openai 7.16.0 → 7.17.0

package/src/helpers/standard-schema.ts

@@ -1,3 +1,4 @@
+import { isObj } from '../internal/utils/values';
 import { OpenAIError } from '../error';
 import type { AutoParseableResponseFormat, AutoParseableTextFormat, AutoParseableTool } from '../lib/parser';
 import {
@@ -138,6 +139,7 @@ type StandardTextFormatProps = Omit<
 /** Function callback invoked with arguments validated by a Standard Schema implementation. */
 type StandardToolFunction<Parameters extends StandardSchemaLike> = (
   args: InferStandardOutput<Parameters>,
+  // oxlint-disable-next-line anti-slop/no-unknown-returns -- Public tool callbacks may return arbitrary application values; preserve the published callback contract.
 ) => unknown | Promise<unknown>;
 
 /** Model-facing function-tool settings and optional Standard Schema validation callback. */
@@ -198,10 +200,11 @@ const JSON_SCHEMA_TYPES = new Set(['string', 'number', 'integer', 'boolean', 'ob
 type JSONPrimitive = string | number | boolean | null;
 
 function getSchemaTypes(schema: unknown): Set<string> | undefined {
-  if (!schema || typeof schema !== 'object' || Array.isArray(schema)) {
+  if (!isObj(schema)) {
     return undefined;
   }
 
+  // SAFETY: The preceding guard excludes null, primitives, and arrays; property values remain unknown until their individual schema checks.
   const type = (schema as Record<string, unknown>)['type'];
   if (type === undefined) {
     return getLiteralSchemaTypes(schema);
@@ -227,10 +230,11 @@ function isJSONPrimitive(value: unknown): value is JSONPrimitive {
 }
 
 function getLiteralValues(schema: unknown): JSONPrimitive[] | undefined {
-  if (!schema || typeof schema !== 'object' || Array.isArray(schema)) {
+  if (!isObj(schema)) {
     return undefined;
   }
 
+  // SAFETY: The preceding guard excludes null, primitives, and arrays; property values remain unknown until their individual schema checks.
   const record = schema as Record<string, unknown>;
   if ('const' in record && isJSONPrimitive(record['const'])) {
     return [record['const']];
@@ -286,19 +290,17 @@ function haveDisjointObjectDiscriminator(left: unknown, right: unknown, root: JS
     return false;
   }
 
+  // SAFETY: The preceding guard excludes null, primitives, and arrays; property values remain unknown until their individual schema checks.
   const leftRecord = left as Record<string, unknown>;
+  // SAFETY: The preceding guard excludes null, primitives, and arrays; property values remain unknown until their individual schema checks.
   const rightRecord = right as Record<string, unknown>;
   const leftProperties = leftRecord['properties'];
   const rightProperties = rightRecord['properties'];
   const leftRequired = leftRecord['required'];
   const rightRequired = rightRecord['required'];
   if (
-    !leftProperties ||
-    typeof leftProperties !== 'object' ||
-    Array.isArray(leftProperties) ||
-    !rightProperties ||
-    typeof rightProperties !== 'object' ||
-    Array.isArray(rightProperties) ||
+    !isObj(leftProperties) ||
+    !isObj(rightProperties) ||
     !Array.isArray(leftRequired) ||
     !Array.isArray(rightRequired)
   ) {
@@ -306,6 +308,7 @@ function haveDisjointObjectDiscriminator(left: unknown, right: unknown, root: JS
   }
 
   for (const property of leftRequired) {
+    // SAFETY: Both properties maps were checked as non-null non-array objects; the selected values remain untrusted inputs to reference resolution.
     if (
       typeof property === 'string' &&
       rightRequired.includes(property) &&
@@ -328,14 +331,13 @@ function getClosedObjectPropertySet(
     return undefined;
   }
 
+  // SAFETY: The preceding guard excludes null, primitives, and arrays; property values remain unknown until their individual schema checks.
   const record = schema as Record<string, unknown>;
   const properties = record['properties'];
   const required = record['required'];
   if (
     record['additionalProperties'] !== false ||
-    !properties ||
-    typeof properties !== 'object' ||
-    Array.isArray(properties) ||
+    !isObj(properties) ||
     !Array.isArray(required) ||
     required.some((property) => typeof property !== 'string')
   ) {
@@ -343,6 +345,7 @@ function getClosedObjectPropertySet(
   }
 
   const propertySet = new Set(Object.keys(properties));
+  // SAFETY: The preceding every check proved each required-property name is a string.
   const requiredProperties = required as string[];
   // A required undeclared property makes a closed branch unsatisfiable, but
   // the strictifier rejects that shape rather than representing it. Keep this
@@ -355,9 +358,9 @@ function getClosedObjectPropertySet(
 }
 
 function haveDisjointClosedObjectPropertySets(left: unknown, right: unknown): boolean {
-  const leftShape = getClosedObjectPropertySet(left);
-  const rightShape = getClosedObjectPropertySet(right);
-  if (!leftShape || !rightShape) {
+  const leftPropertySet = getClosedObjectPropertySet(left);
+  const rightPropertySet = getClosedObjectPropertySet(right);
+  if (!leftPropertySet || !rightPropertySet) {
     return false;
   }
 
@@ -366,8 +369,8 @@ function haveDisjointClosedObjectPropertySets(left: unknown, right: unknown): bo
   // an additional property. This proves oneOf exclusivity without widening
   // overlapping closed shapes.
   return (
-    leftShape.required.some((property) => !rightShape.properties.has(property)) ||
-    rightShape.required.some((property) => !leftShape.properties.has(property))
+    leftPropertySet.required.some((property) => !rightPropertySet.properties.has(property)) ||
+    rightPropertySet.required.some((property) => !leftPropertySet.properties.has(property))
   );
 }
 
@@ -395,17 +398,20 @@ function resolveLocalRefForExclusivity(
   schema: unknown,
   root: JSONSchema,
   seenRefs = new Set<string>(),
+  // oxlint-disable-next-line anti-slop/no-unknown-returns -- Resolving untrusted schema references may produce any value; callers perform the schema checks.
 ): unknown | undefined {
-  if (!schema || typeof schema !== 'object' || Array.isArray(schema)) {
+  if (!isObj(schema)) {
     return schema;
   }
 
+  // SAFETY: The preceding guard excludes null, primitives, and arrays; property values remain unknown until their individual schema checks.
   const record = schema as Record<string, unknown>;
   const ref = record['$ref'];
   if (ref !== undefined) {
     // Annotation keywords do not affect Draft 7 validation, so they are safe
     // to retain while proving the referenced branches are mutually exclusive.
     // Keep the proof conservative for every other sibling constraint.
+    // SAFETY: The helper only checks allowed sibling keys on this object; it does not assume that arbitrary property values form a valid schema.
     if (typeof ref !== 'string' || !hasOnlyRefAndAnnotations(record as JSONSchema)) {
       return undefined;
     }
@@ -425,6 +431,7 @@ function resolveLocalRefForExclusivity(
     if (!Array.isArray(record['allOf'])) {
       return undefined;
     }
+    // SAFETY: The allOf value was checked as an array; normalization performs the remaining branch-shape checks before proving exclusivity.
     const normalized = normalizeObjectAllOfForExclusivity(record as JSONSchema, root);
     if (normalized === undefined) {
       return undefined;
@@ -460,9 +467,10 @@ function normalizeStructuredOutputSchema(schema: JSONSchema): JSONSchema {
   const visitedSchemas = new Set<Record<string, unknown>>();
 
   const visitSchema = (value: unknown): void => {
-    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    if (!isObj(value)) {
       return;
     }
+    // SAFETY: The preceding guard excludes null, primitives, and arrays; property values remain unknown until their individual schema checks.
     const record = value as Record<string, unknown>;
     if (visitedSchemas.has(record)) {
       return;
@@ -528,6 +536,7 @@ function parseStandardSchema<Schema extends StandardSchemaLike>(
 ): InferStandardOutput<Schema> {
   const parsed = parseResponseFormatContent({ type: 'json_schema', $parseRaw: undefined }, content);
   const { standard, validate } = getBinding();
+  // oxlint-disable-next-line anti-slop/no-reflect-apply -- A validator may shadow call; invoke the captured function with its original metadata receiver.
   const result = Reflect.apply(validate, standard, [parsed]);
 
   if (isPromiseLike(result)) {
@@ -541,6 +550,7 @@ function parseStandardSchema<Schema extends StandardSchemaLike>(
     throw new OpenAIError(`Standard Schema validation failed: ${formatStandardSchemaIssues(result.issues)}`);
   }
 
+  // SAFETY: The captured Standard Schema validator completed synchronously without issues, so its value follows that schema's inferred output contract.
   return result.value as InferStandardOutput<Schema>;
 }
 
@@ -548,6 +558,7 @@ function resolveStandardJSONSchema<Schema extends StandardSchemaLike>(
   getBinding: () => StandardSchemaBinding<Schema>,
   schemaOverride?: JSONSchema | Record<string, unknown> | undefined,
 ): Record<string, unknown> {
+  // SAFETY: The override or Standard Schema input converter supplies the schema; normalization and strict conversion below validate the supported structure.
   const schema = (schemaOverride ?? getBinding().standard.jsonSchema?.input({ target: 'draft-07' })) as
     | JSONSchema
     | undefined;
@@ -558,7 +569,8 @@ function resolveStandardJSONSchema<Schema extends StandardSchemaLike>(
     );
   }
 
-  return toStrictJsonSchema(normalizeStructuredOutputSchema(schema)) as unknown as Record<string, unknown>;
+  // SAFETY: Strict conversion returns an object schema here; the record view exposes its JSON keyword properties without narrowing their values.
+  return toStrictJsonSchema(normalizeStructuredOutputSchema(schema)) as Record<string, unknown>;
 }
 
 /**

package/src/helpers/zod-v3-strict-schema.ts

@@ -10,6 +10,7 @@ interface SchemaDefinition {
   typeName: string;
   checks?: readonly { kind: string; value?: unknown }[];
   coerce?: boolean;
+  // oxlint-disable-next-line anti-slop/no-shape-in-symbol-names -- Zod v3 defines this property name on object schemas.
   shape: () => Record<string, SchemaNode>;
   type: SchemaNode;
   innerType: SchemaNode;
@@ -32,6 +33,7 @@ interface SchemaChild {
   path: string;
 }
 
+// oxlint-disable-next-line anti-slop/no-known-value-widening -- Runtime Zod type names index this dictionary, including unsupported names outside the known entries.
 const simpleJSONDomains: Readonly<Record<string, JSONDomain['type']>> = {
   ZodString: 'string',
   ZodNumber: 'number',
@@ -109,6 +111,7 @@ function nativeEnumDomains(def: SchemaDefinition): JSONDomain[] {
   if (!definitionValues || Array.isArray(definitionValues)) {
     return [];
   }
+  // SAFETY: The preceding guard accepts a non-array object; its values remain unknown until individual definition checks.
   const object = definitionValues as Record<string, unknown>;
   const values = Object.keys(object)
     .filter((key) => {
@@ -429,12 +432,15 @@ export function assertSupportedZodV3Schema(
   definitions: Record<string, ZodV3Schema> | undefined,
 ): void {
   const visited = new Set<SchemaDefinition>();
-  visit(schema as unknown as SchemaNode, '$', visited);
+  // SAFETY: The public Zod v3 input is viewed through the validator's minimal schema-node contract; visit checks its definition and rejects unsupported kinds.
+  visit(schema as SchemaNode, '$', visited);
   for (const [name, definition] of Object.entries(definitions ?? {})) {
-    visit(definition as unknown as SchemaNode, `$.definitions.${name}`, visited);
+    // SAFETY: The public Zod v3 input is viewed through the validator's minimal schema-node contract; visit checks its definition and rejects unsupported kinds.
+    visit(definition as SchemaNode, `$.definitions.${name}`, visited);
   }
 }
 
+// oxlint-disable-next-line anti-slop/no-object-parameters -- Serialization validation must inspect any object, including arrays and foreign prototypes, without trusting fields.
 function assertNoJSONSerializationHook(value: object, path: string): void {
   for (let current: object | null = value; current !== null; current = Object.getPrototypeOf(current)) {
     const descriptor = Object.getOwnPropertyDescriptor(current, 'toJSON');

package/src/helpers/zod.ts

@@ -16,7 +16,7 @@ import type { ResponseFormatTextJSONSchemaConfig } from '../resources/responses/
 import type { RealtimeFunctionTool } from '../resources/realtime/realtime';
 import { forEachJSONSchemaChild, toStrictJsonSchema } from '../lib/transform';
 import type { JSONSchema } from '../lib/jsonschema';
-import { hasOwn } from '../internal/utils/values';
+import { hasOwn, isObj } from '../internal/utils/values';
 import { assertJSONSerializableSchema, assertSupportedZodV3Schema } from './zod-v3-strict-schema';
 
 type ZodV4Schema = z4.ZodType | z4Mini.ZodMiniType;
@@ -39,6 +39,7 @@ type ZodTypeLike = (
     }
 ) & {
   /** Synchronous schema parser when the validator exposes an instance-level parse method. */
+  // oxlint-disable-next-line anti-slop/no-unknown-returns -- The public schema adapter accepts arbitrary validated outputs and derives their concrete type separately. Zod parsers and their recursive metadata accept untrusted values before schema validation.
   parse?: (data: unknown) => unknown;
 };
 
@@ -97,11 +98,12 @@ function escapeSchemaDefinitionRefs<T extends object>(
 
   const visited = new Set<object>();
   const visit = (value: unknown): void => {
-    if (!value || typeof value !== 'object' || Array.isArray(value) || visited.has(value)) {
+    if (!isObj(value) || visited.has(value)) {
       return;
     }
 
     visited.add(value);
+    // SAFETY: The traversal has excluded primitives, null, arrays, and previously visited objects; schema property values remain unknown for validation.
     const record = value as Record<string, unknown>;
     const ref = record['$ref'];
     if (typeof ref === 'string') {
@@ -134,8 +136,10 @@ function zodV3ToJsonSchema(
   schema: z3.ZodType,
   options: { name: string; schemaDefinitions?: ZodSchemaDefinitions | undefined },
 ): Record<string, unknown> {
+  // SAFETY: This is the Zod v3 conversion path; assertSupportedZodV3Schema verifies the root and named definitions before conversion.
   assertSupportedZodV3Schema(schema, options.schemaDefinitions as Record<string, z3.ZodType> | undefined);
   const rootName = getZodV3RootName(options.name, options.schemaDefinitions);
+  // SAFETY: This is the Zod v3 conversion path; assertSupportedZodV3Schema verifies the root and named definitions before conversion.
   const jsonSchema = _zodToJsonSchema(schema, {
     openaiStrictMode: true,
     name: rootName,
@@ -143,7 +147,7 @@ function zodV3ToJsonSchema(
     $refStrategy: 'extract-to-root',
     nullableStrategy: 'property',
     ...(options.schemaDefinitions
-      ? { definitions: options.schemaDefinitions as unknown as Record<string, z3.ZodType> }
+      ? { definitions: options.schemaDefinitions as Record<string, z3.ZodType> }
       : undefined),
   });
 
@@ -159,15 +163,17 @@ function zodV4ToJsonSchema(
   schema: ZodV4Schema,
   options: { schemaDefinitions?: ZodSchemaDefinitions | undefined } = {},
 ): Record<string, unknown> {
-  const metadata = options.schemaDefinitions ? z4.registry<Record<string, unknown>>() : undefined;
+  const metadata = options.schemaDefinitions ? z4.registry<{ id: string }>() : undefined;
   const definitionNames = new Map<string, string>();
   for (const [name, definition] of Object.entries(options.schemaDefinitions ?? {})) {
     // Avoid `/` and `~` so Zod versions that escape JSON Pointer tokens emit the same IDs.
     const id = encodeURIComponent(name).replace(/~/g, '%7E');
     definitionNames.set(id, name);
-    metadata?.add(definition as unknown as z4.ZodType, { id });
+    // SAFETY: The Zod v4 conversion path registers these definitions with the v4 metadata registry before toJSONSchema uses them.
+    metadata?.add(definition as z4.ZodType, { id });
   }
 
+  // SAFETY: The v4 schema converter produces JSON Schema; the following normalization checks and rewrites its schema records.
   const jsonSchema = z4.toJSONSchema(schema, {
     target: 'draft-7',
     ...(metadata ? { metadata } : undefined),
@@ -208,6 +214,7 @@ function zodV4ToJsonSchema(
     );
   }
 
+  // SAFETY: Strict conversion returns the normalized object schema; the record view exposes keywords without trusting arbitrary values.
   return toStrictJsonSchema(escapedSchema) as Record<string, unknown>;
 }
 
@@ -221,6 +228,7 @@ function zodV3ToNonStrictJsonSchema(schema: z3.ZodType, options: { name: string
 }
 
 function zodV4ToNonStrictJsonSchema(schema: ZodV4Schema): Record<string, unknown> {
+  // SAFETY: Zod v4 owns this JSON Schema output; the record return preserves arbitrary supported keyword properties.
   return z4.toJSONSchema(schema, {
     target: 'draft-7',
     io: 'input',
@@ -236,17 +244,20 @@ function parseZodObject<ZodInput extends ZodTypeLike>(
   content: string,
 ): InferZodType<ZodInput> {
   const parsed = parseResponseFormatContent({ type: 'json_schema', $parseRaw: undefined }, content);
-  const parser = (zodObject as { parse?: (data: unknown) => unknown }).parse;
+  const parser = zodObject.parse;
 
   if (typeof parser === 'function') {
+    // SAFETY: The schema's parse method is invoked with its original receiver and owns the inferred output type.
     const result = parser.call(zodObject, parsed) as InferZodType<ZodInput>;
-    if (!isZodV4(zodObject as unknown as ZodSchema)) {
+    // SAFETY: This read only identifies the supported Zod version before applying its corresponding serialization checks.
+    if (!isZodV4(zodObject as ZodSchema)) {
       assertJSONSerializableSchema(result);
     }
     return result;
   }
 
-  return z4.parse(zodObject as unknown as ZodV4Schema, parsed) as InferZodType<ZodInput>;
+  // SAFETY: Schemas without a parse method use the supported Zod v4 core parser, which validates the input and supplies the inferred output.
+  return z4.parse(zodObject as ZodV4Schema, parsed) as InferZodType<ZodInput>;
 }
 
 /**
@@ -297,7 +308,8 @@ export function zodResponseFormat<ZodInput extends ZodTypeLike>(
   name: string,
   props?: ZodResponseFormatProps,
 ): AutoParseableResponseFormat<InferZodType<ZodInput>> {
-  const zodSchema = zodObject as unknown as ZodSchema;
+  // SAFETY: The public structural Zod input is dispatched by version below; each version-specific converter validates its supported schema contract.
+  const zodSchema = zodObject as ZodSchema;
   const { schemaDefinitions, ...responseFormatProps } = props ?? {};
   validateSchemaDefinitions(schemaDefinitions);
 
@@ -343,7 +355,8 @@ export function zodTextFormat<ZodInput extends ZodTypeLike>(
   name: string,
   props?: Omit<ResponseFormatTextJSONSchemaConfig, 'schema' | 'type' | 'strict' | 'name'>,
 ): AutoParseableTextFormat<InferZodType<ZodInput>> {
-  const zodSchema = zodObject as unknown as ZodSchema;
+  // SAFETY: The public structural Zod input is dispatched by version below; each version-specific converter validates its supported schema contract.
+  const zodSchema = zodObject as ZodSchema;
 
   return makeParseableTextFormat<InferZodType<ZodInput>>(
     {
@@ -366,6 +379,7 @@ interface ZodFunctionOptions<Parameters extends ZodTypeLike> {
   parameters: Parameters;
 
   /** Optional callback invoked with validated arguments by chat `runTools()`. */
+  // oxlint-disable-next-line anti-slop/no-unknown-returns -- Public tool callbacks may return arbitrary application values; preserve the published callback contract.
   function?: ((args: InferZodType<Parameters>) => unknown | Promise<unknown>) | undefined;
 
   /** Optional model-visible explanation of when and how the function should be used. */
@@ -415,7 +429,8 @@ export function zodFunction<Parameters extends ZodTypeLike>(
 /** Builds a strict Chat Completions function tool from the supplied Zod schema. */
 export function zodFunction<Parameters extends ZodTypeLike>(options: ZodFunctionOptions<Parameters>) {
   const parameters = options.parameters;
-  const zodSchema = parameters as unknown as ZodSchema;
+  // SAFETY: The public structural Zod input is dispatched by version below; each version-specific converter validates its supported schema contract.
+  const zodSchema = parameters as ZodSchema;
 
   return makeParseableTool<any>(
     {
@@ -455,6 +470,7 @@ export function zodResponsesFunction<Parameters extends ZodTypeLike>(options: {
   parameters: Parameters;
 
   /** Optional callback retained on the tool; `responses.parse()` does not execute it. */
+  // oxlint-disable-next-line anti-slop/no-unknown-returns -- Public tool callbacks may return arbitrary application values; preserve the published callback contract.
   function?: ((args: InferZodType<Parameters>) => unknown | Promise<unknown>) | undefined;
 
   /** Optional model-visible explanation of when and how the function should be used. */
@@ -467,10 +483,12 @@ export function zodResponsesFunction<Parameters extends ZodTypeLike>(options: {
   name: string;
 
   /** Callback signature associated with validated function-call arguments. */
+  // oxlint-disable-next-line anti-slop/no-unknown-returns -- Public tool callbacks may return arbitrary application values; preserve the published callback contract.
   function: (args: InferZodType<Parameters>) => unknown;
 }> {
   const parameters = options.parameters;
-  const zodSchema = parameters as unknown as ZodSchema;
+  // SAFETY: The public structural Zod input is dispatched by version below; each version-specific converter validates its supported schema contract.
+  const zodSchema = parameters as ZodSchema;
 
   return makeParseableResponseTool<any>(
     {
@@ -510,7 +528,8 @@ export function zodRealtimeFunction<Parameters extends ZodTypeLike>(options: {
   /** Optional model-visible explanation of when and how the function should be used. */
   description?: string | undefined;
 }): RealtimeFunctionTool {
-  const zodSchema = options.parameters as unknown as ZodSchema;
+  // SAFETY: The public structural Zod input is dispatched by version below; each version-specific converter validates its supported schema contract.
+  const zodSchema = options.parameters as ZodSchema;
 
   return {
     type: 'function',

package/src/internal/assistant-stream-delta.ts

@@ -68,7 +68,7 @@ function commitAssistantStreamArrayProjection(projection: AssistantStreamDeltaPr
   }
 }
 
-function isPrimitiveAssistantStreamValue(value: unknown): boolean {
+function isPrimitiveAssistantStreamValue(value: unknown): value is string | number {
   return typeof value === 'string' || typeof value === 'number';
 }
 
@@ -118,6 +118,7 @@ function getAssistantStreamDeltaIndex(
     );
   }
 
+  // SAFETY: Number.isSafeInteger rejects non-numbers before numeric comparisons; the remaining checks enforce the permitted index range.
   if (
     !Number.isSafeInteger(index) ||
     (index as number) < 0 ||
@@ -128,6 +129,7 @@ function getAssistantStreamDeltaIndex(
     throw new OpenAIError(`Assistant stream delta contains an invalid ${kind} index: ${safeIndex}`);
   }
 
+  // SAFETY: Number.isSafeInteger rejects non-numbers before numeric comparisons; the remaining checks enforce the permitted index range.
   return index as number;
 }
 
@@ -323,6 +325,7 @@ function applyAssistantStreamArrayDelta(
         }
         accumulator[index] = deltaEntry;
       } else {
+        // SAFETY: The preceding validation accepts this accumulated record before recursively merging the matching delta entry.
         accumulator[index] = applyRecord(accumulatedEntry as AssistantStreamRecord, deltaEntry);
       }
     } else {
@@ -398,11 +401,14 @@ export function assertSafeAssistantStreamDelta(value: unknown): void {
 
 export function accumulateAssistantStreamDelta<Accumulator extends object>(
   accumulator: Accumulator,
+  // oxlint-disable-next-line anti-slop/no-object-parameters -- This exported accumulator accepts heterogeneous partial SDK deltas and validates their properties at runtime.
   delta: object,
   cacheArrays = false,
 ): Accumulator {
   assertSafeAssistantStreamDelta(delta);
+  // SAFETY: The generic accumulator uses record entries after delta validation; recursive merge retains the original accumulator's public type.
   const accumulatorRecord = accumulator as AssistantStreamRecord;
+  // SAFETY: The generic accumulator uses record entries after delta validation; recursive merge retains the original accumulator's public type.
   const deltaRecord = delta as AssistantStreamRecord;
   const projection = createAssistantStreamDeltaProjection(
     cacheArrays && !isAssistantStreamValueExternallyMutable(accumulator),

package/src/internal/auth/x509-credential-options.ts

@@ -13,6 +13,7 @@ export function normalizeX509CredentialOptions(options: ClientOptions): {
 } {
   const { credential } = options;
   if (credential === undefined) {
+    // oxlint-disable-next-line anti-slop/no-known-value-widening -- Preserve the exported normalization contract when no X.509 credential is configured.
     return { credential, options };
   }
 
@@ -32,6 +33,7 @@ export function normalizeX509CredentialOptions(options: ClientOptions): {
     );
   }
 
+  // oxlint-disable-next-line anti-slop/no-known-value-widening -- The declared ClientOptions return contract supports both normalized and unchanged client options.
   return {
     credential,
     options: {
@@ -142,5 +144,6 @@ export function prepareX509ClientClone(
     }
   }
 
+  // oxlint-disable-next-line anti-slop/no-known-value-widening -- Preserve the exported clone contract across inherited and replaced credentials and providers.
   return { credential: nextCredential, provider: prepareProviderClone(inherited, overrides) };
 }

package/src/internal/auth/x509-token-exchange.ts

@@ -74,6 +74,7 @@ function cancelResponseBody(response: Response): void {
   }
 }
 
+// oxlint-disable-next-line anti-slop/no-unknown-returns -- Decoded token JSON remains untrusted until the caller validates its fields.
 async function readResponseBody(response: Response, signal?: AbortSignal): Promise<unknown> {
   if (!response.body) {
     throw new OpenAIError('X.509 workload identity token exchange returned invalid JSON.');
@@ -124,12 +125,20 @@ async function readResponseBody(response: Response, signal?: AbortSignal): Promi
   }
 }
 
+interface UnvalidatedTokenResponse {
+  access_token?: unknown;
+  token_type?: unknown;
+  issued_token_type?: unknown;
+  expires_in?: unknown;
+}
+
 function validateTokenResponse(value: unknown): X509ExchangedToken {
   if (typeof value !== 'object' || value === null || Array.isArray(value)) {
     throw new OpenAIError('X.509 workload identity token exchange returned an invalid token response.');
   }
 
-  const response = value as Record<string, unknown>;
+  // SAFETY: The object check above establishes a container; optional unknown fields make no claim about its values.
+  const response = value as UnvalidatedTokenResponse;
   if (
     !hasOwn(response, 'access_token') ||
     typeof response['access_token'] !== 'string' ||

package/src/internal/auth/x509-transport-capability.ts

@@ -44,7 +44,7 @@ class NodeX509Transport implements X509Transport {
     Object.freeze(this);
   }
 
-  static dispatcher(value: object): Agent | ProxyAgent | undefined {
+  static dispatcher(value: X509Transport): Agent | ProxyAgent | undefined {
     return #dispatcher in value ? value.#dispatcher : undefined;
   }
 }
@@ -66,6 +66,7 @@ export function registerX509Transport(transport: X509Transport, registered: Regi
   rememberRegisteredX509Transport(transport, Object.freeze(registered));
 }
 
+// oxlint-disable-next-line anti-slop/no-unknown-returns -- Own data-property values must remain untrusted until their option-specific validators run.
 function dataOption(options: X509TransportOptions, name: keyof X509TransportOptions): unknown {
   const descriptor = Object.getOwnPropertyDescriptor(options, name);
   if (!descriptor || !('value' in descriptor)) {

package/src/internal/auth/x509-workload-identity-auth.ts

@@ -43,10 +43,7 @@ function assertSafeHeaders(headers: Headers): void {
   }
 }
 
-function exchangeDeadline(
-  timeout: number | undefined,
-  callerSignal: AbortSignal | null | undefined,
-): { signal: AbortSignal; dispose: () => void } {
+function exchangeDeadline(timeout: number | undefined, callerSignal: AbortSignal | null | undefined) {
   const deadline = new AbortController();
   const timer =
     timeout === undefined
@@ -104,10 +101,7 @@ interface X509TokenRequestContext {
   fetchOptions: MergedRequestInit;
 }
 
-function waitForRefresh(
-  attempt: X509RefreshAttempt,
-  signal: AbortSignal,
-): { result: Promise<X509ExchangedToken>; dispose: () => void } {
+function waitForRefresh(attempt: X509RefreshAttempt, signal: AbortSignal) {
   let abort: (() => void) | undefined;
   // AbortSignal remains callback-only on supported TypeScript/runtime combinations.
   // oxlint-disable-next-line promise/avoid-new -- A callback-only AbortSignal must race a shared refresh.
@@ -145,6 +139,7 @@ export function isX509WorkloadIdentity(
       }
       break;
     }
+    // SAFETY: Object.getPrototypeOf returns an object or null; the traversal checks descriptors rather than assuming a credential-provider subtype.
     providerOwner = Object.getPrototypeOf(providerOwner) as object | null;
   }
 
@@ -157,6 +152,7 @@ export function isX509WorkloadIdentity(
       }
       return discriminator.value === 'x509';
     }
+    // SAFETY: Object.getPrototypeOf returns an object or null; the traversal checks descriptors rather than assuming a credential-provider subtype.
     current = Object.getPrototypeOf(current) as object | null;
   }
   return false;
@@ -267,9 +263,11 @@ export class X509WorkloadIdentityAuth {
       type: 'x509',
       identityProviderId: this.#identityProviderId,
       serviceAccountId: this.#serviceAccountId,
+      // Spread creates an own data property without invoking inherited setters or changing the object prototype.
       ...(this.#configuredRefreshBufferMs === undefined
         ? {}
         : { refreshBufferMs: this.#configuredRefreshBufferMs }),
+      // Spread creates an own data property without invoking inherited setters or changing the object prototype.
       ...(this.#configuredRefreshBufferSeconds === undefined
         ? {}
         : { refreshBufferSeconds: this.#configuredRefreshBufferSeconds }),
@@ -302,6 +300,7 @@ export class X509WorkloadIdentityAuth {
     if (!defaultHeaders || !requestHeaders) {
       throw new OpenAIError('X.509 workload identity requires snapshotted request headers.');
     }
+    // oxlint-disable-next-line anti-slop/no-known-value-widening -- The exposed snapshot contract deliberately hides the private request-scope representation.
     return { defaultHeaders, requestHeaders };
   }
 
@@ -495,6 +494,7 @@ export class X509WorkloadIdentityAuth {
   }
 
   /** Establishes an independent scope even when concurrent requests share caller options. */
+  // oxlint-disable-next-line anti-slop/no-object-parameters -- Logical request owners are opaque identity tokens; their properties are never read.
   runRequest<T>(operation: () => Promise<T>, requestOwner: object): Promise<T> {
     return this.#transport.run(async () => {
       const scope = this.#transport.current();
@@ -515,6 +515,7 @@ export class X509WorkloadIdentityAuth {
   }
 
   /** Reports whether a public request-building call already belongs to an active logical operation. */
+  // oxlint-disable-next-line anti-slop/no-object-parameters -- Request scope membership compares the opaque caller token by identity only.
   inRequest(requestOwner: object): boolean {
     const scope = this.#transport.current();
     return scope?.owner === this && scope.requestOwner === requestOwner && scope.phase !== 'authorizing';
@@ -540,9 +541,13 @@ export class X509WorkloadIdentityAuth {
       wallStartedAt,
       monotonicStartedAt,
       owner: this,
+      // Spread creates an own data property without invoking inherited setters or changing the object prototype.
       ...(deadlineArmed ? { deadlineArmed } : {}),
+      // Spread creates an own data property without invoking inherited setters or changing the object prototype.
       ...(request ? { request } : {}),
+      // Spread creates an own data property without invoking inherited setters or changing the object prototype.
       ...(effectiveSignal ? { effectiveSignal } : {}),
+      // Spread creates an own data property without invoking inherited setters or changing the object prototype.
       ...(requestOwner ? { requestOwner } : {}),
     };
     return (operation) =>