Workload Identities Node-AWS Pilot private preview

[mark-kogan-stripe]

Why?

This PR introduces an alternate way to create a top-level Stripe client, authenticated via AWS instead of a long-lived API key. Rather than relying on a semi-permanent secret that can be leaked or mismanaged, the SDK fetches a short-lived token backed by a public key and the guarantee that the code is running on genuine cloud provider hardware.

The change adds a separate adapter package within this repo that uses the AWS SDK to build an assertion function capable of retrieving web identity tokens. The core stripe package then uses that assertion function to mint an ephemeral key, refreshing it proactively and also on a single 401 as a fallback, for the lifetime of the session. Once constructed, the resulting Stripe client behaves identically to a standard one.

What?

• Creates an independent package under packages/aws-workload-identity.
• Adds packages/aws-workload-identity/src/index.ts, which uses the AWS SDK to export awsWorkloadIdentity().
• Adds new tests under packages/ and updates ci-tests.
• Adds src/net/WorkloadIdentityTokenTransport.ts, which hard-codes an HTTP call to the intended Stripe endpoint, designed to carry the JWT without allowing redirects.
• Introduces a new error type for errors arising from the workload identity process.
• Updates the request sender to allow a single retry when the authentication method in use is workloadidentity — kept separate from the normal network retry logic.
• Updates stripe.core.ts and stripe.esm.node.ts to include the alternate constructor, along with a new _authMethod parameter that serves as the source of truth for which authentication method is in use.
• Adds WorkloadIdentity.ts, containing the core logic for refreshing and caching the token in a thread-safe way, attaching workload identity credentials as a symbol on the config, validating types, and producing the authenticator function that takes a request and attaches the cached token.
• Adds additional test files for workload identity.
• Updates the README, .gitignore, and changelogs.

See Also

Configuration

• skip-changefile: This PR is not a user-facing change, so there's no changefile.

[jar-stripe]

Lotsa notes 😅 . I saw a couple of patterns around comments that could be cleaned up and checks for types/shapes that really should have been enforced by the type system. It's worth a cleanup pass and then another pass to see if theres anything else like this that i missed

[jar-stripe]

for a follow on ticket, its worth considering zod or runtypes for json validation here.

[jar-stripe]

this check feels unnecessary; the type will does not allow a string form