openai 7.5.0 → 7.6.0

package/src/internal/bedrock.ts

@@ -276,6 +276,149 @@ export function assertProviderOwnsAuthorization(headers: Headers): void {
   }
 }
 
+/** Rejects non-HTTP field bytes without retaining or exposing a bearer credential. */
+export function assertValidBedrockBearerCredential(credential: string): void {
+  if (/^[\t ]|[\t ]$/.test(credential)) {
+    throw new TypeError('Bedrock bearer credential contains an invalid HTTP header value.');
+  }
+
+  for (const character of credential) {
+    const value = character.codePointAt(0) ?? 0;
+    if ((value < 0x20 && value !== 0x09) || value === 0x7f || value > 0xff) {
+      throw new TypeError('Bedrock bearer credential contains an invalid HTTP header value.');
+    }
+  }
+}
+
+interface BedrockBearerSignalFailure {
+  error?: { value: unknown };
+  removeListeners?: () => void;
+}
+
+function createBedrockUserAbortError(signal: AbortSignal): Errors.APIUserAbortError {
+  const error = new Errors.APIUserAbortError();
+  Object.defineProperty(error, 'cause', {
+    value: signal.reason,
+    writable: true,
+    configurable: true,
+  });
+  return error;
+}
+
+function removeBedrockAbortListener(signal: AbortSignal, listener: () => void): void {
+  try {
+    signal.removeEventListener('abort', listener);
+  } catch {
+    // A nonstandard AbortSignal must not replace the actual request outcome.
+  }
+}
+
+function resolveAbortableBedrockBearerToken(
+  tokenProvider: ApiKeySetter,
+  signals: readonly AbortSignal[],
+  failure: BedrockBearerSignalFailure,
+): Promise<string> {
+  // oxlint-disable-next-line promise/avoid-new -- AbortSignal events require a Promise callback bridge.
+  return new Promise<string>((resolve, reject) => {
+    let settled = false;
+    const listeners: { signal: AbortSignal; listener: () => void }[] = [];
+
+    const removeListeners = () => {
+      while (listeners.length > 0) {
+        const registered = listeners.pop();
+        if (registered) {
+          removeBedrockAbortListener(registered.signal, registered.listener);
+        }
+      }
+    };
+    failure.removeListeners = removeListeners;
+
+    const settle = (result: { token: string } | { error: unknown }) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      if ('token' in result) {
+        resolve(result.token);
+      } else {
+        removeListeners();
+        reject(result.error);
+      }
+    };
+
+    const rejectSignalFailure = (error: unknown) => {
+      if (failure.error) {
+        return;
+      }
+      failure.error = { value: error };
+      settle({ error });
+    };
+
+    const registerAbortListener = (signal: AbortSignal): boolean => {
+      const onAbort = () => {
+        if (failure.error) {
+          return;
+        }
+        try {
+          rejectSignalFailure(createBedrockUserAbortError(signal));
+        } catch (error) {
+          rejectSignalFailure(error);
+        }
+      };
+
+      try {
+        if (signal.aborted) {
+          onAbort();
+          return false;
+        }
+        listeners.push({ signal, listener: onAbort });
+        signal.addEventListener('abort', onAbort, { once: true });
+        if (settled) {
+          removeBedrockAbortListener(signal, onAbort);
+          return false;
+        }
+        if (signal.aborted) {
+          onAbort();
+          return false;
+        }
+      } catch (error) {
+        if (settled) {
+          removeBedrockAbortListener(signal, onAbort);
+        } else {
+          rejectSignalFailure(error);
+        }
+        return false;
+      }
+
+      return true;
+    };
+
+    for (const signal of signals) {
+      if (!registerAbortListener(signal)) {
+        return;
+      }
+    }
+
+    let token: Promise<string>;
+    try {
+      token = tokenProvider();
+    } catch (error) {
+      settle({ error });
+      return;
+    }
+
+    const observeToken = async () => {
+      try {
+        settle({ token: await token });
+      } catch (error) {
+        settle({ error });
+      }
+    };
+    // Observe the result even if the provider synchronously triggered cancellation.
+    void observeToken();
+  });
+}
+
 class BedrockBearerAuth implements BedrockRequestAuth {
   private readonly tokenProvider: ApiKeySetter;
 
@@ -283,20 +426,54 @@ class BedrockBearerAuth implements BedrockRequestAuth {
     this.tokenProvider = tokenProvider;
   }
 
-  async prepareRequest(request: FinalizedRequestInit, _context: ProviderRequestContext): Promise<void> {
+  async prepareRequest(request: FinalizedRequestInit, context: ProviderRequestContext): Promise<void> {
     const headers = new Headers(request.headers);
     assertProviderOwnsAuthorization(headers);
 
+    const signals: AbortSignal[] = [];
+    for (const signal of [context.options.signal, request.signal]) {
+      if (signal != null && !signals.includes(signal)) {
+        signals.push(signal);
+      }
+    }
+    const signalFailure: BedrockBearerSignalFailure = {};
     let token: unknown;
     try {
-      token = await this.tokenProvider();
-    } catch (cause) {
-      throw errorWithCause('Failed to resolve a bearer credential for Bedrock.', cause);
+      try {
+        token =
+          signals.length > 0
+            ? await resolveAbortableBedrockBearerToken(() => this.tokenProvider(), signals, signalFailure)
+            : await this.tokenProvider();
+      } catch (cause) {
+        if (signalFailure.error && Object.is(cause, signalFailure.error.value)) {
+          throw cause;
+        }
+        throw errorWithCause('Failed to resolve a bearer credential for Bedrock.', cause);
+      }
+      if (signalFailure.error) {
+        throw signalFailure.error.value;
+      }
+      for (const signal of signals) {
+        if (signal.aborted) {
+          throw createBedrockUserAbortError(signal);
+        }
+      }
+    } finally {
+      signalFailure.removeListeners?.();
     }
     if (typeof token !== 'string' || !token.trim()) {
       throw new Errors.OpenAIError('The Bedrock bearer credential provider must return a non-empty string.');
     }
-    headers.set('authorization', `Bearer ${token}`);
+    assertValidBedrockBearerCredential(token);
+    try {
+      headers.set('authorization', `Bearer ${token}`);
+    } catch (error) {
+      if (error instanceof TypeError) {
+        // oxlint-disable-next-line eslint/preserve-caught-error -- The original error contains the bearer credential.
+        throw new TypeError('Bedrock bearer credential contains an invalid HTTP header value.');
+      }
+      throw error;
+    }
     request.redirect = 'manual';
     request.headers = headers;
   }

package/src/internal/data-residency.ts

@@ -0,0 +1,44 @@
+// File generated from our OpenAPI spec by Castiron. See CONTRIBUTING.md for details.
+
+import { OpenAIError } from '../core/error';
+import { hasOwn } from './utils/values';
+
+/** OpenAI endpoint regions selectable without specifying a full base URL. */
+export type DataResidency = 'global' | 'us' | 'eu' | 'ae';
+
+const endpoints = new Map<DataResidency, string>([
+  ['global', 'https://api.openai.com/v1'],
+  ['us', 'https://us.api.openai.com/v1'],
+  ['eu', 'https://eu.api.openai.com/v1'],
+  ['ae', 'https://ae.api.openai.com/v1'],
+]);
+
+/** Resolves an explicit residency selection before client options are inherited. */
+export function resolveDataResidency(options: {
+  /** Residency shorthand; null and undefined preserve ordinary URL resolution. */
+  dataResidency?: DataResidency | null | undefined;
+  /** Explicit API root, mutually exclusive with a residency selection. */
+  baseURL?: string | null | undefined;
+}): string | undefined {
+  if (options.dataResidency === null || options.dataResidency === undefined) {
+    return undefined;
+  }
+  if (hasOwn(options, 'baseURL')) {
+    throw new OpenAIError('The `dataResidency` and `baseURL` options are mutually exclusive.');
+  }
+  const endpoint = endpoints.get(options.dataResidency);
+  if (endpoint === undefined) {
+    throw new OpenAIError('Invalid `dataResidency`; expected one of: global, us, eu, ae.');
+  }
+  return endpoint;
+}
+
+/** Prevents legacy provider clients from selecting an OpenAI endpoint. */
+export function assertNoDataResidency(
+  dataResidency: DataResidency | null | undefined,
+  clientName: string,
+): void {
+  if (dataResidency !== null && dataResidency !== undefined) {
+    throw new OpenAIError(`${clientName} does not support \`dataResidency\`.`);
+  }
+}

package/src/internal/multipart-encoding.ts

@@ -0,0 +1,53 @@
+// File generated from our OpenAPI spec by Castiron. See CONTRIBUTING.md for details.
+
+import { multipartFormRequestOptions, makeFile } from './uploads';
+import { buildHeaders } from './headers';
+import type { RequestOptions } from './request-options';
+
+/** Encode explicitly typed fields as single, filename-less multipart parts. */
+export async function encodedMultipartFormRequestOptions(
+  options: RequestOptions,
+  client: Parameters<typeof multipartFormRequestOptions>[1],
+  encodings: Record<string, { content_type: string; json: boolean }>,
+  rawBodyField: string | null = null,
+): Promise<RequestOptions> {
+  if (options.body === null || typeof options.body !== 'object' || Array.isArray(options.body)) {
+    throw new TypeError('Multipart request body must be an object');
+  }
+  const body = Object.fromEntries(Object.entries(options.body).filter(([, value]) => value !== undefined));
+  if (
+    rawBodyField !== null &&
+    Object.keys(body).length === 1 &&
+    Object.prototype.hasOwnProperty.call(body, rawBodyField)
+  ) {
+    const value = body[rawBodyField];
+    if (typeof value !== 'string') throw new TypeError('Raw multipart alternative must be a string');
+    return {
+      ...options,
+      body: value,
+      headers: buildHeaders([options.headers, { 'content-type': encodings[rawBodyField]!.content_type }]),
+    };
+  }
+  const encoded: [string, File][] = [];
+  for (const [name, encoding] of Object.entries(encodings)) {
+    if (!Object.prototype.hasOwnProperty.call(body, name)) continue;
+    const value = body[name];
+    const data = encoding.json ? JSON.stringify(value) : value;
+    if (typeof data !== 'string') throw new TypeError(`Multipart field ${name} must encode as a string`);
+    encoded.push([name, makeFile([data], '', { type: encoding.content_type })]);
+    delete body[name];
+  }
+  const multipart = await multipartFormRequestOptions({ ...options, body }, client);
+  const form = multipart.body;
+  // Declared upload fields are rejected during code generation. Defend against untyped body overrides.
+  if (!(form instanceof FormData)) {
+    await (form as ReadableStream).cancel();
+    throw new TypeError('Unexpected streaming upload in typed multipart request body');
+  }
+  for (const [name, part] of encoded) form.append(name, part, '');
+  return {
+    ...options,
+    body: form,
+    headers: buildHeaders([options.headers, { 'content-type': null }]),
+  };
+}