openai 6.44.0 → 6.46.0

package/src/beta/realtime/internal-base.ts

@@ -78,16 +78,54 @@ export function isAzure(client: Pick<OpenAI, 'apiKey' | 'baseURL'>): client is A
   return client instanceof AzureOpenAI;
 }
 
-export function buildRealtimeURL(client: Pick<OpenAI, 'apiKey' | 'baseURL'>, model: string): URL {
-  const path = '/realtime';
+export type RealtimeConnectionConfig =
+  | {
+      /**
+       * Start a new Realtime session using the given model.
+       */
+      model: string;
+      callID?: undefined;
+    }
+  | {
+      model?: undefined;
+      /**
+       * Attach to an in-progress Realtime call over a sideband control connection.
+       */
+      callID: string;
+    };
+
+export function buildRealtimeURL(
+  client: Pick<OpenAI, 'apiKey' | 'baseURL'>,
+  connection: string | RealtimeConnectionConfig,
+): URL {
+  const config: RealtimeConnectionConfig =
+    typeof connection === 'string' ? { model: connection } : connection;
   const baseURL = client.baseURL;
+  const azure = isAzure(client);
+  const hasModel = !!config.model;
+  const hasCallID = !!config.callID;
+
+  const path = '/realtime';
   const url = new URL(baseURL + (baseURL.endsWith('/') ? path.slice(1) : path));
+
+  if (hasModel === hasCallID) {
+    throw new Error('Pass exactly one of `model` or `callID` when opening a Realtime WebSocket.');
+  }
+
   url.protocol = 'wss';
-  if (isAzure(client)) {
+  // Sideband control connections attach to an existing call via `call_id`.
+  if (azure) {
+    if (hasCallID) {
+      throw new Error('Azure `callID` connections require the stable Realtime helpers.');
+    }
     url.searchParams.set('api-version', client.apiVersion);
-    url.searchParams.set('deployment', model);
+    url.searchParams.set('deployment', config.model!);
   } else {
-    url.searchParams.set('model', model);
+    if (hasCallID) {
+      url.searchParams.set('call_id', config.callID!);
+    } else {
+      url.searchParams.set('model', config.model!);
+    }
   }
   return url;
 }

package/src/beta/realtime/websocket.ts

@@ -1,7 +1,12 @@
 import { AzureOpenAI, OpenAI } from '../../index';
 import { OpenAIError } from '../../error';
 import type { RealtimeClientEvent, RealtimeServerEvent } from '../../resources/beta/realtime/realtime';
-import { OpenAIRealtimeEmitter, buildRealtimeURL, isAzure } from './internal-base';
+import {
+  OpenAIRealtimeEmitter,
+  buildRealtimeURL,
+  isAzure,
+  type RealtimeConnectionConfig,
+} from './internal-base';
 import { isRunningInBrowser } from '../../internal/detect-platform';
 
 interface MessageEvent {
@@ -23,8 +28,7 @@ export class OpenAIRealtimeWebSocket extends OpenAIRealtimeEmitter {
   socket: _WebSocket;
 
   constructor(
-    props: {
-      model: string;
+    props: RealtimeConnectionConfig & {
       dangerouslyAllowBrowser?: boolean;
       /**
        * Callback to mutate the URL, needed for Azure.
@@ -54,13 +58,12 @@ export class OpenAIRealtimeWebSocket extends OpenAIRealtimeEmitter {
       throw new Error(
         [
           'Cannot open Realtime WebSocket with a function-based apiKey.',
-          'Use the .create() method so that the key is resolved before connecting:',
-          'await OpenAIRealtimeWebSocket.create(client, { model })',
+          'Use the .create() method so that the key is resolved before connecting.',
         ].join('\n'),
       );
     }
 
-    this.url = buildRealtimeURL(client, props.model);
+    this.url = buildRealtimeURL(client, props);
     props.onURL?.(this.url);
 
     // @ts-ignore
@@ -107,7 +110,7 @@ export class OpenAIRealtimeWebSocket extends OpenAIRealtimeEmitter {
 
   static async create(
     client: Pick<OpenAI, 'apiKey' | 'baseURL' | '_callApiKey'>,
-    props: { model: string; dangerouslyAllowBrowser?: boolean },
+    props: RealtimeConnectionConfig & { dangerouslyAllowBrowser?: boolean },
   ): Promise<OpenAIRealtimeWebSocket> {
     return new OpenAIRealtimeWebSocket({ ...props, __resolvedApiKey: await client._callApiKey() }, client);
   }

package/src/beta/realtime/ws.ts

@@ -1,15 +1,19 @@
 import * as WS from 'ws';
 import { AzureOpenAI, OpenAI } from '../../index';
 import type { RealtimeClientEvent, RealtimeServerEvent } from '../../resources/beta/realtime/realtime';
-import { OpenAIRealtimeEmitter, buildRealtimeURL, isAzure } from './internal-base';
+import {
+  OpenAIRealtimeEmitter,
+  buildRealtimeURL,
+  isAzure,
+  type RealtimeConnectionConfig,
+} from './internal-base';
 
 export class OpenAIRealtimeWS extends OpenAIRealtimeEmitter {
   url: URL;
   socket: WS.WebSocket;
 
   constructor(
-    props: {
-      model: string;
+    props: RealtimeConnectionConfig & {
       options?: WS.ClientOptions | undefined;
       /** @internal */ __resolvedApiKey?: boolean;
     },
@@ -22,12 +26,11 @@ export class OpenAIRealtimeWS extends OpenAIRealtimeEmitter {
       throw new Error(
         [
           'Cannot open Realtime WebSocket with a function-based apiKey.',
-          'Use the .create() method so that the key is resolved before connecting:',
-          'await OpenAIRealtimeWS.create(client, { model })',
+          'Use the .create() method so that the key is resolved before connecting.',
         ].join('\n'),
       );
     }
-    this.url = buildRealtimeURL(client, props.model);
+    this.url = buildRealtimeURL(client, props);
     this.socket = new WS.WebSocket(this.url, {
       ...props.options,
       headers: {
@@ -66,7 +69,7 @@ export class OpenAIRealtimeWS extends OpenAIRealtimeEmitter {
 
   static async create(
     client: Pick<OpenAI, 'apiKey' | 'baseURL' | '_callApiKey'>,
-    props: { model: string; options?: WS.ClientOptions | undefined },
+    props: RealtimeConnectionConfig & { options?: WS.ClientOptions | undefined },
   ): Promise<OpenAIRealtimeWS> {
     return new OpenAIRealtimeWS({ ...props, __resolvedApiKey: await client._callApiKey() }, client);
   }

package/src/client.ts

@@ -233,6 +233,7 @@ import {
 import { type Fetch } from './internal/builtin-types';
 import { isRunningInBrowser } from './internal/detect-platform';
 import { HeadersLike, NullableHeaders, buildHeaders } from './internal/headers';
+import { configureProvider, type Provider, type ProviderRuntime } from './internal/provider';
 import { FinalRequestOptions, RequestOptions } from './internal/request-options';
 import { readEnv } from './internal/utils/env';
 import {
@@ -363,6 +364,12 @@ export interface ClientOptions {
    * Mutually exclusive with `apiKey`.
    */
   workloadIdentity?: WorkloadIdentity | undefined;
+
+  /**
+   * Configure this client to use a third-party API provider.
+   * Mutually exclusive with top-level authentication and `baseURL` options.
+   */
+  provider?: Provider | undefined;
 }
 
 /**
@@ -386,6 +393,7 @@ export class OpenAI {
   #encoder: Opts.RequestEncoder;
   protected idempotencyHeader?: string;
   protected _options: ClientOptions;
+  private _provider: ProviderRuntime | undefined;
   private _workloadIdentityAuth?: WorkloadIdentityAuth;
 
   /**
@@ -397,6 +405,7 @@ export class OpenAI {
    * @param {string | null | undefined} [opts.project=process.env['OPENAI_PROJECT_ID'] ?? null]
    * @param {string | null | undefined} [opts.webhookSecret=process.env['OPENAI_WEBHOOK_SECRET'] ?? null]
    * @param {string} [opts.baseURL=process.env['OPENAI_BASE_URL'] ?? https://api.openai.com/v1] - Override the default base URL for the API.
+   * @param {Provider} [opts.provider] - Configure a third-party API provider. Mutually exclusive with top-level authentication and base URL options.
    * @param {number} [opts.timeout=10 minutes] - The maximum amount of time (in milliseconds) the client will wait for a response before timing out.
    * @param {MergedRequestInit} [opts.fetchOptions] - Additional `RequestInit` options to be passed to `fetch` calls.
    * @param {Fetch} [opts.fetch] - Specify a custom `fetch` function implementation.
@@ -405,16 +414,32 @@ export class OpenAI {
    * @param {Record<string, string | undefined>} opts.defaultQuery - Default query parameters to include with every request to the API.
    * @param {boolean} [opts.dangerouslyAllowBrowser=false] - By default, client-side use of this library is not allowed, as it risks exposing your secret API credentials to attackers.
    */
-  constructor({
-    baseURL = readEnv('OPENAI_BASE_URL'),
-    apiKey = readEnv('OPENAI_API_KEY') ?? null,
-    adminAPIKey = readEnv('OPENAI_ADMIN_KEY') ?? null,
-    organization = readEnv('OPENAI_ORG_ID') ?? null,
-    project = readEnv('OPENAI_PROJECT_ID') ?? null,
-    webhookSecret = readEnv('OPENAI_WEBHOOK_SECRET') ?? null,
-    workloadIdentity,
-    ...opts
-  }: ClientOptions = {}) {
+  constructor(clientOptions: ClientOptions = {}) {
+    const provider = clientOptions.provider;
+    if (provider) {
+      const conflictingOptions = (['apiKey', 'adminAPIKey', 'workloadIdentity', 'baseURL'] as const).filter(
+        (key) => clientOptions[key] != null,
+      );
+      if (conflictingOptions.length) {
+        throw new Errors.OpenAIError(
+          `The \`provider\` option cannot be used with ${conflictingOptions
+            .map((key) => `\`${key}\``)
+            .join(', ')}. Configure authentication and the base URL through the provider instead.`,
+        );
+      }
+    }
+
+    const {
+      baseURL = provider ? null : readEnv('OPENAI_BASE_URL'),
+      apiKey = provider ? null : readEnv('OPENAI_API_KEY') ?? null,
+      adminAPIKey = provider ? null : readEnv('OPENAI_ADMIN_KEY') ?? null,
+      organization = provider ? null : readEnv('OPENAI_ORG_ID') ?? null,
+      project = provider ? null : readEnv('OPENAI_PROJECT_ID') ?? null,
+      webhookSecret = readEnv('OPENAI_WEBHOOK_SECRET') ?? null,
+      workloadIdentity,
+      ...opts
+    } = clientOptions;
+    const providerRuntime = provider ? configureProvider(provider) : undefined;
     const options: ClientOptions = {
       apiKey,
       adminAPIKey,
@@ -422,15 +447,16 @@ export class OpenAI {
       project,
       webhookSecret,
       workloadIdentity,
+      provider,
       ...opts,
-      baseURL: baseURL || `https://api.openai.com/v1`,
+      baseURL: providerRuntime?.baseURL ?? (baseURL || `https://api.openai.com/v1`),
     };
 
     if (apiKey && workloadIdentity) {
       throw new Errors.OpenAIError('The `apiKey` and `workloadIdentity` options are mutually exclusive');
     }
 
-    if (!apiKey && !adminAPIKey && !workloadIdentity) {
+    if (!providerRuntime && !apiKey && !adminAPIKey && !workloadIdentity) {
       throw new Errors.OpenAIError(
         'Missing credentials. Please pass an `apiKey`, `workloadIdentity`, `adminAPIKey`, or set the `OPENAI_API_KEY` or `OPENAI_ADMIN_KEY` environment variable.',
       );
@@ -457,7 +483,7 @@ export class OpenAI {
     this.fetch = options.fetch ?? Shims.getDefaultFetch();
     this.#encoder = Opts.FallbackEncoder;
 
-    const customHeadersEnv = readEnv('OPENAI_CUSTOM_HEADERS');
+    const customHeadersEnv = provider ? undefined : readEnv('OPENAI_CUSTOM_HEADERS');
     if (customHeadersEnv) {
       const parsed: Record<string, string> = {};
       for (const line of customHeadersEnv.split('\n')) {
@@ -470,6 +496,7 @@ export class OpenAI {
     }
 
     this._options = options;
+    this._provider = providerRuntime;
 
     if (workloadIdentity) {
       this._workloadIdentityAuth = new WorkloadIdentityAuth(workloadIdentity, this.fetch);
@@ -486,7 +513,9 @@ export class OpenAI {
    * Create a new client instance re-using the same options given to the current client with optional overriding.
    */
   withOptions(options: Partial<ClientOptions>): this {
-    const client = new (this.constructor as any as new (props: ClientOptions) => typeof this)({
+    const inheritedProvider = this._options.provider;
+    const provider = options.provider ?? inheritedProvider;
+    const inheritedOptions: ClientOptions = {
       ...this._options,
       baseURL: this.baseURL,
       maxRetries: this.maxRetries,
@@ -501,7 +530,23 @@ export class OpenAI {
       organization: this.organization,
       project: this.project,
       webhookSecret: this.webhookSecret,
+    };
+    if (provider) {
+      delete inheritedOptions.apiKey;
+      delete inheritedOptions.adminAPIKey;
+      delete inheritedOptions.workloadIdentity;
+      delete inheritedOptions.baseURL;
+      if (provider !== inheritedProvider) {
+        delete inheritedOptions.organization;
+        delete inheritedOptions.project;
+        delete inheritedOptions.defaultHeaders;
+      }
+    }
+
+    const client = new (this.constructor as any as new (props: ClientOptions) => typeof this)({
+      ...inheritedOptions,
       ...options,
+      provider,
     });
     return client;
   }
@@ -510,7 +555,7 @@ export class OpenAI {
    * Check whether the base URL is set to its default.
    */
   #baseURLOverridden(): boolean {
-    return this.baseURL !== 'https://api.openai.com/v1';
+    return this._provider !== undefined || this.baseURL !== 'https://api.openai.com/v1';
   }
 
   protected defaultQuery(): Record<string, string | undefined> | undefined {
@@ -592,6 +637,8 @@ export class OpenAI {
   }
 
   async _callApiKey(): Promise<boolean> {
+    if (this._provider) return false;
+
     const apiKey = this._options.apiKey;
     if (typeof apiKey !== 'function') return false;
 
@@ -644,6 +691,8 @@ export class OpenAI {
    * Used as a callback for mutating the given `FinalRequestOptions` object.
    */
   protected async prepareOptions(options: FinalRequestOptions): Promise<void> {
+    if (this._provider) return;
+
     const security = options.__security ?? { bearerAuth: true };
     if (security.bearerAuth) {
       await this._callApiKey();
@@ -718,6 +767,7 @@ export class OpenAI {
     });
 
     await this.prepareRequest(req, { url, options });
+    await this._provider?.prepareRequest?.(req, { url, options });
 
     /** Not an API request ID, just for correlating local log entries. */
     const requestLogID = 'log_' + ((Math.random() * (1 << 24)) | 0).toString(16).padStart(6, '0');
@@ -1115,13 +1165,17 @@ export class OpenAI {
         'OpenAI-Organization': this.organization,
         'OpenAI-Project': this.project,
       },
-      await this.authHeaders(options, options.__security ?? { bearerAuth: true }),
+      this._provider ? undefined : (
+        await this.authHeaders(options, options.__security ?? { bearerAuth: true })
+      ),
       this._options.defaultHeaders,
       bodyHeaders,
       options.headers,
     ]);
 
-    this.validateHeaders(headers, options.__security ?? { bearerAuth: true });
+    if (!this._provider) {
+      this.validateHeaders(headers, options.__security ?? { bearerAuth: true });
+    }
 
     return headers.values;
   }
@@ -1132,12 +1186,20 @@ export class OpenAI {
     return () => controller.abort();
   }
 
-  private buildBody({ options: { body, headers: rawHeaders } }: { options: FinalRequestOptions }): {
+  private buildBody({ options }: { options: FinalRequestOptions }): {
     bodyHeaders: HeadersLike;
     body: BodyInit | undefined;
     isStreamingBody: boolean;
   } {
+    const { body, headers: rawHeaders } = options;
     if (!body) {
+      // A resource method always passes a `body` key when its operation defines a
+      // request body, even if the caller omitted an optional body param. Keep the
+      // content-type for those, and only elide it for operations with no body at
+      // all (e.g. GET/DELETE).
+      if (body === undefined && 'body' in options) {
+        return { ...this.#encoder({ body, headers: buildHeaders([rawHeaders]) }), isStreamingBody: false };
+      }
       return { bodyHeaders: undefined, body: undefined, isStreamingBody: false };
     }
     const headers = buildHeaders([rawHeaders]);

package/src/helpers/audio.ts

@@ -1,5 +1,6 @@
 import { spawn } from 'node:child_process';
-import { Readable } from 'node:stream';
+import { pipeline, Readable } from 'node:stream';
+import type { ReadableStream as NodeReadableStream } from 'node:stream/web';
 import { platform, versions } from 'node:process';
 import { checkFileSupport } from '../internal/uploads';
 
@@ -36,14 +37,27 @@ async function nodejsPlayAudio(stream: NodeJS.ReadableStream | Response | File):
     try {
       const ffplay = spawn('ffplay', ['-autoexit', '-nodisp', '-i', 'pipe:0']);
 
+      let source: NodeJS.ReadableStream;
       if (isResponse(stream)) {
-        (stream.body! as any).pipe(ffplay.stdin);
+        const body = stream.body! as NodeReadableStream | NodeJS.ReadableStream;
+        if ('pipe' in body && typeof body.pipe === 'function') {
+          source = body;
+        } else {
+          source = Readable.fromWeb(body as NodeReadableStream);
+        }
       } else if (isFile(stream)) {
-        Readable.from(stream.stream()).pipe(ffplay.stdin);
+        source = Readable.from(stream.stream());
       } else {
-        stream.pipe(ffplay.stdin);
+        source = stream;
       }
 
+      pipeline(source, ffplay.stdin, (error) => {
+        if (error) {
+          ffplay.kill();
+          reject(error);
+        }
+      });
+
       ffplay.on('close', (code: number) => {
         if (code !== 0) {
           reject(new Error(`ffplay process exited with code ${code}`));

package/src/helpers/zod.ts

@@ -34,6 +34,22 @@ function zodV4ToJsonSchema(schema: z4.ZodType): Record<string, unknown> {
   return toStrictJsonSchema(
     z4.toJSONSchema(schema, {
       target: 'draft-7',
+      override: ({ zodSchema, jsonSchema }) => {
+        const def = zodSchema._zod.def;
+
+        if (def.type === 'union' && 'discriminator' in def && Array.isArray(jsonSchema.oneOf)) {
+          if (jsonSchema.anyOf !== undefined) {
+            throw new Error(
+              'Zod discriminated union generated both `anyOf` and `oneOf`, which cannot be represented in an OpenAI strict schema',
+            );
+          }
+
+          // Discriminator values are mutually exclusive, so anyOf preserves the
+          // union while staying inside the API's supported JSON Schema subset.
+          jsonSchema.anyOf = jsonSchema.oneOf;
+          delete jsonSchema.oneOf;
+        }
+      },
     }) as JSONSchema,
   ) as Record<string, unknown>;
 }

package/src/internal/bedrock.ts

@@ -0,0 +1,153 @@
+import * as Errors from '../error';
+import type { ApiKeySetter } from '../client';
+import type { FinalizedRequestInit } from './types';
+import type { ProviderRequestContext } from './provider';
+import { readEnv } from './utils';
+
+export interface BedrockEndpointOptions {
+  /** AWS region used to derive the default Mantle endpoint. */
+  region?: string | undefined;
+
+  /** Bedrock API root. Defaults to AWS_BEDROCK_BASE_URL or the regional Mantle endpoint. */
+  baseURL?: string | null | undefined;
+}
+
+export interface BedrockBearerOptions {
+  /** Explicit Bedrock bearer credential. Set to null to skip the environment bearer fallback. */
+  apiKey?: string | null | undefined;
+
+  /** A function that resolves a Bedrock bearer credential before every request attempt. */
+  tokenProvider?: ApiKeySetter | undefined;
+}
+
+export interface BedrockRequestAuth {
+  prepareRequest(request: FinalizedRequestInit, context: ProviderRequestContext): void | Promise<void>;
+}
+
+export type BedrockAuthFactory = () => BedrockRequestAuth;
+
+export function errorWithCause(message: string, cause: unknown): Errors.OpenAIError {
+  const error = new Errors.OpenAIError(message) as Errors.OpenAIError & { cause?: unknown };
+  error.cause = cause;
+  return error;
+}
+
+export function normalizeOptionalString(value: string | null | undefined): string | undefined {
+  const normalized = typeof value === 'string' ? value.trim() : undefined;
+  return normalized ? normalized : undefined;
+}
+
+function normalizeBaseURL(baseURL: string): string {
+  const url = new URL(baseURL);
+  const responsesMatch = url.pathname.match(/\/responses(?:\/.*)?$/);
+  if (responsesMatch?.index !== undefined) {
+    url.pathname = url.pathname.slice(0, responsesMatch.index) || '/';
+  }
+  return url.toString().replace(/\/$/, '');
+}
+
+export function resolveBedrockEndpoint(options: BedrockEndpointOptions): {
+  region: string | undefined;
+  baseURL: string;
+} {
+  if (options.region !== undefined && !normalizeOptionalString(options.region)) {
+    throw new Errors.OpenAIError('The Bedrock AWS `region` must not be empty.');
+  }
+  if (
+    options.baseURL !== undefined &&
+    options.baseURL !== null &&
+    !normalizeOptionalString(options.baseURL)
+  ) {
+    throw new Errors.OpenAIError('The Bedrock `baseURL` must not be empty.');
+  }
+
+  const region =
+    normalizeOptionalString(options.region) ??
+    normalizeOptionalString(readEnv('AWS_REGION')) ??
+    normalizeOptionalString(readEnv('AWS_DEFAULT_REGION'));
+  const configuredBaseURL =
+    options.baseURL === undefined ? normalizeOptionalString(readEnv('AWS_BEDROCK_BASE_URL'))
+    : options.baseURL === null ? undefined
+    : normalizeOptionalString(options.baseURL);
+
+  if (configuredBaseURL) return { region, baseURL: normalizeBaseURL(configuredBaseURL) };
+  if (!region) {
+    throw new Errors.OpenAIError(
+      'Bedrock requires an AWS region. Pass `region` to `bedrock(...)`, or set `AWS_REGION` or `AWS_DEFAULT_REGION`.',
+    );
+  }
+  return { region, baseURL: `https://bedrock-mantle.${region}.api.aws/openai/v1` };
+}
+
+export function assertProviderOwnsAuthorization(headers: Headers): void {
+  if (headers.has('authorization')) {
+    throw new Errors.OpenAIError(
+      'Bedrock provider authentication cannot be combined with a custom `Authorization` header.',
+    );
+  }
+}
+
+class BedrockBearerAuth implements BedrockRequestAuth {
+  constructor(private readonly tokenProvider: ApiKeySetter) {}
+
+  async prepareRequest(request: FinalizedRequestInit, _context: ProviderRequestContext): Promise<void> {
+    const headers = new Headers(request.headers);
+    assertProviderOwnsAuthorization(headers);
+
+    let token: unknown;
+    try {
+      token = await this.tokenProvider();
+    } catch (cause) {
+      throw errorWithCause('Failed to resolve a bearer credential for Bedrock.', cause);
+    }
+    if (typeof token !== 'string' || !token.trim()) {
+      throw new Errors.OpenAIError('The Bedrock bearer credential provider must return a non-empty string.');
+    }
+    headers.set('authorization', `Bearer ${token}`);
+    request.headers = headers;
+  }
+}
+
+export function resolveBedrockBearerAuth(
+  options: BedrockBearerOptions,
+  { allowEnvironment = true }: { allowEnvironment?: boolean } = {},
+): { factory: BedrockAuthFactory | undefined; explicit: boolean } {
+  if (
+    options.apiKey !== undefined &&
+    options.apiKey !== null &&
+    (typeof options.apiKey !== 'string' || !options.apiKey.trim())
+  ) {
+    throw new Errors.OpenAIError('The Bedrock bearer credential must not be empty.');
+  }
+  if (options.apiKey != null && options.tokenProvider) {
+    throw new Errors.OpenAIError(
+      'The `apiKey` and `tokenProvider` options are mutually exclusive. Configure only one.',
+    );
+  }
+
+  if (options.tokenProvider) {
+    const tokenProvider = options.tokenProvider;
+    return { factory: () => new BedrockBearerAuth(tokenProvider), explicit: true };
+  }
+  if (options.apiKey != null) {
+    const apiKey = options.apiKey;
+    return { factory: () => new BedrockBearerAuth(async () => apiKey), explicit: true };
+  }
+  if (allowEnvironment && options.apiKey !== null && readEnv('AWS_BEARER_TOKEN_BEDROCK')) {
+    return {
+      explicit: false,
+      factory: () =>
+        new BedrockBearerAuth(async () => {
+          const token = readEnv('AWS_BEARER_TOKEN_BEDROCK');
+          if (!token) {
+            throw new Errors.OpenAIError(
+              'Could not find credentials for Bedrock. Set `AWS_BEARER_TOKEN_BEDROCK` or configure AWS credential authentication.',
+            );
+          }
+          return token;
+        }),
+    };
+  }
+
+  return { factory: undefined, explicit: false };
+}

package/src/internal/provider.ts

@@ -0,0 +1,60 @@
+import type { FinalRequestOptions } from './request-options';
+import type { FinalizedRequestInit } from './types';
+
+declare const providerBrand: unique symbol;
+
+/** An opaque provider configuration created by {@link createProvider}. */
+export interface Provider {
+  readonly [providerBrand]: true;
+}
+
+export interface ProviderRequestContext {
+  url: string;
+  options: FinalRequestOptions;
+}
+
+export interface ProviderRuntime {
+  name: string;
+  baseURL: string;
+  prepareRequest?(request: FinalizedRequestInit, context: ProviderRequestContext): void | Promise<void>;
+}
+
+export interface ProviderDefinition {
+  configure(): ProviderRuntime;
+}
+
+/**
+ * A provider factory such as `bedrock(options)` captures configuration in a
+ * definition, while every OpenAI client receives a fresh runtime from
+ * `definition.configure()`. Keeping definitions out of the provider object
+ * makes providers opaque and prevents arbitrary objects from imitating one.
+ * It also leaves provider-specific dependencies outside the core SDK.
+ *
+ * The registry lives on `globalThis` under a global symbol so a provider made
+ * by one copy of the package still works with another copy, including mixed
+ * CommonJS and ESM installations. The WeakMap avoids retaining discarded
+ * provider configurations.
+ */
+const providerDefinitionsKey = Symbol.for('openai.node.providerDefinitions.v1');
+const providerGlobal = globalThis as any;
+const existingProviderDefinitions = providerGlobal[providerDefinitionsKey] as
+  | WeakMap<Provider, ProviderDefinition>
+  | undefined;
+const providerDefinitions = existingProviderDefinitions ?? new WeakMap<Provider, ProviderDefinition>();
+if (!existingProviderDefinitions) {
+  Object.defineProperty(providerGlobal, providerDefinitionsKey, { value: providerDefinitions });
+}
+
+export function createProvider(definition: ProviderDefinition): Provider {
+  const provider = Object.freeze({}) as Provider;
+  providerDefinitions.set(provider, definition);
+  return provider;
+}
+
+export function configureProvider(provider: Provider): ProviderRuntime {
+  const definition = providerDefinitions.get(provider);
+  if (!definition) {
+    throw new Error('Invalid provider. Providers must be created with createProvider().');
+  }
+  return definition.configure();
+}

package/src/internal/utils/log.ts

@@ -109,6 +109,7 @@ export const formatRequestDetails = (details: {
             name.toLowerCase() === 'authorization' ||
             name.toLowerCase() === 'api-key' ||
             name.toLowerCase() === 'x-api-key' ||
+            name.toLowerCase() === 'x-amz-security-token' ||
             name.toLowerCase() === 'cookie' ||
             name.toLowerCase() === 'set-cookie'
           ) ?