OpenAI SDK for TypeScript 7.10

Apply the Node.js 24 and TypeScript 7 prompts first. These rules cover the openai 7.10 client, including its credential and endpoint selection, Responses state, 7.10 steering and safety events, tool callbacks, streams, uploads, webhooks, and provider transports.

Client, credential, and destination boundaries

• Treat the SDK as an outbound API client, not an authentication or authorization layer. Authenticate the local caller and enforce tenant, project, resource, model, tool, and spend policy before invoking it.
• Construct OpenAI only in trusted server or worker code. Leave browser use disabled; dangerouslyAllowBrowser: true only removes the SDK guard and exposes any reusable credential to every browser user, so use a narrowly scoped, short-lived server-minted credential instead.
• Select exactly one credential path. Account for environment fallbacks for OPENAI_API_KEY and OPENAI_ADMIN_KEY; pass apiKey: null or unset OPENAI_API_KEY when selecting workloadIdentity because the constructor rejects a nonempty API key combined with workload identity.
• Isolate adminAPIKey from application request handlers. Put client.admin.organization.* operations behind a separate administrative service and authorization policy.
• Keep baseURL, dataResidency, provider, defaultHeaders, defaultQuery, fetch, fetchOptions, proxy dispatchers, organization, and project in immutable operator configuration. Never derive a credential-bearing destination, header, query value, or transport hook from request or model data.
• Prefer dataResidency when selecting an