openai 7.7.0 → 7.9.0

package/src/client.ts

@@ -17,17 +17,20 @@ import { resolveDataResidency, type DataResidency } from './internal/data-reside
 export type { DataResidency } from './internal/data-residency';
 import * as Errors from './core/error';
 import * as Pagination from './core/pagination';
-import type { WorkloadIdentity, X509WorkloadIdentity } from './auth/types';
+import type { WorkloadIdentity, X509Credential, X509WorkloadIdentity } from './auth/types';
 import { WorkloadIdentityAuth } from './auth/workload-identity-auth';
+import { X509_API_BASE_URL, assertX509APIOrigin } from './internal/auth/x509-api-origin';
 import {
-  X509_API_BASE_URL,
   X509WorkloadIdentityAuth,
-  assertX509APIOrigin,
   assertX509RequestOptions,
   isX509WorkloadIdentity,
   snapshotX509RequestOptions,
 } from './internal/auth/x509-workload-identity-auth';
 import type { X509Transport } from './internal/auth/x509-transport-registry';
+import {
+  normalizeX509CredentialOptions,
+  prepareX509ClientClone,
+} from './internal/auth/x509-credential-options';
 import { isTransientX509ConnectionError, markApprovedX509Client } from '#x509-transport-state';
 import { OAuthError, SubjectTokenProviderError } from './core/error';
 import {
@@ -258,6 +261,7 @@ import {
   formatRequestDetails,
   loggerFor,
   parseLogLevel,
+  redactURL,
 } from './internal/utils/log';
 import { isEmptyObj } from './internal/utils/values';
 
@@ -430,6 +434,9 @@ export interface ClientOptions {
   /** Approved, frozen Node.js certificate transport required only for X.509 workload identity. */
   x509Transport?: X509Transport | undefined;
 
+  /** First-class certificate credential created with `fromX509` from `openai/auth/x509-transport`. */
+  credential?: X509Credential | undefined;
+
   /**
    * Configure this client to use a third-party API provider.
    * Mutually exclusive with top-level authentication and `baseURL` options.
@@ -457,6 +464,7 @@ export class OpenAI {
   private fetch: Fetch;
   #encoder: Opts.RequestEncoder;
   #x509Authentication: X509WorkloadIdentityAuth | undefined;
+  #x509Credential: X509Credential | undefined;
   #x509Fetch: Fetch | undefined;
   // Preserve an explicit global selection without storing a second routing URL.
   #explicitDataResidency = false;
@@ -495,6 +503,8 @@ export class OpenAI {
    * @param {boolean} [opts.dangerouslyAllowBrowser=false] - By default, client-side use of this library is not allowed, as it risks exposing your secret API credentials to attackers.
    */
   constructor(clientOptions: ClientOptions = {}) {
+    const { credential, options: normalizedOptions } = normalizeX509CredentialOptions(clientOptions);
+    clientOptions = normalizedOptions;
     const residencyBaseURL = resolveDataResidency(clientOptions);
     const provider = clientOptions.provider;
     const {
@@ -508,6 +518,7 @@ export class OpenAI {
       webhookSecret = readEnv('OPENAI_WEBHOOK_SECRET') ?? null,
       workloadIdentity,
       x509Transport,
+      credential: _credential,
       ...opts
     } = clientOptions as InternalClientOptions;
     if (provider) {
@@ -601,7 +612,7 @@ export class OpenAI {
     this.fetch = options.fetch ?? Shims.getDefaultFetch();
     this.#encoder = Opts.FallbackEncoder;
 
-    const customHeadersEnv = provider ? undefined : readEnv('OPENAI_CUSTOM_HEADERS');
+    const customHeadersEnv = provider || credential ? undefined : readEnv('OPENAI_CUSTOM_HEADERS');
     if (customHeadersEnv) {
       const parsed: Record<string, string> = {};
       for (const line of customHeadersEnv.split('\n')) {
@@ -620,6 +631,7 @@ export class OpenAI {
       const authentication = new X509WorkloadIdentityAuth(x509Identity, x509Transport, organization, project);
       this._workloadIdentityAuth = authentication;
       this.#x509Authentication = authentication;
+      this.#x509Credential = credential;
       this.#x509Fetch = authentication.fetch();
       this.fetch = this.#x509Fetch;
       markApprovedX509Client(this);
@@ -639,8 +651,6 @@ export class OpenAI {
    */
   withOptions(options: Partial<ClientOptions>): this {
     const residencyBaseURL = resolveDataResidency(options);
-    const inheritedProvider = this._options.provider;
-    const provider = options.provider ?? inheritedProvider;
     const x509Authentication = this.#x509Authentication;
     const inheritedOptions: ClientOptions = {
       ...this._options,
@@ -659,47 +669,41 @@ export class OpenAI {
       project: this.project,
       webhookSecret: this.webhookSecret,
     };
-    const currentlyX509 = x509Authentication !== undefined;
-    const nextIdentity = hasOwn(options, 'workloadIdentity')
-      ? options.workloadIdentity
-      : inheritedOptions.workloadIdentity;
-    const nextX509 = isX509WorkloadIdentity(nextIdentity);
-    if (currentlyX509 !== nextX509) {
-      delete inheritedOptions.fetch;
-      delete inheritedOptions.baseURL;
-      if (nextX509) {
-        inheritedOptions.apiKey = null;
-      } else {
-        delete inheritedOptions.x509Transport;
-      }
-    }
+    const { credential, provider } = prepareX509ClientClone(
+      inheritedOptions,
+      options,
+      this.#x509Credential,
+      x509Authentication !== undefined,
+    );
     if (residencyBaseURL !== undefined) {
       delete inheritedOptions.baseURL;
     }
-    if (provider) {
-      delete inheritedOptions.apiKey;
-      delete inheritedOptions.adminAPIKey;
-      delete inheritedOptions.workloadIdentity;
-      delete inheritedOptions.x509Transport;
-      delete inheritedOptions.baseURL;
-      if (provider !== inheritedProvider) {
-        delete inheritedOptions.organization;
-        delete inheritedOptions.project;
-        delete inheritedOptions.defaultHeaders;
-      }
-    }
 
     const clientOptions: InternalClientOptions = {
       ...inheritedOptions,
       ...options,
+      credential,
       provider,
       [inheritedDataResidencySelection]:
         this.#explicitDataResidency &&
         residencyBaseURL === undefined &&
         !hasOwn(options, 'baseURL') &&
+        options.credential === undefined &&
         !provider,
     };
     const client = new (this.constructor as any as new (props: ClientOptions) => typeof this)(clientOptions);
+    if (provider && new URL(client.baseURL).origin !== new URL(this.baseURL).origin) {
+      Object.assign(client._options, {
+        defaultHeaders: options.defaultHeaders,
+        defaultQuery: options.defaultQuery,
+        fetchOptions: options.fetchOptions,
+        fetch: options.fetch,
+      });
+      client.fetchOptions = options.fetchOptions;
+      client.fetch = options.fetch ?? Shims.getDefaultFetch();
+      client.organization = options.organization ?? null;
+      client.project = options.project ?? null;
+    }
     if (
       this.#x509Authentication &&
       client.#x509Authentication &&
@@ -1151,9 +1155,10 @@ export class OpenAI {
       retriesRemaining = maxRetries;
     }
 
+    const x509Authentication = this.#x509Authentication;
+    x509Authentication?.beginRequestPreparation();
     await this.prepareOptions(options);
 
-    const x509Authentication = this.#x509Authentication;
     x509Authentication?.beginRequestPlanning();
     let built: { req: FinalizedRequestInit; url: string; timeout: number };
     try {
@@ -1346,7 +1351,7 @@ export class OpenAI {
       .filter(([name]) => name === 'x-request-id')
       .map(([name, value]) => ', ' + name + ': ' + JSON.stringify(value))
       .join('');
-    const responseInfo = `[${requestLogID}${retryLogStr}${specialHeaders}] ${req.method} ${url} ${
+    const responseInfo = `[${requestLogID}${retryLogStr}${specialHeaders}] ${req.method} ${redactURL(url)} ${
       response.ok ? 'succeeded' : 'failed'
     } with status ${response.status} in ${headersTime - startTime}ms`;
 

package/src/core/EventEmitter.ts

@@ -186,11 +186,20 @@ export class EventEmitter<EventTypes extends Record<string, (...args: any) => an
         }
         return !listener.once && !listener.removed;
       }) as any;
+      let listenerThrew = false;
+      let firstListenerError: unknown;
       this.#listenerDispatchDepth += 1;
       try {
         for (const registration of listeners as any) {
           if (!registration.removed) {
-            registration.listener(...(args as any));
+            try {
+              registration.listener(...(args as any));
+            } catch (error) {
+              if (!listenerThrew) {
+                listenerThrew = true;
+                firstListenerError = error;
+              }
+            }
           }
         }
       } finally {
@@ -199,6 +208,9 @@ export class EventEmitter<EventTypes extends Record<string, (...args: any) => an
           this.#cleanupEmittedListeners();
         }
       }
+      if (listenerThrew) {
+        throw firstListenerError;
+      }
     }
   }
 

package/src/internal/auth/x509-api-origin.ts

@@ -0,0 +1,27 @@
+import { OpenAIError } from '../../core/error';
+import { isSensitiveQueryParameter } from '../utils/log';
+
+/** Sole API authority approved for OpenAI X.509 workload-identity federation. */
+export const X509_API_BASE_URL = 'https://mtls.api.openai.com/v1';
+
+/** Validates the enrolled API authority and rejects credential-bearing query parameters. */
+export function assertX509APIOrigin(value: string | URL): URL {
+  let target: URL;
+  try {
+    target = new URL(value);
+  } catch {
+    throw new OpenAIError('X.509 workload identity requires the approved global mTLS API origin.');
+  }
+
+  if (target.origin !== 'https://mtls.api.openai.com' || target.username || target.password) {
+    throw new OpenAIError('X.509 workload identity requires the approved global mTLS API origin.');
+  }
+  for (const name of target.searchParams.keys()) {
+    if (isSensitiveQueryParameter(name)) {
+      throw new OpenAIError(
+        'X.509 workload identity cannot send conflicting query authentication credentials.',
+      );
+    }
+  }
+  return target;
+}

package/src/internal/auth/x509-credential-options.ts

@@ -0,0 +1,146 @@
+import { OpenAIError } from '../../core/error';
+import type { ClientOptions } from '../../client';
+import type { X509Credential } from '../../auth/types';
+import { hasOwn } from '../utils/values';
+import { isX509WorkloadIdentity } from './x509-workload-identity-auth';
+import type { RegisteredX509Credential } from './x509-transport-registry';
+import { findX509Credential } from '#x509-transport-state';
+
+/** Validates one privately registered credential and suppresses ambient legacy authentication. */
+export function normalizeX509CredentialOptions(options: ClientOptions): {
+  credential: X509Credential | undefined;
+  options: ClientOptions;
+} {
+  const { credential } = options;
+  if (credential === undefined) {
+    return { credential, options };
+  }
+
+  const registered: RegisteredX509Credential | undefined = findX509Credential(credential);
+  if (!registered) {
+    throw new OpenAIError('An X.509 credential must be created by the SDK authentication helper.');
+  }
+  const conflicting = (['apiKey', 'adminAPIKey', 'workloadIdentity', 'x509Transport'] as const).filter(
+    (name) => {
+      const value = options[name];
+      return value !== null && value !== undefined;
+    },
+  );
+  if (conflicting.length > 0) {
+    throw new OpenAIError(
+      `The \`credential\` option cannot be combined with ${conflicting.map((name) => `\`${name}\``).join(', ')}.`,
+    );
+  }
+
+  return {
+    credential,
+    options: {
+      ...options,
+      apiKey: null,
+      adminAPIKey: null,
+      baseURL: options.baseURL ?? null,
+      organization: options.organization ?? null,
+      project: options.project ?? null,
+      workloadIdentity: registered.identity,
+      x509Transport: registered.transport,
+    },
+  };
+}
+
+/** Distinguishes explicitly supplied ordinary credentials from nullish inheritance. */
+function overridesOrdinaryAuthentication({ apiKey, adminAPIKey }: Partial<ClientOptions>): boolean {
+  return (apiKey !== null && apiKey !== undefined) || (adminAPIKey !== null && adminAPIKey !== undefined);
+}
+
+/** Keeps origin-bound configuration with its owning provider during a client clone. */
+function prepareProviderClone(
+  inherited: ClientOptions,
+  overrides: Partial<ClientOptions>,
+): ClientOptions['provider'] {
+  const inheritedProvider = inherited.provider;
+  const replacingProvider = overrides.credential ?? overrides.workloadIdentity;
+  const provider = overrides.provider ?? (replacingProvider ? undefined : inheritedProvider);
+
+  if (provider !== inheritedProvider) {
+    delete inherited.baseURL;
+    delete inherited.organization;
+    delete inherited.project;
+    delete inherited.defaultHeaders;
+    delete inherited.defaultQuery;
+    delete inherited.fetchOptions;
+    delete inherited.fetch;
+  }
+  if (provider) {
+    delete inherited.apiKey;
+    delete inherited.adminAPIKey;
+    delete inherited.credential;
+    delete inherited.workloadIdentity;
+    delete inherited.x509Transport;
+    delete inherited.baseURL;
+  }
+  return provider;
+}
+
+/** Reconciles one client's credential and provider ownership before cloning its options. */
+export function prepareX509ClientClone(
+  inherited: ClientOptions,
+  overrides: Partial<ClientOptions>,
+  credential: X509Credential | undefined,
+  currentlyX509: boolean,
+): { credential: X509Credential | undefined; provider: ClientOptions['provider'] } {
+  const nextIdentity = hasOwn(overrides, 'workloadIdentity')
+    ? overrides.workloadIdentity
+    : inherited.workloadIdentity;
+  const dropping =
+    credential !== undefined &&
+    ((overridesOrdinaryAuthentication(overrides) && overrides.workloadIdentity === undefined) ||
+      overrides.provider !== undefined);
+  if (credential !== undefined && hasOwn(overrides, 'workloadIdentity')) {
+    delete inherited.x509Transport;
+  }
+  const inheritedCredential =
+    credential !== undefined &&
+    !dropping &&
+    overrides.credential === undefined &&
+    !hasOwn(overrides, 'workloadIdentity') &&
+    !hasOwn(overrides, 'x509Transport')
+      ? credential
+      : undefined;
+  const nextCredential = overrides.credential === undefined ? inheritedCredential : overrides.credential;
+  const nextX509 = nextCredential !== undefined || (!dropping && isX509WorkloadIdentity(nextIdentity));
+
+  if (currentlyX509 !== nextX509) {
+    delete inherited.fetch;
+    delete inherited.baseURL;
+    delete inherited.organization;
+    delete inherited.project;
+    delete inherited.defaultHeaders;
+    delete inherited.defaultQuery;
+    delete inherited.fetchOptions;
+    if (nextX509) {
+      inherited.apiKey = null;
+    } else {
+      delete inherited.x509Transport;
+      if (dropping) {
+        delete inherited.workloadIdentity;
+      }
+    }
+  }
+
+  if (nextCredential !== undefined) {
+    delete inherited.apiKey;
+    delete inherited.adminAPIKey;
+    delete inherited.workloadIdentity;
+    delete inherited.x509Transport;
+    inherited.credential = nextCredential;
+    if (overrides.credential !== undefined) {
+      delete inherited.organization;
+      delete inherited.project;
+      delete inherited.defaultHeaders;
+      delete inherited.defaultQuery;
+      delete inherited.fetchOptions;
+    }
+  }
+
+  return { credential: nextCredential, provider: prepareProviderClone(inherited, overrides) };
+}

package/src/internal/auth/x509-transport-capability.ts

@@ -15,7 +15,13 @@ export interface X509TransportOptions {
   /** X.509 transport currently supports genuine Node.js runtimes only. */
   runtime: 'node';
 
-  /** Caller-owned Undici Agent or ProxyAgent; the SDK never closes or inspects it. */
+  /**
+   * Caller-owned Undici Agent or ProxyAgent; the SDK never closes or inspects it.
+   *
+   * The application attests that its dispatcher, factories, TLS verification,
+   * certificate selection, and CONNECT proxy configuration are trustworthy.
+   * Use `fromX509` when the SDK should own and enforce transport configuration.
+   */
   dispatcher: Agent | ProxyAgent;
 
   /** Attests that the dispatcher uses one static workload-certificate identity. */
@@ -150,10 +156,11 @@ function assertConnectProxySupport(): void {
  * `certificateIdentity: 'static'` is an application attestation: the SDK does
  * not inspect certificates, private dispatcher internals, callbacks, or TLS
  * options and cannot cryptographically prove certificate selection. Configure
- * one static identity without custom dispatcher factories. For HTTPS CONNECT,
- * independently configure `proxyTls` and `requestTls` so workload credentials
- * never reach the proxy. Rotation requires creating a fresh dispatcher and
- * capability; the application remains responsible for draining the old one.
+ * trusted dispatcher factories, verified target and proxy TLS, one static
+ * certificate identity, and independently scoped CONNECT credentials.
+ * Prefer the SDK-owned `fromX509` credential when these guarantees should be
+ * enforced at construction. Rotation requires a fresh caller-owned dispatcher
+ * and capability; the application remains responsible for draining it.
  *
  * This Node-only preview entrypoint requires the optional `undici` peer at
  * version 5.2.0 or later. CONNECT proxy modes require version 5.5.1 or

package/src/internal/auth/x509-transport-registry.ts

@@ -1,5 +1,6 @@
 import { OpenAIError } from '../../core/error';
 import type { NullableHeaders } from '../headers';
+import type { X509WorkloadIdentity } from '../../auth/types';
 import type { ReadableStream } from '../shim-types';
 import type { MergedRequestInit } from '../types';
 import { findRegisteredX509Transport } from '#x509-transport-state';
@@ -49,6 +50,12 @@ export interface X509Transport {
   readonly [x509TransportBrand]: true;
 }
 
+/** Immutable selectors and transport privately registered for an SDK-owned credential. */
+export interface RegisteredX509Credential {
+  readonly identity: X509WorkloadIdentity;
+  readonly transport: X509Transport;
+}
+
 /** Validated short-lived token exchanged using a registered certificate identity. */
 export interface X509ExchangedToken {
   /** Header-safe, in-memory OpenAI bearer credential. */
@@ -63,6 +70,8 @@ export interface X509RequestScope {
   wallStartedAt: number;
   monotonicStartedAt: number;
   deadlineArmed?: boolean;
+  preparationStartedAt?: number;
+  preparationWallStartedAt?: number;
   request?: { signal: AbortSignal | null | undefined; timeout: number; fetchOptions: MergedRequestInit };
   phase?: 'planning' | 'authorizing';
   effectiveSignal?: AbortSignal;

package/src/internal/auth/x509-transport-state-browser.ts

@@ -4,6 +4,7 @@ const transientX509ConnectionErrors = new WeakSet();
 const retryableX509IssuerErrors = new WeakSet();
 const approvedX509Clients = new WeakSet();
 const approvedX509OAuthErrors = new WeakMap();
+const approvedX509Credentials = new WeakMap();
 
 /** Looks up an opaque capability without exposing the registry itself. */
 export const findRegisteredX509Transport = WeakMap.prototype.get.bind(registeredX509Transports);
@@ -34,3 +35,9 @@ export const rememberX509OAuthError = WeakMap.prototype.set.bind(approvedX509OAu
 
 /** Retrieves trusted metadata when public OAuth errors cross module formats. */
 export const findX509OAuthError = WeakMap.prototype.get.bind(approvedX509OAuthErrors);
+
+/** Privately binds SDK-owned credentials without importing Node or optional transport peers. */
+export const rememberX509Credential = WeakMap.prototype.set.bind(approvedX509Credentials);
+
+/** Resolves only credentials registered by the optional Node authentication helper. */
+export const findX509Credential = WeakMap.prototype.get.bind(approvedX509Credentials);

package/src/internal/auth/x509-transport-state.cts

@@ -4,6 +4,7 @@ const transientX509ConnectionErrors = new WeakSet();
 const retryableX509IssuerErrors = new WeakSet();
 const approvedX509Clients = new WeakSet();
 const approvedX509OAuthErrors = new WeakMap();
+const approvedX509Credentials = new WeakMap();
 
 /** Looks up an opaque capability without exposing the registry itself. */
 export const findRegisteredX509Transport = WeakMap.prototype.get.bind(registeredX509Transports);
@@ -34,3 +35,9 @@ export const rememberX509OAuthError = WeakMap.prototype.set.bind(approvedX509OAu
 
 /** Retrieves trusted OAuth metadata for public cross-module error normalization. */
 export const findX509OAuthError = WeakMap.prototype.get.bind(approvedX509OAuthErrors);
+
+/** Privately binds SDK-owned credentials to their immutable identity and approved transport. */
+export const rememberX509Credential = WeakMap.prototype.set.bind(approvedX509Credentials);
+
+/** Resolves only first-class credentials created by the optional Node transport helper. */
+export const findX509Credential = WeakMap.prototype.get.bind(approvedX509Credentials);

package/src/internal/auth/x509-workload-identity-auth.ts

@@ -6,7 +6,9 @@ import type { HeadersLike, NullableHeaders } from '../headers';
 import type { FinalRequestOptions } from '../request-options';
 import { CancelReadableStream } from '../shims';
 import type { MergedRequestInit } from '../types';
+import { isSensitiveHeader } from '../utils/log';
 import { hasOwn } from '../utils/values';
+import { assertX509APIOrigin } from './x509-api-origin';
 import { resolveX509Transport } from './x509-transport-registry';
 import {
   isApprovedX509Client,
@@ -21,10 +23,6 @@ import type {
   X509Transport,
 } from './x509-transport-registry';
 
-/** Sole API authority approved for OpenAI X.509 workload-identity federation. */
-export const X509_API_BASE_URL = 'https://mtls.api.openai.com/v1';
-
-const X509_API_ORIGIN = 'https://mtls.api.openai.com';
 const FORBIDDEN_TRANSPORT_OPTIONS = ['dispatcher', 'agent', 'client', 'tls', 'proxy'];
 const headerValue = (headers: Headers, name: string): string | null =>
   Headers.prototype.get.call(headers, name);
@@ -39,12 +37,7 @@ const userAbortError = (signal: AbortSignal): APIUserAbortError => {
 function assertSafeHeaders(headers: Headers): void {
   for (const name of Headers.prototype.keys.call(headers)) {
     const canonical = name.toLowerCase().split('_').join('-');
-    if (
-      canonical === 'api-key' ||
-      canonical === 'x-api-key' ||
-      canonical === 'proxy-authorization' ||
-      canonical === 'host'
-    ) {
+    if ((canonical !== 'authorization' && isSensitiveHeader(canonical)) || canonical === 'host') {
       throw new OpenAIError('X.509 workload identity cannot send conflicting authentication credentials.');
     }
   }
@@ -180,21 +173,6 @@ export function assertX509WebSocketSupported(client: unknown): void {
   }
 }
 
-/** Rejects every destination outside the sole enrolled, global X.509 API authority. */
-export function assertX509APIOrigin(value: string | URL): URL {
-  let target: URL;
-  try {
-    target = new URL(value);
-  } catch {
-    throw new OpenAIError('X.509 workload identity requires the approved global mTLS API origin.');
-  }
-
-  if (target.origin !== X509_API_ORIGIN || target.username || target.password) {
-    throw new OpenAIError('X.509 workload identity requires the approved global mTLS API origin.');
-  }
-  return target;
-}
-
 /** Prevents caller options from replacing the immutable transport selected at construction. */
 export function assertX509FetchOptions(options: MergedRequestInit | RequestInit | undefined): void {
   if (!options) {
@@ -235,6 +213,7 @@ export class X509WorkloadIdentityAuth {
   readonly #identityProviderId: string;
   readonly #serviceAccountId: string;
   readonly #configuredRefreshBufferMs: number | undefined;
+  readonly #configuredRefreshBufferSeconds: number | undefined;
   readonly #organization: string | null;
   readonly #project: string | null;
   readonly #transport: RegisteredX509Transport;
@@ -254,15 +233,32 @@ export class X509WorkloadIdentityAuth {
     this.#identityProviderId = identity.identityProviderId;
     this.#serviceAccountId = identity.serviceAccountId;
     this.#configuredRefreshBufferMs = identity.refreshBufferMs;
+    this.#configuredRefreshBufferSeconds = identity.refreshBufferSeconds;
     this.#organization = organization;
     this.#project = project;
+    if (this.#configuredRefreshBufferMs !== undefined && this.#configuredRefreshBufferSeconds !== undefined) {
+      throw new OpenAIError(
+        'X.509 workload identity cannot combine refreshBufferSeconds and refreshBufferMs.',
+      );
+    }
     if (
       this.#configuredRefreshBufferMs !== undefined &&
       (!Number.isSafeInteger(this.#configuredRefreshBufferMs) || this.#configuredRefreshBufferMs < 0)
     ) {
       throw new OpenAIError('X.509 workload identity requires a nonnegative integer refreshBufferMs.');
     }
-    this.#refreshBufferMs = this.#configuredRefreshBufferMs ?? DEFAULT_REFRESH_BUFFER_MS;
+    if (
+      this.#configuredRefreshBufferSeconds !== undefined &&
+      (!Number.isSafeInteger(this.#configuredRefreshBufferSeconds) ||
+        this.#configuredRefreshBufferSeconds < 0 ||
+        !Number.isSafeInteger(this.#configuredRefreshBufferSeconds * 1000))
+    ) {
+      throw new OpenAIError('X.509 workload identity requires a nonnegative integer refreshBufferSeconds.');
+    }
+    this.#refreshBufferMs =
+      this.#configuredRefreshBufferSeconds === undefined
+        ? (this.#configuredRefreshBufferMs ?? DEFAULT_REFRESH_BUFFER_MS)
+        : this.#configuredRefreshBufferSeconds * 1000;
   }
 
   /** Reconstructs the immutable selectors captured before caller-owned identity mutation. */
@@ -274,6 +270,9 @@ export class X509WorkloadIdentityAuth {
       ...(this.#configuredRefreshBufferMs === undefined
         ? {}
         : { refreshBufferMs: this.#configuredRefreshBufferMs }),
+      ...(this.#configuredRefreshBufferSeconds === undefined
+        ? {}
+        : { refreshBufferSeconds: this.#configuredRefreshBufferSeconds }),
     };
   }
 
@@ -365,6 +364,15 @@ export class X509WorkloadIdentityAuth {
     return request;
   }
 
+  /** Suspends an already-running network budget during retry-local asynchronous preparation. */
+  beginRequestPreparation(): void {
+    const scope = this.#scope();
+    if (scope.deadlineArmed && scope.preparationStartedAt === undefined) {
+      scope.preparationStartedAt = performance.now();
+      scope.preparationWallStartedAt = Date.now();
+    }
+  }
+
   /** Begins local request construction without charging protected hook latency to the network. */
   beginRequestPlanning(): void {
     this.#scope().phase = 'planning';
@@ -377,6 +385,11 @@ export class X509WorkloadIdentityAuth {
       scope.wallStartedAt = Date.now();
       scope.monotonicStartedAt = performance.now();
       scope.deadlineArmed = true;
+    } else if (scope.preparationStartedAt !== undefined) {
+      scope.monotonicStartedAt += performance.now() - scope.preparationStartedAt;
+      scope.wallStartedAt += Date.now() - (scope.preparationWallStartedAt ?? Date.now());
+      delete scope.preparationStartedAt;
+      delete scope.preparationWallStartedAt;
     }
   }
 
@@ -550,6 +563,8 @@ export class X509WorkloadIdentityAuth {
     delete scope.request;
     delete scope.phase;
     delete scope.deadlineArmed;
+    delete scope.preparationStartedAt;
+    delete scope.preparationWallStartedAt;
     delete scope.effectiveSignal;
     delete scope.materializedBody;
     delete scope.apiURL;
@@ -820,13 +835,7 @@ export class X509WorkloadIdentityAuth {
           'X.509 workload identity cannot override its enrolled organization or project.',
         );
       }
-      if (
-        canonical === 'authorization' ||
-        canonical === 'api-key' ||
-        canonical === 'x-api-key' ||
-        canonical === 'proxy-authorization' ||
-        canonical === 'host'
-      ) {
+      if (isSensitiveHeader(canonical) || canonical === 'host') {
         throw new OpenAIError(
           'X.509 workload identity cannot use caller-supplied authentication credentials.',
         );

package/src/internal/uploads.ts

@@ -348,7 +348,8 @@ const hasStreamingUploadableValue = (value: unknown): boolean => {
     return value.some(hasStreamingUploadableValue);
   }
   if (value && typeof value === 'object' && !isBlob(value) && !(value instanceof Response)) {
-    for (const k in value) {
+    // Own properties only, matching what form encoding serializes; inherited values are never encoded.
+    for (const k of Object.keys(value)) {
       if (hasStreamingUploadableValue((value as Record<string, unknown>)[k])) {
         return true;
       }
@@ -365,7 +366,8 @@ const hasUploadableValue = (value: unknown): boolean => {
     return value.some(hasUploadableValue);
   }
   if (value && typeof value === 'object') {
-    for (const k in value) {
+    // Own properties only, matching what form encoding serializes; inherited values are never encoded.
+    for (const k of Object.keys(value)) {
       if (hasUploadableValue((value as any)[k])) {
         return true;
       }