openai 7.16.0 → 7.18.0

package/src/helpers/zod.ts

@@ -16,7 +16,7 @@ import type { ResponseFormatTextJSONSchemaConfig } from '../resources/responses/
 import type { RealtimeFunctionTool } from '../resources/realtime/realtime';
 import { forEachJSONSchemaChild, toStrictJsonSchema } from '../lib/transform';
 import type { JSONSchema } from '../lib/jsonschema';
-import { hasOwn } from '../internal/utils/values';
+import { hasOwn, isObj } from '../internal/utils/values';
 import { assertJSONSerializableSchema, assertSupportedZodV3Schema } from './zod-v3-strict-schema';
 
 type ZodV4Schema = z4.ZodType | z4Mini.ZodMiniType;
@@ -39,6 +39,7 @@ type ZodTypeLike = (
     }
 ) & {
   /** Synchronous schema parser when the validator exposes an instance-level parse method. */
+  // oxlint-disable-next-line anti-slop/no-unknown-returns -- The public schema adapter accepts arbitrary validated outputs and derives their concrete type separately. Zod parsers and their recursive metadata accept untrusted values before schema validation.
   parse?: (data: unknown) => unknown;
 };
 
@@ -97,11 +98,12 @@ function escapeSchemaDefinitionRefs<T extends object>(
 
   const visited = new Set<object>();
   const visit = (value: unknown): void => {
-    if (!value || typeof value !== 'object' || Array.isArray(value) || visited.has(value)) {
+    if (!isObj(value) || visited.has(value)) {
       return;
     }
 
     visited.add(value);
+    // SAFETY: The traversal has excluded primitives, null, arrays, and previously visited objects; schema property values remain unknown for validation.
     const record = value as Record<string, unknown>;
     const ref = record['$ref'];
     if (typeof ref === 'string') {
@@ -134,8 +136,10 @@ function zodV3ToJsonSchema(
   schema: z3.ZodType,
   options: { name: string; schemaDefinitions?: ZodSchemaDefinitions | undefined },
 ): Record<string, unknown> {
+  // SAFETY: This is the Zod v3 conversion path; assertSupportedZodV3Schema verifies the root and named definitions before conversion.
   assertSupportedZodV3Schema(schema, options.schemaDefinitions as Record<string, z3.ZodType> | undefined);
   const rootName = getZodV3RootName(options.name, options.schemaDefinitions);
+  // SAFETY: This is the Zod v3 conversion path; assertSupportedZodV3Schema verifies the root and named definitions before conversion.
   const jsonSchema = _zodToJsonSchema(schema, {
     openaiStrictMode: true,
     name: rootName,
@@ -143,7 +147,7 @@ function zodV3ToJsonSchema(
     $refStrategy: 'extract-to-root',
     nullableStrategy: 'property',
     ...(options.schemaDefinitions
-      ? { definitions: options.schemaDefinitions as unknown as Record<string, z3.ZodType> }
+      ? { definitions: options.schemaDefinitions as Record<string, z3.ZodType> }
       : undefined),
   });
 
@@ -159,15 +163,17 @@ function zodV4ToJsonSchema(
   schema: ZodV4Schema,
   options: { schemaDefinitions?: ZodSchemaDefinitions | undefined } = {},
 ): Record<string, unknown> {
-  const metadata = options.schemaDefinitions ? z4.registry<Record<string, unknown>>() : undefined;
+  const metadata = options.schemaDefinitions ? z4.registry<{ id: string }>() : undefined;
   const definitionNames = new Map<string, string>();
   for (const [name, definition] of Object.entries(options.schemaDefinitions ?? {})) {
     // Avoid `/` and `~` so Zod versions that escape JSON Pointer tokens emit the same IDs.
     const id = encodeURIComponent(name).replace(/~/g, '%7E');
     definitionNames.set(id, name);
-    metadata?.add(definition as unknown as z4.ZodType, { id });
+    // SAFETY: The Zod v4 conversion path registers these definitions with the v4 metadata registry before toJSONSchema uses them.
+    metadata?.add(definition as z4.ZodType, { id });
   }
 
+  // SAFETY: The v4 schema converter produces JSON Schema; the following normalization checks and rewrites its schema records.
   const jsonSchema = z4.toJSONSchema(schema, {
     target: 'draft-7',
     ...(metadata ? { metadata } : undefined),
@@ -208,6 +214,7 @@ function zodV4ToJsonSchema(
     );
   }
 
+  // SAFETY: Strict conversion returns the normalized object schema; the record view exposes keywords without trusting arbitrary values.
   return toStrictJsonSchema(escapedSchema) as Record<string, unknown>;
 }
 
@@ -221,6 +228,7 @@ function zodV3ToNonStrictJsonSchema(schema: z3.ZodType, options: { name: string
 }
 
 function zodV4ToNonStrictJsonSchema(schema: ZodV4Schema): Record<string, unknown> {
+  // SAFETY: Zod v4 owns this JSON Schema output; the record return preserves arbitrary supported keyword properties.
   return z4.toJSONSchema(schema, {
     target: 'draft-7',
     io: 'input',
@@ -236,17 +244,20 @@ function parseZodObject<ZodInput extends ZodTypeLike>(
   content: string,
 ): InferZodType<ZodInput> {
   const parsed = parseResponseFormatContent({ type: 'json_schema', $parseRaw: undefined }, content);
-  const parser = (zodObject as { parse?: (data: unknown) => unknown }).parse;
+  const parser = zodObject.parse;
 
   if (typeof parser === 'function') {
+    // SAFETY: The schema's parse method is invoked with its original receiver and owns the inferred output type.
     const result = parser.call(zodObject, parsed) as InferZodType<ZodInput>;
-    if (!isZodV4(zodObject as unknown as ZodSchema)) {
+    // SAFETY: This read only identifies the supported Zod version before applying its corresponding serialization checks.
+    if (!isZodV4(zodObject as ZodSchema)) {
       assertJSONSerializableSchema(result);
     }
     return result;
   }
 
-  return z4.parse(zodObject as unknown as ZodV4Schema, parsed) as InferZodType<ZodInput>;
+  // SAFETY: Schemas without a parse method use the supported Zod v4 core parser, which validates the input and supplies the inferred output.
+  return z4.parse(zodObject as ZodV4Schema, parsed) as InferZodType<ZodInput>;
 }
 
 /**
@@ -297,7 +308,8 @@ export function zodResponseFormat<ZodInput extends ZodTypeLike>(
   name: string,
   props?: ZodResponseFormatProps,
 ): AutoParseableResponseFormat<InferZodType<ZodInput>> {
-  const zodSchema = zodObject as unknown as ZodSchema;
+  // SAFETY: The public structural Zod input is dispatched by version below; each version-specific converter validates its supported schema contract.
+  const zodSchema = zodObject as ZodSchema;
   const { schemaDefinitions, ...responseFormatProps } = props ?? {};
   validateSchemaDefinitions(schemaDefinitions);
 
@@ -343,7 +355,8 @@ export function zodTextFormat<ZodInput extends ZodTypeLike>(
   name: string,
   props?: Omit<ResponseFormatTextJSONSchemaConfig, 'schema' | 'type' | 'strict' | 'name'>,
 ): AutoParseableTextFormat<InferZodType<ZodInput>> {
-  const zodSchema = zodObject as unknown as ZodSchema;
+  // SAFETY: The public structural Zod input is dispatched by version below; each version-specific converter validates its supported schema contract.
+  const zodSchema = zodObject as ZodSchema;
 
   return makeParseableTextFormat<InferZodType<ZodInput>>(
     {
@@ -366,6 +379,7 @@ interface ZodFunctionOptions<Parameters extends ZodTypeLike> {
   parameters: Parameters;
 
   /** Optional callback invoked with validated arguments by chat `runTools()`. */
+  // oxlint-disable-next-line anti-slop/no-unknown-returns -- Public tool callbacks may return arbitrary application values; preserve the published callback contract.
   function?: ((args: InferZodType<Parameters>) => unknown | Promise<unknown>) | undefined;
 
   /** Optional model-visible explanation of when and how the function should be used. */
@@ -415,7 +429,8 @@ export function zodFunction<Parameters extends ZodTypeLike>(
 /** Builds a strict Chat Completions function tool from the supplied Zod schema. */
 export function zodFunction<Parameters extends ZodTypeLike>(options: ZodFunctionOptions<Parameters>) {
   const parameters = options.parameters;
-  const zodSchema = parameters as unknown as ZodSchema;
+  // SAFETY: The public structural Zod input is dispatched by version below; each version-specific converter validates its supported schema contract.
+  const zodSchema = parameters as ZodSchema;
 
   return makeParseableTool<any>(
     {
@@ -455,6 +470,7 @@ export function zodResponsesFunction<Parameters extends ZodTypeLike>(options: {
   parameters: Parameters;
 
   /** Optional callback retained on the tool; `responses.parse()` does not execute it. */
+  // oxlint-disable-next-line anti-slop/no-unknown-returns -- Public tool callbacks may return arbitrary application values; preserve the published callback contract.
   function?: ((args: InferZodType<Parameters>) => unknown | Promise<unknown>) | undefined;
 
   /** Optional model-visible explanation of when and how the function should be used. */
@@ -467,10 +483,12 @@ export function zodResponsesFunction<Parameters extends ZodTypeLike>(options: {
   name: string;
 
   /** Callback signature associated with validated function-call arguments. */
+  // oxlint-disable-next-line anti-slop/no-unknown-returns -- Public tool callbacks may return arbitrary application values; preserve the published callback contract.
   function: (args: InferZodType<Parameters>) => unknown;
 }> {
   const parameters = options.parameters;
-  const zodSchema = parameters as unknown as ZodSchema;
+  // SAFETY: The public structural Zod input is dispatched by version below; each version-specific converter validates its supported schema contract.
+  const zodSchema = parameters as ZodSchema;
 
   return makeParseableResponseTool<any>(
     {
@@ -510,7 +528,8 @@ export function zodRealtimeFunction<Parameters extends ZodTypeLike>(options: {
   /** Optional model-visible explanation of when and how the function should be used. */
   description?: string | undefined;
 }): RealtimeFunctionTool {
-  const zodSchema = options.parameters as unknown as ZodSchema;
+  // SAFETY: The public structural Zod input is dispatched by version below; each version-specific converter validates its supported schema contract.
+  const zodSchema = options.parameters as ZodSchema;
 
   return {
     type: 'function',

package/src/internal/assistant-stream-delta.ts

@@ -68,7 +68,7 @@ function commitAssistantStreamArrayProjection(projection: AssistantStreamDeltaPr
   }
 }
 
-function isPrimitiveAssistantStreamValue(value: unknown): boolean {
+function isPrimitiveAssistantStreamValue(value: unknown): value is string | number {
   return typeof value === 'string' || typeof value === 'number';
 }
 
@@ -118,6 +118,7 @@ function getAssistantStreamDeltaIndex(
     );
   }
 
+  // SAFETY: Number.isSafeInteger rejects non-numbers before numeric comparisons; the remaining checks enforce the permitted index range.
   if (
     !Number.isSafeInteger(index) ||
     (index as number) < 0 ||
@@ -128,6 +129,7 @@ function getAssistantStreamDeltaIndex(
     throw new OpenAIError(`Assistant stream delta contains an invalid ${kind} index: ${safeIndex}`);
   }
 
+  // SAFETY: Number.isSafeInteger rejects non-numbers before numeric comparisons; the remaining checks enforce the permitted index range.
   return index as number;
 }
 
@@ -323,6 +325,7 @@ function applyAssistantStreamArrayDelta(
         }
         accumulator[index] = deltaEntry;
       } else {
+        // SAFETY: The preceding validation accepts this accumulated record before recursively merging the matching delta entry.
         accumulator[index] = applyRecord(accumulatedEntry as AssistantStreamRecord, deltaEntry);
       }
     } else {
@@ -398,11 +401,14 @@ export function assertSafeAssistantStreamDelta(value: unknown): void {
 
 export function accumulateAssistantStreamDelta<Accumulator extends object>(
   accumulator: Accumulator,
+  // oxlint-disable-next-line anti-slop/no-object-parameters -- This exported accumulator accepts heterogeneous partial SDK deltas and validates their properties at runtime.
   delta: object,
   cacheArrays = false,
 ): Accumulator {
   assertSafeAssistantStreamDelta(delta);
+  // SAFETY: The generic accumulator uses record entries after delta validation; recursive merge retains the original accumulator's public type.
   const accumulatorRecord = accumulator as AssistantStreamRecord;
+  // SAFETY: The generic accumulator uses record entries after delta validation; recursive merge retains the original accumulator's public type.
   const deltaRecord = delta as AssistantStreamRecord;
   const projection = createAssistantStreamDeltaProjection(
     cacheArrays && !isAssistantStreamValueExternallyMutable(accumulator),

package/src/internal/auth/x509-credential-options.ts

@@ -13,6 +13,7 @@ export function normalizeX509CredentialOptions(options: ClientOptions): {
 } {
   const { credential } = options;
   if (credential === undefined) {
+    // oxlint-disable-next-line anti-slop/no-known-value-widening -- Preserve the exported normalization contract when no X.509 credential is configured.
     return { credential, options };
   }
 
@@ -32,6 +33,7 @@ export function normalizeX509CredentialOptions(options: ClientOptions): {
     );
   }
 
+  // oxlint-disable-next-line anti-slop/no-known-value-widening -- The declared ClientOptions return contract supports both normalized and unchanged client options.
   return {
     credential,
     options: {
@@ -142,5 +144,6 @@ export function prepareX509ClientClone(
     }
   }
 
+  // oxlint-disable-next-line anti-slop/no-known-value-widening -- Preserve the exported clone contract across inherited and replaced credentials and providers.
   return { credential: nextCredential, provider: prepareProviderClone(inherited, overrides) };
 }

package/src/internal/auth/x509-token-exchange.ts

@@ -74,6 +74,7 @@ function cancelResponseBody(response: Response): void {
   }
 }
 
+// oxlint-disable-next-line anti-slop/no-unknown-returns -- Decoded token JSON remains untrusted until the caller validates its fields.
 async function readResponseBody(response: Response, signal?: AbortSignal): Promise<unknown> {
   if (!response.body) {
     throw new OpenAIError('X.509 workload identity token exchange returned invalid JSON.');
@@ -124,12 +125,20 @@ async function readResponseBody(response: Response, signal?: AbortSignal): Promi
   }
 }
 
+interface UnvalidatedTokenResponse {
+  access_token?: unknown;
+  token_type?: unknown;
+  issued_token_type?: unknown;
+  expires_in?: unknown;
+}
+
 function validateTokenResponse(value: unknown): X509ExchangedToken {
   if (typeof value !== 'object' || value === null || Array.isArray(value)) {
     throw new OpenAIError('X.509 workload identity token exchange returned an invalid token response.');
   }
 
-  const response = value as Record<string, unknown>;
+  // SAFETY: The object check above establishes a container; optional unknown fields make no claim about its values.
+  const response = value as UnvalidatedTokenResponse;
   if (
     !hasOwn(response, 'access_token') ||
     typeof response['access_token'] !== 'string' ||

package/src/internal/auth/x509-transport-capability.ts

@@ -44,7 +44,7 @@ class NodeX509Transport implements X509Transport {
     Object.freeze(this);
   }
 
-  static dispatcher(value: object): Agent | ProxyAgent | undefined {
+  static dispatcher(value: X509Transport): Agent | ProxyAgent | undefined {
     return #dispatcher in value ? value.#dispatcher : undefined;
   }
 }
@@ -66,6 +66,7 @@ export function registerX509Transport(transport: X509Transport, registered: Regi
   rememberRegisteredX509Transport(transport, Object.freeze(registered));
 }
 
+// oxlint-disable-next-line anti-slop/no-unknown-returns -- Own data-property values must remain untrusted until their option-specific validators run.
 function dataOption(options: X509TransportOptions, name: keyof X509TransportOptions): unknown {
   const descriptor = Object.getOwnPropertyDescriptor(options, name);
   if (!descriptor || !('value' in descriptor)) {

package/src/internal/auth/x509-workload-identity-auth.ts

@@ -43,10 +43,7 @@ function assertSafeHeaders(headers: Headers): void {
   }
 }
 
-function exchangeDeadline(
-  timeout: number | undefined,
-  callerSignal: AbortSignal | null | undefined,
-): { signal: AbortSignal; dispose: () => void } {
+function exchangeDeadline(timeout: number | undefined, callerSignal: AbortSignal | null | undefined) {
   const deadline = new AbortController();
   const timer =
     timeout === undefined
@@ -104,10 +101,7 @@ interface X509TokenRequestContext {
   fetchOptions: MergedRequestInit;
 }
 
-function waitForRefresh(
-  attempt: X509RefreshAttempt,
-  signal: AbortSignal,
-): { result: Promise<X509ExchangedToken>; dispose: () => void } {
+function waitForRefresh(attempt: X509RefreshAttempt, signal: AbortSignal) {
   let abort: (() => void) | undefined;
   // AbortSignal remains callback-only on supported TypeScript/runtime combinations.
   // oxlint-disable-next-line promise/avoid-new -- A callback-only AbortSignal must race a shared refresh.
@@ -145,6 +139,7 @@ export function isX509WorkloadIdentity(
       }
       break;
     }
+    // SAFETY: Object.getPrototypeOf returns an object or null; the traversal checks descriptors rather than assuming a credential-provider subtype.
     providerOwner = Object.getPrototypeOf(providerOwner) as object | null;
   }
 
@@ -157,6 +152,7 @@ export function isX509WorkloadIdentity(
       }
       return discriminator.value === 'x509';
     }
+    // SAFETY: Object.getPrototypeOf returns an object or null; the traversal checks descriptors rather than assuming a credential-provider subtype.
     current = Object.getPrototypeOf(current) as object | null;
   }
   return false;
@@ -267,9 +263,11 @@ export class X509WorkloadIdentityAuth {
       type: 'x509',
       identityProviderId: this.#identityProviderId,
       serviceAccountId: this.#serviceAccountId,
+      // Spread creates an own data property without invoking inherited setters or changing the object prototype.
       ...(this.#configuredRefreshBufferMs === undefined
         ? {}
         : { refreshBufferMs: this.#configuredRefreshBufferMs }),
+      // Spread creates an own data property without invoking inherited setters or changing the object prototype.
       ...(this.#configuredRefreshBufferSeconds === undefined
         ? {}
         : { refreshBufferSeconds: this.#configuredRefreshBufferSeconds }),
@@ -302,6 +300,7 @@ export class X509WorkloadIdentityAuth {
     if (!defaultHeaders || !requestHeaders) {
       throw new OpenAIError('X.509 workload identity requires snapshotted request headers.');
     }
+    // oxlint-disable-next-line anti-slop/no-known-value-widening -- The exposed snapshot contract deliberately hides the private request-scope representation.
     return { defaultHeaders, requestHeaders };
   }
 
@@ -495,6 +494,7 @@ export class X509WorkloadIdentityAuth {
   }
 
   /** Establishes an independent scope even when concurrent requests share caller options. */
+  // oxlint-disable-next-line anti-slop/no-object-parameters -- Logical request owners are opaque identity tokens; their properties are never read.
   runRequest<T>(operation: () => Promise<T>, requestOwner: object): Promise<T> {
     return this.#transport.run(async () => {
       const scope = this.#transport.current();
@@ -515,6 +515,7 @@ export class X509WorkloadIdentityAuth {
   }
 
   /** Reports whether a public request-building call already belongs to an active logical operation. */
+  // oxlint-disable-next-line anti-slop/no-object-parameters -- Request scope membership compares the opaque caller token by identity only.
   inRequest(requestOwner: object): boolean {
     const scope = this.#transport.current();
     return scope?.owner === this && scope.requestOwner === requestOwner && scope.phase !== 'authorizing';
@@ -540,9 +541,13 @@ export class X509WorkloadIdentityAuth {
       wallStartedAt,
       monotonicStartedAt,
       owner: this,
+      // Spread creates an own data property without invoking inherited setters or changing the object prototype.
       ...(deadlineArmed ? { deadlineArmed } : {}),
+      // Spread creates an own data property without invoking inherited setters or changing the object prototype.
       ...(request ? { request } : {}),
+      // Spread creates an own data property without invoking inherited setters or changing the object prototype.
       ...(effectiveSignal ? { effectiveSignal } : {}),
+      // Spread creates an own data property without invoking inherited setters or changing the object prototype.
       ...(requestOwner ? { requestOwner } : {}),
     };
     return (operation) =>

package/src/internal/bedrock.ts

@@ -54,6 +54,7 @@ export type BedrockAuthFactory = () => BedrockRequestAuth;
 
 /** Wraps a provider failure in an SDK error while preserving its original cause. */
 export function errorWithCause(message: string, cause: unknown): Errors.OpenAIError {
+  // SAFETY: This SDK error is created locally and receives its optional cause immediately below; no existing error shape is trusted.
   const error = new Errors.OpenAIError(message) as Errors.OpenAIError & { cause?: unknown };
   error.cause = cause;
   return error;
@@ -61,6 +62,7 @@ export function errorWithCause(message: string, cause: unknown): Errors.OpenAIEr
 
 /** Trims a configuration string, treating missing and whitespace-only values as absent. */
 export function normalizeOptionalString(value: string | null | undefined): string | undefined {
+  // oxlint-disable-next-line anti-slop/no-runtime-typeof -- Bedrock credential and origin checks validate JavaScript configuration before any credential is sent.
   const normalized = typeof value === 'string' ? value.trim() : undefined;
   return normalized || undefined;
 }
@@ -207,6 +209,7 @@ export function resolveBedrockEndpoint(options: BedrockEndpointOptions): {
     const endpoint =
       options.endpoint ?? parseBedrockEndpointHostname(new URL(baseURL).hostname)?.endpoint ?? 'mantle';
     validateCanonicalBedrockEndpoint(baseURL, endpoint, region);
+    // oxlint-disable-next-line anti-slop/no-known-value-widening -- Preserve the declared endpoint resolver contract across configured URLs and inferred regions.
     return { endpoint, region, baseURL };
   }
   const endpoint = options.endpoint ?? 'mantle';
@@ -220,6 +223,7 @@ export function resolveBedrockEndpoint(options: BedrockEndpointOptions): {
     endpoint === 'runtime'
       ? `bedrock-runtime.${region}.${resolveRuntimeDnsSuffixes(region)[0]}`
       : `bedrock-mantle.${region}.api.aws`;
+  // oxlint-disable-next-line anti-slop/no-known-value-widening -- The resolver intentionally returns its declared endpoint contract across all configuration paths.
   return { endpoint, region, baseURL: `https://${hostname}/openai/v1` };
 }
 
@@ -245,7 +249,9 @@ export function assertBedrockRequestOrigin(baseURL: string, requestURL: string):
 }
 
 /** Validates a final WebSocket URL before a legacy Bedrock client resolves or attaches credentials. */
+// oxlint-disable-next-line anti-slop/no-unknown-parameters -- The WebSocket authentication boundary verifies the caller client at runtime before trusting provider metadata.
 export function assertBedrockWebSocketOrigin(client: unknown, requestURL: URL): void {
+  // oxlint-disable-next-line anti-slop/no-runtime-typeof -- Bedrock credential and origin checks validate JavaScript configuration before any credential is sent.
   if (typeof client !== 'object' || client === null || !(brand_privateBedrockClient in client)) {
     return;
   }
@@ -257,7 +263,9 @@ export function assertBedrockWebSocketOrigin(client: unknown, requestURL: URL):
     normalizedRequestURL.protocol = 'http:';
   }
 
+  // SAFETY: The private Bedrock brand checked above identifies the client whose baseURL is validated against the finalized request origin.
   assertBedrockRequestOrigin(
+    // oxlint-disable-next-line anti-slop/no-chained-type-assertions -- The private Bedrock client brand checked above identifies the client baseURL contract.
     (client as unknown as { baseURL: string }).baseURL,
     normalizedRequestURL.toString(),
   );
@@ -346,6 +354,7 @@ function resolveAbortableBedrockAuth<T>(
       }
     };
 
+    // oxlint-disable-next-line anti-slop/no-unknown-parameters -- Failures and rejection reasons can be arbitrary JavaScript values; preserve them until inspection or forwarding.
     const rejectSignalFailure = (error: unknown) => {
       if (failure.error) {
         return;
@@ -483,6 +492,7 @@ class BedrockBearerAuth implements BedrockRequestAuth {
       resolve: () => this.tokenProvider(),
       failureMessage: 'Failed to resolve a bearer credential for Bedrock.',
       apply: (token) => {
+        // oxlint-disable-next-line anti-slop/no-runtime-typeof -- Bedrock credential and origin checks validate JavaScript configuration before any credential is sent.
         if (typeof token !== 'string' || !token.trim()) {
           throw new Errors.OpenAIError(
             'The Bedrock bearer credential provider must return a non-empty string.',
@@ -533,6 +543,7 @@ export function resolveBedrockBearerAuth(
   if (
     options.apiKey !== undefined &&
     options.apiKey !== null &&
+    // oxlint-disable-next-line anti-slop/no-runtime-typeof -- Bedrock credential and origin checks validate JavaScript configuration before any credential is sent.
     (typeof options.apiKey !== 'string' || !options.apiKey.trim())
   ) {
     throw new Errors.OpenAIError('The Bedrock bearer credential must not be empty.');
@@ -545,13 +556,16 @@ export function resolveBedrockBearerAuth(
 
   if (options.tokenProvider) {
     const tokenProvider = options.tokenProvider;
+    // oxlint-disable-next-line anti-slop/no-known-value-widening -- The declared bearer-auth contract hides concrete authenticator implementations behind their factory.
     return { factory: () => new BedrockBearerAuth(tokenProvider), explicit: true };
   }
   if (options.apiKey != null) {
     const apiKey = options.apiKey;
+    // oxlint-disable-next-line anti-slop/no-known-value-widening -- Explicit API keys use the same declared auth-factory contract as token providers.
     return { factory: () => new BedrockBearerAuth(async () => apiKey), explicit: true };
   }
   if (allowEnvironment && options.apiKey !== null && readEnv('AWS_BEARER_TOKEN_BEDROCK')) {
+    // oxlint-disable-next-line anti-slop/no-known-value-widening -- Environment credentials must preserve the same declared auth-factory contract as explicit options.
     return {
       explicit: false,
       factory: () =>
@@ -567,5 +581,6 @@ export function resolveBedrockBearerAuth(
     };
   }
 
+  // oxlint-disable-next-line anti-slop/no-known-value-widening -- The declared optional factory contract also represents the absence of bearer credentials.
   return { factory: undefined, explicit: false };
 }

package/src/internal/decoders/line.ts

@@ -55,6 +55,7 @@ export class LineDecoder {
     let binaryChunk: Uint8Array;
     if (chunk instanceof ArrayBuffer) {
       binaryChunk = new Uint8Array(chunk);
+      // oxlint-disable-next-line anti-slop/no-runtime-typeof -- The line decoder accepts both text and binary chunks and must select the matching decoding path.
     } else if (typeof chunk === 'string') {
       binaryChunk = encodeUTF8(chunk);
     } else {

package/src/internal/parse.ts

@@ -9,6 +9,7 @@ export type APIResponseProps = {
   response: Response;
   options: FinalRequestOptions;
   controller: AbortController;
+  requestSignal?: AbortSignal | null | undefined;
   requestLogID: string;
   retryOfRequestLogID: string | undefined;
   startTime: number;

package/src/internal/provider.ts

@@ -54,7 +54,9 @@ export interface ProviderDefinition {
  * provider configurations.
  */
 const providerDefinitionsKey = Symbol.for('openai.node.providerDefinitions.v1');
+// SAFETY: This versioned global symbol is the SDK-owned cross-copy WeakMap registry; no provider object fields are trusted through it.
 const providerGlobal = globalThis as any;
+// SAFETY: This versioned global symbol is the SDK-owned cross-copy WeakMap registry; no provider object fields are trusted through it.
 const existingProviderDefinitions = providerGlobal[providerDefinitionsKey] as
   | WeakMap<Provider, ProviderDefinition>
   | undefined;
@@ -70,6 +72,7 @@ if (!existingProviderDefinitions) {
  * installed copy of the SDK in the same JavaScript realm.
  */
 export function createProvider(definition: ProviderDefinition): Provider {
+  // SAFETY: This function creates the opaque handle and immediately registers its identity in the private WeakMap, which is the runtime brand check.
   const provider = Object.freeze({}) as Provider;
   providerDefinitions.set(provider, definition);
   return provider;

package/src/internal/qs/stringify.ts

@@ -22,6 +22,7 @@ const push_to_array = function push_to_array(arr: any[], value_or_array: any) {
 
 let toISOString;
 
+// SAFETY: The defaults object supplies the serializer's established non-null option values and RFC formatter; callers still merge their overrides separately.
 const defaults = {
   addQueryPrefix: false,
   allowDots: false,
@@ -172,6 +173,7 @@ function inner_stringify(
   }
 
   for (const key of obj_keys) {
+    // SAFETY: The serializer supports its existing encoded-key wrapper or property key; the branch selects the wrapper value before indexing the object.
     const value =
       // @ts-ignore
       typeof key === 'object' && key.value !== undefined ? key.value : obj[key as any];
@@ -180,6 +182,7 @@ function inner_stringify(
       continue;
     }
 
+    // SAFETY: Dot encoding applies the serializer's existing string-key protocol; this cast preserves its legacy mixed key representation.
     // @ts-ignore
     const encoded_key = allowDots && encodeDotInKeys ? (key as any).replace(/\./g, '%2E') : key;
     let key_prefix: string;

package/src/internal/qs/utils.ts

@@ -2,16 +2,20 @@ import { RFC1738 } from './formats';
 import type { DefaultEncoder, Format } from './types';
 import { isArray } from '../utils/values';
 
+// oxlint-disable-next-line anti-slop/no-object-parameters -- The cached own-property predicate accepts arrays, callable objects, and records.
 let cachedHas: ((obj: object, key: PropertyKey) => boolean) | undefined;
 
+// oxlint-disable-next-line anti-slop/no-object-parameters -- Own-property lookup is a generic object primitive and must preserve array and callable inputs.
 export const has = (obj: object, key: PropertyKey): boolean => {
+  // SAFETY: Object.hasOwn is an optional native capability; older runtimes use the bound hasOwnProperty fallback with the same own-key semantics.
+  // oxlint-disable-next-line anti-slop/no-object-parameters -- The native or compatibility own-property predicate has the same generic object contract.
   const resolvedHas: (obj: object, key: PropertyKey) => boolean =
     cachedHas ?? (Object as any).hasOwn ?? Function.prototype.call.bind(Object.prototype.hasOwnProperty);
   cachedHas = resolvedHas;
   return resolvedHas(obj, key);
 };
 
-function isUnsafePropertyKey(key: unknown): boolean {
+function isUnsafePropertyKey(key: PropertyKey): boolean {
   return key === '__proto__' || key === 'constructor' || key === 'prototype';
 }
 
@@ -39,6 +43,7 @@ interface MergeState {
 const maxAdoptedRecords = 10_000;
 
 function isIntrinsicFunctionPrototype(
+  // oxlint-disable-next-line anti-slop/no-object-parameters -- Prototype descriptors are inspected before deciding whether an arbitrary adopted value is callable.
   value: object,
   key: PropertyKey,
   descriptor: PropertyDescriptor,
@@ -52,6 +57,7 @@ function isObjectLike(value: unknown): value is object {
   return value !== null && (typeof value === 'object' || typeof value === 'function');
 }
 
+// oxlint-disable-next-line anti-slop/no-object-parameters -- Adoption records retain arbitrary merge-target identities for later descriptor validation.
 function rememberAdoption(state: MergeState, target: object, key: PropertyKey, value: any): void {
   if (!isObjectLike(value)) {
     return;
@@ -77,6 +83,7 @@ function sanitizeAdoptions(state: MergeState): void {
   }[] = [];
   let inspectedProperties = 0;
 
+  // oxlint-disable-next-line anti-slop/no-object-parameters -- Adoption validation inspects arbitrary objects, including arrays and functions, before trusting their structure.
   function inspect(value: object): AdoptedRecord {
     const known = records.get(value);
     if (known) {
@@ -131,7 +138,7 @@ function sanitizeAdoptions(state: MergeState): void {
   const detached: AdoptedRecord[] = [];
   for (const record of visited) {
     for (const key of record.keys) {
-      const descriptor = Reflect.get(record.descriptors, key) as PropertyDescriptor | undefined;
+      const descriptor = record.descriptors[key];
       if (!descriptor) {
         continue;
       }
@@ -204,7 +211,7 @@ function sanitizeAdoptions(state: MergeState): void {
       if (isUnsafePropertyKey(key)) {
         continue;
       }
-      const descriptor = Reflect.get(record.descriptors, key) as PropertyDescriptor | undefined;
+      const descriptor = record.descriptors[key];
       if (!descriptor) {
         continue;
       }
@@ -239,12 +246,14 @@ function readPreparedTarget(state: MergeState, target: any, key: PropertyKey): a
   return target[key];
 }
 
+// oxlint-disable-next-line anti-slop/no-object-parameters -- Merge targets may contain accessors or custom prototypes, so the preview preserves the generic object boundary.
 function previewTarget(state: MergeState, target: object, key: PropertyKey): any {
   const descriptor = Object.getOwnPropertyDescriptor(target, key);
   if (descriptor && 'value' in descriptor) {
     return descriptor.value;
   }
 
+  // oxlint-disable-next-line anti-slop/no-reflect-get -- Generic query merging snapshots arbitrary inherited/accessor keys before mutation.
   const value = Reflect.get(target, key, target);
   let prepared = state.preparedTargets.get(target);
   if (!prepared) {
@@ -280,11 +289,13 @@ function prepareMergeSource(target: any, source: any, state: MergeState, assign
   }
   state.inspectedSourceProperties += sourceKeys.length;
   const sourceIsArray = isArray(source);
+  // oxlint-disable-next-line anti-slop/no-unsafe-dictionary-type -- The query merge graph preserves heterogeneous scalar, array, and object values under its existing merge contract.
   const prepared: Record<string, any> = sourceIsArray ? [] : Object.create(null);
   preparedTargets.set(target, prepared);
 
   if (isArray(target) && sourceIsArray && !assign) {
     const sourceLength = source.length;
+    // SAFETY: prepared was constructed as an array when sourceIsArray is true, which this branch requires.
     (prepared as any[]).length = sourceLength;
     for (let index = 0; index < sourceLength; index += 1) {
       if (!(index in source)) {