spiffe/dist/index.cjs

Node.js SPIFFE Workload API client

//#region rolldown:runtime
var __create = Object.create;
var __defProp = Object.defineProperty;
var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
var __getOwnPropNames = Object.getOwnPropertyNames;
var __getProtoOf = Object.getPrototypeOf;
var __hasOwnProp = Object.prototype.hasOwnProperty;
var __copyProps = (to, from, except, desc) => {
	if (from && typeof from === "object" || typeof from === "function") {
		for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
			key = keys[i];
			if (!__hasOwnProp.call(to, key) && key !== except) {
				__defProp(to, key, {
					get: ((k) => from[k]).bind(null, key),
					enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
				});
			}
		}
	}
	return to;
};
var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
	value: mod,
	enumerable: true
}) : target, mod));

//#endregion
let _grpc_grpc_js = require("@grpc/grpc-js");
let _peculiar_webcrypto = require("@peculiar/webcrypto");
let _peculiar_x509 = require("@peculiar/x509");
_peculiar_x509 = __toESM(_peculiar_x509);
let _protobuf_ts_grpc_transport = require("@protobuf-ts/grpc-transport");
let _protobuf_ts_runtime_rpc = require("@protobuf-ts/runtime-rpc");
let _protobuf_ts_runtime = require("@protobuf-ts/runtime");

//#region src/proto/google/protobuf/struct.ts
/**
* `NullValue` is a singleton enumeration to represent the null value for the
* `Value` type union.
*
* The JSON representation for `NullValue` is JSON `null`.
*
* @generated from protobuf enum google.protobuf.NullValue
*/
let NullValue = /* @__PURE__ */ function(NullValue) {
	/**
	* Null value.
	*
	* @generated from protobuf enum value: NULL_VALUE = 0;
	*/
	NullValue[NullValue["NULL_VALUE"] = 0] = "NULL_VALUE";
	return NullValue;
}({});
var Struct$Type = class extends _protobuf_ts_runtime.MessageType {
	constructor() {
		super("google.protobuf.Struct", [{
			no: 1,
			name: "fields",
			kind: "map",
			K: 9,
			V: {
				kind: "message",
				T: () => Value
			}
		}]);
	}
	/**
	* Encode `Struct` to JSON object.
	*/
	internalJsonWrite(message, options) {
		let json = {};
		for (let [k, v] of Object.entries(message.fields)) json[k] = Value.toJson(v);
		return json;
	}
	/**
	* Decode `Struct` from JSON object.
	*/
	internalJsonRead(json, options, target) {
		if (!(0, _protobuf_ts_runtime.isJsonObject)(json)) throw new globalThis.Error("Unable to parse message " + this.typeName + " from JSON " + (0, _protobuf_ts_runtime.typeofJsonValue)(json) + ".");
		if (!target) target = this.create();
		for (let [k, v] of globalThis.Object.entries(json)) target.fields[k] = Value.fromJson(v);
		return target;
	}
	create(value) {
		const message = globalThis.Object.create(this.messagePrototype);
		message.fields = {};
		if (value !== void 0) (0, _protobuf_ts_runtime.reflectionMergePartial)(this, message, value);
		return message;
	}
	internalBinaryRead(reader, length, options, target) {
		let message = target ?? this.create(), end = reader.pos + length;
		while (reader.pos < end) {
			let [fieldNo, wireType] = reader.tag();
			switch (fieldNo) {
				case 1:
					this.binaryReadMap1(message.fields, reader, options);
					break;
				default:
					let u = options.readUnknownField;
					if (u === "throw") throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
					let d = reader.skip(wireType);
					if (u !== false) (u === true ? _protobuf_ts_runtime.UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
			}
		}
		return message;
	}
	binaryReadMap1(map, reader, options) {
		let len = reader.uint32(), end = reader.pos + len, key, val;
		while (reader.pos < end) {
			let [fieldNo, wireType] = reader.tag();
			switch (fieldNo) {
				case 1:
					key = reader.string();
					break;
				case 2:
					val = Value.internalBinaryRead(reader, reader.uint32(), options);
					break;
				default: throw new globalThis.Error("unknown map entry field for google.protobuf.Struct.fields");
			}
		}
		map[key ?? ""] = val ?? Value.create();
	}
	internalBinaryWrite(message, writer, options) {
		for (let k of globalThis.Object.keys(message.fields)) {
			writer.tag(1, _protobuf_ts_runtime.WireType.LengthDelimited).fork().tag(1, _protobuf_ts_runtime.WireType.LengthDelimited).string(k);
			writer.tag(2, _protobuf_ts_runtime.WireType.LengthDelimited).fork();
			Value.internalBinaryWrite(message.fields[k], writer, options);
			writer.join().join();
		}
		let u = options.writeUnknownFields;
		if (u !== false) (u == true ? _protobuf_ts_runtime.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
		return writer;
	}
};
/**
* @generated MessageType for protobuf message google.protobuf.Struct
*/
const Struct = new Struct$Type();
var Value$Type = class extends _protobuf_ts_runtime.MessageType {
	constructor() {
		super("google.protobuf.Value", [
			{
				no: 1,
				name: "null_value",
				kind: "enum",
				oneof: "kind",
				T: () => ["google.protobuf.NullValue", NullValue]
			},
			{
				no: 2,
				name: "number_value",
				kind: "scalar",
				oneof: "kind",
				T: 1
			},
			{
				no: 3,
				name: "string_value",
				kind: "scalar",
				oneof: "kind",
				T: 9
			},
			{
				no: 4,
				name: "bool_value",
				kind: "scalar",
				oneof: "kind",
				T: 8
			},
			{
				no: 5,
				name: "struct_value",
				kind: "message",
				oneof: "kind",
				T: () => Struct
			},
			{
				no: 6,
				name: "list_value",
				kind: "message",
				oneof: "kind",
				T: () => ListValue
			}
		]);
	}
	/**
	* Encode `Value` to JSON value.
	*/
	internalJsonWrite(message, options) {
		if (message.kind.oneofKind === void 0) throw new globalThis.Error();
		switch (message.kind.oneofKind) {
			case void 0: throw new globalThis.Error();
			case "boolValue": return message.kind.boolValue;
			case "nullValue": return null;
			case "numberValue":
				let numberValue = message.kind.numberValue;
				if (typeof numberValue == "number" && !Number.isFinite(numberValue)) throw new globalThis.Error();
				return numberValue;
			case "stringValue": return message.kind.stringValue;
			case "listValue":
				let listValueField = this.fields.find((f) => f.no === 6);
				if (listValueField?.kind !== "message") throw new globalThis.Error();
				return listValueField.T().toJson(message.kind.listValue);
			case "structValue":
				let structValueField = this.fields.find((f) => f.no === 5);
				if (structValueField?.kind !== "message") throw new globalThis.Error();
				return structValueField.T().toJson(message.kind.structValue);
		}
	}
	/**
	* Decode `Value` from JSON value.
	*/
	internalJsonRead(json, options, target) {
		if (!target) target = this.create();
		switch (typeof json) {
			case "number":
				target.kind = {
					oneofKind: "numberValue",
					numberValue: json
				};
				break;
			case "string":
				target.kind = {
					oneofKind: "stringValue",
					stringValue: json
				};
				break;
			case "boolean":
				target.kind = {
					oneofKind: "boolValue",
					boolValue: json
				};
				break;
			case "object":
				if (json === null) target.kind = {
					oneofKind: "nullValue",
					nullValue: NullValue.NULL_VALUE
				};
				else if (globalThis.Array.isArray(json)) target.kind = {
					oneofKind: "listValue",
					listValue: ListValue.fromJson(json)
				};
				else target.kind = {
					oneofKind: "structValue",
					structValue: Struct.fromJson(json)
				};
				break;
			default: throw new globalThis.Error("Unable to parse " + this.typeName + " from JSON " + (0, _protobuf_ts_runtime.typeofJsonValue)(json));
		}
		return target;
	}
	create(value) {
		const message = globalThis.Object.create(this.messagePrototype);
		message.kind = { oneofKind: void 0 };
		if (value !== void 0) (0, _protobuf_ts_runtime.reflectionMergePartial)(this, message, value);
		return message;
	}
	internalBinaryRead(reader, length, options, target) {
		let message = target ?? this.create(), end = reader.pos + length;
		while (reader.pos < end) {
			let [fieldNo, wireType] = reader.tag();
			switch (fieldNo) {
				case 1:
					message.kind = {
						oneofKind: "nullValue",
						nullValue: reader.int32()
					};
					break;
				case 2:
					message.kind = {
						oneofKind: "numberValue",
						numberValue: reader.double()
					};
					break;
				case 3:
					message.kind = {
						oneofKind: "stringValue",
						stringValue: reader.string()
					};
					break;
				case 4:
					message.kind = {
						oneofKind: "boolValue",
						boolValue: reader.bool()
					};
					break;
				case 5:
					message.kind = {
						oneofKind: "structValue",
						structValue: Struct.internalBinaryRead(reader, reader.uint32(), options, message.kind.structValue)
					};
					break;
				case 6:
					message.kind = {
						oneofKind: "listValue",
						listValue: ListValue.internalBinaryRead(reader, reader.uint32(), options, message.kind.listValue)
					};
					break;
				default:
					let u = options.readUnknownField;
					if (u === "throw") throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
					let d = reader.skip(wireType);
					if (u !== false) (u === true ? _protobuf_ts_runtime.UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
			}
		}
		return message;
	}
	internalBinaryWrite(message, writer, options) {
		if (message.kind.oneofKind === "nullValue") writer.tag(1, _protobuf_ts_runtime.WireType.Varint).int32(message.kind.nullValue);
		if (message.kind.oneofKind === "numberValue") writer.tag(2, _protobuf_ts_runtime.WireType.Bit64).double(message.kind.numberValue);
		if (message.kind.oneofKind === "stringValue") writer.tag(3, _protobuf_ts_runtime.WireType.LengthDelimited).string(message.kind.stringValue);
		if (message.kind.oneofKind === "boolValue") writer.tag(4, _protobuf_ts_runtime.WireType.Varint).bool(message.kind.boolValue);
		if (message.kind.oneofKind === "structValue") Struct.internalBinaryWrite(message.kind.structValue, writer.tag(5, _protobuf_ts_runtime.WireType.LengthDelimited).fork(), options).join();
		if (message.kind.oneofKind === "listValue") ListValue.internalBinaryWrite(message.kind.listValue, writer.tag(6, _protobuf_ts_runtime.WireType.LengthDelimited).fork(), options).join();
		let u = options.writeUnknownFields;
		if (u !== false) (u == true ? _protobuf_ts_runtime.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
		return writer;
	}
};
/**
* @generated MessageType for protobuf message google.protobuf.Value
*/
const Value = new Value$Type();
var ListValue$Type = class extends _protobuf_ts_runtime.MessageType {
	constructor() {
		super("google.protobuf.ListValue", [{
			no: 1,
			name: "values",
			kind: "message",
			repeat: 2,
			T: () => Value
		}]);
	}
	/**
	* Encode `ListValue` to JSON array.
	*/
	internalJsonWrite(message, options) {
		return message.values.map((v) => Value.toJson(v));
	}
	/**
	* Decode `ListValue` from JSON array.
	*/
	internalJsonRead(json, options, target) {
		if (!globalThis.Array.isArray(json)) throw new globalThis.Error("Unable to parse " + this.typeName + " from JSON " + (0, _protobuf_ts_runtime.typeofJsonValue)(json));
		if (!target) target = this.create();
		let values = json.map((v) => Value.fromJson(v));
		target.values.push(...values);
		return target;
	}
	create(value) {
		const message = globalThis.Object.create(this.messagePrototype);
		message.values = [];
		if (value !== void 0) (0, _protobuf_ts_runtime.reflectionMergePartial)(this, message, value);
		return message;
	}
	internalBinaryRead(reader, length, options, target) {
		let message = target ?? this.create(), end = reader.pos + length;
		while (reader.pos < end) {
			let [fieldNo, wireType] = reader.tag();
			switch (fieldNo) {
				case 1:
					message.values.push(Value.internalBinaryRead(reader, reader.uint32(), options));
					break;
				default:
					let u = options.readUnknownField;
					if (u === "throw") throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
					let d = reader.skip(wireType);
					if (u !== false) (u === true ? _protobuf_ts_runtime.UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
			}
		}
		return message;
	}
	internalBinaryWrite(message, writer, options) {
		for (let i = 0; i < message.values.length; i++) Value.internalBinaryWrite(message.values[i], writer.tag(1, _protobuf_ts_runtime.WireType.LengthDelimited).fork(), options).join();
		let u = options.writeUnknownFields;
		if (u !== false) (u == true ? _protobuf_ts_runtime.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
		return writer;
	}
};
/**
* @generated MessageType for protobuf message google.protobuf.ListValue
*/
const ListValue = new ListValue$Type();

//#endregion
//#region src/proto/spiffe/workload/workload.ts
var X509SVIDRequest$Type = class extends _protobuf_ts_runtime.MessageType {
	constructor() {
		super("X509SVIDRequest", []);
	}
	create(value) {
		const message = globalThis.Object.create(this.messagePrototype);
		if (value !== void 0) (0, _protobuf_ts_runtime.reflectionMergePartial)(this, message, value);
		return message;
	}
	internalBinaryRead(reader, length, options, target) {
		let message = target ?? this.create(), end = reader.pos + length;
		while (reader.pos < end) {
			let [fieldNo, wireType] = reader.tag();
			switch (fieldNo) {
				default:
					let u = options.readUnknownField;
					if (u === "throw") throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
					let d = reader.skip(wireType);
					if (u !== false) (u === true ? _protobuf_ts_runtime.UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
			}
		}
		return message;
	}
	internalBinaryWrite(message, writer, options) {
		let u = options.writeUnknownFields;
		if (u !== false) (u == true ? _protobuf_ts_runtime.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
		return writer;
	}
};
/**
* @generated MessageType for protobuf message X509SVIDRequest
*/
const X509SVIDRequest = new X509SVIDRequest$Type();
var X509SVIDResponse$Type = class extends _protobuf_ts_runtime.MessageType {
	constructor() {
		super("X509SVIDResponse", [
			{
				no: 1,
				name: "svids",
				kind: "message",
				repeat: 2,
				T: () => X509SVID
			},
			{
				no: 2,
				name: "crl",
				kind: "scalar",
				repeat: 2,
				T: 12
			},
			{
				no: 3,
				name: "federated_bundles",
				kind: "map",
				K: 9,
				V: {
					kind: "scalar",
					T: 12
				}
			}
		]);
	}
	create(value) {
		const message = globalThis.Object.create(this.messagePrototype);
		message.svids = [];
		message.crl = [];
		message.federatedBundles = {};
		if (value !== void 0) (0, _protobuf_ts_runtime.reflectionMergePartial)(this, message, value);
		return message;
	}
	internalBinaryRead(reader, length, options, target) {
		let message = target ?? this.create(), end = reader.pos + length;
		while (reader.pos < end) {
			let [fieldNo, wireType] = reader.tag();
			switch (fieldNo) {
				case 1:
					message.svids.push(X509SVID.internalBinaryRead(reader, reader.uint32(), options));
					break;
				case 2:
					message.crl.push(reader.bytes());
					break;
				case 3:
					this.binaryReadMap3(message.federatedBundles, reader, options);
					break;
				default:
					let u = options.readUnknownField;
					if (u === "throw") throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
					let d = reader.skip(wireType);
					if (u !== false) (u === true ? _protobuf_ts_runtime.UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
			}
		}
		return message;
	}
	binaryReadMap3(map, reader, options) {
		let len = reader.uint32(), end = reader.pos + len, key, val;
		while (reader.pos < end) {
			let [fieldNo, wireType] = reader.tag();
			switch (fieldNo) {
				case 1:
					key = reader.string();
					break;
				case 2:
					val = reader.bytes();
					break;
				default: throw new globalThis.Error("unknown map entry field for X509SVIDResponse.federated_bundles");
			}
		}
		map[key ?? ""] = val ?? new Uint8Array(0);
	}
	internalBinaryWrite(message, writer, options) {
		for (let i = 0; i < message.svids.length; i++) X509SVID.internalBinaryWrite(message.svids[i], writer.tag(1, _protobuf_ts_runtime.WireType.LengthDelimited).fork(), options).join();
		for (let i = 0; i < message.crl.length; i++) writer.tag(2, _protobuf_ts_runtime.WireType.LengthDelimited).bytes(message.crl[i]);
		for (let k of globalThis.Object.keys(message.federatedBundles)) writer.tag(3, _protobuf_ts_runtime.WireType.LengthDelimited).fork().tag(1, _protobuf_ts_runtime.WireType.LengthDelimited).string(k).tag(2, _protobuf_ts_runtime.WireType.LengthDelimited).bytes(message.federatedBundles[k]).join();
		let u = options.writeUnknownFields;
		if (u !== false) (u == true ? _protobuf_ts_runtime.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
		return writer;
	}
};
/**
* @generated MessageType for protobuf message X509SVIDResponse
*/
const X509SVIDResponse = new X509SVIDResponse$Type();
var X509SVID$Type = class extends _protobuf_ts_runtime.MessageType {
	constructor() {
		super("X509SVID", [
			{
				no: 1,
				name: "spiffe_id",
				kind: "scalar",
				T: 9
			},
			{
				no: 2,
				name: "x509_svid",
				kind: "scalar",
				T: 12
			},
			{
				no: 3,
				name: "x509_svid_key",
				kind: "scalar",
				T: 12
			},
			{
				no: 4,
				name: "bundle",
				kind: "scalar",
				T: 12
			},
			{
				no: 5,
				name: "hint",
				kind: "scalar",
				T: 9
			}
		]);
	}
	create(value) {
		const message = globalThis.Object.create(this.messagePrototype);
		message.spiffeId = "";
		message.x509Svid = new Uint8Array(0);
		message.x509SvidKey = new Uint8Array(0);
		message.bundle = new Uint8Array(0);
		message.hint = "";
		if (value !== void 0) (0, _protobuf_ts_runtime.reflectionMergePartial)(this, message, value);
		return message;
	}
	internalBinaryRead(reader, length, options, target) {
		let message = target ?? this.create(), end = reader.pos + length;
		while (reader.pos < end) {
			let [fieldNo, wireType] = reader.tag();
			switch (fieldNo) {
				case 1:
					message.spiffeId = reader.string();
					break;
				case 2:
					message.x509Svid = reader.bytes();
					break;
				case 3:
					message.x509SvidKey = reader.bytes();
					break;
				case 4:
					message.bundle = reader.bytes();
					break;
				case 5:
					message.hint = reader.string();
					break;
				default:
					let u = options.readUnknownField;
					if (u === "throw") throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
					let d = reader.skip(wireType);
					if (u !== false) (u === true ? _protobuf_ts_runtime.UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
			}
		}
		return message;
	}
	internalBinaryWrite(message, writer, options) {
		if (message.spiffeId !== "") writer.tag(1, _protobuf_ts_runtime.WireType.LengthDelimited).string(message.spiffeId);
		if (message.x509Svid.length) writer.tag(2, _protobuf_ts_runtime.WireType.LengthDelimited).bytes(message.x509Svid);
		if (message.x509SvidKey.length) writer.tag(3, _protobuf_ts_runtime.WireType.LengthDelimited).bytes(message.x509SvidKey);
		if (message.bundle.length) writer.tag(4, _protobuf_ts_runtime.WireType.LengthDelimited).bytes(message.bundle);
		if (message.hint !== "") writer.tag(5, _protobuf_ts_runtime.WireType.LengthDelimited).string(message.hint);
		let u = options.writeUnknownFields;
		if (u !== false) (u == true ? _protobuf_ts_runtime.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
		return writer;
	}
};
/**
* @generated MessageType for protobuf message X509SVID
*/
const X509SVID = new X509SVID$Type();
var X509BundlesRequest$Type = class extends _protobuf_ts_runtime.MessageType {
	constructor() {
		super("X509BundlesRequest", []);
	}
	create(value) {
		const message = globalThis.Object.create(this.messagePrototype);
		if (value !== void 0) (0, _protobuf_ts_runtime.reflectionMergePartial)(this, message, value);
		return message;
	}
	internalBinaryRead(reader, length, options, target) {
		let message = target ?? this.create(), end = reader.pos + length;
		while (reader.pos < end) {
			let [fieldNo, wireType] = reader.tag();
			switch (fieldNo) {
				default:
					let u = options.readUnknownField;
					if (u === "throw") throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
					let d = reader.skip(wireType);
					if (u !== false) (u === true ? _protobuf_ts_runtime.UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
			}
		}
		return message;
	}
	internalBinaryWrite(message, writer, options) {
		let u = options.writeUnknownFields;
		if (u !== false) (u == true ? _protobuf_ts_runtime.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
		return writer;
	}
};
/**
* @generated MessageType for protobuf message X509BundlesRequest
*/
const X509BundlesRequest = new X509BundlesRequest$Type();
var X509BundlesResponse$Type = class extends _protobuf_ts_runtime.MessageType {
	constructor() {
		super("X509BundlesResponse", [{
			no: 1,
			name: "crl",
			kind: "scalar",
			repeat: 2,
			T: 12
		}, {
			no: 2,
			name: "bundles",
			kind: "map",
			K: 9,
			V: {
				kind: "scalar",
				T: 12
			}
		}]);
	}
	create(value) {
		const message = globalThis.Object.create(this.messagePrototype);
		message.crl = [];
		message.bundles = {};
		if (value !== void 0) (0, _protobuf_ts_runtime.reflectionMergePartial)(this, message, value);
		return message;
	}
	internalBinaryRead(reader, length, options, target) {
		let message = target ?? this.create(), end = reader.pos + length;
		while (reader.pos < end) {
			let [fieldNo, wireType] = reader.tag();
			switch (fieldNo) {
				case 1:
					message.crl.push(reader.bytes());
					break;
				case 2:
					this.binaryReadMap2(message.bundles, reader, options);
					break;
				default:
					let u = options.readUnknownField;
					if (u === "throw") throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
					let d = reader.skip(wireType);
					if (u !== false) (u === true ? _protobuf_ts_runtime.UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
			}
		}
		return message;
	}
	binaryReadMap2(map, reader, options) {
		let len = reader.uint32(), end = reader.pos + len, key, val;
		while (reader.pos < end) {
			let [fieldNo, wireType] = reader.tag();
			switch (fieldNo) {
				case 1:
					key = reader.string();
					break;
				case 2:
					val = reader.bytes();
					break;
				default: throw new globalThis.Error("unknown map entry field for X509BundlesResponse.bundles");
			}
		}
		map[key ?? ""] = val ?? new Uint8Array(0);
	}
	internalBinaryWrite(message, writer, options) {
		for (let i = 0; i < message.crl.length; i++) writer.tag(1, _protobuf_ts_runtime.WireType.LengthDelimited).bytes(message.crl[i]);
		for (let k of globalThis.Object.keys(message.bundles)) writer.tag(2, _protobuf_ts_runtime.WireType.LengthDelimited).fork().tag(1, _protobuf_ts_runtime.WireType.LengthDelimited).string(k).tag(2, _protobuf_ts_runtime.WireType.LengthDelimited).bytes(message.bundles[k]).join();
		let u = options.writeUnknownFields;
		if (u !== false) (u == true ? _protobuf_ts_runtime.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
		return writer;
	}
};
/**
* @generated MessageType for protobuf message X509BundlesResponse
*/
const X509BundlesResponse = new X509BundlesResponse$Type();
var JWTSVIDRequest$Type = class extends _protobuf_ts_runtime.MessageType {
	constructor() {
		super("JWTSVIDRequest", [{
			no: 1,
			name: "audience",
			kind: "scalar",
			repeat: 2,
			T: 9
		}, {
			no: 2,
			name: "spiffe_id",
			kind: "scalar",
			T: 9
		}]);
	}
	create(value) {
		const message = globalThis.Object.create(this.messagePrototype);
		message.audience = [];
		message.spiffeId = "";
		if (value !== void 0) (0, _protobuf_ts_runtime.reflectionMergePartial)(this, message, value);
		return message;
	}
	internalBinaryRead(reader, length, options, target) {
		let message = target ?? this.create(), end = reader.pos + length;
		while (reader.pos < end) {
			let [fieldNo, wireType] = reader.tag();
			switch (fieldNo) {
				case 1:
					message.audience.push(reader.string());
					break;
				case 2:
					message.spiffeId = reader.string();
					break;
				default:
					let u = options.readUnknownField;
					if (u === "throw") throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
					let d = reader.skip(wireType);
					if (u !== false) (u === true ? _protobuf_ts_runtime.UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
			}
		}
		return message;
	}
	internalBinaryWrite(message, writer, options) {
		for (let i = 0; i < message.audience.length; i++) writer.tag(1, _protobuf_ts_runtime.WireType.LengthDelimited).string(message.audience[i]);
		if (message.spiffeId !== "") writer.tag(2, _protobuf_ts_runtime.WireType.LengthDelimited).string(message.spiffeId);
		let u = options.writeUnknownFields;
		if (u !== false) (u == true ? _protobuf_ts_runtime.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
		return writer;
	}
};
/**
* @generated MessageType for protobuf message JWTSVIDRequest
*/
const JWTSVIDRequest = new JWTSVIDRequest$Type();
var JWTSVIDResponse$Type = class extends _protobuf_ts_runtime.MessageType {
	constructor() {
		super("JWTSVIDResponse", [{
			no: 1,
			name: "svids",
			kind: "message",
			repeat: 2,
			T: () => JWTSVID
		}]);
	}
	create(value) {
		const message = globalThis.Object.create(this.messagePrototype);
		message.svids = [];
		if (value !== void 0) (0, _protobuf_ts_runtime.reflectionMergePartial)(this, message, value);
		return message;
	}
	internalBinaryRead(reader, length, options, target) {
		let message = target ?? this.create(), end = reader.pos + length;
		while (reader.pos < end) {
			let [fieldNo, wireType] = reader.tag();
			switch (fieldNo) {
				case 1:
					message.svids.push(JWTSVID.internalBinaryRead(reader, reader.uint32(), options));
					break;
				default:
					let u = options.readUnknownField;
					if (u === "throw") throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
					let d = reader.skip(wireType);
					if (u !== false) (u === true ? _protobuf_ts_runtime.UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
			}
		}
		return message;
	}
	internalBinaryWrite(message, writer, options) {
		for (let i = 0; i < message.svids.length; i++) JWTSVID.internalBinaryWrite(message.svids[i], writer.tag(1, _protobuf_ts_runtime.WireType.LengthDelimited).fork(), options).join();
		let u = options.writeUnknownFields;
		if (u !== false) (u == true ? _protobuf_ts_runtime.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
		return writer;
	}
};
/**
* @generated MessageType for protobuf message JWTSVIDResponse
*/
const JWTSVIDResponse = new JWTSVIDResponse$Type();
var JWTSVID$Type = class extends _protobuf_ts_runtime.MessageType {
	constructor() {
		super("JWTSVID", [
			{
				no: 1,
				name: "spiffe_id",
				kind: "scalar",
				T: 9
			},
			{
				no: 2,
				name: "svid",
				kind: "scalar",
				T: 9
			},
			{
				no: 3,
				name: "hint",
				kind: "scalar",
				T: 9
			}
		]);
	}
	create(value) {
		const message = globalThis.Object.create(this.messagePrototype);
		message.spiffeId = "";
		message.svid = "";
		message.hint = "";
		if (value !== void 0) (0, _protobuf_ts_runtime.reflectionMergePartial)(this, message, value);
		return message;
	}
	internalBinaryRead(reader, length, options, target) {
		let message = target ?? this.create(), end = reader.pos + length;
		while (reader.pos < end) {
			let [fieldNo, wireType] = reader.tag();
			switch (fieldNo) {
				case 1:
					message.spiffeId = reader.string();
					break;
				case 2:
					message.svid = reader.string();
					break;
				case 3:
					message.hint = reader.string();
					break;
				default:
					let u = options.readUnknownField;
					if (u === "throw") throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
					let d = reader.skip(wireType);
					if (u !== false) (u === true ? _protobuf_ts_runtime.UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
			}
		}
		return message;
	}
	internalBinaryWrite(message, writer, options) {
		if (message.spiffeId !== "") writer.tag(1, _protobuf_ts_runtime.WireType.LengthDelimited).string(message.spiffeId);
		if (message.svid !== "") writer.tag(2, _protobuf_ts_runtime.WireType.LengthDelimited).string(message.svid);
		if (message.hint !== "") writer.tag(3, _protobuf_ts_runtime.WireType.LengthDelimited).string(message.hint);
		let u = options.writeUnknownFields;
		if (u !== false) (u == true ? _protobuf_ts_runtime.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
		return writer;
	}
};
/**
* @generated MessageType for protobuf message JWTSVID
*/
const JWTSVID = new JWTSVID$Type();
var JWTBundlesRequest$Type = class extends _protobuf_ts_runtime.MessageType {
	constructor() {
		super("JWTBundlesRequest", []);
	}
	create(value) {
		const message = globalThis.Object.create(this.messagePrototype);
		if (value !== void 0) (0, _protobuf_ts_runtime.reflectionMergePartial)(this, message, value);
		return message;
	}
	internalBinaryRead(reader, length, options, target) {
		let message = target ?? this.create(), end = reader.pos + length;
		while (reader.pos < end) {
			let [fieldNo, wireType] = reader.tag();
			switch (fieldNo) {
				default:
					let u = options.readUnknownField;
					if (u === "throw") throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
					let d = reader.skip(wireType);
					if (u !== false) (u === true ? _protobuf_ts_runtime.UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
			}
		}
		return message;
	}
	internalBinaryWrite(message, writer, options) {
		let u = options.writeUnknownFields;
		if (u !== false) (u == true ? _protobuf_ts_runtime.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
		return writer;
	}
};
/**
* @generated MessageType for protobuf message JWTBundlesRequest
*/
const JWTBundlesRequest = new JWTBundlesRequest$Type();
var JWTBundlesResponse$Type = class extends _protobuf_ts_runtime.MessageType {
	constructor() {
		super("JWTBundlesResponse", [{
			no: 1,
			name: "bundles",
			kind: "map",
			K: 9,
			V: {
				kind: "scalar",
				T: 12
			}
		}]);
	}
	create(value) {
		const message = globalThis.Object.create(this.messagePrototype);
		message.bundles = {};
		if (value !== void 0) (0, _protobuf_ts_runtime.reflectionMergePartial)(this, message, value);
		return message;
	}
	internalBinaryRead(reader, length, options, target) {
		let message = target ?? this.create(), end = reader.pos + length;
		while (reader.pos < end) {
			let [fieldNo, wireType] = reader.tag();
			switch (fieldNo) {
				case 1:
					this.binaryReadMap1(message.bundles, reader, options);
					break;
				default:
					let u = options.readUnknownField;
					if (u === "throw") throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
					let d = reader.skip(wireType);
					if (u !== false) (u === true ? _protobuf_ts_runtime.UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
			}
		}
		return message;
	}
	binaryReadMap1(map, reader, options) {
		let len = reader.uint32(), end = reader.pos + len, key, val;
		while (reader.pos < end) {
			let [fieldNo, wireType] = reader.tag();
			switch (fieldNo) {
				case 1:
					key = reader.string();
					break;
				case 2:
					val = reader.bytes();
					break;
				default: throw new globalThis.Error("unknown map entry field for JWTBundlesResponse.bundles");
			}
		}
		map[key ?? ""] = val ?? new Uint8Array(0);
	}
	internalBinaryWrite(message, writer, options) {
		for (let k of globalThis.Object.keys(message.bundles)) writer.tag(1, _protobuf_ts_runtime.WireType.LengthDelimited).fork().tag(1, _protobuf_ts_runtime.WireType.LengthDelimited).string(k).tag(2, _protobuf_ts_runtime.WireType.LengthDelimited).bytes(message.bundles[k]).join();
		let u = options.writeUnknownFields;
		if (u !== false) (u == true ? _protobuf_ts_runtime.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
		return writer;
	}
};
/**
* @generated MessageType for protobuf message JWTBundlesResponse
*/
const JWTBundlesResponse = new JWTBundlesResponse$Type();
var ValidateJWTSVIDRequest$Type = class extends _protobuf_ts_runtime.MessageType {
	constructor() {
		super("ValidateJWTSVIDRequest", [{
			no: 1,
			name: "audience",
			kind: "scalar",
			T: 9
		}, {
			no: 2,
			name: "svid",
			kind: "scalar",
			T: 9
		}]);
	}
	create(value) {
		const message = globalThis.Object.create(this.messagePrototype);
		message.audience = "";
		message.svid = "";
		if (value !== void 0) (0, _protobuf_ts_runtime.reflectionMergePartial)(this, message, value);
		return message;
	}
	internalBinaryRead(reader, length, options, target) {
		let message = target ?? this.create(), end = reader.pos + length;
		while (reader.pos < end) {
			let [fieldNo, wireType] = reader.tag();
			switch (fieldNo) {
				case 1:
					message.audience = reader.string();
					break;
				case 2:
					message.svid = reader.string();
					break;
				default:
					let u = options.readUnknownField;
					if (u === "throw") throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
					let d = reader.skip(wireType);
					if (u !== false) (u === true ? _protobuf_ts_runtime.UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
			}
		}
		return message;
	}
	internalBinaryWrite(message, writer, options) {
		if (message.audience !== "") writer.tag(1, _protobuf_ts_runtime.WireType.LengthDelimited).string(message.audience);
		if (message.svid !== "") writer.tag(2, _protobuf_ts_runtime.WireType.LengthDelimited).string(message.svid);
		let u = options.writeUnknownFields;
		if (u !== false) (u == true ? _protobuf_ts_runtime.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
		return writer;
	}
};
/**
* @generated MessageType for protobuf message ValidateJWTSVIDRequest
*/
const ValidateJWTSVIDRequest = new ValidateJWTSVIDRequest$Type();
var ValidateJWTSVIDResponse$Type = class extends _protobuf_ts_runtime.MessageType {
	constructor() {
		super("ValidateJWTSVIDResponse", [{
			no: 1,
			name: "spiffe_id",
			kind: "scalar",
			T: 9
		}, {
			no: 2,
			name: "claims",
			kind: "message",
			T: () => Struct
		}]);
	}
	create(value) {
		const message = globalThis.Object.create(this.messagePrototype);
		message.spiffeId = "";
		if (value !== void 0) (0, _protobuf_ts_runtime.reflectionMergePartial)(this, message, value);
		return message;
	}
	internalBinaryRead(reader, length, options, target) {
		let message = target ?? this.create(), end = reader.pos + length;
		while (reader.pos < end) {
			let [fieldNo, wireType] = reader.tag();
			switch (fieldNo) {
				case 1:
					message.spiffeId = reader.string();
					break;
				case 2:
					message.claims = Struct.internalBinaryRead(reader, reader.uint32(), options, message.claims);
					break;
				default:
					let u = options.readUnknownField;
					if (u === "throw") throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
					let d = reader.skip(wireType);
					if (u !== false) (u === true ? _protobuf_ts_runtime.UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
			}
		}
		return message;
	}
	internalBinaryWrite(message, writer, options) {
		if (message.spiffeId !== "") writer.tag(1, _protobuf_ts_runtime.WireType.LengthDelimited).string(message.spiffeId);
		if (message.claims) Struct.internalBinaryWrite(message.claims, writer.tag(2, _protobuf_ts_runtime.WireType.LengthDelimited).fork(), options).join();
		let u = options.writeUnknownFields;
		if (u !== false) (u == true ? _protobuf_ts_runtime.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
		return writer;
	}
};
/**
* @generated MessageType for protobuf message ValidateJWTSVIDResponse
*/
const ValidateJWTSVIDResponse = new ValidateJWTSVIDResponse$Type();
/**
* @generated ServiceType for protobuf service SpiffeWorkloadAPI
*/
const SpiffeWorkloadAPI = new _protobuf_ts_runtime_rpc.ServiceType("SpiffeWorkloadAPI", [
	{
		name: "FetchX509SVID",
		serverStreaming: true,
		options: {},
		I: X509SVIDRequest,
		O: X509SVIDResponse
	},
	{
		name: "FetchX509Bundles",
		serverStreaming: true,
		options: {},
		I: X509BundlesRequest,
		O: X509BundlesResponse
	},
	{
		name: "FetchJWTSVID",
		options: {},
		I: JWTSVIDRequest,
		O: JWTSVIDResponse
	},
	{
		name: "FetchJWTBundles",
		serverStreaming: true,
		options: {},
		I: JWTBundlesRequest,
		O: JWTBundlesResponse
	},
	{
		name: "ValidateJWTSVID",
		options: {},
		I: ValidateJWTSVIDRequest,
		O: ValidateJWTSVIDResponse
	}
]);

//#endregion
//#region src/proto/spiffe/workload/workload.client.ts
/**
* ///////////////////////////////////////////////////////////////////////
* X509-SVID Profile
* ///////////////////////////////////////////////////////////////////////
*
* @generated from protobuf service SpiffeWorkloadAPI
*/
var SpiffeWorkloadAPIClient = class {
	typeName = SpiffeWorkloadAPI.typeName;
	methods = SpiffeWorkloadAPI.methods;
	options = SpiffeWorkloadAPI.options;
	constructor(_transport) {
		this._transport = _transport;
	}
	/**
	* Fetch X.509-SVIDs for all SPIFFE identities the workload is entitled to,
	* as well as related information like trust bundles and CRLs. As this
	* information changes, subsequent messages will be streamed from the
	* server.
	*
	* @generated from protobuf rpc: FetchX509SVID
	*/
	fetchX509SVID(input, options) {
		const method = this.methods[0], opt = this._transport.mergeOptions(options);
		return (0, _protobuf_ts_runtime_rpc.stackIntercept)("serverStreaming", this._transport, method, opt, input);
	}
	/**
	* Fetch trust bundles and CRLs. Useful for clients that only need to
	* validate SVIDs without obtaining an SVID for themself. As this
	* information changes, subsequent messages will be streamed from the
	* server.
	*
	* @generated from protobuf rpc: FetchX509Bundles
	*/
	fetchX509Bundles(input, options) {
		const method = this.methods[1], opt = this._transport.mergeOptions(options);
		return (0, _protobuf_ts_runtime_rpc.stackIntercept)("serverStreaming", this._transport, method, opt, input);
	}
	/**
	* Fetch JWT-SVIDs for all SPIFFE identities the workload is entitled to,
	* for the requested audience. If an optional SPIFFE ID is requested, only
	* the JWT-SVID for that SPIFFE ID is returned.
	*
	* @generated from protobuf rpc: FetchJWTSVID
	*/
	fetchJWTSVID(input, options) {
		const method = this.methods[2], opt = this._transport.mergeOptions(options);
		return (0, _protobuf_ts_runtime_rpc.stackIntercept)("unary", this._transport, method, opt, input);
	}
	/**
	* Fetches the JWT bundles, formatted as JWKS documents, keyed by the
	* SPIFFE ID of the trust domain. As this information changes, subsequent
	* messages will be streamed from the server.
	*
	* @generated from protobuf rpc: FetchJWTBundles
	*/
	fetchJWTBundles(input, options) {
		const method = this.methods[3], opt = this._transport.mergeOptions(options);
		return (0, _protobuf_ts_runtime_rpc.stackIntercept)("serverStreaming", this._transport, method, opt, input);
	}
	/**
	* Validates a JWT-SVID against the requested audience. Returns the SPIFFE
	* ID of the JWT-SVID and JWT claims.
	*
	* @generated from protobuf rpc: ValidateJWTSVID
	*/
	validateJWTSVID(input, options) {
		const method = this.methods[4], opt = this._transport.mergeOptions(options);
		return (0, _protobuf_ts_runtime_rpc.stackIntercept)("unary", this._transport, method, opt, input);
	}
};

//#endregion
//#region src/index.ts
function createClient(baseURL) {
	const baseUrl = baseURL ?? process.env.SPIFFE_ENDPOINT_SOCKET;
	if (!baseUrl) throw new Error("SPIFFE_ENDPOINT_SOCKET environment variable is not set");
	return new SpiffeWorkloadAPIClient(new _protobuf_ts_grpc_transport.GrpcTransport({
		host: baseUrl,
		channelCredentials: _grpc_grpc_js.ChannelCredentials.createInsecure(),
		meta: { "workload.spiffe.io": "true" }
	}));
}
/**
* Utility function to parse a raw certificate. Can be used to convert the
* raw certificate into a PEM certificate:
*
* ```typescript
* const cert = parseCertificate(data)
* const pem = cert.toString('pem')
* ```
*
* **Note:** if you have a certificate bundle, use `parseCertificateBundle` instead, as
* this function will incorrectly parse bundles as a single certificate.
*
* @param data The raw data of the certificate
* @returns [X509Certificate](https://peculiarventures.github.io/x509/classes/X509Certificate.html)
* @see https://github.com/PeculiarVentures/x509
*/
function parseCertificate(data) {
	initCryptoProvider();
	return new _peculiar_x509.X509Certificate(data);
}
/**
* Utility function to parse a certificate bundle. Can be used to convert the
* bundle into a PEM chain:
*
* ```typescript
* const certs = parseCertificateBundle(data)
* const pemChain = certs.toString('pem-chain')
* ```
*
* @param data The raw data of the certificate bundle
* @returns [X509Certificates](https://peculiarventures.github.io/x509/classes/X509Certificates.html)
* @see https://github.com/PeculiarVentures/x509
*/
function parseCertificateBundle(data) {
	initCryptoProvider();
	let currentIndex = 0;
	const certs = [];
	while (currentIndex < data.length) {
		const beginOfSequence = currentIndex;
		currentIndex += 1;
		let length = data[currentIndex++];
		if (length === 128) throw new TypeError("Indefinite length encoding not supported");
		if (length & 128) {
			const lengthBytes = length & 127;
			length = 0;
			for (let i = 0; i < lengthBytes; i++) length = length << 8 | data[currentIndex++];
		}
		certs.push(new _peculiar_x509.X509Certificate(data.slice(beginOfSequence, currentIndex + length)));
		currentIndex += length;
	}
	return new _peculiar_x509.X509Certificates(certs);
}
function initCryptoProvider() {
	try {
		_peculiar_x509.cryptoProvider.get();
	} catch {
		const crypto = new _peculiar_webcrypto.Crypto();
		_peculiar_x509.cryptoProvider.set(crypto);
	}
}

//#endregion
exports.JWTBundlesRequest = JWTBundlesRequest;
exports.JWTBundlesResponse = JWTBundlesResponse;
exports.JWTSVID = JWTSVID;
exports.JWTSVIDRequest = JWTSVIDRequest;
exports.JWTSVIDResponse = JWTSVIDResponse;
exports.ListValue = ListValue;
exports.NullValue = NullValue;
exports.SpiffeWorkloadAPI = SpiffeWorkloadAPI;
exports.SpiffeWorkloadAPIClient = SpiffeWorkloadAPIClient;
exports.Struct = Struct;
exports.ValidateJWTSVIDRequest = ValidateJWTSVIDRequest;
exports.ValidateJWTSVIDResponse = ValidateJWTSVIDResponse;
exports.Value = Value;
exports.X509BundlesRequest = X509BundlesRequest;
exports.X509BundlesResponse = X509BundlesResponse;
exports.X509SVID = X509SVID;
exports.X509SVIDRequest = X509SVIDRequest;
exports.X509SVIDResponse = X509SVIDResponse;
exports.createClient = createClient;
exports.parseCertificate = parseCertificate;
exports.parseCertificateBundle = parseCertificateBundle;