From b7a4d74062e08044d8057933dfe26fd4ab7ad361 Mon Sep 17 00:00:00 2001
From: Michael D'Angelo <mdangelo@openai.com>
Date: Mon, 17 Aug 2026 12:15:41 -0700
Subject: [PATCH 1/3] test: verify the installed SDK TypeScript contract

---
 .../scripts/fixtures/package-consumer.ts      | 33 +++++++++++++++++++
 sdk/typescript/scripts/smoke-package.mjs      | 32 +++++++++++++++++-
 sdk/typescript/tsconfig.build.json            |  1 +
 3 files changed, 65 insertions(+), 1 deletion(-)
 create mode 100644 sdk/typescript/scripts/fixtures/package-consumer.ts

diff --git a/sdk/typescript/scripts/fixtures/package-consumer.ts b/sdk/typescript/scripts/fixtures/package-consumer.ts
new file mode 100644
index 000000000..dc17741c9
--- /dev/null
+++ b/sdk/typescript/scripts/fixtures/package-consumer.ts
@@ -0,0 +1,33 @@
+import {
+  CodexSecurity,
+  DiffTarget,
+  estimateScanCost,
+  type ScanCost,
+  type ScanOptions,
+  type ScanResult,
+} from "@openai/codex-security";
+
+const options: ScanOptions = {
+  target: DiffTarget.refs({ base: "HEAD~1" }),
+  onProgress(progress) {
+    const completed: number = progress.filesCompleted;
+    void completed;
+  },
+};
+
+export async function scan(repository: string): Promise<ScanResult> {
+  const client = new CodexSecurity();
+  try {
+    return await client.run(repository, options);
+  } finally {
+    await client.close();
+  }
+}
+
+export const cost: ScanCost | null = estimateScanCost("gpt-5.6-sol", {
+  input_tokens: 10,
+  output_tokens: 2,
+});
+
+// @ts-expect-error Dependency injection is internal, not a public constructor overload.
+new CodexSecurity({}, {}, { surface: "sdk" });
diff --git a/sdk/typescript/scripts/smoke-package.mjs b/sdk/typescript/scripts/smoke-package.mjs
index 9c7307b6b..c95e2bcdf 100644
--- a/sdk/typescript/scripts/smoke-package.mjs
+++ b/sdk/typescript/scripts/smoke-package.mjs
@@ -351,6 +351,36 @@ try {
     { cwd: consumer },
   );
 
+  await cp(
+    join(packageRoot, "scripts", "fixtures", "package-consumer.ts"),
+    join(consumer, "consumer.ts"),
+  );
+  await writeFile(
+    join(consumer, "tsconfig.json"),
+    JSON.stringify({
+      files: ["consumer.ts"],
+      compilerOptions: {
+        target: "ES2022",
+        lib: ["ESNext"],
+        module: "NodeNext",
+        moduleResolution: "NodeNext",
+        strict: true,
+        noEmit: true,
+        types: ["node"],
+        typeRoots: [join(packageRoot, "node_modules", "@types")],
+      },
+    }),
+  );
+  run(
+    process.execPath,
+    [
+      join(packageRoot, "node_modules", "typescript", "bin", "tsc"),
+      "--project",
+      join(consumer, "tsconfig.json"),
+    ],
+    { cwd: consumer },
+  );
+
   assert.equal(
     typeof installedManifest.bin?.["codex-security"],
     "string",
@@ -496,7 +526,7 @@ try {
   await smokeNestedDeepScanWorker(installedRoot, consumer);
 
   console.log(
-    `Validated installed ${packageManifest.name}@${packageManifest.version}: public import, CLI, ${expectedPluginFiles.length} bundled plugin files, bundled Codex version, and a nested worker without global codex.`,
+    `Validated installed ${packageManifest.name}@${packageManifest.version}: public import, NodeNext types, CLI, ${expectedPluginFiles.length} bundled plugin files, bundled Codex version, and a nested worker without global codex.`,
   );
 } finally {
   await rm(consumer, {
diff --git a/sdk/typescript/tsconfig.build.json b/sdk/typescript/tsconfig.build.json
index ccf7d2ecb..cf223fc5e 100644
--- a/sdk/typescript/tsconfig.build.json
+++ b/sdk/typescript/tsconfig.build.json
@@ -7,6 +7,7 @@
     "outDir": "dist",
     "declaration": true,
     "declarationMap": true,
+    "stripInternal": true,
     "sourceMap": true,
     "inlineSources": true,
     "noEmit": false,

From 496bc455b502960346728659e5d0481974afc5b8 Mon Sep 17 00:00:00 2001
From: Michael D'Angelo <mdangelo@openai.com>
Date: Mon, 17 Aug 2026 12:33:34 -0700
Subject: [PATCH 2/3] test: make the hidden constructor assertion sensitive to
 arity

---
 sdk/typescript/scripts/fixtures/package-consumer.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk/typescript/scripts/fixtures/package-consumer.ts b/sdk/typescript/scripts/fixtures/package-consumer.ts
index dc17741c9..5b40df370 100644
--- a/sdk/typescript/scripts/fixtures/package-consumer.ts
+++ b/sdk/typescript/scripts/fixtures/package-consumer.ts
@@ -30,4 +30,4 @@ export const cost: ScanCost | null = estimateScanCost("gpt-5.6-sol", {
 });
 
 // @ts-expect-error Dependency injection is internal, not a public constructor overload.
-new CodexSecurity({}, {}, { surface: "sdk" });
+new CodexSecurity({}, undefined as never, { surface: "sdk" });

From b178a833ca2edcf5093bfecff54c268cffe7610a Mon Sep 17 00:00:00 2001
From: mldangelo-oai <269034524+mldangelo-oai@users.noreply.github.com>
Date: Mon, 17 Aug 2026 16:12:36 -0700
Subject: [PATCH 3/3] fix(sdk): keep scan event internals out of declarations

---
 sdk/typescript/src/api.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sdk/typescript/src/api.ts b/sdk/typescript/src/api.ts
index a498b213b..3ada669f8 100644
--- a/sdk/typescript/src/api.ts
+++ b/sdk/typescript/src/api.ts
@@ -2232,6 +2232,7 @@ interface ScanEventRunOptions {
   onObserverError?: (observer: ScanObserverName, error: unknown) => void;
 }
 
+/** @internal */
 export async function runScanEvents(
   options: ScanEventRunOptions,
 ): Promise<ScanResult> {