.x509SvidKey);
    if (message.bundle.length)
      writer.tag(4, import_runtime2.WireType.LengthDelimited).bytes(message.bundle);
    if (message.hint !== "")
      writer.tag(5, import_runtime2.WireType.LengthDelimited).string(message.hint);
    let u = options.writeUnknownFields;
    if (u !== false)
      (u == true ? import_runtime2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
    return writer;
  }
};
var X509SVID = new X509SVID$Type();
var X509BundlesRequest$Type = class extends import_runtime2.MessageType {
  constructor() {
    super("X509BundlesRequest", []);
  }
  create(value) {
    const message = {};
    globalThis.Object.defineProperty(message, import_runtime2.MESSAGE_TYPE, { enumerable: false, value: this });
    if (value !== void 0)
      (0, import_runtime2.reflectionMergePartial)(this, message, value);
    return message;
  }
  internalBinaryRead(reader, length, options, target) {
    return target ?? this.create();
  }
  internalBinaryWrite(message, writer, options) {
    let u = options.writeUnknownFields;
    if (u !== false)
      (u == true ? import_runtime2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
    return writer;
  }
};
var X509BundlesRequest = new X509BundlesRequest$Type();
var X509BundlesResponse$Type = class extends import_runtime2.MessageType {
  constructor() {
    super("X509BundlesResponse", [
      {
        no: 1,
        name: "crl",
        kind: "scalar",
        repeat: 2,
        T: 12
        /*ScalarType.BYTES*/
      },
      {
        no: 2,
        name: "bundles",
        kind: "map",
        K: 9,
        V: {
          kind: "scalar",
          T: 12
          /*ScalarType.BYTES*/
        }
      }
    ]);
  }
  create(value) {
    const message = { crl: [], bundles: {} };
    globalThis.Object.defineProperty(message, import_runtime2.MESSAGE_TYPE, { enumerable: false, value: this });
    if (value !== void 0)
      (0, import_runtime2.reflectionMergePartial)(this, message, value);
    return message;
  }
  internalBinaryRead(reader, length, options, target) {
    let message = target ?? this.create(), end = reader.pos + length;
    while (reader.pos < end) {
      let [fieldNo, wireType] = reader.tag();
      switch (fieldNo) {
        case /* repeated bytes crl */
        1:
          message.crl.push(reader.bytes());
          break;
        case /* map<string, bytes> bundles */
        2:
          this.binaryReadMap2(message.bundles, reader, options);
          break;
        default:
          let u = options.readUnknownField;
          if (u === "throw")
            throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
          let d = reader.skip(wireType);
          if (u !== false)
            (u === true ? import_runtime2.UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
      }
    }
    return message;
  }
  binaryReadMap2(map, reader, options) {
    let len = reader.uint32(), end = reader.pos + len, key, val;
    while (reader.pos < end) {
      let [fieldNo, wireType] = reader.tag();
      switch (fieldNo) {
        case 1:
          key = reader.string();
          break;
        case 2:
          val = reader.bytes();
          break;
        default:
          throw new globalThis.Error("unknown map entry field for field X509BundlesResponse.bundles");
      }
    }
    map[key ?? ""] = val ?? new Uint8Array(0);
  }
  internalBinaryWrite(message, writer, options) {
    for (let i = 0; i < message.crl.length; i++)
      writer.tag(1, import_runtime2.WireType.LengthDelimited).bytes(message.crl[i]);
    for (let k of Object.keys(message.bundles))
      writer.tag(2, import_runtime2.WireType.LengthDelimited).fork().tag(1, import_runtime2.WireType.LengthDelimited).string(k).tag(2, import_runtime2.WireType.LengthDelimited).bytes(message.bundles[k]).join();
    let u = options.writeUnknownFields;
    if (u !== false)
      (u == true ? import_runtime2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
    return writer;
  }
};
var X509BundlesResponse = new X509BundlesResponse$Type();
var JWTSVIDRequest$Type = class extends import_runtime2.MessageType {
  constructor() {
    super("JWTSVIDRequest", [
      {
        no: 1,
        name: "audience",
        kind: "scalar",
        repeat: 2,
        T: 9
        /*ScalarType.STRING*/
      },
      {
        no: 2,
        name: "spiffe_id",
        kind: "scalar",
        T: 9
        /*ScalarType.STRING*/
      }
    ]);
  }
  create(value) {
    const message = { audience: [], spiffeId: "" };
    globalThis.Object.defineProperty(message, import_runtime2.MESSAGE_TYPE, { enumerable: false, value: this });
    if (value !== void 0)
      (0, import_runtime2.reflectionMergePartial)(this, message, value);
    return message;
  }
  internalBinaryRead(reader, length, options, target) {
    let message = target ?? this.create(), end = reader.pos + length;
    while (reader.pos < end) {
      let [fieldNo, wireType] = reader.tag();
      switch (fieldNo) {
        case /* repeated string audience */
        1:
          message.audience.push(reader.string());
          break;
        case /* string spiffe_id */
        2:
          message.spiffeId = reader.string();
          break;
        default:
          let u = options.readUnknownField;
          if (u === "throw")
            throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
          let d = reader.skip(wireType);
          if (u !== false)
            (u === true ? import_runtime2.UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
      }
    }
    return message;
  }
  internalBinaryWrite(message, writer, options) {
    for (let i = 0; i < message.audience.length; i++)
      writer.tag(1, import_runtime2.WireType.LengthDelimited).string(message.audience[i]);
    if (message.spiffeId !== "")
      writer.tag(2, import_runtime2.WireType.LengthDelimited).string(message.spiffeId);
    let u = options.writeUnknownFields;
    if (u !== false)
      (u == true ? import_runtime2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
    return writer;
  }
};
var JWTSVIDRequest = new JWTSVIDRequest$Type();
var JWTSVIDResponse$Type = class extends import_runtime2.MessageType {
  constructor() {
    super("JWTSVIDResponse", [
      { no: 1, name: "svids", kind: "message", repeat: 1, T: () => JWTSVID }
    ]);
  }
  create(value) {
    const message = { svids: [] };
    globalThis.Object.defineProperty(message, import_runtime2.MESSAGE_TYPE, { enumerable: false, value: this });
    if (value !== void 0)
      (0, import_runtime2.reflectionMergePartial)(this, message, value);
    return message;
  }
  internalBinaryRead(reader, length, options, target) {
    let message = target ?? this.create(), end = reader.pos + length;
    while (reader.pos < end) {
      let [fieldNo, wireType] = reader.tag();
      switch (fieldNo) {
        case /* repeated JWTSVID svids */
        1:
          message.svids.push(JWTSVID.internalBinaryRead(reader, reader.uint32(), options));
          break;
        default:
          let u = options.readUnknownField;
          if (u === "throw")
            throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
          let d = reader.skip(wireType);
          if (u !== false)
            (u === true ? import_runtime2.UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
      }
    }
    return message;
  }
  internalBinaryWrite(message, writer, options) {
    for (let i = 0; i < message.svids.length; i++)
      JWTSVID.internalBinaryWrite(message.svids[i], writer.tag(1, import_runtime2.WireType.LengthDelimited).fork(), options).join();
    let u = options.writeUnknownFields;
    if (u !== false)
      (u == true ? import_runtime2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
    return writer;
  }
};
var JWTSVIDResponse = new JWTSVIDResponse$Type();
var JWTSVID$Type = class extends import_runtime2.MessageType {
  constructor() {
    super("JWTSVID", [
      {
        no: 1,
        name: "spiffe_id",
        kind: "scalar",
        T: 9
        /*ScalarType.STRING*/
      },
      {
        no: 2,
        name: "svid",
        kind: "scalar",
        T: 9
        /*ScalarType.STRING*/
      },
      {
        no: 3,
        name: "hint",
        kind: "scalar",
        T: 9
        /*ScalarType.STRING*/
      }
    ]);
  }
  create(value) {
    const message = { spiffeId: "", svid: "", hint: "" };
    globalThis.Object.defineProperty(message, import_runtime2.MESSAGE_TYPE, { enumerable: false, value: this });
    if (value !== void 0)
      (0, import_runtime2.reflectionMergePartial)(this, message, value);
    return message;
  }
  internalBinaryRead(reader, length, options, target) {
    let message = target ?? this.create(), end = reader.pos + length;
    while (reader.pos < end) {
      let [fieldNo, wireType] = reader.tag();
      switch (fieldNo) {
        case /* string spiffe_id */
        1:
          message.spiffeId = reader.string();
          break;
        case /* string svid */
        2:
          message.svid = reader.string();
          break;
        case /* string hint */
        3:
          message.hint = reader.string();
          break;
        default:
          let u = options.readUnknownField;
          if (u === "throw")
            throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
          let d = reader.skip(wireType);
          if (u !== false)
            (u === true ? import_runtime2.UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
      }
    }
    return message;
  }
  internalBinaryWrite(message, writer, options) {
    if (message.spiffeId !== "")
      writer.tag(1, import_runtime2.WireType.LengthDelimited).string(message.spiffeId);
    if (message.svid !== "")
      writer.tag(2, import_runtime2.WireType.LengthDelimited).string(message.svid);
    if (message.hint !== "")
      writer.tag(3, import_runtime2.WireType.LengthDelimited).string(message.hint);
    let u = options.writeUnknownFields;
    if (u !== false)
      (u == true ? import_runtime2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
    return writer;
  }
};
var JWTSVID = new JWTSVID$Type();
var JWTBundlesRequest$Type = class extends import_runtime2.MessageType {
  constructor() {
    super("JWTBundlesRequest", []);
  }
  create(value) {
    const message = {};
    globalThis.Object.defineProperty(message, import_runtime2.MESSAGE_TYPE, { enumerable: false, value: this });
    if (value !== void 0)
      (0, import_runtime2.reflectionMergePartial)(this, message, value);
    return message;
  }
  internalBinaryRead(reader, length, options, target) {
    return target ?? this.create();
  }
  internalBinaryWrite(message, writer, options) {
    let u = options.writeUnknownFields;
    if (u !== false)
      (u == true ? import_runtime2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
    return writer;
  }
};
var JWTBundlesRequest = new JWTBundlesRequest$Type();
var JWTBundlesResponse$Type = class extends import_runtime2.MessageType {
  constructor() {
    super("JWTBundlesResponse", [
      {
        no: 1,
        name: "bundles",
        kind: "map",
        K: 9,
        V: {
          kind: "scalar",
          T: 12
          /*ScalarType.BYTES*/
        }
      }
    ]);
  }
  create(value) {
    const message = { bundles: {} };
    globalThis.Object.defineProperty(message, import_runtime2.MESSAGE_TYPE, { enumerable: false, value: this });
    if (value !== void 0)
      (0, import_runtime2.reflectionMergePartial)(this, message, value);
    return message;
  }
  internalBinaryRead(reader, length, options, target) {
    let message = target ?? this.create(), end = reader.pos + length;
    while (reader.pos < end) {
      let [fieldNo, wireType] = reader.tag();
      switch (fieldNo) {
        case /* map<string, bytes> bundles */
        1:
          this.binaryReadMap1(message.bundles, reader, options);
          break;
        default:
          let u = options.readUnknownField;
          if (u === "throw")
            throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
          let d = reader.skip(wireType);
          if (u !== false)
            (u === true ? import_runtime2.UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
      }
    }
    return message;
  }
  binaryReadMap1(map, reader, options) {
    let len = reader.uint32(), end = reader.pos + len, key, val;
    while (reader.pos < end) {
      let [fieldNo, wireType] = reader.tag();
      switch (fieldNo) {
        case 1:
          key = reader.string();
          break;
        case 2:
          val = reader.bytes();
          break;
        default:
          throw new globalThis.Error("unknown map entry field for field JWTBundlesResponse.bundles");
      }
    }
    map[key ?? ""] = val ?? new Uint8Array(0);
  }
  internalBinaryWrite(message, writer, options) {
    for (let k of Object.keys(message.bundles))
      writer.tag(1, import_runtime2.WireType.LengthDelimited).fork().tag(1, import_runtime2.WireType.LengthDelimited).string(k).tag(2, import_runtime2.WireType.LengthDelimited).bytes(message.bundles[k]).join();
    let u = options.writeUnknownFields;
    if (u !== false)
      (u == true ? import_runtime2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
    return writer;
  }
};
var JWTBundlesResponse = new JWTBundlesResponse$Type();
var ValidateJWTSVIDRequest$Type = class extends import_runtime2.MessageType {
  constructor() {
    super("ValidateJWTSVIDRequest", [
      {
        no: 1,
        name: "audience",
        kind: "scalar",
        T: 9
        /*ScalarType.STRING*/
      },
      {
        no: 2,
        name: "svid",
        kind: "scalar",
        T: 9
        /*ScalarType.STRING*/
      }
    ]);
  }
  create(value) {
    const message = { audience: "", svid: "" };
    globalThis.Object.defineProperty(message, import_runtime2.MESSAGE_TYPE, { enumerable: false, value: this });
    if (value !== void 0)
      (0, import_runtime2.reflectionMergePartial)(this, message, value);
    return message;
  }
  internalBinaryRead(reader, length, options, target) {
    let message = target ?? this.create(), end = reader.pos + length;
    while (reader.pos < end) {
      let [fieldNo, wireType] = reader.tag();
      switch (fieldNo) {
        case /* string audience */
        1:
          message.audience = reader.string();
          break;
        case /* string svid */
        2:
          message.svid = reader.string();
          break;
        default:
          let u = options.readUnknownField;
          if (u === "throw")
            throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
          let d = reader.skip(wireType);
          if (u !== false)
            (u === true ? import_runtime2.UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
      }
    }
    return message;
  }
  internalBinaryWrite(message, writer, options) {
    if (message.audience !== "")
      writer.tag(1, import_runtime2.WireType.LengthDelimited).string(message.audience);
    if (message.svid !== "")
      writer.tag(2, import_runtime2.WireType.LengthDelimited).string(message.svid);
    let u = options.writeUnknownFields;
    if (u !== false)
      (u == true ? import_runtime2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
    return writer;
  }
};
var ValidateJWTSVIDRequest = new ValidateJWTSVIDRequest$Type();
var ValidateJWTSVIDResponse$Type = class extends import_runtime2.MessageType {
  constructor() {
    super("ValidateJWTSVIDResponse", [
      {
        no: 1,
        name: "spiffe_id",
        kind: "scalar",
        T: 9
        /*ScalarType.STRING*/
      },
      { no: 2, name: "claims", kind: "message", T: () => Struct }
    ]);
  }
  create(value) {
    const message = { spiffeId: "" };
    globalThis.Object.defineProperty(message, import_runtime2.MESSAGE_TYPE, { enumerable: false, value: this });
    if (value !== void 0)
      (0, import_runtime2.reflectionMergePartial)(this, message, value);
    return message;
  }
  internalBinaryRead(reader, length, options, target) {
    let message = target ?? this.create(), end = reader.pos + length;
    while (reader.pos < end) {
      let [fieldNo, wireType] = reader.tag();
      switch (fieldNo) {
        case /* string spiffe_id */
        1:
          message.spiffeId = reader.string();
          break;
        case /* google.protobuf.Struct claims */
        2:
          message.claims = Struct.internalBinaryRead(reader, reader.uint32(), options, message.claims);
          break;
        default:
          let u = options.readUnknownField;
          if (u === "throw")
            throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
          let d = reader.skip(wireType);
          if (u !== false)
            (u === true ? import_runtime2.UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
      }
    }
    return message;
  }
  internalBinaryWrite(message, writer, options) {
    if (message.spiffeId !== "")
      writer.tag(1, import_runtime2.WireType.LengthDelimited).string(message.spiffeId);
    if (message.claims)
      Struct.internalBinaryWrite(message.claims, writer.tag(2, import_runtime2.WireType.LengthDelimited).fork(), options).join();
    let u = options.writeUnknownFields;
    if (u !== false)
      (u == true ? import_runtime2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
    return writer;
  }
};
var ValidateJWTSVIDResponse = new ValidateJWTSVIDResponse$Type();
var SpiffeWorkloadAPI = new import_runtime_rpc.ServiceType("SpiffeWorkloadAPI", [
  { name: "FetchX509SVID", serverStreaming: true, options: {}, I: X509SVIDRequest, O: X509SVIDResponse },
  { name: "FetchX509Bundles", serverStreaming: true, options: {}, I: X509BundlesRequest, O: X509BundlesResponse },
  { name: "FetchJWTSVID", options: {}, I: JWTSVIDRequest, O: JWTSVIDResponse },
  { name: "FetchJWTBundles", serverStreaming: true, options: {}, I: JWTBundlesRequest, O: JWTBundlesResponse },
  { name: "ValidateJWTSVID", options: {}, I: ValidateJWTSVIDRequest, O: ValidateJWTSVIDResponse }
]);

// src/proto/spiffe/workload/workload.client.ts
var SpiffeWorkloadAPIClient = class {
  constructor(_transport) {
    this._transport = _transport;
    this.typeName = SpiffeWorkloadAPI.typeName;
    this.methods = SpiffeWorkloadAPI.methods;
    this.options = SpiffeWorkloadAPI.options;
  }
  /**
   * Fetch X.509-SVIDs for all SPIFFE identities the workload is entitled to,
   * as well as related information like trust bundles and CRLs. As this
   * information changes, subsequent messages will be streamed from the
   * server.
   *
   * @generated from protobuf rpc: FetchX509SVID(X509SVIDRequest) returns (stream X509SVIDResponse);
   */
  fetchX509SVID(input, options) {
    const method = this.methods[0], opt = this._transport.mergeOptions(options);
    return (0, import_runtime_rpc2.stackIntercept)("serverStreaming", this._transport, method, opt, input);
  }
  /**
   * Fetch trust bundles and CRLs. Useful for clients that only need to
   * validate SVIDs without obtaining an SVID for themself. As this
   * information changes, subsequent messages will be streamed from the
   * server.
   *
   * @generated from protobuf rpc: FetchX509Bundles(X509BundlesRequest) returns (stream X509BundlesResponse);
   */
  fetchX509Bundles(input, options) {
    const method = this.methods[1], opt = this._transport.mergeOptions(options);
    return (0, import_runtime_rpc2.stackIntercept)(
      "serverStreaming",
      this._transport,
      method,
      opt,
      input
    );
  }
  // ///////////////////////////////////////////////////////////////////////
  // JWT-SVID Profile
  // ///////////////////////////////////////////////////////////////////////
  /**
   * Fetch JWT-SVIDs for all SPIFFE identities the workload is entitled to,
   * for the requested audience. If an optional SPIFFE ID is requested, only
   * the JWT-SVID for that SPIFFE ID is returned.
   *
   * @generated from protobuf rpc: FetchJWTSVID(JWTSVIDRequest) returns (JWTSVIDResponse);
   */
  fetchJWTSVID(input, options) {
    const method = this.methods[2], opt = this._transport.mergeOptions(options);
    return (0, import_runtime_rpc2.stackIntercept)("unary", this._transport, method, opt, input);
  }
  /**
   * Fetches the JWT bundles, formatted as JWKS documents, keyed by the
   * SPIFFE ID of the trust domain. As this information changes, subsequent
   * messages will be streamed from the server.
   *
   * @generated from protobuf rpc: FetchJWTBundles(JWTBundlesRequest) returns (stream JWTBundlesResponse);
   */
  fetchJWTBundles(input, options) {
    const method = this.methods[3], opt = this._transport.mergeOptions(options);
    return (0, import_runtime_rpc2.stackIntercept)("serverStreaming", this._transport, method, opt, input);
  }
  /**
   * Validates a JWT-SVID against the requested audience. Returns the SPIFFE
   * ID of the JWT-SVID and JWT claims.
   *
   * @generated from protobuf rpc: ValidateJWTSVID(ValidateJWTSVIDRequest) returns (ValidateJWTSVIDResponse);
   */
  validateJWTSVID(input, options) {
    const method = this.methods[4], opt = this._transport.mergeOptions(options);
    return (0, import_runtime_rpc2.stackIntercept)("unary", this._transport, method, opt, input);
  }
};

// src/index.ts
function createClient(baseURL) {
  const baseUrl = baseURL ?? process.env.SPIFFE_ENDPOINT_SOCKET;
  if (!baseUrl) {
    throw new Error("SPIFFE_ENDPOINT_SOCKET environment variable is not set");
  }
  const transport = new import_grpc_transport.GrpcTransport({
    host: baseUrl,
    channelCredentials: import_grpc_js.ChannelCredentials.createInsecure(),
    meta: { "workload.spiffe.io": "true" }
  });
  return new SpiffeWorkloadAPIClient(transport);
}
function parseCertificate(data) {
  initCryptoProvider();
  return new x509.X509Certificate(data);
}
function parseCertificateBundle(data) {
  initCryptoProvider();
  let currentIndex = 0;
  const certs = [];
  while (currentIndex < data.length) {
    const beginOfSequence = currentIndex;
    currentIndex += 1;
    let length = data[currentIndex++];
    if (length === 128)
      throw new TypeError("Indefinite length encoding not supported");
    if (length & 128) {
      const lengthBytes = length & 127;
      length = 0;
      for (let i = 0; i < lengthBytes; i++) {
        length = length << 8 | data[currentIndex++];
      }
    }
    certs.push(new x509.X509Certificate(data.slice(beginOfSequence, currentIndex + length)));
    currentIndex += length;
  }
  return new x509.X509Certificates(certs);
}
function initCryptoProvider() {
  try {
    x509.cryptoProvider.get();
  } catch {
    const crypto = new import_webcrypto.Crypto();
    x509.cryptoProvider.set(crypto);
  }
}
// Annotate the CommonJS export names for ESM import in node:
0 && (module.exports = {
  JWTBundlesRequest,
  JWTBundlesResponse,
  JWTSVID,
  JWTSVIDRequest,
  JWTSVIDResponse,
  ListValue,
  NullValue,
  SpiffeWorkloadAPI,
  SpiffeWorkloadAPIClient,
  Struct,
  ValidateJWTSVIDRequest,
  ValidateJWTSVIDResponse,
  Value,
  X509BundlesRequest,
  X509BundlesResponse,
  X509SVID,
  X509SVIDRequest,
  X509SVIDResponse,
  createClient,
  parseCertificate,
  parseCertificateBundle
});