@independo/inderun-web 0.3.0-dev.1 → 0.3.0-dev.10

package/dist/index.d.ts

@@ -1,12 +1,13 @@
-export { type ConnectivityService, type DeviceConstraintsService, type SecureStorageService, type ClockService, type HttpClientService, type HttpRequest, type HttpResponse, type HostServices, type ThermalState } from "./core/host.js";
-export { type ProviderDescriptor, type ProviderDynamicCapabilities, type ProviderCapabilitySnapshot, type RunContext, type ProviderAdapter } from "./core/provider.js";
+export { type AbortSignalLike, type ConnectivityService, type DeviceConstraintsService, type SecureStorageService, type ClockService, type HttpClientService, type HttpRequest, type HttpResponse, type HttpStreamResponse, type HttpStreamingClientService, type HostServices, type ThermalState } from "./core/host.js";
+export { type ProviderDescriptor, type ProviderDynamicCapabilities, type ProviderCapabilitySnapshot, type RunContext, type ProviderAdapter, type ProviderStreamContext, type ProviderStreamEvent, type StreamRun } from "./core/provider.js";
+export { EventGate } from "./core/event-gate.js";
 export { ProviderRegistry } from "./core/registry.js";
 export { type RouteSelection, Router } from "./core/router.js";
 export { type RoutePlanner, type PlannerOutcome, type WasmUnavailableReason, type SharedPlannerInput, type SharedPlannerRoutePlan, WasmRoutePlanner } from "./core/route-planner.js";
 export { type IndeRunExceptionParams, IndeRunException, createCapabilityMismatch, createOffline, createAuthError, createRateLimited, createTimeout, createUnavailable, createInternal, toIndeRunException } from "./core/errors.js";
-export { IndeRun } from "./core/engine.js";
+export { IndeRun, type StreamHandleResult } from "./core/engine.js";
 export type { IndeRunApi } from "./core/generated/inderun-api.js";
 export { type TelemetryEventType, type TelemetryEvent, type TelemetryService, NoOpTelemetryService } from "./core/telemetry.js";
-export { BrowserConnectivityService, FetchHttpClient, SystemClockService, createBrowserHostServices, type CreateBrowserHostServicesOptions, type FetchHttpClientOptions } from "./core/browser-host.js";
+export { BrowserConnectivityService, FetchHttpClient, FetchStreamingHttpClient, SystemClockService, createBrowserHostServices, type CreateBrowserHostServicesOptions, type FetchHttpClientOptions } from "./core/browser-host.js";
 export { createIndeRunWeb, type CreateIndeRunWebOptions } from "./web-sdk.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,YAAY,EAClB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,KAAK,UAAU,EACf,KAAK,eAAe,EACrB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,gBAAgB,EACjB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,KAAK,sBAAsB,EAC3B,gBAAgB,EAChB,wBAAwB,EACxB,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EACnB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,YAAY,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAElE,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,oBAAoB,EACrB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,0BAA0B,EAC1B,eAAe,EACf,kBAAkB,EAClB,yBAAyB,EACzB,KAAK,gCAAgC,EACrC,KAAK,sBAAsB,EAC5B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,gBAAgB,EAAE,KAAK,uBAAuB,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,EAC/B,KAAK,YAAY,EACjB,KAAK,YAAY,EAClB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,SAAS,EACf,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,gBAAgB,EACjB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,KAAK,sBAAsB,EAC3B,gBAAgB,EAChB,wBAAwB,EACxB,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EACnB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACpE,YAAY,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAElE,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,oBAAoB,EACrB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,0BAA0B,EAC1B,eAAe,EACf,wBAAwB,EACxB,kBAAkB,EAClB,yBAAyB,EACzB,KAAK,gCAAgC,EACrC,KAAK,sBAAsB,EAC5B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,gBAAgB,EAAE,KAAK,uBAAuB,EAAE,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -1,12 +1,13 @@
 export {} from "./core/host.js";
 export {} from "./core/provider.js";
+export { EventGate } from "./core/event-gate.js";
 export { ProviderRegistry } from "./core/registry.js";
 export { Router } from "./core/router.js";
 export { WasmRoutePlanner } from "./core/route-planner.js";
 export { IndeRunException, createCapabilityMismatch, createOffline, createAuthError, createRateLimited, createTimeout, createUnavailable, createInternal, toIndeRunException } from "./core/errors.js";
 export { IndeRun } from "./core/engine.js";
 export { NoOpTelemetryService } from "./core/telemetry.js";
-export { BrowserConnectivityService, FetchHttpClient, SystemClockService, createBrowserHostServices } from "./core/browser-host.js";
+export { BrowserConnectivityService, FetchHttpClient, FetchStreamingHttpClient, SystemClockService, createBrowserHostServices } from "./core/browser-host.js";
 export { createIndeRunWeb } from "./web-sdk.js";
 // The OpenAI Responses adapter is provider-specific and intentionally excluded
 // from this unified index. Import it from "@independo/inderun-web/openai".

package/dist/providers/openai/provider.d.ts

@@ -1,6 +1,6 @@
 import type { TaskRequest, TaskResult } from "@independo/inderun-contracts";
 import type { HostServices } from "../../core/host.js";
-import type { ProviderAdapter, ProviderDescriptor, ProviderDynamicCapabilities, RunContext } from "../../core/provider.js";
+import type { ProviderAdapter, ProviderDescriptor, ProviderDynamicCapabilities, ProviderStreamContext, ProviderStreamEvent, RunContext } from "../../core/provider.js";
 export declare const DEFAULT_OPENAI_RESPONSES_ENDPOINT = "https://api.openai.com/v1/responses";
 /**
  * Configuration for the OpenAI Responses provider.
@@ -84,6 +84,49 @@ export declare class OpenAIResponsesProvider implements ProviderAdapter {
      * @throws IndeRunException mapped to the standard error taxonomy.
      */
     run(request: TaskRequest, context: RunContext): Promise<TaskResult>;
+    /**
+     * Executes a normalized text-to-text task in Mode 2 against the OpenAI
+     * Responses API's server-sent event stream.
+     *
+     * The request is the Mode 1 body plus `"stream": true`, so both modes stay a
+     * single code path up to the transport. The response head is classified
+     * before the body is read: a non-2xx is drained to text and run through the
+     * same `mapHttpError` as Mode 1, because a 429 must surface as RateLimited
+     * rather than as a malformed event stream.
+     *
+     * Event mapping, from the Responses API's typed SSE events to the canonical
+     * provider vocabulary:
+     *
+     * - `response.output_text.delta` becomes a delta;
+     * - `response.completed` and `response.incomplete` become the terminal done,
+     *   with `finalText`, `usage`, and `finishReason` read off the embedded
+     *   response object by the same helpers Mode 1 uses — it has the same shape;
+     * - `response.failed` and `error` become a terminal error;
+     * - every other event type is ignored, since the set is open and additive.
+     *
+     * @param request - Canonical IndeRun task request.
+     * @param context - Engine stream context: run id, host services, abort signal.
+     */
+    stream(request: TaskRequest, context: ProviderStreamContext): AsyncGenerator<ProviderStreamEvent>;
+    /**
+     * Maps a `response.failed` / `error` stream event onto the error taxonomy.
+     * These arrive over an HTTP 200 body, so there is no status code to classify
+     * from; OpenAI reports rate limiting and auth failures here with the same
+     * `code` values it uses in unary error bodies.
+     *
+     * Two payload shapes exist and both are accepted: the standalone `error`
+     * event carries `code`/`message` at its root, while `response.failed` nests
+     * them under `response.error`. The root `type` is the event name rather than
+     * an error type, so it is never read as one.
+     */
+    private mapStreamError;
+    /**
+     * Resolves the request headers, including the bearer token behind
+     * `authContextRef`. Shared by `run` and `stream`: the credential never travels
+     * in the request payload, only the slot id does, so both modes must resolve it
+     * the same way.
+     */
+    private resolveHeaders;
     private createRequestBody;
     /**
      * Maps an OpenAI HTTP error response onto the IndeRun error taxonomy:

package/dist/providers/openai/provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../../src/providers/openai/provider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAQ5E,OAAO,KAAK,EAAE,YAAY,EAAe,MAAM,oBAAoB,CAAC;AACpE,OAAO,KAAK,EACV,eAAe,EACf,kBAAkB,EAClB,2BAA2B,EAC3B,UAAU,EACX,MAAM,wBAAwB,CAAC;AAEhC,eAAO,MAAM,iCAAiC,wCAAwC,CAAC;AAKvF;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,IAAI,CAAC,EAAE,gBAAgB,GAAG,MAAM,CAAC;IACjC;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAwBD;;;;;;GAMG;AACH,qBAAa,uBAAwB,YAAW,eAAe;IAUjD,OAAO,CAAC,QAAQ,CAAC,OAAO;IATpC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAS;IAC5B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA4B;IACjD,OAAO,CAAC,YAAY,CAAC,CAA6D;IAElF;;;OAGG;gBAC0B,OAAO,EAAE,qBAAqB;IAM3D;;OAEG;IACH,QAAQ,IAAI,kBAAkB;IAsB9B;;;;;;;;OAQG;IACG,YAAY,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,2BAA2B,CAAC;YAkB9D,sBAAsB;IAuCpC;;;;;;OAMG;IACG,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAkHzE,OAAO,CAAC,iBAAiB;IAuBzB;;;;;;;OAOG;IACH,OAAO,CAAC,YAAY;CAmErB"}
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../../src/providers/openai/provider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAQ5E,OAAO,KAAK,EAAE,YAAY,EAAe,MAAM,oBAAoB,CAAC;AACpE,OAAO,KAAK,EACV,eAAe,EACf,kBAAkB,EAClB,2BAA2B,EAC3B,qBAAqB,EACrB,mBAAmB,EACnB,UAAU,EACX,MAAM,wBAAwB,CAAC;AA4BhC,eAAO,MAAM,iCAAiC,wCAAwC,CAAC;AAKvF;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,IAAI,CAAC,EAAE,gBAAgB,GAAG,MAAM,CAAC;IACjC;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AA6BD;;;;;;GAMG;AACH,qBAAa,uBAAwB,YAAW,eAAe;IAUjD,OAAO,CAAC,QAAQ,CAAC,OAAO;IATpC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAS;IAC5B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA4B;IACjD,OAAO,CAAC,YAAY,CAAC,CAA6D;IAElF;;;OAGG;gBAC0B,OAAO,EAAE,qBAAqB;IAM3D;;OAEG;IACH,QAAQ,IAAI,kBAAkB;IAuB9B;;;;;;;;OAQG;IACG,YAAY,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,2BAA2B,CAAC;YA+B9D,sBAAsB;IAuCpC;;;;;;OAMG;IACG,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAiFzE;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACI,MAAM,CACX,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,qBAAqB,GAC7B,cAAc,CAAC,mBAAmB,CAAC;IAiGtC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,cAAc;IAmBtB;;;;;OAKG;YACW,cAAc;IA2C5B,OAAO,CAAC,iBAAiB;IA2BzB;;;;;;;OAOG;IACH,OAAO,CAAC,YAAY;CAmErB"}

package/dist/providers/openai/provider.js

@@ -1,4 +1,14 @@
 import { createAuthError, createInternal, createRateLimited, createTimeout, createUnavailable } from "../../core/errors.js";
+import { parseSseStream } from "../../core/sse.js";
+/** Buffers a body stream to text, for error responses that are not event streams. */
+async function drainToText(body) {
+    const decoder = new TextDecoder();
+    let text = "";
+    for await (const chunk of body) {
+        text += decoder.decode(chunk, { stream: true });
+    }
+    return text + decoder.decode();
+}
 export const DEFAULT_OPENAI_RESPONSES_ENDPOINT = "https://api.openai.com/v1/responses";
 const DEFAULT_HEALTH_CHECK_TIMEOUT_MS = 3000;
 const DEFAULT_HEALTH_CHECK_CACHE_MS = 5000;
@@ -33,9 +43,10 @@ export class OpenAIResponsesProvider {
             id: this.id,
             type: "cloud",
             transport: "http",
+            streamingStyle: "tokens",
             supports: {
                 run: true,
-                streaming: false,
+                streaming: true,
                 realtime: false,
                 tools: false,
                 reasoningEvents: false,
@@ -71,7 +82,18 @@ export class OpenAIResponsesProvider {
                 reason: "OpenAI Responses provider requires a SecureStorageService when auth is enabled."
             };
         }
-        return this.checkEndpointReachable(host.httpClient, host.clock);
+        const reachability = await this.checkEndpointReachable(host.httpClient, host.clock);
+        if (host.streamingHttpClient) {
+            return reachability;
+        }
+        // Mode 1 still works without it; only streaming is taken away, and the
+        // planner turns this into an inspectable `streaming_unavailable` rejection
+        // rather than an unexplained routing failure.
+        return {
+            ...reachability,
+            streamingAvailable: false,
+            streamingUnavailableReason: "Host does not provide an HttpStreamingClientService, which OpenAI streaming requires."
+        };
     }
     async checkEndpointReachable(httpClient, clock) {
         const now = clock ? clock.now() : Date.now();
@@ -120,33 +142,7 @@ export class OpenAIResponsesProvider {
                 runId: context.runId
             });
         }
-        const headers = {
-            "Content-Type": "application/json"
-        };
-        if (this.auth === "authContextRef") {
-            const slotId = request.authContextRef ?? this.options.authContextRef;
-            if (!slotId) {
-                throw createAuthError("OpenAI Responses provider requires authContextRef.", {
-                    providerId: this.id,
-                    runId: context.runId
-                });
-            }
-            const secureStorage = context.hostServices.secureStorage;
-            if (!secureStorage) {
-                throw createAuthError("OpenAI Responses provider requires a SecureStorageService when auth is enabled.", {
-                    providerId: this.id,
-                    runId: context.runId
-                });
-            }
-            const secret = await secureStorage.getSecret(slotId);
-            if (!secret) {
-                throw createAuthError(`No OpenAI credential found for authContextRef '${slotId}'.`, {
-                    providerId: this.id,
-                    runId: context.runId
-                });
-            }
-            headers.Authorization = `Bearer ${secret}`;
-        }
+        const headers = await this.resolveHeaders(request, context);
         let response;
         try {
             const httpRequest = {
@@ -203,11 +199,177 @@ export class OpenAIResponsesProvider {
         }
         return result;
     }
-    createRequestBody(request) {
+    /**
+     * Executes a normalized text-to-text task in Mode 2 against the OpenAI
+     * Responses API's server-sent event stream.
+     *
+     * The request is the Mode 1 body plus `"stream": true`, so both modes stay a
+     * single code path up to the transport. The response head is classified
+     * before the body is read: a non-2xx is drained to text and run through the
+     * same `mapHttpError` as Mode 1, because a 429 must surface as RateLimited
+     * rather than as a malformed event stream.
+     *
+     * Event mapping, from the Responses API's typed SSE events to the canonical
+     * provider vocabulary:
+     *
+     * - `response.output_text.delta` becomes a delta;
+     * - `response.completed` and `response.incomplete` become the terminal done,
+     *   with `finalText`, `usage`, and `finishReason` read off the embedded
+     *   response object by the same helpers Mode 1 uses — it has the same shape;
+     * - `response.failed` and `error` become a terminal error;
+     * - every other event type is ignored, since the set is open and additive.
+     *
+     * @param request - Canonical IndeRun task request.
+     * @param context - Engine stream context: run id, host services, abort signal.
+     */
+    async *stream(request, context) {
+        const streamingClient = context.hostServices.streamingHttpClient;
+        if (!streamingClient) {
+            throw createUnavailable("OpenAI Responses streaming requires an HttpStreamingClientService.", {
+                providerId: this.id,
+                runId: context.runId
+            });
+        }
+        const headers = await this.resolveHeaders(request, context);
+        headers.Accept = "text/event-stream";
+        let response;
+        try {
+            const httpRequest = {
+                method: "POST",
+                url: this.endpointUrl,
+                headers,
+                body: JSON.stringify(this.createRequestBody(request, true))
+            };
+            if (this.options.timeoutMs !== undefined) {
+                httpRequest.timeoutMs = this.options.timeoutMs;
+            }
+            response = await streamingClient.stream(httpRequest, context.signal);
+        }
+        catch (err) {
+            if (isAbortError(err)) {
+                throw createTimeout("OpenAI Responses stream timed out before the first byte.", {
+                    providerId: this.id,
+                    runId: context.runId
+                });
+            }
+            throw createUnavailable("OpenAI Responses stream failed before a response was received.", {
+                providerId: this.id,
+                runId: context.runId,
+                details: { originalError: getErrorSummary(err) }
+            });
+        }
+        if (response.status < 200 || response.status >= 300) {
+            throw this.mapHttpError(response.status, response.statusText, response.headers, await drainToText(response.body), context);
+        }
+        for await (const sseEvent of parseSseStream(response.body)) {
+            if (sseEvent.data === "[DONE]") {
+                continue;
+            }
+            const parsed = parseJson(sseEvent.data);
+            // The `event:` line and the payload's own `type` carry the same value;
+            // prefer the payload so a proxy that drops event names still works.
+            const type = parsed.type ?? sseEvent.event;
+            if (type === "response.output_text.delta") {
+                if (parsed.delta) {
+                    yield { kind: "delta", text: parsed.delta };
+                }
+                continue;
+            }
+            if (type === "response.completed" || type === "response.incomplete") {
+                const body = parsed.response ?? {};
+                const done = {
+                    kind: "done",
+                    finalText: extractOutputText(body) ?? "",
+                    finishReason: getFinishReason(body)
+                };
+                const usage = getUsage(body);
+                if (usage) {
+                    done.usage = usage;
+                }
+                yield done;
+                return;
+            }
+            if (type === "response.failed" || type === "error") {
+                yield { kind: "error", error: this.mapStreamError(parsed, context) };
+                return;
+            }
+        }
+        // Falling out of the loop means the stream ended without a terminal event.
+        // The engine reports that as a provider fault; inventing a completion from
+        // whatever deltas happened to arrive would hide a truncated response.
+    }
+    /**
+     * Maps a `response.failed` / `error` stream event onto the error taxonomy.
+     * These arrive over an HTTP 200 body, so there is no status code to classify
+     * from; OpenAI reports rate limiting and auth failures here with the same
+     * `code` values it uses in unary error bodies.
+     *
+     * Two payload shapes exist and both are accepted: the standalone `error`
+     * event carries `code`/`message` at its root, while `response.failed` nests
+     * them under `response.error`. The root `type` is the event name rather than
+     * an error type, so it is never read as one.
+     */
+    mapStreamError(event, context) {
+        const nested = event.error ?? event.response?.error;
+        const message = nested?.message ?? event.message ?? "OpenAI Responses stream reported a failure.";
+        const code = nested?.code ?? event.code;
+        const details = { errorType: nested?.type, errorCode: code };
+        const params = { providerId: this.id, runId: context.runId, details };
+        switch (code) {
+            case "rate_limit_exceeded":
+                return createRateLimited(message, { ...params, retryable: true });
+            case "invalid_api_key":
+            case "authentication_error":
+                return createAuthError(message, params);
+            default:
+                return createUnavailable(message, { ...params, retryable: true });
+        }
+    }
+    /**
+     * Resolves the request headers, including the bearer token behind
+     * `authContextRef`. Shared by `run` and `stream`: the credential never travels
+     * in the request payload, only the slot id does, so both modes must resolve it
+     * the same way.
+     */
+    async resolveHeaders(request, context) {
+        const headers = {
+            "Content-Type": "application/json"
+        };
+        if (this.auth !== "authContextRef") {
+            return headers;
+        }
+        const slotId = request.authContextRef ?? this.options.authContextRef;
+        if (!slotId) {
+            throw createAuthError("OpenAI Responses provider requires authContextRef.", {
+                providerId: this.id,
+                runId: context.runId
+            });
+        }
+        const secureStorage = context.hostServices.secureStorage;
+        if (!secureStorage) {
+            throw createAuthError("OpenAI Responses provider requires a SecureStorageService when auth is enabled.", {
+                providerId: this.id,
+                runId: context.runId
+            });
+        }
+        const secret = await secureStorage.getSecret(slotId);
+        if (!secret) {
+            throw createAuthError(`No OpenAI credential found for authContextRef '${slotId}'.`, {
+                providerId: this.id,
+                runId: context.runId
+            });
+        }
+        headers.Authorization = `Bearer ${secret}`;
+        return headers;
+    }
+    createRequestBody(request, stream = false) {
         const body = {
             model: this.options.model,
             input: createInput(request)
         };
+        if (stream) {
+            body.stream = true;
+        }
         const generation = request.generation;
         if (generation?.maxOutputTokens !== undefined) {
             body.max_output_tokens = generation.maxOutputTokens;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@independo/inderun-web",
-  "version": "0.3.0-dev.1",
+  "version": "0.3.0-dev.10",
   "description": "TypeScript/Web SDK for IndeRun.",
   "license": "MIT",
   "author": {
@@ -55,8 +55,8 @@
     "README.md"
   ],
   "dependencies": {
-    "@independo/inderun-route-core-wasm": "^0.3.0-dev.1",
-    "@independo/inderun-contracts": "^0.3.0-dev.1"
+    "@independo/inderun-contracts": "^0.3.0-dev.10",
+    "@independo/inderun-route-core-wasm": "^0.3.0-dev.10"
   },
   "peerDependencies": {
     "@huggingface/transformers": "^4.0.0"
@@ -69,7 +69,7 @@
   "devDependencies": {
     "@types/node": "^26.2.0",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",