openai 7.3.0 → 7.5.0

package/auth/types.d.ts

@@ -1,23 +1,32 @@
+/** Supplies a fresh external identity token for an OpenAI workload-identity exchange. */
 export interface SubjectTokenProvider {
+    /** Whether the provider returns a signed JWT or an OpenID Connect identity token. */
     tokenType: 'jwt' | 'id';
+    /** Returns a fresh subject token whenever the SDK needs to exchange or refresh its access token. */
     getToken: () => Promise<string>;
 }
+/** Configures federation from an external workload identity into an OpenAI service account. */
 export interface WorkloadIdentity {
-    /**Optional client identifier for token exchange compatibility.*/
+    /** Optional OAuth client identifier included in the token-exchange request. */
     clientId?: string;
-    /**Identity provider resource id in WIFAPI.*/
+    /** Identifier of the OpenAI identity-provider resource that trusts the external workload. */
     identityProviderId: string;
-    /**OpenAI Service account id to bind the verified external identity to.*/
+    /** Identifier of the OpenAI service account that receives the verified external identity. */
     serviceAccountId: string;
-    /**The provider configuration for obtaining the subject token.*/
+    /** Provider that obtains the external subject token for each token exchange. */
     provider: SubjectTokenProvider;
-    /**Optional buffer time in seconds to refresh the OpenAI token before it expires. Defaults to 1200 seconds (20 minutes).*/
+    /** Seconds before expiration when access-token refresh begins; defaults to 1,200 seconds. */
     refreshBufferSeconds?: number;
 }
+/** OAuth token-exchange response returned by the OpenAI workload-identity endpoint. */
 export interface TokenExchangeResponse {
+    /** OpenAI access token to use as the request's bearer credential. */
     access_token: string;
+    /** OAuth token-type URN describing the issued access token. */
     issued_token_type: string;
+    /** Authorization scheme associated with the access token, normally `Bearer`. */
     token_type: string;
+    /** Token lifetime in seconds; the SDK assumes 3,600 seconds when omitted. */
     expires_in?: number;
 }
 //# sourceMappingURL=types.d.ts.map

package/auth/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/auth/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,KAAK,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,gBAAgB;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,6CAA6C;IAC7C,kBAAkB,EAAE,MAAM,CAAC;IAE3B,yEAAyE;IACzE,gBAAgB,EAAE,MAAM,CAAC;IAEzB,gEAAgE;IAChE,QAAQ,EAAE,oBAAoB,CAAC;IAE/B,0HAA0H;IAC1H,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/auth/types.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,MAAM,WAAW,oBAAoB;IACnC,qFAAqF;IACrF,SAAS,EAAE,KAAK,GAAG,IAAI,CAAC;IAExB,oGAAoG;IACpG,QAAQ,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CACjC;AAED,+FAA+F;AAC/F,MAAM,WAAW,gBAAgB;IAC/B,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,6FAA6F;IAC7F,kBAAkB,EAAE,MAAM,CAAC;IAE3B,6FAA6F;IAC7F,gBAAgB,EAAE,MAAM,CAAC;IAEzB,gFAAgF;IAChF,QAAQ,EAAE,oBAAoB,CAAC;IAE/B,6FAA6F;IAC7F,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,uFAAuF;AACvF,MAAM,WAAW,qBAAqB;IACpC,qEAAqE;IACrE,YAAY,EAAE,MAAM,CAAC;IAErB,+DAA+D;IAC/D,iBAAiB,EAAE,MAAM,CAAC;IAE1B,gFAAgF;IAChF,UAAU,EAAE,MAAM,CAAC;IAEnB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB"}

package/auth/workload-identity-auth.d.mts

@@ -1,16 +1,41 @@
 import type { WorkloadIdentity } from "./types.mjs";
 import type { Fetch } from "../internal/builtin-types.mjs";
+/**
+ * Exchanges external workload-identity tokens for cached OpenAI access tokens.
+ *
+ * Concurrent token exchanges are shared. Valid cached tokens are returned while
+ * a proactive refresh runs in the background; expired or missing tokens wait
+ * for a successful exchange before they are returned.
+ */
 export declare class WorkloadIdentityAuth {
     private cachedToken;
     private refreshPromise;
+    private tokenGeneration;
     private readonly config;
     private readonly tokenExchangeUrl;
     private readonly fetch;
+    /**
+     * Creates a workload-identity token cache and OAuth token-exchange client.
+     *
+     * @param config External identity provider, OpenAI service account, and refresh settings.
+     * @param fetch Optional fetch implementation for calls to the OpenAI token endpoint.
+     */
     constructor(config: WorkloadIdentity, fetch?: Fetch);
+    /**
+     * Returns a valid OpenAI access token, exchanging or refreshing credentials as needed.
+     *
+     * Cached tokens nearing expiration are returned immediately while a background
+     * refresh runs. Concurrent callers share the same in-flight token exchange.
+     *
+     * @throws {OAuthError} When the token endpoint rejects the subject token or identity.
+     * @throws {APIError} When another unsuccessful HTTP response prevents token exchange.
+     * @throws {OpenAIError} When a successful exchange has an invalid access token or expiration.
+     */
     getToken(): Promise<string>;
     private refreshToken;
-    private isTokenExpired;
+    private static isTokenExpired;
     private needsRefresh;
+    /** Discards the cached access token so the next request performs a fresh exchange. */
     invalidateToken(): void;
 }
 //# sourceMappingURL=workload-identity-auth.d.mts.map

package/auth/workload-identity-auth.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"workload-identity-auth.d.mts","sourceRoot":"","sources":["../src/auth/workload-identity-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAyB,oBAAgB;AACvE,OAAO,KAAK,EAAE,KAAK,EAAE,sCAAkC;AAgBvD,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,WAAW,CAA4B;IAC/C,OAAO,CAAC,cAAc,CAAgC;IACtD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmB;IAC1C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAiD;IAClF,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;gBAElB,MAAM,EAAE,gBAAgB,EAAE,KAAK,CAAC,EAAE,KAAK;IAK7C,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC;YAyBnB,YAAY;IAgE1B,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,YAAY;IAMpB,eAAe,IAAI,IAAI;CAIxB"}
+{"version":3,"file":"workload-identity-auth.d.mts","sourceRoot":"","sources":["../src/auth/workload-identity-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAyB,oBAAgB;AACvE,OAAO,KAAK,EAAE,KAAK,EAAE,sCAAkC;AAgBvD;;;;;;GAMG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,WAAW,CAA4B;IAC/C,OAAO,CAAC,cAAc,CAAgC;IACtD,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmB;IAC1C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAiD;IAClF,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAE9B;;;;;OAKG;gBACS,MAAM,EAAE,gBAAgB,EAAE,KAAK,CAAC,EAAE,KAAK;IAKnD;;;;;;;;;OASG;IACG,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC;YA+BnB,YAAY;IA6E1B,OAAO,CAAC,MAAM,CAAC,cAAc;IAI7B,OAAO,CAAC,YAAY;IAMpB,sFAAsF;IACtF,eAAe,IAAI,IAAI;CAKxB"}

package/auth/workload-identity-auth.d.ts

@@ -1,16 +1,41 @@
 import type { WorkloadIdentity } from "./types.js";
 import type { Fetch } from "../internal/builtin-types.js";
+/**
+ * Exchanges external workload-identity tokens for cached OpenAI access tokens.
+ *
+ * Concurrent token exchanges are shared. Valid cached tokens are returned while
+ * a proactive refresh runs in the background; expired or missing tokens wait
+ * for a successful exchange before they are returned.
+ */
 export declare class WorkloadIdentityAuth {
     private cachedToken;
     private refreshPromise;
+    private tokenGeneration;
     private readonly config;
     private readonly tokenExchangeUrl;
     private readonly fetch;
+    /**
+     * Creates a workload-identity token cache and OAuth token-exchange client.
+     *
+     * @param config External identity provider, OpenAI service account, and refresh settings.
+     * @param fetch Optional fetch implementation for calls to the OpenAI token endpoint.
+     */
     constructor(config: WorkloadIdentity, fetch?: Fetch);
+    /**
+     * Returns a valid OpenAI access token, exchanging or refreshing credentials as needed.
+     *
+     * Cached tokens nearing expiration are returned immediately while a background
+     * refresh runs. Concurrent callers share the same in-flight token exchange.
+     *
+     * @throws {OAuthError} When the token endpoint rejects the subject token or identity.
+     * @throws {APIError} When another unsuccessful HTTP response prevents token exchange.
+     * @throws {OpenAIError} When a successful exchange has an invalid access token or expiration.
+     */
     getToken(): Promise<string>;
     private refreshToken;
-    private isTokenExpired;
+    private static isTokenExpired;
     private needsRefresh;
+    /** Discards the cached access token so the next request performs a fresh exchange. */
     invalidateToken(): void;
 }
 //# sourceMappingURL=workload-identity-auth.d.ts.map

package/auth/workload-identity-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workload-identity-auth.d.ts","sourceRoot":"","sources":["../src/auth/workload-identity-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAyB,mBAAgB;AACvE,OAAO,KAAK,EAAE,KAAK,EAAE,qCAAkC;AAgBvD,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,WAAW,CAA4B;IAC/C,OAAO,CAAC,cAAc,CAAgC;IACtD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmB;IAC1C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAiD;IAClF,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;gBAElB,MAAM,EAAE,gBAAgB,EAAE,KAAK,CAAC,EAAE,KAAK;IAK7C,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC;YAyBnB,YAAY;IAgE1B,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,YAAY;IAMpB,eAAe,IAAI,IAAI;CAIxB"}
+{"version":3,"file":"workload-identity-auth.d.ts","sourceRoot":"","sources":["../src/auth/workload-identity-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAyB,mBAAgB;AACvE,OAAO,KAAK,EAAE,KAAK,EAAE,qCAAkC;AAgBvD;;;;;;GAMG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,WAAW,CAA4B;IAC/C,OAAO,CAAC,cAAc,CAAgC;IACtD,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmB;IAC1C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAiD;IAClF,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAE9B;;;;;OAKG;gBACS,MAAM,EAAE,gBAAgB,EAAE,KAAK,CAAC,EAAE,KAAK;IAKnD;;;;;;;;;OASG;IACG,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC;YA+BnB,YAAY;IA6E1B,OAAO,CAAC,MAAM,CAAC,cAAc;IAI7B,OAAO,CAAC,YAAY;IAMpB,sFAAsF;IACtF,eAAe,IAAI,IAAI;CAKxB"}

package/auth/workload-identity-auth.js

@@ -9,36 +9,66 @@ const SUBJECT_TOKEN_TYPES = {
     id: 'urn:ietf:params:oauth:token-type:id_token',
 };
 const TOKEN_EXCHANGE_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:token-exchange';
+/**
+ * Exchanges external workload-identity tokens for cached OpenAI access tokens.
+ *
+ * Concurrent token exchanges are shared. Valid cached tokens are returned while
+ * a proactive refresh runs in the background; expired or missing tokens wait
+ * for a successful exchange before they are returned.
+ */
 class WorkloadIdentityAuth {
+    /**
+     * Creates a workload-identity token cache and OAuth token-exchange client.
+     *
+     * @param config External identity provider, OpenAI service account, and refresh settings.
+     * @param fetch Optional fetch implementation for calls to the OpenAI token endpoint.
+     */
     constructor(config, fetch) {
         this.cachedToken = null;
         this.refreshPromise = null;
+        this.tokenGeneration = 0;
         this.tokenExchangeUrl = 'https://auth.openai.com/oauth/token';
         this.config = config;
         this.fetch = fetch ?? Shims.getDefaultFetch();
     }
+    /**
+     * Returns a valid OpenAI access token, exchanging or refreshing credentials as needed.
+     *
+     * Cached tokens nearing expiration are returned immediately while a background
+     * refresh runs. Concurrent callers share the same in-flight token exchange.
+     *
+     * @throws {OAuthError} When the token endpoint rejects the subject token or identity.
+     * @throws {APIError} When another unsuccessful HTTP response prevents token exchange.
+     * @throws {OpenAIError} When a successful exchange has an invalid access token or expiration.
+     */
     async getToken() {
-        if (!this.cachedToken || this.isTokenExpired(this.cachedToken)) {
+        if (!this.cachedToken || WorkloadIdentityAuth.isTokenExpired(this.cachedToken)) {
             if (this.refreshPromise) {
                 return await this.refreshPromise;
             }
-            this.refreshPromise = this.refreshToken();
+            const refreshPromise = this.refreshToken(this.tokenGeneration);
+            this.refreshPromise = refreshPromise;
             try {
-                const token = await this.refreshPromise;
-                return token;
+                return await refreshPromise;
             }
             finally {
-                this.refreshPromise = null;
+                if (this.refreshPromise === refreshPromise) {
+                    this.refreshPromise = null;
+                }
             }
         }
         if (this.needsRefresh(this.cachedToken) && !this.refreshPromise) {
-            this.refreshPromise = this.refreshToken().finally(() => {
-                this.refreshPromise = null;
+            const refreshPromise = this.refreshToken(this.tokenGeneration).finally(() => {
+                if (this.refreshPromise === refreshPromise) {
+                    this.refreshPromise = null;
+                }
             });
+            this.refreshPromise = refreshPromise;
+            void refreshPromise.catch(() => null);
         }
         return this.cachedToken.token;
     }
-    async refreshToken() {
+    async refreshToken(generation) {
         const subjectToken = await this.config.provider.getToken();
         const body = {
             grant_type: TOKEN_EXCHANGE_GRANT_TYPE,
@@ -56,6 +86,7 @@ class WorkloadIdentityAuth {
                 'Content-Type': 'application/json',
             },
             body: JSON.stringify(body),
+            redirect: 'manual',
         });
         if (!response.ok) {
             const errorText = await response.text();
@@ -63,7 +94,9 @@ class WorkloadIdentityAuth {
             try {
                 body = JSON.parse(errorText);
             }
-            catch { }
+            catch {
+                // Ignore non-JSON error bodies.
+            }
             if (response.status === 400 || response.status === 401 || response.status === 403) {
                 throw new error_1.OAuthError(response.status, body, response.headers);
             }
@@ -79,14 +112,23 @@ class WorkloadIdentityAuth {
         }
         const accessToken = tokenResponse.access_token;
         const expiresIn = tokenResponse.expires_in ?? 3600;
-        const expiresAt = Date.now() + expiresIn * 1000;
-        this.cachedToken = {
-            token: accessToken,
-            expiresAt,
-        };
+        if (typeof expiresIn !== 'number' || !Number.isFinite(expiresIn) || expiresIn <= 0) {
+            throw new error_1.OpenAIError("Token exchange response has invalid 'expires_in' field");
+        }
+        const now = Date.now();
+        const expiresAt = now + expiresIn * 1000;
+        if (!Number.isSafeInteger(expiresAt) || expiresAt <= now) {
+            throw new error_1.OpenAIError("Token exchange response has invalid 'expires_in' field");
+        }
+        if (this.tokenGeneration === generation) {
+            this.cachedToken = {
+                token: accessToken,
+                expiresAt,
+            };
+        }
         return accessToken;
     }
-    isTokenExpired(cachedToken) {
+    static isTokenExpired(cachedToken) {
         return Date.now() >= cachedToken.expiresAt;
     }
     needsRefresh(cachedToken) {
@@ -94,7 +136,9 @@ class WorkloadIdentityAuth {
         const bufferMs = bufferSeconds * 1000;
         return Date.now() >= cachedToken.expiresAt - bufferMs;
     }
+    /** Discards the cached access token so the next request performs a fresh exchange. */
     invalidateToken() {
+        this.tokenGeneration += 1;
         this.cachedToken = null;
         this.refreshPromise = null;
     }

package/auth/workload-identity-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"workload-identity-auth.js","sourceRoot":"","sources":["../src/auth/workload-identity-auth.ts"],"names":[],"mappings":";;;;AAEA,oEAA2C;AAC3C,4CAAkE;AAOlE,MAAM,mBAAmB,GAA8D;IACrF,GAAG,EAAE,sCAAsC;IAC3C,EAAE,EAAE,2CAA2C;CAChD,CAAC;AAEF,MAAM,yBAAyB,GAAG,iDAAiD,CAAC;AAEpF,MAAa,oBAAoB;IAO/B,YAAY,MAAwB,EAAE,KAAa;QAN3C,gBAAW,GAAuB,IAAI,CAAC;QACvC,mBAAc,GAA2B,IAAI,CAAC;QAErC,qBAAgB,GAAW,qCAAqC,CAAC;QAIhF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,KAAK,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/D,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;gBACxB,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC;YACnC,CAAC;YAED,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YAE1C,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC;gBACxC,OAAO,KAAK,CAAC;YACf,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YAChE,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;gBACrD,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;YAC7B,CAAC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC3D,MAAM,IAAI,GAA2B;YACnC,UAAU,EAAE,yBAAyB;YACrC,aAAa,EAAE,YAAY;YAC3B,kBAAkB,EAAE,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;YACvE,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;YACpD,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;SACjD,CAAC;QAEF,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACzB,IAAI,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC3C,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,IAAI,GAAQ,SAAS,CAAC;YAE1B,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YAEV,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAClF,MAAM,IAAI,kBAAU,CAAC,QAAQ,CAAC,MAAyB,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;YACnF,CAAC;YACD,MAAM,gBAAQ,CAAC,QAAQ,CACrB,QAAQ,CAAC,MAAM,EACf,IAAI,EACJ,qCAAqC,QAAQ,CAAC,MAAM,EAAE,EACtD,QAAQ,CAAC,OAAO,CACjB,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACrD,IACE,OAAO,aAAa,KAAK,QAAQ;YACjC,aAAa,KAAK,IAAI;YACtB,CAAC,CAAC,cAAc,IAAI,aAAa,CAAC;YAClC,OAAO,aAAa,CAAC,YAAY,KAAK,QAAQ;YAC9C,aAAa,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAC9C,CAAC;YACD,MAAM,IAAI,mBAAW,CAAC,sDAAsD,CAAC,CAAC;QAChF,CAAC;QAED,MAAM,WAAW,GAAG,aAAa,CAAC,YAAY,CAAC;QAC/C,MAAM,SAAS,GAAI,aAAgD,CAAC,UAAU,IAAI,IAAI,CAAC;QACvF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC;QAEhD,IAAI,CAAC,WAAW,GAAG;YACjB,KAAK,EAAE,WAAW;YAClB,SAAS;SACV,CAAC;QAEF,OAAO,WAAW,CAAC;IACrB,CAAC;IAEO,cAAc,CAAC,WAAwB;QAC7C,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC,SAAS,CAAC;IAC7C,CAAC;IAEO,YAAY,CAAC,WAAwB;QAC3C,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,oBAAoB,IAAI,IAAI,CAAC;QAC/D,MAAM,QAAQ,GAAG,aAAa,GAAG,IAAI,CAAC;QACtC,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC,SAAS,GAAG,QAAQ,CAAC;IACxD,CAAC;IAED,eAAe;QACb,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;IAC7B,CAAC;CACF;AAnHD,oDAmHC"}
+{"version":3,"file":"workload-identity-auth.js","sourceRoot":"","sources":["../src/auth/workload-identity-auth.ts"],"names":[],"mappings":";;;;AAEA,oEAA2C;AAC3C,4CAAkE;AAOlE,MAAM,mBAAmB,GAA8D;IACrF,GAAG,EAAE,sCAAsC;IAC3C,EAAE,EAAE,2CAA2C;CAChD,CAAC;AAEF,MAAM,yBAAyB,GAAG,iDAAiD,CAAC;AAEpF;;;;;;GAMG;AACH,MAAa,oBAAoB;IAQ/B;;;;;OAKG;IACH,YAAY,MAAwB,EAAE,KAAa;QAb3C,gBAAW,GAAuB,IAAI,CAAC;QACvC,mBAAc,GAA2B,IAAI,CAAC;QAC9C,oBAAe,GAAG,CAAC,CAAC;QAEX,qBAAgB,GAAW,qCAAqC,CAAC;QAUhF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,KAAK,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;IAChD,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,oBAAoB,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/E,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;gBACxB,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC;YACnC,CAAC;YAED,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC/D,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;YAErC,IAAI,CAAC;gBACH,OAAO,MAAM,cAAc,CAAC;YAC9B,CAAC;oBAAS,CAAC;gBACT,IAAI,IAAI,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;oBAC3C,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;gBAC7B,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YAChE,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC1E,IAAI,IAAI,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;oBAC3C,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;gBAC7B,CAAC;YACH,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;YACrC,KAAK,cAAc,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;QAED,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,UAAkB;QAC3C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC3D,MAAM,IAAI,GAA2B;YACnC,UAAU,EAAE,yBAAyB;YACrC,aAAa,EAAE,YAAY;YAC3B,kBAAkB,EAAE,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;YACvE,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;YACpD,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;SACjD,CAAC;QAEF,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACzB,IAAI,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC3C,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,IAAI,GAAQ,SAAS,CAAC;YAE1B,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,gCAAgC;YAClC,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAClF,MAAM,IAAI,kBAAU,CAAC,QAAQ,CAAC,MAAyB,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;YACnF,CAAC;YACD,MAAM,gBAAQ,CAAC,QAAQ,CACrB,QAAQ,CAAC,MAAM,EACf,IAAI,EACJ,qCAAqC,QAAQ,CAAC,MAAM,EAAE,EACtD,QAAQ,CAAC,OAAO,CACjB,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACrD,IACE,OAAO,aAAa,KAAK,QAAQ;YACjC,aAAa,KAAK,IAAI;YACtB,CAAC,CAAC,cAAc,IAAI,aAAa,CAAC;YAClC,OAAO,aAAa,CAAC,YAAY,KAAK,QAAQ;YAC9C,aAAa,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAC9C,CAAC;YACD,MAAM,IAAI,mBAAW,CAAC,sDAAsD,CAAC,CAAC;QAChF,CAAC;QAED,MAAM,WAAW,GAAG,aAAa,CAAC,YAAY,CAAC;QAC/C,MAAM,SAAS,GAAI,aAAgD,CAAC,UAAU,IAAI,IAAI,CAAC;QACvF,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACnF,MAAM,IAAI,mBAAW,CAAC,wDAAwD,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,GAAG,GAAG,SAAS,GAAG,IAAI,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;YACzD,MAAM,IAAI,mBAAW,CAAC,wDAAwD,CAAC,CAAC;QAClF,CAAC;QAED,IAAI,IAAI,CAAC,eAAe,KAAK,UAAU,EAAE,CAAC;YACxC,IAAI,CAAC,WAAW,GAAG;gBACjB,KAAK,EAAE,WAAW;gBAClB,SAAS;aACV,CAAC;QACJ,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAEO,MAAM,CAAC,cAAc,CAAC,WAAwB;QACpD,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC,SAAS,CAAC;IAC7C,CAAC;IAEO,YAAY,CAAC,WAAwB;QAC3C,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,oBAAoB,IAAI,IAAI,CAAC;QAC/D,MAAM,QAAQ,GAAG,aAAa,GAAG,IAAI,CAAC;QACtC,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC,SAAS,GAAG,QAAQ,CAAC;IACxD,CAAC;IAED,sFAAsF;IACtF,eAAe;QACb,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;IAC7B,CAAC;CACF;AAzJD,oDAyJC"}

package/auth/workload-identity-auth.mjs

@@ -5,36 +5,66 @@ const SUBJECT_TOKEN_TYPES = {
     id: 'urn:ietf:params:oauth:token-type:id_token',
 };
 const TOKEN_EXCHANGE_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:token-exchange';
+/**
+ * Exchanges external workload-identity tokens for cached OpenAI access tokens.
+ *
+ * Concurrent token exchanges are shared. Valid cached tokens are returned while
+ * a proactive refresh runs in the background; expired or missing tokens wait
+ * for a successful exchange before they are returned.
+ */
 export class WorkloadIdentityAuth {
+    /**
+     * Creates a workload-identity token cache and OAuth token-exchange client.
+     *
+     * @param config External identity provider, OpenAI service account, and refresh settings.
+     * @param fetch Optional fetch implementation for calls to the OpenAI token endpoint.
+     */
     constructor(config, fetch) {
         this.cachedToken = null;
         this.refreshPromise = null;
+        this.tokenGeneration = 0;
         this.tokenExchangeUrl = 'https://auth.openai.com/oauth/token';
         this.config = config;
         this.fetch = fetch ?? Shims.getDefaultFetch();
     }
+    /**
+     * Returns a valid OpenAI access token, exchanging or refreshing credentials as needed.
+     *
+     * Cached tokens nearing expiration are returned immediately while a background
+     * refresh runs. Concurrent callers share the same in-flight token exchange.
+     *
+     * @throws {OAuthError} When the token endpoint rejects the subject token or identity.
+     * @throws {APIError} When another unsuccessful HTTP response prevents token exchange.
+     * @throws {OpenAIError} When a successful exchange has an invalid access token or expiration.
+     */
     async getToken() {
-        if (!this.cachedToken || this.isTokenExpired(this.cachedToken)) {
+        if (!this.cachedToken || WorkloadIdentityAuth.isTokenExpired(this.cachedToken)) {
             if (this.refreshPromise) {
                 return await this.refreshPromise;
             }
-            this.refreshPromise = this.refreshToken();
+            const refreshPromise = this.refreshToken(this.tokenGeneration);
+            this.refreshPromise = refreshPromise;
             try {
-                const token = await this.refreshPromise;
-                return token;
+                return await refreshPromise;
             }
             finally {
-                this.refreshPromise = null;
+                if (this.refreshPromise === refreshPromise) {
+                    this.refreshPromise = null;
+                }
             }
         }
         if (this.needsRefresh(this.cachedToken) && !this.refreshPromise) {
-            this.refreshPromise = this.refreshToken().finally(() => {
-                this.refreshPromise = null;
+            const refreshPromise = this.refreshToken(this.tokenGeneration).finally(() => {
+                if (this.refreshPromise === refreshPromise) {
+                    this.refreshPromise = null;
+                }
             });
+            this.refreshPromise = refreshPromise;
+            void refreshPromise.catch(() => null);
         }
         return this.cachedToken.token;
     }
-    async refreshToken() {
+    async refreshToken(generation) {
         const subjectToken = await this.config.provider.getToken();
         const body = {
             grant_type: TOKEN_EXCHANGE_GRANT_TYPE,
@@ -52,6 +82,7 @@ export class WorkloadIdentityAuth {
                 'Content-Type': 'application/json',
             },
             body: JSON.stringify(body),
+            redirect: 'manual',
         });
         if (!response.ok) {
             const errorText = await response.text();
@@ -59,7 +90,9 @@ export class WorkloadIdentityAuth {
             try {
                 body = JSON.parse(errorText);
             }
-            catch { }
+            catch {
+                // Ignore non-JSON error bodies.
+            }
             if (response.status === 400 || response.status === 401 || response.status === 403) {
                 throw new OAuthError(response.status, body, response.headers);
             }
@@ -75,14 +108,23 @@ export class WorkloadIdentityAuth {
         }
         const accessToken = tokenResponse.access_token;
         const expiresIn = tokenResponse.expires_in ?? 3600;
-        const expiresAt = Date.now() + expiresIn * 1000;
-        this.cachedToken = {
-            token: accessToken,
-            expiresAt,
-        };
+        if (typeof expiresIn !== 'number' || !Number.isFinite(expiresIn) || expiresIn <= 0) {
+            throw new OpenAIError("Token exchange response has invalid 'expires_in' field");
+        }
+        const now = Date.now();
+        const expiresAt = now + expiresIn * 1000;
+        if (!Number.isSafeInteger(expiresAt) || expiresAt <= now) {
+            throw new OpenAIError("Token exchange response has invalid 'expires_in' field");
+        }
+        if (this.tokenGeneration === generation) {
+            this.cachedToken = {
+                token: accessToken,
+                expiresAt,
+            };
+        }
         return accessToken;
     }
-    isTokenExpired(cachedToken) {
+    static isTokenExpired(cachedToken) {
         return Date.now() >= cachedToken.expiresAt;
     }
     needsRefresh(cachedToken) {
@@ -90,7 +132,9 @@ export class WorkloadIdentityAuth {
         const bufferMs = bufferSeconds * 1000;
         return Date.now() >= cachedToken.expiresAt - bufferMs;
     }
+    /** Discards the cached access token so the next request performs a fresh exchange. */
     invalidateToken() {
+        this.tokenGeneration += 1;
         this.cachedToken = null;
         this.refreshPromise = null;
     }

package/auth/workload-identity-auth.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"workload-identity-auth.mjs","sourceRoot":"","sources":["../src/auth/workload-identity-auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,KAAK,8BAA0B;AAC3C,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,0BAAsB;AAOlE,MAAM,mBAAmB,GAA8D;IACrF,GAAG,EAAE,sCAAsC;IAC3C,EAAE,EAAE,2CAA2C;CAChD,CAAC;AAEF,MAAM,yBAAyB,GAAG,iDAAiD,CAAC;AAEpF,MAAM,OAAO,oBAAoB;IAO/B,YAAY,MAAwB,EAAE,KAAa;QAN3C,gBAAW,GAAuB,IAAI,CAAC;QACvC,mBAAc,GAA2B,IAAI,CAAC;QAErC,qBAAgB,GAAW,qCAAqC,CAAC;QAIhF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,KAAK,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/D,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;gBACxB,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC;YACnC,CAAC;YAED,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YAE1C,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC;gBACxC,OAAO,KAAK,CAAC;YACf,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YAChE,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;gBACrD,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;YAC7B,CAAC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC3D,MAAM,IAAI,GAA2B;YACnC,UAAU,EAAE,yBAAyB;YACrC,aAAa,EAAE,YAAY;YAC3B,kBAAkB,EAAE,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;YACvE,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;YACpD,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;SACjD,CAAC;QAEF,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACzB,IAAI,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC3C,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,IAAI,GAAQ,SAAS,CAAC;YAE1B,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YAEV,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAClF,MAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAyB,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;YACnF,CAAC;YACD,MAAM,QAAQ,CAAC,QAAQ,CACrB,QAAQ,CAAC,MAAM,EACf,IAAI,EACJ,qCAAqC,QAAQ,CAAC,MAAM,EAAE,EACtD,QAAQ,CAAC,OAAO,CACjB,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACrD,IACE,OAAO,aAAa,KAAK,QAAQ;YACjC,aAAa,KAAK,IAAI;YACtB,CAAC,CAAC,cAAc,IAAI,aAAa,CAAC;YAClC,OAAO,aAAa,CAAC,YAAY,KAAK,QAAQ;YAC9C,aAAa,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAC9C,CAAC;YACD,MAAM,IAAI,WAAW,CAAC,sDAAsD,CAAC,CAAC;QAChF,CAAC;QAED,MAAM,WAAW,GAAG,aAAa,CAAC,YAAY,CAAC;QAC/C,MAAM,SAAS,GAAI,aAAgD,CAAC,UAAU,IAAI,IAAI,CAAC;QACvF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC;QAEhD,IAAI,CAAC,WAAW,GAAG;YACjB,KAAK,EAAE,WAAW;YAClB,SAAS;SACV,CAAC;QAEF,OAAO,WAAW,CAAC;IACrB,CAAC;IAEO,cAAc,CAAC,WAAwB;QAC7C,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC,SAAS,CAAC;IAC7C,CAAC;IAEO,YAAY,CAAC,WAAwB;QAC3C,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,oBAAoB,IAAI,IAAI,CAAC;QAC/D,MAAM,QAAQ,GAAG,aAAa,GAAG,IAAI,CAAC;QACtC,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC,SAAS,GAAG,QAAQ,CAAC;IACxD,CAAC;IAED,eAAe;QACb,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;IAC7B,CAAC;CACF"}
+{"version":3,"file":"workload-identity-auth.mjs","sourceRoot":"","sources":["../src/auth/workload-identity-auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,KAAK,8BAA0B;AAC3C,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,0BAAsB;AAOlE,MAAM,mBAAmB,GAA8D;IACrF,GAAG,EAAE,sCAAsC;IAC3C,EAAE,EAAE,2CAA2C;CAChD,CAAC;AAEF,MAAM,yBAAyB,GAAG,iDAAiD,CAAC;AAEpF;;;;;;GAMG;AACH,MAAM,OAAO,oBAAoB;IAQ/B;;;;;OAKG;IACH,YAAY,MAAwB,EAAE,KAAa;QAb3C,gBAAW,GAAuB,IAAI,CAAC;QACvC,mBAAc,GAA2B,IAAI,CAAC;QAC9C,oBAAe,GAAG,CAAC,CAAC;QAEX,qBAAgB,GAAW,qCAAqC,CAAC;QAUhF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,KAAK,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;IAChD,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,oBAAoB,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/E,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;gBACxB,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC;YACnC,CAAC;YAED,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC/D,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;YAErC,IAAI,CAAC;gBACH,OAAO,MAAM,cAAc,CAAC;YAC9B,CAAC;oBAAS,CAAC;gBACT,IAAI,IAAI,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;oBAC3C,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;gBAC7B,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YAChE,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC1E,IAAI,IAAI,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;oBAC3C,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;gBAC7B,CAAC;YACH,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;YACrC,KAAK,cAAc,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;QAED,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,UAAkB;QAC3C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC3D,MAAM,IAAI,GAA2B;YACnC,UAAU,EAAE,yBAAyB;YACrC,aAAa,EAAE,YAAY;YAC3B,kBAAkB,EAAE,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;YACvE,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;YACpD,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;SACjD,CAAC;QAEF,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACzB,IAAI,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC3C,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,IAAI,GAAQ,SAAS,CAAC;YAE1B,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,gCAAgC;YAClC,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAClF,MAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAyB,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;YACnF,CAAC;YACD,MAAM,QAAQ,CAAC,QAAQ,CACrB,QAAQ,CAAC,MAAM,EACf,IAAI,EACJ,qCAAqC,QAAQ,CAAC,MAAM,EAAE,EACtD,QAAQ,CAAC,OAAO,CACjB,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACrD,IACE,OAAO,aAAa,KAAK,QAAQ;YACjC,aAAa,KAAK,IAAI;YACtB,CAAC,CAAC,cAAc,IAAI,aAAa,CAAC;YAClC,OAAO,aAAa,CAAC,YAAY,KAAK,QAAQ;YAC9C,aAAa,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAC9C,CAAC;YACD,MAAM,IAAI,WAAW,CAAC,sDAAsD,CAAC,CAAC;QAChF,CAAC;QAED,MAAM,WAAW,GAAG,aAAa,CAAC,YAAY,CAAC;QAC/C,MAAM,SAAS,GAAI,aAAgD,CAAC,UAAU,IAAI,IAAI,CAAC;QACvF,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACnF,MAAM,IAAI,WAAW,CAAC,wDAAwD,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,GAAG,GAAG,SAAS,GAAG,IAAI,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;YACzD,MAAM,IAAI,WAAW,CAAC,wDAAwD,CAAC,CAAC;QAClF,CAAC;QAED,IAAI,IAAI,CAAC,eAAe,KAAK,UAAU,EAAE,CAAC;YACxC,IAAI,CAAC,WAAW,GAAG;gBACjB,KAAK,EAAE,WAAW;gBAClB,SAAS;aACV,CAAC;QACJ,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAEO,MAAM,CAAC,cAAc,CAAC,WAAwB;QACpD,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC,SAAS,CAAC;IAC7C,CAAC;IAEO,YAAY,CAAC,WAAwB;QAC3C,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,oBAAoB,IAAI,IAAI,CAAC;QAC/D,MAAM,QAAQ,GAAG,aAAa,GAAG,IAAI,CAAC;QACtC,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC,SAAS,GAAG,QAAQ,CAAC;IACxD,CAAC;IAED,sFAAsF;IACtF,eAAe;QACb,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;IAC7B,CAAC;CACF"}

package/azure.d.mts

@@ -1,6 +1,6 @@
-import type { RequestInit } from "./internal/builtin-types.mjs";
+import type { RequestInit, RequestInfo, Response } from "./internal/builtin-types.mjs";
 import type { NullableHeaders } from "./internal/headers.mjs";
-import { FinalRequestOptions } from "./internal/request-options.mjs";
+import type { FinalRequestOptions } from "./internal/request-options.mjs";
 import { OpenAI } from "./client.mjs";
 import type { ClientOptions } from "./client.mjs";
 /** API Client for interfacing with the Azure OpenAI API. */
@@ -16,8 +16,9 @@ export interface AzureClientOptions extends Omit<ClientOptions, 'provider'> {
      */
     endpoint?: string | undefined;
     /**
-     * A model deployment, if given, sets the base client URL to include `/deployments/{deployment}`.
-     * Note: this means you won't be able to use non-deployment endpoints. Not supported with Assistants APIs.
+     * Azure model deployment inserted into supported deployment-scoped request
+     * paths. The client's base URL remains unchanged, so non-deployment endpoints
+     * remain available.
      */
     deployment?: string | undefined;
     /**
@@ -32,35 +33,47 @@ export interface AzureClientOptions extends Omit<ClientOptions, 'provider'> {
 }
 /** API Client for interfacing with the Azure OpenAI API. */
 export declare class AzureOpenAI extends OpenAI {
+    /** Azure deployment configured for deployment-scoped model requests. */
     deploymentName: string | undefined;
+    /** Azure OpenAI API version included in requests made by this client. */
     apiVersion: string;
     /**
      * API Client for interfacing with the Azure OpenAI API.
      *
-     * @param {string | undefined} [opts.apiVersion=process.env['OPENAI_API_VERSION'] ?? undefined]
-     * @param {string | undefined} [opts.endpoint=process.env['AZURE_OPENAI_ENDPOINT'] ?? undefined] - Your Azure endpoint, including the resource, e.g. `https://example-resource.azure.openai.com/`
-     * @param {string | undefined} [opts.apiKey=process.env['AZURE_OPENAI_API_KEY'] ?? undefined]
-     * @param {string | undefined} opts.deployment - A model deployment, if given, sets the base client URL to include `/deployments/{deployment}`.
-     * @param {string | null | undefined} [opts.organization=process.env['OPENAI_ORG_ID'] ?? null]
-     * @param {string} [opts.baseURL=process.env['OPENAI_BASE_URL']] - Sets the base URL for the API, e.g. `https://example-resource.azure.openai.com/openai/`.
-     * @param {number} [opts.timeout=10 minutes] - The maximum amount of time (in milliseconds) the client will wait for a response before timing out.
-     * @param {number} [opts.httpAgent] - An HTTP agent used to manage HTTP(s) connections.
+     * @param {string | undefined} [opts.apiVersion] - Defaults to `process.env['OPENAI_API_VERSION'] ?? undefined`.
+     * @param {string | undefined} [opts.endpoint] - Your Azure endpoint, including the resource, e.g. `https://example-resource.azure.openai.com/`. Defaults to `process.env['AZURE_OPENAI_ENDPOINT'] ?? undefined`.
+     * @param {string | undefined} [opts.apiKey] - Defaults to `process.env['AZURE_OPENAI_API_KEY'] ?? undefined`.
+     * @param {string | undefined} opts.deployment - Azure model deployment inserted into supported deployment-scoped request paths.
+     * @param {string | null | undefined} [opts.organization] - Defaults to `process.env['OPENAI_ORG_ID'] ?? null`.
+     * @param {string} [opts.baseURL] - Sets the base URL for the API, e.g. `https://example-resource.azure.openai.com/openai/`. Defaults to `process.env['OPENAI_BASE_URL']`.
+     * @param {number} [opts.timeout] - The maximum amount of time (in milliseconds) the client will wait for a response before timing out. Defaults to 10 minutes.
+     * @param {() => Promise<string>} [opts.azureADTokenProvider] - Returns a fresh Microsoft Entra access token for each request; cannot be combined with `apiKey`.
      * @param {Fetch} [opts.fetch] - Specify a custom `fetch` function implementation.
-     * @param {number} [opts.maxRetries=2] - The maximum number of times the client will retry a request.
+     * @param {number} [opts.maxRetries] - The maximum number of times the client will retry a request. Defaults to `2`.
      * @param {Headers} opts.defaultHeaders - Default headers to include with every request to the API.
      * @param {DefaultQuery} opts.defaultQuery - Default query parameters to include with every request to the API.
-     * @param {boolean} [opts.dangerouslyAllowBrowser=false] - By default, client-side use of this library is not allowed, as it risks exposing your secret API credentials to attackers.
+     * @param {boolean} [opts.dangerouslyAllowBrowser] - By default, client-side use of this library is not allowed, as it risks exposing your secret API credentials to attackers. Defaults to `false`.
      */
     constructor({ baseURL, apiKey, apiVersion, endpoint, deployment, azureADTokenProvider, dangerouslyAllowBrowser, ...opts }?: AzureClientOptions);
+    /** Builds an Azure request and inserts its deployment into model-scoped endpoint paths. */
     buildRequest(options: FinalRequestOptions, props?: {
+        /** Number of retries already attempted for the current request. */
         retryCount?: number;
     }): Promise<{
+        /** Fetch request options after authentication, headers, and the body are prepared. */
         req: RequestInit & {
+            /** Fully resolved request headers sent to Azure OpenAI. */
             headers: Headers;
         };
+        /** Absolute deployment-aware request URL. */
         url: string;
+        /** Request timeout in milliseconds. */
         timeout: number;
     }>;
+    protected fetchWithAuth(url: RequestInfo, init: RequestInit, timeout: number, controller: AbortController, schemes?: {
+        bearerAuth?: boolean;
+        adminAPIKeyAuth?: boolean;
+    }): Promise<Response>;
     protected authHeaders(opts: FinalRequestOptions, schemes?: {
         bearerAuth?: boolean;
         adminAPIKeyAuth?: boolean;

package/azure.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"azure.d.mts","sourceRoot":"","sources":["src/azure.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,qCAAiC;AAC5D,OAAO,KAAK,EAAE,eAAe,EAAE,+BAA2B;AAG1D,OAAO,EAAE,mBAAmB,EAAE,uCAAmC;AAEjE,OAAO,EAAE,MAAM,EAAE,qBAAiB;AAClC,OAAO,KAAK,EAAE,aAAa,EAAE,qBAAiB;AAE9C,4DAA4D;AAC5D,MAAM,WAAW,kBAAmB,SAAQ,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC;IACzE,uEAAuE;IACvE,QAAQ,CAAC,EAAE,KAAK,CAAC;IAEjB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEhC;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE9B;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEhC;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE5B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;CAC5D;AAED,4DAA4D;AAC5D,qBAAa,WAAY,SAAQ,MAAM;IACrC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,UAAU,EAAE,MAAM,CAAM;IAExB;;;;;;;;;;;;;;;;OAgBG;gBACS,EACV,OAAoC,EACpC,MAAwC,EACxC,UAA0C,EAC1C,QAAQ,EACR,UAAU,EACV,oBAAoB,EACpB,uBAAuB,EACvB,GAAG,IAAI,EACR,GAAE,kBAAuB;IA0DX,YAAY,CACzB,OAAO,EAAE,mBAAmB,EAC5B,KAAK,GAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAO,GAClC,OAAO,CAAC;QAAE,GAAG,EAAE,WAAW,GAAG;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;cAa5D,WAAW,CAClC,IAAI,EAAE,mBAAmB,EACzB,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAC;QAAC,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GAC5D,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;CAOxC"}
+{"version":3,"file":"azure.d.mts","sourceRoot":"","sources":["src/azure.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,qCAAiC;AACnF,OAAO,KAAK,EAAE,eAAe,EAAE,+BAA2B;AAG1D,OAAO,KAAK,EAAE,mBAAmB,EAAE,uCAAmC;AAGtE,OAAO,EAAE,MAAM,EAAE,qBAAiB;AAClC,OAAO,KAAK,EAAE,aAAa,EAAE,qBAAiB;AAE9C,4DAA4D;AAC5D,MAAM,WAAW,kBAAmB,SAAQ,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC;IACzE,uEAAuE;IACvE,QAAQ,CAAC,EAAE,KAAK,CAAC;IAEjB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEhC;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE9B;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEhC;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE5B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;CAC5D;AAED,4DAA4D;AAC5D,qBAAa,WAAY,SAAQ,MAAM;IACrC,wEAAwE;IACxE,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,yEAAyE;IACzE,UAAU,SAAM;IAEhB;;;;;;;;;;;;;;;;OAgBG;gBACS,EACV,OAAoC,EACpC,MAAwC,EACxC,UAA0C,EAC1C,QAAQ,EACR,UAAU,EACV,oBAAoB,EACpB,uBAAuB,EACvB,GAAG,IAAI,EACR,GAAE,kBAAuB;IAwD1B,2FAA2F;IAC5E,YAAY,CACzB,OAAO,EAAE,mBAAmB,EAC5B,KAAK,GAAE;QACL,mEAAmE;QACnE,UAAU,CAAC,EAAE,MAAM,CAAC;KAChB,GACL,OAAO,CAAC;QACT,sFAAsF;QACtF,GAAG,EAAE,WAAW,GAAG;YACjB,2DAA2D;YAC3D,OAAO,EAAE,OAAO,CAAC;SAClB,CAAC;QACF,6CAA6C;QAC7C,GAAG,EAAE,MAAM,CAAC;QACZ,uCAAuC;QACvC,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;cAiBuB,aAAa,CACpC,GAAG,EAAE,WAAW,EAChB,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,eAAe,EAC3B,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAC;QAAC,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GAC5D,OAAO,CAAC,QAAQ,CAAC;cAQK,WAAW,CAClC,IAAI,EAAE,mBAAmB,EACzB,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAC;QAAC,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GAC5D,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;CAOxC"}

package/azure.d.ts

@@ -1,6 +1,6 @@
-import type { RequestInit } from "./internal/builtin-types.js";
+import type { RequestInit, RequestInfo, Response } from "./internal/builtin-types.js";
 import type { NullableHeaders } from "./internal/headers.js";
-import { FinalRequestOptions } from "./internal/request-options.js";
+import type { FinalRequestOptions } from "./internal/request-options.js";
 import { OpenAI } from "./client.js";
 import type { ClientOptions } from "./client.js";
 /** API Client for interfacing with the Azure OpenAI API. */
@@ -16,8 +16,9 @@ export interface AzureClientOptions extends Omit<ClientOptions, 'provider'> {
      */
     endpoint?: string | undefined;
     /**
-     * A model deployment, if given, sets the base client URL to include `/deployments/{deployment}`.
-     * Note: this means you won't be able to use non-deployment endpoints. Not supported with Assistants APIs.
+     * Azure model deployment inserted into supported deployment-scoped request
+     * paths. The client's base URL remains unchanged, so non-deployment endpoints
+     * remain available.
      */
     deployment?: string | undefined;
     /**
@@ -32,35 +33,47 @@ export interface AzureClientOptions extends Omit<ClientOptions, 'provider'> {
 }
 /** API Client for interfacing with the Azure OpenAI API. */
 export declare class AzureOpenAI extends OpenAI {
+    /** Azure deployment configured for deployment-scoped model requests. */
     deploymentName: string | undefined;
+    /** Azure OpenAI API version included in requests made by this client. */
     apiVersion: string;
     /**
      * API Client for interfacing with the Azure OpenAI API.
      *
-     * @param {string | undefined} [opts.apiVersion=process.env['OPENAI_API_VERSION'] ?? undefined]
-     * @param {string | undefined} [opts.endpoint=process.env['AZURE_OPENAI_ENDPOINT'] ?? undefined] - Your Azure endpoint, including the resource, e.g. `https://example-resource.azure.openai.com/`
-     * @param {string | undefined} [opts.apiKey=process.env['AZURE_OPENAI_API_KEY'] ?? undefined]
-     * @param {string | undefined} opts.deployment - A model deployment, if given, sets the base client URL to include `/deployments/{deployment}`.
-     * @param {string | null | undefined} [opts.organization=process.env['OPENAI_ORG_ID'] ?? null]
-     * @param {string} [opts.baseURL=process.env['OPENAI_BASE_URL']] - Sets the base URL for the API, e.g. `https://example-resource.azure.openai.com/openai/`.
-     * @param {number} [opts.timeout=10 minutes] - The maximum amount of time (in milliseconds) the client will wait for a response before timing out.
-     * @param {number} [opts.httpAgent] - An HTTP agent used to manage HTTP(s) connections.
+     * @param {string | undefined} [opts.apiVersion] - Defaults to `process.env['OPENAI_API_VERSION'] ?? undefined`.
+     * @param {string | undefined} [opts.endpoint] - Your Azure endpoint, including the resource, e.g. `https://example-resource.azure.openai.com/`. Defaults to `process.env['AZURE_OPENAI_ENDPOINT'] ?? undefined`.
+     * @param {string | undefined} [opts.apiKey] - Defaults to `process.env['AZURE_OPENAI_API_KEY'] ?? undefined`.
+     * @param {string | undefined} opts.deployment - Azure model deployment inserted into supported deployment-scoped request paths.
+     * @param {string | null | undefined} [opts.organization] - Defaults to `process.env['OPENAI_ORG_ID'] ?? null`.
+     * @param {string} [opts.baseURL] - Sets the base URL for the API, e.g. `https://example-resource.azure.openai.com/openai/`. Defaults to `process.env['OPENAI_BASE_URL']`.
+     * @param {number} [opts.timeout] - The maximum amount of time (in milliseconds) the client will wait for a response before timing out. Defaults to 10 minutes.
+     * @param {() => Promise<string>} [opts.azureADTokenProvider] - Returns a fresh Microsoft Entra access token for each request; cannot be combined with `apiKey`.
      * @param {Fetch} [opts.fetch] - Specify a custom `fetch` function implementation.
-     * @param {number} [opts.maxRetries=2] - The maximum number of times the client will retry a request.
+     * @param {number} [opts.maxRetries] - The maximum number of times the client will retry a request. Defaults to `2`.
      * @param {Headers} opts.defaultHeaders - Default headers to include with every request to the API.
      * @param {DefaultQuery} opts.defaultQuery - Default query parameters to include with every request to the API.
-     * @param {boolean} [opts.dangerouslyAllowBrowser=false] - By default, client-side use of this library is not allowed, as it risks exposing your secret API credentials to attackers.
+     * @param {boolean} [opts.dangerouslyAllowBrowser] - By default, client-side use of this library is not allowed, as it risks exposing your secret API credentials to attackers. Defaults to `false`.
      */
     constructor({ baseURL, apiKey, apiVersion, endpoint, deployment, azureADTokenProvider, dangerouslyAllowBrowser, ...opts }?: AzureClientOptions);
+    /** Builds an Azure request and inserts its deployment into model-scoped endpoint paths. */
     buildRequest(options: FinalRequestOptions, props?: {
+        /** Number of retries already attempted for the current request. */
         retryCount?: number;
     }): Promise<{
+        /** Fetch request options after authentication, headers, and the body are prepared. */
         req: RequestInit & {
+            /** Fully resolved request headers sent to Azure OpenAI. */
             headers: Headers;
         };
+        /** Absolute deployment-aware request URL. */
         url: string;
+        /** Request timeout in milliseconds. */
         timeout: number;
     }>;
+    protected fetchWithAuth(url: RequestInfo, init: RequestInit, timeout: number, controller: AbortController, schemes?: {
+        bearerAuth?: boolean;
+        adminAPIKeyAuth?: boolean;
+    }): Promise<Response>;
     protected authHeaders(opts: FinalRequestOptions, schemes?: {
         bearerAuth?: boolean;
         adminAPIKeyAuth?: boolean;