openai 7.15.0 → 7.17.0

package/resources/responses/ws.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ws.d.ts","sourceRoot":"","sources":["../../src/resources/responses/ws.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,EAAE,aAAa,EAAE,0CAAuC;AAC/D,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,qBAAkB;AACzE,OAAO,EAAE,MAAM,EAAE,wBAAqB;AAGtC,YAAY,EAAE,2BAA2B,EAAE,qBAAkB;AAE7D,MAAM,WAAW,wBAAyB,SAAQ,EAAE,CAAC,aAAa,EAAE,sBAAsB;CAAG;AAE7F,qBAAa,WAAY,SAAQ,eAAe,CAAC,aAAa,CAAC;IAC7D,OAAO,CAAC,UAAU,CAAsC;gBAE5C,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,wBAAwB,GAAG,IAAI,GAAG,SAAS;IAajF,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,aAAa;CAatF"}
+{"version":3,"file":"ws.d.ts","sourceRoot":"","sources":["../../src/resources/responses/ws.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,EAAE,aAAa,EAAE,0CAAuC;AAC/D,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,qBAAkB;AACzE,OAAO,EAAE,MAAM,EAAE,wBAAqB;AAKtC,YAAY,EAAE,sBAAsB,EAAE,6BAA0B;AAEhE,YAAY,EAAE,2BAA2B,EAAE,qBAAkB;AAE7D,MAAM,WAAW,wBAAyB,SAAQ,EAAE,CAAC,aAAa,EAAE,sBAAsB;IACxF,iEAAiE;IACjE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,qBAAa,WAAY,SAAQ,eAAe,CAAC,aAAa,CAAC;IAC7D,OAAO,CAAC,UAAU,CAAsC;gBAE5C,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,wBAAwB,GAAG,IAAI,GAAG,SAAS;IAYjF,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,aAAa;CAwBtF"}

package/resources/responses/ws.js

@@ -7,6 +7,8 @@ const WS = tslib_1.__importStar(require("ws"));
 const ws_adapter_node_1 = require("../../internal/ws-adapter-node.js");
 const ws_base_1 = require("./ws-base.js");
 const version_1 = require("../../version.js");
+const error_1 = require("../../core/error.js");
+const ws_1 = require("../../internal/ws.js");
 class ResponsesWS extends ws_base_1.ResponsesWSBase {
     constructor(client, options) {
         if (!WS?.WebSocket) {
@@ -18,15 +20,22 @@ class ResponsesWS extends ws_base_1.ResponsesWSBase {
         this._connectInitial();
     }
     _createSocket(url, authHeaders) {
-        const ws = new WS.WebSocket(url, {
+        const capturedAuthHeaders = { ...authHeaders };
+        const socketOptions = {
             ...this._wsOptions,
             headers: {
                 'User-Agent': `${this._client.constructor.name}/JS ${version_1.VERSION}`,
-                ...authHeaders,
+                ...capturedAuthHeaders,
                 ...this._wsOptions?.headers,
             },
             followRedirects: false,
-        });
+        };
+        if (this._client._hasApiKeyProvider() &&
+            !capturedAuthHeaders['Authorization'] &&
+            !(0, ws_1.snapshotWebSocketCredentials)(socketOptions)) {
+            throw new error_1.OpenAIError('Cannot open a Responses WebSocket with an unresolved function-based apiKey. Resolve it before constructing the WebSocket or provide explicit WebSocket credentials.');
+        }
+        const ws = new WS.WebSocket(url, socketOptions);
         return new ws_adapter_node_1.NodeWebSocket(ws);
     }
 }

package/resources/responses/ws.js.map

@@ -1 +1 @@
-{"version":3,"file":"ws.js","sourceRoot":"","sources":["../../src/resources/responses/ws.ts"],"names":[],"mappings":";AAAA,qFAAqF;;;;AAErF,+CAAyB;AACzB,uEAA+D;AAC/D,0CAAyE;AAEzE,8CAAwC;AAMxC,MAAa,WAAY,SAAQ,yBAA8B;IAG7D,YAAY,MAAc,EAAE,OAAqD;QAC/E,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,wGAAwG,CACzG,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,SAAS,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;QAChE,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,eAAe,EAAE,CAAC;IACzB,CAAC;IAES,aAAa,CAAC,GAAQ,EAAE,WAAmC;QACnE,MAAM,EAAE,GAAG,IAAI,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE;YAC/B,GAAG,IAAI,CAAC,UAAU;YAClB,OAAO,EAAE;gBACP,YAAY,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,OAAO,iBAAO,EAAE;gBAE9D,GAAG,WAAW;gBACd,GAAG,IAAI,CAAC,UAAU,EAAE,OAAO;aAC5B;YACD,eAAe,EAAE,KAAK;SACvB,CAAC,CAAC;QACH,OAAO,IAAI,+BAAa,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC;CACF;AA7BD,kCA6BC"}
+{"version":3,"file":"ws.js","sourceRoot":"","sources":["../../src/resources/responses/ws.ts"],"names":[],"mappings":";AAAA,qFAAqF;;;;AAErF,+CAAyB;AACzB,uEAA+D;AAC/D,0CAAyE;AAEzE,8CAAwC;AACxC,+CAA+C;AAC/C,6CAAiE;AAWjE,MAAa,WAAY,SAAQ,yBAA8B;IAG7D,YAAY,MAAc,EAAE,OAAqD;QAC/E,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,wGAAwG,CACzG,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,SAAS,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;QAChE,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,eAAe,EAAE,CAAC;IACzB,CAAC;IAES,aAAa,CAAC,GAAQ,EAAE,WAAmC;QACnE,MAAM,mBAAmB,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC;QAC/C,MAAM,aAAa,GAA6B;YAC9C,GAAG,IAAI,CAAC,UAAU;YAClB,OAAO,EAAE;gBACP,YAAY,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,OAAO,iBAAO,EAAE;gBAC9D,GAAG,mBAAmB;gBACtB,GAAG,IAAI,CAAC,UAAU,EAAE,OAAO;aAC5B;YACD,eAAe,EAAE,KAAK;SACvB,CAAC;QACF,IACE,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE;YACjC,CAAC,mBAAmB,CAAC,eAAe,CAAC;YACrC,CAAC,IAAA,iCAA4B,EAAC,aAAa,CAAC,EAC5C,CAAC;YACD,MAAM,IAAI,mBAAW,CACnB,qKAAqK,CACtK,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,GAAG,IAAI,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAChD,OAAO,IAAI,+BAAa,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC;CACF;AAvCD,kCAuCC"}

package/resources/responses/ws.mjs

@@ -3,6 +3,8 @@ import * as WS from 'ws';
 import { NodeWebSocket } from "../../internal/ws-adapter-node.mjs";
 import { ResponsesWSBase } from "./ws-base.mjs";
 import { VERSION } from "../../version.mjs";
+import { OpenAIError } from "../../core/error.mjs";
+import { snapshotWebSocketCredentials } from "../../internal/ws.mjs";
 export class ResponsesWS extends ResponsesWSBase {
     constructor(client, options) {
         if (!WS?.WebSocket) {
@@ -14,15 +16,22 @@ export class ResponsesWS extends ResponsesWSBase {
         this._connectInitial();
     }
     _createSocket(url, authHeaders) {
-        const ws = new WS.WebSocket(url, {
+        const capturedAuthHeaders = { ...authHeaders };
+        const socketOptions = {
             ...this._wsOptions,
             headers: {
                 'User-Agent': `${this._client.constructor.name}/JS ${VERSION}`,
-                ...authHeaders,
+                ...capturedAuthHeaders,
                 ...this._wsOptions?.headers,
             },
             followRedirects: false,
-        });
+        };
+        if (this._client._hasApiKeyProvider() &&
+            !capturedAuthHeaders['Authorization'] &&
+            !snapshotWebSocketCredentials(socketOptions)) {
+            throw new OpenAIError('Cannot open a Responses WebSocket with an unresolved function-based apiKey. Resolve it before constructing the WebSocket or provide explicit WebSocket credentials.');
+        }
+        const ws = new WS.WebSocket(url, socketOptions);
         return new NodeWebSocket(ws);
     }
 }

package/resources/responses/ws.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"ws.mjs","sourceRoot":"","sources":["../../src/resources/responses/ws.ts"],"names":[],"mappings":"AAAA,qFAAqF;AAErF,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,EAAE,aAAa,EAAE,2CAAuC;AAC/D,OAAO,EAAE,eAAe,EAA+B,sBAAkB;AAEzE,OAAO,EAAE,OAAO,EAAE,0BAAsB;AAMxC,MAAM,OAAO,WAAY,SAAQ,eAA8B;IAG7D,YAAY,MAAc,EAAE,OAAqD;QAC/E,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,wGAAwG,CACzG,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,SAAS,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;QAChE,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,eAAe,EAAE,CAAC;IACzB,CAAC;IAES,aAAa,CAAC,GAAQ,EAAE,WAAmC;QACnE,MAAM,EAAE,GAAG,IAAI,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE;YAC/B,GAAG,IAAI,CAAC,UAAU;YAClB,OAAO,EAAE;gBACP,YAAY,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,OAAO,OAAO,EAAE;gBAE9D,GAAG,WAAW;gBACd,GAAG,IAAI,CAAC,UAAU,EAAE,OAAO;aAC5B;YACD,eAAe,EAAE,KAAK;SACvB,CAAC,CAAC;QACH,OAAO,IAAI,aAAa,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC;CACF"}
+{"version":3,"file":"ws.mjs","sourceRoot":"","sources":["../../src/resources/responses/ws.ts"],"names":[],"mappings":"AAAA,qFAAqF;AAErF,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,EAAE,aAAa,EAAE,2CAAuC;AAC/D,OAAO,EAAE,eAAe,EAA+B,sBAAkB;AAEzE,OAAO,EAAE,OAAO,EAAE,0BAAsB;AACxC,OAAO,EAAE,WAAW,EAAE,6BAAyB;AAC/C,OAAO,EAAE,4BAA4B,EAAE,8BAA0B;AAWjE,MAAM,OAAO,WAAY,SAAQ,eAA8B;IAG7D,YAAY,MAAc,EAAE,OAAqD;QAC/E,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,wGAAwG,CACzG,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,SAAS,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;QAChE,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,eAAe,EAAE,CAAC;IACzB,CAAC;IAES,aAAa,CAAC,GAAQ,EAAE,WAAmC;QACnE,MAAM,mBAAmB,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC;QAC/C,MAAM,aAAa,GAA6B;YAC9C,GAAG,IAAI,CAAC,UAAU;YAClB,OAAO,EAAE;gBACP,YAAY,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,OAAO,OAAO,EAAE;gBAC9D,GAAG,mBAAmB;gBACtB,GAAG,IAAI,CAAC,UAAU,EAAE,OAAO;aAC5B;YACD,eAAe,EAAE,KAAK;SACvB,CAAC;QACF,IACE,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE;YACjC,CAAC,mBAAmB,CAAC,eAAe,CAAC;YACrC,CAAC,4BAA4B,CAAC,aAAa,CAAC,EAC5C,CAAC;YACD,MAAM,IAAI,WAAW,CACnB,qKAAqK,CACtK,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,GAAG,IAAI,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAChD,OAAO,IAAI,aAAa,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC;CACF"}

package/src/_vendor/zod-to-json-schema/Options.ts

@@ -63,6 +63,8 @@ export const getDefaultOptions = <Target extends Targets>(
   options: Partial<Options<Target>> | string | undefined,
 ): Options<Target> => {
   // We need to add `definitions` here as we may mutate it
+  // Preserve the public string-name overload alongside object options.
+  // SAFETY: Defaults and the supplied options are merged into the vendored converter's target-specific options contract, with fresh mutable definitions.
   const resolvedOptions = (
     typeof options === 'string'
       ? {

package/src/_vendor/zod-to-json-schema/parseDef.ts

@@ -125,6 +125,7 @@ export function parseDef(
   refs.seen.set(def, newItem);
 
   try {
+    // SAFETY: The vendored Zod definition carries its typeName discriminator; selectParser dispatches on that discriminator and handles unsupported definitions.
     const jsonSchema = selectParser(def, (def as any).typeName, refs, forceResolution);
 
     if (jsonSchema) {

package/src/_vendor/zod-to-json-schema/parsers/bigint.ts

@@ -35,6 +35,7 @@ export function parseBigintDef(def: ZodBigIntDef, refs: Refs): JsonSchema7Bigint
           }
         } else {
           if (!check.inclusive) {
+            // SAFETY: This target uses the draft's boolean exclusive-bound keyword instead of the numeric keyword represented by the shared schema type.
             res.exclusiveMinimum = true as any;
           }
           setResponseValueAndErrors(res, 'minimum', check.value, check.message, refs);
@@ -50,6 +51,7 @@ export function parseBigintDef(def: ZodBigIntDef, refs: Refs): JsonSchema7Bigint
           }
         } else {
           if (!check.inclusive) {
+            // SAFETY: This target uses the draft's boolean exclusive-bound keyword instead of the numeric keyword represented by the shared schema type.
             res.exclusiveMaximum = true as any;
           }
           setResponseValueAndErrors(res, 'maximum', check.value, check.message, refs);

package/src/_vendor/zod-to-json-schema/parsers/literal.ts

@@ -33,6 +33,7 @@ export function parseLiteralDef(def: ZodLiteralDef, refs: Refs): JsonSchema7Lite
   }
 
   if (refs.target === 'openApi3') {
+    // SAFETY: The OpenAPI branch represents a primitive literal with enum instead of const, retaining the vendored converter's target compatibility.
     return {
       type: parsedType === 'bigint' ? 'integer' : parsedType,
       enum: [def.value],

package/src/_vendor/zod-to-json-schema/parsers/null.ts

@@ -5,6 +5,7 @@ export type JsonSchema7NullType = {
 };
 
 export function parseNullDef(refs: Refs): JsonSchema7NullType {
+  // SAFETY: The OpenAPI target uses nullable plus enum because its null representation differs from the JSON Schema return type.
   return refs.target === 'openApi3'
     ? ({
         enum: ['null'],

package/src/_vendor/zod-to-json-schema/parsers/nullable.ts

@@ -23,12 +23,14 @@ export function parseNullableDef(
     (!def.innerType._def.checks || !def.innerType._def.checks.length)
   ) {
     if (refs.target === 'openApi3' || refs.nullableStrategy === 'property') {
+      // SAFETY: The preceding primitive discriminator check permits the mapping lookup; the nullable-property target uses its existing extension representation.
       return {
         type: primitiveMappings[def.innerType._def.typeName as keyof typeof primitiveMappings],
         nullable: true,
       } as any;
     }
 
+    // SAFETY: The preceding primitive discriminator check permits the mapping lookup; the nullable-property target uses its existing extension representation.
     return {
       type: [primitiveMappings[def.innerType._def.typeName as keyof typeof primitiveMappings], 'null'],
     };
@@ -45,9 +47,11 @@ export function parseNullableDef(
     );
 
     if (base && '$ref' in base) {
+      // SAFETY: The OpenAPI branch adds nullable to the converted base schema, an extension not represented by the shared JSON Schema union.
       return { allOf: [base], nullable: true } as any;
     }
 
+    // SAFETY: The OpenAPI branch adds nullable to the converted base schema, an extension not represented by the shared JSON Schema union.
     return base && ({ ...base, nullable: true } as any);
   }
 

package/src/_vendor/zod-to-json-schema/parsers/number.ts

@@ -38,6 +38,7 @@ export function parseNumberDef(def: ZodNumberDef, refs: Refs): JsonSchema7Number
           }
         } else {
           if (!check.inclusive) {
+            // SAFETY: This target uses the draft's boolean exclusive-bound keyword instead of the numeric keyword represented by the shared schema type.
             res.exclusiveMinimum = true as any;
           }
           setResponseValueAndErrors(res, 'minimum', check.value, check.message, refs);
@@ -53,6 +54,7 @@ export function parseNumberDef(def: ZodNumberDef, refs: Refs): JsonSchema7Number
           }
         } else {
           if (!check.inclusive) {
+            // SAFETY: This target uses the draft's boolean exclusive-bound keyword instead of the numeric keyword represented by the shared schema type.
             res.exclusiveMaximum = true as any;
           }
           setResponseValueAndErrors(res, 'maximum', check.value, check.message, refs);

package/src/_vendor/zod-to-json-schema/parsers/optional.ts

@@ -15,23 +15,22 @@ export const parseOptionalDef = (
     return parseDef(def.innerType._def, { ...refs, currentPath: refs.currentPath }, forceResolution);
   }
 
+  // `not: {}` accepts no JSON values and is unsupported by strict Structured Outputs.
+  // Keep the wrapper, but generate only its real branch at the correct reference path.
+  // Override callbacks retain their existing output and path contract.
+  const omitNeverBranch = refs.openaiStrictMode && !refs.override;
   const innerSchema = parseDef(
     def.innerType._def,
     {
       ...refs,
-      currentPath: [...refs.currentPath, 'anyOf', '1'],
+      currentPath: [...refs.currentPath, 'anyOf', omitNeverBranch ? '0' : '1'],
     },
     forceResolution,
   );
 
   return innerSchema
     ? {
-        anyOf: [
-          {
-            not: {},
-          },
-          innerSchema,
-        ],
+        anyOf: omitNeverBranch ? [innerSchema] : [{ not: {} }, innerSchema],
       }
     : {};
 };

package/src/_vendor/zod-to-json-schema/parsers/record.ts

@@ -23,6 +23,7 @@ export function parseRecordDef(
   refs: Refs,
 ): JsonSchema7RecordType {
   if (refs.target === 'openApi3' && def.keyType?._def.typeName === ZodFirstPartyTypeKind.ZodEnum) {
+    // SAFETY: The OpenAPI enum-key path emits an explicitly checked object schema while preserving the vendored record parser's public return type.
     return {
       type: 'object',
       required: def.keyType._def.values,
@@ -53,6 +54,7 @@ export function parseRecordDef(
   }
 
   if (def.keyType?._def.typeName === ZodFirstPartyTypeKind.ZodString && def.keyType._def.checks?.length) {
+    // SAFETY: Removing only type from the parsed string schema leaves the keyword subset allowed in propertyNames.
     const keyType = Object.fromEntries(
       Object.entries(parseStringDef(def.keyType._def, refs)).filter(([key]) => key !== 'type'),
     ) as JsonSchema7RecordPropertyNamesType;

package/src/_vendor/zod-to-json-schema/parsers/string.ts

@@ -222,6 +222,7 @@ export function parseStringDef(def: ZodStringDef, refs: Refs): JsonSchema7String
         case 'base64': {
           switch (refs.base64Strategy) {
             case 'format:binary': {
+              // SAFETY: The explicit OpenAPI binary strategy uses format: binary, an extension to the vendored JSON Schema string-format type.
               addFormat(res, 'binary' as any, check.message, refs);
               break;
             }

package/src/_vendor/zod-to-json-schema/parsers/union.ts

@@ -46,6 +46,7 @@ export function parseUnionDef(
 
     const types: JsonSchema7Primitive[] = [];
     for (const x of options) {
+      // SAFETY: The preceding every check restricts each option to a primitive mapping key with no additional checks.
       const type = primitiveMappings[x._def.typeName as ZodPrimitive]; //Can be safely casted due to row 43
       if (type && !types.includes(type)) {
         types.push(type);
@@ -59,6 +60,7 @@ export function parseUnionDef(
     // all options literals
 
     const types: JsonSchema7Primitive[] = [];
+    // SAFETY: The preceding every check establishes that every union option is a Zod literal definition.
     for (const x of options as readonly { _def: ZodLiteralDef }[]) {
       const type = typeof x._def.value;
       switch (type) {
@@ -118,6 +120,7 @@ const asAnyOf = (
   def: ZodUnionDef | ZodDiscriminatedUnionDef<any, any>,
   refs: Refs,
 ): JsonSchema7PrimitiveUnionType | JsonSchema7AnyOfType | undefined => {
+  // SAFETY: Zod union options are either the discriminated-union map values or the ordinary option array; both contain schema definitions for parseDef.
   const anyOf = ((def.options instanceof Map ? [...def.options.values()] : def.options) as any[])
     .map((x, i) =>
       parseDef(x._def, {

package/src/_vendor/zod-to-json-schema/util.ts

@@ -3,6 +3,7 @@ import type { ZodSchema, ZodTypeDef } from 'zod/v3';
 export const zodDef = (zodSchema: ZodSchema | ZodTypeDef): ZodTypeDef =>
   '_def' in zodSchema ? zodSchema._def : zodSchema;
 
+// oxlint-disable-next-line anti-slop/no-object-parameters -- Preserve the upstream utility contract: any object can have enumerable own or inherited keys.
 export function isEmptyObj(obj: object | null | undefined): boolean {
   if (!obj) {
     return true;

package/src/_vendor/zod-to-json-schema/zodToJsonSchema.ts

@@ -14,6 +14,7 @@ function ownStrictRootSchema(
     throw new TypeError('Root schema must be a plain JSON-schema record');
   }
 
+  // SAFETY: Object.getPrototypeOf returns an object or null; the following comparison permits only plain or null-prototype schemas.
   const prototype = Object.getPrototypeOf(schema) as object | null;
   if (![null, Object.prototype].includes(prototype)) {
     throw new TypeError('Root schema must be a plain JSON-schema record');
@@ -67,6 +68,7 @@ function ownStrictRootSchema(
     throw new Error("Root schema must have type: 'object' but got type: undefined");
   }
 
+  // SAFETY: The copied schema preserves the validated JSON fields while taking ownership of the mutable converter result.
   return owned as JsonSchema7Type;
 }
 
@@ -120,7 +122,7 @@ const zodToJsonSchema = <Target extends Targets = 'jsonSchema7'>(
       return undefined;
     }
 
-    const definitions: Record<string, any> = {};
+    const definitions: Record<string, JsonSchema7Type> = {};
     const processedDefinitions = new Set();
 
     // the call to `parseDef()` here might itself add more entries to `.definitions`

package/src/auth/subject-token-providers.ts

@@ -16,15 +16,18 @@ const errorFunctionToString = Function.prototype.toString;
 const nativeErrorSource = errorFunctionToString.call(Error);
 const nativeSyntaxErrorSource = errorFunctionToString.call(SyntaxError);
 const nativeErrorBrandDescriptor = getOwnErrorDescriptor(Error, 'isError');
+// SAFETY: The captured Error.isError data property was checked to be callable and follows the native error-brand predicate contract.
 const nativeErrorBrand =
   nativeErrorBrandDescriptor &&
   'value' in nativeErrorBrandDescriptor &&
   typeof nativeErrorBrandDescriptor.value === 'function'
-    ? (nativeErrorBrandDescriptor.value as (error: object) => boolean)
+    ? // oxlint-disable-next-line anti-slop/no-object-parameters -- The native error-brand predicate inspects arbitrary objects without trusting their properties.
+      (nativeErrorBrandDescriptor.value as (error: object) => boolean)
     : undefined;
 
 type AzureJSONErrorKind = 'error' | 'syntax' | 'tagged-wrapper' | 'unknown' | 'unsafe';
 
+// oxlint-disable-next-line anti-slop/no-object-parameters -- Cross-realm prototypes are inspected through descriptors before any error contract is trusted.
 function hasNativeErrorPrototype(prototype: object, kind: 'Error' | 'SyntaxError'): boolean {
   const name = getOwnErrorDescriptor(prototype, 'name');
   const constructor = getOwnErrorDescriptor(prototype, 'constructor');
@@ -49,10 +52,12 @@ function hasNativeErrorPrototype(prototype: object, kind: 'Error' | 'SyntaxError
   );
 }
 
+// oxlint-disable-next-line anti-slop/no-object-parameters -- Untrusted thrown objects, including proxies, must be classified before treating them as errors.
 function classifyCrossRealmAzureError(error: object): AzureJSONErrorKind {
   try {
     const prototypes: object[] = [];
     let tagged = false;
+    // SAFETY: Object.getPrototypeOf returns an object or null; the traversal never treats the prototype as a more specific instance.
     for (
       let prototype: object | null = error;
       prototype !== null;

package/src/auth/workload-identity-auth.ts

@@ -53,6 +53,7 @@ function calculateRefreshAt(
 const NATIVE_RESPONSE_PROTOTYPE = Response.prototype;
 const READ_NATIVE_RESPONSE_BODY = NATIVE_RESPONSE_PROTOTYPE.arrayBuffer;
 
+// oxlint-disable-next-line anti-slop/no-object-parameters -- Custom fetch response prototypes are verified through descriptors before trusting their native contract.
 function isResponsePrototype(response: Response, prototype: object): boolean {
   const constructor = Object.getOwnPropertyDescriptor(prototype, 'constructor')?.value;
   if (
@@ -73,6 +74,7 @@ function isResponsePrototype(response: Response, prototype: object): boolean {
   );
 }
 
+// oxlint-disable-next-line anti-slop/no-object-parameters -- The prototype walk compares untrusted cross-realm objects by identity and descriptor metadata.
 function isResponseBodyPrototype(prototype: object, responsePrototype: object | null): boolean {
   if (prototype === responsePrototype) {
     return true;
@@ -89,10 +91,12 @@ function isResponseBodyPrototype(prototype: object, responsePrototype: object |
 }
 
 function decodeNativeResponseBody(body: ArrayBuffer): string {
+  // SAFETY: Bun is an optional runtime global; its version is checked before selecting Bun-specific decoding behavior.
   const scope = globalThis as typeof globalThis & { Bun?: { version?: unknown } };
   return new TextDecoder('utf-8', { ignoreBOM: typeof scope.Bun?.version === 'string' }).decode(body);
 }
 
+// oxlint-disable-next-line anti-slop/no-unknown-returns -- Decoded token JSON remains untrusted until the caller validates its fields.
 async function parseOAuthTokenResponse(response: Response): Promise<unknown> {
   let readText: ((this: Response) => Promise<string>) | undefined;
   let responsePrototype: object | null = null;
@@ -140,6 +144,7 @@ async function parseOAuthTokenResponse(response: Response): Promise<unknown> {
 }
 
 function isUnsafeAccessToken(accessToken: string): boolean {
+  // SAFETY: Bun is an optional runtime global; its version is checked before selecting Bun-specific decoding behavior.
   const scope = globalThis as typeof globalThis & { Bun?: { version?: unknown } };
   if (typeof scope.Bun?.version === 'string') {
     return /[^\t\u0020-\u007E]|^[\t ]|[\t ]$/u.test(accessToken);
@@ -173,7 +178,9 @@ export class WorkloadIdentityAuth {
     this.config = {
       identityProviderId,
       serviceAccountId,
+      // Spread creates an own data property without invoking inherited setters or changing the object prototype.
       ...(clientId === undefined ? {} : { clientId }),
+      // Spread creates an own data property without invoking inherited setters or changing the object prototype.
       ...(refreshBufferSeconds === undefined ? {} : { refreshBufferSeconds }),
       provider: {
         tokenType: provider.tokenType,
@@ -226,6 +233,7 @@ export class WorkloadIdentityAuth {
 
   private async refreshToken(generation: number): Promise<string> {
     const subjectToken = await this.config.provider.getToken();
+    // oxlint-disable-next-line anti-slop/no-known-value-widening -- The token-exchange field dictionary gains an optional client_id after its required fields are initialized.
     const body: Record<string, string> = {
       grant_type: TOKEN_EXCHANGE_GRANT_TYPE,
       subject_token: subjectToken,
@@ -260,7 +268,7 @@ export class WorkloadIdentityAuth {
       }
 
       if (response.status === 400 || response.status === 401 || response.status === 403) {
-        throw new OAuthError(response.status as 400 | 401 | 403, body, response.headers);
+        throw new OAuthError(response.status, body, response.headers);
       }
       throw APIError.generate(
         response.status,
@@ -283,6 +291,7 @@ export class WorkloadIdentityAuth {
       throw new OpenAIError("Token exchange response missing 'access_token' field");
     }
 
+    // SAFETY: The token response was checked as an object with a valid access token; expires_in is still validated by calculateExpiresAt.
     const expiresIn = (tokenResponse as Partial<TokenExchangeResponse>).expires_in ?? 3600;
     const expiresAt = calculateExpiresAt(expiresIn, exchangeStartedAt);
 

package/src/auth/x509-transport.ts

@@ -82,6 +82,7 @@ function safeOptionRecord(
   if (prototype !== Object.prototype && prototype !== null) {
     throw new Error(`X.509 ${label} options must have only own plain data properties.`);
   }
+  // SAFETY: The snapshot starts empty with no prototype; only checked own data properties are copied into it below.
   const snapshot = Object.create(null) as Record<string, unknown>;
   for (const name of Reflect.ownKeys(value)) {
     if (typeof name !== 'string' || !allowed.has(name)) {
@@ -179,6 +180,7 @@ function validatedCredentialOptions(options: X509CredentialOptions): ValidatedX5
   const leaf = new X509Certificate(certificateChain);
   const privateKey = createPrivateKey({
     key: privateKeyPEM,
+    // Create an own data property so an inherited setter cannot intercept the private-key passphrase.
     ...(passphrase === undefined ? {} : { passphrase }),
   });
   if (!leaf.checkPrivateKey(privateKey)) {
@@ -239,6 +241,7 @@ function credentialDispatcher(
   requestTls: VerifiedX509TLSOptions,
 ): { dispatcher: Agent | ProxyAgent; proxy: X509ProxyMode } {
   if (proxyOptionsInput === undefined) {
+    // oxlint-disable-next-line anti-slop/no-known-value-widening -- The dispatcher owner returns one contract for direct Agents and both supported CONNECT proxy modes.
     return { dispatcher: new Agent({ connect: requestTls }), proxy: 'direct' };
   }
 
@@ -262,16 +265,20 @@ function credentialDispatcher(
   }
   const auth = proxyAuthentication(url);
 
+  // oxlint-disable-next-line anti-slop/no-known-value-widening -- The declared transport contract preserves the same dispatcher and proxy types across both construction paths.
   return {
     proxy,
     dispatcher: new ProxyAgent({
       uri: url.href,
+      // Define proxy credentials as own data without invoking inherited setters.
       ...(auth === undefined ? {} : { auth }),
       requestTls,
+      // Keep the optional proxy TLS configuration as an own data property.
       ...(proxy === 'https-connect'
         ? {
             proxyTls: {
               rejectUnauthorized: true,
+              // Define explicit proxy trust roots as own data without invoking inherited setters.
               ...(proxyCA === undefined ? {} : { ca: proxyCA }),
             },
           }
@@ -300,6 +307,7 @@ export function createX509Transport(options: X509TransportOptions): X509Transpor
         transport: capability,
         identityProviderId,
         serviceAccountId,
+        // Preserve the cancellation signal as own data without invoking inherited setters.
         ...(signal ? { signal } : {}),
       }),
     run: (operation) =>
@@ -315,11 +323,13 @@ export function createX509Transport(options: X509TransportOptions): X509Transpor
 export function fromX509(options: X509CredentialOptions): X509Credential {
   const configured = validatedCredentialOptions(options);
 
-  const requestTls = {
+  const requestTls: VerifiedX509TLSOptions = {
     cert: configured.certificateChain,
     key: configured.privateKey,
-    rejectUnauthorized: true as const,
+    rejectUnauthorized: true,
+    // Define the TLS passphrase as own data so inherited setters cannot intercept it.
     ...(configured.passphrase === undefined ? {} : { passphrase: configured.passphrase }),
+    // Define explicit workload trust roots as own data without invoking inherited setters.
     ...(configured.ca === undefined ? {} : { ca: configured.ca }),
   };
   const { dispatcher, proxy } = credentialDispatcher(configured.proxy, requestTls);
@@ -335,6 +345,7 @@ export function fromX509(options: X509CredentialOptions): X509Credential {
       type: 'x509',
       identityProviderId: configured.identityProviderId,
       serviceAccountId: configured.serviceAccountId,
+      // Preserve the optional refresh setting as own data without invoking inherited setters.
       ...(configured.refreshBufferSeconds === undefined
         ? {}
         : { refreshBufferSeconds: configured.refreshBufferSeconds }),

package/src/azure.ts

@@ -101,6 +101,7 @@ export class AzureOpenAI extends OpenAI {
       );
     }
 
+    // oxlint-disable-next-line anti-slop/no-runtime-typeof -- Azure accepts JavaScript credential configuration; distinguish static keys from callable token providers.
     if (typeof azureADTokenProvider === 'function') {
       dangerouslyAllowBrowser ??= true;
     }
@@ -143,6 +144,7 @@ export class AzureOpenAI extends OpenAI {
       apiKey: azureADTokenProvider ?? apiKey,
       baseURL,
       ...opts,
+      // Spread creates an own data property without invoking inherited setters or changing the object prototype.
       ...(dangerouslyAllowBrowser === undefined ? {} : { dangerouslyAllowBrowser }),
     });
 
@@ -224,6 +226,7 @@ export class AzureOpenAI extends OpenAI {
     schemes?: { bearerAuth?: boolean; adminAPIKeyAuth?: boolean },
   ): Promise<NullableHeaders | undefined> {
     const security = schemes ?? { bearerAuth: true, adminAPIKeyAuth: true };
+    // oxlint-disable-next-line anti-slop/no-runtime-typeof -- Azure accepts JavaScript credential configuration; distinguish static keys from callable token providers.
     if (security.bearerAuth && typeof this._options.apiKey === 'string') {
       return buildHeaders([{ 'api-key': this.apiKey }]);
     }

package/src/bedrock.ts

@@ -1,5 +1,6 @@
 import * as Errors from './error';
 import { OpenAI } from './client';
+import { resolveRealtimeAPIKey } from './internal/realtime-credentials';
 import type { ApiKeySetter, ClientOptions } from './client';
 import { assertNoDataResidency } from './internal/data-residency';
 import {
@@ -111,6 +112,7 @@ function addBedrockOutputText<ResponseT extends ResponsesAPI.Response>(response:
 function restoreBedrockStreamOutputText(responses: API.Responses): API.Responses {
   const stream = responses.stream.bind(responses);
 
+  // SAFETY: The wrapper forwards the original stream parameters and preserves its generic result, only repairing the final response's output_text property.
   responses.stream = ((body: ResponseStreamParams, options?: RequestOptions) => {
     const responseStream = stream(body, options);
     const finalResponse = responseStream.finalResponse.bind(responseStream);
@@ -161,6 +163,8 @@ export class BedrockOpenAI extends OpenAI {
       apiKey = readEnv('AWS_BEARER_TOKEN_BEDROCK') ?? null;
     }
 
+    // SAFETY: The widening keeps a runtime guard for JavaScript callers that supply an API-key function despite the declared string contract.
+    // oxlint-disable-next-line anti-slop/no-runtime-typeof -- Reject a JavaScript function supplied as a static Bedrock API key before it can become a credential.
     if (typeof (apiKey as unknown) === 'function') {
       throw new Errors.OpenAIError(
         'Pass refreshable Bedrock credentials via `bedrockTokenProvider`, not `apiKey`.',
@@ -225,11 +229,6 @@ export class BedrockOpenAI extends OpenAI {
     const configuredBaseURL = this._options.baseURL ?? this.baseURL;
     assertBedrockRequestOrigin(configuredBaseURL, this.buildURL(options.path, null, options.defaultBaseURL));
 
-    const security = options.__security ?? { bearerAuth: true };
-    if (security.adminAPIKeyAuth && !security.bearerAuth) {
-      await this._callApiKey();
-    }
-
     await super.prepareOptions(options);
     assertBedrockRequestOrigin(configuredBaseURL, this.buildURL(options.path, null, options.defaultBaseURL));
   }
@@ -240,6 +239,10 @@ export class BedrockOpenAI extends OpenAI {
   ): Promise<void> {
     assertBedrockRequestOrigin(this._options.baseURL ?? this.baseURL, context.url);
     await super.prepareRequest(request, context);
+    assertBedrockRequestOrigin(
+      this._options.baseURL ?? this.baseURL,
+      this.buildURL(context.options.path, null, context.options.defaultBaseURL),
+    );
     request.redirect = 'manual';
   }
 
@@ -248,8 +251,19 @@ export class BedrockOpenAI extends OpenAI {
     schemes?: { bearerAuth?: boolean; adminAPIKeyAuth?: boolean },
   ): Promise<NullableHeaders | undefined> {
     const security = schemes ?? { bearerAuth: true, adminAPIKeyAuth: true };
-    const credential = this.apiKey;
-    if ((security.bearerAuth || security.adminAPIKeyAuth) && credential !== null) {
+    if (security.bearerAuth || security.adminAPIKeyAuth) {
+      assertBedrockRequestOrigin(
+        this._options.baseURL ?? this.baseURL,
+        this.buildURL(opts.path, null, opts.defaultBaseURL),
+      );
+      const { apiKey: credential } = await resolveRealtimeAPIKey(this);
+      assertBedrockRequestOrigin(
+        this._options.baseURL ?? this.baseURL,
+        this.buildURL(opts.path, null, opts.defaultBaseURL),
+      );
+      if (credential === null) {
+        return undefined;
+      }
       assertValidBedrockBearerCredential(credential);
       try {
         return buildHeaders([{ Authorization: `Bearer ${credential}` }]);
@@ -270,8 +284,10 @@ export class BedrockOpenAI extends OpenAI {
     const bedrockTokenProvider =
       options.apiKey === undefined ? (options.bedrockTokenProvider ?? this.bedrockTokenProvider) : undefined;
 
+    // SAFETY: Bedrock options extend the base client options; forwarding them preserves the subclass's existing withOptions construction behavior.
     return super.withOptions({
       ...options,
+      // Spread creates an own data property without invoking inherited setters or changing the object prototype.
       ...(bedrockTokenProvider ? { apiKey: undefined, bedrockTokenProvider } : {}),
     } as Partial<ClientOptions>);
   }

package/src/beta/realtime/internal-base.ts

@@ -12,6 +12,7 @@ import { assertX509WebSocketSupported } from '../../internal/auth/x509-workload-
 /** Parses frame data without exposing malformed payloads through JSON syntax errors. */
 export function parseRealtimeEvent(data: string): RealtimeServerEvent {
   try {
+    // SAFETY: RealtimeServerEvent is the API wire contract; JSON syntax is checked here while future event types remain accepted at runtime.
     return JSON.parse(data) as RealtimeServerEvent;
   } catch (error) {
     if (error instanceof SyntaxError) {
@@ -86,6 +87,7 @@ type RealtimeEvents = Simplify<
           type: EventType;
         }
       >,
+      // oxlint-disable-next-line anti-slop/no-unknown-returns -- Preserve the published event-callback contract, which accepts and ignores arbitrary return values.
     ) => unknown;
   }
 >;