release: 6.45.0 (#1944)

* chore(internal): codegen related update

* fix: avoid serializing null optional bodies

* [codex] Add AWS-native authentication for Bedrock (#1938)

* [bedrock_sigv4_auth] Add AWS-native Bedrock authentication

* Add AWS-native Bedrock provider authentication

* Expand Bedrock authentication test coverage

* Fix provider conflict test types

* Align Bedrock auth options and endpoint

* Add opt-in Bedrock live test

* Keep confirmed Bedrock compatibility endpoint

* Use Responses-compatible Bedrock model in examples

* Address Bedrock review feedback

* Test Bedrock default credential chain

* fix Bedrock provider packaging

---------

Co-authored-by: Jim Blomo <jim@openai.com>

* release: 6.45.0

---------

Co-authored-by: stainless-app[bot] <142633134+stainless-app[bot]@users.noreply.github.com>
Co-authored-by: Alex Chang <apcha@openai.com>
Co-authored-by: Hayden <hayden@openai.com>
Co-authored-by: Jim Blomo <jim@openai.com>

Author: 4 people

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "6.44.0"
+  ".": "6.45.0"
 }

CHANGELOG.md

@@ -1,5 +1,53 @@
 # Changelog
 
+## 6.45.0 (2026-06-24)
+
+Full Changelog: [v6.44.0...v6.45.0](https://github.com/openai/openai-node/compare/v6.44.0...v6.45.0)
+
+### Features
+
+* add afterCompletion hook to runTools ([#1064](https://github.com/openai/openai-node/issues/1064)) ([4976c22](https://github.com/openai/openai-node/commit/4976c22bf608e4d5f70d6386cfe9c428cf8ff2c7))
+* **realtime:** support sideband call_id connections ([#1795](https://github.com/openai/openai-node/issues/1795)) ([4fd59e1](https://github.com/openai/openai-node/commit/4fd59e1be4ad478373cdcb4f185109af29067da8))
+* reject emitted promise on error in EventEmitter ([#1596](https://github.com/openai/openai-node/issues/1596)) ([e0b09da](https://github.com/openai/openai-node/commit/e0b09da782f0d6ce69a383fd3f3d02a0c7608d6d))
+* **responses:** add response input items helper ([#1794](https://github.com/openai/openai-node/issues/1794)) ([7e5a86a](https://github.com/openai/openai-node/commit/7e5a86a6162d76a7248fa983cb16a16c185a097a))
+* **responses:** add response stream accumulator helper ([#1793](https://github.com/openai/openai-node/issues/1793)) ([32e3e39](https://github.com/openai/openai-node/commit/32e3e39e1736659196aadd7d0bb8d6ca90f69168))
+
+
+### Bug Fixes
+
+* avoid serializing null optional bodies ([e4ddff6](https://github.com/openai/openai-node/commit/e4ddff6f2085b1c69eaa790e48d1a22d2dd9d7fb))
+* clean up stream abort listeners ([#1884](https://github.com/openai/openai-node/issues/1884)) ([be55b8f](https://github.com/openai/openai-node/commit/be55b8fb352be80d9d30dd263451615f4342d69f))
+* Leading whitespace chunks break partial parser (structured outputs) ([#1213](https://github.com/openai/openai-node/issues/1213)) ([88d806e](https://github.com/openai/openai-node/commit/88d806eb91f2b41ba4cac3ee69eb73656cab1849))
+* **responses:** avoid parsing incomplete structured output ([#1852](https://github.com/openai/openai-node/issues/1852)) ([4c39681](https://github.com/openai/openai-node/commit/4c396817cbc9586654fa7a376d55a29d8793995d))
+* **responses:** restore output_text on streamed final responses ([#1681](https://github.com/openai/openai-node/issues/1681)) ([bbde4d9](https://github.com/openai/openai-node/commit/bbde4d9e3bbceef5e14bcb71b3a7c36388dbab2b))
+* validate workload identity access tokens ([#1885](https://github.com/openai/openai-node/issues/1885)) ([80febe4](https://github.com/openai/openai-node/commit/80febe441c2dc2d110b412be022fe044bbae2cd9))
+* **zod:** fully resolve extracted wrapper definitions ([#1766](https://github.com/openai/openai-node/issues/1766)) ([5d46ed2](https://github.com/openai/openai-node/commit/5d46ed2012f73b18d6594c62b9fb6351bef76d3d))
+* **zod:** sanitize extracted definition refs ([#1903](https://github.com/openai/openai-node/issues/1903)) ([6ef2111](https://github.com/openai/openai-node/commit/6ef21116801bdaa8e9f25686a8bd365a270401bf))
+
+
+### Chores
+
+* **internal:** codegen related update ([81fcf96](https://github.com/openai/openai-node/commit/81fcf96fccca29dbcbf33bcb7578b98e06d7a6b0))
+
+
+### Documentation
+
+* add vision example using image URL ([#1571](https://github.com/openai/openai-node/issues/1571)) ([70966c9](https://github.com/openai/openai-node/commit/70966c922d0f65eb4711552cf5acb85c7842c2a9))
+* **azure:** add Responses API example ([#1675](https://github.com/openai/openai-node/issues/1675)) ([46453b0](https://github.com/openai/openai-node/commit/46453b06aa8682e5d37be810296bd2f96fe11096))
+* **azure:** use standard client for v1 chat ([#1692](https://github.com/openai/openai-node/issues/1692)) ([fba57e5](https://github.com/openai/openai-node/commit/fba57e577c484c579fbc12741aba6f7df2875eca))
+* clarify abort-on-function-call example ([#1843](https://github.com/openai/openai-node/issues/1843)) ([f21f248](https://github.com/openai/openai-node/commit/f21f24842827f514262bf3c0b5ba4c634585ce31))
+* clarify assistant stream event names ([#1860](https://github.com/openai/openai-node/issues/1860)) ([95fc6cd](https://github.com/openai/openai-node/commit/95fc6cd2d0790797eb62b62a0da45dd13de62c0e))
+* clarify supported zod schema features ([#1880](https://github.com/openai/openai-node/issues/1880)) ([ea93760](https://github.com/openai/openai-node/commit/ea93760643871960ad28cbb8654432f091902241))
+* fix helper example links ([#1890](https://github.com/openai/openai-node/issues/1890)) ([9c58f39](https://github.com/openai/openai-node/commit/9c58f399bd71201d4ff08d5192ca84608aba082b))
+* fix typos in tool calls stream example ([#1817](https://github.com/openai/openai-node/issues/1817)) ([8915ef0](https://github.com/openai/openai-node/commit/8915ef0d46ab47b03c561d87e4271b79bc569793))
+* **readme:** fix two typos and remove duplicate section ([#1733](https://github.com/openai/openai-node/issues/1733)) ([e2f8051](https://github.com/openai/openai-node/commit/e2f80517c01b25432371f7814c20221b3aed67d4))
+* **runner:** remove "the the" duplicate-word typo in JSDoc ([#1892](https://github.com/openai/openai-node/issues/1892)) ([52f075f](https://github.com/openai/openai-node/commit/52f075ff39c14a6114c74b73e9dfbc230445f681))
+
+
+### Build System
+
+* vendor tsc-multi build tool ([#1948](https://github.com/openai/openai-node/issues/1948)) ([7c35bcd](https://github.com/openai/openai-node/commit/7c35bcd186140f47a13f9e60e19e40a1994cbf5e))
+
 ## 6.44.0 (2026-06-17)
 
 Full Changelog: [v6.43.0...v6.44.0](https://github.com/openai/openai-node/compare/v6.43.0...v6.44.0)

README.md

@@ -521,13 +521,15 @@ For more information on support for the Azure API, see [azure.md](azure.md).
 
 ## Amazon Bedrock
 
-To use this library with [Amazon Bedrock's OpenAI-compatible API](https://docs.aws.amazon.com/bedrock/latest/userguide/models-api-compatibility.html), use the `BedrockOpenAI` class instead of the `OpenAI` class.
+To use this library with [Amazon Bedrock's OpenAI-compatible API](https://docs.aws.amazon.com/bedrock/latest/userguide/models-api-compatibility.html), configure the standard `OpenAI` client with the Bedrock provider:
 
 ```ts
-import { BedrockOpenAI } from 'openai';
+import OpenAI from 'openai';
+import { bedrock } from 'openai/providers/bedrock/aws';
 
-// gets the bearer token from AWS_BEARER_TOKEN_BEDROCK and the region from AWS_REGION/AWS_DEFAULT_REGION
-const client = new BedrockOpenAI();
+const client = new OpenAI({
+  provider: bedrock({ region: 'us-west-2' }),
+});
 
 const response = await client.responses.create({
   model: 'openai.gpt-5.4',
@@ -537,19 +539,24 @@ const response = await client.responses.create({
 console.log(response.output_text);
 ```
 
-`BedrockOpenAI` configures AWS bearer auth and the Bedrock Mantle endpoint, then uses the normal SDK resources. AWS controls which endpoints and features are supported; unsupported calls surface the provider's normal HTTP errors through the SDK.
+Use a model that [supports the Responses API](https://docs.aws.amazon.com/bedrock/latest/userguide/models-api-compatibility.html). A model returned by the Models API may support a different Bedrock inference API instead.
 
-Pass `baseURL` or set `AWS_BEDROCK_BASE_URL` to override the derived `https://bedrock-mantle.<region>.api.aws/openai/v1` endpoint. For long-running apps, pass `bedrockTokenProvider` to refresh the Bedrock bearer token before each request.
+This uses the regional `https://bedrock-mantle.<region>.api.aws/openai/v1` endpoint. The region can also come from `AWS_REGION` or `AWS_DEFAULT_REGION`, and `AWS_BEDROCK_BASE_URL` can override the endpoint.
 
-Set `AWS_BEARER_TOKEN_BEDROCK` to an [Amazon Bedrock API key](https://docs.aws.amazon.com/bedrock/latest/userguide/api-keys.html). To refresh tokens yourself, pass a provider instead of `apiKey`:
+The AWS entrypoint uses the standard AWS credential chain by default. It also accepts a named profile, static credentials, or a custom credential provider. Install its peer dependencies before importing it:
 
-```ts
-const client = new BedrockOpenAI({
-  awsRegion: 'us-west-2',
-  bedrockTokenProvider: async () => refreshBedrockToken(),
-});
+```bash
+npm install @aws-sdk/credential-provider-node @smithy/hash-node @smithy/signature-v4
 ```
 
+The AWS entrypoint uses normal static imports so bundlers and serverless packagers can trace these dependencies. If one is missing, importing `openai/providers/bedrock/aws` fails immediately with the runtime's normal module-not-found error, for example:
+
+```text
+Cannot find module '@aws-sdk/credential-provider-node'
+```
+
+For Bedrock API key authentication, import `bedrock` from `openai/providers/bedrock` instead. That entrypoint has no AWS dependencies and works in browser-compatible runtimes when `dangerouslyAllowBrowser` is enabled. SigV4 authentication is supported in Node.js and compatible server runtimes and requires replayable request bodies. The legacy, bearer-only `BedrockOpenAI` class remains available for compatibility.
+
 For more information on support for Amazon Bedrock, see [bedrock.md](bedrock.md).
 
 ## Advanced Usage

bedrock.md

@@ -1,13 +1,14 @@
 # Amazon Bedrock
 
-To use this library with [Amazon Bedrock's OpenAI-compatible API](https://docs.aws.amazon.com/bedrock/latest/userguide/models-api-compatibility.html), use the `BedrockOpenAI`
-class instead of the `OpenAI` class.
+To use this library with [Amazon Bedrock's OpenAI-compatible API](https://docs.aws.amazon.com/bedrock/latest/userguide/models-api-compatibility.html), configure the standard `OpenAI` client with the Bedrock provider:
 
 ```ts
-import { BedrockOpenAI } from 'openai';
+import OpenAI from 'openai';
+import { bedrock } from 'openai/providers/bedrock/aws';
 
-// gets the bearer token from AWS_BEARER_TOKEN_BEDROCK and the region from AWS_REGION/AWS_DEFAULT_REGION
-const client = new BedrockOpenAI();
+const client = new OpenAI({
+  provider: bedrock({ region: 'us-west-2' }),
+});
 
 const response = await client.responses.create({
   model: 'openai.gpt-5.4',
@@ -17,15 +18,142 @@ const response = await client.responses.create({
 console.log(response.output_text);
 ```
 
-`BedrockOpenAI` configures AWS bearer auth and the Bedrock Mantle endpoint, then uses the normal SDK resources. AWS controls which endpoints and features are supported; unsupported calls surface the provider's normal HTTP errors through the SDK.
+Use a model that [supports the Responses API](https://docs.aws.amazon.com/bedrock/latest/userguide/models-api-compatibility.html). A model returned by the Models API may support a different Bedrock inference API instead.
+
+The provider uses the regional `https://bedrock-mantle.<region>.api.aws/openai/v1` endpoint and the normal SDK resources. AWS controls which endpoints and features are supported; unsupported calls surface the provider's normal HTTP errors through the SDK.
+
+The region defaults to `AWS_REGION` or `AWS_DEFAULT_REGION`. Pass `baseURL` or set `AWS_BEDROCK_BASE_URL` to override the derived endpoint:
+
+```ts
+const client = new OpenAI({
+  provider: bedrock({
+    region: 'us-west-2',
+    baseURL: 'https://bedrock.example.com/openai/v1',
+  }),
+});
+```
+
+## Authentication
+
+The AWS entrypoint selects authentication in this order:
+
+1. One explicit mode passed to `bedrock(...)`: `apiKey` or `tokenProvider`, static AWS credentials, `profile`, or `credentialProvider`.
+2. The [Amazon Bedrock API key](https://docs.aws.amazon.com/bedrock/latest/userguide/api-keys.html) in `AWS_BEARER_TOKEN_BEDROCK`.
+3. The default AWS credential chain.
+
+Explicit bearer and AWS credential modes are mutually exclusive. Similarly, configure only one AWS credential mode at a time.
+
+### Bearer authentication
+
+Pass a Bedrock API key directly, set `AWS_BEARER_TOKEN_BEDROCK`, or use `tokenProvider` to resolve a fresh token before every request attempt:
+
+```ts
+const client = new OpenAI({
+  provider: bedrock({
+    region: 'us-west-2',
+    apiKey: process.env['BEDROCK_API_KEY'],
+  }),
+});
+```
+
+For a refreshable bearer credential:
 
-Pass `baseURL` or set `AWS_BEDROCK_BASE_URL` to override the derived `https://bedrock-mantle.<region>.api.aws/openai/v1` endpoint. For long-running apps, pass `bedrockTokenProvider` to refresh the Bedrock bearer token before each request.
+```ts
+const client = new OpenAI({
+  provider: bedrock({
+    region: 'us-west-2',
+    tokenProvider: async () => refreshBedrockToken(),
+  }),
+});
+```
 
-Set `AWS_BEARER_TOKEN_BEDROCK` to an [Amazon Bedrock API key](https://docs.aws.amazon.com/bedrock/latest/userguide/api-keys.html). To refresh tokens yourself, pass a provider instead of `apiKey`:
+Bearer authentication does not require any additional dependencies when imported from the dependency-free entrypoint:
 
 ```ts
+import { bedrock } from 'openai/providers/bedrock';
+
+const client = new OpenAI({
+  provider: bedrock({
+    region: 'us-west-2',
+    apiKey: process.env['AWS_BEARER_TOKEN_BEDROCK'],
+  }),
+});
+```
+
+The dependency-free entrypoint supports only `apiKey`, `tokenProvider`, and `AWS_BEARER_TOKEN_BEDROCK`. Use the AWS entrypoint for SigV4 authentication.
+
+### AWS credentials and SigV4
+
+Install the AWS entrypoint's peer dependencies to sign requests with SigV4:
+
+```sh
+npm install @aws-sdk/credential-provider-node @smithy/hash-node @smithy/signature-v4
+```
+
+The AWS entrypoint uses normal static imports so Vite, Webpack, and serverless packagers can include these dependencies. If one is missing, importing `openai/providers/bedrock/aws` fails immediately with the runtime's normal module-not-found error, for example:
+
+```text
+Cannot find module '@aws-sdk/credential-provider-node'
+```
+
+Import the AWS entrypoint, then omit explicit authentication to use the default AWS credential chain or select a shared-config profile:
+
+```ts
+import { bedrock } from 'openai/providers/bedrock/aws';
+
+const client = new OpenAI({
+  provider: bedrock({
+    region: 'us-west-2',
+    profile: 'my-profile',
+  }),
+});
+```
+
+Pass temporary AWS credentials directly, including the session token:
+
+```ts
+const client = new OpenAI({
+  provider: bedrock({
+    region: 'us-west-2',
+    accessKeyId: process.env['AWS_ACCESS_KEY_ID'],
+    secretAccessKey: process.env['AWS_SECRET_ACCESS_KEY'],
+    sessionToken: process.env['AWS_SESSION_TOKEN'],
+  }),
+});
+```
+
+For credentials that can change, pass a provider. It is called before every request attempt, including retries:
+
+```ts
+const client = new OpenAI({
+  provider: bedrock({
+    region: 'us-west-2',
+    credentialProvider: async () => ({
+      accessKeyId: process.env['AWS_ACCESS_KEY_ID']!,
+      secretAccessKey: process.env['AWS_SECRET_ACCESS_KEY']!,
+      sessionToken: process.env['AWS_SESSION_TOKEN'],
+    }),
+  }),
+});
+```
+
+SigV4 authentication is supported in Node.js and compatible server runtimes. Bearer authentication can be used in other runtimes without loading the AWS packages by importing from `openai/providers/bedrock`.
+
+The SDK's current SigV4 mode requires a replayable, buffered body such as a string, `ArrayBuffer`, or typed-array view. The standard JSON API methods already meet this requirement. Custom `FormData`, readable streams, and other non-replayable request bodies are rejected before sending; response streaming is unaffected. Signed requests also do not automatically follow redirects, because the redirect target would require a new signature.
+
+Bedrock Mantle also supports `UNSIGNED-PAYLOAD` and AWS-chunked request signing, but this SDK does not enable those modes. Mantle waits for the complete request body before authentication and authorization, so streaming a request body does not reduce request latency.
+
+## Legacy `BedrockOpenAI` class
+
+The `BedrockOpenAI` class remains available for existing bearer-authenticated applications. It accepts the `awsRegion` and `bedrockTokenProvider` option names and uses the same `/openai/v1` endpoint as the provider:
+
+```ts
+import { BedrockOpenAI } from 'openai';
+
 const client = new BedrockOpenAI({
   awsRegion: 'us-west-2',
-  bedrockTokenProvider: async () => refreshBedrockToken(),
+  apiKey: process.env['AWS_BEARER_TOKEN_BEDROCK'],
 });
 ```
+
+New applications using AWS credentials should prefer `new OpenAI({ provider: bedrock(...) })` with the `openai/providers/bedrock/aws` entrypoint.

ecosystem-tests/ts-browser-webpack/src/index.ts

@@ -1,5 +1,6 @@
 import OpenAI, { toFile } from 'openai';
 import { distance } from 'fastest-levenshtein';
+import { bedrock } from 'openai/providers/bedrock';
 import { ChatCompletion } from 'openai/resources/chat/completions';
 
 type TestCase = {
@@ -96,6 +97,22 @@ const params = new URLSearchParams(location.search);
 
 const client = new OpenAI({ apiKey: params.get('apiKey') ?? undefined, dangerouslyAllowBrowser: true });
 
+it('supports Bedrock bearer authentication without AWS dependencies', async function () {
+  let authorization: string | null = null;
+  const bedrockClient = new OpenAI({
+    provider: bedrock({ region: 'us-east-1', apiKey: 'bedrock-token' }),
+    dangerouslyAllowBrowser: true,
+    fetch: async (_url, init) => {
+      authorization = new Headers(init?.headers).get('authorization');
+      return new Response('{}', { headers: { 'Content-Type': 'application/json' } });
+    },
+  });
+
+  await bedrockClient.request({ method: 'get', path: '/models' });
+
+  expect(authorization).toEqual('Bearer bedrock-token');
+});
+
 async function typeTests() {
   // @ts-expect-error this should error if the `Uploadable` type was resolved correctly
   await client.audio.transcriptions.create({ file: { foo: true }, model: 'whisper-1' });

examples/bedrock/responses.ts

@@ -1,11 +1,16 @@
 #!/usr/bin/env -S npm run tsn -- -T
 
-import { BedrockOpenAI } from 'openai';
+import OpenAI from 'openai';
+import { bedrock } from 'openai/providers/bedrock/aws';
 
-const client = new BedrockOpenAI();
+const client = new OpenAI({
+  provider: bedrock({ region: 'us-west-2' }),
+});
 
-// For refreshed Bedrock bearer tokens:
-// const client = new BedrockOpenAI({ awsRegion: 'us-west-2', bedrockTokenProvider: getBedrockToken });
+// For refreshed Bedrock bearer tokens, import from 'openai/providers/bedrock':
+// const client = new OpenAI({
+//   provider: bedrock({ region: 'us-west-2', tokenProvider: getBedrockToken }),
+// });
 
 async function main() {
   const response = await client.responses.create({

jest.config.ts

@@ -17,7 +17,7 @@ const config: JestConfigWithTsJest = {
     '<rootDir>/deno_tests/',
     '<rootDir>/packages/',
   ],
-  testPathIgnorePatterns: ['scripts'],
+  testPathIgnorePatterns: ['scripts', '<rootDir>/tests/live/'],
   // prettierPath: require.resolve('prettier-2'),
 };
 

jest.live.config.ts

@@ -0,0 +1,11 @@
+import type { JestConfigWithTsJest } from 'ts-jest';
+
+import baseConfig from './jest.config';
+
+const config: JestConfigWithTsJest = {
+  ...baseConfig,
+  testMatch: ['<rootDir>/tests/live/**/*.live.test.ts'],
+  testPathIgnorePatterns: [],
+};
+
+export default config;

jsr.json

@@ -1,12 +1,17 @@
 {
   "name": "@openai/openai",
-  "version": "6.44.0",
+  "version": "6.45.0",
   "exports": {
     ".": "./index.ts",
+    "./providers/bedrock": "./providers/bedrock.ts",
+    "./providers/bedrock/aws": "./providers/bedrock/aws.ts",
     "./helpers/zod": "./helpers/zod.ts",
     "./beta/realtime/websocket": "./beta/realtime/websocket.ts"
   },
   "imports": {
+    "@aws-sdk/credential-provider-node": "npm:@aws-sdk/credential-provider-node@^3.972.47",
+    "@smithy/hash-node": "npm:@smithy/hash-node@^4.3.5",
+    "@smithy/signature-v4": "npm:@smithy/signature-v4@^5.4.5",
     "zod": "npm:zod@3"
   },
   "publish": {