openai 7.4.0 → 7.6.0

package/internal/uploads.d.ts

@@ -1,13 +1,18 @@
-import { type RequestOptions } from "./request-options.js";
+import type { RequestOptions } from "./request-options.js";
 import type { FilePropertyBag, Fetch } from "./builtin-types.js";
 import type { OpenAI } from "../client.js";
 import type { ReadableStream } from "./shim-types.js";
+/** Text, binary data, or a blob that can contribute bytes to an uploaded file. */
 export type BlobPart = string | ArrayBuffer | ArrayBufferView | Blob | DataView;
+/** Node.js-compatible byte stream carrying the source path used to infer a filename. */
 type FsReadStream = AsyncIterable<Uint8Array> & {
+    /** Source filesystem path, represented as a string or path-like object. */
     path: string | {
+        /** Converts the path-like value into its filesystem path. */
         toString(): string;
     };
 };
+/** Asynchronous chunks consumed lazily while encoding a streaming multipart upload. */
 export type StreamingFileInput = AsyncIterable<BlobPart> | ReadableStream<BlobPart>;
 declare const brand_privateStreamingFile: unique symbol;
 /**
@@ -15,10 +20,16 @@ declare const brand_privateStreamingFile: unique symbol;
  * Create one with {@link toStreamingFile} when buffering an upload into a `File` is undesirable.
  */
 export interface StreamingFile {
-    /** Brand check, prevent users from creating a StreamingFile without a filename. */
+    /** Ensures streaming files are created with a filename through {@link toStreamingFile}. */
     readonly [brand_privateStreamingFile]: true;
+    /** Source chunks read incrementally as the multipart request body is transmitted. */
     readonly data: StreamingFileInput;
+    /**
+     * Logical source filename; ordinary uploads send its basename, while Skills can preserve
+     * a validated relative directory path.
+     */
     readonly name: string;
+    /** Optional MIME type; defaults to `application/octet-stream` when omitted. */
     readonly type?: string | undefined;
 }
 /**
@@ -27,41 +38,100 @@ export interface StreamingFile {
  * Unlike {@link toFile}, this helper does not create a web `File`, because the `File` constructor
  * must consume all of its contents up front. The stream is instead encoded lazily as multipart
  * form data when the request is sent.
+ *
+ * @param data Async-iterable or readable-stream chunks containing text, binary data, or blobs.
+ * @param name Non-empty logical/source filename. Ordinary uploads send only its basename; Skills
+ * uploads may preserve a validated relative path with normalized forward slashes.
+ * @param options Optional MIME type for the streaming file.
+ * @throws {TypeError} If `name` is empty or the content type contains control characters.
  */
 export declare function toStreamingFile(data: StreamingFileInput, name: string, options?: Pick<FilePropertyBag, 'type'>): StreamingFile;
+/**
+ * Bun file compatibility shape for file objects whose names are optional in their types.
+ *
+ * @see https://github.com/oven-sh/bun/issues/5980
+ */
 interface BunFile extends Blob {
+    /** Filename exposed by Bun when one is available. */
     readonly name?: string | undefined;
 }
+/** Blob-compatible upload value that exposes a filename at runtime. */
 type NamedBlob = Blob & {
+    /** Filename supplied by a native `File` or another named Blob implementation. */
     readonly name?: string | undefined;
 };
-export declare const checkFileSupport: () => void;
 /**
- * Typically, this is a native "File" class.
+ * Verifies that the current runtime exposes the global `File` constructor.
  *
- * We provide the {@link toFile} utility to convert a variety of objects
- * into the File class.
+ * @throws {Error} If `File` is unavailable; older Node.js runtimes receive an
+ * additional upgrade or `node:buffer` compatibility suggestion.
+ */
+export declare const checkFileSupport: () => void;
+/**
+ * Values accepted by SDK methods that upload multipart files.
  *
- * For convenience, you can also pass a fetch Response, or in Node,
- * the result of fs.createReadStream().
+ * Supports native files, fetch responses, blobs, Node.js filesystem read
+ * streams, async byte sources, web readable streams, and files created with
+ * {@link toStreamingFile}. Use {@link toFile} to materialize compatible content
+ * as a native `File` when buffering the complete upload is acceptable.
  */
 export type Uploadable = File | Response | FsReadStream | BunFile | NamedBlob | AsyncIterable<BlobPart> | ReadableStream<BlobPart> | StreamingFile;
 /**
  * Construct a `File` instance. This is used to ensure a helpful error is thrown
  * for environments that don't define a global `File` yet.
+ *
+ * A missing filename becomes `unknown_file`.
  */
 export declare function makeFile(fileBits: BlobPart[], fileName: string | undefined, options?: FilePropertyBag): File;
-export declare function getName(value: any): string | undefined;
+/**
+ * Infers a filename from an object's `name`, `url`, `filename`, or `path` value.
+ *
+ * Directory components separated by either `/` or `\\` are discarded unless an
+ * explicitly supplied `name` or `filename` opts into preserving its path. Preserved
+ * paths must be safe and relative, and use forward slashes. Paths inferred from URLs and filesystem streams
+ * discard their directories.
+ */
+export declare function getName(value: any, options?: {
+    stripFilename?: boolean | undefined;
+}): string | undefined;
+/** Identifies objects that expose a callable `Symbol.asyncIterator` method. */
 export declare const isAsyncIterable: (value: any) => value is AsyncIterable<any>;
 /**
- * Returns a multipart/form-data request if any part of the given request body contains a File / Blob value.
- * Otherwise returns the request as is.
+ * Converts a request to multipart form data when its body contains an upload.
+ *
+ * Uploads include files, blobs, responses, async iterables, readable
+ * streams, and {@link StreamingFile} values anywhere in a nested body. Bodies
+ * containing streaming values are encoded lazily; other uploads use `FormData`.
+ * Requests without uploads are returned unchanged.
  */
-export declare const maybeMultipartFormRequestOptions: (opts: RequestOptions, fetch: OpenAI | Fetch) => Promise<RequestOptions>;
+export declare const maybeMultipartFormRequestOptions: (opts: RequestOptions, fetch: OpenAI | Fetch, formOptions?: CreateFormOptions) => Promise<RequestOptions>;
+/** Request options whose body must be encoded as multipart form data. */
 type MultipartFormRequestOptions = Omit<RequestOptions, 'body'> & {
+    /** Nested fields and upload values to encode into the multipart request body. */
     body: unknown;
 };
-export declare const multipartFormRequestOptions: (opts: MultipartFormRequestOptions, fetch: OpenAI | Fetch) => Promise<RequestOptions>;
-export declare const createForm: <T = Record<string, unknown>>(body: T | undefined, fetch: OpenAI | Fetch) => Promise<FormData>;
+/**
+ * Encodes a request body as multipart form data even when no file is present.
+ *
+ * Streaming uploads produce a lazy multipart `ReadableStream` and an explicit
+ * boundary header; other values are materialized into platform `FormData`.
+ */
+export declare const multipartFormRequestOptions: (opts: MultipartFormRequestOptions, fetch: OpenAI | Fetch, formOptions?: CreateFormOptions) => Promise<RequestOptions>;
+/** Controls whether explicitly supplied multipart filenames retain directory components. */
+export type CreateFormOptions = {
+    /** Keep directories in explicit filenames when false; inferred paths remain basename-only. */
+    stripFilenames?: boolean;
+};
+/**
+ * Materializes an object into platform `FormData` after verifying fetch support.
+ *
+ * Strings, numbers, and booleans become text fields; responses, blobs,
+ * and async byte sources become file fields. Arrays and nested objects use
+ * bracketed field names, while `undefined` values are omitted.
+ *
+ * @throws {TypeError} If the fetch implementation cannot encode global
+ * `FormData`, a field is `null`, or a field has an unsupported value.
+ */
+export declare const createForm: <T = Record<string, unknown>>(body: T | undefined, fetch: OpenAI | Fetch, options?: CreateFormOptions) => Promise<FormData>;
 export {};
 //# sourceMappingURL=uploads.d.ts.map

package/internal/uploads.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"uploads.d.ts","sourceRoot":"","sources":["../src/internal/uploads.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,cAAc,EAAE,6BAA0B;AACxD,OAAO,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,2BAAwB;AAC9D,OAAO,KAAK,EAAE,MAAM,EAAE,qBAAkB;AAGxC,OAAO,KAAK,EAAE,cAAc,EAAE,wBAAqB;AAGnD,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,WAAW,GAAG,eAAe,GAAG,IAAI,GAAG,QAAQ,CAAC;AAChF,KAAK,YAAY,GAAG,aAAa,CAAC,UAAU,CAAC,GAAG;IAAE,IAAI,EAAE,MAAM,GAAG;QAAE,QAAQ,IAAI,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAE1F,MAAM,MAAM,kBAAkB,GAAG,aAAa,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;AAEpF,QAAA,MAAM,0BAA0B,eAAuD,CAAC;AAExF;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,mFAAmF;IACnF,QAAQ,CAAC,CAAC,0BAA0B,CAAC,EAAE,IAAI,CAAC;IAC5C,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,kBAAkB,EACxB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,GACtC,aAAa,CAWf;AAGD,UAAU,OAAQ,SAAQ,IAAI;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC;AAED,KAAK,SAAS,GAAG,IAAI,GAAG;IAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAE/D,eAAO,MAAM,gBAAgB,YAY5B,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GAClB,IAAI,GACJ,QAAQ,GACR,YAAY,GACZ,OAAO,GACP,SAAS,GACT,aAAa,CAAC,QAAQ,CAAC,GACvB,cAAc,CAAC,QAAQ,CAAC,GACxB,aAAa,CAAC;AAElB;;;GAGG;AACH,wBAAgB,QAAQ,CACtB,QAAQ,EAAE,QAAQ,EAAE,EACpB,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,OAAO,CAAC,EAAE,eAAe,GACxB,IAAI,CAGN;AAED,wBAAgB,OAAO,CAAC,KAAK,EAAE,GAAG,GAAG,MAAM,GAAG,SAAS,CActD;AAED,eAAO,MAAM,eAAe,GAAI,OAAO,GAAG,KAAG,KAAK,IAAI,aAAa,CAAC,GAAG,CAC0B,CAAC;AAElG;;;GAGG;AACH,eAAO,MAAM,gCAAgC,GAC3C,MAAM,cAAc,EACpB,OAAO,MAAM,GAAG,KAAK,KACpB,OAAO,CAAC,cAAc,CAQxB,CAAC;AAEF,KAAK,2BAA2B,GAAG,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,GAAG;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAEpF,eAAO,MAAM,2BAA2B,GACtC,MAAM,2BAA2B,EACjC,OAAO,MAAM,GAAG,KAAK,KACpB,OAAO,CAAC,cAAc,CAMxB,CAAC;AAsCF,eAAO,MAAM,UAAU,GAAU,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC1D,MAAM,CAAC,GAAG,SAAS,EACnB,OAAO,MAAM,GAAG,KAAK,KACpB,OAAO,CAAC,QAAQ,CASlB,CAAC"}
+{"version":3,"file":"uploads.d.ts","sourceRoot":"","sources":["../src/internal/uploads.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,6BAA0B;AACxD,OAAO,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,2BAAwB;AAC9D,OAAO,KAAK,EAAE,MAAM,EAAE,qBAAkB;AAGxC,OAAO,KAAK,EAAE,cAAc,EAAE,wBAAqB;AAGnD,kFAAkF;AAClF,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,WAAW,GAAG,eAAe,GAAG,IAAI,GAAG,QAAQ,CAAC;AAEhF,wFAAwF;AACxF,KAAK,YAAY,GAAG,aAAa,CAAC,UAAU,CAAC,GAAG;IAC9C,2EAA2E;IAC3E,IAAI,EACA,MAAM,GACN;QACE,6DAA6D;QAC7D,QAAQ,IAAI,MAAM,CAAC;KACpB,CAAC;CACP,CAAC;AAEF,uFAAuF;AACvF,MAAM,MAAM,kBAAkB,GAAG,aAAa,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;AAEpF,QAAA,MAAM,0BAA0B,eAAuD,CAAC;AAExF;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,2FAA2F;IAC3F,QAAQ,CAAC,CAAC,0BAA0B,CAAC,EAAE,IAAI,CAAC;IAE5C,qFAAqF;IACrF,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAElC;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,+EAA+E;IAC/E,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,kBAAkB,EACxB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,GACtC,aAAa,CAgBf;AAED;;;;GAIG;AACH,UAAU,OAAQ,SAAQ,IAAI;IAC5B,qDAAqD;IACrD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC;AAED,uEAAuE;AACvE,KAAK,SAAS,GAAG,IAAI,GAAG;IACtB,iFAAiF;IACjF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,YAa5B,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,UAAU,GAClB,IAAI,GACJ,QAAQ,GACR,YAAY,GACZ,OAAO,GACP,SAAS,GACT,aAAa,CAAC,QAAQ,CAAC,GACvB,cAAc,CAAC,QAAQ,CAAC,GACxB,aAAa,CAAC;AAElB;;;;;GAKG;AACH,wBAAgB,QAAQ,CACtB,QAAQ,EAAE,QAAQ,EAAE,EACpB,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,OAAO,CAAC,EAAE,eAAe,GACxB,IAAI,CAGN;AAED;;;;;;;GAOG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE;IAAE,aAAa,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;CAAE,GAAG,MAAM,GAAG,SAAS,CAuBzG;AAcD,+EAA+E;AAC/E,eAAO,MAAM,eAAe,GAAI,OAAO,GAAG,KAAG,KAAK,IAAI,aAAa,CAAC,GAAG,CAC0B,CAAC;AAElG;;;;;;;GAOG;AACH,eAAO,MAAM,gCAAgC,GAC3C,MAAM,cAAc,EACpB,OAAO,MAAM,GAAG,KAAK,EACrB,cAAc,iBAAiB,KAC9B,OAAO,CAAC,cAAc,CAUxB,CAAC;AAEF,yEAAyE;AACzE,KAAK,2BAA2B,GAAG,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,GAAG;IAChE,iFAAiF;IACjF,IAAI,EAAE,OAAO,CAAC;CACf,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,GACtC,MAAM,2BAA2B,EACjC,OAAO,MAAM,GAAG,KAAK,EACrB,cAAc,iBAAiB,KAC9B,OAAO,CAAC,cAAc,CAMxB,CAAC;AAwCF,4FAA4F;AAC5F,MAAM,MAAM,iBAAiB,GAAG;IAC9B,8FAA8F;IAC9F,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,UAAU,GAAU,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC1D,MAAM,CAAC,GAAG,SAAS,EACnB,OAAO,MAAM,GAAG,KAAK,EACrB,UAAS,iBAAsB,KAC9B,OAAO,CAAC,QAAQ,CAWlB,CAAC"}

package/internal/uploads.js

@@ -14,25 +14,42 @@ const brand_privateStreamingFile = /* @__PURE__ */ Symbol('brand.privateStreamin
  * Unlike {@link toFile}, this helper does not create a web `File`, because the `File` constructor
  * must consume all of its contents up front. The stream is instead encoded lazily as multipart
  * form data when the request is sent.
+ *
+ * @param data Async-iterable or readable-stream chunks containing text, binary data, or blobs.
+ * @param name Non-empty logical/source filename. Ordinary uploads send only its basename; Skills
+ * uploads may preserve a validated relative path with normalized forward slashes.
+ * @param options Optional MIME type for the streaming file.
+ * @throws {TypeError} If `name` is empty or the content type contains control characters.
  */
 function toStreamingFile(data, name, options) {
-    if (!name) {
+    if (typeof name !== 'string' || !name) {
         throw new TypeError('toStreamingFile requires a non-empty file name');
     }
+    const type = options?.type;
+    if (type) {
+        validateStreamingFileType(type);
+    }
     return {
         [brand_privateStreamingFile]: true,
         data,
         name,
-        ...(options?.type ? { type: options.type } : {}),
+        ...(type ? { type } : {}),
     };
 }
+/**
+ * Verifies that the current runtime exposes the global `File` constructor.
+ *
+ * @throws {Error} If `File` is unavailable; older Node.js runtimes receive an
+ * additional upgrade or `node:buffer` compatibility suggestion.
+ */
 const checkFileSupport = () => {
     if (typeof File === 'undefined') {
         const { process } = globalThis;
-        const isOldNode = typeof process?.versions?.node === 'string' && parseInt(process.versions.node.split('.')) < 20;
+        const isOldNode = typeof process?.versions?.node === 'string' &&
+            Number.parseInt(process.versions.node.split('.'), 10) < 20;
         throw new Error('`File` is not defined as a global, which is required for file uploads.' +
-            (isOldNode ?
-                " Update to a supported Node.js LTS release, or set `globalThis.File` to `import('node:buffer').File`."
+            (isOldNode
+                ? " Update to a supported Node.js LTS release, or set `globalThis.File` to `import('node:buffer').File`."
                 : ''));
     }
 };
@@ -40,42 +57,84 @@ exports.checkFileSupport = checkFileSupport;
 /**
  * Construct a `File` instance. This is used to ensure a helpful error is thrown
  * for environments that don't define a global `File` yet.
+ *
+ * A missing filename becomes `unknown_file`.
  */
 function makeFile(fileBits, fileName, options) {
     (0, exports.checkFileSupport)();
     return new File(fileBits, fileName ?? 'unknown_file', options);
 }
-function getName(value) {
-    return (((typeof value === 'object' &&
-        value !== null &&
-        (('name' in value && value.name && String(value.name)) ||
-            ('url' in value && value.url && String(value.url)) ||
-            ('filename' in value && value.filename && String(value.filename)) ||
-            ('path' in value && value.path && String(value.path)))) ||
-        '')
-        .split(/[\\/]/)
-        .pop() || undefined);
+/**
+ * Infers a filename from an object's `name`, `url`, `filename`, or `path` value.
+ *
+ * Directory components separated by either `/` or `\\` are discarded unless an
+ * explicitly supplied `name` or `filename` opts into preserving its path. Preserved
+ * paths must be safe and relative, and use forward slashes. Paths inferred from URLs and filesystem streams
+ * discard their directories.
+ */
+function getName(value, options) {
+    if (typeof value !== 'object' || value === null) {
+        return undefined;
+    }
+    const name = 'name' in value ? value.name : undefined;
+    const explicitName = (name && String(name)) || ('filename' in value && value.filename && String(value.filename));
+    if (explicitName) {
+        return options?.stripFilename === false ? normalizeFilenamePath(explicitName) : basename(explicitName);
+    }
+    const url = 'url' in value && value.url && String(value.url);
+    if (url) {
+        try {
+            return basename(new URL(url).pathname);
+        }
+        catch {
+            return basename(url);
+        }
+    }
+    const path = 'path' in value && value.path && String(value.path);
+    return path ? basename(path) : undefined;
+}
+function basename(value) {
+    return value.split(/[\\/]/).pop() || undefined;
+}
+function normalizeFilenamePath(value) {
+    const normalized = value.replace(/\\/g, '/');
+    if (normalized.startsWith('/') || /^[A-Za-z]:/.test(normalized) || normalized.split('/').includes('..')) {
+        throw new TypeError('Upload file name must be a safe relative path without parent directory segments');
+    }
+    return normalized;
 }
+/** Identifies objects that expose a callable `Symbol.asyncIterator` method. */
 const isAsyncIterable = (value) => value != null && typeof value === 'object' && typeof value[Symbol.asyncIterator] === 'function';
 exports.isAsyncIterable = isAsyncIterable;
 /**
- * Returns a multipart/form-data request if any part of the given request body contains a File / Blob value.
- * Otherwise returns the request as is.
+ * Converts a request to multipart form data when its body contains an upload.
+ *
+ * Uploads include files, blobs, responses, async iterables, readable
+ * streams, and {@link StreamingFile} values anywhere in a nested body. Bodies
+ * containing streaming values are encoded lazily; other uploads use `FormData`.
+ * Requests without uploads are returned unchanged.
  */
-const maybeMultipartFormRequestOptions = async (opts, fetch) => {
-    if (!hasUploadableValue(opts.body))
+const maybeMultipartFormRequestOptions = async (opts, fetch, formOptions) => {
+    if (!hasUploadableValue(opts.body)) {
         return opts;
+    }
     if (hasStreamingUploadableValue(opts.body)) {
-        return createStreamingFormRequestOptions(opts);
+        return createStreamingFormRequestOptions(opts, formOptions);
     }
-    return { ...opts, body: await (0, exports.createForm)(opts.body, fetch) };
+    return { ...opts, body: await (0, exports.createForm)(opts.body, fetch, formOptions) };
 };
 exports.maybeMultipartFormRequestOptions = maybeMultipartFormRequestOptions;
-const multipartFormRequestOptions = async (opts, fetch) => {
+/**
+ * Encodes a request body as multipart form data even when no file is present.
+ *
+ * Streaming uploads produce a lazy multipart `ReadableStream` and an explicit
+ * boundary header; other values are materialized into platform `FormData`.
+ */
+const multipartFormRequestOptions = async (opts, fetch, formOptions) => {
     if (hasStreamingUploadableValue(opts.body)) {
-        return createStreamingFormRequestOptions(opts);
+        return createStreamingFormRequestOptions(opts, formOptions);
     }
-    return { ...opts, body: await (0, exports.createForm)(opts.body, fetch) };
+    return { ...opts, body: await (0, exports.createForm)(opts.body, fetch, formOptions) };
 };
 exports.multipartFormRequestOptions = multipartFormRequestOptions;
 const supportsFormDataMap = /* @__PURE__ */ new WeakMap();
@@ -88,8 +147,9 @@ const supportsFormDataMap = /* @__PURE__ */ new WeakMap();
 function supportsFormData(fetchObject) {
     const fetch = typeof fetchObject === 'function' ? fetchObject : fetchObject.fetch;
     const cached = supportsFormDataMap.get(fetch);
-    if (cached)
+    if (cached) {
         return cached;
+    }
     const promise = (async () => {
         try {
             let FetchResponse;
@@ -115,18 +175,27 @@ function supportsFormData(fetchObject) {
     supportsFormDataMap.set(fetch, promise);
     return promise;
 }
-const createForm = async (body, fetch) => {
+/**
+ * Materializes an object into platform `FormData` after verifying fetch support.
+ *
+ * Strings, numbers, and booleans become text fields; responses, blobs,
+ * and async byte sources become file fields. Arrays and nested objects use
+ * bracketed field names, while `undefined` values are omitted.
+ *
+ * @throws {TypeError} If the fetch implementation cannot encode global
+ * `FormData`, a field is `null`, or a field has an unsupported value.
+ */
+const createForm = async (body, fetch, options = {}) => {
     if (!(await supportsFormData(fetch))) {
         throw new TypeError('The provided fetch function does not support file uploads with the current global FormData class.');
     }
     const form = new FormData();
-    await Promise.all(Object.entries(body || {}).map(([key, value]) => addFormValue(form, key, value)));
+    await Promise.all(Object.entries(body || {}).map(([key, value]) => addFormValue(form, key, value, options)));
     return form;
 };
 exports.createForm = createForm;
-// We check for Blob not File because Bun.File doesn't inherit from File,
-// but they both inherit from Blob and have a `name` property at runtime.
-const isNamedBlob = (value) => value instanceof Blob && 'name' in value;
+// Native files, Bun files, and unnamed upload values all inherit from Blob.
+const isBlob = (value) => value instanceof Blob;
 const isReadableStream = (value) => typeof value === 'object' &&
     value !== null &&
     'getReader' in value &&
@@ -138,68 +207,92 @@ const isUploadable = (value) => typeof value === 'object' &&
         (0, exports.isAsyncIterable)(value) ||
         isReadableStream(value) ||
         isStreamingFile(value) ||
-        isNamedBlob(value));
+        isBlob(value));
 const hasStreamingUploadableValue = (value) => {
-    if (isStreamingFile(value) || (0, exports.isAsyncIterable)(value) || isReadableStream(value))
+    if (isStreamingFile(value) || (0, exports.isAsyncIterable)(value) || isReadableStream(value)) {
         return true;
-    if (Array.isArray(value))
+    }
+    if (Array.isArray(value)) {
         return value.some(hasStreamingUploadableValue);
-    if (value && typeof value === 'object' && !isNamedBlob(value) && !(value instanceof Response)) {
+    }
+    if (value && typeof value === 'object' && !isBlob(value) && !(value instanceof Response)) {
         for (const k in value) {
-            if (hasStreamingUploadableValue(value[k]))
+            if (hasStreamingUploadableValue(value[k])) {
                 return true;
+            }
         }
     }
     return false;
 };
 const hasUploadableValue = (value) => {
-    if (isUploadable(value))
+    if (isUploadable(value)) {
         return true;
-    if (Array.isArray(value))
+    }
+    if (Array.isArray(value)) {
         return value.some(hasUploadableValue);
+    }
     if (value && typeof value === 'object') {
         for (const k in value) {
-            if (hasUploadableValue(value[k]))
+            if (hasUploadableValue(value[k])) {
                 return true;
+            }
         }
     }
     return false;
 };
-const createStreamingFormRequestOptions = (opts) => {
+const snapshotPreservedUploadEntries = (entries, filenames) => {
+    const snapshot = [];
+    for (const entry of entries) {
+        if (isUploadable(entry.value) && !filenames.has(entry.value)) {
+            filenames.set(entry.value, getStreamingFileName(entry.value, { stripFilenames: false }));
+        }
+        snapshot.push(entry);
+    }
+    return snapshot;
+};
+const createStreamingFormRequestOptions = (opts, options = {}) => {
+    const entries = iterateFormEntries(opts.body);
+    const preservedFilenames = options.stripFilenames === false ? new WeakMap() : undefined;
+    const multipartEntries = preservedFilenames
+        ? snapshotPreservedUploadEntries(entries, preservedFilenames)
+        : entries;
     const boundary = `openai-${Math.random().toString(36).slice(2)}`;
-    const body = (0, shims_1.ReadableStreamFrom)(iterateMultipartBody(opts.body, boundary));
+    const body = (0, shims_1.ReadableStreamFrom)(iterateMultipartBody(multipartEntries, boundary, options, preservedFilenames));
     return {
         ...opts,
         body,
         headers: (0, headers_1.buildHeaders)([{ 'content-type': `multipart/form-data; boundary=${boundary}` }, opts.headers]),
     };
 };
-async function* iterateMultipartBody(body, boundary) {
-    for await (const { key, value } of iterateFormEntries(body)) {
-        yield (0, bytes_1.encodeUTF8)(`--${boundary}\r\n`);
+async function* iterateMultipartBody(entries, boundary, options, preservedFilenames) {
+    for await (const { key, value } of entries) {
         if (isUploadable(value)) {
-            const filename = getStreamingFileName(value);
+            const filename = preservedFilenames?.get(value) ?? getStreamingFileName(value, options);
             const type = getStreamingFileType(value);
-            yield (0, bytes_1.encodeUTF8)(`Content-Disposition: form-data; name="${escapeHeaderValue(key)}"; filename="${escapeHeaderValue(filename)}"\r\n` + `Content-Type: ${type}\r\n\r\n`);
+            yield (0, bytes_1.encodeUTF8)(`--${boundary}\r\n`);
+            yield (0, bytes_1.encodeUTF8)(`Content-Disposition: form-data; name="${escapeHeaderValue(key)}"; filename="${escapeHeaderValue(filename)}"\r\nContent-Type: ${type}\r\n\r\n`);
             yield* iterateBytes(getStreamingFileData(value));
         }
         else {
+            yield (0, bytes_1.encodeUTF8)(`--${boundary}\r\n`);
             yield (0, bytes_1.encodeUTF8)(`Content-Disposition: form-data; name="${escapeHeaderValue(key)}"\r\n\r\n${String(value)}`);
         }
         yield (0, bytes_1.encodeUTF8)('\r\n');
     }
     yield (0, bytes_1.encodeUTF8)(`--${boundary}--\r\n`);
 }
-async function* iterateFormEntries(body) {
-    if (!body || typeof body !== 'object')
+function* iterateFormEntries(body) {
+    if (!body || typeof body !== 'object') {
         return;
+    }
     for (const [key, value] of Object.entries(body)) {
         yield* iterateFormValue(key, value);
     }
 }
-async function* iterateFormValue(key, value) {
-    if (value === undefined)
+function* iterateFormValue(key, value) {
+    if (value === undefined) {
         return;
+    }
     if (value == null) {
         throw new TypeError(`Received null for "${key}"; to pass null in FormData, you must use the string 'null'`);
     }
@@ -223,21 +316,44 @@ async function* iterateFormValue(key, value) {
         throw new TypeError(`Invalid value given to form, expected a string, number, boolean, object, Array, File or Blob but got ${value} instead`);
     }
 }
-function getStreamingFileName(value) {
-    return isStreamingFile(value) ? value.name : getName(value) ?? 'unknown_file';
+function getStreamingFileName(value, options) {
+    if (isStreamingFile(value)) {
+        const { name } = value;
+        if (typeof name !== 'string' || !name) {
+            throw new TypeError('Streaming upload file name must be a non-empty string');
+        }
+        return options.stripFilenames === false
+            ? normalizeFilenamePath(name)
+            : (basename(name) ?? 'unknown_file');
+    }
+    return getName(value, { stripFilename: options.stripFilenames }) ?? 'unknown_file';
 }
 function getStreamingFileType(value) {
-    if (isStreamingFile(value))
-        return value.type || 'application/octet-stream';
-    if (isNamedBlob(value) && value.type)
-        return value.type;
-    if (value instanceof Response)
-        return value.headers.get('content-type') || 'application/octet-stream';
-    return 'application/octet-stream';
+    let type;
+    if (isStreamingFile(value) || isBlob(value)) {
+        ({ type } = value);
+    }
+    else if (value instanceof Response) {
+        type = value.headers.get('content-type') ?? undefined;
+    }
+    return validateStreamingFileType(type || 'application/octet-stream');
+}
+function validateStreamingFileType(type) {
+    if (typeof type !== 'string') {
+        throw new TypeError('Streaming upload content type must be a string');
+    }
+    for (let index = 0; index < type.length; index += 1) {
+        const character = type.codePointAt(index) ?? 0;
+        if (character <= 0x1f || character === 0x7f) {
+            throw new TypeError('Streaming upload content type must not contain control characters');
+        }
+    }
+    return type;
 }
 function getStreamingFileData(value) {
-    if (isStreamingFile(value))
+    if (isStreamingFile(value)) {
         return value.data;
+    }
     return value;
 }
 async function* iterateBytes(value) {
@@ -251,12 +367,7 @@ async function* iterateBytes(value) {
         yield new Uint8Array(value);
     }
     else if (value instanceof Response) {
-        if (value.body) {
-            yield* iterateBytes(value.body);
-        }
-        else {
-            yield* iterateBytes(await value.blob());
-        }
+        yield* iterateBytes(value.body || (await value.blob()));
     }
     else if (value instanceof Blob) {
         if (typeof value.stream === 'function') {
@@ -281,32 +392,58 @@ async function* iterateBytes(value) {
     }
 }
 function escapeHeaderValue(value) {
-    return value.replace(/["\\\r\n]/g, (character) => encodeURIComponent(character));
+    return Array.from(value, (character) => {
+        const codePoint = character.codePointAt(0) ?? 0;
+        return codePoint <= 0x1f || codePoint === 0x7f || character === '"' || character === '\\'
+            ? encodeURIComponent(character)
+            : character;
+    }).join('');
 }
-const addFormValue = async (form, key, value) => {
-    if (value === undefined)
+const addFormValue = async (form, key, value, options) => {
+    if (value === undefined) {
         return;
+    }
     if (value == null) {
         throw new TypeError(`Received null for "${key}"; to pass null in FormData, you must use the string 'null'`);
     }
-    // TODO: make nested formats configurable
+    // Nested form keys use the current bracketed encoding.
     if (typeof value === 'string' || typeof value === 'number' || typeof value === 'boolean') {
         form.append(key, String(value));
     }
     else if (value instanceof Response) {
-        form.append(key, makeFile([await value.blob()], getName(value)));
+        const blob = await value.blob();
+        form.append(key, makeFile([blob], getName(value, { stripFilename: options.stripFilenames }), { type: blob.type }));
     }
     else if ((0, exports.isAsyncIterable)(value)) {
-        form.append(key, makeFile([await new Response((0, shims_1.ReadableStreamFrom)(value)).blob()], getName(value)));
+        form.append(key, makeFile([await new Response((0, shims_1.ReadableStreamFrom)(value)).blob()], getName(value, { stripFilename: options.stripFilenames })));
     }
-    else if (isNamedBlob(value)) {
-        form.append(key, value, getName(value));
+    else if (isBlob(value)) {
+        const filename = getName(value, { stripFilename: options.stripFilenames });
+        if (filename === undefined) {
+            form.append(key, value);
+        }
+        else {
+            form.append(key, value, filename);
+        }
     }
     else if (Array.isArray(value)) {
-        await Promise.all(value.map((entry) => addFormValue(form, key + '[]', entry)));
+        // Prepare array elements concurrently, then preserve their repeated-field order.
+        const entries = await Promise.all(value.map(async (entry) => {
+            const entryForm = new FormData();
+            await addFormValue(entryForm, key + '[]', entry, options);
+            return entryForm;
+        }));
+        for (const entryForm of entries) {
+            if (!entryForm) {
+                continue;
+            }
+            for (const [entryKey, entryValue] of entryForm.entries()) {
+                form.append(entryKey, entryValue);
+            }
+        }
     }
     else if (typeof value === 'object') {
-        await Promise.all(Object.entries(value).map(([name, prop]) => addFormValue(form, `${key}[${name}]`, prop)));
+        await Promise.all(Object.entries(value).map(([name, prop]) => addFormValue(form, `${key}[${name}]`, prop, options)));
     }
     else {
         throw new TypeError(`Invalid value given to form, expected a string, number, boolean, object, Array, File or Blob but got ${value} instead`);