openai 7.4.0 → 7.6.0

package/lib/webhook-signature.js

@@ -0,0 +1,125 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.webhookSignatureRequiresSigning = webhookSignatureRequiresSigning;
+exports.verifyWebhookSignature = verifyWebhookSignature;
+const error_1 = require("../error.js");
+const base64_1 = require("../internal/utils/base64.js");
+const bytes_1 = require("../internal/utils/bytes.js");
+const MAX_DIRECT_WEBHOOK_VERIFICATIONS = 32;
+const SHA256_SIGNATURE_LENGTH = 32;
+/**
+ * Checks whether a webhook header requires constant-work HMAC signing without
+ * retaining an unbounded number of signature candidates.
+ *
+ * @internal
+ */
+function webhookSignatureRequiresSigning(signatureHeader) {
+    return (signatureHeader.split(' ', MAX_DIRECT_WEBHOOK_VERIFICATIONS + 1).length > MAX_DIRECT_WEBHOOK_VERIFICATIONS);
+}
+function* signatureCandidates(signatureHeader) {
+    let start = 0;
+    while (start <= signatureHeader.length) {
+        const separator = signatureHeader.indexOf(' ', start);
+        const candidate = signatureHeader.slice(start, separator === -1 ? undefined : separator);
+        yield candidate.startsWith('v1,') ? candidate.slice(3) : candidate;
+        if (separator === -1) {
+            break;
+        }
+        start = separator + 1;
+    }
+}
+function decodeSignature(signature) {
+    try {
+        const signatureBytes = (0, base64_1.fromBase64)(signature);
+        return signatureBytes.byteLength === SHA256_SIGNATURE_LENGTH ? signatureBytes : undefined;
+    }
+    catch {
+        // Invalid base64 does not prevent trying the next value.
+        return undefined;
+    }
+}
+function firstValidLengthSignature(signatureHeader) {
+    for (const signature of signatureCandidates(signatureHeader)) {
+        const signatureBytes = decodeSignature(signature);
+        if (signatureBytes) {
+            return signatureBytes;
+        }
+    }
+    return undefined;
+}
+function selectMatchingSignature(signatureHeader, expectedSignature, firstSignature) {
+    let matchingSignature = firstSignature;
+    for (const signature of signatureCandidates(signatureHeader)) {
+        const signatureBytes = decodeSignature(signature);
+        if (!signatureBytes) {
+            continue;
+        }
+        let difference = 0;
+        for (const [index, byte] of signatureBytes.entries()) {
+            // oxlint-disable-next-line no-bitwise -- Compare every HMAC byte without short-circuiting on shared prefixes.
+            difference |= byte ^ (expectedSignature[index] ?? 0);
+        }
+        if (difference === 0) {
+            matchingSignature = signatureBytes;
+        }
+    }
+    return matchingSignature;
+}
+/**
+ * Checks the timestamp and HMAC signatures after the resource has validated its
+ * crypto capabilities, secret, and required headers.
+ *
+ * @internal
+ */
+async function verifyWebhookSignature(payload, signatureHeader, timestamp, webhookId, secret, tolerance) {
+    // oxlint-disable-next-line unicorn/prefer-number-coercion -- Preserve numeric-prefix parsing while signing the original timestamp text.
+    const timestampSeconds = Number.parseInt(timestamp, 10);
+    if (Number.isNaN(timestampSeconds)) {
+        throw new error_1.InvalidWebhookSignatureError('Invalid webhook timestamp format');
+    }
+    const nowSeconds = Math.floor(Date.now() / 1000);
+    if (nowSeconds - timestampSeconds > tolerance) {
+        throw new error_1.InvalidWebhookSignatureError('Webhook timestamp is too old');
+    }
+    if (timestampSeconds > nowSeconds + tolerance) {
+        throw new error_1.InvalidWebhookSignatureError('Webhook timestamp is too new');
+    }
+    // Multiple signatures are space-separated; accept a matching value at any position.
+    const useBoundedVerification = webhookSignatureRequiresSigning(signatureHeader);
+    const firstSignature = useBoundedVerification ? firstValidLengthSignature(signatureHeader) : undefined;
+    if (useBoundedVerification && !firstSignature) {
+        throw new error_1.InvalidWebhookSignatureError('The given webhook signature does not match the expected signature');
+    }
+    const decodedSecret = Uint8Array.from(secret.startsWith('whsec_') ? (0, base64_1.fromBase64)(secret.slice('whsec_'.length)) : (0, bytes_1.encodeUTF8)(secret));
+    const signedPayload = webhookId ? `${webhookId}.${timestamp}.${payload}` : `${timestamp}.${payload}`;
+    const signedPayloadBytes = Uint8Array.from((0, bytes_1.encodeUTF8)(signedPayload));
+    const key = await crypto.subtle.importKey('raw', decodedSecret, { name: 'HMAC', hash: 'SHA-256' }, false, useBoundedVerification ? ['sign', 'verify'] : ['verify']);
+    if (useBoundedVerification && firstSignature) {
+        const expectedSignature = new Uint8Array(await crypto.subtle.sign('HMAC', key, signedPayloadBytes));
+        const signatureToVerify = selectMatchingSignature(signatureHeader, expectedSignature, firstSignature);
+        try {
+            if (await crypto.subtle.verify('HMAC', key, Uint8Array.from(signatureToVerify), signedPayloadBytes)) {
+                return;
+            }
+        }
+        catch {
+            // Provider verification failures have the same typed mismatch as the direct path.
+        }
+        throw new error_1.InvalidWebhookSignatureError('The given webhook signature does not match the expected signature');
+    }
+    for (const signature of signatureCandidates(signatureHeader)) {
+        try {
+            const signatureBytes = Uint8Array.from((0, base64_1.fromBase64)(signature));
+            // oxlint-disable-next-line no-await-in-loop -- Check signatures in order and stop at the first match.
+            const isValid = await crypto.subtle.verify('HMAC', key, signatureBytes, signedPayloadBytes);
+            if (isValid) {
+                return;
+            }
+        }
+        catch {
+            // Invalid base64 or signature format does not prevent trying the next value.
+        }
+    }
+    throw new error_1.InvalidWebhookSignatureError('The given webhook signature does not match the expected signature');
+}
+//# sourceMappingURL=webhook-signature.js.map

package/lib/webhook-signature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-signature.js","sourceRoot":"","sources":["../src/lib/webhook-signature.ts"],"names":[],"mappings":";;AAaA,0EAIC;AAsED,wDA4EC;AAnKD,uCAAwD;AACxD,wDAAsD;AACtD,sDAAqD;AAErD,MAAM,gCAAgC,GAAG,EAAE,CAAC;AAC5C,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAEnC;;;;;GAKG;AACH,SAAgB,+BAA+B,CAAC,eAAuB;IACrE,OAAO,CACL,eAAe,CAAC,KAAK,CAAC,GAAG,EAAE,gCAAgC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,gCAAgC,CAC3G,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,CAAC,mBAAmB,CAAC,eAAuB;IACnD,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,OAAO,KAAK,IAAI,eAAe,CAAC,MAAM,EAAE,CAAC;QACvC,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACzF,MAAM,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEnE,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;YACrB,MAAM;QACR,CAAC;QACD,KAAK,GAAG,SAAS,GAAG,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,SAAiB;IACxC,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,IAAA,mBAAU,EAAC,SAAS,CAAC,CAAC;QAC7C,OAAO,cAAc,CAAC,UAAU,KAAK,uBAAuB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,yDAAyD;QACzD,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,eAAuB;IACxD,KAAK,MAAM,SAAS,IAAI,mBAAmB,CAAC,eAAe,CAAC,EAAE,CAAC;QAC7D,MAAM,cAAc,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,cAAc,EAAE,CAAC;YACnB,OAAO,cAAc,CAAC;QACxB,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,uBAAuB,CAC9B,eAAuB,EACvB,iBAA6B,EAC7B,cAA0B;IAE1B,IAAI,iBAAiB,GAAG,cAAc,CAAC;IAEvC,KAAK,MAAM,SAAS,IAAI,mBAAmB,CAAC,eAAe,CAAC,EAAE,CAAC;QAC7D,MAAM,cAAc,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,SAAS;QACX,CAAC;QAED,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC;YACrD,8GAA8G;YAC9G,UAAU,IAAI,IAAI,GAAG,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;YACrB,iBAAiB,GAAG,cAAc,CAAC;QACrC,CAAC;IACH,CAAC;IAED,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,sBAAsB,CAC1C,OAAe,EACf,eAAuB,EACvB,SAAiB,EACjB,SAAiB,EACjB,MAAc,EACd,SAAiB;IAEjB,wIAAwI;IACxI,MAAM,gBAAgB,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,oCAA4B,CAAC,kCAAkC,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACjD,IAAI,UAAU,GAAG,gBAAgB,GAAG,SAAS,EAAE,CAAC;QAC9C,MAAM,IAAI,oCAA4B,CAAC,8BAA8B,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,gBAAgB,GAAG,UAAU,GAAG,SAAS,EAAE,CAAC;QAC9C,MAAM,IAAI,oCAA4B,CAAC,8BAA8B,CAAC,CAAC;IACzE,CAAC;IAED,oFAAoF;IACpF,MAAM,sBAAsB,GAAG,+BAA+B,CAAC,eAAe,CAAC,CAAC;IAChF,MAAM,cAAc,GAAG,sBAAsB,CAAC,CAAC,CAAC,yBAAyB,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEvG,IAAI,sBAAsB,IAAI,CAAC,cAAc,EAAE,CAAC;QAC9C,MAAM,IAAI,oCAA4B,CACpC,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,UAAU,CAAC,IAAI,CACnC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAA,mBAAU,EAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAA,kBAAU,EAAC,MAAM,CAAC,CAC7F,CAAC;IACF,MAAM,aAAa,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,IAAI,SAAS,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,SAAS,IAAI,OAAO,EAAE,CAAC;IACrG,MAAM,kBAAkB,GAAG,UAAU,CAAC,IAAI,CAAC,IAAA,kBAAU,EAAC,aAAa,CAAC,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,aAAa,EACb,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,sBAAsB,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CACzD,CAAC;IAEF,IAAI,sBAAsB,IAAI,cAAc,EAAE,CAAC;QAC7C,MAAM,iBAAiB,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC,CAAC;QACpG,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,eAAe,EAAE,iBAAiB,EAAE,cAAc,CAAC,CAAC;QAEtG,IAAI,CAAC;YACH,IAAI,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,kBAAkB,CAAC,EAAE,CAAC;gBACpG,OAAO;YACT,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,kFAAkF;QACpF,CAAC;QAED,MAAM,IAAI,oCAA4B,CACpC,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,SAAS,IAAI,mBAAmB,CAAC,eAAe,CAAC,EAAE,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,IAAA,mBAAU,EAAC,SAAS,CAAC,CAAC,CAAC;YAC9D,sGAAsG;YACtG,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAC5F,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,6EAA6E;QAC/E,CAAC;IACH,CAAC;IAED,MAAM,IAAI,oCAA4B,CAAC,mEAAmE,CAAC,CAAC;AAC9G,CAAC"}

package/lib/webhook-signature.mjs

@@ -0,0 +1,121 @@
+import { InvalidWebhookSignatureError } from "../error.mjs";
+import { fromBase64 } from "../internal/utils/base64.mjs";
+import { encodeUTF8 } from "../internal/utils/bytes.mjs";
+const MAX_DIRECT_WEBHOOK_VERIFICATIONS = 32;
+const SHA256_SIGNATURE_LENGTH = 32;
+/**
+ * Checks whether a webhook header requires constant-work HMAC signing without
+ * retaining an unbounded number of signature candidates.
+ *
+ * @internal
+ */
+export function webhookSignatureRequiresSigning(signatureHeader) {
+    return (signatureHeader.split(' ', MAX_DIRECT_WEBHOOK_VERIFICATIONS + 1).length > MAX_DIRECT_WEBHOOK_VERIFICATIONS);
+}
+function* signatureCandidates(signatureHeader) {
+    let start = 0;
+    while (start <= signatureHeader.length) {
+        const separator = signatureHeader.indexOf(' ', start);
+        const candidate = signatureHeader.slice(start, separator === -1 ? undefined : separator);
+        yield candidate.startsWith('v1,') ? candidate.slice(3) : candidate;
+        if (separator === -1) {
+            break;
+        }
+        start = separator + 1;
+    }
+}
+function decodeSignature(signature) {
+    try {
+        const signatureBytes = fromBase64(signature);
+        return signatureBytes.byteLength === SHA256_SIGNATURE_LENGTH ? signatureBytes : undefined;
+    }
+    catch {
+        // Invalid base64 does not prevent trying the next value.
+        return undefined;
+    }
+}
+function firstValidLengthSignature(signatureHeader) {
+    for (const signature of signatureCandidates(signatureHeader)) {
+        const signatureBytes = decodeSignature(signature);
+        if (signatureBytes) {
+            return signatureBytes;
+        }
+    }
+    return undefined;
+}
+function selectMatchingSignature(signatureHeader, expectedSignature, firstSignature) {
+    let matchingSignature = firstSignature;
+    for (const signature of signatureCandidates(signatureHeader)) {
+        const signatureBytes = decodeSignature(signature);
+        if (!signatureBytes) {
+            continue;
+        }
+        let difference = 0;
+        for (const [index, byte] of signatureBytes.entries()) {
+            // oxlint-disable-next-line no-bitwise -- Compare every HMAC byte without short-circuiting on shared prefixes.
+            difference |= byte ^ (expectedSignature[index] ?? 0);
+        }
+        if (difference === 0) {
+            matchingSignature = signatureBytes;
+        }
+    }
+    return matchingSignature;
+}
+/**
+ * Checks the timestamp and HMAC signatures after the resource has validated its
+ * crypto capabilities, secret, and required headers.
+ *
+ * @internal
+ */
+export async function verifyWebhookSignature(payload, signatureHeader, timestamp, webhookId, secret, tolerance) {
+    // oxlint-disable-next-line unicorn/prefer-number-coercion -- Preserve numeric-prefix parsing while signing the original timestamp text.
+    const timestampSeconds = Number.parseInt(timestamp, 10);
+    if (Number.isNaN(timestampSeconds)) {
+        throw new InvalidWebhookSignatureError('Invalid webhook timestamp format');
+    }
+    const nowSeconds = Math.floor(Date.now() / 1000);
+    if (nowSeconds - timestampSeconds > tolerance) {
+        throw new InvalidWebhookSignatureError('Webhook timestamp is too old');
+    }
+    if (timestampSeconds > nowSeconds + tolerance) {
+        throw new InvalidWebhookSignatureError('Webhook timestamp is too new');
+    }
+    // Multiple signatures are space-separated; accept a matching value at any position.
+    const useBoundedVerification = webhookSignatureRequiresSigning(signatureHeader);
+    const firstSignature = useBoundedVerification ? firstValidLengthSignature(signatureHeader) : undefined;
+    if (useBoundedVerification && !firstSignature) {
+        throw new InvalidWebhookSignatureError('The given webhook signature does not match the expected signature');
+    }
+    const decodedSecret = Uint8Array.from(secret.startsWith('whsec_') ? fromBase64(secret.slice('whsec_'.length)) : encodeUTF8(secret));
+    const signedPayload = webhookId ? `${webhookId}.${timestamp}.${payload}` : `${timestamp}.${payload}`;
+    const signedPayloadBytes = Uint8Array.from(encodeUTF8(signedPayload));
+    const key = await crypto.subtle.importKey('raw', decodedSecret, { name: 'HMAC', hash: 'SHA-256' }, false, useBoundedVerification ? ['sign', 'verify'] : ['verify']);
+    if (useBoundedVerification && firstSignature) {
+        const expectedSignature = new Uint8Array(await crypto.subtle.sign('HMAC', key, signedPayloadBytes));
+        const signatureToVerify = selectMatchingSignature(signatureHeader, expectedSignature, firstSignature);
+        try {
+            if (await crypto.subtle.verify('HMAC', key, Uint8Array.from(signatureToVerify), signedPayloadBytes)) {
+                return;
+            }
+        }
+        catch {
+            // Provider verification failures have the same typed mismatch as the direct path.
+        }
+        throw new InvalidWebhookSignatureError('The given webhook signature does not match the expected signature');
+    }
+    for (const signature of signatureCandidates(signatureHeader)) {
+        try {
+            const signatureBytes = Uint8Array.from(fromBase64(signature));
+            // oxlint-disable-next-line no-await-in-loop -- Check signatures in order and stop at the first match.
+            const isValid = await crypto.subtle.verify('HMAC', key, signatureBytes, signedPayloadBytes);
+            if (isValid) {
+                return;
+            }
+        }
+        catch {
+            // Invalid base64 or signature format does not prevent trying the next value.
+        }
+    }
+    throw new InvalidWebhookSignatureError('The given webhook signature does not match the expected signature');
+}
+//# sourceMappingURL=webhook-signature.mjs.map

package/lib/webhook-signature.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-signature.mjs","sourceRoot":"","sources":["../src/lib/webhook-signature.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,qBAAiB;AACxD,OAAO,EAAE,UAAU,EAAE,qCAAiC;AACtD,OAAO,EAAE,UAAU,EAAE,oCAAgC;AAErD,MAAM,gCAAgC,GAAG,EAAE,CAAC;AAC5C,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAEnC;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAAC,eAAuB;IACrE,OAAO,CACL,eAAe,CAAC,KAAK,CAAC,GAAG,EAAE,gCAAgC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,gCAAgC,CAC3G,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,CAAC,mBAAmB,CAAC,eAAuB;IACnD,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,OAAO,KAAK,IAAI,eAAe,CAAC,MAAM,EAAE,CAAC;QACvC,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACzF,MAAM,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEnE,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;YACrB,MAAM;QACR,CAAC;QACD,KAAK,GAAG,SAAS,GAAG,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,SAAiB;IACxC,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;QAC7C,OAAO,cAAc,CAAC,UAAU,KAAK,uBAAuB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,yDAAyD;QACzD,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,eAAuB;IACxD,KAAK,MAAM,SAAS,IAAI,mBAAmB,CAAC,eAAe,CAAC,EAAE,CAAC;QAC7D,MAAM,cAAc,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,cAAc,EAAE,CAAC;YACnB,OAAO,cAAc,CAAC;QACxB,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,uBAAuB,CAC9B,eAAuB,EACvB,iBAA6B,EAC7B,cAA0B;IAE1B,IAAI,iBAAiB,GAAG,cAAc,CAAC;IAEvC,KAAK,MAAM,SAAS,IAAI,mBAAmB,CAAC,eAAe,CAAC,EAAE,CAAC;QAC7D,MAAM,cAAc,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,SAAS;QACX,CAAC;QAED,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC;YACrD,8GAA8G;YAC9G,UAAU,IAAI,IAAI,GAAG,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;YACrB,iBAAiB,GAAG,cAAc,CAAC;QACrC,CAAC;IACH,CAAC;IAED,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAe,EACf,eAAuB,EACvB,SAAiB,EACjB,SAAiB,EACjB,MAAc,EACd,SAAiB;IAEjB,wIAAwI;IACxI,MAAM,gBAAgB,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,4BAA4B,CAAC,kCAAkC,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACjD,IAAI,UAAU,GAAG,gBAAgB,GAAG,SAAS,EAAE,CAAC;QAC9C,MAAM,IAAI,4BAA4B,CAAC,8BAA8B,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,gBAAgB,GAAG,UAAU,GAAG,SAAS,EAAE,CAAC;QAC9C,MAAM,IAAI,4BAA4B,CAAC,8BAA8B,CAAC,CAAC;IACzE,CAAC;IAED,oFAAoF;IACpF,MAAM,sBAAsB,GAAG,+BAA+B,CAAC,eAAe,CAAC,CAAC;IAChF,MAAM,cAAc,GAAG,sBAAsB,CAAC,CAAC,CAAC,yBAAyB,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEvG,IAAI,sBAAsB,IAAI,CAAC,cAAc,EAAE,CAAC;QAC9C,MAAM,IAAI,4BAA4B,CACpC,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,UAAU,CAAC,IAAI,CACnC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAC7F,CAAC;IACF,MAAM,aAAa,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,IAAI,SAAS,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,SAAS,IAAI,OAAO,EAAE,CAAC;IACrG,MAAM,kBAAkB,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,aAAa,EACb,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,sBAAsB,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CACzD,CAAC;IAEF,IAAI,sBAAsB,IAAI,cAAc,EAAE,CAAC;QAC7C,MAAM,iBAAiB,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC,CAAC;QACpG,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,eAAe,EAAE,iBAAiB,EAAE,cAAc,CAAC,CAAC;QAEtG,IAAI,CAAC;YACH,IAAI,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,kBAAkB,CAAC,EAAE,CAAC;gBACpG,OAAO;YACT,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,kFAAkF;QACpF,CAAC;QAED,MAAM,IAAI,4BAA4B,CACpC,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,SAAS,IAAI,mBAAmB,CAAC,eAAe,CAAC,EAAE,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;YAC9D,sGAAsG;YACtG,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAC5F,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,6EAA6E;QAC/E,CAAC;IACH,CAAC;IAED,MAAM,IAAI,4BAA4B,CAAC,mEAAmE,CAAC,CAAC;AAC9G,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openai",
-  "version": "7.4.0",
+  "version": "7.6.0",
   "description": "The official TypeScript library for the OpenAI API",
   "author": "OpenAI <support@openai.com>",
   "types": "./index.d.ts",
@@ -24,15 +24,23 @@
     "test:unit": "vitest run --config vitest.config.mts",
     "test:generated": "OPENAI_TEST_SUITE=generated ./scripts/test",
     "test:live:bedrock": "jest --config jest.live.config.ts --runInBand tests/live/bedrock.live.test.ts",
+    "test:live:x509": "pnpm build && node --input-type=module < examples/mtls/x509-workload-identity.mjs",
     "build": "./scripts/build",
     "format": "./scripts/format",
     "tsn": "ts-node -r tsconfig-paths/register",
-    "lint": "./scripts/lint",
-    "fix": "./scripts/format"
+    "lint": "./scripts/lint"
   },
   "overrides": {
     "minimatch": "^9.0.5"
   },
+  "imports": {
+    "#x509-transport-state": {
+      "types": "./src/internal/auth/x509-transport-state.cts",
+      "browser": "./internal/auth/x509-transport-state-browser.mjs",
+      "node": "./internal/auth/x509-transport-state.cjs",
+      "default": "./internal/auth/x509-transport-state-browser.mjs"
+    }
+  },
   "exports": {
     ".": {
       "require": {
@@ -42,6 +50,14 @@
       "types": "./index.d.mts",
       "default": "./index.mjs"
     },
+    "./auth": {
+      "require": {
+        "types": "./auth/index.d.ts",
+        "default": "./auth/index.js"
+      },
+      "types": "./auth/index.d.mts",
+      "default": "./auth/index.mjs"
+    },
     "./_vendor/*.mjs": {
       "default": "./_vendor/*.mjs"
     },
@@ -257,6 +273,7 @@
     "@aws-sdk/credential-provider-node": ">=3.972.0 <4",
     "@smithy/hash-node": ">=4.3.0 <5",
     "@smithy/signature-v4": ">=5.4.0 <6",
+    "undici": ">=5 <9",
     "ws": "^8.18.0",
     "zod": "^3.25 || ^4.0"
   },
@@ -270,6 +287,9 @@
     "@smithy/signature-v4": {
       "optional": true
     },
+    "undici": {
+      "optional": true
+    },
     "ws": {
       "optional": true
     },

package/providers/bedrock/aws.d.mts

@@ -1,24 +1,51 @@
-import { type BedrockBearerOptions, type BedrockEndpointOptions } from "../../internal/bedrock.mjs";
-import { type Provider } from "../../internal/provider.mjs";
+import type { BedrockBearerOptions, BedrockEndpointOptions } from "../../internal/bedrock.mjs";
+import type { Provider } from "../../internal/provider.mjs";
+/** AWS credentials used to sign an Amazon Bedrock request with Signature Version 4. */
 export interface AwsCredentialIdentity {
+    /** AWS access-key identifier associated with the signing identity. */
     accessKeyId: string;
+    /** Secret access key paired with the AWS access-key identifier. */
     secretAccessKey: string;
+    /** Session token required by temporary AWS credentials, when present. */
     sessionToken?: string;
+    /** Expiration timestamp supplied by a refreshable temporary-credential provider. */
     expiration?: Date;
 }
+/** Resolves current AWS signing credentials before a Bedrock request attempt. */
 export type AwsCredentialsProvider = () => AwsCredentialIdentity | Promise<AwsCredentialIdentity>;
+/**
+ * Configures a Bedrock endpoint and exactly one explicit bearer or AWS credential mode.
+ *
+ * When no explicit credential mode is supplied, `AWS_BEARER_TOKEN_BEDROCK` is
+ * preferred, followed by the default AWS credential-provider chain.
+ */
 export interface BedrockProviderOptions extends BedrockEndpointOptions, BedrockBearerOptions {
-    /** Explicit AWS access key ID. Must be paired with secretAccessKey. */
+    /** Explicit AWS access-key identifier; must be paired with `secretAccessKey`. */
     accessKeyId?: string | undefined;
-    /** Explicit AWS secret access key. Must be paired with accessKeyId. */
+    /** Explicit AWS secret access key; must be paired with `accessKeyId`. */
     secretAccessKey?: string | undefined;
-    /** Optional session token for explicit temporary AWS credentials. */
+    /** Session token for explicit temporary AWS credentials; requires both access-key fields. */
     sessionToken?: string | undefined;
-    /** Explicit AWS shared-config profile. */
+    /** AWS shared-config profile; cannot be combined with another explicit credential mode. */
     profile?: string | undefined;
-    /** A refreshable provider returning AWS credentials. */
+    /** Refreshable signing-credential provider invoked for each request attempt, including retries. */
     credentialProvider?: AwsCredentialsProvider | undefined;
 }
-/** Configure the standard OpenAI client for Amazon Bedrock using bearer or AWS authentication. */
+/**
+ * Configures the standard OpenAI client for Amazon Bedrock bearer or AWS SigV4 authentication.
+ *
+ * Explicit bearer credentials, static AWS credentials, a shared-config profile,
+ * and a credential provider are mutually exclusive. Without explicit
+ * credentials, `AWS_BEARER_TOKEN_BEDROCK` takes precedence over the default AWS
+ * credential chain. The region defaults to `AWS_REGION` or `AWS_DEFAULT_REGION`.
+ *
+ * This entrypoint requires `@aws-sdk/credential-provider-node`,
+ * `@smithy/hash-node`, and `@smithy/signature-v4`. AWS signing is available in
+ * Node.js-compatible server runtimes and requires replayable request bodies.
+ *
+ * @param options Bedrock endpoint and optional explicit authentication settings.
+ * @returns A provider accepted by `new OpenAI({ provider })`.
+ * @throws {OpenAIError} If endpoint settings or credential modes are invalid or ambiguous.
+ */
 export declare function bedrock(options?: BedrockProviderOptions): Provider;
 //# sourceMappingURL=aws.d.mts.map

package/providers/bedrock/aws.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"aws.d.mts","sourceRoot":"","sources":["../../src/providers/bedrock/aws.ts"],"names":[],"mappings":"AAMA,OAAO,EAML,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAE5B,mCAA+B;AAChC,OAAO,EAAkB,KAAK,QAAQ,EAA+B,oCAAgC;AAKrG,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,IAAI,CAAC;CACnB;AAED,MAAM,MAAM,sBAAsB,GAAG,MAAM,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAElG,MAAM,WAAW,sBAAuB,SAAQ,sBAAsB,EAAE,oBAAoB;IAC1F,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEjC,uEAAuE;IACvE,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAErC,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAElC,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE7B,wDAAwD;IACxD,kBAAkB,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;CACzD;AAiKD,kGAAkG;AAClG,wBAAgB,OAAO,CAAC,OAAO,GAAE,sBAA2B,GAAG,QAAQ,CA+CtE"}
+{"version":3,"file":"aws.d.mts","sourceRoot":"","sources":["../../src/providers/bedrock/aws.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EACV,oBAAoB,EAEpB,sBAAsB,EAEvB,mCAA+B;AAEhC,OAAO,KAAK,EAAE,QAAQ,EAA0B,oCAAgC;AAGhF,uFAAuF;AACvF,MAAM,WAAW,qBAAqB;IACpC,sEAAsE;IACtE,WAAW,EAAE,MAAM,CAAC;IAEpB,mEAAmE;IACnE,eAAe,EAAE,MAAM,CAAC;IAExB,yEAAyE;IACzE,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,oFAAoF;IACpF,UAAU,CAAC,EAAE,IAAI,CAAC;CACnB;AAED,iFAAiF;AACjF,MAAM,MAAM,sBAAsB,GAAG,MAAM,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAElG;;;;;GAKG;AACH,MAAM,WAAW,sBAAuB,SAAQ,sBAAsB,EAAE,oBAAoB;IAC1F,iFAAiF;IACjF,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEjC,yEAAyE;IACzE,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAErC,6FAA6F;IAC7F,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAElC,2FAA2F;IAC3F,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE7B,mGAAmG;IACnG,kBAAkB,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;CACzD;AA2LD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,OAAO,CAAC,OAAO,GAAE,sBAA2B,GAAG,QAAQ,CA4DtE"}

package/providers/bedrock/aws.d.ts

@@ -1,24 +1,51 @@
-import { type BedrockBearerOptions, type BedrockEndpointOptions } from "../../internal/bedrock.js";
-import { type Provider } from "../../internal/provider.js";
+import type { BedrockBearerOptions, BedrockEndpointOptions } from "../../internal/bedrock.js";
+import type { Provider } from "../../internal/provider.js";
+/** AWS credentials used to sign an Amazon Bedrock request with Signature Version 4. */
 export interface AwsCredentialIdentity {
+    /** AWS access-key identifier associated with the signing identity. */
     accessKeyId: string;
+    /** Secret access key paired with the AWS access-key identifier. */
     secretAccessKey: string;
+    /** Session token required by temporary AWS credentials, when present. */
     sessionToken?: string;
+    /** Expiration timestamp supplied by a refreshable temporary-credential provider. */
     expiration?: Date;
 }
+/** Resolves current AWS signing credentials before a Bedrock request attempt. */
 export type AwsCredentialsProvider = () => AwsCredentialIdentity | Promise<AwsCredentialIdentity>;
+/**
+ * Configures a Bedrock endpoint and exactly one explicit bearer or AWS credential mode.
+ *
+ * When no explicit credential mode is supplied, `AWS_BEARER_TOKEN_BEDROCK` is
+ * preferred, followed by the default AWS credential-provider chain.
+ */
 export interface BedrockProviderOptions extends BedrockEndpointOptions, BedrockBearerOptions {
-    /** Explicit AWS access key ID. Must be paired with secretAccessKey. */
+    /** Explicit AWS access-key identifier; must be paired with `secretAccessKey`. */
     accessKeyId?: string | undefined;
-    /** Explicit AWS secret access key. Must be paired with accessKeyId. */
+    /** Explicit AWS secret access key; must be paired with `accessKeyId`. */
     secretAccessKey?: string | undefined;
-    /** Optional session token for explicit temporary AWS credentials. */
+    /** Session token for explicit temporary AWS credentials; requires both access-key fields. */
     sessionToken?: string | undefined;
-    /** Explicit AWS shared-config profile. */
+    /** AWS shared-config profile; cannot be combined with another explicit credential mode. */
     profile?: string | undefined;
-    /** A refreshable provider returning AWS credentials. */
+    /** Refreshable signing-credential provider invoked for each request attempt, including retries. */
     credentialProvider?: AwsCredentialsProvider | undefined;
 }
-/** Configure the standard OpenAI client for Amazon Bedrock using bearer or AWS authentication. */
+/**
+ * Configures the standard OpenAI client for Amazon Bedrock bearer or AWS SigV4 authentication.
+ *
+ * Explicit bearer credentials, static AWS credentials, a shared-config profile,
+ * and a credential provider are mutually exclusive. Without explicit
+ * credentials, `AWS_BEARER_TOKEN_BEDROCK` takes precedence over the default AWS
+ * credential chain. The region defaults to `AWS_REGION` or `AWS_DEFAULT_REGION`.
+ *
+ * This entrypoint requires `@aws-sdk/credential-provider-node`,
+ * `@smithy/hash-node`, and `@smithy/signature-v4`. AWS signing is available in
+ * Node.js-compatible server runtimes and requires replayable request bodies.
+ *
+ * @param options Bedrock endpoint and optional explicit authentication settings.
+ * @returns A provider accepted by `new OpenAI({ provider })`.
+ * @throws {OpenAIError} If endpoint settings or credential modes are invalid or ambiguous.
+ */
 export declare function bedrock(options?: BedrockProviderOptions): Provider;
 //# sourceMappingURL=aws.d.ts.map

package/providers/bedrock/aws.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aws.d.ts","sourceRoot":"","sources":["../../src/providers/bedrock/aws.ts"],"names":[],"mappings":"AAMA,OAAO,EAML,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAE5B,kCAA+B;AAChC,OAAO,EAAkB,KAAK,QAAQ,EAA+B,mCAAgC;AAKrG,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,IAAI,CAAC;CACnB;AAED,MAAM,MAAM,sBAAsB,GAAG,MAAM,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAElG,MAAM,WAAW,sBAAuB,SAAQ,sBAAsB,EAAE,oBAAoB;IAC1F,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEjC,uEAAuE;IACvE,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAErC,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAElC,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE7B,wDAAwD;IACxD,kBAAkB,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;CACzD;AAiKD,kGAAkG;AAClG,wBAAgB,OAAO,CAAC,OAAO,GAAE,sBAA2B,GAAG,QAAQ,CA+CtE"}
+{"version":3,"file":"aws.d.ts","sourceRoot":"","sources":["../../src/providers/bedrock/aws.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EACV,oBAAoB,EAEpB,sBAAsB,EAEvB,kCAA+B;AAEhC,OAAO,KAAK,EAAE,QAAQ,EAA0B,mCAAgC;AAGhF,uFAAuF;AACvF,MAAM,WAAW,qBAAqB;IACpC,sEAAsE;IACtE,WAAW,EAAE,MAAM,CAAC;IAEpB,mEAAmE;IACnE,eAAe,EAAE,MAAM,CAAC;IAExB,yEAAyE;IACzE,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,oFAAoF;IACpF,UAAU,CAAC,EAAE,IAAI,CAAC;CACnB;AAED,iFAAiF;AACjF,MAAM,MAAM,sBAAsB,GAAG,MAAM,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAElG;;;;;GAKG;AACH,MAAM,WAAW,sBAAuB,SAAQ,sBAAsB,EAAE,oBAAoB;IAC1F,iFAAiF;IACjF,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEjC,yEAAyE;IACzE,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAErC,6FAA6F;IAC7F,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAElC,2FAA2F;IAC3F,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE7B,mGAAmG;IACnG,kBAAkB,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;CACzD;AA2LD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,OAAO,CAAC,OAAO,GAAE,sBAA2B,GAAG,QAAQ,CA4DtE"}

package/providers/bedrock/aws.js

@@ -8,15 +8,15 @@ const signature_v4_1 = require("@smithy/signature-v4");
 const Errors = tslib_1.__importStar(require("../../error.js"));
 const bedrock_1 = require("../../internal/bedrock.js");
 const provider_1 = require("../../internal/provider.js");
-const BEDROCK_SERVICE = 'bedrock-mantle';
 function validateStaticCredentials(options) {
     const hasAccessKey = options.accessKeyId !== undefined;
     const hasSecretKey = options.secretAccessKey !== undefined;
     if (hasAccessKey !== hasSecretKey || (options.sessionToken !== undefined && !hasAccessKey)) {
         throw new Errors.OpenAIError('The `accessKeyId` and `secretAccessKey` options must be provided together. A `sessionToken` may only be used with both.');
     }
-    if (!hasAccessKey)
+    if (!hasAccessKey) {
         return undefined;
+    }
     if (typeof options.accessKeyId !== 'string' ||
         !options.accessKeyId.trim() ||
         typeof options.secretAccessKey !== 'string' ||
@@ -34,21 +34,31 @@ function validateStaticCredentials(options) {
     };
 }
 function requestTarget(parsedURL) {
-    const query = {};
+    const query = Object.create(null);
     for (const [name, value] of parsedURL.searchParams) {
+        if (name === '__proto__') {
+            throw new Errors.OpenAIError('The Bedrock SigV4 signer cannot safely sign a `__proto__` query parameter.');
+        }
         const existing = query[name];
-        query[name] =
-            existing === undefined ? value
-                : typeof existing === 'string' ? [existing, value]
-                    : [...existing, value];
+        if (existing === undefined) {
+            query[name] = value;
+        }
+        else if (typeof existing === 'string') {
+            query[name] = [existing, value];
+        }
+        else {
+            query[name] = [...existing, value];
+        }
     }
     return { path: parsedURL.pathname, query };
 }
 function signableBody(body) {
-    if (body === undefined || body === null)
+    if (body === undefined || body === null) {
         return undefined;
-    if (typeof body === 'string' || body instanceof ArrayBuffer || ArrayBuffer.isView(body))
+    }
+    if (typeof body === 'string' || body instanceof ArrayBuffer || ArrayBuffer.isView(body)) {
         return body;
+    }
     throw new Errors.OpenAIError("The SDK's Bedrock SigV4 mode requires a replayable request body. Buffer the body before sending or use bearer authentication.");
 }
 function validateCredentialIdentity(identity) {
@@ -67,8 +77,9 @@ class BedrockSigV4Auth {
         this.options = options;
     }
     credentialsProvider() {
-        if (this.resolvedCredentialsProvider)
+        if (this.resolvedCredentialsProvider) {
             return this.resolvedCredentialsProvider;
+        }
         if (this.options.staticCredentials) {
             const credentials = this.options.staticCredentials;
             return (this.resolvedCredentialsProvider = async () => credentials);
@@ -84,7 +95,7 @@ class BedrockSigV4Auth {
         return (this.signer ?? (this.signer = new signature_v4_1.SignatureV4({
             credentials: this.credentialsProvider(),
             region: this.options.region,
-            service: BEDROCK_SERVICE,
+            service: this.options.endpoint === 'runtime' ? 'bedrock' : 'bedrock-mantle',
             sha256: hash_node_1.Hash.bind(null, 'sha256'),
         })));
     }
@@ -93,9 +104,12 @@ class BedrockSigV4Auth {
             throw new Errors.OpenAIError('Bedrock AWS credential authentication is only supported in Node.js and compatible server runtimes. Use bearer authentication in this runtime.');
         }
         const parsedURL = new URL(url);
-        const canonicalRegion = /^bedrock-mantle\.([a-z0-9-]+)\.api\.aws$/i.exec(parsedURL.hostname)?.[1];
-        if (canonicalRegion && canonicalRegion !== this.options.region) {
-            throw new Errors.OpenAIError(`The Bedrock endpoint region \`${canonicalRegion}\` does not match the SigV4 region \`${this.options.region}\`.`);
+        const canonicalEndpoint = (0, bedrock_1.parseBedrockEndpointHostname)(parsedURL.hostname);
+        if (canonicalEndpoint && canonicalEndpoint.endpoint !== this.options.endpoint) {
+            throw new Errors.OpenAIError(`The Bedrock ${canonicalEndpoint.endpoint} hostname does not match the selected \`${this.options.endpoint}\` endpoint.`);
+        }
+        if (canonicalEndpoint && canonicalEndpoint.region !== this.options.region) {
+            throw new Errors.OpenAIError(`The Bedrock endpoint region \`${canonicalEndpoint.region}\` does not match the SigV4 region \`${this.options.region}\`.`);
         }
         const headers = new Headers(request.headers);
         (0, bedrock_1.assertProviderOwnsAuthorization)(headers);
@@ -105,6 +119,7 @@ class BedrockSigV4Auth {
         headers.set('host', parsedURL.host);
         const method = (request.method ?? 'GET').toUpperCase();
         const body = signableBody(request.body);
+        const target = requestTarget(parsedURL);
         let signed;
         try {
             signed = await this.signatureV4().sign({
@@ -112,14 +127,14 @@ class BedrockSigV4Auth {
                 hostname: parsedURL.hostname,
                 ...(parsedURL.port ? { port: Number(parsedURL.port) } : {}),
                 method,
-                ...requestTarget(parsedURL),
+                ...target,
                 headers: Object.fromEntries(headers.entries()),
-                ...(body !== undefined ? { body } : {}),
+                ...(body === undefined ? {} : { body }),
             });
         }
         catch (cause) {
-            const message = this.options.usesDefaultChain ?
-                'Could not find credentials for Bedrock. Pass AWS credentials to `bedrock(...)` or configure the default AWS credential chain.'
+            const message = this.options.usesDefaultChain
+                ? 'Could not find credentials for Bedrock. Pass AWS credentials to `bedrock(...)` or configure the default AWS credential chain.'
                 : 'Failed to resolve AWS credentials for Bedrock. Verify your AWS profile, environment variables, or runtime identity configuration and try again.';
             throw (0, bedrock_1.errorWithCause)(message, cause);
         }
@@ -128,7 +143,22 @@ class BedrockSigV4Auth {
         request.headers = new Headers(signed.headers);
     }
 }
-/** Configure the standard OpenAI client for Amazon Bedrock using bearer or AWS authentication. */
+/**
+ * Configures the standard OpenAI client for Amazon Bedrock bearer or AWS SigV4 authentication.
+ *
+ * Explicit bearer credentials, static AWS credentials, a shared-config profile,
+ * and a credential provider are mutually exclusive. Without explicit
+ * credentials, `AWS_BEARER_TOKEN_BEDROCK` takes precedence over the default AWS
+ * credential chain. The region defaults to `AWS_REGION` or `AWS_DEFAULT_REGION`.
+ *
+ * This entrypoint requires `@aws-sdk/credential-provider-node`,
+ * `@smithy/hash-node`, and `@smithy/signature-v4`. AWS signing is available in
+ * Node.js-compatible server runtimes and requires replayable request bodies.
+ *
+ * @param options Bedrock endpoint and optional explicit authentication settings.
+ * @returns A provider accepted by `new OpenAI({ provider })`.
+ * @throws {OpenAIError} If endpoint settings or credential modes are invalid or ambiguous.
+ */
 function bedrock(options = {}) {
     const staticCredentials = validateStaticCredentials(options);
     const profile = (0, bedrock_1.normalizeOptionalString)(options.profile);
@@ -144,15 +174,21 @@ function bedrock(options = {}) {
     if (bearerAuth.explicit && explicitAwsAuth) {
         throw new Errors.OpenAIError('Bearer and AWS credential authentication are mutually exclusive. Configure exactly one explicit mode: bearer credential, static AWS credentials, profile, or credential provider.');
     }
-    const { region, baseURL } = (0, bedrock_1.resolveBedrockEndpoint)(options);
+    const { endpoint, region, baseURL } = (0, bedrock_1.resolveBedrockEndpoint)(options);
     if (!bearerAuth.factory && !region) {
         throw new Errors.OpenAIError('Bedrock requires an AWS region. Pass `region` to `bedrock(...)`, or set `AWS_REGION` or `AWS_DEFAULT_REGION`.');
     }
+    if (!bearerAuth.factory &&
+        options.endpoint === undefined &&
+        !(0, bedrock_1.parseBedrockEndpointHostname)(new URL(baseURL).hostname)) {
+        throw new Errors.OpenAIError('A custom Bedrock endpoint requires an explicit `endpoint` option when using AWS credential authentication.');
+    }
     const credentialProvider = options.credentialProvider;
     return (0, provider_1.createProvider)({
         configure() {
             const auth = bearerAuth.factory?.() ??
                 new BedrockSigV4Auth({
+                    endpoint,
                     region: region,
                     staticCredentials,
                     profile,
@@ -162,7 +198,10 @@ function bedrock(options = {}) {
             return {
                 name: 'bedrock',
                 baseURL,
-                prepareRequest: auth.prepareRequest.bind(auth),
+                async prepareRequest(request, context) {
+                    (0, bedrock_1.assertBedrockRequestOrigin)(baseURL, context.url);
+                    await auth.prepareRequest(request, context);
+                },
             };
         },
     });