openai 7.5.0 → 7.7.0

package/client.mjs

@@ -1,8 +1,8 @@
 // File generated from our OpenAPI spec by Castiron. See CONTRIBUTING.md for details.
-var _OpenAI_instances, _a, _OpenAI_encoder, _OpenAI_responseAttempts, _OpenAI_baseURLOverridden;
+var _OpenAI_instances, _a, _OpenAI_encoder, _OpenAI_x509Authentication, _OpenAI_x509Fetch, _OpenAI_explicitDataResidency, _OpenAI_responseAttempts, _OpenAI_baseURLOverridden;
 import { __classPrivateFieldGet, __classPrivateFieldSet } from "./internal/tslib.mjs";
 import { uuid4 } from "./internal/utils/uuid.mjs";
-import { validatePositiveInteger, isAbsoluteURL, safeJSON } from "./internal/utils/values.mjs";
+import { validatePositiveInteger, isAbsoluteURL, safeJSON, hasOwn } from "./internal/utils/values.mjs";
 import { sleep } from "./internal/utils/sleep.mjs";
 import { castToError, isAbortError } from "./internal/errors.mjs";
 import { addRequestID, defaultParseResponse } from "./internal/parse.mjs";
@@ -11,9 +11,12 @@ import * as Shims from "./internal/shims.mjs";
 import * as Opts from "./internal/request-options.mjs";
 import { stringifyQuery } from "./internal/utils/query.mjs";
 import { VERSION } from "./version.mjs";
+import { resolveDataResidency } from "./internal/data-residency.mjs";
 import * as Errors from "./core/error.mjs";
 import * as Pagination from "./core/pagination.mjs";
 import { WorkloadIdentityAuth } from "./auth/workload-identity-auth.mjs";
+import { X509_API_BASE_URL, X509WorkloadIdentityAuth, assertX509APIOrigin, assertX509RequestOptions, isX509WorkloadIdentity, snapshotX509RequestOptions, } from "./internal/auth/x509-workload-identity-auth.mjs";
+import { isTransientX509ConnectionError, markApprovedX509Client } from '#x509-transport-state';
 import { OAuthError, SubjectTokenProviderError } from "./core/error.mjs";
 import * as Uploads from "./core/uploads.mjs";
 import * as API from "./resources/index.mjs";
@@ -65,6 +68,7 @@ function isRunningInBrowserOrBrowserWorker() {
         scope.WebSocketPair === undefined);
 }
 const WORKLOAD_IDENTITY_API_KEY_PLACEHOLDER = 'workload-identity-auth';
+const inheritedDataResidencySelection = Symbol('inheritedDataResidencySelection');
 /**
  * API Client for interfacing with the OpenAI API.
  */
@@ -90,6 +94,10 @@ export class OpenAI {
     constructor(clientOptions = {}) {
         _OpenAI_instances.add(this);
         _OpenAI_encoder.set(this, void 0);
+        _OpenAI_x509Authentication.set(this, void 0);
+        _OpenAI_x509Fetch.set(this, void 0);
+        // Preserve an explicit global selection without storing a second routing URL.
+        _OpenAI_explicitDataResidency.set(this, false);
         _OpenAI_responseAttempts.set(this, new WeakMap());
         /**
          * Given a prompt, the model will return one or more predicted completions, and can also return the probabilities of alternative tokens at each position.
@@ -148,16 +156,22 @@ export class OpenAI {
          * @deprecated The Sora API is scheduled to permanently shut down on September 24, 2026.
          */
         this.videos = new API.Videos(this);
+        const residencyBaseURL = resolveDataResidency(clientOptions);
         const provider = clientOptions.provider;
+        const { baseURL = provider ? null : readEnv('OPENAI_BASE_URL'), dataResidency: _dataResidency, [inheritedDataResidencySelection]: inheritedResidencySelection = false, apiKey = provider ? null : (readEnv('OPENAI_API_KEY') ?? null), adminAPIKey = provider ? null : (readEnv('OPENAI_ADMIN_KEY') ?? null), organization = provider ? null : (readEnv('OPENAI_ORG_ID') ?? null), project = provider ? null : (readEnv('OPENAI_PROJECT_ID') ?? null), webhookSecret = readEnv('OPENAI_WEBHOOK_SECRET') ?? null, workloadIdentity, x509Transport, ...opts } = clientOptions;
         if (provider) {
-            const conflictingOptions = ['apiKey', 'adminAPIKey', 'workloadIdentity', 'baseURL'].filter((key) => clientOptions[key] != null);
+            const conflictingOptions = ['apiKey', 'adminAPIKey', 'workloadIdentity', 'x509Transport', 'baseURL', 'dataResidency'].filter((key) => (key === 'workloadIdentity' ? workloadIdentity : clientOptions[key]) != null);
             if (conflictingOptions.length) {
                 throw new Errors.OpenAIError(`The \`provider\` option cannot be used with ${conflictingOptions
                     .map((key) => `\`${key}\``)
                     .join(', ')}. Configure authentication and the base URL through the provider instead.`);
             }
         }
-        const { baseURL = provider ? null : readEnv('OPENAI_BASE_URL'), apiKey = provider ? null : (readEnv('OPENAI_API_KEY') ?? null), adminAPIKey = provider ? null : (readEnv('OPENAI_ADMIN_KEY') ?? null), organization = provider ? null : (readEnv('OPENAI_ORG_ID') ?? null), project = provider ? null : (readEnv('OPENAI_PROJECT_ID') ?? null), webhookSecret = readEnv('OPENAI_WEBHOOK_SECRET') ?? null, workloadIdentity, ...opts } = clientOptions;
+        const identity = isX509WorkloadIdentity(workloadIdentity)
+            ? { x509: workloadIdentity, legacy: undefined }
+            : { x509: undefined, legacy: workloadIdentity };
+        const x509Identity = identity.x509;
+        const usesX509Identity = x509Identity !== undefined;
         const providerRuntime = provider ? configureProvider(provider) : undefined;
         const options = {
             apiKey,
@@ -166,10 +180,30 @@ export class OpenAI {
             project,
             webhookSecret,
             workloadIdentity,
+            x509Transport,
             provider,
             ...opts,
-            baseURL: providerRuntime?.baseURL ?? (baseURL || `https://api.openai.com/v1`),
+            baseURL: providerRuntime?.baseURL ??
+                residencyBaseURL ??
+                (baseURL || (usesX509Identity ? X509_API_BASE_URL : `https://api.openai.com/v1`)),
         };
+        if (x509Transport && !usesX509Identity) {
+            throw new Errors.OpenAIError('An X.509 transport requires an X.509 workload identity.');
+        }
+        if (usesX509Identity) {
+            if (residencyBaseURL !== undefined || inheritedResidencySelection) {
+                throw new Errors.OpenAIError('X.509 workload identity does not support data residency selection.');
+            }
+            if (clientOptions.fetch !== undefined) {
+                throw new Errors.OpenAIError('X.509 workload identity does not support a custom fetch implementation.');
+            }
+            assertX509APIOrigin(options.baseURL);
+            assertX509RequestOptions(options.fetchOptions);
+            if (this.fetchWithAuth !== _a.prototype.fetchWithAuth ||
+                this.fetchWithTimeout !== _a.prototype.fetchWithTimeout) {
+                throw new Errors.OpenAIError('X.509 workload identity does not support overridden fetch dispatch hooks.');
+            }
+        }
         if (apiKey && workloadIdentity) {
             throw new Errors.OpenAIError('The `apiKey` and `workloadIdentity` options are mutually exclusive');
         }
@@ -180,6 +214,7 @@ export class OpenAI {
             throw new Errors.OpenAIError("It looks like you're running in a browser-like environment.\n\nThis is disabled by default, as it risks exposing your secret API credentials to attackers.\nIf you understand the risks and have appropriate mitigations in place,\nyou can set the `dangerouslyAllowBrowser` option to `true`, e.g.,\n\nnew OpenAI({ apiKey, dangerouslyAllowBrowser: true });\n\nhttps://help.openai.com/en/articles/5112595-best-practices-for-api-key-safety\n");
         }
         this.baseURL = options.baseURL;
+        __classPrivateFieldSet(this, _OpenAI_explicitDataResidency, residencyBaseURL !== undefined || inheritedResidencySelection, "f");
         this.timeout = options.timeout ?? _a.DEFAULT_TIMEOUT; /* 10 minutes */
         this.logger = options.logger ?? console;
         const defaultLogLevel = 'warn';
@@ -206,8 +241,16 @@ export class OpenAI {
         }
         this._options = options;
         this._provider = providerRuntime;
-        if (workloadIdentity) {
-            this._workloadIdentityAuth = new WorkloadIdentityAuth(workloadIdentity, this.fetch);
+        if (x509Identity) {
+            const authentication = new X509WorkloadIdentityAuth(x509Identity, x509Transport, organization, project);
+            this._workloadIdentityAuth = authentication;
+            __classPrivateFieldSet(this, _OpenAI_x509Authentication, authentication, "f");
+            __classPrivateFieldSet(this, _OpenAI_x509Fetch, authentication.fetch(), "f");
+            this.fetch = __classPrivateFieldGet(this, _OpenAI_x509Fetch, "f");
+            markApprovedX509Client(this);
+        }
+        else if (identity.legacy) {
+            this._workloadIdentityAuth = new WorkloadIdentityAuth(identity.legacy, this.fetch);
         }
         this.apiKey = typeof apiKey === 'string' ? apiKey : null;
         this.adminAPIKey = adminAPIKey;
@@ -219,8 +262,10 @@ export class OpenAI {
      * Create a new client instance re-using the same options given to the current client with optional overriding.
      */
     withOptions(options) {
+        const residencyBaseURL = resolveDataResidency(options);
         const inheritedProvider = this._options.provider;
         const provider = options.provider ?? inheritedProvider;
+        const x509Authentication = __classPrivateFieldGet(this, _OpenAI_x509Authentication, "f");
         const inheritedOptions = {
             ...this._options,
             baseURL: this.baseURL,
@@ -228,19 +273,39 @@ export class OpenAI {
             timeout: this.timeout,
             logger: this.logger,
             logLevel: this.logLevel,
-            fetch: this.fetch,
+            fetch: __classPrivateFieldGet(this, _OpenAI_x509Authentication, "f") ? undefined : this.fetch,
             fetchOptions: this.fetchOptions,
             apiKey: this._options.apiKey,
             adminAPIKey: this.adminAPIKey,
-            workloadIdentity: this._options.workloadIdentity,
+            workloadIdentity: x509Authentication?.identitySnapshot() ?? this._options.workloadIdentity,
+            x509Transport: this._options.x509Transport,
             organization: this.organization,
             project: this.project,
             webhookSecret: this.webhookSecret,
         };
+        const currentlyX509 = x509Authentication !== undefined;
+        const nextIdentity = hasOwn(options, 'workloadIdentity')
+            ? options.workloadIdentity
+            : inheritedOptions.workloadIdentity;
+        const nextX509 = isX509WorkloadIdentity(nextIdentity);
+        if (currentlyX509 !== nextX509) {
+            delete inheritedOptions.fetch;
+            delete inheritedOptions.baseURL;
+            if (nextX509) {
+                inheritedOptions.apiKey = null;
+            }
+            else {
+                delete inheritedOptions.x509Transport;
+            }
+        }
+        if (residencyBaseURL !== undefined) {
+            delete inheritedOptions.baseURL;
+        }
         if (provider) {
             delete inheritedOptions.apiKey;
             delete inheritedOptions.adminAPIKey;
             delete inheritedOptions.workloadIdentity;
+            delete inheritedOptions.x509Transport;
             delete inheritedOptions.baseURL;
             if (provider !== inheritedProvider) {
                 delete inheritedOptions.organization;
@@ -248,11 +313,24 @@ export class OpenAI {
                 delete inheritedOptions.defaultHeaders;
             }
         }
-        const client = new this.constructor({
+        const clientOptions = {
             ...inheritedOptions,
             ...options,
             provider,
-        });
+            [inheritedDataResidencySelection]: __classPrivateFieldGet(this, _OpenAI_explicitDataResidency, "f") &&
+                residencyBaseURL === undefined &&
+                !hasOwn(options, 'baseURL') &&
+                !provider,
+        };
+        const client = new this.constructor(clientOptions);
+        if (__classPrivateFieldGet(this, _OpenAI_x509Authentication, "f") &&
+            __classPrivateFieldGet(client, _OpenAI_x509Authentication, "f") &&
+            this.baseURL === client.baseURL &&
+            __classPrivateFieldGet(this, _OpenAI_x509Authentication, "f").matches(__classPrivateFieldGet(client, _OpenAI_x509Authentication, "f"))) {
+            client._workloadIdentityAuth = __classPrivateFieldGet(this, _OpenAI_x509Authentication, "f");
+            __classPrivateFieldSet(client, _OpenAI_x509Authentication, __classPrivateFieldGet(this, _OpenAI_x509Authentication, "f"), "f");
+            __classPrivateFieldSet(client, _OpenAI_x509Fetch, __classPrivateFieldGet(this, _OpenAI_x509Fetch, "f"), "f");
+        }
         return client;
     }
     defaultQuery() {
@@ -277,14 +355,41 @@ export class OpenAI {
         bearerAuth: true,
         adminAPIKeyAuth: true,
     }) {
+        const authentication = __classPrivateFieldGet(this, _OpenAI_x509Authentication, "f") ?? this._workloadIdentityAuth;
+        if (authentication instanceof X509WorkloadIdentityAuth &&
+            schemes.adminAPIKeyAuth &&
+            this.adminAPIKey !== null) {
+            return await this.adminAPIKeyAuth(opts);
+        }
         return buildHeaders([
             schemes.bearerAuth ? await this.bearerAuth(opts) : null,
             schemes.adminAPIKeyAuth ? await this.adminAPIKeyAuth(opts) : null,
         ]);
     }
     async bearerAuth(opts) {
-        if (this._workloadIdentityAuth) {
-            return buildHeaders([{ Authorization: `Bearer ${await this._workloadIdentityAuth.getToken()}` }]);
+        const authentication = __classPrivateFieldGet(this, _OpenAI_x509Authentication, "f") ?? this._workloadIdentityAuth;
+        if (authentication) {
+            if (authentication instanceof X509WorkloadIdentityAuth) {
+                if (authentication === this._workloadIdentityAuth &&
+                    (this.fetchWithAuth !== _a.prototype.fetchWithAuth ||
+                        this.fetchWithTimeout !== _a.prototype.fetchWithTimeout)) {
+                    throw new Errors.OpenAIError('X.509 workload identity does not support overridden fetch dispatch hooks.');
+                }
+                const snapshots = authentication.headerSnapshots();
+                if (!X509WorkloadIdentityAuth.shouldAuthenticate(opts, snapshots.defaultHeaders, snapshots.requestHeaders)) {
+                    return undefined;
+                }
+            }
+            const token = authentication instanceof X509WorkloadIdentityAuth
+                ? await authentication.getToken(opts, {
+                    apiURL: authentication.requestAPIURL(),
+                    ...authentication.headerSnapshots(),
+                    ...authentication.requestSnapshot(),
+                    signal: authentication.effectiveSignal(),
+                    ...authentication.tenantSnapshot(),
+                })
+                : await authentication.getToken();
+            return buildHeaders([{ Authorization: `Bearer ${token}` }]);
         }
         if (this.apiKey == null) {
             return undefined;
@@ -387,10 +492,17 @@ export class OpenAI {
         }));
     }
     request(options, remainingRetries = null) {
-        return this.responsePromise(this.makeRequest(options, remainingRetries, undefined));
+        const authentication = __classPrivateFieldGet(this, _OpenAI_x509Authentication, "f") ?? this._workloadIdentityAuth;
+        const request = authentication instanceof X509WorkloadIdentityAuth
+            ? Promise.resolve(options).then((resolved) => authentication.runRequest(() => this.makeRequest(resolved, remainingRetries, undefined), this))
+            : this.makeRequest(options, remainingRetries, undefined);
+        return this.responsePromise(request);
     }
     responsePromise(request, parse = (client, props) => this.parseResponseWithTimeout(client, props)) {
-        const promise = new APIPromise(this, request, parse);
+        const promise = new APIPromise(this, request, (client, props) => {
+            const resume = __classPrivateFieldGet(this, _OpenAI_responseAttempts, "f").get(props.controller)?.continueRequest;
+            return resume ? resume(() => parse(client, props)) : parse(client, props);
+        });
         // A body timeout can retry after the original raw response has arrived. Wait for
         // parsing before selecting the response so withResponse() reports the retry.
         promise.withResponse = async () => {
@@ -411,15 +523,30 @@ export class OpenAI {
         while (true) {
             const attempt = __classPrivateFieldGet(this, _OpenAI_responseAttempts, "f").get(props.controller);
             const timeout = attempt?.timeout ?? props.options.timeout ?? this.timeout;
-            const remaining = Math.max(0, props.startTime + timeout - Date.now());
-            const callerSignal = props.options.signal;
+            const x509Authentication = attempt?.authentication;
+            const callerSignal = x509Authentication ? props.controller.signal : props.options.signal;
+            const abortError = () => x509Authentication && callerSignal
+                ? this._makeUserAbortError(callerSignal)
+                : new Errors.APIUserAbortError();
+            let remaining;
+            try {
+                remaining =
+                    x509Authentication?.remainingTimeout(props.options, timeout) ??
+                        Math.max(0, props.startTime + timeout - Date.now());
+            }
+            catch (error) {
+                const cancellation = callerSignal?.aborted ? abortError() : undefined;
+                props.controller.abort();
+                void Shims.CancelReadableStream(props.response.body).catch(() => undefined);
+                throw cancellation ?? error;
+            }
             let timer;
             let abortListener;
             let timedOut = false;
             try {
                 // Tool runners preserve a completed buffered turn before cancellation stops the next request.
-                if (callerSignal?.aborted && props.options.__metadata?.['helperMethod'] !== 'runTools') {
-                    throw new Errors.APIUserAbortError();
+                if (callerSignal?.aborted && attempt?.helperMethod !== 'runTools') {
+                    throw abortError();
                 }
                 const timeoutPromise = new Promise((_, reject) => {
                     timer = setTimeout(() => {
@@ -428,21 +555,33 @@ export class OpenAI {
                         reject(new Errors.APIConnectionTimeoutError());
                     }, remaining);
                     if (callerSignal) {
-                        abortListener = () => reject(new Errors.APIUserAbortError());
+                        abortListener = () => {
+                            if (!timedOut)
+                                reject(abortError());
+                        };
                         callerSignal.addEventListener('abort', abortListener, { once: true });
                     }
                 });
                 return await Promise.race([defaultParseResponse(client, props), timeoutPromise]);
             }
             catch (error) {
-                if (callerSignal?.aborted) {
-                    throw new Errors.APIUserAbortError();
+                if (callerSignal?.aborted && !timedOut) {
+                    throw abortError();
                 }
                 if (!timedOut) {
+                    if (x509Authentication && error instanceof SyntaxError) {
+                        throw new SyntaxError('X.509 workload identity API response contains invalid JSON.');
+                    }
+                    if (x509Authentication && !(error instanceof Errors.OpenAIError)) {
+                        throw new Errors.APIConnectionError({
+                            message: 'X.509 workload identity API response body could not be read.',
+                        });
+                    }
                     throw error;
                 }
                 const retriesRemaining = attempt?.retriesRemaining ?? 0;
                 if (!retriesRemaining ||
+                    attempt?.hasStreamingBody ||
                     props.options.__metadata?.['hasStreamingBody'] ||
                     (globalThis.ReadableStream &&
                         props.options.body instanceof globalThis.ReadableStream) ||
@@ -470,6 +609,46 @@ export class OpenAI {
             }
         }
     }
+    /** Keeps terminal X.509 error-body consumption inside the original logical request deadline. */
+    async readX509ResponseError(response, options, timeout, controller, authentication) {
+        const deadline = new AbortController();
+        const callerSignal = controller.signal;
+        let timedOut = false;
+        const cancel = () => deadline.abort(callerSignal.reason);
+        callerSignal.addEventListener('abort', cancel, { once: true });
+        if (callerSignal.aborted) {
+            cancel();
+        }
+        try {
+            const remaining = authentication.remainingTimeout(options, timeout);
+            const expiration = authentication.waitForRetry(remaining, deadline.signal).then(() => {
+                throw new Errors.APIConnectionTimeoutError();
+            });
+            const body = await Promise.race([
+                response.text().catch(() => 'X.509 workload identity API response body could not be read.'),
+                expiration,
+            ]);
+            if (callerSignal.aborted) {
+                throw this._makeUserAbortError(callerSignal);
+            }
+            return body;
+        }
+        catch (error) {
+            if (error instanceof Errors.APIConnectionTimeoutError) {
+                timedOut = !callerSignal.aborted;
+                controller.abort();
+                void Shims.CancelReadableStream(response.body).catch(() => undefined);
+            }
+            if (callerSignal.aborted && !timedOut) {
+                throw this._makeUserAbortError(callerSignal);
+            }
+            throw error;
+        }
+        finally {
+            callerSignal.removeEventListener('abort', cancel);
+            deadline.abort();
+        }
+    }
     async makeRequest(optionsInput, retriesRemaining, retryOfRequestLogID) {
         const options = await optionsInput;
         const maxRetries = options.maxRetries ?? this.maxRetries;
@@ -477,37 +656,102 @@ export class OpenAI {
             retriesRemaining = maxRetries;
         }
         await this.prepareOptions(options);
-        const { req, url, timeout } = await this.buildRequest(options, {
-            retryCount: maxRetries - retriesRemaining,
-        });
-        const hasStreamingBody = options.__metadata?.['hasStreamingBody'] === true;
-        await this.prepareRequest(req, { url, options });
-        await this._provider?.prepareRequest?.(req, { url, options });
+        const x509Authentication = __classPrivateFieldGet(this, _OpenAI_x509Authentication, "f");
+        x509Authentication?.beginRequestPlanning();
+        let built;
+        try {
+            const candidate = await this.buildRequest(options, {
+                retryCount: maxRetries - retriesRemaining,
+            });
+            built = { req: candidate.req, url: candidate.url, timeout: candidate.timeout };
+            if (x509Authentication) {
+                validatePositiveInteger('timeout', built.timeout);
+                x509Authentication.authorizePlannedRequest(built.url, built.req, built.timeout);
+                if (X509WorkloadIdentityAuth.isStreamingRequestBody(built.req.body)) {
+                    options.__metadata = { ...options.__metadata, hasStreamingBody: true };
+                }
+                await this.prepareRequest(built.req, { url: built.url, options });
+                await this._provider?.prepareRequest?.(built.req, { url: built.url, options });
+                x509Authentication.beginRequestPlanning();
+                x509Authentication.authorizePlannedRequest(built.url, built.req, built.timeout, true);
+                if (X509WorkloadIdentityAuth.isStreamingRequestBody(built.req.body)) {
+                    options.__metadata = { ...options.__metadata, hasStreamingBody: true };
+                }
+                const callerSignal = x509Authentication.requestSnapshot().signal;
+                if (callerSignal?.aborted || built.req.signal?.aborted) {
+                    throw this._makeUserAbortError(callerSignal?.aborted ? callerSignal : built.req.signal);
+                }
+                x509Authentication.setEffectiveSignal(built.req.signal || callerSignal
+                    ? createRequestController(built.req.signal ?? callerSignal, callerSignal).signal
+                    : undefined);
+                x509Authentication.beginRequestNetwork();
+                const security = options.__security ?? { bearerAuth: true };
+                const authenticationHeaders = await this.authHeaders(options, security);
+                const suppliedHeaders = x509Authentication.headerSnapshots();
+                const supplied = buildHeaders([suppliedHeaders.defaultHeaders, suppliedHeaders.requestHeaders]);
+                for (const [name, value] of authenticationHeaders?.values ?? []) {
+                    if (!supplied.nulls.has(name) && !built.req.headers.has(name)) {
+                        built.req.headers.set(name, value);
+                    }
+                }
+                this.validateHeaders(buildHeaders([supplied, built.req.headers]), security);
+            }
+        }
+        catch (error) {
+            x509Authentication?.retireRequestBody();
+            if (x509Authentication &&
+                retriesRemaining &&
+                !options.__metadata?.['hasStreamingBody'] &&
+                X509WorkloadIdentityAuth.isRetryableFailure(error)) {
+                return await this.retryRequest(options, retriesRemaining, retryOfRequestLogID ?? 'x509-token-exchange', X509WorkloadIdentityAuth.retryHeaders(error));
+            }
+            throw error;
+        }
+        const { req, url } = built;
+        const timeout = x509Authentication
+            ? Math.min(built.timeout, x509Authentication.requestSnapshot().timeout)
+            : built.timeout;
+        x509Authentication?.bindRequest(options, req, this.adminAPIKey);
+        let hasStreamingBody = options.__metadata?.['hasStreamingBody'] === true;
+        if (!x509Authentication) {
+            await this.prepareRequest(req, { url, options });
+            await this._provider?.prepareRequest?.(req, { url, options });
+        }
+        x509Authentication?.adoptRequestHeaders(req);
+        if (x509Authentication && X509WorkloadIdentityAuth.isStreamingRequestBody(req.body)) {
+            hasStreamingBody = true;
+        }
         /** Not an API request ID, just for correlating local log entries. */
         const requestLogID = 'log_' + ((Math.random() * (1 << 24)) | 0).toString(16).padStart(6, '0');
         const retryLogStr = retryOfRequestLogID === undefined ? '' : `, retryOf: ${retryOfRequestLogID}`;
-        const startTime = Date.now();
+        const startTime = x509Authentication?.requestStartedAt(options) ?? Date.now();
         loggerFor(this).debug(`[${requestLogID}] sending request`, formatRequestDetails({
             retryOfRequestLogID,
             method: options.method,
             url,
-            options,
+            options: x509Authentication ? { body: req.body, ...x509Authentication.requestSnapshot() } : options,
             headers: req.headers,
         }));
-        if (options.signal?.aborted || req.signal?.aborted) {
-            throw this._makeUserAbortError(options.signal?.aborted ? options.signal : req.signal);
+        const callerSignal = x509Authentication ? x509Authentication.requestSnapshot().signal : options.signal;
+        if (callerSignal?.aborted || req.signal?.aborted) {
+            throw this._makeUserAbortError(callerSignal?.aborted ? callerSignal : req.signal);
         }
         const security = options.__security ?? { bearerAuth: true };
         // Request hooks may replace the caller signal before it reaches fetch.
-        const controller = this.fetchWithTimeout === _a.prototype.fetchWithTimeout
-            ? createRequestController(req.signal)
+        const controller = x509Authentication || this.fetchWithTimeout === _a.prototype.fetchWithTimeout
+            ? createRequestController(req.signal ?? (x509Authentication ? callerSignal : undefined), x509Authentication ? callerSignal : undefined)
             : new AbortController();
-        const response = await this.fetchWithAuth(url, req, timeout, controller, security).catch(castToError);
+        const remainingTimeout = x509Authentication?.remainingTimeout(options, timeout) ?? timeout;
+        const fetchWithAuth = x509Authentication ? _a.prototype.fetchWithAuth : this.fetchWithAuth;
+        x509Authentication?.releaseRequestBody(req.body);
+        const response = await fetchWithAuth
+            .call(this, url, req, remainingTimeout, controller, security)
+            .catch(castToError);
         const headersTime = Date.now();
         if (response instanceof globalThis.Error) {
             const retryMessage = `retrying, ${retriesRemaining} attempts remaining`;
-            if (options.signal?.aborted || req.signal?.aborted) {
-                throw this._makeUserAbortError(options.signal?.aborted ? options.signal : req.signal);
+            if (callerSignal?.aborted || req.signal?.aborted) {
+                throw this._makeUserAbortError(callerSignal?.aborted ? callerSignal : req.signal);
             }
             // detect native connection timeout errors
             // deno throws "TypeError: error sending request for url (https://example/): client error (Connect): tcp connect error: Operation timed out (os error 60): Operation timed out (os error 60)"
@@ -515,13 +759,15 @@ export class OpenAI {
             // others do not provide enough information to distinguish timeouts from other connection errors
             const isTimeout = isAbortError(response) ||
                 /timed? ?out/i.test(String(response) + ('cause' in response ? String(response.cause) : ''));
-            if (retriesRemaining && !hasStreamingBody) {
+            if (retriesRemaining &&
+                !hasStreamingBody &&
+                (!x509Authentication || isTransientX509ConnectionError(response))) {
                 loggerFor(this).info(`[${requestLogID}] connection ${isTimeout ? 'timed out' : 'failed'} - ${retryMessage}`);
                 loggerFor(this).debug(`[${requestLogID}] connection ${isTimeout ? 'timed out' : 'failed'} (${retryMessage})`, formatRequestDetails({
                     retryOfRequestLogID,
                     url,
                     durationMs: headersTime - startTime,
-                    message: response.message,
+                    message: x509Authentication ? 'X.509 workload identity API connection failed.' : response.message,
                 }));
                 return this.retryRequest(options, retriesRemaining, retryOfRequestLogID ?? requestLogID);
             }
@@ -533,7 +779,7 @@ export class OpenAI {
                 retryOfRequestLogID,
                 url,
                 durationMs: headersTime - startTime,
-                message: response.message,
+                message: x509Authentication ? 'X.509 workload identity API connection failed.' : response.message,
             }));
             if (response instanceof OAuthError || response instanceof SubjectTokenProviderError) {
                 throw response;
@@ -550,8 +796,14 @@ export class OpenAI {
                             'configure a matching undici fetch and fetchOptions.dispatcher with an Agent whose headersTimeout is at least the SDK timeout.',
                     })
                     : new Errors.APIConnectionTimeoutError();
+                if (x509Authentication) {
+                    throw new Errors.APIConnectionTimeoutError();
+                }
                 throw Object.assign(timeoutError, { cause: response });
             }
+            if (x509Authentication) {
+                throw new Errors.APIConnectionError({ message: 'X.509 workload identity API connection failed.' });
+            }
             throw new Errors.APIConnectionError({
                 message: getConnectionErrorMessage(response),
                 cause: response,
@@ -563,26 +815,48 @@ export class OpenAI {
             .join('');
         const responseInfo = `[${requestLogID}${retryLogStr}${specialHeaders}] ${req.method} ${url} ${response.ok ? 'succeeded' : 'failed'} with status ${response.status} in ${headersTime - startTime}ms`;
         if (!response.ok) {
+            const rejectedX509Credential = response.status === 401 &&
+                x509Authentication &&
+                security.bearerAuth &&
+                x509Authentication.usedWorkloadToken(options);
+            if (rejectedX509Credential) {
+                x509Authentication.invalidateToken();
+            }
             if (response.status === 401 &&
-                this._workloadIdentityAuth &&
+                (x509Authentication || this._workloadIdentityAuth) &&
                 security.bearerAuth &&
-                !options.__metadata?.['hasStreamingBody'] &&
+                (!x509Authentication || x509Authentication.usedWorkloadToken(options)) &&
+                (!x509Authentication || retriesRemaining > 0) &&
+                !hasStreamingBody &&
                 !options.__metadata?.['workloadIdentityTokenRefreshed']) {
-                await Shims.CancelReadableStream(response.body);
-                this._workloadIdentityAuth.invalidateToken();
-                return this.makeRequest({
+                if (x509Authentication) {
+                    void Shims.CancelReadableStream(response.body).catch(() => undefined);
+                }
+                else {
+                    await Shims.CancelReadableStream(response.body);
+                    this._workloadIdentityAuth?.invalidateToken();
+                }
+                const replayOptions = {
                     ...options,
                     __metadata: {
                         ...options.__metadata,
                         workloadIdentityTokenRefreshed: true,
                     },
-                }, retriesRemaining, retryOfRequestLogID ?? requestLogID);
+                };
+                return this.makeRequest(replayOptions, x509Authentication ? retriesRemaining - 1 : retriesRemaining, retryOfRequestLogID ?? requestLogID);
             }
-            const shouldRetry = await this.shouldRetry(response);
+            const shouldRetry = rejectedX509Credential && options.__metadata?.['workloadIdentityTokenRefreshed']
+                ? false
+                : await this.shouldRetry(response);
             if (retriesRemaining && shouldRetry && !hasStreamingBody) {
                 const retryMessage = `retrying, ${retriesRemaining} attempts remaining`;
                 // We don't need the body of this response.
-                await Shims.CancelReadableStream(response.body);
+                if (x509Authentication) {
+                    void Shims.CancelReadableStream(response.body).catch(() => undefined);
+                }
+                else {
+                    await Shims.CancelReadableStream(response.body);
+                }
                 loggerFor(this).info(`${responseInfo} - ${retryMessage}`);
                 loggerFor(this).debug(`[${requestLogID}] response error (${retryMessage})`, formatRequestDetails({
                     retryOfRequestLogID,
@@ -599,7 +873,9 @@ export class OpenAI {
                     : `error; no more retries left`
                 : `error; not retryable`;
             loggerFor(this).info(`${responseInfo} - ${retryMessage}`);
-            const errText = await response.text().catch((err) => castToError(err).message);
+            const errText = x509Authentication
+                ? await this.readX509ResponseError(response, options, timeout, controller, x509Authentication)
+                : await response.text().catch((err) => castToError(err).message);
             const errJSON = safeJSON(errText);
             const errMessage = errJSON ? undefined : errText;
             loggerFor(this).debug(`[${requestLogID}] response error (${retryMessage})`, formatRequestDetails({
@@ -621,7 +897,16 @@ export class OpenAI {
             headers: response.headers,
             durationMs: headersTime - startTime,
         }));
-        __classPrivateFieldGet(this, _OpenAI_responseAttempts, "f").set(controller, { timeout, retriesRemaining });
+        const continueRequest = x509Authentication?.continuation();
+        x509Authentication?.releaseRequestCredentials();
+        __classPrivateFieldGet(this, _OpenAI_responseAttempts, "f").set(controller, {
+            timeout,
+            retriesRemaining,
+            hasStreamingBody,
+            ...(x509Authentication ? { authentication: x509Authentication } : {}),
+            helperMethod: options.__metadata?.['helperMethod'],
+            ...(continueRequest ? { continueRequest } : {}),
+        });
         return { response, options, controller, requestLogID, retryOfRequestLogID, startTime };
     }
     getAPIList(path, Page, opts) {
@@ -630,7 +915,10 @@ export class OpenAI {
             : { method: 'get', path, ...opts });
     }
     requestAPIList(Page, options) {
-        const request = this.makeRequest(options, null, undefined);
+        const authentication = __classPrivateFieldGet(this, _OpenAI_x509Authentication, "f") ?? this._workloadIdentityAuth;
+        const request = authentication instanceof X509WorkloadIdentityAuth
+            ? Promise.resolve(options).then((resolved) => authentication.runRequest(() => this.makeRequest(resolved, null, undefined), this))
+            : this.makeRequest(options, null, undefined);
         const page = new Pagination.PagePromise(this, request, Page);
         const guarded = this.responsePromise(request, async (client, props) => {
             const body = await this.parseResponseWithTimeout(client, props);
@@ -647,7 +935,7 @@ export class OpenAI {
         bearerAuth: true,
         adminAPIKeyAuth: true,
     }) {
-        if (this._workloadIdentityAuth && schemes.bearerAuth) {
+        if (this._workloadIdentityAuth && !__classPrivateFieldGet(this, _OpenAI_x509Fetch, "f") && schemes.bearerAuth) {
             const headers = init.headers;
             const authHeader = headers.get('Authorization');
             if (!authHeader || authHeader === `Bearer ${WORKLOAD_IDENTITY_API_KEY_PLACEHOLDER}`) {
@@ -655,7 +943,8 @@ export class OpenAI {
                 headers.set('Authorization', `Bearer ${token}`);
             }
         }
-        const response = await this.fetchWithTimeout(url, init, timeout, controller);
+        const fetchWithTimeout = __classPrivateFieldGet(this, _OpenAI_x509Fetch, "f") ? _a.prototype.fetchWithTimeout : this.fetchWithTimeout;
+        const response = await fetchWithTimeout.call(this, url, init, timeout, controller);
         return response;
     }
     async fetchWithTimeout(url, init, ms, controller) {
@@ -680,7 +969,7 @@ export class OpenAI {
         }
         try {
             // use undefined this binding; fetch errors if bound to something else in browser/cloudflare
-            return await this.fetch.call(undefined, url, fetchOptions);
+            return await (__classPrivateFieldGet(this, _OpenAI_x509Fetch, "f") ?? this.fetch).call(undefined, url, fetchOptions);
         }
         catch (err) {
             if (signal && !composed)
@@ -743,7 +1032,19 @@ export class OpenAI {
             const maxRetries = options.maxRetries ?? this.maxRetries;
             timeoutMillis = this.calculateDefaultRetryTimeoutMillis(retriesRemaining, maxRetries);
         }
-        await sleep(timeoutMillis);
+        const x509Authentication = __classPrivateFieldGet(this, _OpenAI_x509Authentication, "f");
+        if (x509Authentication) {
+            const remaining = x509Authentication.remainingTimeout(options, x509Authentication.requestSnapshot().timeout);
+            if (timeoutMillis >= remaining) {
+                throw new Errors.APIConnectionTimeoutError();
+            }
+        }
+        if (x509Authentication) {
+            await x509Authentication.waitForRetry(timeoutMillis, x509Authentication.effectiveSignal());
+        }
+        else {
+            await sleep(timeoutMillis);
+        }
         return this.makeRequest(options, retriesRemaining - 1, requestLogID);
     }
     calculateDefaultRetryTimeoutMillis(retriesRemaining, maxRetries) {
@@ -757,20 +1058,64 @@ export class OpenAI {
         return sleepSeconds * jitter * 1000;
     }
     async buildRequest(inputOptions, { retryCount = 0 } = {}) {
+        if (__classPrivateFieldGet(this, _OpenAI_x509Authentication, "f") && !__classPrivateFieldGet(this, _OpenAI_x509Authentication, "f").inRequest(this)) {
+            const authentication = __classPrivateFieldGet(this, _OpenAI_x509Authentication, "f");
+            return await authentication.runRequest(async () => {
+                const built = await _a.prototype.buildRequest.call(this, inputOptions, { retryCount });
+                authentication.releaseRequestBody(built.req.body);
+                return built;
+            }, this);
+        }
         const options = { ...inputOptions };
+        const x509Authentication = __classPrivateFieldGet(this, _OpenAI_x509Authentication, "f");
+        const x509Tenant = x509Authentication?.snapshotTenant(this.organization, this.project);
+        const x509Headers = x509Authentication?.snapshotHeaders(this._options.defaultHeaders, options.headers);
+        if (x509Headers) {
+            options.headers = x509Headers.requestHeaders;
+        }
+        const x509ClientFetchOptions = x509Authentication
+            ? snapshotX509RequestOptions(this.fetchOptions)
+            : undefined;
+        const x509RequestFetchOptions = x509Authentication
+            ? snapshotX509RequestOptions(options.fetchOptions)
+            : undefined;
         const { method, path, query, defaultBaseURL } = options;
         const url = this.buildURL(path, query, defaultBaseURL);
-        if ('timeout' in options)
+        x509Authentication?.snapshotAPIURL(url);
+        const explicitTimeout = 'timeout' in options;
+        if (explicitTimeout)
             validatePositiveInteger('timeout', options.timeout);
         options.timeout = options.timeout ?? this.timeout;
+        if (x509Authentication && x509RequestFetchOptions) {
+            x509Authentication.snapshotRequest(options.signal, options.timeout, x509RequestFetchOptions);
+        }
+        if (x509Authentication) {
+            const snapshot = x509Authentication.requestSnapshot();
+            options.timeout = snapshot.timeout;
+            if (snapshot.signal === undefined) {
+                delete options.signal;
+            }
+            else {
+                options.signal = snapshot.signal;
+            }
+        }
         const { bodyHeaders, body, isStreamingBody } = this.buildBody({ options });
         if (isStreamingBody) {
             inputOptions.__metadata = {
                 ...inputOptions.__metadata,
                 hasStreamingBody: true,
             };
+            x509Authentication?.ownRequestBody(body, options.body);
         }
-        const reqHeaders = await this.buildHeaders({ options: inputOptions, method, bodyHeaders, retryCount });
+        const reqHeaders = await this.buildHeaders({
+            options: inputOptions,
+            method,
+            bodyHeaders,
+            retryCount,
+            x509Headers,
+            x509Timeout: explicitTimeout ? options.timeout : undefined,
+            x509Tenant,
+        });
         const req = {
             method,
             headers: reqHeaders,
@@ -778,12 +1123,12 @@ export class OpenAI {
             ...(globalThis.ReadableStream &&
                 body instanceof globalThis.ReadableStream && { duplex: 'half' }),
             ...(body && { body }),
-            ...(this.fetchOptions ?? {}),
-            ...(options.fetchOptions ?? {}),
+            ...((x509Authentication ? x509ClientFetchOptions : this.fetchOptions) ?? {}),
+            ...((x509Authentication ? x509RequestFetchOptions : options.fetchOptions) ?? {}),
         };
         return { req, url, timeout: options.timeout };
     }
-    async buildHeaders({ options, method, bodyHeaders, retryCount, }) {
+    async buildHeaders({ options, method, bodyHeaders, retryCount, x509Headers, x509Timeout, x509Tenant, }) {
         let idempotencyHeaders = {};
         if (this.idempotencyHeader && method !== 'get') {
             if (!options.idempotencyKey)
@@ -791,26 +1136,27 @@ export class OpenAI {
             idempotencyHeaders[this.idempotencyHeader] = options.idempotencyKey;
         }
         const helperMethod = options.__metadata?.['helperMethod'];
+        const timeout = x509Headers ? x509Timeout : options.timeout;
         const headers = buildHeaders([
             idempotencyHeaders,
             {
                 Accept: 'application/json',
                 ...(!isRunningInBrowserOrBrowserWorker() ? { 'User-Agent': this.getUserAgent() } : undefined),
                 'X-Stainless-Retry-Count': String(retryCount),
-                ...(options.timeout ? { 'X-Stainless-Timeout': String(Math.trunc(options.timeout / 1000)) } : {}),
+                ...(timeout ? { 'X-Stainless-Timeout': String(Math.trunc(timeout / 1000)) } : {}),
                 ...getPlatformHeaders(),
                 ...(typeof helperMethod === 'string' ? { 'X-Stainless-Helper-Method': helperMethod } : {}),
-                'OpenAI-Organization': this.organization,
-                'OpenAI-Project': this.project,
+                'OpenAI-Organization': x509Tenant ? x509Tenant.organization : this.organization,
+                'OpenAI-Project': x509Tenant ? x509Tenant.project : this.project,
             },
-            this._provider
+            this._provider || __classPrivateFieldGet(this, _OpenAI_x509Authentication, "f")?.isPlanningRequest()
                 ? undefined
                 : await this.authHeaders(options, options.__security ?? { bearerAuth: true }),
-            this._options.defaultHeaders,
+            x509Headers?.defaultHeaders ?? this._options.defaultHeaders,
             bodyHeaders,
-            options.headers,
+            x509Headers?.requestHeaders ?? options.headers,
         ]);
-        if (!this._provider) {
+        if (!this._provider && !__classPrivateFieldGet(this, _OpenAI_x509Authentication, "f")?.isPlanningRequest()) {
             this.validateHeaders(headers, options.__security ?? { bearerAuth: true });
         }
         return headers.values;
@@ -887,8 +1233,10 @@ export class OpenAI {
         }
     }
 }
-_a = OpenAI, _OpenAI_encoder = new WeakMap(), _OpenAI_responseAttempts = new WeakMap(), _OpenAI_instances = new WeakSet(), _OpenAI_baseURLOverridden = function _OpenAI_baseURLOverridden() {
-    return this._provider !== undefined || this.baseURL !== 'https://api.openai.com/v1';
+_a = OpenAI, _OpenAI_encoder = new WeakMap(), _OpenAI_x509Authentication = new WeakMap(), _OpenAI_x509Fetch = new WeakMap(), _OpenAI_explicitDataResidency = new WeakMap(), _OpenAI_responseAttempts = new WeakMap(), _OpenAI_instances = new WeakSet(), _OpenAI_baseURLOverridden = function _OpenAI_baseURLOverridden() {
+    return (__classPrivateFieldGet(this, _OpenAI_explicitDataResidency, "f") ||
+        this._provider !== undefined ||
+        this.baseURL !== 'https://api.openai.com/v1');
 };
 OpenAI.OpenAI = _a;
 OpenAI.DEFAULT_TIMEOUT = 600000; // 10 minutes
@@ -933,7 +1281,7 @@ OpenAI.Containers = Containers;
 OpenAI.Skills = Skills;
 OpenAI.Videos = Videos;
 const composedCallerSignals = new WeakMap();
-function createRequestController(callerSignal) {
+function createRequestController(callerSignal, originalSignal) {
     const controller = new AbortController();
     if (!callerSignal)
         return controller;
@@ -944,7 +1292,11 @@ function createRequestController(callerSignal) {
     try {
         // Native composition keeps cancellation active after response headers without
         // retaining an abort listener on the caller's signal or changing its reason.
-        const composed = nativeAbortSignal.any([controller.signal, callerSignal]);
+        const signals = [controller.signal, callerSignal];
+        if (originalSignal && originalSignal !== callerSignal) {
+            signals.push(originalSignal);
+        }
+        const composed = nativeAbortSignal.any(signals);
         Object.defineProperty(controller, 'signal', { value: composed, configurable: true });
         composedCallerSignals.set(controller, callerSignal);
     }