openai 7.4.0 → 7.6.0

package/client.js

@@ -1,6 +1,6 @@
 "use strict";
-// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
-var _OpenAI_instances, _a, _OpenAI_encoder, _OpenAI_baseURLOverridden;
+// File generated from our OpenAPI spec by Castiron. See CONTRIBUTING.md for details.
+var _OpenAI_instances, _a, _OpenAI_encoder, _OpenAI_x509Authentication, _OpenAI_x509Fetch, _OpenAI_explicitDataResidency, _OpenAI_responseAttempts, _OpenAI_baseURLOverridden;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OpenAI = void 0;
 const tslib_1 = require("./internal/tslib.js");
@@ -8,14 +8,18 @@ const uuid_1 = require("./internal/utils/uuid.js");
 const values_1 = require("./internal/utils/values.js");
 const sleep_1 = require("./internal/utils/sleep.js");
 const errors_1 = require("./internal/errors.js");
+const parse_1 = require("./internal/parse.js");
 const detect_platform_1 = require("./internal/detect-platform.js");
 const Shims = tslib_1.__importStar(require("./internal/shims.js"));
 const Opts = tslib_1.__importStar(require("./internal/request-options.js"));
 const query_1 = require("./internal/utils/query.js");
 const version_1 = require("./version.js");
+const data_residency_1 = require("./internal/data-residency.js");
 const Errors = tslib_1.__importStar(require("./core/error.js"));
 const Pagination = tslib_1.__importStar(require("./core/pagination.js"));
 const workload_identity_auth_1 = require("./auth/workload-identity-auth.js");
+const x509_workload_identity_auth_1 = require("./internal/auth/x509-workload-identity-auth.js");
+const _x509_transport_state_1 = require("#x509-transport-state");
 const error_1 = require("./core/error.js");
 const Uploads = tslib_1.__importStar(require("./core/uploads.js"));
 const API = tslib_1.__importStar(require("./resources/index.js"));
@@ -50,7 +54,24 @@ const provider_1 = require("./internal/provider.js");
 const env_1 = require("./internal/utils/env.js");
 const log_1 = require("./internal/utils/log.js");
 const values_2 = require("./internal/utils/values.js");
+function isRunningInBrowserOrBrowserWorker() {
+    if ((0, detect_platform_2.isRunningInBrowser)())
+        return true;
+    const scope = globalThis;
+    return (typeof scope.WorkerGlobalScope === 'function' &&
+        scope instanceof scope.WorkerGlobalScope &&
+        typeof scope.WorkerNavigator === 'function' &&
+        scope.navigator instanceof scope.WorkerNavigator &&
+        typeof scope.navigator?.userAgent === 'string' &&
+        scope.navigator.userAgent !== 'Cloudflare-Workers' &&
+        scope.process?.versions?.node === undefined &&
+        scope.Deno === undefined &&
+        scope.Bun === undefined &&
+        scope.EdgeRuntime === undefined &&
+        scope.WebSocketPair === undefined);
+}
 const WORKLOAD_IDENTITY_API_KEY_PLACEHOLDER = 'workload-identity-auth';
+const inheritedDataResidencySelection = Symbol('inheritedDataResidencySelection');
 /**
  * API Client for interfacing with the OpenAI API.
  */
@@ -76,6 +97,11 @@ class OpenAI {
     constructor(clientOptions = {}) {
         _OpenAI_instances.add(this);
         _OpenAI_encoder.set(this, void 0);
+        _OpenAI_x509Authentication.set(this, void 0);
+        _OpenAI_x509Fetch.set(this, void 0);
+        // Preserve an explicit global selection without storing a second routing URL.
+        _OpenAI_explicitDataResidency.set(this, false);
+        _OpenAI_responseAttempts.set(this, new WeakMap());
         /**
          * Given a prompt, the model will return one or more predicted completions, and can also return the probabilities of alternative tokens at each position.
          */
@@ -129,17 +155,26 @@ class OpenAI {
         this.evals = new API.Evals(this);
         this.containers = new API.Containers(this);
         this.skills = new API.Skills(this);
+        /**
+         * @deprecated The Sora API is scheduled to permanently shut down on September 24, 2026.
+         */
         this.videos = new API.Videos(this);
+        const residencyBaseURL = (0, data_residency_1.resolveDataResidency)(clientOptions);
         const provider = clientOptions.provider;
+        const { baseURL = provider ? null : (0, env_1.readEnv)('OPENAI_BASE_URL'), dataResidency: _dataResidency, [inheritedDataResidencySelection]: inheritedResidencySelection = false, apiKey = provider ? null : ((0, env_1.readEnv)('OPENAI_API_KEY') ?? null), adminAPIKey = provider ? null : ((0, env_1.readEnv)('OPENAI_ADMIN_KEY') ?? null), organization = provider ? null : ((0, env_1.readEnv)('OPENAI_ORG_ID') ?? null), project = provider ? null : ((0, env_1.readEnv)('OPENAI_PROJECT_ID') ?? null), webhookSecret = (0, env_1.readEnv)('OPENAI_WEBHOOK_SECRET') ?? null, workloadIdentity, x509Transport, ...opts } = clientOptions;
         if (provider) {
-            const conflictingOptions = ['apiKey', 'adminAPIKey', 'workloadIdentity', 'baseURL'].filter((key) => clientOptions[key] != null);
+            const conflictingOptions = ['apiKey', 'adminAPIKey', 'workloadIdentity', 'x509Transport', 'baseURL', 'dataResidency'].filter((key) => (key === 'workloadIdentity' ? workloadIdentity : clientOptions[key]) != null);
             if (conflictingOptions.length) {
                 throw new Errors.OpenAIError(`The \`provider\` option cannot be used with ${conflictingOptions
                     .map((key) => `\`${key}\``)
                     .join(', ')}. Configure authentication and the base URL through the provider instead.`);
             }
         }
-        const { baseURL = provider ? null : (0, env_1.readEnv)('OPENAI_BASE_URL'), apiKey = provider ? null : (0, env_1.readEnv)('OPENAI_API_KEY') ?? null, adminAPIKey = provider ? null : (0, env_1.readEnv)('OPENAI_ADMIN_KEY') ?? null, organization = provider ? null : (0, env_1.readEnv)('OPENAI_ORG_ID') ?? null, project = provider ? null : (0, env_1.readEnv)('OPENAI_PROJECT_ID') ?? null, webhookSecret = (0, env_1.readEnv)('OPENAI_WEBHOOK_SECRET') ?? null, workloadIdentity, ...opts } = clientOptions;
+        const identity = (0, x509_workload_identity_auth_1.isX509WorkloadIdentity)(workloadIdentity)
+            ? { x509: workloadIdentity, legacy: undefined }
+            : { x509: undefined, legacy: workloadIdentity };
+        const x509Identity = identity.x509;
+        const usesX509Identity = x509Identity !== undefined;
         const providerRuntime = provider ? (0, provider_1.configureProvider)(provider) : undefined;
         const options = {
             apiKey,
@@ -148,21 +183,42 @@ class OpenAI {
             project,
             webhookSecret,
             workloadIdentity,
+            x509Transport,
             provider,
             ...opts,
-            baseURL: providerRuntime?.baseURL ?? (baseURL || `https://api.openai.com/v1`),
+            baseURL: providerRuntime?.baseURL ??
+                residencyBaseURL ??
+                (baseURL || (usesX509Identity ? x509_workload_identity_auth_1.X509_API_BASE_URL : `https://api.openai.com/v1`)),
         };
+        if (x509Transport && !usesX509Identity) {
+            throw new Errors.OpenAIError('An X.509 transport requires an X.509 workload identity.');
+        }
+        if (usesX509Identity) {
+            if (residencyBaseURL !== undefined || inheritedResidencySelection) {
+                throw new Errors.OpenAIError('X.509 workload identity does not support data residency selection.');
+            }
+            if (clientOptions.fetch !== undefined) {
+                throw new Errors.OpenAIError('X.509 workload identity does not support a custom fetch implementation.');
+            }
+            (0, x509_workload_identity_auth_1.assertX509APIOrigin)(options.baseURL);
+            (0, x509_workload_identity_auth_1.assertX509RequestOptions)(options.fetchOptions);
+            if (this.fetchWithAuth !== _a.prototype.fetchWithAuth ||
+                this.fetchWithTimeout !== _a.prototype.fetchWithTimeout) {
+                throw new Errors.OpenAIError('X.509 workload identity does not support overridden fetch dispatch hooks.');
+            }
+        }
         if (apiKey && workloadIdentity) {
             throw new Errors.OpenAIError('The `apiKey` and `workloadIdentity` options are mutually exclusive');
         }
         if (!providerRuntime && !apiKey && !adminAPIKey && !workloadIdentity) {
             throw new Errors.OpenAIError('Missing credentials. Please pass an `apiKey`, `workloadIdentity`, `adminAPIKey`, or set the `OPENAI_API_KEY` or `OPENAI_ADMIN_KEY` environment variable.');
         }
-        if (!options.dangerouslyAllowBrowser && (0, detect_platform_2.isRunningInBrowser)()) {
+        if (!options.dangerouslyAllowBrowser && isRunningInBrowserOrBrowserWorker()) {
             throw new Errors.OpenAIError("It looks like you're running in a browser-like environment.\n\nThis is disabled by default, as it risks exposing your secret API credentials to attackers.\nIf you understand the risks and have appropriate mitigations in place,\nyou can set the `dangerouslyAllowBrowser` option to `true`, e.g.,\n\nnew OpenAI({ apiKey, dangerouslyAllowBrowser: true });\n\nhttps://help.openai.com/en/articles/5112595-best-practices-for-api-key-safety\n");
         }
         this.baseURL = options.baseURL;
-        this.timeout = options.timeout ?? _a.DEFAULT_TIMEOUT /* 10 minutes */;
+        tslib_1.__classPrivateFieldSet(this, _OpenAI_explicitDataResidency, residencyBaseURL !== undefined || inheritedResidencySelection, "f");
+        this.timeout = options.timeout ?? _a.DEFAULT_TIMEOUT; /* 10 minutes */
         this.logger = options.logger ?? console;
         const defaultLogLevel = 'warn';
         // Set default logLevel early so that we can log a warning in parseLogLevel.
@@ -188,8 +244,16 @@ class OpenAI {
         }
         this._options = options;
         this._provider = providerRuntime;
-        if (workloadIdentity) {
-            this._workloadIdentityAuth = new workload_identity_auth_1.WorkloadIdentityAuth(workloadIdentity, this.fetch);
+        if (x509Identity) {
+            const authentication = new x509_workload_identity_auth_1.X509WorkloadIdentityAuth(x509Identity, x509Transport, organization, project);
+            this._workloadIdentityAuth = authentication;
+            tslib_1.__classPrivateFieldSet(this, _OpenAI_x509Authentication, authentication, "f");
+            tslib_1.__classPrivateFieldSet(this, _OpenAI_x509Fetch, authentication.fetch(), "f");
+            this.fetch = tslib_1.__classPrivateFieldGet(this, _OpenAI_x509Fetch, "f");
+            (0, _x509_transport_state_1.markApprovedX509Client)(this);
+        }
+        else if (identity.legacy) {
+            this._workloadIdentityAuth = new workload_identity_auth_1.WorkloadIdentityAuth(identity.legacy, this.fetch);
         }
         this.apiKey = typeof apiKey === 'string' ? apiKey : null;
         this.adminAPIKey = adminAPIKey;
@@ -201,8 +265,10 @@ class OpenAI {
      * Create a new client instance re-using the same options given to the current client with optional overriding.
      */
     withOptions(options) {
+        const residencyBaseURL = (0, data_residency_1.resolveDataResidency)(options);
         const inheritedProvider = this._options.provider;
         const provider = options.provider ?? inheritedProvider;
+        const x509Authentication = tslib_1.__classPrivateFieldGet(this, _OpenAI_x509Authentication, "f");
         const inheritedOptions = {
             ...this._options,
             baseURL: this.baseURL,
@@ -210,19 +276,39 @@ class OpenAI {
             timeout: this.timeout,
             logger: this.logger,
             logLevel: this.logLevel,
-            fetch: this.fetch,
+            fetch: tslib_1.__classPrivateFieldGet(this, _OpenAI_x509Authentication, "f") ? undefined : this.fetch,
             fetchOptions: this.fetchOptions,
             apiKey: this._options.apiKey,
             adminAPIKey: this.adminAPIKey,
-            workloadIdentity: this._options.workloadIdentity,
+            workloadIdentity: x509Authentication?.identitySnapshot() ?? this._options.workloadIdentity,
+            x509Transport: this._options.x509Transport,
             organization: this.organization,
             project: this.project,
             webhookSecret: this.webhookSecret,
         };
+        const currentlyX509 = x509Authentication !== undefined;
+        const nextIdentity = (0, values_1.hasOwn)(options, 'workloadIdentity')
+            ? options.workloadIdentity
+            : inheritedOptions.workloadIdentity;
+        const nextX509 = (0, x509_workload_identity_auth_1.isX509WorkloadIdentity)(nextIdentity);
+        if (currentlyX509 !== nextX509) {
+            delete inheritedOptions.fetch;
+            delete inheritedOptions.baseURL;
+            if (nextX509) {
+                inheritedOptions.apiKey = null;
+            }
+            else {
+                delete inheritedOptions.x509Transport;
+            }
+        }
+        if (residencyBaseURL !== undefined) {
+            delete inheritedOptions.baseURL;
+        }
         if (provider) {
             delete inheritedOptions.apiKey;
             delete inheritedOptions.adminAPIKey;
             delete inheritedOptions.workloadIdentity;
+            delete inheritedOptions.x509Transport;
             delete inheritedOptions.baseURL;
             if (provider !== inheritedProvider) {
                 delete inheritedOptions.organization;
@@ -230,11 +316,24 @@ class OpenAI {
                 delete inheritedOptions.defaultHeaders;
             }
         }
-        const client = new this.constructor({
+        const clientOptions = {
             ...inheritedOptions,
             ...options,
             provider,
-        });
+            [inheritedDataResidencySelection]: tslib_1.__classPrivateFieldGet(this, _OpenAI_explicitDataResidency, "f") &&
+                residencyBaseURL === undefined &&
+                !(0, values_1.hasOwn)(options, 'baseURL') &&
+                !provider,
+        };
+        const client = new this.constructor(clientOptions);
+        if (tslib_1.__classPrivateFieldGet(this, _OpenAI_x509Authentication, "f") &&
+            tslib_1.__classPrivateFieldGet(client, _OpenAI_x509Authentication, "f") &&
+            this.baseURL === client.baseURL &&
+            tslib_1.__classPrivateFieldGet(this, _OpenAI_x509Authentication, "f").matches(tslib_1.__classPrivateFieldGet(client, _OpenAI_x509Authentication, "f"))) {
+            client._workloadIdentityAuth = tslib_1.__classPrivateFieldGet(this, _OpenAI_x509Authentication, "f");
+            tslib_1.__classPrivateFieldSet(client, _OpenAI_x509Authentication, tslib_1.__classPrivateFieldGet(this, _OpenAI_x509Authentication, "f"), "f");
+            tslib_1.__classPrivateFieldSet(client, _OpenAI_x509Fetch, tslib_1.__classPrivateFieldGet(this, _OpenAI_x509Fetch, "f"), "f");
+        }
         return client;
     }
     defaultQuery() {
@@ -259,14 +358,41 @@ class OpenAI {
         bearerAuth: true,
         adminAPIKeyAuth: true,
     }) {
+        const authentication = tslib_1.__classPrivateFieldGet(this, _OpenAI_x509Authentication, "f") ?? this._workloadIdentityAuth;
+        if (authentication instanceof x509_workload_identity_auth_1.X509WorkloadIdentityAuth &&
+            schemes.adminAPIKeyAuth &&
+            this.adminAPIKey !== null) {
+            return await this.adminAPIKeyAuth(opts);
+        }
         return (0, headers_1.buildHeaders)([
             schemes.bearerAuth ? await this.bearerAuth(opts) : null,
             schemes.adminAPIKeyAuth ? await this.adminAPIKeyAuth(opts) : null,
         ]);
     }
     async bearerAuth(opts) {
-        if (this._workloadIdentityAuth) {
-            return (0, headers_1.buildHeaders)([{ Authorization: `Bearer ${await this._workloadIdentityAuth.getToken()}` }]);
+        const authentication = tslib_1.__classPrivateFieldGet(this, _OpenAI_x509Authentication, "f") ?? this._workloadIdentityAuth;
+        if (authentication) {
+            if (authentication instanceof x509_workload_identity_auth_1.X509WorkloadIdentityAuth) {
+                if (authentication === this._workloadIdentityAuth &&
+                    (this.fetchWithAuth !== _a.prototype.fetchWithAuth ||
+                        this.fetchWithTimeout !== _a.prototype.fetchWithTimeout)) {
+                    throw new Errors.OpenAIError('X.509 workload identity does not support overridden fetch dispatch hooks.');
+                }
+                const snapshots = authentication.headerSnapshots();
+                if (!x509_workload_identity_auth_1.X509WorkloadIdentityAuth.shouldAuthenticate(opts, snapshots.defaultHeaders, snapshots.requestHeaders)) {
+                    return undefined;
+                }
+            }
+            const token = authentication instanceof x509_workload_identity_auth_1.X509WorkloadIdentityAuth
+                ? await authentication.getToken(opts, {
+                    apiURL: authentication.requestAPIURL(),
+                    ...authentication.headerSnapshots(),
+                    ...authentication.requestSnapshot(),
+                    signal: authentication.effectiveSignal(),
+                    ...authentication.tenantSnapshot(),
+                })
+                : await authentication.getToken();
+            return (0, headers_1.buildHeaders)([{ Authorization: `Bearer ${token}` }]);
         }
         if (this.apiKey == null) {
             return undefined;
@@ -289,7 +415,8 @@ class OpenAI {
         return `stainless-node-retry-${(0, uuid_1.uuid4)()}`;
     }
     makeStatusError(status, error, message, headers) {
-        return Errors.APIError.generate(status, error, message, headers);
+        const normalizedError = error && typeof error === 'object' && error.error == null ? { error } : error;
+        return Errors.APIError.generate(status, normalizedError, message, headers);
     }
     async _callApiKey() {
         if (this._provider)
@@ -316,8 +443,8 @@ class OpenAI {
     }
     buildURL(path, query, defaultBaseURL) {
         const baseURL = (!tslib_1.__classPrivateFieldGet(this, _OpenAI_instances, "m", _OpenAI_baseURLOverridden).call(this) && defaultBaseURL) || this.baseURL;
-        const url = (0, values_1.isAbsoluteURL)(path) ?
-            new URL(path)
+        const url = (0, values_1.isAbsoluteURL)(path)
+            ? new URL(path)
             : new URL(baseURL + (baseURL.endsWith('/') && path.startsWith('/') ? path.slice(1) : path));
         const defaultQuery = this.defaultQuery();
         const pathQuery = Object.fromEntries(url.searchParams);
@@ -368,7 +495,162 @@ class OpenAI {
         }));
     }
     request(options, remainingRetries = null) {
-        return new api_promise_1.APIPromise(this, this.makeRequest(options, remainingRetries, undefined));
+        const authentication = tslib_1.__classPrivateFieldGet(this, _OpenAI_x509Authentication, "f") ?? this._workloadIdentityAuth;
+        const request = authentication instanceof x509_workload_identity_auth_1.X509WorkloadIdentityAuth
+            ? Promise.resolve(options).then((resolved) => authentication.runRequest(() => this.makeRequest(resolved, remainingRetries, undefined), this))
+            : this.makeRequest(options, remainingRetries, undefined);
+        return this.responsePromise(request);
+    }
+    responsePromise(request, parse = (client, props) => this.parseResponseWithTimeout(client, props)) {
+        const promise = new api_promise_1.APIPromise(this, request, (client, props) => {
+            const resume = tslib_1.__classPrivateFieldGet(this, _OpenAI_responseAttempts, "f").get(props.controller)?.continueRequest;
+            return resume ? resume(() => parse(client, props)) : parse(client, props);
+        });
+        // A body timeout can retry after the original raw response has arrived. Wait for
+        // parsing before selecting the response so withResponse() reports the retry.
+        promise.withResponse = async () => {
+            const data = await promise;
+            const { response } = await request;
+            return { data, response, request_id: response.headers.get('x-request-id') };
+        };
+        promise._thenUnwrap = (transform) => this.responsePromise(request, async (client, props) => (0, parse_1.addRequestID)(transform(await parse(client, props), props), props.response));
+        return promise;
+    }
+    async parseResponseWithTimeout(client, props) {
+        if (props.options.stream ||
+            props.options.__binaryResponse ||
+            props.response.status === 204 ||
+            props.response.headers.get('content-length') === '0') {
+            return (0, parse_1.defaultParseResponse)(client, props);
+        }
+        while (true) {
+            const attempt = tslib_1.__classPrivateFieldGet(this, _OpenAI_responseAttempts, "f").get(props.controller);
+            const timeout = attempt?.timeout ?? props.options.timeout ?? this.timeout;
+            const x509Authentication = attempt?.authentication;
+            const callerSignal = x509Authentication ? props.controller.signal : props.options.signal;
+            const abortError = () => x509Authentication && callerSignal
+                ? this._makeUserAbortError(callerSignal)
+                : new Errors.APIUserAbortError();
+            let remaining;
+            try {
+                remaining =
+                    x509Authentication?.remainingTimeout(props.options, timeout) ??
+                        Math.max(0, props.startTime + timeout - Date.now());
+            }
+            catch (error) {
+                const cancellation = callerSignal?.aborted ? abortError() : undefined;
+                props.controller.abort();
+                void Shims.CancelReadableStream(props.response.body).catch(() => undefined);
+                throw cancellation ?? error;
+            }
+            let timer;
+            let abortListener;
+            let timedOut = false;
+            try {
+                // Tool runners preserve a completed buffered turn before cancellation stops the next request.
+                if (callerSignal?.aborted && attempt?.helperMethod !== 'runTools') {
+                    throw abortError();
+                }
+                const timeoutPromise = new Promise((_, reject) => {
+                    timer = setTimeout(() => {
+                        timedOut = true;
+                        props.controller.abort();
+                        reject(new Errors.APIConnectionTimeoutError());
+                    }, remaining);
+                    if (callerSignal) {
+                        abortListener = () => {
+                            if (!timedOut)
+                                reject(abortError());
+                        };
+                        callerSignal.addEventListener('abort', abortListener, { once: true });
+                    }
+                });
+                return await Promise.race([(0, parse_1.defaultParseResponse)(client, props), timeoutPromise]);
+            }
+            catch (error) {
+                if (callerSignal?.aborted && !timedOut) {
+                    throw abortError();
+                }
+                if (!timedOut) {
+                    if (x509Authentication && error instanceof SyntaxError) {
+                        throw new SyntaxError('X.509 workload identity API response contains invalid JSON.');
+                    }
+                    if (x509Authentication && !(error instanceof Errors.OpenAIError)) {
+                        throw new Errors.APIConnectionError({
+                            message: 'X.509 workload identity API response body could not be read.',
+                        });
+                    }
+                    throw error;
+                }
+                const retriesRemaining = attempt?.retriesRemaining ?? 0;
+                if (!retriesRemaining ||
+                    attempt?.hasStreamingBody ||
+                    props.options.__metadata?.['hasStreamingBody'] ||
+                    (globalThis.ReadableStream &&
+                        props.options.body instanceof globalThis.ReadableStream) ||
+                    (typeof props.options.body === 'object' &&
+                        props.options.body !== null &&
+                        (Symbol.asyncIterator in props.options.body ||
+                            (Symbol.iterator in props.options.body &&
+                                'next' in props.options.body &&
+                                typeof props.options.body.next === 'function')))) {
+                    throw new Errors.APIConnectionTimeoutError();
+                }
+                if (timer !== undefined)
+                    clearTimeout(timer);
+                if (abortListener)
+                    callerSignal?.removeEventListener('abort', abortListener);
+                abortListener = undefined;
+                const next = await this.retryRequest(props.options, retriesRemaining, props.retryOfRequestLogID ?? props.requestLogID);
+                Object.assign(props, next);
+            }
+            finally {
+                if (timer !== undefined)
+                    clearTimeout(timer);
+                if (abortListener)
+                    callerSignal?.removeEventListener('abort', abortListener);
+            }
+        }
+    }
+    /** Keeps terminal X.509 error-body consumption inside the original logical request deadline. */
+    async readX509ResponseError(response, options, timeout, controller, authentication) {
+        const deadline = new AbortController();
+        const callerSignal = controller.signal;
+        let timedOut = false;
+        const cancel = () => deadline.abort(callerSignal.reason);
+        callerSignal.addEventListener('abort', cancel, { once: true });
+        if (callerSignal.aborted) {
+            cancel();
+        }
+        try {
+            const remaining = authentication.remainingTimeout(options, timeout);
+            const expiration = authentication.waitForRetry(remaining, deadline.signal).then(() => {
+                throw new Errors.APIConnectionTimeoutError();
+            });
+            const body = await Promise.race([
+                response.text().catch(() => 'X.509 workload identity API response body could not be read.'),
+                expiration,
+            ]);
+            if (callerSignal.aborted) {
+                throw this._makeUserAbortError(callerSignal);
+            }
+            return body;
+        }
+        catch (error) {
+            if (error instanceof Errors.APIConnectionTimeoutError) {
+                timedOut = !callerSignal.aborted;
+                controller.abort();
+                void Shims.CancelReadableStream(response.body).catch(() => undefined);
+            }
+            if (callerSignal.aborted && !timedOut) {
+                throw this._makeUserAbortError(callerSignal);
+            }
+            throw error;
+        }
+        finally {
+            callerSignal.removeEventListener('abort', cancel);
+            deadline.abort();
+        }
     }
     async makeRequest(optionsInput, retriesRemaining, retryOfRequestLogID) {
         const options = await optionsInput;
@@ -377,34 +659,102 @@ class OpenAI {
             retriesRemaining = maxRetries;
         }
         await this.prepareOptions(options);
-        const { req, url, timeout } = await this.buildRequest(options, {
-            retryCount: maxRetries - retriesRemaining,
-        });
-        const hasStreamingBody = options.__metadata?.['hasStreamingBody'] === true;
-        await this.prepareRequest(req, { url, options });
-        await this._provider?.prepareRequest?.(req, { url, options });
+        const x509Authentication = tslib_1.__classPrivateFieldGet(this, _OpenAI_x509Authentication, "f");
+        x509Authentication?.beginRequestPlanning();
+        let built;
+        try {
+            const candidate = await this.buildRequest(options, {
+                retryCount: maxRetries - retriesRemaining,
+            });
+            built = { req: candidate.req, url: candidate.url, timeout: candidate.timeout };
+            if (x509Authentication) {
+                (0, values_1.validatePositiveInteger)('timeout', built.timeout);
+                x509Authentication.authorizePlannedRequest(built.url, built.req, built.timeout);
+                if (x509_workload_identity_auth_1.X509WorkloadIdentityAuth.isStreamingRequestBody(built.req.body)) {
+                    options.__metadata = { ...options.__metadata, hasStreamingBody: true };
+                }
+                await this.prepareRequest(built.req, { url: built.url, options });
+                await this._provider?.prepareRequest?.(built.req, { url: built.url, options });
+                x509Authentication.beginRequestPlanning();
+                x509Authentication.authorizePlannedRequest(built.url, built.req, built.timeout, true);
+                if (x509_workload_identity_auth_1.X509WorkloadIdentityAuth.isStreamingRequestBody(built.req.body)) {
+                    options.__metadata = { ...options.__metadata, hasStreamingBody: true };
+                }
+                const callerSignal = x509Authentication.requestSnapshot().signal;
+                if (callerSignal?.aborted || built.req.signal?.aborted) {
+                    throw this._makeUserAbortError(callerSignal?.aborted ? callerSignal : built.req.signal);
+                }
+                x509Authentication.setEffectiveSignal(built.req.signal || callerSignal
+                    ? createRequestController(built.req.signal ?? callerSignal, callerSignal).signal
+                    : undefined);
+                x509Authentication.beginRequestNetwork();
+                const security = options.__security ?? { bearerAuth: true };
+                const authenticationHeaders = await this.authHeaders(options, security);
+                const suppliedHeaders = x509Authentication.headerSnapshots();
+                const supplied = (0, headers_1.buildHeaders)([suppliedHeaders.defaultHeaders, suppliedHeaders.requestHeaders]);
+                for (const [name, value] of authenticationHeaders?.values ?? []) {
+                    if (!supplied.nulls.has(name) && !built.req.headers.has(name)) {
+                        built.req.headers.set(name, value);
+                    }
+                }
+                this.validateHeaders((0, headers_1.buildHeaders)([supplied, built.req.headers]), security);
+            }
+        }
+        catch (error) {
+            x509Authentication?.retireRequestBody();
+            if (x509Authentication &&
+                retriesRemaining &&
+                !options.__metadata?.['hasStreamingBody'] &&
+                x509_workload_identity_auth_1.X509WorkloadIdentityAuth.isRetryableFailure(error)) {
+                return await this.retryRequest(options, retriesRemaining, retryOfRequestLogID ?? 'x509-token-exchange', x509_workload_identity_auth_1.X509WorkloadIdentityAuth.retryHeaders(error));
+            }
+            throw error;
+        }
+        const { req, url } = built;
+        const timeout = x509Authentication
+            ? Math.min(built.timeout, x509Authentication.requestSnapshot().timeout)
+            : built.timeout;
+        x509Authentication?.bindRequest(options, req, this.adminAPIKey);
+        let hasStreamingBody = options.__metadata?.['hasStreamingBody'] === true;
+        if (!x509Authentication) {
+            await this.prepareRequest(req, { url, options });
+            await this._provider?.prepareRequest?.(req, { url, options });
+        }
+        x509Authentication?.adoptRequestHeaders(req);
+        if (x509Authentication && x509_workload_identity_auth_1.X509WorkloadIdentityAuth.isStreamingRequestBody(req.body)) {
+            hasStreamingBody = true;
+        }
         /** Not an API request ID, just for correlating local log entries. */
         const requestLogID = 'log_' + ((Math.random() * (1 << 24)) | 0).toString(16).padStart(6, '0');
         const retryLogStr = retryOfRequestLogID === undefined ? '' : `, retryOf: ${retryOfRequestLogID}`;
-        const startTime = Date.now();
+        const startTime = x509Authentication?.requestStartedAt(options) ?? Date.now();
         (0, log_1.loggerFor)(this).debug(`[${requestLogID}] sending request`, (0, log_1.formatRequestDetails)({
             retryOfRequestLogID,
             method: options.method,
             url,
-            options,
+            options: x509Authentication ? { body: req.body, ...x509Authentication.requestSnapshot() } : options,
             headers: req.headers,
         }));
-        if (options.signal?.aborted) {
-            throw new Errors.APIUserAbortError();
+        const callerSignal = x509Authentication ? x509Authentication.requestSnapshot().signal : options.signal;
+        if (callerSignal?.aborted || req.signal?.aborted) {
+            throw this._makeUserAbortError(callerSignal?.aborted ? callerSignal : req.signal);
         }
         const security = options.__security ?? { bearerAuth: true };
-        const controller = new AbortController();
-        const response = await this.fetchWithAuth(url, req, timeout, controller, security).catch(errors_1.castToError);
+        // Request hooks may replace the caller signal before it reaches fetch.
+        const controller = x509Authentication || this.fetchWithTimeout === _a.prototype.fetchWithTimeout
+            ? createRequestController(req.signal ?? (x509Authentication ? callerSignal : undefined), x509Authentication ? callerSignal : undefined)
+            : new AbortController();
+        const remainingTimeout = x509Authentication?.remainingTimeout(options, timeout) ?? timeout;
+        const fetchWithAuth = x509Authentication ? _a.prototype.fetchWithAuth : this.fetchWithAuth;
+        x509Authentication?.releaseRequestBody(req.body);
+        const response = await fetchWithAuth
+            .call(this, url, req, remainingTimeout, controller, security)
+            .catch(errors_1.castToError);
         const headersTime = Date.now();
         if (response instanceof globalThis.Error) {
             const retryMessage = `retrying, ${retriesRemaining} attempts remaining`;
-            if (options.signal?.aborted) {
-                throw new Errors.APIUserAbortError();
+            if (callerSignal?.aborted || req.signal?.aborted) {
+                throw this._makeUserAbortError(callerSignal?.aborted ? callerSignal : req.signal);
             }
             // detect native connection timeout errors
             // deno throws "TypeError: error sending request for url (https://example/): client error (Connect): tcp connect error: Operation timed out (os error 60): Operation timed out (os error 60)"
@@ -412,29 +762,50 @@ class OpenAI {
             // others do not provide enough information to distinguish timeouts from other connection errors
             const isTimeout = (0, errors_1.isAbortError)(response) ||
                 /timed? ?out/i.test(String(response) + ('cause' in response ? String(response.cause) : ''));
-            if (retriesRemaining && !hasStreamingBody) {
+            if (retriesRemaining &&
+                !hasStreamingBody &&
+                (!x509Authentication || (0, _x509_transport_state_1.isTransientX509ConnectionError)(response))) {
                 (0, log_1.loggerFor)(this).info(`[${requestLogID}] connection ${isTimeout ? 'timed out' : 'failed'} - ${retryMessage}`);
                 (0, log_1.loggerFor)(this).debug(`[${requestLogID}] connection ${isTimeout ? 'timed out' : 'failed'} (${retryMessage})`, (0, log_1.formatRequestDetails)({
                     retryOfRequestLogID,
                     url,
                     durationMs: headersTime - startTime,
-                    message: response.message,
+                    message: x509Authentication ? 'X.509 workload identity API connection failed.' : response.message,
                 }));
                 return this.retryRequest(options, retriesRemaining, retryOfRequestLogID ?? requestLogID);
             }
-            const terminalMessage = hasStreamingBody ? 'error; streaming body cannot be retried' : 'error; no more retries left';
+            const terminalMessage = hasStreamingBody
+                ? 'error; streaming body cannot be retried'
+                : 'error; no more retries left';
             (0, log_1.loggerFor)(this).info(`[${requestLogID}] connection ${isTimeout ? 'timed out' : 'failed'} - ${terminalMessage}`);
             (0, log_1.loggerFor)(this).debug(`[${requestLogID}] connection ${isTimeout ? 'timed out' : 'failed'} (${terminalMessage})`, (0, log_1.formatRequestDetails)({
                 retryOfRequestLogID,
                 url,
                 durationMs: headersTime - startTime,
-                message: response.message,
+                message: x509Authentication ? 'X.509 workload identity API connection failed.' : response.message,
             }));
             if (response instanceof error_1.OAuthError || response instanceof error_1.SubjectTokenProviderError) {
                 throw response;
             }
             if (isTimeout) {
-                throw new Errors.APIConnectionTimeoutError();
+                const transportCause = 'cause' in response ? response.cause : undefined;
+                const isHeadersTimeout = typeof transportCause === 'object' &&
+                    transportCause !== null &&
+                    'code' in transportCause &&
+                    transportCause.code === 'UND_ERR_HEADERS_TIMEOUT';
+                const timeoutError = isHeadersTimeout
+                    ? new Errors.APIConnectionTimeoutError({
+                        message: 'Request timed out. Node.js fetch timed out waiting for response headers; ' +
+                            'configure a matching undici fetch and fetchOptions.dispatcher with an Agent whose headersTimeout is at least the SDK timeout.',
+                    })
+                    : new Errors.APIConnectionTimeoutError();
+                if (x509Authentication) {
+                    throw new Errors.APIConnectionTimeoutError();
+                }
+                throw Object.assign(timeoutError, { cause: response });
+            }
+            if (x509Authentication) {
+                throw new Errors.APIConnectionError({ message: 'X.509 workload identity API connection failed.' });
             }
             throw new Errors.APIConnectionError({
                 message: getConnectionErrorMessage(response),
@@ -447,26 +818,48 @@ class OpenAI {
             .join('');
         const responseInfo = `[${requestLogID}${retryLogStr}${specialHeaders}] ${req.method} ${url} ${response.ok ? 'succeeded' : 'failed'} with status ${response.status} in ${headersTime - startTime}ms`;
         if (!response.ok) {
+            const rejectedX509Credential = response.status === 401 &&
+                x509Authentication &&
+                security.bearerAuth &&
+                x509Authentication.usedWorkloadToken(options);
+            if (rejectedX509Credential) {
+                x509Authentication.invalidateToken();
+            }
             if (response.status === 401 &&
-                this._workloadIdentityAuth &&
+                (x509Authentication || this._workloadIdentityAuth) &&
                 security.bearerAuth &&
-                !options.__metadata?.['hasStreamingBody'] &&
+                (!x509Authentication || x509Authentication.usedWorkloadToken(options)) &&
+                (!x509Authentication || retriesRemaining > 0) &&
+                !hasStreamingBody &&
                 !options.__metadata?.['workloadIdentityTokenRefreshed']) {
-                await Shims.CancelReadableStream(response.body);
-                this._workloadIdentityAuth.invalidateToken();
-                return this.makeRequest({
+                if (x509Authentication) {
+                    void Shims.CancelReadableStream(response.body).catch(() => undefined);
+                }
+                else {
+                    await Shims.CancelReadableStream(response.body);
+                    this._workloadIdentityAuth?.invalidateToken();
+                }
+                const replayOptions = {
                     ...options,
                     __metadata: {
                         ...options.__metadata,
                         workloadIdentityTokenRefreshed: true,
                     },
-                }, retriesRemaining, retryOfRequestLogID ?? requestLogID);
+                };
+                return this.makeRequest(replayOptions, x509Authentication ? retriesRemaining - 1 : retriesRemaining, retryOfRequestLogID ?? requestLogID);
             }
-            const shouldRetry = await this.shouldRetry(response);
+            const shouldRetry = rejectedX509Credential && options.__metadata?.['workloadIdentityTokenRefreshed']
+                ? false
+                : await this.shouldRetry(response);
             if (retriesRemaining && shouldRetry && !hasStreamingBody) {
                 const retryMessage = `retrying, ${retriesRemaining} attempts remaining`;
                 // We don't need the body of this response.
-                await Shims.CancelReadableStream(response.body);
+                if (x509Authentication) {
+                    void Shims.CancelReadableStream(response.body).catch(() => undefined);
+                }
+                else {
+                    await Shims.CancelReadableStream(response.body);
+                }
                 (0, log_1.loggerFor)(this).info(`${responseInfo} - ${retryMessage}`);
                 (0, log_1.loggerFor)(this).debug(`[${requestLogID}] response error (${retryMessage})`, (0, log_1.formatRequestDetails)({
                     retryOfRequestLogID,
@@ -477,12 +870,15 @@ class OpenAI {
                 }));
                 return this.retryRequest(options, retriesRemaining, retryOfRequestLogID ?? requestLogID, response.headers);
             }
-            const retryMessage = shouldRetry ?
-                hasStreamingBody ? `error; streaming body cannot be retried`
+            const retryMessage = shouldRetry
+                ? hasStreamingBody
+                    ? `error; streaming body cannot be retried`
                     : `error; no more retries left`
                 : `error; not retryable`;
             (0, log_1.loggerFor)(this).info(`${responseInfo} - ${retryMessage}`);
-            const errText = await response.text().catch((err) => (0, errors_1.castToError)(err).message);
+            const errText = x509Authentication
+                ? await this.readX509ResponseError(response, options, timeout, controller, x509Authentication)
+                : await response.text().catch((err) => (0, errors_1.castToError)(err).message);
             const errJSON = (0, values_1.safeJSON)(errText);
             const errMessage = errJSON ? undefined : errText;
             (0, log_1.loggerFor)(this).debug(`[${requestLogID}] response error (${retryMessage})`, (0, log_1.formatRequestDetails)({
@@ -504,22 +900,45 @@ class OpenAI {
             headers: response.headers,
             durationMs: headersTime - startTime,
         }));
+        const continueRequest = x509Authentication?.continuation();
+        x509Authentication?.releaseRequestCredentials();
+        tslib_1.__classPrivateFieldGet(this, _OpenAI_responseAttempts, "f").set(controller, {
+            timeout,
+            retriesRemaining,
+            hasStreamingBody,
+            ...(x509Authentication ? { authentication: x509Authentication } : {}),
+            helperMethod: options.__metadata?.['helperMethod'],
+            ...(continueRequest ? { continueRequest } : {}),
+        });
         return { response, options, controller, requestLogID, retryOfRequestLogID, startTime };
     }
     getAPIList(path, Page, opts) {
-        return this.requestAPIList(Page, opts && 'then' in opts ?
-            opts.then((opts) => ({ method: 'get', path, ...opts }))
+        return this.requestAPIList(Page, opts && 'then' in opts
+            ? opts.then((opts) => ({ method: 'get', path, ...opts }))
             : { method: 'get', path, ...opts });
     }
     requestAPIList(Page, options) {
-        const request = this.makeRequest(options, null, undefined);
-        return new Pagination.PagePromise(this, request, Page);
+        const authentication = tslib_1.__classPrivateFieldGet(this, _OpenAI_x509Authentication, "f") ?? this._workloadIdentityAuth;
+        const request = authentication instanceof x509_workload_identity_auth_1.X509WorkloadIdentityAuth
+            ? Promise.resolve(options).then((resolved) => authentication.runRequest(() => this.makeRequest(resolved, null, undefined), this))
+            : this.makeRequest(options, null, undefined);
+        const page = new Pagination.PagePromise(this, request, Page);
+        const guarded = this.responsePromise(request, async (client, props) => {
+            const body = await this.parseResponseWithTimeout(client, props);
+            return new Page(client, props.response, body, props.options);
+        });
+        page.then = guarded.then.bind(guarded);
+        page.catch = guarded.catch.bind(guarded);
+        page.finally = guarded.finally.bind(guarded);
+        page.withResponse = guarded.withResponse.bind(guarded);
+        page._thenUnwrap = guarded._thenUnwrap.bind(guarded);
+        return page;
     }
     async fetchWithAuth(url, init, timeout, controller, schemes = {
         bearerAuth: true,
         adminAPIKeyAuth: true,
     }) {
-        if (this._workloadIdentityAuth && schemes.bearerAuth) {
+        if (this._workloadIdentityAuth && !tslib_1.__classPrivateFieldGet(this, _OpenAI_x509Fetch, "f") && schemes.bearerAuth) {
             const headers = init.headers;
             const authHeader = headers.get('Authorization');
             if (!authHeader || authHeader === `Bearer ${WORKLOAD_IDENTITY_API_KEY_PLACEHOLDER}`) {
@@ -527,13 +946,15 @@ class OpenAI {
                 headers.set('Authorization', `Bearer ${token}`);
             }
         }
-        const response = await this.fetchWithTimeout(url, init, timeout, controller);
+        const fetchWithTimeout = tslib_1.__classPrivateFieldGet(this, _OpenAI_x509Fetch, "f") ? _a.prototype.fetchWithTimeout : this.fetchWithTimeout;
+        const response = await fetchWithTimeout.call(this, url, init, timeout, controller);
         return response;
     }
     async fetchWithTimeout(url, init, ms, controller) {
         const { signal, method, ...options } = init || {};
         const abort = this._makeAbort(controller);
-        if (signal)
+        const composed = !!signal && composedCallerSignals.get(controller) === signal;
+        if (signal && !composed)
             signal.addEventListener('abort', abort, { once: true });
         const timeout = setTimeout(abort, ms);
         const isReadableBody = (globalThis.ReadableStream && options.body instanceof globalThis.ReadableStream) ||
@@ -551,7 +972,12 @@ class OpenAI {
         }
         try {
             // use undefined this binding; fetch errors if bound to something else in browser/cloudflare
-            return await this.fetch.call(undefined, url, fetchOptions);
+            return await (tslib_1.__classPrivateFieldGet(this, _OpenAI_x509Fetch, "f") ?? this.fetch).call(undefined, url, fetchOptions);
+        }
+        catch (err) {
+            if (signal && !composed)
+                signal.removeEventListener('abort', abort);
+            throw err;
         }
         finally {
             clearTimeout(timeout);
@@ -591,7 +1017,7 @@ class OpenAI {
         }
         // About the Retry-After header: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Retry-After
         const retryAfterHeader = responseHeaders?.get('retry-after');
-        if (retryAfterHeader && !timeoutMillis) {
+        if (retryAfterHeader && timeoutMillis === undefined) {
             const timeoutSeconds = parseFloat(retryAfterHeader);
             if (!Number.isNaN(timeoutSeconds)) {
                 timeoutMillis = timeoutSeconds * 1000;
@@ -602,11 +1028,26 @@ class OpenAI {
         }
         // If the API asks us to wait a certain amount of time, just do what it
         // says, but otherwise calculate a default
-        if (timeoutMillis === undefined) {
+        if (timeoutMillis === undefined ||
+            !Number.isFinite(timeoutMillis) ||
+            timeoutMillis < 0 ||
+            timeoutMillis > 60 * 1000) {
             const maxRetries = options.maxRetries ?? this.maxRetries;
             timeoutMillis = this.calculateDefaultRetryTimeoutMillis(retriesRemaining, maxRetries);
         }
-        await (0, sleep_1.sleep)(timeoutMillis);
+        const x509Authentication = tslib_1.__classPrivateFieldGet(this, _OpenAI_x509Authentication, "f");
+        if (x509Authentication) {
+            const remaining = x509Authentication.remainingTimeout(options, x509Authentication.requestSnapshot().timeout);
+            if (timeoutMillis >= remaining) {
+                throw new Errors.APIConnectionTimeoutError();
+            }
+        }
+        if (x509Authentication) {
+            await x509Authentication.waitForRetry(timeoutMillis, x509Authentication.effectiveSignal());
+        }
+        else {
+            await (0, sleep_1.sleep)(timeoutMillis);
+        }
         return this.makeRequest(options, retriesRemaining - 1, requestLogID);
     }
     calculateDefaultRetryTimeoutMillis(retriesRemaining, maxRetries) {
@@ -620,20 +1061,64 @@ class OpenAI {
         return sleepSeconds * jitter * 1000;
     }
     async buildRequest(inputOptions, { retryCount = 0 } = {}) {
+        if (tslib_1.__classPrivateFieldGet(this, _OpenAI_x509Authentication, "f") && !tslib_1.__classPrivateFieldGet(this, _OpenAI_x509Authentication, "f").inRequest(this)) {
+            const authentication = tslib_1.__classPrivateFieldGet(this, _OpenAI_x509Authentication, "f");
+            return await authentication.runRequest(async () => {
+                const built = await _a.prototype.buildRequest.call(this, inputOptions, { retryCount });
+                authentication.releaseRequestBody(built.req.body);
+                return built;
+            }, this);
+        }
         const options = { ...inputOptions };
+        const x509Authentication = tslib_1.__classPrivateFieldGet(this, _OpenAI_x509Authentication, "f");
+        const x509Tenant = x509Authentication?.snapshotTenant(this.organization, this.project);
+        const x509Headers = x509Authentication?.snapshotHeaders(this._options.defaultHeaders, options.headers);
+        if (x509Headers) {
+            options.headers = x509Headers.requestHeaders;
+        }
+        const x509ClientFetchOptions = x509Authentication
+            ? (0, x509_workload_identity_auth_1.snapshotX509RequestOptions)(this.fetchOptions)
+            : undefined;
+        const x509RequestFetchOptions = x509Authentication
+            ? (0, x509_workload_identity_auth_1.snapshotX509RequestOptions)(options.fetchOptions)
+            : undefined;
         const { method, path, query, defaultBaseURL } = options;
         const url = this.buildURL(path, query, defaultBaseURL);
-        if ('timeout' in options)
+        x509Authentication?.snapshotAPIURL(url);
+        const explicitTimeout = 'timeout' in options;
+        if (explicitTimeout)
             (0, values_1.validatePositiveInteger)('timeout', options.timeout);
         options.timeout = options.timeout ?? this.timeout;
+        if (x509Authentication && x509RequestFetchOptions) {
+            x509Authentication.snapshotRequest(options.signal, options.timeout, x509RequestFetchOptions);
+        }
+        if (x509Authentication) {
+            const snapshot = x509Authentication.requestSnapshot();
+            options.timeout = snapshot.timeout;
+            if (snapshot.signal === undefined) {
+                delete options.signal;
+            }
+            else {
+                options.signal = snapshot.signal;
+            }
+        }
         const { bodyHeaders, body, isStreamingBody } = this.buildBody({ options });
         if (isStreamingBody) {
             inputOptions.__metadata = {
                 ...inputOptions.__metadata,
                 hasStreamingBody: true,
             };
+            x509Authentication?.ownRequestBody(body, options.body);
         }
-        const reqHeaders = await this.buildHeaders({ options: inputOptions, method, bodyHeaders, retryCount });
+        const reqHeaders = await this.buildHeaders({
+            options: inputOptions,
+            method,
+            bodyHeaders,
+            retryCount,
+            x509Headers,
+            x509Timeout: explicitTimeout ? options.timeout : undefined,
+            x509Tenant,
+        });
         const req = {
             method,
             headers: reqHeaders,
@@ -641,35 +1126,40 @@ class OpenAI {
             ...(globalThis.ReadableStream &&
                 body instanceof globalThis.ReadableStream && { duplex: 'half' }),
             ...(body && { body }),
-            ...(this.fetchOptions ?? {}),
-            ...(options.fetchOptions ?? {}),
+            ...((x509Authentication ? x509ClientFetchOptions : this.fetchOptions) ?? {}),
+            ...((x509Authentication ? x509RequestFetchOptions : options.fetchOptions) ?? {}),
         };
         return { req, url, timeout: options.timeout };
     }
-    async buildHeaders({ options, method, bodyHeaders, retryCount, }) {
+    async buildHeaders({ options, method, bodyHeaders, retryCount, x509Headers, x509Timeout, x509Tenant, }) {
         let idempotencyHeaders = {};
         if (this.idempotencyHeader && method !== 'get') {
             if (!options.idempotencyKey)
                 options.idempotencyKey = this.defaultIdempotencyKey();
             idempotencyHeaders[this.idempotencyHeader] = options.idempotencyKey;
         }
+        const helperMethod = options.__metadata?.['helperMethod'];
+        const timeout = x509Headers ? x509Timeout : options.timeout;
         const headers = (0, headers_1.buildHeaders)([
             idempotencyHeaders,
             {
                 Accept: 'application/json',
-                'User-Agent': this.getUserAgent(),
+                ...(!isRunningInBrowserOrBrowserWorker() ? { 'User-Agent': this.getUserAgent() } : undefined),
                 'X-Stainless-Retry-Count': String(retryCount),
-                ...(options.timeout ? { 'X-Stainless-Timeout': String(Math.trunc(options.timeout / 1000)) } : {}),
+                ...(timeout ? { 'X-Stainless-Timeout': String(Math.trunc(timeout / 1000)) } : {}),
                 ...(0, detect_platform_1.getPlatformHeaders)(),
-                'OpenAI-Organization': this.organization,
-                'OpenAI-Project': this.project,
+                ...(typeof helperMethod === 'string' ? { 'X-Stainless-Helper-Method': helperMethod } : {}),
+                'OpenAI-Organization': x509Tenant ? x509Tenant.organization : this.organization,
+                'OpenAI-Project': x509Tenant ? x509Tenant.project : this.project,
             },
-            this._provider ? undefined : (await this.authHeaders(options, options.__security ?? { bearerAuth: true })),
-            this._options.defaultHeaders,
+            this._provider || tslib_1.__classPrivateFieldGet(this, _OpenAI_x509Authentication, "f")?.isPlanningRequest()
+                ? undefined
+                : await this.authHeaders(options, options.__security ?? { bearerAuth: true }),
+            x509Headers?.defaultHeaders ?? this._options.defaultHeaders,
             bodyHeaders,
-            options.headers,
+            x509Headers?.requestHeaders ?? options.headers,
         ]);
-        if (!this._provider) {
+        if (!this._provider && !tslib_1.__classPrivateFieldGet(this, _OpenAI_x509Authentication, "f")?.isPlanningRequest()) {
             this.validateHeaders(headers, options.__security ?? { bearerAuth: true });
         }
         return headers.values;
@@ -679,6 +1169,11 @@ class OpenAI {
         //       would capture all request options, and cause a memory leak.
         return () => controller.abort();
     }
+    _makeUserAbortError(signal) {
+        const error = new Errors.APIUserAbortError();
+        Object.defineProperty(error, 'cause', { value: signal.reason, writable: true, configurable: true });
+        return error;
+    }
     buildBody({ options }) {
         const { body, headers: rawHeaders } = options;
         if (!body) {
@@ -742,8 +1237,10 @@ class OpenAI {
     }
 }
 exports.OpenAI = OpenAI;
-_a = OpenAI, _OpenAI_encoder = new WeakMap(), _OpenAI_instances = new WeakSet(), _OpenAI_baseURLOverridden = function _OpenAI_baseURLOverridden() {
-    return this._provider !== undefined || this.baseURL !== 'https://api.openai.com/v1';
+_a = OpenAI, _OpenAI_encoder = new WeakMap(), _OpenAI_x509Authentication = new WeakMap(), _OpenAI_x509Fetch = new WeakMap(), _OpenAI_explicitDataResidency = new WeakMap(), _OpenAI_responseAttempts = new WeakMap(), _OpenAI_instances = new WeakSet(), _OpenAI_baseURLOverridden = function _OpenAI_baseURLOverridden() {
+    return (tslib_1.__classPrivateFieldGet(this, _OpenAI_explicitDataResidency, "f") ||
+        this._provider !== undefined ||
+        this.baseURL !== 'https://api.openai.com/v1');
 };
 OpenAI.OpenAI = _a;
 OpenAI.DEFAULT_TIMEOUT = 600000; // 10 minutes
@@ -787,6 +1284,31 @@ OpenAI.Evals = evals_1.Evals;
 OpenAI.Containers = containers_1.Containers;
 OpenAI.Skills = skills_1.Skills;
 OpenAI.Videos = videos_1.Videos;
+const composedCallerSignals = new WeakMap();
+function createRequestController(callerSignal, originalSignal) {
+    const controller = new AbortController();
+    if (!callerSignal)
+        return controller;
+    const nativeAbortSignal = globalThis.AbortSignal;
+    if (typeof nativeAbortSignal?.any !== 'function' || !(callerSignal instanceof nativeAbortSignal)) {
+        return controller;
+    }
+    try {
+        // Native composition keeps cancellation active after response headers without
+        // retaining an abort listener on the caller's signal or changing its reason.
+        const signals = [controller.signal, callerSignal];
+        if (originalSignal && originalSignal !== callerSignal) {
+            signals.push(originalSignal);
+        }
+        const composed = nativeAbortSignal.any(signals);
+        Object.defineProperty(controller, 'signal', { value: composed, configurable: true });
+        composedCallerSignals.set(controller, callerSignal);
+    }
+    catch {
+        // Older or incompatible runtimes retain the existing listener-based fallback.
+    }
+    return controller;
+}
 function getConnectionErrorMessage(error) {
     if (isUndiciDispatcherVersionMismatchError(error)) {
         return `Connection error. This may be caused by passing an undici dispatcher, such as ProxyAgent, that is incompatible with the fetch implementation. If you are using undici's ProxyAgent, pass the fetch implementation from the same undici package: import { fetch, ProxyAgent } from 'undici'; new OpenAI({ fetch, fetchOptions: { dispatcher: new ProxyAgent(...) } });`;