openai 7.4.0 → 7.6.0

package/src/realtime/websocket.ts

@@ -1,37 +1,173 @@
-import { AzureOpenAI, OpenAI } from '../index';
+import type { AzureOpenAI } from '../index';
+import { assertBedrockWebSocketOrigin } from '../internal/bedrock';
+import { OpenAI } from '../index';
 import { OpenAIError } from '../error';
-import type { RealtimeClientEvent, RealtimeServerEvent } from '../resources/realtime/realtime';
+import type { RealtimeClientEvent } from '../resources/realtime/realtime';
 import {
   OpenAIRealtimeEmitter,
   buildRealtimeURL,
   getAzureRealtimeConnection,
   isAzure,
-  type AzureRealtimeConnectionConfig,
-  type RealtimeConnectionConfig,
+  parseRealtimeEvent,
 } from './internal-base';
+import type { AzureRealtimeConnectionConfig, RealtimeConnectionConfig } from './internal-base';
 import { isRunningInBrowser } from '../internal/detect-platform';
 
 interface MessageEvent {
   data: string;
 }
 
-type _WebSocket =
-  typeof globalThis extends (
-    {
-      WebSocket: infer ws extends abstract new (...args: any) => any;
-    }
-  ) ?
-    // @ts-ignore
+/** Native WebSocket instance supplied by the current JavaScript runtime. */
+type _WebSocket = typeof globalThis extends {
+  /** Runtime-provided WebSocket constructor used for native Realtime connections. */
+  WebSocket: infer ws extends abstract new (...args: any) => any;
+}
+  ? // @ts-ignore
     InstanceType<ws>
   : any;
 
+type RuntimeScope = typeof globalThis & {
+  process?: { versions?: { node?: string } };
+  WorkerGlobalScope?: typeof Object;
+  WorkerNavigator?: typeof Object;
+  Deno?: { version?: { deno?: string } };
+  Bun?: { version?: string };
+  EdgeRuntime?: unknown;
+  WebSocketPair?: unknown;
+};
+
+/** Identifies browser pages and workers without blocking trusted server runtimes. */
+function isRunningInBrowserOrBrowserWorker(): boolean {
+  if (isRunningInBrowser()) {
+    return true;
+  }
+
+  const scope = globalThis as RuntimeScope;
+  return (
+    typeof scope.WorkerGlobalScope === 'function' &&
+    scope instanceof scope.WorkerGlobalScope &&
+    typeof scope.WorkerNavigator === 'function' &&
+    scope.navigator instanceof scope.WorkerNavigator &&
+    typeof scope.navigator?.userAgent === 'string' &&
+    scope.navigator.userAgent !== 'Cloudflare-Workers' &&
+    scope.process?.versions?.node === undefined &&
+    scope.Deno === undefined &&
+    scope.Bun === undefined &&
+    scope.EdgeRuntime === undefined &&
+    scope.WebSocketPair === undefined
+  );
+}
+
+/** Reports whether the runtime supports request headers in native WebSocket options. */
+function supportsWebSocketRequestHeaders(): boolean {
+  const scope = globalThis as RuntimeScope;
+  if (
+    isRunningInBrowserOrBrowserWorker() ||
+    scope.EdgeRuntime !== undefined ||
+    scope.WebSocketPair !== undefined ||
+    scope.navigator?.userAgent === 'Cloudflare-Workers'
+  ) {
+    return false;
+  }
+
+  if (scope.Deno !== undefined) {
+    const [major, minor] = (scope.Deno.version?.deno ?? '').split('.').map(Number);
+    return major !== undefined && minor !== undefined && (major > 2 || (major === 2 && minor >= 5));
+  }
+
+  if (typeof scope.Bun?.version === 'string') {
+    return true;
+  }
+
+  return (
+    Object.prototype.toString.call(scope.process) === '[object process]' &&
+    typeof scope.process?.versions?.node === 'string'
+  );
+}
+
+/** Removes Azure credentials while preserving the existing public URL redaction contract. */
+function redactAzureCredentials(url: URL, isBearerToken: boolean): void {
+  let hasApiKey = !isBearerToken;
+  let hasAuthorization = isBearerToken;
+  const parameterNames = [...url.searchParams.keys()];
+
+  for (const name of parameterNames) {
+    if (name.toLowerCase() === 'api-key') {
+      hasApiKey = true;
+      url.searchParams.delete(name);
+    } else if (name.toLowerCase() === 'authorization') {
+      hasAuthorization = true;
+      url.searchParams.delete(name);
+    }
+  }
+
+  if (hasApiKey) {
+    url.searchParams.set('api-key', '<REDACTED>');
+  }
+  if (hasAuthorization) {
+    url.searchParams.set('Authorization', '<REDACTED>');
+  }
+}
+
+/** Opens an Azure native socket with header authentication and a credential-free URL. */
+function createAzureWebSocket(
+  url: URL,
+  apiKey: string | null,
+  isBearerToken: boolean,
+  protocols: string[],
+): _WebSocket {
+  if (!supportsWebSocketRequestHeaders()) {
+    throw new OpenAIError(
+      'Azure OpenAI Realtime credentials require a WebSocket transport that supports request headers; use openai/realtime/ws or a server-side authentication proxy.',
+    );
+  }
+  if (!apiKey) {
+    throw new Error('Azure OpenAI Realtime requires an API key');
+  }
+
+  redactAzureCredentials(url, isBearerToken);
+  const socketURL = new URL(url);
+  socketURL.searchParams.delete('api-key');
+  socketURL.searchParams.delete('Authorization');
+  const headers = isBearerToken ? { Authorization: `Bearer ${apiKey}` } : { 'api-key': apiKey };
+
+  // @ts-ignore
+  return new WebSocket(socketURL.toString(), { protocols, headers });
+}
+
+/**
+ * Connects to the Realtime API using the runtime's native `WebSocket` implementation.
+ *
+ * Browser use is blocked by default to prevent secret API-key exposure. Use an
+ * ephemeral Realtime credential in browser clients; set
+ * `dangerouslyAllowBrowser` only after independently securing the credential.
+ * Register an SDK `error` listener and wait for `socket`'s `open` event before
+ * sending Realtime client events.
+ */
 export class OpenAIRealtimeWebSocket extends OpenAIRealtimeEmitter {
+  /** Secure Realtime WebSocket URL; Azure authentication query parameters are redacted. */
   url: URL;
+
+  /** Underlying runtime-native WebSocket instance for connection lifecycle events. */
   socket: _WebSocket;
 
+  /**
+   * Immediately opens a native WebSocket session or attaches to an existing call.
+   *
+   * Clients with function-based credentials must use
+   * {@link OpenAIRealtimeWebSocket.create}; Azure clients should use
+   * {@link OpenAIRealtimeWebSocket.azure}. An ephemeral credential whose value
+   * starts with `ek_` is permitted in browser runtimes automatically.
+   *
+   * @param props Exactly one model, transcription intent, or call ID, plus browser-safety settings.
+   * @param client Existing client whose endpoint and API key should be reused.
+   * @throws {OpenAIError} If browser access would expose an unapproved credential.
+   */
   constructor(
     props: RealtimeConnectionConfig & {
+      /** Allows browser execution; use only when the credential cannot expose a secret API key. */
       dangerouslyAllowBrowser?: boolean;
+
       /**
        * Callback to mutate the URL, needed for Azure.
        * @internal
@@ -48,7 +184,7 @@ export class OpenAIRealtimeWebSocket extends OpenAIRealtimeEmitter {
       props.dangerouslyAllowBrowser ??
       (client as any)?._options?.dangerouslyAllowBrowser ??
       (client?.apiKey?.startsWith('ek_') ? true : null);
-    if (!dangerouslyAllowBrowser && isRunningInBrowser()) {
+    if (!dangerouslyAllowBrowser && isRunningInBrowserOrBrowserWorker()) {
       throw new OpenAIError(
         "It looks like you're running in a browser-like environment.\n\nThis is disabled by default, as it risks exposing your secret API credentials to attackers.\n\nYou can avoid this error by creating an ephemeral session token:\nhttps://platform.openai.com/docs/api-reference/realtime-sessions\n",
       );
@@ -67,17 +203,34 @@ export class OpenAIRealtimeWebSocket extends OpenAIRealtimeEmitter {
 
     this.url = buildRealtimeURL(client, props);
     props.onURL?.(this.url);
+    if (this.url.protocol !== 'wss:') {
+      throw new OpenAIError('Realtime WebSocket URLs must use the wss: protocol.');
+    }
+    assertBedrockWebSocketOrigin(client, this.url);
+
+    const azure = isAzure(client);
+    const protocols = ['realtime', ...(azure ? [] : [`openai-insecure-api-key.${client.apiKey}`])];
 
-    // @ts-ignore
-    this.socket = new WebSocket(this.url.toString(), [
-      'realtime',
-      ...(isAzure(client) ? [] : [`openai-insecure-api-key.${client.apiKey}`]),
-    ]);
+    this.socket = azure
+      ? createAzureWebSocket(this.url, client.apiKey, props.__resolvedApiKey === true, protocols)
+      : new WebSocket(this.url.toString(), protocols);
 
     this.socket.addEventListener('message', (websocketEvent: MessageEvent) => {
       const event = (() => {
         try {
-          return JSON.parse(websocketEvent.data.toString()) as RealtimeServerEvent;
+          const parsedEvent = parseRealtimeEvent(websocketEvent.data.toString());
+
+          if (
+            typeof parsedEvent !== 'object' ||
+            parsedEvent === null ||
+            Array.isArray(parsedEvent) ||
+            !Object.getOwnPropertyDescriptor(parsedEvent, 'type') ||
+            typeof parsedEvent.type !== 'string'
+          ) {
+            throw new TypeError('Realtime WebSocket event must be an object with a string type.');
+          }
+
+          return parsedEvent;
         } catch (err) {
           this._onError(null, 'could not parse websocket event', err);
           return null;
@@ -99,26 +252,53 @@ export class OpenAIRealtimeWebSocket extends OpenAIRealtimeEmitter {
     this.socket.addEventListener('error', (event: any) => {
       this._onError(null, event.message, null);
     });
-
-    if (isAzure(client)) {
-      if (this.url.searchParams.get('Authorization') !== null) {
-        this.url.searchParams.set('Authorization', '<REDACTED>');
-      } else {
-        this.url.searchParams.set('api-key', '<REDACTED>');
-      }
-    }
   }
 
+  /**
+   * Resolves a client's current API credential before opening a native Realtime WebSocket.
+   *
+   * Use this factory instead of the constructor when the client's `apiKey` is a function.
+   *
+   * @param client OpenAI client that owns the endpoint and refreshable or static credential.
+   * @param props Exactly one model, transcription intent, or call ID, plus browser-safety settings.
+   */
   static async create(
     client: Pick<OpenAI, 'apiKey' | 'baseURL' | '_callApiKey'>,
-    props: RealtimeConnectionConfig & { dangerouslyAllowBrowser?: boolean },
+    props: RealtimeConnectionConfig & {
+      /** Allows browser execution after the caller has secured the supplied credential. */
+      dangerouslyAllowBrowser?: boolean;
+    },
   ): Promise<OpenAIRealtimeWebSocket> {
-    return new OpenAIRealtimeWebSocket({ ...props, __resolvedApiKey: await client._callApiKey() }, client);
+    const resolvedApiKey = await client._callApiKey();
+    const url = buildRealtimeURL(client, props);
+    assertBedrockWebSocketOrigin(client, url);
+    return new OpenAIRealtimeWebSocket(
+      {
+        ...props,
+        buildRealtimeURL: () => url,
+        __resolvedApiKey: resolvedApiKey,
+      },
+      client,
+    );
   }
 
+  /**
+   * Opens a native Azure deployment or transcription session, or an existing sideband call.
+   *
+   * Azure credentials are sent in WebSocket handshake headers and never appear
+   * in the native socket URL. Browser WebSockets cannot set these headers;
+   * use a server-side authentication proxy or the Node.js `ws` transport.
+   *
+   * @param client Azure OpenAI client that supplies the endpoint and credential.
+   * @param options Deployment, transcription intent, or call ID, plus browser-safety settings.
+   * @throws {Error} If the Azure credential or required deployment is unavailable.
+   */
   static async azure(
     client: Pick<AzureOpenAI, '_callApiKey' | 'apiVersion' | 'apiKey' | 'baseURL' | 'deploymentName'>,
-    options: AzureRealtimeConnectionConfig & { dangerouslyAllowBrowser?: boolean } = {},
+    options: AzureRealtimeConnectionConfig & {
+      /** Allows browser execution after the caller has secured the supplied Azure credential. */
+      dangerouslyAllowBrowser?: boolean;
+    } = {},
   ): Promise<OpenAIRealtimeWebSocket> {
     const connection = getAzureRealtimeConnection(client, options);
     const isApiKeyProvider = await client._callApiKey();
@@ -126,27 +306,22 @@ export class OpenAIRealtimeWebSocket extends OpenAIRealtimeEmitter {
     if (!apiKey) {
       throw new Error('Azure OpenAI Realtime requires an API key');
     }
-    const azureApiKey = apiKey;
-    function onURL(url: URL) {
-      if (isApiKeyProvider) {
-        url.searchParams.set('Authorization', `Bearer ${azureApiKey}`);
-      } else {
-        url.searchParams.set('api-key', azureApiKey);
-      }
-    }
     const { dangerouslyAllowBrowser } = options;
     return new OpenAIRealtimeWebSocket(
       {
         ...connection,
-        onURL,
-        ...(dangerouslyAllowBrowser ? { dangerouslyAllowBrowser } : {}),
+        ...(dangerouslyAllowBrowser === undefined ? {} : { dangerouslyAllowBrowser }),
         __resolvedApiKey: isApiKeyProvider,
       },
       client,
     );
   }
 
-  send(event: RealtimeClientEvent) {
+  /**
+   * Serializes and sends a Realtime client event after the native WebSocket has opened.
+   * Serialization and transport failures are delivered to the SDK `error` event.
+   */
+  send(event: RealtimeClientEvent): void {
     try {
       this.socket.send(JSON.stringify(event));
     } catch (err) {
@@ -154,7 +329,17 @@ export class OpenAIRealtimeWebSocket extends OpenAIRealtimeEmitter {
     }
   }
 
-  close(props?: { code: number; reason: string }) {
+  /**
+   * Closes the WebSocket with status code `1000` and reason `OK` by default.
+   * Connection-closing failures are delivered to the SDK `error` event.
+   */
+  close(props?: {
+    /** WebSocket close status code; defaults to `1000`. */
+    code: number;
+
+    /** WebSocket close reason; defaults to `OK`. */
+    reason: string;
+  }): void {
     try {
       this.socket.close(props?.code ?? 1000, props?.reason ?? 'OK');
     } catch (err) {

package/src/realtime/ws.ts

@@ -1,23 +1,50 @@
 import * as WS from 'ws';
-import { AzureOpenAI, OpenAI } from '../index';
-import type { RealtimeClientEvent, RealtimeServerEvent } from '../resources/realtime/realtime';
+import { assertBedrockWebSocketOrigin } from '../internal/bedrock';
+import { protectWebSocketOptionsFromCredentialRedirects } from '../internal/ws';
+import type { AzureOpenAI } from '../index';
+import { OpenAI } from '../index';
+import type { RealtimeClientEvent } from '../resources/realtime/realtime';
 import {
   OpenAIRealtimeEmitter,
   buildRealtimeURL,
   getAzureRealtimeConnection,
   isAzure,
-  type AzureRealtimeConnectionConfig,
-  type RealtimeConnectionConfig,
+  parseRealtimeEvent,
 } from './internal-base';
+import type { AzureRealtimeConnectionConfig, RealtimeConnectionConfig } from './internal-base';
 
+/**
+ * Connects to the Realtime API using the Node.js `ws` WebSocket implementation.
+ *
+ * Install the optional `ws` peer dependency before importing this entrypoint.
+ * Subscribe to `socket`'s `open` and `close` events for connection lifecycle,
+ * and register an SDK `error` listener for API or transport failures.
+ */
 export class OpenAIRealtimeWS extends OpenAIRealtimeEmitter {
+  /** Secure Realtime WebSocket URL with its model, transcription intent, or call ID. */
   url: URL;
+
+  /** Underlying `ws.WebSocket` instance for connection lifecycle and transport events. */
   socket: WS.WebSocket;
 
+  /**
+   * Immediately opens a model or transcription session, or attaches to an existing call.
+   *
+   * Pass an existing OpenAI client as the second argument to reuse its endpoint
+   * and static credentials. Clients with function-based credentials must use
+   * {@link OpenAIRealtimeWS.create}; Azure clients should use
+   * {@link OpenAIRealtimeWS.azure}.
+   *
+   * @param props Exactly one model, transcription intent, or call ID, plus `ws` client settings.
+   * @param client Existing client whose endpoint and API key should be reused.
+   */
   constructor(
     props: RealtimeConnectionConfig & {
+      /** Options passed directly to the underlying `ws.WebSocket` constructor. */
       options?: WS.ClientOptions | undefined;
-      /** @internal */ __resolvedApiKey?: boolean;
+
+      /** Indicates that a function-based credential was resolved by an async factory. @internal */
+      __resolvedApiKey?: boolean;
     },
     client?: Pick<OpenAI, 'apiKey' | 'baseURL'>,
   ) {
@@ -33,18 +60,36 @@ export class OpenAIRealtimeWS extends OpenAIRealtimeEmitter {
       );
     }
     this.url = buildRealtimeURL(client, props);
-    this.socket = new WS.WebSocket(this.url, {
-      ...props.options,
-      headers: {
-        ...props.options?.headers,
-        ...(isAzure(client) && !props.__resolvedApiKey ? {} : { Authorization: `Bearer ${client.apiKey}` }),
-      },
-    });
+    assertBedrockWebSocketOrigin(client, this.url);
+    const headers = {
+      ...props.options?.headers,
+      ...(isAzure(client) && !props.__resolvedApiKey ? {} : { Authorization: `Bearer ${client.apiKey}` }),
+    };
+
+    this.socket = new WS.WebSocket(
+      this.url,
+      protectWebSocketOptionsFromCredentialRedirects({
+        ...props.options,
+        headers,
+      }),
+    );
 
     this.socket.on('message', (wsEvent) => {
       const event = (() => {
         try {
-          return JSON.parse(wsEvent.toString()) as RealtimeServerEvent;
+          const parsedEvent = parseRealtimeEvent(wsEvent.toString());
+
+          if (
+            typeof parsedEvent !== 'object' ||
+            parsedEvent === null ||
+            Array.isArray(parsedEvent) ||
+            !Object.getOwnPropertyDescriptor(parsedEvent, 'type') ||
+            typeof parsedEvent.type !== 'string'
+          ) {
+            throw new TypeError('Realtime WebSocket event must be an object with a string type.');
+          }
+
+          return parsedEvent;
         } catch (err) {
           this._onError(null, 'could not parse websocket event', err);
           return null;
@@ -68,16 +113,51 @@ export class OpenAIRealtimeWS extends OpenAIRealtimeEmitter {
     });
   }
 
+  /**
+   * Resolves a client's current API credential before opening a Realtime connection.
+   *
+   * Use this factory instead of the constructor when the client's `apiKey` is a function.
+   *
+   * @param client OpenAI client that owns the endpoint and refreshable or static credential.
+   * @param props Exactly one model, transcription intent, or call ID, plus `ws` client settings.
+   */
   static async create(
     client: Pick<OpenAI, 'apiKey' | 'baseURL' | '_callApiKey'>,
-    props: RealtimeConnectionConfig & { options?: WS.ClientOptions | undefined },
+    props: RealtimeConnectionConfig & {
+      /** Options passed directly to the underlying `ws.WebSocket` constructor. */
+      options?: WS.ClientOptions | undefined;
+    },
   ): Promise<OpenAIRealtimeWS> {
-    return new OpenAIRealtimeWS({ ...props, __resolvedApiKey: await client._callApiKey() }, client);
+    const resolvedApiKey = await client._callApiKey();
+    const url = buildRealtimeURL(client, props);
+    assertBedrockWebSocketOrigin(client, url);
+    return new OpenAIRealtimeWS(
+      {
+        ...props,
+        buildRealtimeURL: () => url,
+        __resolvedApiKey: resolvedApiKey,
+      },
+      client,
+    );
   }
 
+  /**
+   * Opens an Azure deployment or transcription session, or an existing sideband call.
+   *
+   * Static Azure API keys are sent in the `api-key` header; function-based
+   * credentials are resolved first and sent as bearer credentials. The client's
+   * configured deployment is used unless a deployment, transcription intent, or call ID is supplied.
+   *
+   * @param client Azure OpenAI client that supplies the endpoint and credential.
+   * @param props Deployment, transcription intent, or call ID, plus `ws` connection settings.
+   * @throws {Error} If the Azure credential or required deployment is unavailable.
+   */
   static async azure(
     client: Pick<AzureOpenAI, '_callApiKey' | 'apiVersion' | 'apiKey' | 'baseURL' | 'deploymentName'>,
-    props: AzureRealtimeConnectionConfig & { options?: WS.ClientOptions | undefined } = {},
+    props: AzureRealtimeConnectionConfig & {
+      /** Options passed directly to the underlying `ws.WebSocket` constructor. */
+      options?: WS.ClientOptions | undefined;
+    } = {},
   ): Promise<OpenAIRealtimeWS> {
     const connection = getAzureRealtimeConnection(client, props);
     const isApiKeyProvider = await client._callApiKey();
@@ -101,7 +181,11 @@ export class OpenAIRealtimeWS extends OpenAIRealtimeEmitter {
     );
   }
 
-  send(event: RealtimeClientEvent) {
+  /**
+   * Serializes and sends a Realtime client event after the WebSocket has opened.
+   * Serialization and transport failures are delivered to the SDK `error` event.
+   */
+  send(event: RealtimeClientEvent): void {
     try {
       this.socket.send(JSON.stringify(event));
     } catch (err) {
@@ -109,7 +193,17 @@ export class OpenAIRealtimeWS extends OpenAIRealtimeEmitter {
     }
   }
 
-  close(props?: { code: number; reason: string }) {
+  /**
+   * Closes the WebSocket with status code `1000` and reason `OK` by default.
+   * Connection-closing failures are delivered to the SDK `error` event.
+   */
+  close(props?: {
+    /** WebSocket close status code; defaults to `1000`. */
+    code: number;
+
+    /** WebSocket close reason; defaults to `OK`. */
+    reason: string;
+  }): void {
     try {
       this.socket.close(props?.code ?? 1000, props?.reason ?? 'OK');
     } catch (err) {

package/src/resources/admin/admin.ts

@@ -1,4 +1,4 @@
-// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+// File generated from our OpenAPI spec by Castiron. See CONTRIBUTING.md for details.
 
 import { APIResource } from '../../core/resource';
 import * as OrganizationAPI from './organization/organization';

package/src/resources/admin/index.ts

@@ -1,4 +1,4 @@
-// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+// File generated from our OpenAPI spec by Castiron. See CONTRIBUTING.md for details.
 
 export { Admin } from './admin';
 export { Organization } from './organization/index';

package/src/resources/admin/organization/admin-api-keys.ts

@@ -1,4 +1,4 @@
-// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+// File generated from our OpenAPI spec by Castiron. See CONTRIBUTING.md for details.
 
 import { APIResource } from '../../../core/resource';
 import { APIPromise } from '../../../core/api-promise';

package/src/resources/admin/organization/audit-logs.ts

@@ -1,4 +1,4 @@
-// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+// File generated from our OpenAPI spec by Castiron. See CONTRIBUTING.md for details.
 
 import { APIResource } from '../../../core/resource';
 import {
@@ -125,6 +125,7 @@ export interface AuditLogListResponse {
     | 'tenant.workload_identity.mapping.archived'
     | 'tenant.workload_identity.binding.created'
     | 'tenant.workload_identity.principal.provisioned'
+    | 'tenant.workload_identity.access_token.issued'
     | 'tenant.admin_api_key.created'
     | 'tenant.admin_api_key.updated'
     | 'tenant.admin_api_key.deleted'
@@ -181,6 +182,7 @@ export interface AuditLogListResponse {
     | 'tenant.resource_role_assignment.deleted'
     | 'tenant.resource_access.updated'
     | 'tenant.resource_access.deleted'
+    | 'tenant.ads_account.onboarding.redemption'
     | 'tenant.session_policy.created'
     | 'tenant.session_policy.updated'
     | 'tenant.session_policy.deleted'
@@ -1929,6 +1931,7 @@ export interface AuditLogListParams extends ConversationCursorPageParams {
     | 'tenant.workload_identity.mapping.archived'
     | 'tenant.workload_identity.binding.created'
     | 'tenant.workload_identity.principal.provisioned'
+    | 'tenant.workload_identity.access_token.issued'
     | 'tenant.admin_api_key.created'
     | 'tenant.admin_api_key.updated'
     | 'tenant.admin_api_key.deleted'
@@ -1985,6 +1988,7 @@ export interface AuditLogListParams extends ConversationCursorPageParams {
     | 'tenant.resource_role_assignment.deleted'
     | 'tenant.resource_access.updated'
     | 'tenant.resource_access.deleted'
+    | 'tenant.ads_account.onboarding.redemption'
     | 'tenant.session_policy.created'
     | 'tenant.session_policy.updated'
     | 'tenant.session_policy.deleted'

package/src/resources/admin/organization/certificates.ts

@@ -1,4 +1,4 @@
-// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+// File generated from our OpenAPI spec by Castiron. See CONTRIBUTING.md for details.
 
 import { APIResource } from '../../../core/resource';
 import { APIPromise } from '../../../core/api-promise';

package/src/resources/admin/organization/data-retention.ts

@@ -1,4 +1,4 @@
-// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+// File generated from our OpenAPI spec by Castiron. See CONTRIBUTING.md for details.
 
 import { APIResource } from '../../../core/resource';
 import { APIPromise } from '../../../core/api-promise';

package/src/resources/admin/organization/groups/groups.ts

@@ -1,4 +1,4 @@
-// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+// File generated from our OpenAPI spec by Castiron. See CONTRIBUTING.md for details.
 
 import { APIResource } from '../../../../core/resource';
 import * as RolesAPI from './roles';

package/src/resources/admin/organization/groups/index.ts

@@ -1,4 +1,4 @@
-// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+// File generated from our OpenAPI spec by Castiron. See CONTRIBUTING.md for details.
 
 export {
   Groups,

package/src/resources/admin/organization/groups/roles.ts

@@ -1,4 +1,4 @@
-// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+// File generated from our OpenAPI spec by Castiron. See CONTRIBUTING.md for details.
 
 import { APIResource } from '../../../../core/resource';
 import * as RolesAPI from '../roles';

package/src/resources/admin/organization/groups/users.ts

@@ -1,4 +1,4 @@
-// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+// File generated from our OpenAPI spec by Castiron. See CONTRIBUTING.md for details.
 
 import { APIResource } from '../../../../core/resource';
 import { APIPromise } from '../../../../core/api-promise';

package/src/resources/admin/organization/groups.ts

@@ -1,3 +1,3 @@
-// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+// File generated from our OpenAPI spec by Castiron. See CONTRIBUTING.md for details.
 
 export * from './groups/index';

package/src/resources/admin/organization/index.ts

@@ -1,4 +1,4 @@
-// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+// File generated from our OpenAPI spec by Castiron. See CONTRIBUTING.md for details.
 
 export {
   AdminAPIKeys,
@@ -59,6 +59,7 @@ export { Organization } from './organization';
 export {
   Projects,
   type Project,
+  type ProjectResidency,
   type ProjectCreateParams,
   type ProjectUpdateParams,
   type ProjectListParams,
@@ -90,6 +91,7 @@ export {
 } from './spend-limit';
 export {
   Usage,
+  type CostQuantityUnit,
   type UsageAudioSpeechesResponse,
   type UsageAudioTranscriptionsResponse,
   type UsageCodeInterpreterSessionsResponse,