This is a Go library implementing the SPIFFE Workload API for workload identity management and secure communication. It provides client libraries to fetch X.509-SVIDs, JWT-SVIDs, and trust bundles from a Workload API agent (typically SPIRE). The library offers high-level TLS dial/listen functions (spiffetls) with various authentication modes (mTLS, TLS with JWT), supporting both Unix sockets and Windows named pipes. Core packages include spiffeid (SPIFFE ID parsing and matching), svid (SVID parsing and validation), bundle (trust bundle management), workloadapi (Workload API client and credential source watchers), and federation (remote trust domain bundle fetching). The architecture is modular with clear interfaces (Source, Authorizer, Logger, Backoff) that allow swapping backends. The code is well-tested with extensive unit tests and integration test helpers. Experimental features include WIT-SVIDs and a Broker API. This library is a critical component for any workload that needs SPIFFE-based identity in a zero-trust environment.