openai 7.16.0 → 7.17.0

package/src/internal/bedrock.ts

@@ -54,6 +54,7 @@ export type BedrockAuthFactory = () => BedrockRequestAuth;
 
 /** Wraps a provider failure in an SDK error while preserving its original cause. */
 export function errorWithCause(message: string, cause: unknown): Errors.OpenAIError {
+  // SAFETY: This SDK error is created locally and receives its optional cause immediately below; no existing error shape is trusted.
   const error = new Errors.OpenAIError(message) as Errors.OpenAIError & { cause?: unknown };
   error.cause = cause;
   return error;
@@ -61,6 +62,7 @@ export function errorWithCause(message: string, cause: unknown): Errors.OpenAIEr
 
 /** Trims a configuration string, treating missing and whitespace-only values as absent. */
 export function normalizeOptionalString(value: string | null | undefined): string | undefined {
+  // oxlint-disable-next-line anti-slop/no-runtime-typeof -- Bedrock credential and origin checks validate JavaScript configuration before any credential is sent.
   const normalized = typeof value === 'string' ? value.trim() : undefined;
   return normalized || undefined;
 }
@@ -207,6 +209,7 @@ export function resolveBedrockEndpoint(options: BedrockEndpointOptions): {
     const endpoint =
       options.endpoint ?? parseBedrockEndpointHostname(new URL(baseURL).hostname)?.endpoint ?? 'mantle';
     validateCanonicalBedrockEndpoint(baseURL, endpoint, region);
+    // oxlint-disable-next-line anti-slop/no-known-value-widening -- Preserve the declared endpoint resolver contract across configured URLs and inferred regions.
     return { endpoint, region, baseURL };
   }
   const endpoint = options.endpoint ?? 'mantle';
@@ -220,6 +223,7 @@ export function resolveBedrockEndpoint(options: BedrockEndpointOptions): {
     endpoint === 'runtime'
       ? `bedrock-runtime.${region}.${resolveRuntimeDnsSuffixes(region)[0]}`
       : `bedrock-mantle.${region}.api.aws`;
+  // oxlint-disable-next-line anti-slop/no-known-value-widening -- The resolver intentionally returns its declared endpoint contract across all configuration paths.
   return { endpoint, region, baseURL: `https://${hostname}/openai/v1` };
 }
 
@@ -245,7 +249,9 @@ export function assertBedrockRequestOrigin(baseURL: string, requestURL: string):
 }
 
 /** Validates a final WebSocket URL before a legacy Bedrock client resolves or attaches credentials. */
+// oxlint-disable-next-line anti-slop/no-unknown-parameters -- The WebSocket authentication boundary verifies the caller client at runtime before trusting provider metadata.
 export function assertBedrockWebSocketOrigin(client: unknown, requestURL: URL): void {
+  // oxlint-disable-next-line anti-slop/no-runtime-typeof -- Bedrock credential and origin checks validate JavaScript configuration before any credential is sent.
   if (typeof client !== 'object' || client === null || !(brand_privateBedrockClient in client)) {
     return;
   }
@@ -257,7 +263,9 @@ export function assertBedrockWebSocketOrigin(client: unknown, requestURL: URL):
     normalizedRequestURL.protocol = 'http:';
   }
 
+  // SAFETY: The private Bedrock brand checked above identifies the client whose baseURL is validated against the finalized request origin.
   assertBedrockRequestOrigin(
+    // oxlint-disable-next-line anti-slop/no-chained-type-assertions -- The private Bedrock client brand checked above identifies the client baseURL contract.
     (client as unknown as { baseURL: string }).baseURL,
     normalizedRequestURL.toString(),
   );
@@ -346,6 +354,7 @@ function resolveAbortableBedrockAuth<T>(
       }
     };
 
+    // oxlint-disable-next-line anti-slop/no-unknown-parameters -- Failures and rejection reasons can be arbitrary JavaScript values; preserve them until inspection or forwarding.
     const rejectSignalFailure = (error: unknown) => {
       if (failure.error) {
         return;
@@ -483,6 +492,7 @@ class BedrockBearerAuth implements BedrockRequestAuth {
       resolve: () => this.tokenProvider(),
       failureMessage: 'Failed to resolve a bearer credential for Bedrock.',
       apply: (token) => {
+        // oxlint-disable-next-line anti-slop/no-runtime-typeof -- Bedrock credential and origin checks validate JavaScript configuration before any credential is sent.
         if (typeof token !== 'string' || !token.trim()) {
           throw new Errors.OpenAIError(
             'The Bedrock bearer credential provider must return a non-empty string.',
@@ -533,6 +543,7 @@ export function resolveBedrockBearerAuth(
   if (
     options.apiKey !== undefined &&
     options.apiKey !== null &&
+    // oxlint-disable-next-line anti-slop/no-runtime-typeof -- Bedrock credential and origin checks validate JavaScript configuration before any credential is sent.
     (typeof options.apiKey !== 'string' || !options.apiKey.trim())
   ) {
     throw new Errors.OpenAIError('The Bedrock bearer credential must not be empty.');
@@ -545,13 +556,16 @@ export function resolveBedrockBearerAuth(
 
   if (options.tokenProvider) {
     const tokenProvider = options.tokenProvider;
+    // oxlint-disable-next-line anti-slop/no-known-value-widening -- The declared bearer-auth contract hides concrete authenticator implementations behind their factory.
     return { factory: () => new BedrockBearerAuth(tokenProvider), explicit: true };
   }
   if (options.apiKey != null) {
     const apiKey = options.apiKey;
+    // oxlint-disable-next-line anti-slop/no-known-value-widening -- Explicit API keys use the same declared auth-factory contract as token providers.
     return { factory: () => new BedrockBearerAuth(async () => apiKey), explicit: true };
   }
   if (allowEnvironment && options.apiKey !== null && readEnv('AWS_BEARER_TOKEN_BEDROCK')) {
+    // oxlint-disable-next-line anti-slop/no-known-value-widening -- Environment credentials must preserve the same declared auth-factory contract as explicit options.
     return {
       explicit: false,
       factory: () =>
@@ -567,5 +581,6 @@ export function resolveBedrockBearerAuth(
     };
   }
 
+  // oxlint-disable-next-line anti-slop/no-known-value-widening -- The declared optional factory contract also represents the absence of bearer credentials.
   return { factory: undefined, explicit: false };
 }

package/src/internal/decoders/line.ts

@@ -55,6 +55,7 @@ export class LineDecoder {
     let binaryChunk: Uint8Array;
     if (chunk instanceof ArrayBuffer) {
       binaryChunk = new Uint8Array(chunk);
+      // oxlint-disable-next-line anti-slop/no-runtime-typeof -- The line decoder accepts both text and binary chunks and must select the matching decoding path.
     } else if (typeof chunk === 'string') {
       binaryChunk = encodeUTF8(chunk);
     } else {

package/src/internal/parse.ts

@@ -9,6 +9,7 @@ export type APIResponseProps = {
   response: Response;
   options: FinalRequestOptions;
   controller: AbortController;
+  requestSignal?: AbortSignal | null | undefined;
   requestLogID: string;
   retryOfRequestLogID: string | undefined;
   startTime: number;

package/src/internal/provider.ts

@@ -54,7 +54,9 @@ export interface ProviderDefinition {
  * provider configurations.
  */
 const providerDefinitionsKey = Symbol.for('openai.node.providerDefinitions.v1');
+// SAFETY: This versioned global symbol is the SDK-owned cross-copy WeakMap registry; no provider object fields are trusted through it.
 const providerGlobal = globalThis as any;
+// SAFETY: This versioned global symbol is the SDK-owned cross-copy WeakMap registry; no provider object fields are trusted through it.
 const existingProviderDefinitions = providerGlobal[providerDefinitionsKey] as
   | WeakMap<Provider, ProviderDefinition>
   | undefined;
@@ -70,6 +72,7 @@ if (!existingProviderDefinitions) {
  * installed copy of the SDK in the same JavaScript realm.
  */
 export function createProvider(definition: ProviderDefinition): Provider {
+  // SAFETY: This function creates the opaque handle and immediately registers its identity in the private WeakMap, which is the runtime brand check.
   const provider = Object.freeze({}) as Provider;
   providerDefinitions.set(provider, definition);
   return provider;

package/src/internal/qs/stringify.ts

@@ -22,6 +22,7 @@ const push_to_array = function push_to_array(arr: any[], value_or_array: any) {
 
 let toISOString;
 
+// SAFETY: The defaults object supplies the serializer's established non-null option values and RFC formatter; callers still merge their overrides separately.
 const defaults = {
   addQueryPrefix: false,
   allowDots: false,
@@ -172,6 +173,7 @@ function inner_stringify(
   }
 
   for (const key of obj_keys) {
+    // SAFETY: The serializer supports its existing encoded-key wrapper or property key; the branch selects the wrapper value before indexing the object.
     const value =
       // @ts-ignore
       typeof key === 'object' && key.value !== undefined ? key.value : obj[key as any];
@@ -180,6 +182,7 @@ function inner_stringify(
       continue;
     }
 
+    // SAFETY: Dot encoding applies the serializer's existing string-key protocol; this cast preserves its legacy mixed key representation.
     // @ts-ignore
     const encoded_key = allowDots && encodeDotInKeys ? (key as any).replace(/\./g, '%2E') : key;
     let key_prefix: string;

package/src/internal/qs/utils.ts

@@ -2,16 +2,20 @@ import { RFC1738 } from './formats';
 import type { DefaultEncoder, Format } from './types';
 import { isArray } from '../utils/values';
 
+// oxlint-disable-next-line anti-slop/no-object-parameters -- The cached own-property predicate accepts arrays, callable objects, and records.
 let cachedHas: ((obj: object, key: PropertyKey) => boolean) | undefined;
 
+// oxlint-disable-next-line anti-slop/no-object-parameters -- Own-property lookup is a generic object primitive and must preserve array and callable inputs.
 export const has = (obj: object, key: PropertyKey): boolean => {
+  // SAFETY: Object.hasOwn is an optional native capability; older runtimes use the bound hasOwnProperty fallback with the same own-key semantics.
+  // oxlint-disable-next-line anti-slop/no-object-parameters -- The native or compatibility own-property predicate has the same generic object contract.
   const resolvedHas: (obj: object, key: PropertyKey) => boolean =
     cachedHas ?? (Object as any).hasOwn ?? Function.prototype.call.bind(Object.prototype.hasOwnProperty);
   cachedHas = resolvedHas;
   return resolvedHas(obj, key);
 };
 
-function isUnsafePropertyKey(key: unknown): boolean {
+function isUnsafePropertyKey(key: PropertyKey): boolean {
   return key === '__proto__' || key === 'constructor' || key === 'prototype';
 }
 
@@ -39,6 +43,7 @@ interface MergeState {
 const maxAdoptedRecords = 10_000;
 
 function isIntrinsicFunctionPrototype(
+  // oxlint-disable-next-line anti-slop/no-object-parameters -- Prototype descriptors are inspected before deciding whether an arbitrary adopted value is callable.
   value: object,
   key: PropertyKey,
   descriptor: PropertyDescriptor,
@@ -52,6 +57,7 @@ function isObjectLike(value: unknown): value is object {
   return value !== null && (typeof value === 'object' || typeof value === 'function');
 }
 
+// oxlint-disable-next-line anti-slop/no-object-parameters -- Adoption records retain arbitrary merge-target identities for later descriptor validation.
 function rememberAdoption(state: MergeState, target: object, key: PropertyKey, value: any): void {
   if (!isObjectLike(value)) {
     return;
@@ -77,6 +83,7 @@ function sanitizeAdoptions(state: MergeState): void {
   }[] = [];
   let inspectedProperties = 0;
 
+  // oxlint-disable-next-line anti-slop/no-object-parameters -- Adoption validation inspects arbitrary objects, including arrays and functions, before trusting their structure.
   function inspect(value: object): AdoptedRecord {
     const known = records.get(value);
     if (known) {
@@ -131,7 +138,7 @@ function sanitizeAdoptions(state: MergeState): void {
   const detached: AdoptedRecord[] = [];
   for (const record of visited) {
     for (const key of record.keys) {
-      const descriptor = Reflect.get(record.descriptors, key) as PropertyDescriptor | undefined;
+      const descriptor = record.descriptors[key];
       if (!descriptor) {
         continue;
       }
@@ -204,7 +211,7 @@ function sanitizeAdoptions(state: MergeState): void {
       if (isUnsafePropertyKey(key)) {
         continue;
       }
-      const descriptor = Reflect.get(record.descriptors, key) as PropertyDescriptor | undefined;
+      const descriptor = record.descriptors[key];
       if (!descriptor) {
         continue;
       }
@@ -239,12 +246,14 @@ function readPreparedTarget(state: MergeState, target: any, key: PropertyKey): a
   return target[key];
 }
 
+// oxlint-disable-next-line anti-slop/no-object-parameters -- Merge targets may contain accessors or custom prototypes, so the preview preserves the generic object boundary.
 function previewTarget(state: MergeState, target: object, key: PropertyKey): any {
   const descriptor = Object.getOwnPropertyDescriptor(target, key);
   if (descriptor && 'value' in descriptor) {
     return descriptor.value;
   }
 
+  // oxlint-disable-next-line anti-slop/no-reflect-get -- Generic query merging snapshots arbitrary inherited/accessor keys before mutation.
   const value = Reflect.get(target, key, target);
   let prepared = state.preparedTargets.get(target);
   if (!prepared) {
@@ -280,11 +289,13 @@ function prepareMergeSource(target: any, source: any, state: MergeState, assign
   }
   state.inspectedSourceProperties += sourceKeys.length;
   const sourceIsArray = isArray(source);
+  // oxlint-disable-next-line anti-slop/no-unsafe-dictionary-type -- The query merge graph preserves heterogeneous scalar, array, and object values under its existing merge contract.
   const prepared: Record<string, any> = sourceIsArray ? [] : Object.create(null);
   preparedTargets.set(target, prepared);
 
   if (isArray(target) && sourceIsArray && !assign) {
     const sourceLength = source.length;
+    // SAFETY: prepared was constructed as an array when sourceIsArray is true, which this branch requires.
     (prepared as any[]).length = sourceLength;
     for (let index = 0; index < sourceLength; index += 1) {
       if (!(index in source)) {

package/src/internal/responses/response-accumulator.ts

@@ -128,6 +128,7 @@ type ResponseIgnoredEvent = Extract<
       | 'response.audio.done'
       | 'response.audio.transcript.delta'
       | 'response.audio.transcript.done'
+      | 'response.compaction.compacting'
       | 'response.image_generation_call.partial_image'
       | 'response.mcp_list_tools.in_progress'
       | 'response.mcp_list_tools.completed'
@@ -198,6 +199,7 @@ function hasRoutedOutputCallIdentity(
 }
 
 function getOutputItemIdentityKeys(output: Response['output'][number], eventType: string): string[] {
+  // oxlint-disable-next-line anti-slop/no-runtime-typeof -- Validate untrusted streamed item identifiers and discriminators before mutating the response snapshot.
   if (!hasOwn(output, 'type') || typeof output.type !== 'string') {
     throw new OpenAIError(`expected an own output item type for ${eventType}`);
   }
@@ -206,6 +208,7 @@ function getOutputItemIdentityKeys(output: Response['output'][number], eventType
   const identities: string[] = [];
 
   if (hasOwn(output, 'id')) {
+    // oxlint-disable-next-line anti-slop/no-runtime-typeof -- Validate untrusted streamed item identifiers and discriminators before mutating the response snapshot.
     if (typeof output.id !== 'string' || output.id.length === 0) {
       throw new OpenAIError(`expected a non-empty output item id for ${eventType}`);
     }
@@ -215,6 +218,7 @@ function getOutputItemIdentityKeys(output: Response['output'][number], eventType
   }
 
   if (hasRoutedOutputCallIdentity(output)) {
+    // oxlint-disable-next-line anti-slop/no-runtime-typeof -- Validate untrusted streamed item identifiers and discriminators before mutating the response snapshot.
     if (!hasOwn(output, 'call_id') || typeof output.call_id !== 'string' || output.call_id.length === 0) {
       throw new OpenAIError(`expected a non-empty output item call_id for ${eventType}`);
     }
@@ -328,6 +332,7 @@ const expectedOutputItemTypes = {
   'response.mcp_list_tools.in_progress': 'mcp_list_tools',
   'response.mcp_list_tools.completed': 'mcp_list_tools',
   'response.mcp_list_tools.failed': 'mcp_list_tools',
+  'response.compaction.compacting': 'compaction',
 } satisfies Record<
   Exclude<ResponseItemScopedEvent['type'], 'response.content_part.added' | 'response.content_part.done'>,
   Response['output'][number]['type']
@@ -400,7 +405,9 @@ function validateOutputItemIdentity(
     return;
   }
 
+  // SAFETY: The event type was classified as item-scoped; the following checks validate its own item_id before use.
   const itemEvent = event as ResponseItemScopedEvent;
+  // oxlint-disable-next-line anti-slop/no-runtime-typeof -- Validate untrusted streamed item identifiers and discriminators before mutating the response snapshot.
   if (!hasOwn(event, 'item_id') || typeof itemEvent.item_id !== 'string' || itemEvent.item_id.length === 0) {
     throw new OpenAIError(`expected a non-empty item_id for ${event.type}`);
   }
@@ -514,6 +521,7 @@ const supportedResponseEventTypes = createSupportedResponseEventTypes([
   'response.audio.done',
   'response.audio.transcript.delta',
   'response.audio.transcript.done',
+  'response.compaction.compacting',
   'response.image_generation_call.partial_image',
   'response.mcp_list_tools.in_progress',
   'response.mcp_list_tools.completed',
@@ -535,19 +543,37 @@ const responseEventRoutingFields = [
   'summary_index',
 ] as const;
 
-function sanitizeResponseEvent(event: ResponseAccumulatorEvent): ResponseAccumulatorEvent {
+// These fields are snapshotted before the event-specific validators inspect them.
+interface ResponseEventPayload {
+  item_id?: unknown;
+  output_index?: unknown;
+  content_index?: unknown;
+  annotation_index?: unknown;
+  command_index?: unknown;
+  summary_index?: unknown;
+  item?: unknown;
+  part?: unknown;
+}
+
+function sanitizeResponseEvent(
+  event: ResponseAccumulatorEvent & ResponseEventPayload,
+): ResponseAccumulatorEvent {
   let descriptor: PropertyDescriptor | undefined;
   try {
     descriptor = Object.getOwnPropertyDescriptor(event, 'type');
   } catch {
+    // SAFETY: assertNever always throws; the cast routes invalid runtime events through the existing unsupported-event error path.
     return assertNever(event as never);
   }
 
   const type: unknown = descriptor?.value;
+  // SAFETY: The string is used only as a Set lookup key; membership performs the supported-event check.
   if (
+    // oxlint-disable-next-line anti-slop/no-runtime-typeof -- Validate untrusted streamed item identifiers and discriminators before mutating the response snapshot.
     typeof type !== 'string' ||
     !supportedResponseEventTypes.has(type as ResponseAccumulatorEvent['type'])
   ) {
+    // SAFETY: assertNever always throws; the cast routes invalid runtime events through the existing unsupported-event error path.
     return assertNever(event as never);
   }
 
@@ -566,21 +592,23 @@ function sanitizeResponseEvent(event: ResponseAccumulatorEvent): ResponseAccumul
     try {
       for (const field of responseEventRoutingFields) {
         const routingDescriptor = Object.getOwnPropertyDescriptor(event, field);
-        stableValues.set(field, routingDescriptor ? Reflect.get(event, field, event) : undefined);
+        stableValues.set(field, routingDescriptor ? event[field] : undefined);
       }
 
       if (type === 'response.output_item.done') {
-        stableValues.set('item', structuredClone(Reflect.get(event, 'item', event)));
+        stableValues.set('item', structuredClone(event.item));
       } else if (type === 'response.content_part.added' || type === 'response.content_part.done') {
-        stableValues.set('part', structuredClone(Reflect.get(event, 'part', event)));
+        stableValues.set('part', structuredClone(event.part));
       }
     } catch {
+      // SAFETY: assertNever always throws; the cast routes invalid runtime events through the existing unsupported-event error path.
       return assertNever(event as never);
     }
   }
 
   return new Proxy(event, {
     get(target, property) {
+      // oxlint-disable-next-line anti-slop/no-reflect-get -- Proxy forwarding must preserve arbitrary keys with the original target as accessor receiver.
       return stableValues.has(property) ? stableValues.get(property) : Reflect.get(target, property, target);
     },
   });
@@ -772,6 +800,7 @@ function accumulateOutputTextEvent(
           throw new OpenAIError(`expected content to be 'output_text', got ${content.type}`);
         }
         validateArrayIndex(content.annotations, event.annotation_index, 'annotation', true);
+        // SAFETY: The output_text discriminator and annotation index were checked; the annotation is cloned from the corresponding API event contract.
         content.annotations[event.annotation_index] = structuredClone(
           event.annotation,
         ) as ResponseOutputText['annotations'][number];
@@ -1151,6 +1180,7 @@ function isIgnoredResponseEvent(event: ResponseAccumulatorEvent): event is Respo
     case 'response.audio.done':
     case 'response.audio.transcript.delta':
     case 'response.audio.transcript.done':
+    case 'response.compaction.compacting':
     case 'response.image_generation_call.partial_image':
     case 'response.mcp_list_tools.in_progress':
     case 'response.mcp_list_tools.completed':

package/src/internal/to-file.ts

@@ -186,7 +186,7 @@ async function getBytes(value: BlobLikePart | AsyncIterable<BlobLikePart>): Prom
     isAsyncIterable(value) // includes Readable, ReadableStream, etc.
   ) {
     for await (const chunk of value) {
-      parts.push(...(await getBytes(chunk as BlobLikePart)));
+      parts.push(...(await getBytes(chunk)));
     }
   } else {
     const constructor = value?.constructor?.name;

package/src/internal/uploads.ts

@@ -105,6 +105,7 @@ type NamedBlob = Blob & {
  */
 export const checkFileSupport = () => {
   if (typeof File === 'undefined') {
+    // SAFETY: This optional Node global is inspected only to improve the missing-File diagnostic in runtimes without process.
     const { process } = globalThis as any;
     const isOldNode =
       typeof process?.versions?.node === 'string' &&
@@ -148,6 +149,7 @@ export function makeFile(
   options?: FilePropertyBag,
 ): File {
   checkFileSupport();
+  // SAFETY: The SDK BlobPart union supports Node and web binary inputs; the native File constructor handles those parts across their differing ambient types.
   return new File(fileBits as any, fileName ?? 'unknown_file', options);
 }
 
@@ -268,6 +270,7 @@ const supportsFormDataMap = /* @__PURE__ */ new WeakMap<Fetch, Promise<boolean>>
  * confusing error messages later on.
  */
 function supportsFormData(fetchObject: OpenAI | Fetch): Promise<boolean> {
+  // SAFETY: The union has already excluded callable fetch values; the remaining OpenAI client owns the fetch implementation used by this probe.
   const fetch: Fetch = typeof fetchObject === 'function' ? fetchObject : (fetchObject as any).fetch;
   const cached = supportsFormDataMap.get(fetch);
   if (cached) {
@@ -277,10 +280,12 @@ function supportsFormData(fetchObject: OpenAI | Fetch): Promise<boolean> {
     try {
       let FetchResponse: typeof Response;
       if ('Response' in fetch) {
+        // SAFETY: Custom fetch implementations may expose their matching Response constructor; the enclosing probe catches incompatible constructors.
         FetchResponse = fetch.Response as typeof Response;
       } else {
         const response = await fetch('data:,');
         await response.arrayBuffer();
+        // SAFETY: The successful fetch response supplies the constructor used to test its own FormData support; failures remain inside the probe's catch.
         FetchResponse = response.constructor as typeof Response;
       }
       const data = new FormData();
@@ -351,6 +356,7 @@ const isUploadable = (value: unknown): value is Uploadable =>
     isStreamingFile(value) ||
     isBlob(value));
 
+// SAFETY: The enclosing object guard and own-key enumeration allow reading these property values without assigning them a trusted value type.
 const hasStreamingUploadableValue = (value: unknown): boolean => {
   if (isStreamingFile(value) || isAsyncIterable(value) || isReadableStream(value)) {
     return true;
@@ -369,6 +375,7 @@ const hasStreamingUploadableValue = (value: unknown): boolean => {
   return false;
 };
 
+// SAFETY: The enclosing object guard and own-key enumeration allow reading these property values without assigning them a trusted value type.
 const hasUploadableValue = (value: unknown): boolean => {
   if (isUploadable(value)) {
     return true;
@@ -496,6 +503,7 @@ function* iterateFormValue(key: string, value: unknown): Generator<FormEntry> {
 }
 
 function getStreamingFileName(value: Uploadable, options: CreateFormOptions): string {
+  // oxlint-disable-next-line anti-slop/no-known-value-widening -- The runtime guard validates JavaScript and custom upload values before trusting the StreamingFile brand.
   if (isStreamingFile(value)) {
     const { name } = value;
     if (typeof name !== 'string' || !name) {
@@ -513,6 +521,7 @@ function getStreamingFileName(value: Uploadable, options: CreateFormOptions): st
 function getStreamingFileType(value: Uploadable): string {
   let type: string | undefined;
 
+  // oxlint-disable-next-line anti-slop/no-known-value-widening -- Runtime upload-brand checks intentionally accept unknown inputs despite the static Uploadable annotation.
   if (isStreamingFile(value) || isBlob(value)) {
     ({ type } = value);
   } else if (value instanceof Response) {
@@ -537,7 +546,8 @@ function validateStreamingFileType(type: string): string {
   return type;
 }
 
-function getStreamingFileData(value: Uploadable): unknown {
+function getStreamingFileData(value: Uploadable): Exclude<Uploadable, StreamingFile> {
+  // oxlint-disable-next-line anti-slop/no-known-value-widening -- The runtime guard validates the streaming wrapper before accessing its potentially custom data.
   if (isStreamingFile(value)) {
     return value.data;
   }

package/src/internal/utils/abort.ts

@@ -4,16 +4,18 @@ interface WeakReference<T> {
 }
 type WeakAbortCallback = WeakReference<AbortCallback>;
 interface AbortFinalizer {
-  register: (target: AbortCallback, cleanup: AbortCallback, token: object) => void;
-  unregister: (token: object) => boolean;
+  register: (target: AbortCallback, cleanup: AbortCallback, token: WeakAbortCallback) => void;
+  unregister: (token: WeakAbortCallback) => boolean;
 }
 
 // Keep these optional runtime features out of the SDK's ES2020 type requirements.
+// SAFETY: These host features are optional and checked before use; the structural view avoids requiring newer ambient library declarations.
 const weakGlobals = globalThis as typeof globalThis & {
   WeakRef?: new <T extends object>(target: T) => WeakReference<T>;
   FinalizationRegistry?: new (cleanup: (value: AbortCallback) => void) => AbortFinalizer;
 };
 const finalizer =
+  // oxlint-disable-next-line anti-slop/no-runtime-typeof -- Weak references and finalizers are optional host capabilities, so probe them before constructing either.
   typeof weakGlobals.FinalizationRegistry === 'function'
     ? new weakGlobals.FinalizationRegistry((cleanup) => {
         try {
@@ -68,10 +70,12 @@ function releaseOnAbort(
 
 /** Keep cancellation alive until abort or collection of the response body or bodyless custom response. */
 export function retainRequestAbortCallback(
+  // oxlint-disable-next-line anti-slop/no-object-parameters -- Abort callbacks are retained by any response-body or custom-response owner identity.
   owner: object,
   abort: AbortCallback,
   requestSignal: AbortSignal,
 ): void {
+  // oxlint-disable-next-line anti-slop/no-runtime-typeof -- Weak references and finalizers are optional host capabilities, so probe them before constructing either.
   if (typeof weakGlobals.WeakRef === 'function' && finalizer && !requestSignal.aborted) {
     let callbacks = callbackOwners.get(owner);
     if (!callbacks) {
@@ -99,6 +103,7 @@ export function addRequestAbortListener(
       // No listener was installed for an already aborted signal.
     };
   }
+  // oxlint-disable-next-line anti-slop/no-runtime-typeof -- Weak references and finalizers are optional host capabilities, so probe them before constructing either.
   if (typeof weakGlobals.WeakRef !== 'function' || !finalizer) {
     signal.addEventListener('abort', abort, { once: true });
     return () => signal.removeEventListener('abort', abort);

package/src/internal/utils/bytes.ts

@@ -19,6 +19,7 @@ let encodeUTF8_: (str: string) => Uint8Array;
 /** Encodes text as UTF-8 bytes, reusing the platform encoder after its first call. */
 export function encodeUTF8(str: string) {
   let encoder;
+  // SAFETY: Supported runtimes provide the standard TextEncoder/TextDecoder globals; the cast keeps their ambient DOM declarations optional.
   return (
     encodeUTF8_ ??
     ((encoder = new (globalThis as any).TextEncoder()), (encodeUTF8_ = encoder.encode.bind(encoder)))
@@ -30,6 +31,7 @@ let decodeUTF8_: (bytes: Uint8Array) => string;
 /** Decodes UTF-8 bytes as text, reusing the platform decoder after its first call. */
 export function decodeUTF8(bytes: Uint8Array) {
   let decoder;
+  // SAFETY: Supported runtimes provide the standard TextEncoder/TextDecoder globals; the cast keeps their ambient DOM declarations optional.
   return (
     decodeUTF8_ ??
     ((decoder = new (globalThis as any).TextDecoder()), (decodeUTF8_ = decoder.decode.bind(decoder)))

package/src/internal/utils/path.ts

@@ -24,6 +24,7 @@ const EMPTY = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.create(null))
  * `encodeURIComponent`. Nullish values, ordinary objects, and literal or
  * percent-encoded `.`/`..` path segments are rejected with an SDK error.
  */
+// SAFETY: This branch compares prototype methods to recognize cross-realm plain values; it does not call the optional hasOwnProperty member.
 export const createPathTagFunction = (pathEncoder = encodeURIPath) =>
   function path(statics: readonly string[], ...params: readonly unknown[]): string {
     // If there are no params, no processing is needed.
@@ -45,6 +46,7 @@ export const createPathTagFunction = (pathEncoder = encodeURIPath) =>
         if (
           index !== params.length &&
           (value == null ||
+            // oxlint-disable-next-line anti-slop/no-runtime-typeof -- Path parameters may arrive from JavaScript callers and require runtime validation before URL encoding.
             (typeof value === 'object' &&
               // handle values from other realms
               value.toString ===

package/src/internal/utils/sleep.ts

@@ -1 +1,52 @@
-export const sleep = (ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms));
+export const sleep = (ms: number, ...signals: (AbortSignal | null | undefined)[]): Promise<void> =>
+  new Promise((resolve, reject) => {
+    const activeSignals = [...new Set(signals.filter((signal): signal is AbortSignal => signal != null))];
+    let timeout: ReturnType<typeof setTimeout> | undefined;
+    let settled = false;
+    const cleanup = () => {
+      for (const signal of activeSignals) {
+        try {
+          signal.removeEventListener('abort', abort);
+        } catch {
+          // Structural signal cleanup must not prevent the promise from settling.
+        }
+      }
+    };
+    const settle = (callback: () => void) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      if (timeout !== undefined) {
+        clearTimeout(timeout);
+        timeout = undefined;
+      }
+      cleanup();
+      callback();
+    };
+    const abort = () => {
+      settle(() => reject());
+    };
+
+    if (activeSignals.some((signal) => signal.aborted)) {
+      abort();
+      return;
+    }
+
+    timeout = setTimeout(() => {
+      settle(resolve);
+    }, ms);
+    for (const signal of activeSignals) {
+      if (settled) {
+        break;
+      }
+      try {
+        signal.addEventListener('abort', abort, { once: true });
+      } catch (error) {
+        settle(() => reject(error));
+      }
+    }
+    if (activeSignals.some((signal) => signal.aborted)) {
+      abort();
+    }
+  });

package/src/internal/ws-adapter-browser.ts

@@ -166,6 +166,7 @@ export class BrowserWebSocket implements WebSocketLike {
           const message = ev?.message || ev?.error?.message || 'WebSocket error';
           const err = new Error(message);
           if (ev?.error) {
+            // SAFETY: The locally created Error receives the browser error event's cause; the cast avoids requiring newer Error ambient declarations.
             (err as any).cause = ev.error;
           }
           listener(err);
@@ -173,6 +174,7 @@ export class BrowserWebSocket implements WebSocketLike {
       }
 
       default: {
+        // SAFETY: Non-special events use the native DOM handler contract directly; the adapter only wraps message, close, and error variants above.
         return listener as DOMEventHandler;
       }
     }