openai 7.7.0 → 7.8.0

package/src/core/EventEmitter.ts

@@ -186,11 +186,20 @@ export class EventEmitter<EventTypes extends Record<string, (...args: any) => an
         }
         return !listener.once && !listener.removed;
       }) as any;
+      let listenerThrew = false;
+      let firstListenerError: unknown;
       this.#listenerDispatchDepth += 1;
       try {
         for (const registration of listeners as any) {
           if (!registration.removed) {
-            registration.listener(...(args as any));
+            try {
+              registration.listener(...(args as any));
+            } catch (error) {
+              if (!listenerThrew) {
+                listenerThrew = true;
+                firstListenerError = error;
+              }
+            }
           }
         }
       } finally {
@@ -199,6 +208,9 @@ export class EventEmitter<EventTypes extends Record<string, (...args: any) => an
           this.#cleanupEmittedListeners();
         }
       }
+      if (listenerThrew) {
+        throw firstListenerError;
+      }
     }
   }
 

package/src/internal/auth/x509-api-origin.ts

@@ -0,0 +1,27 @@
+import { OpenAIError } from '../../core/error';
+import { isSensitiveQueryParameter } from '../utils/log';
+
+/** Sole API authority approved for OpenAI X.509 workload-identity federation. */
+export const X509_API_BASE_URL = 'https://mtls.api.openai.com/v1';
+
+/** Validates the enrolled API authority and rejects credential-bearing query parameters. */
+export function assertX509APIOrigin(value: string | URL): URL {
+  let target: URL;
+  try {
+    target = new URL(value);
+  } catch {
+    throw new OpenAIError('X.509 workload identity requires the approved global mTLS API origin.');
+  }
+
+  if (target.origin !== 'https://mtls.api.openai.com' || target.username || target.password) {
+    throw new OpenAIError('X.509 workload identity requires the approved global mTLS API origin.');
+  }
+  for (const name of target.searchParams.keys()) {
+    if (isSensitiveQueryParameter(name)) {
+      throw new OpenAIError(
+        'X.509 workload identity cannot send conflicting query authentication credentials.',
+      );
+    }
+  }
+  return target;
+}

package/src/internal/auth/x509-credential-options.ts

@@ -0,0 +1,146 @@
+import { OpenAIError } from '../../core/error';
+import type { ClientOptions } from '../../client';
+import type { X509Credential } from '../../auth/types';
+import { hasOwn } from '../utils/values';
+import { isX509WorkloadIdentity } from './x509-workload-identity-auth';
+import type { RegisteredX509Credential } from './x509-transport-registry';
+import { findX509Credential } from '#x509-transport-state';
+
+/** Validates one privately registered credential and suppresses ambient legacy authentication. */
+export function normalizeX509CredentialOptions(options: ClientOptions): {
+  credential: X509Credential | undefined;
+  options: ClientOptions;
+} {
+  const { credential } = options;
+  if (credential === undefined) {
+    return { credential, options };
+  }
+
+  const registered: RegisteredX509Credential | undefined = findX509Credential(credential);
+  if (!registered) {
+    throw new OpenAIError('An X.509 credential must be created by the SDK authentication helper.');
+  }
+  const conflicting = (['apiKey', 'adminAPIKey', 'workloadIdentity', 'x509Transport'] as const).filter(
+    (name) => {
+      const value = options[name];
+      return value !== null && value !== undefined;
+    },
+  );
+  if (conflicting.length > 0) {
+    throw new OpenAIError(
+      `The \`credential\` option cannot be combined with ${conflicting.map((name) => `\`${name}\``).join(', ')}.`,
+    );
+  }
+
+  return {
+    credential,
+    options: {
+      ...options,
+      apiKey: null,
+      adminAPIKey: null,
+      baseURL: options.baseURL ?? null,
+      organization: options.organization ?? null,
+      project: options.project ?? null,
+      workloadIdentity: registered.identity,
+      x509Transport: registered.transport,
+    },
+  };
+}
+
+/** Distinguishes explicitly supplied ordinary credentials from nullish inheritance. */
+function overridesOrdinaryAuthentication({ apiKey, adminAPIKey }: Partial<ClientOptions>): boolean {
+  return (apiKey !== null && apiKey !== undefined) || (adminAPIKey !== null && adminAPIKey !== undefined);
+}
+
+/** Keeps origin-bound configuration with its owning provider during a client clone. */
+function prepareProviderClone(
+  inherited: ClientOptions,
+  overrides: Partial<ClientOptions>,
+): ClientOptions['provider'] {
+  const inheritedProvider = inherited.provider;
+  const replacingProvider = overrides.credential ?? overrides.workloadIdentity;
+  const provider = overrides.provider ?? (replacingProvider ? undefined : inheritedProvider);
+
+  if (provider !== inheritedProvider) {
+    delete inherited.baseURL;
+    delete inherited.organization;
+    delete inherited.project;
+    delete inherited.defaultHeaders;
+    delete inherited.defaultQuery;
+    delete inherited.fetchOptions;
+    delete inherited.fetch;
+  }
+  if (provider) {
+    delete inherited.apiKey;
+    delete inherited.adminAPIKey;
+    delete inherited.credential;
+    delete inherited.workloadIdentity;
+    delete inherited.x509Transport;
+    delete inherited.baseURL;
+  }
+  return provider;
+}
+
+/** Reconciles one client's credential and provider ownership before cloning its options. */
+export function prepareX509ClientClone(
+  inherited: ClientOptions,
+  overrides: Partial<ClientOptions>,
+  credential: X509Credential | undefined,
+  currentlyX509: boolean,
+): { credential: X509Credential | undefined; provider: ClientOptions['provider'] } {
+  const nextIdentity = hasOwn(overrides, 'workloadIdentity')
+    ? overrides.workloadIdentity
+    : inherited.workloadIdentity;
+  const dropping =
+    credential !== undefined &&
+    ((overridesOrdinaryAuthentication(overrides) && overrides.workloadIdentity === undefined) ||
+      overrides.provider !== undefined);
+  if (credential !== undefined && hasOwn(overrides, 'workloadIdentity')) {
+    delete inherited.x509Transport;
+  }
+  const inheritedCredential =
+    credential !== undefined &&
+    !dropping &&
+    overrides.credential === undefined &&
+    !hasOwn(overrides, 'workloadIdentity') &&
+    !hasOwn(overrides, 'x509Transport')
+      ? credential
+      : undefined;
+  const nextCredential = overrides.credential === undefined ? inheritedCredential : overrides.credential;
+  const nextX509 = nextCredential !== undefined || (!dropping && isX509WorkloadIdentity(nextIdentity));
+
+  if (currentlyX509 !== nextX509) {
+    delete inherited.fetch;
+    delete inherited.baseURL;
+    delete inherited.organization;
+    delete inherited.project;
+    delete inherited.defaultHeaders;
+    delete inherited.defaultQuery;
+    delete inherited.fetchOptions;
+    if (nextX509) {
+      inherited.apiKey = null;
+    } else {
+      delete inherited.x509Transport;
+      if (dropping) {
+        delete inherited.workloadIdentity;
+      }
+    }
+  }
+
+  if (nextCredential !== undefined) {
+    delete inherited.apiKey;
+    delete inherited.adminAPIKey;
+    delete inherited.workloadIdentity;
+    delete inherited.x509Transport;
+    inherited.credential = nextCredential;
+    if (overrides.credential !== undefined) {
+      delete inherited.organization;
+      delete inherited.project;
+      delete inherited.defaultHeaders;
+      delete inherited.defaultQuery;
+      delete inherited.fetchOptions;
+    }
+  }
+
+  return { credential: nextCredential, provider: prepareProviderClone(inherited, overrides) };
+}

package/src/internal/auth/x509-transport-capability.ts

@@ -15,7 +15,13 @@ export interface X509TransportOptions {
   /** X.509 transport currently supports genuine Node.js runtimes only. */
   runtime: 'node';
 
-  /** Caller-owned Undici Agent or ProxyAgent; the SDK never closes or inspects it. */
+  /**
+   * Caller-owned Undici Agent or ProxyAgent; the SDK never closes or inspects it.
+   *
+   * The application attests that its dispatcher, factories, TLS verification,
+   * certificate selection, and CONNECT proxy configuration are trustworthy.
+   * Use `fromX509` when the SDK should own and enforce transport configuration.
+   */
   dispatcher: Agent | ProxyAgent;
 
   /** Attests that the dispatcher uses one static workload-certificate identity. */
@@ -150,10 +156,11 @@ function assertConnectProxySupport(): void {
  * `certificateIdentity: 'static'` is an application attestation: the SDK does
  * not inspect certificates, private dispatcher internals, callbacks, or TLS
  * options and cannot cryptographically prove certificate selection. Configure
- * one static identity without custom dispatcher factories. For HTTPS CONNECT,
- * independently configure `proxyTls` and `requestTls` so workload credentials
- * never reach the proxy. Rotation requires creating a fresh dispatcher and
- * capability; the application remains responsible for draining the old one.
+ * trusted dispatcher factories, verified target and proxy TLS, one static
+ * certificate identity, and independently scoped CONNECT credentials.
+ * Prefer the SDK-owned `fromX509` credential when these guarantees should be
+ * enforced at construction. Rotation requires a fresh caller-owned dispatcher
+ * and capability; the application remains responsible for draining it.
  *
  * This Node-only preview entrypoint requires the optional `undici` peer at
  * version 5.2.0 or later. CONNECT proxy modes require version 5.5.1 or

package/src/internal/auth/x509-transport-registry.ts

@@ -1,5 +1,6 @@
 import { OpenAIError } from '../../core/error';
 import type { NullableHeaders } from '../headers';
+import type { X509WorkloadIdentity } from '../../auth/types';
 import type { ReadableStream } from '../shim-types';
 import type { MergedRequestInit } from '../types';
 import { findRegisteredX509Transport } from '#x509-transport-state';
@@ -49,6 +50,12 @@ export interface X509Transport {
   readonly [x509TransportBrand]: true;
 }
 
+/** Immutable selectors and transport privately registered for an SDK-owned credential. */
+export interface RegisteredX509Credential {
+  readonly identity: X509WorkloadIdentity;
+  readonly transport: X509Transport;
+}
+
 /** Validated short-lived token exchanged using a registered certificate identity. */
 export interface X509ExchangedToken {
   /** Header-safe, in-memory OpenAI bearer credential. */
@@ -63,6 +70,8 @@ export interface X509RequestScope {
   wallStartedAt: number;
   monotonicStartedAt: number;
   deadlineArmed?: boolean;
+  preparationStartedAt?: number;
+  preparationWallStartedAt?: number;
   request?: { signal: AbortSignal | null | undefined; timeout: number; fetchOptions: MergedRequestInit };
   phase?: 'planning' | 'authorizing';
   effectiveSignal?: AbortSignal;

package/src/internal/auth/x509-transport-state-browser.ts

@@ -4,6 +4,7 @@ const transientX509ConnectionErrors = new WeakSet();
 const retryableX509IssuerErrors = new WeakSet();
 const approvedX509Clients = new WeakSet();
 const approvedX509OAuthErrors = new WeakMap();
+const approvedX509Credentials = new WeakMap();
 
 /** Looks up an opaque capability without exposing the registry itself. */
 export const findRegisteredX509Transport = WeakMap.prototype.get.bind(registeredX509Transports);
@@ -34,3 +35,9 @@ export const rememberX509OAuthError = WeakMap.prototype.set.bind(approvedX509OAu
 
 /** Retrieves trusted metadata when public OAuth errors cross module formats. */
 export const findX509OAuthError = WeakMap.prototype.get.bind(approvedX509OAuthErrors);
+
+/** Privately binds SDK-owned credentials without importing Node or optional transport peers. */
+export const rememberX509Credential = WeakMap.prototype.set.bind(approvedX509Credentials);
+
+/** Resolves only credentials registered by the optional Node authentication helper. */
+export const findX509Credential = WeakMap.prototype.get.bind(approvedX509Credentials);

package/src/internal/auth/x509-transport-state.cts

@@ -4,6 +4,7 @@ const transientX509ConnectionErrors = new WeakSet();
 const retryableX509IssuerErrors = new WeakSet();
 const approvedX509Clients = new WeakSet();
 const approvedX509OAuthErrors = new WeakMap();
+const approvedX509Credentials = new WeakMap();
 
 /** Looks up an opaque capability without exposing the registry itself. */
 export const findRegisteredX509Transport = WeakMap.prototype.get.bind(registeredX509Transports);
@@ -34,3 +35,9 @@ export const rememberX509OAuthError = WeakMap.prototype.set.bind(approvedX509OAu
 
 /** Retrieves trusted OAuth metadata for public cross-module error normalization. */
 export const findX509OAuthError = WeakMap.prototype.get.bind(approvedX509OAuthErrors);
+
+/** Privately binds SDK-owned credentials to their immutable identity and approved transport. */
+export const rememberX509Credential = WeakMap.prototype.set.bind(approvedX509Credentials);
+
+/** Resolves only first-class credentials created by the optional Node transport helper. */
+export const findX509Credential = WeakMap.prototype.get.bind(approvedX509Credentials);

package/src/internal/auth/x509-workload-identity-auth.ts

@@ -6,7 +6,9 @@ import type { HeadersLike, NullableHeaders } from '../headers';
 import type { FinalRequestOptions } from '../request-options';
 import { CancelReadableStream } from '../shims';
 import type { MergedRequestInit } from '../types';
+import { isSensitiveHeader } from '../utils/log';
 import { hasOwn } from '../utils/values';
+import { assertX509APIOrigin } from './x509-api-origin';
 import { resolveX509Transport } from './x509-transport-registry';
 import {
   isApprovedX509Client,
@@ -21,10 +23,6 @@ import type {
   X509Transport,
 } from './x509-transport-registry';
 
-/** Sole API authority approved for OpenAI X.509 workload-identity federation. */
-export const X509_API_BASE_URL = 'https://mtls.api.openai.com/v1';
-
-const X509_API_ORIGIN = 'https://mtls.api.openai.com';
 const FORBIDDEN_TRANSPORT_OPTIONS = ['dispatcher', 'agent', 'client', 'tls', 'proxy'];
 const headerValue = (headers: Headers, name: string): string | null =>
   Headers.prototype.get.call(headers, name);
@@ -39,12 +37,7 @@ const userAbortError = (signal: AbortSignal): APIUserAbortError => {
 function assertSafeHeaders(headers: Headers): void {
   for (const name of Headers.prototype.keys.call(headers)) {
     const canonical = name.toLowerCase().split('_').join('-');
-    if (
-      canonical === 'api-key' ||
-      canonical === 'x-api-key' ||
-      canonical === 'proxy-authorization' ||
-      canonical === 'host'
-    ) {
+    if ((canonical !== 'authorization' && isSensitiveHeader(canonical)) || canonical === 'host') {
       throw new OpenAIError('X.509 workload identity cannot send conflicting authentication credentials.');
     }
   }
@@ -180,21 +173,6 @@ export function assertX509WebSocketSupported(client: unknown): void {
   }
 }
 
-/** Rejects every destination outside the sole enrolled, global X.509 API authority. */
-export function assertX509APIOrigin(value: string | URL): URL {
-  let target: URL;
-  try {
-    target = new URL(value);
-  } catch {
-    throw new OpenAIError('X.509 workload identity requires the approved global mTLS API origin.');
-  }
-
-  if (target.origin !== X509_API_ORIGIN || target.username || target.password) {
-    throw new OpenAIError('X.509 workload identity requires the approved global mTLS API origin.');
-  }
-  return target;
-}
-
 /** Prevents caller options from replacing the immutable transport selected at construction. */
 export function assertX509FetchOptions(options: MergedRequestInit | RequestInit | undefined): void {
   if (!options) {
@@ -235,6 +213,7 @@ export class X509WorkloadIdentityAuth {
   readonly #identityProviderId: string;
   readonly #serviceAccountId: string;
   readonly #configuredRefreshBufferMs: number | undefined;
+  readonly #configuredRefreshBufferSeconds: number | undefined;
   readonly #organization: string | null;
   readonly #project: string | null;
   readonly #transport: RegisteredX509Transport;
@@ -254,15 +233,32 @@ export class X509WorkloadIdentityAuth {
     this.#identityProviderId = identity.identityProviderId;
     this.#serviceAccountId = identity.serviceAccountId;
     this.#configuredRefreshBufferMs = identity.refreshBufferMs;
+    this.#configuredRefreshBufferSeconds = identity.refreshBufferSeconds;
     this.#organization = organization;
     this.#project = project;
+    if (this.#configuredRefreshBufferMs !== undefined && this.#configuredRefreshBufferSeconds !== undefined) {
+      throw new OpenAIError(
+        'X.509 workload identity cannot combine refreshBufferSeconds and refreshBufferMs.',
+      );
+    }
     if (
       this.#configuredRefreshBufferMs !== undefined &&
       (!Number.isSafeInteger(this.#configuredRefreshBufferMs) || this.#configuredRefreshBufferMs < 0)
     ) {
       throw new OpenAIError('X.509 workload identity requires a nonnegative integer refreshBufferMs.');
     }
-    this.#refreshBufferMs = this.#configuredRefreshBufferMs ?? DEFAULT_REFRESH_BUFFER_MS;
+    if (
+      this.#configuredRefreshBufferSeconds !== undefined &&
+      (!Number.isSafeInteger(this.#configuredRefreshBufferSeconds) ||
+        this.#configuredRefreshBufferSeconds < 0 ||
+        !Number.isSafeInteger(this.#configuredRefreshBufferSeconds * 1000))
+    ) {
+      throw new OpenAIError('X.509 workload identity requires a nonnegative integer refreshBufferSeconds.');
+    }
+    this.#refreshBufferMs =
+      this.#configuredRefreshBufferSeconds === undefined
+        ? (this.#configuredRefreshBufferMs ?? DEFAULT_REFRESH_BUFFER_MS)
+        : this.#configuredRefreshBufferSeconds * 1000;
   }
 
   /** Reconstructs the immutable selectors captured before caller-owned identity mutation. */
@@ -274,6 +270,9 @@ export class X509WorkloadIdentityAuth {
       ...(this.#configuredRefreshBufferMs === undefined
         ? {}
         : { refreshBufferMs: this.#configuredRefreshBufferMs }),
+      ...(this.#configuredRefreshBufferSeconds === undefined
+        ? {}
+        : { refreshBufferSeconds: this.#configuredRefreshBufferSeconds }),
     };
   }
 
@@ -365,6 +364,15 @@ export class X509WorkloadIdentityAuth {
     return request;
   }
 
+  /** Suspends an already-running network budget during retry-local asynchronous preparation. */
+  beginRequestPreparation(): void {
+    const scope = this.#scope();
+    if (scope.deadlineArmed && scope.preparationStartedAt === undefined) {
+      scope.preparationStartedAt = performance.now();
+      scope.preparationWallStartedAt = Date.now();
+    }
+  }
+
   /** Begins local request construction without charging protected hook latency to the network. */
   beginRequestPlanning(): void {
     this.#scope().phase = 'planning';
@@ -377,6 +385,11 @@ export class X509WorkloadIdentityAuth {
       scope.wallStartedAt = Date.now();
       scope.monotonicStartedAt = performance.now();
       scope.deadlineArmed = true;
+    } else if (scope.preparationStartedAt !== undefined) {
+      scope.monotonicStartedAt += performance.now() - scope.preparationStartedAt;
+      scope.wallStartedAt += Date.now() - (scope.preparationWallStartedAt ?? Date.now());
+      delete scope.preparationStartedAt;
+      delete scope.preparationWallStartedAt;
     }
   }
 
@@ -550,6 +563,8 @@ export class X509WorkloadIdentityAuth {
     delete scope.request;
     delete scope.phase;
     delete scope.deadlineArmed;
+    delete scope.preparationStartedAt;
+    delete scope.preparationWallStartedAt;
     delete scope.effectiveSignal;
     delete scope.materializedBody;
     delete scope.apiURL;
@@ -820,13 +835,7 @@ export class X509WorkloadIdentityAuth {
           'X.509 workload identity cannot override its enrolled organization or project.',
         );
       }
-      if (
-        canonical === 'authorization' ||
-        canonical === 'api-key' ||
-        canonical === 'x-api-key' ||
-        canonical === 'proxy-authorization' ||
-        canonical === 'host'
-      ) {
+      if (isSensitiveHeader(canonical) || canonical === 'host') {
         throw new OpenAIError(
           'X.509 workload identity cannot use caller-supplied authentication credentials.',
         );

package/src/internal/uploads.ts

@@ -348,7 +348,8 @@ const hasStreamingUploadableValue = (value: unknown): boolean => {
     return value.some(hasStreamingUploadableValue);
   }
   if (value && typeof value === 'object' && !isBlob(value) && !(value instanceof Response)) {
-    for (const k in value) {
+    // Own properties only, matching what form encoding serializes; inherited values are never encoded.
+    for (const k of Object.keys(value)) {
       if (hasStreamingUploadableValue((value as Record<string, unknown>)[k])) {
         return true;
       }
@@ -365,7 +366,8 @@ const hasUploadableValue = (value: unknown): boolean => {
     return value.some(hasUploadableValue);
   }
   if (value && typeof value === 'object') {
-    for (const k in value) {
+    // Own properties only, matching what form encoding serializes; inherited values are never encoded.
+    for (const k of Object.keys(value)) {
       if (hasUploadableValue((value as any)[k])) {
         return true;
       }

package/src/internal/utils/log.ts

@@ -82,6 +82,62 @@ export function loggerFor(client: OpenAI): Logger {
   return levelLogger;
 }
 
+const sensitiveQueryNames = new Set([
+  'apikey',
+  'accesstoken',
+  'refreshtoken',
+  'sessiontoken',
+  'sessionid',
+  'idtoken',
+  'authtoken',
+  'authorization',
+  'token',
+  'password',
+  'clientsecret',
+  'xamzsecuritytoken',
+  'xamzsignature',
+  'xamzcredential',
+]);
+
+/** Recognizes credential-bearing query names across ordinary and provider authentication. */
+export function isSensitiveQueryParameter(name: string): boolean {
+  const normalized = name.toLowerCase().replace(/[-_]/gu, '');
+  return sensitiveQueryNames.has(normalized) || sensitiveQueryNames.has(normalized.replace(/^x/u, ''));
+}
+
+const sensitiveHeaderNames = new Set([
+  'authorization',
+  'proxy-authorization',
+  'api-key',
+  'x-api-key',
+  'x-amz-security-token',
+  'cookie',
+  'set-cookie',
+  'x-session-token',
+  'x-session-id',
+  'x-auth-token',
+  'x-id-token',
+]);
+
+/** Recognizes credential-bearing request headers across provider and workload authentication. */
+export function isSensitiveHeader(name: string): boolean {
+  return sensitiveHeaderNames.has(name.toLowerCase().replace(/_/gu, '-')) || isSensitiveQueryParameter(name);
+}
+
+/** Removes credential-valued query parameters before a request URL reaches any logger. */
+export function redactURL(value: string): string {
+  const url = new URL(value);
+  url.username = '';
+  url.password = '';
+  url.hash = '';
+  for (const name of url.searchParams.keys()) {
+    if (isSensitiveQueryParameter(name)) {
+      url.searchParams.set(name, '***');
+    }
+  }
+  return url.href;
+}
+
 export const formatRequestDetails = (details: {
   options?: RequestOptions | undefined;
   headers?: Headers | Record<string, string> | undefined;
@@ -97,21 +153,30 @@ export const formatRequestDetails = (details: {
   if (details.options) {
     details.options = { ...details.options };
     delete details.options['headers']; // redundant + leaks internals
+    if (details.options.path) {
+      const path = details.options.path;
+      const redacted = new URL(redactURL(new URL(path, 'https://redacted.invalid').href));
+      details.options.path =
+        redacted.origin === 'https://redacted.invalid'
+          ? `${path.startsWith('/') ? '/' : ''}${redacted.pathname.slice(1)}${redacted.search}`
+          : redacted.href;
+    }
+    if (details.options.query) {
+      details.options.query = Object.fromEntries(
+        Object.entries(details.options.query).map(([name, value]) => [
+          name,
+          isSensitiveQueryParameter(name) ? '***' : value,
+        ]),
+      );
+    }
+  }
+  if (details.url) {
+    details.url = redactURL(details.url);
   }
   if (details.headers) {
     details.headers = Object.fromEntries(
       (details.headers instanceof Headers ? [...details.headers] : Object.entries(details.headers)).map(
-        ([name, value]) => [
-          name,
-          name.toLowerCase() === 'authorization' ||
-          name.toLowerCase() === 'api-key' ||
-          name.toLowerCase() === 'x-api-key' ||
-          name.toLowerCase() === 'x-amz-security-token' ||
-          name.toLowerCase() === 'cookie' ||
-          name.toLowerCase() === 'set-cookie'
-            ? '***'
-            : value,
-        ],
+        ([name, value]) => [name, isSensitiveHeader(name) ? '***' : value],
       ),
     );
   }

package/src/lib/EventEmitter.ts

@@ -184,11 +184,20 @@ export class EventEmitter<EventTypes extends Record<string, (...args: any) => an
         }
         return !listener.once && !listener.removed;
       }) as any;
+      let listenerThrew = false;
+      let firstListenerError: unknown;
       this.#listenerDispatchDepth += 1;
       try {
         for (const registration of listeners as any) {
           if (!registration.removed) {
-            registration.listener(...(args as any));
+            try {
+              registration.listener(...(args as any));
+            } catch (error) {
+              if (!listenerThrew) {
+                listenerThrew = true;
+                firstListenerError = error;
+              }
+            }
           }
         }
       } finally {
@@ -197,6 +206,9 @@ export class EventEmitter<EventTypes extends Record<string, (...args: any) => an
           this.#cleanupEmittedListeners();
         }
       }
+      if (listenerThrew) {
+        throw firstListenerError;
+      }
     }
   }
 

package/src/realtime/ws.ts

@@ -3,6 +3,7 @@ import { assertBedrockWebSocketOrigin } from '../internal/bedrock';
 import { protectWebSocketOptionsFromCredentialRedirects } from '../internal/ws';
 import type { AzureOpenAI } from '../index';
 import { OpenAI } from '../index';
+import { VERSION } from '../version';
 import type { RealtimeClientEvent } from '../resources/realtime/realtime';
 import {
   OpenAIRealtimeEmitter,
@@ -62,6 +63,7 @@ export class OpenAIRealtimeWS extends OpenAIRealtimeEmitter {
     this.url = buildRealtimeURL(client, props);
     assertBedrockWebSocketOrigin(client, this.url);
     const headers = {
+      'User-Agent': `${client.constructor.name}/JS ${VERSION}`,
       ...props.options?.headers,
       ...(isAzure(client) && !props.__resolvedApiKey ? {} : { Authorization: `Bearer ${client.apiKey}` }),
     };

package/src/resources/admin/organization/audit-logs.ts

@@ -130,6 +130,8 @@ export interface AuditLogListResponse {
     | 'tenant.admin_api_key.updated'
     | 'tenant.admin_api_key.deleted'
     | 'tenant.project_api_key.created'
+    | 'tenant.trusted_access.business_verification.started'
+    | 'tenant.trusted_access.application.submitted'
     | 'tenant.chatgpt_access_token.revoked'
     | 'tenant.migration.completed'
     | 'tenant.sso.migrated'
@@ -1936,6 +1938,8 @@ export interface AuditLogListParams extends ConversationCursorPageParams {
     | 'tenant.admin_api_key.updated'
     | 'tenant.admin_api_key.deleted'
     | 'tenant.project_api_key.created'
+    | 'tenant.trusted_access.business_verification.started'
+    | 'tenant.trusted_access.application.submitted'
     | 'tenant.chatgpt_access_token.revoked'
     | 'tenant.migration.completed'
     | 'tenant.sso.migrated'

package/src/resources/beta/responses/responses.ts

@@ -10525,6 +10525,11 @@ export interface BetaResponseUsage {
    * The total number of tokens used.
    */
   total_tokens: number;
+
+  /**
+   * Compute units for the request. Currently null when available.
+   */
+  compute_units?: number | null;
 }
 
 export namespace BetaResponseUsage {