openai 7.15.0 → 7.17.0

package/src/providers/bedrock/aws.ts

@@ -96,11 +96,12 @@ function validateStaticCredentials(options: BedrockProviderOptions): AwsCredenti
   return {
     accessKeyId: options.accessKeyId,
     secretAccessKey: options.secretAccessKey,
+    // Spread creates an own data property without invoking inherited setters or changing the object prototype.
     ...(options.sessionToken ? { sessionToken: options.sessionToken } : {}),
   };
 }
 
-function requestTarget(parsedURL: URL): { path: string; query: Record<string, string | string[]> } {
+function requestTarget(parsedURL: URL) {
   const query: Record<string, string | string[]> = Object.create(null);
   for (const [name, value] of parsedURL.searchParams) {
     if (name === '__proto__') {
@@ -195,6 +196,7 @@ class BedrockSigV4Auth implements BedrockRequestAuth {
   }
 
   async prepareRequest(request: FinalizedRequestInit, context: ProviderRequestContext): Promise<void> {
+    // SAFETY: process is optional outside Node; the native process tag is checked before using Node-specific signing and credential behavior.
     if (Object.prototype.toString.call((globalThis as any).process) !== '[object process]') {
       throw new Errors.OpenAIError(
         'Bedrock AWS credential authentication is only supported in Node.js and compatible server runtimes. Use bearer authentication in this runtime.',
@@ -230,10 +232,12 @@ class BedrockSigV4Auth implements BedrockRequestAuth {
         this.signatureV4().sign({
           protocol: parsedURL.protocol,
           hostname: parsedURL.hostname,
+          // Spread creates an own data property without invoking inherited setters or changing the object prototype.
           ...(parsedURL.port ? { port: Number(parsedURL.port) } : {}),
           method,
           ...target,
           headers: Object.fromEntries(headers.entries()),
+          // Spread creates an own data property without invoking inherited setters or changing the object prototype.
           ...(body === undefined ? {} : { body }),
         }),
       failureMessage: this.options.usesDefaultChain

package/src/realtime/internal-base.ts

@@ -13,6 +13,7 @@ import { assertX509WebSocketSupported } from '../internal/auth/x509-workload-ide
 /** Parses frame data without exposing malformed payloads through JSON syntax errors. */
 export function parseRealtimeEvent(data: string): RealtimeServerEvent {
   try {
+    // SAFETY: RealtimeServerEvent is the API wire contract; JSON syntax is checked here while future event types remain accepted at runtime.
     return JSON.parse(data) as RealtimeServerEvent;
   } catch (error) {
     if (error instanceof SyntaxError) {
@@ -87,6 +88,7 @@ type RealtimeEvents = Simplify<
           type: EventType;
         }
       >,
+      // oxlint-disable-next-line anti-slop/no-unknown-returns -- Preserve the published event-callback contract, which accepts and ignores arbitrary return values.
     ) => unknown;
   }
 >;

package/src/realtime/websocket.ts

@@ -43,6 +43,7 @@ function isRunningInBrowserOrBrowserWorker(): boolean {
     return true;
   }
 
+  // SAFETY: RuntimeScope describes optional host capabilities; the following predicates verify their presence and value before use.
   const scope = globalThis as RuntimeScope;
   return (
     typeof scope.WorkerGlobalScope === 'function' &&
@@ -61,6 +62,7 @@ function isRunningInBrowserOrBrowserWorker(): boolean {
 
 /** Reports whether the runtime supports request headers in native WebSocket options. */
 function supportsWebSocketRequestHeaders(): boolean {
+  // SAFETY: RuntimeScope describes optional host capabilities; the following predicates verify their presence and value before use.
   const scope = globalThis as RuntimeScope;
   if (
     isRunningInBrowserOrBrowserWorker() ||
@@ -183,7 +185,9 @@ export class OpenAIRealtimeWebSocket extends OpenAIRealtimeEmitter {
   ) {
     super();
     let apiKey = getRealtimeAPIKey(client, props.__apiKey);
+    // SAFETY: The supplied OpenAI client owns _options; these compatibility reads preserve its provider and browser-consent settings.
     const hasProvider = typeof (client as any)?._options?.apiKey === 'function';
+    // SAFETY: The supplied OpenAI client owns _options; these compatibility reads preserve its provider and browser-consent settings.
     const dangerouslyAllowBrowser =
       props.dangerouslyAllowBrowser ??
       (client as any)?._options?.dangerouslyAllowBrowser ??
@@ -257,7 +261,12 @@ export class OpenAIRealtimeWebSocket extends OpenAIRealtimeEmitter {
     });
 
     this.socket.addEventListener('error', (event: any) => {
-      this._onError(null, event.message, null);
+      // Native ErrorEvents can carry an empty message while `error` still holds the failure.
+      const cause = event.error ?? null;
+      const message = [event.message, cause?.message].find(
+        (value) => typeof value === 'string' && value !== '',
+      );
+      this._onError(null, message ?? 'unknown error', cause);
     });
   }
 
@@ -317,6 +326,7 @@ export class OpenAIRealtimeWebSocket extends OpenAIRealtimeEmitter {
     return new OpenAIRealtimeWebSocket(
       {
         ...connection,
+        // Preserve explicit browser consent as an own data property without invoking an inherited setter.
         ...(dangerouslyAllowBrowser === undefined ? {} : { dangerouslyAllowBrowser }),
         __resolvedApiKey: isApiKeyProvider,
         __apiKey: apiKey,

package/src/realtime/ws.ts

@@ -55,6 +55,7 @@ export class OpenAIRealtimeWS extends OpenAIRealtimeEmitter {
     super();
     client ??= new OpenAI();
     const apiKey = props.__apiKey === undefined ? client.apiKey : props.__apiKey;
+    // SAFETY: The supplied OpenAI client owns _options; this read detects its existing API-key provider without changing its public surface.
     const hasProvider = typeof (client as any)?._options?.apiKey === 'function';
     if (hasProvider && !props.__resolvedApiKey) {
       throw new Error(
@@ -69,6 +70,7 @@ export class OpenAIRealtimeWS extends OpenAIRealtimeEmitter {
     const headers = {
       'User-Agent': `${client.constructor.name}/JS ${VERSION}`,
       ...props.options?.headers,
+      // A credential must be an own data property without invoking an inherited setter.
       ...(isAzure(client) && !props.__resolvedApiKey ? {} : { Authorization: `Bearer ${apiKey}` }),
     };
 
@@ -178,6 +180,7 @@ export class OpenAIRealtimeWS extends OpenAIRealtimeEmitter {
           ...props.options,
           headers: {
             ...props.options?.headers,
+            // A credential must be an own data property without invoking an inherited setter.
             ...(isApiKeyProvider ? {} : { 'api-key': apiKey }),
           },
         },

package/src/resources/beta/agents/agents.ts

@@ -4048,6 +4048,7 @@ export interface SessionTurnError {
    * - `session_budget_exceeded` - The session has reached its usage budget.
    * - `usage_limit_exceeded` - The organization has reached a usage, plan, or
    *   billing limit.
+   * - `credit_balance_exhausted` - The organization has no API credits remaining.
    * - `rate_limit_exceeded` - The request exceeds the available rate limit.
    * - `server_overloaded` - The model service is temporarily overloaded.
    * - `cyber_policy` - The request was rejected by a safety policy.
@@ -4070,6 +4071,7 @@ export interface SessionTurnError {
     | 'context_length_exceeded'
     | 'session_budget_exceeded'
     | 'usage_limit_exceeded'
+    | 'credit_balance_exhausted'
     | 'rate_limit_exceeded'
     | 'server_overloaded'
     | 'cyber_policy'

package/src/resources/beta/beta.ts

@@ -217,6 +217,7 @@ import {
   BetaResponseCodeInterpreterCallInProgressEvent,
   BetaResponseCodeInterpreterCallInterpretingEvent,
   BetaResponseCodeInterpreterToolCall,
+  BetaResponseCompactionCompactingEvent,
   BetaResponseCompactionItem,
   BetaResponseCompactionItemParam,
   BetaResponseCompletedEvent,
@@ -588,6 +589,7 @@ export declare namespace Beta {
     type BetaResponseCodeInterpreterCallInProgressEvent as BetaResponseCodeInterpreterCallInProgressEvent,
     type BetaResponseCodeInterpreterCallInterpretingEvent as BetaResponseCodeInterpreterCallInterpretingEvent,
     type BetaResponseCodeInterpreterToolCall as BetaResponseCodeInterpreterToolCall,
+    type BetaResponseCompactionCompactingEvent as BetaResponseCompactionCompactingEvent,
     type BetaResponseCompactionItem as BetaResponseCompactionItem,
     type BetaResponseCompactionItemParam as BetaResponseCompactionItemParam,
     type BetaResponseCompletedEvent as BetaResponseCompletedEvent,

package/src/resources/beta/index.ts

@@ -165,6 +165,7 @@ export {
   type BetaResponseCodeInterpreterCallInProgressEvent,
   type BetaResponseCodeInterpreterCallInterpretingEvent,
   type BetaResponseCodeInterpreterToolCall,
+  type BetaResponseCompactionCompactingEvent,
   type BetaResponseCompactionItem,
   type BetaResponseCompactionItemParam,
   type BetaResponseCompletedEvent,

package/src/resources/beta/responses/index.ts

@@ -40,6 +40,7 @@ export {
   type BetaResponseCodeInterpreterCallInProgressEvent,
   type BetaResponseCodeInterpreterCallInterpretingEvent,
   type BetaResponseCodeInterpreterToolCall,
+  type BetaResponseCompactionCompactingEvent,
   type BetaResponseCompactionItem,
   type BetaResponseCompactionItemParam,
   type BetaResponseCompletedEvent,

package/src/resources/beta/responses/internal-base.ts

@@ -27,13 +27,21 @@ type WebSocketErrorEvent = Extract<ResponsesAPI.BetaResponsesServerEvent, { type
 export class WebSocketError extends OpenAIError {
   /**
    * The error data that the API sent back in an error event.
+   *
+   * This property is non-enumerable to avoid exposing the event through
+   * JSON serialization, object spread, or Object.assign.
    */
   error?: WebSocketErrorEvent | undefined;
 
   constructor(message: string, event: WebSocketErrorEvent | null) {
     super(message);
 
-    this.error = event ?? undefined;
+    Object.defineProperty(this, 'error', {
+      value: event ?? undefined,
+      writable: true,
+      configurable: true,
+      enumerable: false,
+    });
   }
 }
 
@@ -77,8 +85,8 @@ export abstract class ResponsesEmitter extends EventEmitter<WebSocketEvents> {
   protected _onError(event: null, message: string, cause: any): void;
   protected _onError(event: WebSocketErrorEvent, message?: string | undefined): void;
   protected _onError(event: WebSocketErrorEvent | null, message?: string | undefined, cause?: any): void {
-    const eventMessage = event && ('error' in event ? event.error?.message : event.message);
-    message = message ?? eventMessage ?? safeJSONStringify(event) ?? 'unknown error';
+    const safeMessage = safeWebSocketErrorMessage(event, message);
+    message = safeMessage ?? 'unknown error';
 
     if (!this._hasListener('error')) {
       const error = new WebSocketError(
@@ -109,10 +117,20 @@ export function buildURL(client: OpenAI, parameters: Record<string, unknown>): U
   return url;
 }
 
-function safeJSONStringify(value: unknown): string | null {
+function safeWebSocketErrorMessage(event: unknown, message: unknown): string | undefined {
+  if (typeof message === 'string') return message;
+  if (typeof event !== 'object' || event === null) return undefined;
+
   try {
-    return JSON.stringify(value);
+    const error = Object.getOwnPropertyDescriptor(event, 'error')?.value;
+    const nestedMessage =
+      typeof error === 'object' && error !== null
+        ? Object.getOwnPropertyDescriptor(error, 'message')?.value
+        : undefined;
+    const eventMessage = Object.getOwnPropertyDescriptor(event, 'message')?.value;
+    const candidate = typeof nestedMessage === 'string' ? nestedMessage : eventMessage;
+    return typeof candidate === 'string' ? candidate : undefined;
   } catch {
-    return null;
+    return undefined;
   }
 }

package/src/resources/beta/responses/responses.ts

@@ -2443,6 +2443,49 @@ export namespace BetaResponseCodeInterpreterToolCall {
   }
 }
 
+/**
+ * Emitted when new summary content is sampled for a compaction trigger. Contains
+ * no summary content.
+ */
+export interface BetaResponseCompactionCompactingEvent {
+  /**
+   * The ID of the compaction output item.
+   */
+  item_id: string;
+
+  /**
+   * The index of the compaction output item.
+   */
+  output_index: number;
+
+  /**
+   * The sequence number of the event that was emitted.
+   */
+  sequence_number: number;
+
+  /**
+   * The type of the event, always `response.compaction.compacting`.
+   */
+  type: 'response.compaction.compacting';
+
+  /**
+   * The agent that owns this multi-agent streaming event.
+   */
+  agent?: BetaResponseCompactionCompactingEvent.Agent;
+}
+
+export namespace BetaResponseCompactionCompactingEvent {
+  /**
+   * The agent that owns this multi-agent streaming event.
+   */
+  export interface Agent {
+    /**
+     * The canonical name of the agent that produced this item.
+     */
+    agent_name: string;
+  }
+}
+
 /**
  * A compaction item generated by the
  * [`v1/responses/compact` API](https://developers.openai.com/api/reference/resources/responses/methods/compact).
@@ -10942,6 +10985,7 @@ export type BetaResponseStreamEvent =
   | BetaResponseCodeInterpreterCallCompletedEvent
   | BetaResponseCodeInterpreterCallInProgressEvent
   | BetaResponseCodeInterpreterCallInterpretingEvent
+  | BetaResponseCompactionCompactingEvent
   | BetaResponseCompletedEvent
   | BetaResponseContentPartAddedEvent
   | BetaResponseContentPartDoneEvent
@@ -12231,6 +12275,7 @@ export type BetaResponsesServerEvent =
   | BetaResponsesServerEvent.BetaResponseCodeInterpreterCallWsCompleted
   | BetaResponsesServerEvent.BetaResponseCodeInterpreterCallInWsProgress
   | BetaResponsesServerEvent.BetaResponseCodeInterpreterCallWsInterpreting
+  | BetaResponsesServerEvent.BetaResponseCompactionWsCompacting
   | BetaResponsesServerEvent.BetaResponseWsCompleted
   | BetaResponsesServerEvent.BetaResponseContentPartWsAdded
   | BetaResponsesServerEvent.BetaResponseContentPartWsDone
@@ -12387,6 +12432,18 @@ export namespace BetaResponsesServerEvent {
     stream_id?: string;
   }
 
+  /**
+   * Emitted when new summary content is sampled for a compaction trigger. Contains
+   * no summary content.
+   */
+  export interface BetaResponseCompactionWsCompacting extends BetaResponseCompactionCompactingEvent {
+    /**
+     * The WebSocket lane that emitted this event. This field is present when the
+     * originating `response.create` event supplied a `stream_id`.
+     */
+    stream_id?: string;
+  }
+
   /**
    * Emitted when the model response is complete.
    */
@@ -14820,6 +14877,7 @@ export declare namespace Responses {
     type BetaResponseCodeInterpreterCallInProgressEvent as BetaResponseCodeInterpreterCallInProgressEvent,
     type BetaResponseCodeInterpreterCallInterpretingEvent as BetaResponseCodeInterpreterCallInterpretingEvent,
     type BetaResponseCodeInterpreterToolCall as BetaResponseCodeInterpreterToolCall,
+    type BetaResponseCompactionCompactingEvent as BetaResponseCompactionCompactingEvent,
     type BetaResponseCompactionItem as BetaResponseCompactionItem,
     type BetaResponseCompactionItemParam as BetaResponseCompactionItemParam,
     type BetaResponseCompletedEvent as BetaResponseCompletedEvent,

package/src/resources/beta/responses/ws-base.ts

@@ -6,6 +6,8 @@ import { sleep } from '../../../internal/utils/sleep';
 import { type WebSocketLike, ReadyState } from '../../../internal/ws-adapter';
 import {
   SendQueue,
+  getMaxBufferedEvents,
+  type WebSocketStreamOptions,
   flattenRawData,
   isRecoverableClose,
   type RawWebSocketData,
@@ -51,11 +53,11 @@ export interface ResponsesWSBaseOptions {
   reconnect?: ResponsesWSReconnectOptions | null | undefined;
 
   /**
-   * Maximum size of the outgoing message queue in bytes.
-   * Messages queued while the socket is connecting or reconnecting are held
-   * in memory up to this limit. Once the limit is reached, new messages are
-   * discarded and an `error` event is emitted.
-   * Default: 1 MB
+   * Byte budget for outgoing messages queued while the socket is connecting
+   * or reconnecting. An empty queue accepts one message even if it exceeds
+   * this budget. Further messages are discarded and an `error` event is emitted
+   * if the total queued size would exceed the budget.
+   * Default: 1 MiB (1,048,576 bytes).
    */
   maxQueueSize?: number | undefined;
 }
@@ -101,7 +103,11 @@ export abstract class ResponsesWSBase<TSocket extends WebSocketLike> extends Res
     this.socket = this._connect();
   }
 
-  /** Creates a platform-specific WebSocket for the given URL and auth headers. */
+  /**
+   * Creates a platform-specific WebSocket for the given URL and captured client auth headers.
+   * The transport must supply or validate its final credentials before connecting;
+   * these headers may be empty when authentication is managed by the transport.
+   */
   protected abstract _createSocket(url: URL, authHeaders: Record<string, string>): TSocket;
 
   send(event: ResponsesAPI.BetaResponsesClientEvent) {
@@ -169,6 +175,11 @@ export abstract class ResponsesWSBase<TSocket extends WebSocketLike> extends Res
    * The iterator will exit if the socket closes but exiting the iterator
    * does not close the socket.
    *
+   * Pass `maxBufferedEvents` to limit queued records for this iterator, including
+   * lifecycle events. Overflow discards its backlog and rejects `next()` with a
+   * WebSocketError; the shared socket and other iterators remain active.
+   * Omitted means unlimited. This is an event-count limit, not a byte limit.
+   *
    * @example
    * ```ts
    * for await (const event of client.stream()) {
@@ -186,26 +197,59 @@ export abstract class ResponsesWSBase<TSocket extends WebSocketLike> extends Res
    * }
    * ```
    */
-  stream(): AsyncIterableIterator<ResponsesStreamMessage> {
-    return this[Symbol.asyncIterator]();
+  stream(options?: WebSocketStreamOptions): AsyncIterableIterator<ResponsesStreamMessage> {
+    return options === undefined ? this[Symbol.asyncIterator]() : this[Symbol.asyncIterator](options);
   }
 
-  [Symbol.asyncIterator](): AsyncIterableIterator<ResponsesStreamMessage> {
+  [Symbol.asyncIterator](options?: WebSocketStreamOptions): AsyncIterableIterator<ResponsesStreamMessage> {
     if (!this.socket) {
       throw new OpenAIError('Internal error: failed to initialize socket. Please report this issue.');
     }
 
+    const maxBufferedEvents = getMaxBufferedEvents(options);
+
     // Two-queue async iterator: `queue` buffers incoming messages,
     // `resolvers` buffers waiting next() calls. A push wakes the
     // oldest next(); a next() drains the oldest message.
-    const queue: ResponsesStreamMessage[] = [];
-    const resolvers: (() => void)[] = [];
+    const queue: (ResponsesStreamMessage | undefined)[] = [];
+    const resolvers: ((() => void) | undefined)[] = [];
+    let queueHead = 0;
+    let resolverHead = 0;
     let done = false;
+    let failure: WebSocketError | undefined;
     let currentSocket = this.socket;
 
+    const wakeResolver = () => {
+      if (resolverHead >= resolvers.length) return;
+
+      const resolver = resolvers[resolverHead];
+      resolvers[resolverHead] = undefined;
+      resolverHead += 1;
+      if (resolverHead >= 64 && resolverHead * 2 >= resolvers.length) {
+        resolvers.splice(0, resolverHead);
+        resolverHead = 0;
+      }
+      resolver?.();
+    };
+
     const push = (msg: ResponsesStreamMessage) => {
+      if (done) return;
+
+      if (maxBufferedEvents !== undefined && queue.length - queueHead >= maxBufferedEvents) {
+        failure = new WebSocketError(
+          `WebSocket stream exceeded maxBufferedEvents (${maxBufferedEvents})`,
+          null,
+        );
+        done = true;
+        queue.length = 0;
+        queueHead = 0;
+        cleanup();
+        flushResolvers();
+        return;
+      }
+
       queue.push(msg);
-      resolvers.shift()?.();
+      wakeResolver();
     };
 
     const onEvent = (event: ResponsesAPI.BetaResponsesServerEvent) => {
@@ -235,9 +279,14 @@ export abstract class ResponsesWSBase<TSocket extends WebSocketLike> extends Res
     };
 
     const flushResolvers = () => {
-      for (let resolver = resolvers.shift(); resolver; resolver = resolvers.shift()) {
-        resolver();
+      while (resolverHead < resolvers.length) {
+        const resolver = resolvers[resolverHead];
+        resolvers[resolverHead] = undefined;
+        resolverHead += 1;
+        resolver?.();
       }
+      resolvers.length = 0;
+      resolverHead = 0;
     };
 
     const onClose = (
@@ -251,8 +300,9 @@ export abstract class ResponsesWSBase<TSocket extends WebSocketLike> extends Res
       cleanup();
     };
 
-    const onSocketSwap = (oldSocket: TSocket, newSocket: TSocket) => {
-      oldSocket.off('open', onOpen);
+    const onSocketSwap = (_oldSocket: TSocket, newSocket: TSocket) => {
+      if (currentSocket === newSocket) return;
+      currentSocket.off('open', onOpen);
       newSocket.on('open', onOpen);
       currentSocket = newSocket;
     };
@@ -309,9 +359,21 @@ export abstract class ResponsesWSBase<TSocket extends WebSocketLike> extends Res
       }
     }
 
-    const resolve = (res: (value: IteratorResult<ResponsesStreamMessage>) => void) => {
-      if (queue.length > 0) {
-        res({ value: queue.shift()!, done: false });
+    const resolve = (
+      res: (value: IteratorResult<ResponsesStreamMessage>) => void,
+      reject: (error: WebSocketError) => void,
+    ) => {
+      if (failure) {
+        reject(failure);
+      } else if (queueHead < queue.length) {
+        const queued = queue[queueHead]!;
+        queue[queueHead] = undefined;
+        queueHead += 1;
+        if (queueHead >= 64 && queueHead * 2 >= queue.length) {
+          queue.splice(0, queueHead);
+          queueHead = 0;
+        }
+        res({ value: queued, done: false });
       } else if (done) {
         res({ value: undefined, done: true });
       } else {
@@ -321,10 +383,10 @@ export abstract class ResponsesWSBase<TSocket extends WebSocketLike> extends Res
     };
 
     const next = (): Promise<IteratorResult<ResponsesStreamMessage>> =>
-      new Promise((res) => {
-        if (resolve(res)) return;
+      new Promise((res, reject) => {
+        if (resolve(res, reject)) return;
         resolvers.push(() => {
-          resolve(res);
+          resolve(res, reject);
         });
       });
 
@@ -332,6 +394,8 @@ export abstract class ResponsesWSBase<TSocket extends WebSocketLike> extends Res
       next,
       return: (): Promise<IteratorReturnResult<undefined>> => {
         done = true;
+        queue.length = 0;
+        queueHead = 0;
         cleanup();
         flushResolvers();
         return Promise.resolve({ value: undefined, done: true });
@@ -364,6 +428,35 @@ export abstract class ResponsesWSBase<TSocket extends WebSocketLike> extends Res
         return;
       }
 
+      if (
+        event === null ||
+        typeof event !== 'object' ||
+        Array.isArray(event) ||
+        !Object.prototype.hasOwnProperty.call(event, 'type') ||
+        typeof event.type !== 'string'
+      ) {
+        this._onError(
+          null,
+          'received invalid WebSocket event: expected an object with an own string type',
+          undefined,
+        );
+        return;
+      }
+
+      const eventType: string = event.type;
+      const reservedEventType =
+        eventType === 'raw' ||
+        eventType === 'close' ||
+        eventType === 'event' ||
+        eventType === 'reconnecting' ||
+        eventType === 'reconnected' ||
+        eventType === 'open' ||
+        eventType === 'error';
+      if (reservedEventType && eventType !== 'error') {
+        this._onError(null, 'received reserved WebSocket event type', undefined);
+        return;
+      }
+
       this._emit('event', event);
 
       if (event.type === 'error') {
@@ -607,9 +700,7 @@ export abstract class ResponsesWSBase<TSocket extends WebSocketLike> extends Res
   }
 
   protected _authHeaders(): Record<string, string> {
-    if (this._client.apiKey) {
-      return { Authorization: `Bearer ${this._client.apiKey}` };
-    }
-    return {};
+    const apiKey = this._client.apiKey;
+    return typeof apiKey === 'string' && apiKey ? { Authorization: `Bearer ${apiKey}` } : {};
   }
 }

package/src/resources/beta/responses/ws.ts

@@ -5,10 +5,17 @@ import { NodeWebSocket } from '../../../internal/ws-adapter-node';
 import { ResponsesWSBase, type ResponsesWSBaseOptions } from './ws-base';
 import { OpenAI } from '../../../client';
 import { VERSION } from '../../../version';
+import { OpenAIError } from '../../../core/error';
+import { snapshotWebSocketCredentials } from '../../../internal/ws';
+
+export type { WebSocketStreamOptions } from '../../../internal/ws';
 
 export type { ResponsesWSReconnectOptions } from './ws-base';
 
-export interface ResponsesWSClientOptions extends WS.ClientOptions, ResponsesWSBaseOptions {}
+export interface ResponsesWSClientOptions extends WS.ClientOptions, ResponsesWSBaseOptions {
+  /** Basic authentication forwarded by the Node `ws` transport. */
+  auth?: string;
+}
 
 export class ResponsesWS extends ResponsesWSBase<NodeWebSocket> {
   private _wsOptions: WS.ClientOptions | null | undefined;
@@ -19,7 +26,6 @@ export class ResponsesWS extends ResponsesWSBase<NodeWebSocket> {
         'ResponsesWS from "openai/resources/beta/responses/ws" requires the "ws" package but it could not be loaded.',
       );
     }
-
     const { reconnect, maxQueueSize, ...wsOptions } = options ?? {};
     super(client, { reconnect, maxQueueSize });
     this._wsOptions = wsOptions;
@@ -27,16 +33,27 @@ export class ResponsesWS extends ResponsesWSBase<NodeWebSocket> {
   }
 
   protected _createSocket(url: URL, authHeaders: Record<string, string>): NodeWebSocket {
-    const ws = new WS.WebSocket(url, {
+    const capturedAuthHeaders = { ...authHeaders };
+    const socketOptions: ResponsesWSClientOptions = {
       ...this._wsOptions,
       headers: {
         'User-Agent': `${this._client.constructor.name}/JS ${VERSION}`,
-
-        ...authHeaders,
+        ...capturedAuthHeaders,
         ...this._wsOptions?.headers,
       },
       followRedirects: false,
-    });
+    };
+    if (
+      this._client._hasApiKeyProvider() &&
+      !capturedAuthHeaders['Authorization'] &&
+      !snapshotWebSocketCredentials(socketOptions)
+    ) {
+      throw new OpenAIError(
+        'Cannot open a Responses WebSocket with an unresolved function-based apiKey. Resolve it before constructing the WebSocket or provide explicit WebSocket credentials.',
+      );
+    }
+
+    const ws = new WS.WebSocket(url, socketOptions);
     return new NodeWebSocket(ws);
   }
 }