Align JS SDK product behavior with public Go and Python SDKs

[complynx]

The JS SDK diverged from public Go/Python behavior across credentials, requests, operations, and protobuf helpers. This change aligns the product contracts while retaining JS events, promises, native values, and client ownership. Failed operation waits now reject with an inspectable OperationError; automatic credential discovery remains opt-in.

• Add IMDS/token-endpoint credentials, opt-in VM discovery, and per-request named providers. Use and trim NEBIUS_IAM_TOKEN, align CLI credential priority, and reject invalid explicit credentials.
• Recover rejected credentials through cache wrappers, reuse tokens replaced in the shared file, and bound the complete acquisition chain. Preserve zero and negative exchange/federation lifetimes and recovery errors, observe renewal failures, and handle launcher, callback-server and interrupted-response failures without unhandled events; keep manual federation login available and close callback servers after failed login. Apply one deadline across callback and token POST, destroy stalled HTTP requests, and measure OAuth expiry from acquisition start.
• Align retries, idempotency, deadlines, diagnostics, typed parent/tenant defaults, operation validation, progress, and polling errors/cancellation. Completed native failures survive late cancellation when recovery is declined, late polling responses preserve terminal state, and alpha operations expose decoded resource snapshots. Progress payloads remain available after completion.
• Add canonical protobuf JSON, Any/FieldMask and descriptor-based field/reset-mask helpers that compose explicit metadata; preserve existing toJSON output and correct wire merging, wire-tag validation, extensions, and unsigned values.
• Document migration behavior and new APIs in README/JSDoc, correct contributor setup instructions, and require public API comment coverage and STE in AGENTS.md.

The candidate is based on latest JS main 644aa844, public API 43cab7c, GoSDK 83393ae1, and PySDK 94511726. All 481 public RPCs and 1,219 messages are generated, with no missing entries.

Validation: 430 tests pass across 34 suites, including 50 generator tests and both rebuilt-package tests. The full CJS/ESM build, runtime lint, scoped generator lint, changed-file formatting, and whitespace checks pass. Generator reference tests use local ts-proto 2.6.1; the repository configuration is restored. Production E2E calls and live identity-provider login were not run locally.

Final fresh primary review found no actionable findings. The independent claude-opus-5-5 cross-review considers the code merge-ready; its latent helper-name collision concern has no match in the public schema. Remaining suggestions were style nits. Detailed coverage and limits are recorded in the PR audit comment.

Documentation follow-up: strict documentation validation, README example type-checking, touched-file lint and formatting pass. The final primary review is clean; the final Opus review’s remaining contributor command clarification was applied. No findings remain unresolved.

Compatibility matrix: #285 (comment)

Audit and verification: #285 (comment)

Written by Codex (gpt-6/Codex)
on behalf of Daniel Drizhuk

[complynx]

Compatibility matrix for SDK behavior changes

Reports moved from repository files to this PR discussion. The 59 contracts below use public GoSDK 83393ae1, public PySDK 94511726, JS baseline 644aa844, and API 43cab7c. JS events, promises, native values, timers, cache locks, and client ownership remain native.

Accepted choices (the user selected all recommendations):

• A1: Failed operation waits reject with OperationError and retain the operation.
• A2: Automatic environment and CLI credentials remain opt-in in JS.
• A3: Use typed parent/tenant defaults, noParentId, and explicit-value precedence.
• A4: Provide additive canonical protobuf JSON; preserve generated toJSON.

Compatibility matrix — all 59 contracts

Layer	Contract	Public GoSDK	Public PySDK	JS baseline	JS action	Result	Evidence
Generated API	Public API revision	Pinned public API 43cab7c	Pinned public API 43cab7c	Latest main: API 43cab7c	Generate all current public services and messages	Reviewed; local tests pass	nebius-api; scripts/generator; api/generators/protoc-gen-gosdk; api/generators/protoc-gen-pysdk
Generated API	Unary RPC method paths and schemas	Descriptor-generated	Descriptor-generated	Descriptor-generated	Keep all method paths and wire schemas equivalent	Reviewed; local tests pass	scripts/generator/emit/printService.ts
Generated API	Streaming RPCs	Public generator rejects streaming RPCs	Public SDK rejects native streams	Unary generator; current public schema has no streaming RPCs	No missing public streaming RPC; native transport surfaces differ by language	Language-specific	api/generators/protoc-gen-gosdk/main.go; public descriptor audit
Generated API	Service-name annotations	Reads api_service_name	Registry reads annotation	Generated API name	Retain annotated endpoint resolution	Reviewed; local tests pass	src/runtime/resolver.ts; generator_extensions.cases.ts; resolver source review
Generated API	Updater annotations	METHOD_UPDATER overrides method name	METHOD_UPDATER overrides method name	Supported	Retain annotation-driven reset masks	Reviewed; local tests pass	src/tests/generator_extensions.cases.ts
Generated API	Deprecation annotations	Generated documentation	Generated warnings and documentation	Generated warnings and documentation	Keep JS warning mechanism and annotation values	Reviewed; local tests pass	scripts/generator/emit/helpers.ts; generator_extensions.cases.ts
Generated API	NID annotations	Typed default insertion; ID warnings moved to gateway	Public uses legacy parent-only behavior	No NID annotation support	Generated NID annotations drive default insertion; explicit request values stay unchanged	Implemented; local tests pass	scripts/generator/emit/printMessage/index.ts; printService.ts; src/runtime/request.ts; sdk_parity.test.ts
Generated API	Generated client construction	Services() hierarchy	Service(sdk)	new Service(sdk)	Keep idiomatic JS construction	Language-specific	src/sdk.ts; public GoSDK /sdk.go
Protobuf	Binary codecs; maps; oneofs; unknown fields	Native protobuf	Direct generated codecs	Replaced singular message occurrences; omitted map values disappeared	Merge singular and same-oneof message occurrences, preserve unknown bytes, and insert map-entry defaults; copy registered extensions in typed constructors	Implemented; local tests pass	scripts/generator/emit/printMessage/emitDecode.ts; decodeOneofs.ts; src/tests/review_parity.test.ts
Protobuf	Enum values and int64	Native enum and int64	Python enum and int	Signed Long conversion also applied to uint64/fixed64	Preserve enum behavior and full unsigned 64-bit values across constructors, JSON and wire decoding	Implemented; local tests pass	scripts/generator/emit/helpers.ts; emitDecode.ts; emitJSON.ts; emitPartial.ts; src/tests/review_parity.test.ts
Protobuf	Timestamp and duration wire values	Nanosecond precision	Timestamp/duration representations	Pre-epoch and native duration reflection had value/validity gaps	Preserve signed duration seconds and reject invalid raw timestamp components; retain native millisecond values	Implemented; local tests pass	src/runtime/protos/wkt.ts; src/tests/review_parity.test.ts
Protobuf	Canonical protobuf JSON	protojson uses canonical Any and FieldMask	Canonical registry-aware JSON	Raw Any JSON; unchanged mask paths; permissive legacy parser	Add canonical Any/FieldMask and builtin wrapper conversion; validate fields, oneofs, scalar types/ranges and WKT input; accept null collections; support ignoreUnknownFields; convert registered extensions to bracketed full names and retain nested/default presence; canonical temporal fractional precision	Implemented; local tests pass	src/runtime/protos/proto_json.ts; fieldmask.ts; src/tests/review_parity.test.ts
Protobuf	Any pack/unpack and operation payloads	Native Any and decoded operation payloads	Registry Any unpacking	Registry lookup only; operation raw payloads only	Registry pack/unpack; decode request, alpha resource snapshot and progress payloads; retain progress after completion and copy headers; unknown/Empty payloads remain raw	Implemented; local tests pass	src/runtime/protos/registry.ts; operation.ts; sdk_parity.test.ts (known and unknown payloads)
Masks	Mask parser, wildcard algebra, path keys	Full mask library	Full mask library	Parser and algebra implemented	Named and wildcard submasks merge; existing Go vectors pass	Implemented; local tests pass	src/runtime/fieldmask.ts; go_mask_compat.test.ts; go_fieldpath_compat.test.ts; go_fieldkey_compat.test.ts
Masks	Full-update reset masks and immutable fields	Descriptor-aware	Descriptor-aware	Descriptor-aware	Default excludes immutable fields; explicit includeImmutables option now supported	Implemented; local tests pass	src/runtime/resetmask.ts; resetmask.test.ts; sdk_parity.test.ts; public Go protobuf/options.go
Masks	Explicit reset/select metadata	Header helpers	Metadata supports headers	Automatic reset only; manual metadata possible	Add typed call options and composable metadata helpers; preserve existing explicit select/reset mask values	Implemented; local tests pass	src/runtime/request.ts; public Go proto/fieldmask/grpcheader
Masks	Known-field masks, modified reset masks, filter and patch	Public protobuf mask utilities	Only automatic reset-mask helper	Missing descriptor filter/patch/diff helpers	Add descriptor helpers with protobuf collection presence, native Value null preservation, and signed duration values	Implemented; local tests pass	src/runtime/protobuf_mask.ts; src/runtime/protos/wkt.ts; src/tests/review_parity.test.ts
Configuration	CLI location and environment precedence	CLI config; environment token has priority; blank token-file falls through	CLI config; environment token has priority; token-file presence is checked even when blank	Implemented	Verify profile selection and override order; follow Go for blank token-file/token-endpoint fallback	Reviewed; local tests pass	src/runtime/cli_config.ts; src/tests/cli_config_*.test.ts
Configuration	Automatic credential discovery	Default CLI config reader	Environment fallback	Explicit credentials/config only	A2 accepted: environment and CLI configuration remain opt-in	Accepted JS policy; tested	src/sdk.ts; sdk_parity.test.ts (IAM environment and explicit SDK credentials)
Configuration	Token-file lazy resolution	Lazy file read	Lazy file read	Lazy file read	Keep lazy credential reads and rotation	Reviewed; local tests pass	src/runtime/token/file.ts
Configuration	Token endpoint profiles	token-endpoint supported	Not available in the public SDK	Missing	Add lazy public Go-compatible IMDS source	Implemented; local tests pass	public GoSDK /config/reader/reader.go:309; src/runtime/cli_config.ts
Configuration	Tenant and parent defaults	Tenant-aware, validates default NID type	Public uses legacy parent-only behavior	Parent-only and name-based	A3 accepted: NID-aware parent/tenant defaults; preserve explicit values; trim explicit defaults and use profile defaults for blank tenant options	Implemented; local tests pass	src/runtime/request.ts; src/sdk.ts; sdk_parity.test.ts (parent precedence, typed tenant, noParentId)
Configuration	Disable parent insertion	WithNoParentID disables parent and tenant	Public config reader option	Config option only	Add SDK noParentId option	Implemented; local tests pass	public GoSDK /options.go; src/sdk.ts
Credentials	Static and environment access tokens	Supported; trim environment tokens and skip whitespace-only values	Supported; trim environment tokens and skip whitespace-only values	EnvBearer defaulted to NEBIUS_TOKEN	EnvBearer defaults to NEBIUS_IAM_TOKEN and trims whitespace; retain opt-in and explicit variable names; whitespace-only values fall through to profile credentials	Implemented; local tests pass	src/runtime/token/static.ts; sdk_parity.test.ts; cli_config_env_token.test.ts
Credentials	Service account key/file/credentials JSON	JWT token exchange	JWT token exchange	Key sources supported; CLI federation priority/conflicts differed	Use public key-source precedence and reject credentials-file/ID conflicts	Implemented; local tests pass	src/runtime/cli_config.ts; src/tests/review_parity.test.ts
Credentials	Federated subject credentials	JWT actor token exchange	JWT actor token exchange	JWT actor token exchange	Verify rotating file source and request fields	Reviewed; local tests pass	src/runtime/service_account/federated_credentials.ts
Credentials	Browser federation and PKCE	Federation HTTP OAuth	Federation HTTP OAuth	Federation HTTP OAuth	OAuth access-token source and PKCE fields reviewed; JS callback server and invitation mechanisms retained; close loopback callback servers on success and failed login; allow manual login without a browser opener; return launcher, callback-server and interrupted-response failures through promises; preserve zero and negative OAuth lifetimes from acquisition start; bound callback and token POST by one deadline and destroy stalled requests	Implemented; local tests pass	src/runtime/token/federation_bearer; federation_cleanup.test.ts (14 callback, browser, HTTP, lifetime and renewal cases); no live identity-provider login
Credentials	Impersonation	TokenExchange actor and subject	TokenExchange actor and subject	Implemented	Retain actor/subject token exchange and use source error recovery before reacquiring rejected actor tokens; force fresh actor acquisition after rejection even with cached renewable credentials; preserve non-positive lifetimes and bound actor acquisition, recovery, service resolution and exchange within one deadline	Implemented; local tests pass	src/runtime/token/impersonated.ts; src/tests/sdk_parity.test.ts
Credentials	IMDS acquisition	Metadata:true GET; 3 HTTP attempts; 200ms linear backoff	Not available in the public SDK	Missing	Add HTTP IMDS bearer and direct SDK tokenEndpoint credentials	Implemented; local tests pass	public GoSDK /auth/imds_tokener.go
Credentials	Access-token retrieval	SDK.BearerToken	SDK.get_token	Missing SDK method	Add SDK.getToken without constructing an API request	Implemented; local tests pass	public GoSDK /sdk.go; src/sdk.ts; src/runtime/authorization/token.ts; sdk_parity.test.ts
Credentials	In-memory renewal and shared file caches	Go synchronization and timers	Python async synchronization	Shared file cache removal wrote at the previous read offset	Write cache updates under existing locks at explicit offset zero, preserving other profiles; delegate rotated-token recovery and forced renewal through synchronous cache wrappers; retain successful shared-cache recovery tokens for the next RPC authentication in both cache wrappers	Implemented; local tests pass	src/runtime/token/file_cache/token_cache.ts; src/tests/review_parity.test.ts; src/runtime/token/file_cache/renewable_bearer.ts; sdk_parity.test.ts
Credentials	Failed token renewal and stale tokens	Valid cache can survive transient renewal errors	Valid cache can survive transient renewal errors	Supported	Verify explicit synchronous renewal and invalidation	Reviewed; local tests pass	src/runtime/token/renewable.ts
Credentials	Credential logging	Sanitized structured wrappers; lazy readers are not forced by logs	Sanitized credential representations	Mostly implemented; SDK logs force reader.read	Credential diagnostics no longer force lazy reader.read; existing secret sanitizers retained	Implemented; reviewed serializers	src/sdk.ts; src/runtime/token_sanitizer.ts; auth_integration.test.ts; service-account and file-cache diagnostics reviewed
Transport	Resolver overrides and templates	Ordered resolvers	Ordered resolvers	Ordered resolvers	Retain resolver composition and API endpoint templates	Reviewed; local tests pass	src/runtime/resolver.ts
Transport	TLS roots and per-address overrides	System TLS; dial overrides	System TLS; address overrides	System TLS; address overrides	Verify TLS root propagation to HTTP credential calls	Reviewed; local tests pass	src/runtime/tls/system_certs.ts; src/sdk.ts
Transport	User-agent and keepalive	Prefix warning; configured keepalive	Prefix warning; configured keepalive	Prefix warning; configured keepalive	Keep same product defaults with language-specific user-agent	Reviewed; local tests pass	src/tests/sdk_user_agent.test.ts; src/tests/keepalive_metrics.test.ts
Transport	Channel lifetime and shutdown	SDK context and Go channels	Owned event loop and channel pool	Shared clients and promises	Retain JS ownership; reject use after SDK close	Implemented; local tests pass	src/sdk.ts
Requests	Default retries and timeouts	3 attempts; 60s request; 20s attempt; 15min auth	3 total attempts; same timeout defaults	4 total attempts; same timeout defaults	Use 3 default total attempts; add SDK-wide requestOptions	Implemented; local tests pass	public GoSDK /options.go; public PySDK src/nebius/aio/request.py; src/runtime/request.ts
Requests	Explicit service retry hints	CALL yes; NOTHING/UNIT_OF_WORK no	Explicit hints precede default codes	Default codes override service hints	Honor explicit hints before transport defaults	Implemented; local tests pass	src/runtime/request.ts:isRetriableError
Requests	Individual attempt deadline vs total deadline	Internal attempt timeout can retry; caller deadline stops	Attempt timeout retries; logical deadline stops	Attempt deadlines never retry	Use a fresh request execution window after successful authentication; cap all cycles by the earlier AuthTimeout or caller deadline	Implemented; local tests pass	src/runtime/request.ts; src/tests/sdk_parity.test.ts
Requests	Idempotency	All unary calls; stable per logical call	All unary calls; stable per logical call	Excludes read method names	Add one stable key to every unary call; preserve supplied key	Implemented; local tests pass	public GoSDK /conn/idempotency.go; public PySDK src/nebius/aio/idempotency.py
Requests	Authorization override and RPC rejection	Preserves caller authorization; renews on UNAUTHENTICATED	Preserves caller authorization; retries rejected credentials	Always adds token; no RPC auth renewal	Caller headers suppress auth; bounded synchronous renewal retries only changed credentials	Implemented; local tests pass	src/runtime/request.ts; authorization/token.ts; token/file.ts; token/imds.ts; metrics.ts; sdk_parity.test.ts
Requests	Final diagnostics and absent IDs	Final headers/status available	Final attempt status; absent IDs empty	First attempt can settle status; absent IDs remain pending	Expose final attempt diagnostics; settle absent IDs as empty	Implemented; local tests pass	src/runtime/request.ts
Requests	Request submission and cancellation	Native terminal response authoritative	Snapshots input; preserves terminal result	Mutable input; cancellation removes status listeners	Snapshot generated input; preserve completed result; cancel auth waits	Implemented; local tests pass	src/runtime/request.ts
Errors	Structured service errors and unknown details	Typed details and retained raw details	Typed details and retained raw details	Generated serviceErrors and Status details	Verify known and unknown error detail retention and IDs	Reviewed; local tests pass	src/runtime/error.ts; src/tests/disk_service_error.test.ts
Operations	Failed terminal operation	Wait returns operation error	Public wait leaves terminal failure checking to callers	Wait resolves even on failure	A1 accepted: wait rejects with OperationError retaining the operation	Implemented; local tests pass	src/runtime/operation.ts; sdk_parity.test.ts (terminal failure, no further polling)
Operations	Transient poll errors and overall limits	Backoff until context ends; nonretriable errors stop; non-positive poll intervals use the 1-second default	Public catches transient errors; total timeout bounds wait; non-positive poll intervals raise ValueError; concurrent updates preserve terminal state	Backoff; caller deadline can loop indefinitely	Bound polling/backoff by overall deadline; retain nonretriable failures; follow Go for non-positive intervals (1-second default); preserve terminal state on overlapping wait/update responses	Implemented; local tests pass	src/runtime/operation.ts; public Go operations/options.go @83393ae1; public Python aio/operation.py @94511726; local wait tests
Operations	Progress tracker, timestamps, alpha operation	Progress helpers; v1 and alpha	Progress helpers; v1 and alpha	Work ratios capped at 1; time estimates exceeded completion bounds	Retain actual work ratios, force terminal overall progress to 1, and align time estimates	Implemented; local tests pass	src/runtime/operation.ts; src/tests/progress_tracker.test.ts; src/tests/review_parity.test.ts
Observability	Logging and config/auth metrics	slog and callbacks	logging and callbacks	JS handlers and callbacks	Keep JS APIs; verify callback failures do not affect requests	Reviewed; local tests pass	src/runtime/metrics.ts; src/runtime/util/logging.ts
Generated API	Paginated list iteration	Generated Filter iterator for paginated List	Caller-managed pages	No generated iterator	Added filter() as an async generator; clones input and stops on early return	Implemented; local tests pass	scripts/generator/emit/printService.ts; sdk_parity.test.ts
Generated API	Service-bound operation listing	ListOperations on operation-producing services	Operation service lookup	getOperationService only	Added listOperations() on the same service address; operation pages also support filter()	Implemented; local tests pass	scripts/generator/emit/printService.ts; sdk_parity.test.ts
Masks	Field-path manipulation and traversal	Get/ReplaceAtFieldPath; depth/breadth traversal	Mask path helpers	No protobuf path operations	Add path lookup/replacement and depth/breadth traversal; support terminal oneof-group lookup; reject incompatible replacement values	Implemented; local tests pass	src/runtime/protobuf_mask.ts; src/tests/review_parity.test.ts
Credentials	Named credential wrappers	Public NamedTokener	Named credential cache keys	Public NamedBearer	Retained public named wrappers and native cache mechanisms	Reviewed; native JS mechanism	src/runtime/token.ts; public Go auth/named_tokener.go
Credentials	Token-exchange bearer token type	Case-insensitive Bearer token type	Accepts Bearer	Case-sensitive check	Accepted case-insensitive bearer token types for exchange and impersonation	Implemented; local tests pass	src/runtime/token/exchangeable.ts; impersonated.ts; src/tests/auth_integration.test.ts; token type checks reviewed
Configuration	Invalid explicit credential initialization	Returns construction/config errors	Raises initialization errors	Can log an error and disable auth	Invalid explicit credential inputs now throw; lazy sources remain lazy	Implemented; local tests pass	src/sdk.ts; config and service-account tests
Operations	Malformed operation envelopes	Rejects empty ID and invalid timestamps	Accepts partial direct-message wrappers	Malformed raw timestamps normalized before operation validation	Validate operation envelopes and retain invalid raw timestamp status through native conversion	Implemented; local tests pass	src/runtime/operation.ts; src/runtime/protos/wkt.ts; src/tests/review_parity.test.ts
Requests	Cancellable delay helpers	Context cancellation	Async cancellation	CancelableSleep constructor accesses this before super completes	Fixed native Promise-subclass construction and canceled waits	Implemented; local tests pass	src/runtime/util/cancelable.ts; operation/request cancellation tests
Credentials	Opt-in VM credential discovery	Missing CLI config probes IMDS, then mounted token file	Missing CLI config raises an error	Missing CLI config raises an error	Config.load opts in to bounded VM fallback; synchronous constructor retained	Implemented; local tests pass	config/reader/metadata.go; src/runtime/cli_config.ts; vm_discovery.test.ts
Authorization	Per-request named credentials	OneOfCredentials requires an explicit selector; closes all sources	One credential source per SDK	One credential source per SDK	OneOfProvider selects an identity via authorizationOptions.selector, validates selection, and closes every source	Implemented; local tests pass	auth/interceptors.go; src/runtime/authorization/one_of.ts; sdk_parity.test.ts

“Implemented” records a code change. “Reviewed” records retained behavior checked against source and the local suite. Language-specific results preserve JS mechanisms. No decision remains pending.

Written by Codex (gpt-6/Codex)
on behalf of Daniel Drizhuk

[complynx]

Behavior-change audit and validation record

The audit before this documentation follow-up completed 34 fresh primary passes, two separate SDK parity audits, and nine independent Opus cross-reviews. Incomplete review attempts are excluded. The final primary found no actionable findings. The final claude-opus-5-5 cross-review considered the code merge-ready, with no substantive current-schema defect. Its latent helper-name concern has no matching public RPC; the remaining suggestions were style nits.

Coverage included configuration, credentials/acquisition/recovery, authorization, transport, requests, operations/progress, protobuf wire/JSON/Any/extensions/native values, masks/traversal, pagination, generated services, diagnostics, and shutdown. The final primary compared public layers against both reference SDKs. The final Opus comparison sampled those layers; Python token implementations and Go mask filter/traverse were not separately compared in that cross-review.

Validation before the documentation follow-up:

• 430 tests across 34 suites, including 50 generator tests and two built-package tests.
• Full CJS/ESM builds, runtime and scoped generator lint, formatting and whitespace checks passed.
• GitHub CI passed for Node.js 22, 24, and 26, plus Semgrep.
• Generator reference tests used local ts-proto 2.6.1; the repository Buf configuration was restored.

Limits: generated message fields were sampled; third-party runtime internals were not audited exhaustively. No production calls or live identity-provider login were run locally. Dayjs keeps millisecond precision. Private-only SDK features are outside this public-source parity scope.

Public schema inventory

{
  "publicMethods": 481,
  "generatedMethods": 481,
  "publicMessages": 1219,
  "generatedPublicMessages": 1219,
  "missingMethods": [],
  "missingMessages": [],
  "extraMethods": [],
  "schemaRevision": "43cab7c03f9b162b2e524d03b7c47fd74451fcd9"
}

Documentation follow-up review: five completed fresh primary passes and four independent claude-opus-5-5 cross-reviews. One primary interrupted by user steering is excluded. The final primary found no actionable findings. The final Opus confirmed the changed API claims and agent rules; it repeated a contributor command clarification, which was applied. No findings remain unresolved. Earlier passes corrected recursive cloning, the protobuf source path, public module/member comments, and timeout wording.

The final AGENTS.md keeps durable JSDoc coverage and STE rules in caveman form. It omits setup facts available elsewhere and rules specific to this PR discussion.

Documentation validation passed with zero missing-documentation validation warnings. The 135 existing duplicate-declaration conversion warnings remain. README examples type-check against the built package; touched-file lint, formatting and whitespace checks pass. All ten changed TypeScript files emit byte-identical JavaScript when comments are removed. The five external report backups match the deleted blobs. Original workspace staging was preserved throughout review and publication.

Follow-up commit: 8a4a99d0. GitHub checks passed again for Node.js 22, 24, and 26, plus Semgrep. The Dependabot-only auto-merge job was skipped as expected. Squash auto-merge is enabled; the PR still needs the required human approval.

Written by Codex (gpt-6/Codex)
on behalf of Daniel Drizhuk