openai 6.44.0 → 6.45.0

package/src/providers/bedrock/aws.ts

@@ -0,0 +1,255 @@
+import { defaultProvider } from '@aws-sdk/credential-provider-node';
+import { Hash } from '@smithy/hash-node';
+import { SignatureV4 } from '@smithy/signature-v4';
+
+import * as Errors from '../../error';
+import type { BodyInit } from '../../internal/builtin-types';
+import {
+  assertProviderOwnsAuthorization,
+  errorWithCause,
+  normalizeOptionalString,
+  resolveBedrockBearerAuth,
+  resolveBedrockEndpoint,
+  type BedrockBearerOptions,
+  type BedrockEndpointOptions,
+  type BedrockRequestAuth,
+} from '../../internal/bedrock';
+import { createProvider, type Provider, type ProviderRequestContext } from '../../internal/provider';
+import type { FinalizedRequestInit } from '../../internal/types';
+
+const BEDROCK_SERVICE = 'bedrock-mantle';
+
+export interface AwsCredentialIdentity {
+  accessKeyId: string;
+  secretAccessKey: string;
+  sessionToken?: string;
+  expiration?: Date;
+}
+
+export type AwsCredentialsProvider = () => AwsCredentialIdentity | Promise<AwsCredentialIdentity>;
+
+export interface BedrockProviderOptions extends BedrockEndpointOptions, BedrockBearerOptions {
+  /** Explicit AWS access key ID. Must be paired with secretAccessKey. */
+  accessKeyId?: string | undefined;
+
+  /** Explicit AWS secret access key. Must be paired with accessKeyId. */
+  secretAccessKey?: string | undefined;
+
+  /** Optional session token for explicit temporary AWS credentials. */
+  sessionToken?: string | undefined;
+
+  /** Explicit AWS shared-config profile. */
+  profile?: string | undefined;
+
+  /** A refreshable provider returning AWS credentials. */
+  credentialProvider?: AwsCredentialsProvider | undefined;
+}
+
+function validateStaticCredentials(options: BedrockProviderOptions): AwsCredentialIdentity | undefined {
+  const hasAccessKey = options.accessKeyId !== undefined;
+  const hasSecretKey = options.secretAccessKey !== undefined;
+  if (hasAccessKey !== hasSecretKey || (options.sessionToken !== undefined && !hasAccessKey)) {
+    throw new Errors.OpenAIError(
+      'The `accessKeyId` and `secretAccessKey` options must be provided together. A `sessionToken` may only be used with both.',
+    );
+  }
+  if (!hasAccessKey) return undefined;
+
+  if (
+    typeof options.accessKeyId !== 'string' ||
+    !options.accessKeyId.trim() ||
+    typeof options.secretAccessKey !== 'string' ||
+    !options.secretAccessKey.trim()
+  ) {
+    throw new Errors.OpenAIError(
+      'Static AWS credentials require non-empty `accessKeyId` and `secretAccessKey` values.',
+    );
+  }
+  if (
+    options.sessionToken !== undefined &&
+    (typeof options.sessionToken !== 'string' || !options.sessionToken.trim())
+  ) {
+    throw new Errors.OpenAIError('A static AWS `sessionToken` must not be empty when provided.');
+  }
+
+  return {
+    accessKeyId: options.accessKeyId,
+    secretAccessKey: options.secretAccessKey,
+    ...(options.sessionToken ? { sessionToken: options.sessionToken } : {}),
+  };
+}
+
+function requestTarget(parsedURL: URL): { path: string; query: Record<string, string | string[]> } {
+  const query: Record<string, string | string[]> = {};
+  for (const [name, value] of parsedURL.searchParams) {
+    const existing = query[name];
+    query[name] =
+      existing === undefined ? value
+      : typeof existing === 'string' ? [existing, value]
+      : [...existing, value];
+  }
+  return { path: parsedURL.pathname, query };
+}
+
+function signableBody(body: BodyInit | null | undefined): string | ArrayBuffer | ArrayBufferView | undefined {
+  if (body === undefined || body === null) return undefined;
+  if (typeof body === 'string' || body instanceof ArrayBuffer || ArrayBuffer.isView(body)) return body;
+  throw new Errors.OpenAIError(
+    "The SDK's Bedrock SigV4 mode requires a replayable request body. Buffer the body before sending or use bearer authentication.",
+  );
+}
+
+function validateCredentialIdentity(identity: AwsCredentialIdentity): AwsCredentialIdentity {
+  if (
+    typeof identity?.accessKeyId !== 'string' ||
+    !identity.accessKeyId.trim() ||
+    typeof identity.secretAccessKey !== 'string' ||
+    !identity.secretAccessKey.trim() ||
+    (identity.sessionToken !== undefined &&
+      (typeof identity.sessionToken !== 'string' || !identity.sessionToken.trim()))
+  ) {
+    throw new Errors.OpenAIError(
+      'Failed to resolve AWS credentials for Bedrock. Verify your AWS profile, environment variables, or runtime identity configuration and try again.',
+    );
+  }
+  return identity;
+}
+
+class BedrockSigV4Auth implements BedrockRequestAuth {
+  private signer: SignatureV4 | undefined;
+  private resolvedCredentialsProvider: (() => Promise<AwsCredentialIdentity>) | undefined;
+
+  constructor(
+    private readonly options: {
+      region: string;
+      staticCredentials?: AwsCredentialIdentity | undefined;
+      profile?: string | undefined;
+      credentialProvider?: AwsCredentialsProvider | undefined;
+      usesDefaultChain: boolean;
+    },
+  ) {}
+
+  private credentialsProvider(): () => Promise<AwsCredentialIdentity> {
+    if (this.resolvedCredentialsProvider) return this.resolvedCredentialsProvider;
+
+    if (this.options.staticCredentials) {
+      const credentials = this.options.staticCredentials;
+      return (this.resolvedCredentialsProvider = async () => credentials);
+    }
+    if (this.options.credentialProvider) {
+      const provider = this.options.credentialProvider;
+      return (this.resolvedCredentialsProvider = async () => validateCredentialIdentity(await provider()));
+    }
+
+    const provider = defaultProvider(this.options.profile ? { profile: this.options.profile } : {});
+    return (this.resolvedCredentialsProvider = async () => validateCredentialIdentity(await provider()));
+  }
+
+  private signatureV4(): SignatureV4 {
+    return (this.signer ??= new SignatureV4({
+      credentials: this.credentialsProvider(),
+      region: this.options.region,
+      service: BEDROCK_SERVICE,
+      sha256: Hash.bind(null, 'sha256'),
+    }));
+  }
+
+  async prepareRequest(request: FinalizedRequestInit, { url }: ProviderRequestContext): Promise<void> {
+    if (Object.prototype.toString.call((globalThis as any).process) !== '[object process]') {
+      throw new Errors.OpenAIError(
+        'Bedrock AWS credential authentication is only supported in Node.js and compatible server runtimes. Use bearer authentication in this runtime.',
+      );
+    }
+
+    const parsedURL = new URL(url);
+    const canonicalRegion = /^bedrock-mantle\.([a-z0-9-]+)\.api\.aws$/i.exec(parsedURL.hostname)?.[1];
+    if (canonicalRegion && canonicalRegion !== this.options.region) {
+      throw new Errors.OpenAIError(
+        `The Bedrock endpoint region \`${canonicalRegion}\` does not match the SigV4 region \`${this.options.region}\`.`,
+      );
+    }
+
+    const headers = new Headers(request.headers);
+    assertProviderOwnsAuthorization(headers);
+    headers.delete('x-amz-date');
+    headers.delete('x-amz-security-token');
+    headers.delete('x-amz-content-sha256');
+    headers.set('host', parsedURL.host);
+
+    const method = (request.method ?? 'GET').toUpperCase();
+    const body = signableBody(request.body);
+
+    let signed: { headers: Record<string, string> };
+    try {
+      signed = await this.signatureV4().sign({
+        protocol: parsedURL.protocol,
+        hostname: parsedURL.hostname,
+        ...(parsedURL.port ? { port: Number(parsedURL.port) } : {}),
+        method,
+        ...requestTarget(parsedURL),
+        headers: Object.fromEntries(headers.entries()),
+        ...(body !== undefined ? { body } : {}),
+      });
+    } catch (cause) {
+      const message =
+        this.options.usesDefaultChain ?
+          'Could not find credentials for Bedrock. Pass AWS credentials to `bedrock(...)` or configure the default AWS credential chain.'
+        : 'Failed to resolve AWS credentials for Bedrock. Verify your AWS profile, environment variables, or runtime identity configuration and try again.';
+      throw errorWithCause(message, cause);
+    }
+
+    request.method = method;
+    request.redirect = 'manual';
+    request.headers = new Headers(signed.headers);
+  }
+}
+
+/** Configure the standard OpenAI client for Amazon Bedrock using bearer or AWS authentication. */
+export function bedrock(options: BedrockProviderOptions = {}): Provider {
+  const staticCredentials = validateStaticCredentials(options);
+  const profile = normalizeOptionalString(options.profile);
+  if (options.profile !== undefined && !profile) {
+    throw new Errors.OpenAIError('The Bedrock AWS `profile` must not be empty.');
+  }
+
+  const awsModes = [!!staticCredentials, !!profile, !!options.credentialProvider].filter(Boolean).length;
+  if (awsModes > 1) {
+    throw new Errors.OpenAIError(
+      'Bedrock authentication is ambiguous. Configure exactly one explicit AWS mode: static credentials, profile, or credential provider.',
+    );
+  }
+  const explicitAwsAuth = awsModes === 1;
+  const bearerAuth = resolveBedrockBearerAuth(options, { allowEnvironment: !explicitAwsAuth });
+  if (bearerAuth.explicit && explicitAwsAuth) {
+    throw new Errors.OpenAIError(
+      'Bearer and AWS credential authentication are mutually exclusive. Configure exactly one explicit mode: bearer credential, static AWS credentials, profile, or credential provider.',
+    );
+  }
+
+  const { region, baseURL } = resolveBedrockEndpoint(options);
+  if (!bearerAuth.factory && !region) {
+    throw new Errors.OpenAIError(
+      'Bedrock requires an AWS region. Pass `region` to `bedrock(...)`, or set `AWS_REGION` or `AWS_DEFAULT_REGION`.',
+    );
+  }
+  const credentialProvider = options.credentialProvider;
+
+  return createProvider({
+    configure() {
+      const auth =
+        bearerAuth.factory?.() ??
+        new BedrockSigV4Auth({
+          region: region!,
+          staticCredentials,
+          profile,
+          credentialProvider,
+          usesDefaultChain: !explicitAwsAuth,
+        });
+      return {
+        name: 'bedrock',
+        baseURL,
+        prepareRequest: auth.prepareRequest.bind(auth),
+      };
+    },
+  });
+}

package/src/providers/bedrock.ts

@@ -0,0 +1,33 @@
+import * as Errors from '../error';
+import type { Provider } from '../internal/provider';
+import { createProvider } from '../internal/provider';
+import {
+  resolveBedrockBearerAuth,
+  resolveBedrockEndpoint,
+  type BedrockBearerOptions,
+  type BedrockEndpointOptions,
+} from '../internal/bedrock';
+
+export interface BedrockProviderOptions extends BedrockEndpointOptions, BedrockBearerOptions {}
+
+/** Configure the standard OpenAI client for Amazon Bedrock using bearer authentication. */
+export function bedrock(options: BedrockProviderOptions = {}): Provider {
+  const { baseURL } = resolveBedrockEndpoint(options);
+  const { factory } = resolveBedrockBearerAuth(options);
+  if (!factory) {
+    throw new Errors.OpenAIError(
+      'Bedrock bearer authentication requires an `apiKey`, `tokenProvider`, or `AWS_BEARER_TOKEN_BEDROCK`. For AWS credential authentication, import `bedrock` from `openai/providers/bedrock/aws`.',
+    );
+  }
+
+  return createProvider({
+    configure() {
+      const auth = factory();
+      return {
+        name: 'bedrock',
+        baseURL,
+        prepareRequest: auth.prepareRequest.bind(auth),
+      };
+    },
+  });
+}

package/src/realtime/internal-base.ts

@@ -83,16 +83,99 @@ export function isAzure(client: Pick<OpenAI, 'apiKey' | 'baseURL'>): client is A
   return client instanceof AzureOpenAI;
 }
 
-export function buildRealtimeURL(client: Pick<OpenAI, 'apiKey' | 'baseURL'>, model: string): URL {
-  const path = '/realtime';
+export type RealtimeConnectionConfig =
+  | {
+      /**
+       * Start a new Realtime session using the given model.
+       */
+      model: string;
+      callID?: undefined;
+    }
+  | {
+      model?: undefined;
+      /**
+       * Attach to an in-progress Realtime call over a sideband control connection.
+       */
+      callID: string;
+    };
+
+export type AzureRealtimeConnectionConfig =
+  | {
+      /**
+       * Override the deployment configured on the Azure client.
+       */
+      deploymentName?: string;
+      callID?: undefined;
+    }
+  | {
+      deploymentName?: undefined;
+      /**
+       * Attach to an in-progress Azure Realtime call over a sideband control connection.
+       */
+      callID: string;
+    };
+
+export function buildRealtimeURL(
+  client: Pick<OpenAI, 'apiKey' | 'baseURL'>,
+  connection: string | RealtimeConnectionConfig,
+): URL {
+  const config: RealtimeConnectionConfig =
+    typeof connection === 'string' ? { model: connection } : connection;
   const baseURL = client.baseURL;
-  const url = new URL(baseURL + (baseURL.endsWith('/') ? path.slice(1) : path));
+  const azure = isAzure(client);
+  const hasModel = !!config.model;
+  const hasCallID = !!config.callID;
+
+  if (hasModel === hasCallID) {
+    throw new Error('Pass exactly one of `model` or `callID` when opening a Realtime WebSocket.');
+  }
+
+  let url: URL;
+  if (azure && hasCallID) {
+    url = new URL(baseURL);
+    const basePath = url.pathname.replace(/\/+/g, '/').replace(/\/+$/, '');
+    const versionedPath = basePath.endsWith('/v1') ? basePath : `${basePath}/v1`;
+    url.pathname = `${versionedPath}/realtime`;
+    url.search = '';
+    url.hash = '';
+  } else {
+    const path = '/realtime';
+    url = new URL(baseURL + (baseURL.endsWith('/') ? path.slice(1) : path));
+  }
+
   url.protocol = 'wss';
-  if (isAzure(client)) {
-    url.searchParams.set('api-version', client.apiVersion);
-    url.searchParams.set('deployment', model);
+  // Sideband control connections attach to an existing call via `call_id`.
+  if (azure) {
+    if (hasCallID) {
+      url.searchParams.set('call_id', config.callID!);
+    } else {
+      url.searchParams.set('api-version', client.apiVersion);
+      url.searchParams.set('deployment', config.model!);
+    }
   } else {
-    url.searchParams.set('model', model);
+    if (hasCallID) {
+      url.searchParams.set('call_id', config.callID!);
+    } else {
+      url.searchParams.set('model', config.model!);
+    }
   }
   return url;
 }
+
+export function getAzureRealtimeConnection(
+  client: Pick<AzureOpenAI, 'deploymentName'>,
+  connection: AzureRealtimeConnectionConfig,
+): RealtimeConnectionConfig {
+  if (connection.callID !== undefined) {
+    if (connection.deploymentName !== undefined) {
+      throw new Error('Pass either `deploymentName` or `callID`, but not both.');
+    }
+    return { callID: connection.callID };
+  }
+
+  const model = connection.deploymentName ?? client.deploymentName;
+  if (!model) {
+    throw new Error('No deployment name provided');
+  }
+  return { model };
+}

package/src/realtime/websocket.ts

@@ -1,7 +1,14 @@
 import { AzureOpenAI, OpenAI } from '../index';
 import { OpenAIError } from '../error';
 import type { RealtimeClientEvent, RealtimeServerEvent } from '../resources/realtime/realtime';
-import { OpenAIRealtimeEmitter, buildRealtimeURL, isAzure } from './internal-base';
+import {
+  OpenAIRealtimeEmitter,
+  buildRealtimeURL,
+  getAzureRealtimeConnection,
+  isAzure,
+  type AzureRealtimeConnectionConfig,
+  type RealtimeConnectionConfig,
+} from './internal-base';
 import { isRunningInBrowser } from '../internal/detect-platform';
 
 interface MessageEvent {
@@ -23,8 +30,7 @@ export class OpenAIRealtimeWebSocket extends OpenAIRealtimeEmitter {
   socket: _WebSocket;
 
   constructor(
-    props: {
-      model: string;
+    props: RealtimeConnectionConfig & {
       dangerouslyAllowBrowser?: boolean;
       /**
        * Callback to mutate the URL, needed for Azure.
@@ -54,13 +60,12 @@ export class OpenAIRealtimeWebSocket extends OpenAIRealtimeEmitter {
       throw new Error(
         [
           'Cannot open Realtime WebSocket with a function-based apiKey.',
-          'Use the .create() method so that the key is resolved before connecting:',
-          'await OpenAIRealtimeWebSocket.create(client, { model })',
+          'Use the .create() method so that the key is resolved before connecting.',
         ].join('\n'),
       );
     }
 
-    this.url = buildRealtimeURL(client, props.model);
+    this.url = buildRealtimeURL(client, props);
     props.onURL?.(this.url);
 
     // @ts-ignore
@@ -106,15 +111,16 @@ export class OpenAIRealtimeWebSocket extends OpenAIRealtimeEmitter {
 
   static async create(
     client: Pick<OpenAI, 'apiKey' | 'baseURL' | '_callApiKey'>,
-    props: { model: string; dangerouslyAllowBrowser?: boolean },
+    props: RealtimeConnectionConfig & { dangerouslyAllowBrowser?: boolean },
   ): Promise<OpenAIRealtimeWebSocket> {
     return new OpenAIRealtimeWebSocket({ ...props, __resolvedApiKey: await client._callApiKey() }, client);
   }
 
   static async azure(
     client: Pick<AzureOpenAI, '_callApiKey' | 'apiVersion' | 'apiKey' | 'baseURL' | 'deploymentName'>,
-    options: { deploymentName?: string; dangerouslyAllowBrowser?: boolean } = {},
+    options: AzureRealtimeConnectionConfig & { dangerouslyAllowBrowser?: boolean } = {},
   ): Promise<OpenAIRealtimeWebSocket> {
+    const connection = getAzureRealtimeConnection(client, options);
     const isApiKeyProvider = await client._callApiKey();
     const apiKey = client.apiKey;
     if (!apiKey) {
@@ -128,14 +134,10 @@ export class OpenAIRealtimeWebSocket extends OpenAIRealtimeEmitter {
         url.searchParams.set('api-key', azureApiKey);
       }
     }
-    const deploymentName = options.deploymentName ?? client.deploymentName;
-    if (!deploymentName) {
-      throw new Error('No deployment name provided');
-    }
     const { dangerouslyAllowBrowser } = options;
     return new OpenAIRealtimeWebSocket(
       {
-        model: deploymentName,
+        ...connection,
         onURL,
         ...(dangerouslyAllowBrowser ? { dangerouslyAllowBrowser } : {}),
         __resolvedApiKey: isApiKeyProvider,

package/src/realtime/ws.ts

@@ -1,15 +1,21 @@
 import * as WS from 'ws';
 import { AzureOpenAI, OpenAI } from '../index';
 import type { RealtimeClientEvent, RealtimeServerEvent } from '../resources/realtime/realtime';
-import { OpenAIRealtimeEmitter, buildRealtimeURL, isAzure } from './internal-base';
+import {
+  OpenAIRealtimeEmitter,
+  buildRealtimeURL,
+  getAzureRealtimeConnection,
+  isAzure,
+  type AzureRealtimeConnectionConfig,
+  type RealtimeConnectionConfig,
+} from './internal-base';
 
 export class OpenAIRealtimeWS extends OpenAIRealtimeEmitter {
   url: URL;
   socket: WS.WebSocket;
 
   constructor(
-    props: {
-      model: string;
+    props: RealtimeConnectionConfig & {
       options?: WS.ClientOptions | undefined;
       /** @internal */ __resolvedApiKey?: boolean;
     },
@@ -22,12 +28,11 @@ export class OpenAIRealtimeWS extends OpenAIRealtimeEmitter {
       throw new Error(
         [
           'Cannot open Realtime WebSocket with a function-based apiKey.',
-          'Use the .create() method so that the key is resolved before connecting:',
-          'await OpenAIRealtimeWS.create(client, { model })',
+          'Use the .create() method so that the key is resolved before connecting.',
         ].join('\n'),
       );
     }
-    this.url = buildRealtimeURL(client, props.model);
+    this.url = buildRealtimeURL(client, props);
     this.socket = new WS.WebSocket(this.url, {
       ...props.options,
       headers: {
@@ -65,27 +70,24 @@ export class OpenAIRealtimeWS extends OpenAIRealtimeEmitter {
 
   static async create(
     client: Pick<OpenAI, 'apiKey' | 'baseURL' | '_callApiKey'>,
-    props: { model: string; options?: WS.ClientOptions | undefined },
+    props: RealtimeConnectionConfig & { options?: WS.ClientOptions | undefined },
   ): Promise<OpenAIRealtimeWS> {
     return new OpenAIRealtimeWS({ ...props, __resolvedApiKey: await client._callApiKey() }, client);
   }
 
   static async azure(
     client: Pick<AzureOpenAI, '_callApiKey' | 'apiVersion' | 'apiKey' | 'baseURL' | 'deploymentName'>,
-    props: { deploymentName?: string; options?: WS.ClientOptions | undefined } = {},
+    props: AzureRealtimeConnectionConfig & { options?: WS.ClientOptions | undefined } = {},
   ): Promise<OpenAIRealtimeWS> {
+    const connection = getAzureRealtimeConnection(client, props);
     const isApiKeyProvider = await client._callApiKey();
     const apiKey = client.apiKey;
     if (!apiKey) {
       throw new Error('Azure OpenAI Realtime requires an API key');
     }
-    const deploymentName = props.deploymentName ?? client.deploymentName;
-    if (!deploymentName) {
-      throw new Error('No deployment name provided');
-    }
     return new OpenAIRealtimeWS(
       {
-        model: deploymentName,
+        ...connection,
         options: {
           ...props.options,
           headers: {

package/src/version.ts

@@ -1 +1 @@
-export const VERSION = '6.44.0'; // x-release-please-version
+export const VERSION = '6.45.0'; // x-release-please-version

package/version.d.mts

@@ -1,2 +1,2 @@
-export declare const VERSION = "6.44.0";
+export declare const VERSION = "6.45.0";
 //# sourceMappingURL=version.d.mts.map

package/version.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "6.44.0";
+export declare const VERSION = "6.45.0";
 //# sourceMappingURL=version.d.ts.map

package/version.js

@@ -1,5 +1,5 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.VERSION = void 0;
-exports.VERSION = '6.44.0'; // x-release-please-version
+exports.VERSION = '6.45.0'; // x-release-please-version
 //# sourceMappingURL=version.js.map

package/version.mjs

@@ -1,2 +1,2 @@
-export const VERSION = '6.44.0'; // x-release-please-version
+export const VERSION = '6.45.0'; // x-release-please-version
 //# sourceMappingURL=version.mjs.map