openai 7.7.0 → 7.9.0

package/resources/shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../src/resources/shared.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,SAAS,GACjB,CAAC,MAAM,GAAG,EAAE,CAAC,GACb,SAAS,GACT,QAAQ,GACR,mBAAmB,GACnB,QAAQ,GACR,mBAAmB,GACnB,kBAAkB,GAClB,6BAA6B,GAC7B,uBAAuB,GACvB,kCAAkC,GAClC,sBAAsB,GACtB,iCAAiC,GACjC,aAAa,GACb,wBAAwB,GACxB,aAAa,GACb,WAAW,GACX,sBAAsB,GACtB,mBAAmB,GACnB,0BAA0B,GAC1B,yBAAyB,GACzB,eAAe,CAAC;AAEpB,MAAM,MAAM,SAAS,GACjB,aAAa,GACb,eAAe,GACf,cAAc,GACd,SAAS,GACT,oBAAoB,GACpB,SAAS,GACT,cAAc,GACd,cAAc,GACd,yBAAyB,GACzB,yBAAyB,GACzB,qBAAqB,GACrB,SAAS,GACT,oBAAoB,GACpB,qBAAqB,GACrB,aAAa,GACb,wBAAwB,GACxB,SAAS,GACT,oBAAoB,GACpB,eAAe,GACf,cAAc,GACd,qBAAqB,GACrB,OAAO,GACP,YAAY,GACZ,YAAY,GACZ,kBAAkB,GAClB,uBAAuB,GACvB,uBAAuB,GACvB,mBAAmB,GACnB,SAAS,GACT,cAAc,GACd,cAAc,GACd,oBAAoB,GACpB,yBAAyB,GACzB,yBAAyB,GACzB,SAAS,GACT,oBAAoB,GACpB,IAAI,GACJ,eAAe,GACf,SAAS,GACT,oBAAoB,GACpB,IAAI,GACJ,eAAe,GACf,YAAY,GACZ,uBAAuB,GACvB,SAAS,GACT,oBAAoB,GACpB,QAAQ,GACR,mBAAmB,GACnB,mBAAmB,GACnB,mBAAmB,GACnB,sBAAsB,GACtB,iCAAiC,GACjC,iCAAiC,GACjC,iCAAiC,GACjC,2BAA2B,GAC3B,sCAAsC,GACtC,uBAAuB,GACvB,4BAA4B,GAC5B,kCAAkC,GAClC,uCAAuC,GACvC,mBAAmB,GACnB,mBAAmB,GACnB,aAAa,GACb,wBAAwB,GACxB,aAAa,GACb,wBAAwB,GACxB,oBAAoB,GACpB,qBAAqB,GACrB,oBAAoB,GACpB,sBAAsB,GACtB,OAAO,GACP,YAAY,GACZ,YAAY,GACZ,WAAW,GACX,gBAAgB,GAChB,gBAAgB,GAChB,eAAe,GACf,mBAAmB,GACnB,oBAAoB,GACpB,oBAAoB,GACpB,oBAAoB,GACpB,oBAAoB,GACpB,wBAAwB,CAAC;AAE7B;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;;;;;;;;;;;OAYG;IACH,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,CAAC;IAE/D;;;OAGG;IACH,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;CAC3D;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,OAAO,EAAE,KAAK,CAAC,gBAAgB,GAAG,OAAO,CAAC,CAAC;IAE3C;;OAEG;IACH,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG,qBAAqB,CAAC,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC;AAE/F,yBAAiB,qBAAqB,CAAC;IACrC;;OAEG;IACH,UAAiB,IAAI;QACnB;;WAEG;QACH,IAAI,EAAE,MAAM,CAAC;KACd;IAED;;OAEG;IACH,UAAiB,OAAO;QACtB;;WAEG;QACH,UAAU,EAAE,MAAM,CAAC;QAEnB;;WAEG;QACH,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAEzB;;WAEG;QACH,IAAI,EAAE,SAAS,CAAC;KACjB;CACF;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAEpB,OAAO,EAAE,MAAM,CAAC;IAEhB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAErB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAEhC;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CACzB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,CAAC;AAE5D;;;;;;;GAOG;AACH,MAAM,MAAM,QAAQ,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,CAAC;AAEjD,MAAM,MAAM,cAAc,GAAG,eAAe,GAAG,uBAAuB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAEvF;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACxB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,cAAc,GAAG,WAAW,GAAG,IAAI,CAAC;IAEvD;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IAEhC;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,GAAG,IAAI,CAAC;IAE1D;;;;OAIG;IACH,IAAI,CAAC,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC,GAAG,UAAU,GAAG,KAAK,CAAC;IAE1C;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,GAAG,IAAI,CAAC;CAClD;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,GAAG,IAAI,CAAC;AAEtG;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC;;OAEG;IACH,IAAI,EAAE,aAAa,CAAC;CACrB;AAED;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC;;OAEG;IACH,WAAW,EAAE,wBAAwB,CAAC,UAAU,CAAC;IAEjD;;OAEG;IACH,IAAI,EAAE,aAAa,CAAC;CACrB;AAED,yBAAiB,wBAAwB,CAAC;IACxC;;OAEG;IACH,UAAiB,UAAU;QACzB;;;WAGG;QACH,IAAI,EAAE,MAAM,CAAC;QAEb;;;WAGG;QACH,WAAW,CAAC,EAAE,MAAM,CAAC;QAErB;;;WAGG;QACH,MAAM,CAAC,EAAE;YAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;SAAE,CAAC;QAEpC;;;;;;WAMG;QACH,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;KACzB;CACF;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,MAAM,WAAW,yBAAyB;IACxC;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,IAAI,EAAE,SAAS,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC;;OAEG;IACH,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED,MAAM,MAAM,cAAc,GACtB,CAAC,MAAM,GAAG,EAAE,CAAC,GACb,SAAS,GACT,QAAQ,GACR,mBAAmB,GACnB,QAAQ,GACR,mBAAmB,GACnB,kBAAkB,GAClB,6BAA6B,GAC7B,uBAAuB,GACvB,kCAAkC,GAClC,sBAAsB,GACtB,iCAAiC,GACjC,aAAa,GACb,wBAAwB,GACxB,aAAa,GACb,WAAW,GACX,sBAAsB,GACtB,mBAAmB,GACnB,0BAA0B,GAC1B,yBAAyB,GACzB,eAAe,CAAC"}
+{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../src/resources/shared.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,SAAS,GACjB,CAAC,MAAM,GAAG,EAAE,CAAC,GACb,SAAS,GACT,QAAQ,GACR,mBAAmB,GACnB,QAAQ,GACR,mBAAmB,GACnB,kBAAkB,GAClB,6BAA6B,GAC7B,uBAAuB,GACvB,kCAAkC,GAClC,sBAAsB,GACtB,iCAAiC,GACjC,aAAa,GACb,wBAAwB,GACxB,aAAa,GACb,WAAW,GACX,sBAAsB,GACtB,mBAAmB,GACnB,0BAA0B,GAC1B,yBAAyB,GACzB,eAAe,CAAC;AAEpB,MAAM,MAAM,SAAS,GACjB,aAAa,GACb,eAAe,GACf,cAAc,GACd,SAAS,GACT,oBAAoB,GACpB,SAAS,GACT,cAAc,GACd,cAAc,GACd,yBAAyB,GACzB,yBAAyB,GACzB,qBAAqB,GACrB,SAAS,GACT,oBAAoB,GACpB,qBAAqB,GACrB,aAAa,GACb,wBAAwB,GACxB,SAAS,GACT,oBAAoB,GACpB,eAAe,GACf,cAAc,GACd,qBAAqB,GACrB,OAAO,GACP,YAAY,GACZ,YAAY,GACZ,kBAAkB,GAClB,uBAAuB,GACvB,uBAAuB,GACvB,mBAAmB,GACnB,SAAS,GACT,cAAc,GACd,cAAc,GACd,oBAAoB,GACpB,yBAAyB,GACzB,yBAAyB,GACzB,SAAS,GACT,oBAAoB,GACpB,IAAI,GACJ,eAAe,GACf,SAAS,GACT,oBAAoB,GACpB,IAAI,GACJ,eAAe,GACf,YAAY,GACZ,uBAAuB,GACvB,SAAS,GACT,oBAAoB,GACpB,QAAQ,GACR,mBAAmB,GACnB,mBAAmB,GACnB,mBAAmB,GACnB,sBAAsB,GACtB,iCAAiC,GACjC,iCAAiC,GACjC,iCAAiC,GACjC,2BAA2B,GAC3B,sCAAsC,GACtC,uBAAuB,GACvB,4BAA4B,GAC5B,kCAAkC,GAClC,uCAAuC,GACvC,mBAAmB,GACnB,mBAAmB,GACnB,aAAa,GACb,wBAAwB,GACxB,aAAa,GACb,wBAAwB,GACxB,oBAAoB,GACpB,qBAAqB,GACrB,oBAAoB,GACpB,sBAAsB,GACtB,OAAO,GACP,YAAY,GACZ,YAAY,GACZ,WAAW,GACX,gBAAgB,GAChB,gBAAgB,GAChB,eAAe,GACf,mBAAmB,GACnB,oBAAoB,GACpB,oBAAoB,GACpB,oBAAoB,GACpB,oBAAoB,GACpB,wBAAwB,CAAC;AAE7B;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;;;;;;;;;;;OAYG;IACH,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,CAAC;IAE/D;;;OAGG;IACH,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;CAC3D;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,OAAO,EAAE,KAAK,CAAC,gBAAgB,GAAG,OAAO,CAAC,CAAC;IAE3C;;OAEG;IACH,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG,qBAAqB,CAAC,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC;AAE/F,yBAAiB,qBAAqB,CAAC;IACrC;;OAEG;IACH,UAAiB,IAAI;QACnB;;WAEG;QACH,IAAI,EAAE,MAAM,CAAC;KACd;IAED;;OAEG;IACH,UAAiB,OAAO;QACtB;;WAEG;QACH,UAAU,EAAE,MAAM,CAAC;QAEnB;;WAEG;QACH,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAEzB;;WAEG;QACH,IAAI,EAAE,SAAS,CAAC;KACjB;CACF;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAEpB,OAAO,EAAE,MAAM,CAAC;IAEhB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAErB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAEhC;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CACzB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,CAAC;AAE5D;;;;;;;GAOG;AACH,MAAM,MAAM,QAAQ,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,CAAC;AAEjD,MAAM,MAAM,cAAc,GAAG,eAAe,GAAG,uBAAuB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAEvF;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,cAAc,GAAG,WAAW,GAAG,IAAI,CAAC;IAEvD;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IAEhC;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,GAAG,IAAI,CAAC;IAE1D;;;;OAIG;IACH,IAAI,CAAC,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC,GAAG,UAAU,GAAG,KAAK,CAAC;IAE1C;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,GAAG,IAAI,CAAC;CAClD;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,GAAG,IAAI,CAAC;AAEtG;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC;;OAEG;IACH,IAAI,EAAE,aAAa,CAAC;CACrB;AAED;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC;;OAEG;IACH,WAAW,EAAE,wBAAwB,CAAC,UAAU,CAAC;IAEjD;;OAEG;IACH,IAAI,EAAE,aAAa,CAAC;CACrB;AAED,yBAAiB,wBAAwB,CAAC;IACxC;;OAEG;IACH,UAAiB,UAAU;QACzB;;;WAGG;QACH,IAAI,EAAE,MAAM,CAAC;QAEb;;;WAGG;QACH,WAAW,CAAC,EAAE,MAAM,CAAC;QAErB;;;WAGG;QACH,MAAM,CAAC,EAAE;YAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;SAAE,CAAC;QAEpC;;;;;;WAMG;QACH,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;KACzB;CACF;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,MAAM,WAAW,yBAAyB;IACxC;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,IAAI,EAAE,SAAS,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC;;OAEG;IACH,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED,MAAM,MAAM,cAAc,GACtB,CAAC,MAAM,GAAG,EAAE,CAAC,GACb,SAAS,GACT,QAAQ,GACR,mBAAmB,GACnB,QAAQ,GACR,mBAAmB,GACnB,kBAAkB,GAClB,6BAA6B,GAC7B,uBAAuB,GACvB,kCAAkC,GAClC,sBAAsB,GACtB,iCAAiC,GACjC,aAAa,GACb,wBAAwB,GACxB,aAAa,GACb,WAAW,GACX,sBAAsB,GACtB,mBAAmB,GACnB,0BAA0B,GAC1B,yBAAyB,GACzB,eAAe,CAAC"}

package/src/_vendor/partial-json-parser/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2023 Promplate Dev Team
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/src/_vendor/partial-json-parser/README.md

@@ -1,3 +1,13 @@
 # Partial JSON Parser
 
-Vendored from https://www.npmjs.com/package/partial-json with some modifications
+Vendored from [`partial-json@0.1.7`](https://www.npmjs.com/package/partial-json/v/0.1.7),
+with local modifications for the SDK's streaming parser.
+
+- Upstream source: https://github.com/promplate/partial-json-parser-js/tree/b65f82c541f5dd7dc17e0764db78fca6a8d2a159
+- Published tarball SHA-256: `30eafeed6fdc25fb2ca24f34c37796d9f98f0bf5e156452b98a2c356762f6322`
+- Upstream license: MIT; the exact published copyright and license notice are in [`LICENSE`](LICENSE).
+
+SDK maintainers own this vendored copy. Updates must review upstream changes,
+preserve local streaming-parser behavior, refresh the exact upstream license,
+record the upstream commit and tarball SHA-256, and verify the license remains in
+the packed SDK.

package/src/auth/index.ts

@@ -1,6 +1,7 @@
 export type {
   WorkloadIdentity,
   X509WorkloadIdentity,
+  X509Credential,
   SubjectTokenProvider,
   TokenExchangeResponse,
 } from './types';

package/src/auth/types.ts

@@ -21,7 +21,7 @@ export interface WorkloadIdentity {
   /** Provider that obtains the external subject token for each token exchange. */
   provider: SubjectTokenProvider;
 
-  /** Seconds before expiration when access-token refresh begins; defaults to 1,200 seconds. */
+  /** Seconds before expiration when access-token refresh begins; defaults to 1,200 seconds and is capped at half of the actual token lifetime. */
   refreshBufferSeconds?: number;
 }
 
@@ -36,7 +36,10 @@ export interface X509WorkloadIdentity {
   /** OpenAI service account authorized for the verified certificate identity. */
   serviceAccountId: string;
 
-  /** Optional milliseconds before expiry when the certificate-backed token should refresh. */
+  /** Seconds before expiration when access-token refresh begins; defaults to 1,200 seconds. */
+  refreshBufferSeconds?: number;
+
+  /** @deprecated Use refreshBufferSeconds to match other workload-identity credentials. */
   refreshBufferMs?: number;
 
   /** X.509 federation proves certificate possession instead of supplying a subject token. */
@@ -44,9 +47,12 @@ export interface X509WorkloadIdentity {
 
   /** X.509 federation does not send an OAuth client identifier. */
   clientId?: never;
+}
 
-  /** X.509 federation does not accept subject-token refresh configuration. */
-  refreshBufferSeconds?: never;
+/** An SDK-owned certificate credential created by the Node-only X.509 authentication helper. */
+export interface X509Credential {
+  /** Closes the credential's owned certificate transport after requests have finished. */
+  close: () => Promise<void>;
 }
 
 /** OAuth token-exchange response returned by the OpenAI workload-identity endpoint. */

package/src/auth/workload-identity-auth.ts

@@ -6,6 +6,7 @@ import { APIError, OAuthError, OpenAIError } from '../core/error';
 interface CachedToken {
   token: string;
   expiresAt: number;
+  refreshAt: number;
 }
 
 const SUBJECT_TOKEN_TYPES: Record<WorkloadIdentity['provider']['tokenType'], string> = {
@@ -14,6 +15,20 @@ const SUBJECT_TOKEN_TYPES: Record<WorkloadIdentity['provider']['tokenType'], str
 };
 
 const TOKEN_EXCHANGE_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:token-exchange';
+// Cap the refresh buffer at half the actual token lifetime, matching the X.509
+// workload-identity path, so short-lived tokens keep a usable cache window.
+const MAX_REFRESH_BUFFER_FRACTION = 0.5;
+
+function calculateRefreshAt(
+  expiresAt: number,
+  now: number,
+  refreshBufferSeconds: number | undefined,
+): number {
+  const configuredBufferMs = (refreshBufferSeconds ?? 1200) * 1000;
+  const effectiveBufferMs = Math.min(configuredBufferMs, (expiresAt - now) * MAX_REFRESH_BUFFER_FRACTION);
+  return expiresAt - effectiveBufferMs;
+}
+
 const NATIVE_RESPONSE_PROTOTYPE = Response.prototype;
 const READ_NATIVE_RESPONSE_BODY = NATIVE_RESPONSE_PROTOTYPE.arrayBuffer;
 
@@ -133,7 +148,17 @@ export class WorkloadIdentityAuth {
    * @param fetch Optional fetch implementation for calls to the OpenAI token endpoint.
    */
   constructor(config: WorkloadIdentity, fetch?: Fetch) {
-    this.config = config;
+    const { identityProviderId, serviceAccountId, clientId, refreshBufferSeconds, provider } = config;
+    this.config = {
+      identityProviderId,
+      serviceAccountId,
+      ...(clientId === undefined ? {} : { clientId }),
+      ...(refreshBufferSeconds === undefined ? {} : { refreshBufferSeconds }),
+      provider: {
+        tokenType: provider.tokenType,
+        getToken: provider.getToken.bind(provider),
+      },
+    };
     this.fetch = fetch ?? Shims.getDefaultFetch();
   }
 
@@ -165,7 +190,7 @@ export class WorkloadIdentityAuth {
       }
     }
 
-    if (this.needsRefresh(this.cachedToken) && !this.refreshPromise) {
+    if (WorkloadIdentityAuth.needsRefresh(this.cachedToken) && !this.refreshPromise) {
       const refreshPromise = this.refreshToken(this.tokenGeneration).finally(() => {
         if (this.refreshPromise === refreshPromise) {
           this.refreshPromise = null;
@@ -250,6 +275,7 @@ export class WorkloadIdentityAuth {
       this.cachedToken = {
         token: accessToken,
         expiresAt,
+        refreshAt: calculateRefreshAt(expiresAt, now, this.config.refreshBufferSeconds),
       };
     }
 
@@ -260,10 +286,8 @@ export class WorkloadIdentityAuth {
     return Date.now() >= cachedToken.expiresAt;
   }
 
-  private needsRefresh(cachedToken: CachedToken): boolean {
-    const bufferSeconds = this.config.refreshBufferSeconds ?? 1200;
-    const bufferMs = bufferSeconds * 1000;
-    return Date.now() >= cachedToken.expiresAt - bufferMs;
+  private static needsRefresh(cachedToken: CachedToken): boolean {
+    return Date.now() >= cachedToken.refreshAt;
   }
 
   /** Discards the cached access token so the next request performs a fresh exchange. */

package/src/auth/x509-transport.ts

@@ -1,15 +1,284 @@
 import { AsyncLocalStorage } from 'node:async_hooks';
+import { createPrivateKey, X509Certificate } from 'node:crypto';
 import { setTimeout as delay } from 'node:timers/promises';
+import { types } from 'node:util';
+import { Agent, ProxyAgent } from 'undici';
 import {
   createX509Transport as createCapability,
   registerX509Transport,
   sendX509Request,
 } from '../internal/auth/x509-transport-capability';
-import type { X509Transport, X509TransportOptions } from '../internal/auth/x509-transport-capability';
+import type {
+  X509ProxyMode,
+  X509Transport,
+  X509TransportOptions,
+} from '../internal/auth/x509-transport-capability';
 import { exchangeX509Token } from '../internal/auth/x509-token-exchange';
 import { isRetryableX509TransportFailure } from '../internal/auth/x509-transport-registry';
 import type { X509RequestScope } from '../internal/auth/x509-transport-registry';
-import { markTransientX509ConnectionError } from '#x509-transport-state';
+import { markTransientX509ConnectionError, rememberX509Credential } from '#x509-transport-state';
+import type { X509Credential, X509WorkloadIdentity } from './types';
+
+/** Explicit, separately trusted CONNECT configuration for an SDK-owned X.509 credential. */
+export interface X509CredentialProxyOptions {
+  /** CONNECT proxy endpoint; its protocol must match the selected mode. */
+  url: string | URL;
+
+  /** Whether the connection to the CONNECT proxy itself is encrypted. */
+  mode: Exclude<X509ProxyMode, 'direct'>;
+
+  /** Optional private trust roots for the HTTPS proxy; never used for workload TLS. */
+  ca?: string | string[] | undefined;
+}
+
+/** Private certificate material and enrolled selectors for one SDK-owned workload credential. */
+export interface X509CredentialOptions {
+  /** Leaf client certificate followed by its required PEM intermediate chain. */
+  certificateChain: string;
+
+  /** PEM private key matching the leaf client certificate. */
+  privateKey: string;
+
+  /** Existing OpenAI identity-provider resource enrolled for the certificate. */
+  identityProviderId: string;
+
+  /** OpenAI service account authorized for the verified certificate identity. */
+  serviceAccountId: string;
+
+  /** Optional private certificate authorities trusted for OpenAI's issuer and API. */
+  ca?: string | string[] | undefined;
+
+  /** Optional passphrase used to decrypt an encrypted PEM private key. */
+  passphrase?: string | undefined;
+
+  /** Optional CONNECT proxy with separately scoped target and proxy TLS settings. */
+  proxy?: X509CredentialProxyOptions | undefined;
+
+  /** Seconds before expiration when access-token refresh begins; defaults to 1,200. */
+  refreshBufferSeconds?: number | undefined;
+}
+
+const credentialOptionNames = new Set([
+  'certificateChain',
+  'privateKey',
+  'identityProviderId',
+  'serviceAccountId',
+  'ca',
+  'passphrase',
+  'proxy',
+  'refreshBufferSeconds',
+]);
+const proxyOptionNames = new Set(['url', 'mode', 'ca']);
+
+function safeOptionRecord(
+  value: unknown,
+  allowed: ReadonlySet<string>,
+  label: string,
+): Record<string, unknown> {
+  if (!value || typeof value !== 'object' || types.isProxy(value)) {
+    throw new Error(`X.509 ${label} options must be a non-proxy object.`);
+  }
+  const prototype: unknown = Object.getPrototypeOf(value);
+  if (prototype !== Object.prototype && prototype !== null) {
+    throw new Error(`X.509 ${label} options must have only own plain data properties.`);
+  }
+  const snapshot = Object.create(null) as Record<string, unknown>;
+  for (const name of Reflect.ownKeys(value)) {
+    if (typeof name !== 'string' || !allowed.has(name)) {
+      throw new Error(`Unsupported X.509 ${label} option: \`${String(name)}\`.`);
+    }
+    const descriptor = Object.getOwnPropertyDescriptor(value, name);
+    if (!descriptor || !('value' in descriptor)) {
+      throw new Error(`X.509 ${label} option \`${name}\` must be a plain data property.`);
+    }
+    snapshot[name] = descriptor.value;
+  }
+  return snapshot;
+}
+
+function requiredCredentialValue(options: Record<string, unknown>, name: string): string {
+  const value = options[name];
+  if (typeof value !== 'string' || value.trim().length === 0) {
+    throw new Error(`X.509 credential requires a nonempty own \`${name}\` value.`);
+  }
+  return value;
+}
+
+function snapshotCertificateAuthorities(value: unknown): string | string[] | undefined {
+  if (value === undefined) {
+    return undefined;
+  }
+  if (typeof value === 'string') {
+    if (value.trim().length === 0) {
+      throw new Error('X.509 certificate authorities must contain nonempty PEM values.');
+    }
+    return value;
+  }
+  if (!Array.isArray(value) || types.isProxy(value) || value.length === 0) {
+    throw new Error('X.509 certificate authorities must be a PEM string or plain PEM string array.');
+  }
+  const authorities: string[] = [];
+  for (let index = 0; index < value.length; index += 1) {
+    const entry = Object.getOwnPropertyDescriptor(value, String(index));
+    if (!entry || !('value' in entry) || typeof entry.value !== 'string' || entry.value.trim().length === 0) {
+      throw new Error('X.509 certificate authorities require own plain nonempty PEM strings.');
+    }
+    authorities.push(entry.value);
+  }
+  return authorities;
+}
+
+class OwnedX509Credential implements X509Credential {
+  readonly #dispatcher: Agent | ProxyAgent;
+  #closing: Promise<void> | undefined;
+
+  constructor(dispatcher: Agent | ProxyAgent) {
+    this.#dispatcher = dispatcher;
+    Object.freeze(this);
+  }
+
+  /** Closes this credential's owned transport once all in-flight requests have drained. */
+  close(): Promise<void> {
+    this.#closing ??= this.#dispatcher.close();
+    return this.#closing;
+  }
+}
+
+interface ValidatedX509CredentialOptions {
+  certificateChain: string;
+  privateKey: string;
+  identityProviderId: string;
+  serviceAccountId: string;
+  refreshBufferSeconds: number | undefined;
+  passphrase: string | undefined;
+  ca: string | string[] | undefined;
+  proxy: unknown;
+}
+
+function validatedCredentialOptions(options: X509CredentialOptions): ValidatedX509CredentialOptions {
+  const configured = safeOptionRecord(options, credentialOptionNames, 'credential');
+  const certificateChain = requiredCredentialValue(configured, 'certificateChain');
+  const privateKeyPEM = requiredCredentialValue(configured, 'privateKey');
+  const identityProviderId = requiredCredentialValue(configured, 'identityProviderId');
+  const serviceAccountId = requiredCredentialValue(configured, 'serviceAccountId');
+  const { refreshBufferSeconds, passphrase } = configured;
+  if (passphrase !== undefined && typeof passphrase !== 'string') {
+    throw new Error('X.509 credential requires a string private-key passphrase.');
+  }
+  if (
+    refreshBufferSeconds !== undefined &&
+    (typeof refreshBufferSeconds !== 'number' ||
+      !Number.isSafeInteger(refreshBufferSeconds) ||
+      refreshBufferSeconds < 0 ||
+      !Number.isSafeInteger(refreshBufferSeconds * 1000))
+  ) {
+    throw new Error('X.509 credential requires a nonnegative integer refreshBufferSeconds.');
+  }
+  const ca = snapshotCertificateAuthorities(configured['ca']);
+
+  const leaf = new X509Certificate(certificateChain);
+  const privateKey = createPrivateKey({
+    key: privateKeyPEM,
+    ...(passphrase === undefined ? {} : { passphrase }),
+  });
+  if (!leaf.checkPrivateKey(privateKey)) {
+    throw new Error('X.509 credential private key must match its leaf client certificate.');
+  }
+
+  return {
+    certificateChain,
+    privateKey: privateKeyPEM,
+    identityProviderId,
+    serviceAccountId,
+    refreshBufferSeconds,
+    passphrase,
+    ca,
+    proxy: configured['proxy'],
+  };
+}
+
+interface VerifiedX509TLSOptions {
+  cert: string;
+  key: string;
+  rejectUnauthorized: true;
+  passphrase?: string;
+  ca?: string | string[];
+}
+
+function proxyAuthentication(url: URL): string | undefined {
+  if (url.username === '' && url.password === '') {
+    return undefined;
+  }
+  let username: string;
+  let password: string;
+  try {
+    username = decodeURIComponent(url.username);
+    password = decodeURIComponent(url.password);
+  } catch {
+    throw new Error('X.509 CONNECT proxy credentials contain invalid URL encoding.');
+  }
+  if (username.includes(':')) {
+    throw new Error('X.509 CONNECT proxy username cannot contain a colon.');
+  }
+  return Buffer.from(`${username}:${password}`, 'utf-8').toString('base64');
+}
+
+function normalizeProxyURL(value: unknown): URL {
+  if (typeof value !== 'string' && (typeof value !== 'object' || value === null || types.isProxy(value))) {
+    throw new Error('X.509 CONNECT proxy requires an own URL string or URL value.');
+  }
+  try {
+    return new URL(typeof value === 'string' ? value : URL.prototype.toString.call(value));
+  } catch {
+    throw new Error('X.509 CONNECT proxy requires a valid proxy URL.');
+  }
+}
+
+function credentialDispatcher(
+  proxyOptionsInput: unknown,
+  requestTls: VerifiedX509TLSOptions,
+): { dispatcher: Agent | ProxyAgent; proxy: X509ProxyMode } {
+  if (proxyOptionsInput === undefined) {
+    return { dispatcher: new Agent({ connect: requestTls }), proxy: 'direct' };
+  }
+
+  const proxyOptions = safeOptionRecord(proxyOptionsInput, proxyOptionNames, 'proxy');
+  const url = normalizeProxyURL(proxyOptions['url']);
+  const selected = proxyOptions['mode'];
+  const proxy: X509ProxyMode =
+    selected === 'http-connect' || selected === 'https-connect' ? selected : 'direct';
+  if (
+    (proxy !== 'http-connect' && proxy !== 'https-connect') ||
+    url.protocol !== (proxy === 'https-connect' ? 'https:' : 'http:') ||
+    url.pathname !== '/' ||
+    url.search ||
+    url.hash
+  ) {
+    throw new Error('X.509 CONNECT proxy URL protocol must match its selected secure proxy mode.');
+  }
+  const proxyCA = snapshotCertificateAuthorities(proxyOptions['ca']);
+  if (proxy === 'http-connect' && proxyCA !== undefined) {
+    throw new Error('A plaintext X.509 CONNECT proxy cannot configure proxy TLS authorities.');
+  }
+  const auth = proxyAuthentication(url);
+
+  return {
+    proxy,
+    dispatcher: new ProxyAgent({
+      uri: url.href,
+      ...(auth === undefined ? {} : { auth }),
+      requestTls,
+      ...(proxy === 'https-connect'
+        ? {
+            proxyTls: {
+              rejectUnauthorized: true,
+              ...(proxyCA === undefined ? {} : { ca: proxyCA }),
+            },
+          }
+        : {}),
+    }),
+  };
+}
 
 /** Creates one frozen, caller-attested Node.js transport for X.509 workload authentication. */
 export function createX509Transport(options: X509TransportOptions): X509Transport {
@@ -42,6 +311,46 @@ export function createX509Transport(options: X509TransportOptions): X509Transpor
   return capability;
 }
 
+/** Creates a first-class certificate credential with SDK-owned, verified TLS and CONNECT policy. */
+export function fromX509(options: X509CredentialOptions): X509Credential {
+  const configured = validatedCredentialOptions(options);
+
+  const requestTls = {
+    cert: configured.certificateChain,
+    key: configured.privateKey,
+    rejectUnauthorized: true as const,
+    ...(configured.passphrase === undefined ? {} : { passphrase: configured.passphrase }),
+    ...(configured.ca === undefined ? {} : { ca: configured.ca }),
+  };
+  const { dispatcher, proxy } = credentialDispatcher(configured.proxy, requestTls);
+
+  try {
+    const transport = createX509Transport({
+      runtime: 'node',
+      dispatcher,
+      certificateIdentity: 'static',
+      proxy,
+    });
+    const identity: X509WorkloadIdentity = Object.freeze({
+      type: 'x509',
+      identityProviderId: configured.identityProviderId,
+      serviceAccountId: configured.serviceAccountId,
+      ...(configured.refreshBufferSeconds === undefined
+        ? {}
+        : { refreshBufferSeconds: configured.refreshBufferSeconds }),
+    });
+    const credential = new OwnedX509Credential(dispatcher);
+    rememberX509Credential(credential, Object.freeze({ identity, transport }));
+    return credential;
+  } catch (error) {
+    void dispatcher.close();
+    throw error;
+  }
+}
+
+/** Namespaced first-class credential factory, isolated from ordinary browser-safe auth imports. */
+export const workloadIdentity = Object.freeze({ fromX509 });
+
 export type {
   X509ProxyMode,
   X509Transport,

package/src/azure.ts

@@ -13,7 +13,7 @@ import { assertNoDataResidency } from './internal/data-residency';
 /** API Client for interfacing with the Azure OpenAI API. */
 export interface AzureClientOptions extends Omit<
   ClientOptions,
-  'provider' | 'dataResidency' | 'workloadIdentity' | 'x509Transport'
+  'provider' | 'dataResidency' | 'credential' | 'workloadIdentity' | 'x509Transport'
 > {
   /** AzureOpenAI does not support third-party provider configuration. */
   provider?: never;
@@ -21,6 +21,9 @@ export interface AzureClientOptions extends Omit<
   /** OpenAI data residency cannot be combined with Azure routing. */
   dataResidency?: never;
 
+  /** Azure cannot receive an SDK-owned OpenAI X.509 certificate credential. */
+  credential?: never;
+
   /** Azure cannot receive OpenAI X.509 workload-identity certificate transports. */
   x509Transport?: never;
 

package/src/bedrock.ts

@@ -20,7 +20,7 @@ import type * as ResponsesAPI from './resources/responses/responses';
 /** Configures Amazon Bedrock's OpenAI-compatible endpoint and bearer-token authentication. */
 export interface BedrockClientOptions extends Omit<
   ClientOptions,
-  'apiKey' | 'adminAPIKey' | 'baseURL' | 'workloadIdentity' | 'x509Transport' | 'dataResidency'
+  'apiKey' | 'adminAPIKey' | 'baseURL' | 'credential' | 'workloadIdentity' | 'x509Transport' | 'dataResidency'
 > {
   /**
    * Bedrock bearer token used for authentication.
@@ -46,6 +46,9 @@ export interface BedrockClientOptions extends Omit<
   /** OpenAI data residency cannot be combined with Bedrock routing. */
   dataResidency?: never;
 
+  /** Bedrock cannot receive an SDK-owned OpenAI X.509 certificate credential. */
+  credential?: never;
+
   /**
    * BedrockOpenAI only supports Bedrock bearer token authentication.
    */

package/src/beta/realtime/ws.ts

@@ -3,6 +3,7 @@ import { assertBedrockWebSocketOrigin } from '../../internal/bedrock';
 import { protectWebSocketOptionsFromCredentialRedirects } from '../../internal/ws';
 import type { AzureOpenAI } from '../../index';
 import { OpenAI } from '../../index';
+import { VERSION } from '../../version';
 import type { RealtimeClientEvent } from '../../resources/beta/realtime/realtime';
 import { OpenAIRealtimeEmitter, buildRealtimeURL, isAzure, parseRealtimeEvent } from './internal-base';
 import type { RealtimeConnectionConfig } from './internal-base';
@@ -68,6 +69,7 @@ export class OpenAIRealtimeWS extends OpenAIRealtimeEmitter {
     assertTrustedRealtimeURL(client, this.url);
     assertBedrockWebSocketOrigin(client, this.url);
     const headers = {
+      'User-Agent': `${client.constructor.name}/JS ${VERSION}`,
       ...props.options?.headers,
       ...(isAzure(client) && !props.__resolvedApiKey ? {} : { Authorization: `Bearer ${client.apiKey}` }),
       'OpenAI-Beta': 'realtime=v1',