@independo/inderun-web 0.3.0-dev.5 → 0.3.0-dev.6

package/README.md

@@ -30,10 +30,49 @@ const result = await inderun.run({
 });
 ```
 
+## Streaming
+
+`stream()` returns the run handle, its canonical `StreamEvent` sequence, and a `cancel()` hook:
+
+```ts
+const { handle, events, cancel } = await inderun.stream({
+  schemaVersion: "1.0",
+  task: { kind: "text_to_text" },
+  prompt: "Write a one-sentence summary of IndeRun."
+});
+
+for await (const event of events) {
+  if (event.type === "content_delta") process.stdout.write(event.payload.text);
+  if (event.type === "terminal") console.log(event.payload.outcome);
+}
+```
+
+Order by `event.sequence`, not by arrival: it is the ordering authority for a run. Treat an
+unrecognized `event.type` as ignore-or-pass-through — the set is open and additive. Exactly one
+`terminal` event is produced per run, and `cancel()` is idempotent.
+
+Streaming needs a host that can deliver a response body incrementally.
+`createBrowserHostServices` provides one; a custom host without a
+`streamingHttpClient` still runs Mode 1, and a stream request is refused at routing
+time with a `streaming_unavailable` reason rather than failing later.
+
+### Custom OpenAI-compatible endpoints
+
+The adapter speaks the OpenAI **Responses** API, not chat completions. A custom endpoint must
+accept `"stream": true` and emit `text/event-stream` with the Responses event types —
+`response.output_text.delta`, and `response.completed` / `response.incomplete` carrying the
+response object. Unknown event types are ignored, so an endpoint that emits extra events is
+fine; one that emits a different vocabulary entirely is not.
+
 ## Security Model
 
 Browser apps should use a proxy endpoint and keep provider credentials server-side. `createIndeRunWeb` rejects direct calls to the public OpenAI Responses endpoint unless `allowDirectOpenAIEndpoint: true` is set for a controlled environment.
 
+This applies to streaming too, and is the reason `@independo/inderun-demo-proxy` relays event
+streams rather than buffering them: a browser cannot open its own authenticated connection to
+OpenAI without shipping the key in client code. Never embed a developer-owned API key in
+distributed client code — put it behind a trusted backend proxy and point `endpointUrl` at that.
+
 ## Advanced: registering the OpenAI provider directly
 
 `createIndeRunWeb` wires the OpenAI Responses provider for you. To register it

package/dist/core/browser-host.d.ts

@@ -1,4 +1,4 @@
-import type { ClockService, ConnectivityService, HostServices, HttpClientService, HttpRequest, HttpResponse } from "./host.js";
+import type { ClockService, ConnectivityService, HostServices, HttpClientService, HttpRequest, HttpResponse, HttpStreamResponse, HttpStreamingClientService } from "./host.js";
 /**
  * Configuration for the fetch-backed HTTP host service.
  */
@@ -49,12 +49,39 @@ export declare class FetchHttpClient implements HttpClientService {
      */
     send(request: HttpRequest): Promise<HttpResponse>;
 }
+/**
+ * Streaming HTTP client service that adapts `fetch` to IndeRun's incremental
+ * HTTP contract by handing back `Response.body` rather than buffering it.
+ *
+ * Two abort sources are merged onto one controller: `timeoutMs`, which bounds
+ * only the wait for the response head, and the caller's `signal`, which stays
+ * live for the whole body. The timeout timer is therefore cleared as soon as
+ * the head resolves — a stream that legitimately stays open for minutes must
+ * not be killed by a time-to-first-byte budget.
+ */
+export declare class FetchStreamingHttpClient implements HttpStreamingClientService {
+    private readonly fetchFn;
+    /**
+     * Creates a fetch-backed streaming HTTP client.
+     * @param options - Optional fetch implementation override.
+     * @throws Error when no fetch implementation is available.
+     */
+    constructor(options?: FetchHttpClientOptions);
+    /**
+     * Sends a normalized HTTP request and resolves once the response head is available.
+     * @param request - Normalized HTTP request payload.
+     * @param signal - Optional caller-driven cancellation covering the whole response.
+     * @returns Response head plus a lazily-consumed body chunk sequence.
+     */
+    stream(request: HttpRequest, signal?: AbortSignal): Promise<HttpStreamResponse>;
+}
 /**
  * Options for constructing default browser host services.
  */
 export interface CreateBrowserHostServicesOptions extends Partial<HostServices> {
     /**
-     * Optional fetch implementation used when `httpClient` is not supplied.
+     * Optional fetch implementation used when `httpClient`/`streamingHttpClient`
+     * are not supplied.
      */
     fetchFn?: typeof fetch;
 }

package/dist/core/browser-host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"browser-host.d.ts","sourceRoot":"","sources":["../../src/core/browser-host.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,YAAY,EACZ,mBAAmB,EACnB,YAAY,EACZ,iBAAiB,EACjB,WAAW,EACX,YAAY,EACb,MAAM,WAAW,CAAC;AAEnB;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB;AAED;;GAEG;AACH,qBAAa,0BAA2B,YAAW,mBAAmB;IACpE;;;OAGG;IACG,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC;CAOnC;AAED;;GAEG;AACH,qBAAa,kBAAmB,YAAW,YAAY;IACrD;;OAEG;IACH,GAAG,IAAI,MAAM;IAIb;;OAEG;IACH,YAAY,IAAI,MAAM;CAOvB;AAED;;GAEG;AACH,qBAAa,eAAgB,YAAW,iBAAiB;IACvD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IAEvC;;;;OAIG;gBACS,OAAO,GAAE,sBAA2B;IAShD;;;;OAIG;IACG,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC;CA0CxD;AAED;;GAEG;AACH,MAAM,WAAW,gCAAiC,SAAQ,OAAO,CAAC,YAAY,CAAC;IAC7E;;OAEG;IACH,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,GAAE,gCAAqC,GAC7C,YAAY,CA2Bd"}
+{"version":3,"file":"browser-host.d.ts","sourceRoot":"","sources":["../../src/core/browser-host.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,YAAY,EACZ,mBAAmB,EACnB,YAAY,EACZ,iBAAiB,EACjB,WAAW,EACX,YAAY,EACZ,kBAAkB,EAClB,0BAA0B,EAC3B,MAAM,WAAW,CAAC;AAEnB;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB;AAED;;GAEG;AACH,qBAAa,0BAA2B,YAAW,mBAAmB;IACpE;;;OAGG;IACG,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC;CAOnC;AAED;;GAEG;AACH,qBAAa,kBAAmB,YAAW,YAAY;IACrD;;OAEG;IACH,GAAG,IAAI,MAAM;IAIb;;OAEG;IACH,YAAY,IAAI,MAAM;CAOvB;AAED;;GAEG;AACH,qBAAa,eAAgB,YAAW,iBAAiB;IACvD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IAEvC;;;;OAIG;gBACS,OAAO,GAAE,sBAA2B;IAShD;;;;OAIG;IACG,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC;CA0CxD;AAED;;;;;;;;;GASG;AACH,qBAAa,wBAAyB,YAAW,0BAA0B;IACzE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IAEvC;;;;OAIG;gBACS,OAAO,GAAE,sBAA2B;IAShD;;;;;OAKG;IACG,MAAM,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,kBAAkB,CAAC;CAwHtF;AAED;;GAEG;AACH,MAAM,WAAW,gCAAiC,SAAQ,OAAO,CAAC,YAAY,CAAC;IAC7E;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,GAAE,gCAAqC,GAC7C,YAAY,CAmCd"}

package/dist/core/browser-host.js

@@ -93,6 +93,154 @@ export class FetchHttpClient {
         }
     }
 }
+/**
+ * Streaming HTTP client service that adapts `fetch` to IndeRun's incremental
+ * HTTP contract by handing back `Response.body` rather than buffering it.
+ *
+ * Two abort sources are merged onto one controller: `timeoutMs`, which bounds
+ * only the wait for the response head, and the caller's `signal`, which stays
+ * live for the whole body. The timeout timer is therefore cleared as soon as
+ * the head resolves — a stream that legitimately stays open for minutes must
+ * not be killed by a time-to-first-byte budget.
+ */
+export class FetchStreamingHttpClient {
+    fetchFn;
+    /**
+     * Creates a fetch-backed streaming HTTP client.
+     * @param options - Optional fetch implementation override.
+     * @throws Error when no fetch implementation is available.
+     */
+    constructor(options = {}) {
+        const fetchFn = options.fetchFn ?? globalThis.fetch?.bind(globalThis);
+        if (!fetchFn) {
+            throw new Error("FetchStreamingHttpClient requires a fetch implementation.");
+        }
+        this.fetchFn = fetchFn;
+    }
+    /**
+     * Sends a normalized HTTP request and resolves once the response head is available.
+     * @param request - Normalized HTTP request payload.
+     * @param signal - Optional caller-driven cancellation covering the whole response.
+     * @returns Response head plus a lazily-consumed body chunk sequence.
+     */
+    async stream(request, signal) {
+        const controller = typeof AbortController === "undefined" ? undefined : new AbortController();
+        let timeoutId;
+        let onAbort;
+        if (controller) {
+            if (request.timeoutMs !== undefined) {
+                timeoutId = setTimeout(() => controller.abort(), request.timeoutMs);
+            }
+            if (signal) {
+                if (signal.aborted) {
+                    controller.abort();
+                }
+                else {
+                    onAbort = () => controller.abort();
+                    signal.addEventListener("abort", onAbort, { once: true });
+                }
+            }
+        }
+        const clearTimeoutTimer = () => {
+            if (timeoutId !== undefined) {
+                clearTimeout(timeoutId);
+                timeoutId = undefined;
+            }
+        };
+        const releaseAbortListener = () => {
+            if (signal && onAbort) {
+                signal.removeEventListener("abort", onAbort);
+                onAbort = undefined;
+            }
+        };
+        let response;
+        try {
+            const init = { method: request.method };
+            if (request.headers) {
+                init.headers = request.headers;
+            }
+            if (request.body !== undefined) {
+                init.body = request.body;
+            }
+            if (controller) {
+                init.signal = controller.signal;
+            }
+            response = await this.fetchFn(request.url, init);
+        }
+        catch (error) {
+            clearTimeoutTimer();
+            releaseAbortListener();
+            throw error;
+        }
+        clearTimeoutTimer();
+        const headers = {};
+        response.headers.forEach((value, key) => {
+            headers[key.toLowerCase()] = value;
+        });
+        const stream = response.body;
+        async function* iterate() {
+            try {
+                if (!stream) {
+                    // A bodyless response (204, HEAD) or a fetch polyfill without stream
+                    // support: fall back to the buffered text so callers still terminate.
+                    const text = await response.text();
+                    if (text.length > 0) {
+                        yield new TextEncoder().encode(text);
+                    }
+                    return;
+                }
+                const reader = stream.getReader();
+                // The body is also raced against `signal` directly, not just against the
+                // fetch-level abort: a fetch implementation is free not to error an
+                // in-flight body when its request signal fires, and the caller's
+                // cancellation guarantee must not depend on that.
+                let onBodyAbort;
+                const aborted = new Promise((_resolve, reject) => {
+                    if (!signal)
+                        return;
+                    onBodyAbort = () => reject(Object.assign(new Error("The stream was aborted."), { name: "AbortError" }));
+                    if (signal.aborted) {
+                        onBodyAbort();
+                    }
+                    else {
+                        signal.addEventListener("abort", onBodyAbort, { once: true });
+                    }
+                });
+                // Keeps an abort that arrives after the body finished from surfacing as
+                // an unhandled rejection; the race below still observes it.
+                void aborted.catch(() => undefined);
+                try {
+                    for (;;) {
+                        const { done, value } = await Promise.race([reader.read(), aborted]);
+                        if (done)
+                            return;
+                        if (value)
+                            yield value;
+                    }
+                }
+                catch (error) {
+                    await reader.cancel().catch(() => undefined);
+                    throw error;
+                }
+                finally {
+                    if (signal && onBodyAbort) {
+                        signal.removeEventListener("abort", onBodyAbort);
+                    }
+                    reader.releaseLock();
+                }
+            }
+            finally {
+                releaseAbortListener();
+            }
+        }
+        return {
+            status: response.status,
+            statusText: response.statusText,
+            headers,
+            body: iterate()
+        };
+    }
+}
 /**
  * Creates a browser-oriented HostServices bundle for the Web SDK.
  * Supplied host services override the defaults; missing connectivity, clock, and HTTP services are created.
@@ -112,6 +260,15 @@ export function createBrowserHostServices(options = {}) {
     else {
         hostServices.httpClient = new FetchHttpClient();
     }
+    if (options.streamingHttpClient) {
+        hostServices.streamingHttpClient = options.streamingHttpClient;
+    }
+    else if (options.fetchFn) {
+        hostServices.streamingHttpClient = new FetchStreamingHttpClient({ fetchFn: options.fetchFn });
+    }
+    else {
+        hostServices.streamingHttpClient = new FetchStreamingHttpClient();
+    }
     if (options.deviceConstraints) {
         hostServices.deviceConstraints = options.deviceConstraints;
     }

package/dist/core/engine.d.ts

@@ -1,20 +1,15 @@
-import { type StreamEvent, type StreamRunHandle, type TaskRequest, type TaskResult } from "@independo/inderun-contracts";
+import { type TaskRequest, type TaskResult } from "@independo/inderun-contracts";
 import type { HostServices } from "./host.js";
-import type { ProviderCapabilitySnapshot } from "./provider.js";
+import type { ProviderCapabilitySnapshot, StreamRun } from "./provider.js";
 import type { IndeRunApi } from "./generated/inderun-api.js";
 import { ProviderRegistry } from "./registry.js";
 import { type TelemetryService } from "./telemetry.js";
 /**
- * Handle returned by IndeRun.stream(). `events` is the canonical StreamEvent
- * sequence for this run, terminating in exactly one terminal StreamEvent per the
- * Event Gate's guarantee. `cancel()` is idempotent: repeated or concurrent calls
- * produce exactly one `cancelled` terminal outcome.
+ * @deprecated Renamed to `StreamRun`, which is the name the generated
+ * `IndeRunApi` surface and the Swift/Kotlin SDKs use. Kept as an alias so the
+ * rename is not a breaking change.
  */
-export interface StreamHandleResult {
-    handle: StreamRunHandle;
-    events: AsyncIterable<StreamEvent>;
-    cancel(reason?: string): void;
-}
+export type StreamHandleResult = StreamRun;
 /**
  * Main orchestrator SDK entrypoint class.
  * Validates tasks, executes routing rules based on request constraints and connectivity,
@@ -69,7 +64,7 @@ export declare class IndeRun implements IndeRunApi {
      * @param request - The canonical task request containing prompts, tasks, and constraints.
      * @throws {IndeRunException} If validation fails or no eligible streaming provider exists.
      */
-    stream(request: TaskRequest): Promise<StreamHandleResult>;
+    stream(request: TaskRequest): Promise<StreamRun>;
     /**
      * Reports each registered provider's static descriptor and current dynamic capability check,
      * without executing a task. Useful for UI that shows live provider availability before a run.

package/dist/core/engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/core/engine.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,eAAe,EAEpB,KAAK,WAAW,EAChB,KAAK,UAAU,EAChB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,KAAK,EAAmB,0BAA0B,EAAE,MAAM,eAAe,CAAC;AACjF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAQjD,OAAO,EAAuB,KAAK,gBAAgB,EAAwB,MAAM,gBAAgB,CAAC;AAGlG;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,eAAe,CAAC;IACxB,MAAM,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IACnC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED;;;;GAIG;AACH,qBAAa,OAAQ,YAAW,UAAU;IAWtC,OAAO,CAAC,QAAQ;IAChB,OAAO,CAAC,YAAY;IAXtB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,gBAAgB,CAAmB;IAE3C;;;;;OAKG;gBAEO,QAAQ,EAAE,gBAAgB,EAC1B,YAAY,EAAE,YAAY,EAClC,gBAAgB,CAAC,EAAE,gBAAgB;IAOrC;;;OAGG;IACH,OAAO,CAAC,QAAQ;IAShB;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IAoBxB;;;;;;;OAOG;IACG,GAAG,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IAuIpD;;;;;;;;;;;;;;;;;OAiBG;IACG,MAAM,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA8Q/D;;;OAGG;IACG,iBAAiB,IAAI,OAAO,CAAC,0BAA0B,EAAE,CAAC;CASjE"}
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/core/engine.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,WAAW,EAChB,KAAK,UAAU,EAChB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,KAAK,EAAmB,0BAA0B,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC5F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAQjD,OAAO,EAAuB,KAAK,gBAAgB,EAAwB,MAAM,gBAAgB,CAAC;AAGlG;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,SAAS,CAAC;AAE3C;;;;GAIG;AACH,qBAAa,OAAQ,YAAW,UAAU;IAWtC,OAAO,CAAC,QAAQ;IAChB,OAAO,CAAC,YAAY;IAXtB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,gBAAgB,CAAmB;IAE3C;;;;;OAKG;gBAEO,QAAQ,EAAE,gBAAgB,EAC1B,YAAY,EAAE,YAAY,EAClC,gBAAgB,CAAC,EAAE,gBAAgB;IAOrC;;;OAGG;IACH,OAAO,CAAC,QAAQ;IAShB;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IAoBxB;;;;;;;OAOG;IACG,GAAG,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IAuIpD;;;;;;;;;;;;;;;;;OAiBG;IACG,MAAM,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC;IA+QtD;;;OAGG;IACG,iBAAiB,IAAI,OAAO,CAAC,0BAA0B,EAAE,CAAC;CASjE"}

package/dist/core/engine.js

@@ -335,6 +335,7 @@ export class IndeRun {
                             schemaVersion: "1.0",
                             finalText: ev.finalText,
                             telemetry: { providerUsed: providerId, totalMs: now() - startTime },
+                            ...(ev.finishReason !== undefined ? { finishReason: ev.finishReason } : {}),
                             ...(ev.usage !== undefined ? { usage: ev.usage } : {})
                         };
                         const terminal = gate.terminate(outcome, now());

package/dist/core/generated/inderun-api.d.ts

@@ -1,10 +1,14 @@
 import type { TaskRequest, TaskResult } from "@independo/inderun-contracts";
-import type { ProviderCapabilitySnapshot } from "../provider.js";
+import type { StreamRun, ProviderCapabilitySnapshot } from "../provider.js";
 export interface IndeRunApi {
     /**
      * Executes a Mode 1 (request/response) text-to-text task against a routed provider and returns the completed TaskResult. Routing (local vs. cloud, which provider) is decided internally from TaskRequest.constraints/preferences — the caller does not select a provider directly. Rejects the request up front on validation failure; otherwise throws an IndeRunException (carrying an IndeRunError) if no eligible provider is found or every attempted provider fails. There is no partial or streaming result in this mode: run() either resolves with a complete TaskResult or throws.
      */
     run(request: TaskRequest): Promise<TaskResult>;
+    /**
+     * Executes a Mode 2 (streaming) text-to-text task and returns a handle to the run, its canonical StreamEvent sequence, and a cancel hook. The requested interaction mode is a routing input rather than a filter applied after routing: providers that cannot stream are rejected during planning with a normalized reason, so a stream and a run over the same registry may legitimately resolve to different provider chains. Two failure surfaces exist deliberately — validation and route-selection failures reject this call, since there is no handle to correlate them with yet, while provider failure, cancellation, and completion all arrive as the single terminal StreamEvent in the returned sequence. Fallback is narrower than run()'s: a provider failure is only fallback-eligible before the first content event has been delivered; once one has, the run is committed to that provider and a later failure becomes a terminal error rather than a silent provider swap. Cancellation forecloses both at any commit state and always produces exactly one cancelled outcome.
+     */
+    stream(request: TaskRequest): Promise<StreamRun>;
     /**
      * Returns a live snapshot of every registered provider's static descriptor and current dynamic availability, without executing a task or producing any side effects. Call this before run() when you need to show which providers/models are currently available — for example a settings screen or provider picker. Availability can change between calls (a local model can unload, cloud credentials can expire), so don't cache the result across a run() call.
      */

package/dist/core/generated/inderun-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inderun-api.d.ts","sourceRoot":"","sources":["../../../src/core/generated/inderun-api.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AAEjE,MAAM,WAAW,UAAU;IACzB;;OAEG;IACH,GAAG,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/C;;OAEG;IACH,iBAAiB,IAAI,OAAO,CAAC,0BAA0B,EAAE,CAAC,CAAC;CAC5D"}
+{"version":3,"file":"inderun-api.d.ts","sourceRoot":"","sources":["../../../src/core/generated/inderun-api.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,KAAK,EAAE,SAAS,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AAE5E,MAAM,WAAW,UAAU;IACzB;;OAEG;IACH,GAAG,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/C;;OAEG;IACH,MAAM,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACjD;;OAEG;IACH,iBAAiB,IAAI,OAAO,CAAC,0BAA0B,EAAE,CAAC,CAAC;CAC5D"}

package/dist/core/host.d.ts

@@ -1,2 +1,2 @@
-export type { ClockService, ConnectivityService, DeviceConstraintsService, HostServices, HttpClientService, HttpRequest, HttpResponse, SecureStorageService, TelemetryService, ThermalState } from "@independo/inderun-contracts";
+export type { AbortSignalLike, ClockService, ConnectivityService, DeviceConstraintsService, HostServices, HttpClientService, HttpRequest, HttpResponse, HttpStreamResponse, HttpStreamingClientService, SecureStorageService, TelemetryService, ThermalState } from "@independo/inderun-contracts";
 //# sourceMappingURL=host.d.ts.map

package/dist/core/host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"host.d.ts","sourceRoot":"","sources":["../../src/core/host.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,YAAY,EACZ,mBAAmB,EACnB,wBAAwB,EACxB,YAAY,EACZ,iBAAiB,EACjB,WAAW,EACX,YAAY,EACZ,oBAAoB,EACpB,gBAAgB,EAChB,YAAY,EACb,MAAM,8BAA8B,CAAC"}
+{"version":3,"file":"host.d.ts","sourceRoot":"","sources":["../../src/core/host.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,wBAAwB,EACxB,YAAY,EACZ,iBAAiB,EACjB,WAAW,EACX,YAAY,EACZ,kBAAkB,EAClB,0BAA0B,EAC1B,oBAAoB,EACpB,gBAAgB,EAChB,YAAY,EACb,MAAM,8BAA8B,CAAC"}

package/dist/core/provider.d.ts

@@ -1,4 +1,4 @@
-import type { TaskRequest, TaskResult } from "@independo/inderun-contracts";
+import type { StreamEvent, StreamRunHandle, TaskRequest, TaskResult } from "@independo/inderun-contracts";
 import type { HostServices } from "./host.js";
 /**
  * Static metadata descriptor defining the capabilities, requirements, and constraints
@@ -168,6 +168,12 @@ export type ProviderStreamEvent = {
 } | {
     kind: "done";
     finalText: string;
+    /**
+     * How generation ended, when the provider reports it. Mirrors
+     * `TaskResult.finishReason` for Mode 1 and surfaces on the `completed`
+     * terminal outcome; omit when the provider gives no signal.
+     */
+    finishReason?: TaskResult["finishReason"];
     usage?: TaskResult["usage"];
 } | {
     kind: "error";
@@ -196,4 +202,18 @@ export interface ProviderAdapter {
      */
     stream?(req: TaskRequest, ctx: ProviderStreamContext): AsyncIterable<ProviderStreamEvent>;
 }
+/**
+ * What `IndeRun.stream()` returns: the run's identity, its canonical event
+ * sequence, and a cancel hook.
+ *
+ * `events` terminates in exactly one terminal `StreamEvent`, per the Event
+ * Gate's guarantee, and is single-use — the run is driven once, not restarted
+ * per consumer. `cancel()` is idempotent: repeated or concurrent calls produce
+ * exactly one `cancelled` terminal outcome.
+ */
+export interface StreamRun {
+    handle: StreamRunHandle;
+    events: AsyncIterable<StreamEvent>;
+    cancel(reason?: string): void;
+}
 //# sourceMappingURL=provider.d.ts.map

package/dist/core/provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../src/core/provider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAE9C;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,EAAE,EAAE,MAAM,CAAC;IACX;;OAEG;IACH,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;IACjC;;OAEG;IACH,SAAS,EAAE,YAAY,GAAG,gBAAgB,GAAG,MAAM,GAAG,KAAK,GAAG,UAAU,CAAC;IACzE;;OAEG;IACH,cAAc,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,WAAW,CAAC;IAEnD;;OAEG;IACH,QAAQ,EAAE;QACR,mEAAmE;QACnE,GAAG,EAAE,OAAO,CAAC;QACb,mDAAmD;QACnD,SAAS,EAAE,OAAO,CAAC;QACnB,6DAA6D;QAC7D,QAAQ,EAAE,OAAO,CAAC;QAClB,6DAA6D;QAC7D,KAAK,EAAE,OAAO,CAAC;QACf,wEAAwE;QACxE,eAAe,EAAE,OAAO,CAAC;QACzB,kFAAkF;QAClF,gBAAgB,EAAE,OAAO,CAAC;QAC1B,6EAA6E;QAC7E,UAAU,EAAE,OAAO,CAAC;KACrB,CAAC;IAEF;;;;;OAKG;IACH,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IAEjC;;OAEG;IACH,KAAK,EAAE,MAAM,EAAE,CAAC;IAEhB;;OAEG;IACH,MAAM,CAAC,EAAE;QACP,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IAEF;;OAEG;IACH,OAAO,CAAC,EAAE;QACR,6DAA6D;QAC7D,gBAAgB,EAAE,OAAO,CAAC;QAC1B,2DAA2D;QAC3D,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C;;OAEG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;OAGG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED;;;GAGG;AACH,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,UAAU,EAAE,kBAAkB,CAAC;IAC/B;;;OAGG;IACH,YAAY,EAAE,2BAA2B,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,YAAY,EAAE,YAAY,CAAC;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAsB,SAAQ,UAAU;IACvD;;;;;;OAMG;IACH,MAAM,EAAE,WAAW,CAAC;CACrB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,CAAA;CAAE,GAChE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC;AAEtC;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,QAAQ,IAAI,kBAAkB,CAAC;IAC/B;;OAEG;IACH,YAAY,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACvE;;OAEG;IACH,GAAG,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC5D;;;OAGG;IACH,MAAM,CAAC,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,qBAAqB,GAAG,aAAa,CAAC,mBAAmB,CAAC,CAAC;CAC3F"}
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../src/core/provider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,WAAW,EACX,eAAe,EACf,WAAW,EACX,UAAU,EACX,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAE9C;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,EAAE,EAAE,MAAM,CAAC;IACX;;OAEG;IACH,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;IACjC;;OAEG;IACH,SAAS,EAAE,YAAY,GAAG,gBAAgB,GAAG,MAAM,GAAG,KAAK,GAAG,UAAU,CAAC;IACzE;;OAEG;IACH,cAAc,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,WAAW,CAAC;IAEnD;;OAEG;IACH,QAAQ,EAAE;QACR,mEAAmE;QACnE,GAAG,EAAE,OAAO,CAAC;QACb,mDAAmD;QACnD,SAAS,EAAE,OAAO,CAAC;QACnB,6DAA6D;QAC7D,QAAQ,EAAE,OAAO,CAAC;QAClB,6DAA6D;QAC7D,KAAK,EAAE,OAAO,CAAC;QACf,wEAAwE;QACxE,eAAe,EAAE,OAAO,CAAC;QACzB,kFAAkF;QAClF,gBAAgB,EAAE,OAAO,CAAC;QAC1B,6EAA6E;QAC7E,UAAU,EAAE,OAAO,CAAC;KACrB,CAAC;IAEF;;;;;OAKG;IACH,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IAEjC;;OAEG;IACH,KAAK,EAAE,MAAM,EAAE,CAAC;IAEhB;;OAEG;IACH,MAAM,CAAC,EAAE;QACP,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IAEF;;OAEG;IACH,OAAO,CAAC,EAAE;QACR,6DAA6D;QAC7D,gBAAgB,EAAE,OAAO,CAAC;QAC1B,2DAA2D;QAC3D,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C;;OAEG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;OAGG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED;;;GAGG;AACH,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,UAAU,EAAE,kBAAkB,CAAC;IAC/B;;;OAGG;IACH,YAAY,EAAE,2BAA2B,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,YAAY,EAAE,YAAY,CAAC;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAsB,SAAQ,UAAU;IACvD;;;;;;OAMG;IACH,MAAM,EAAE,WAAW,CAAC;CACrB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClC;IACE,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,YAAY,CAAC,EAAE,UAAU,CAAC,cAAc,CAAC,CAAC;IAC1C,KAAK,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;CAC7B,GACD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC;AAEtC;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,QAAQ,IAAI,kBAAkB,CAAC;IAC/B;;OAEG;IACH,YAAY,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACvE;;OAEG;IACH,GAAG,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC5D;;;OAGG;IACH,MAAM,CAAC,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,qBAAqB,GAAG,aAAa,CAAC,mBAAmB,CAAC,CAAC;CAC3F;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,eAAe,CAAC;IACxB,MAAM,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IACnC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B"}

package/dist/core/sse.d.ts

@@ -0,0 +1,40 @@
+/**
+ * A single dispatched server-sent event.
+ *
+ * `event` and `id` are `undefined` when the stream did not carry those fields.
+ * `data` is the accumulated data payload with its trailing newline removed, and
+ * is passed through verbatim — sentinels such as OpenAI's `[DONE]` are the
+ * caller's concern, not the framing layer's.
+ */
+export interface SseEvent {
+    event?: string;
+    data: string;
+    id?: string;
+}
+/**
+ * Frames a raw byte stream into server-sent events.
+ *
+ * Follows the WHATWG server-sent events stream parsing rules, minus
+ * reconnection: `retry` is parsed as a field and ignored, and there is no
+ * Last-Event-ID reconnect logic. Concretely that means:
+ *
+ * - lines end with LF, CRLF, or bare CR;
+ * - a line beginning with `:` is a comment (servers send these as keep-alives);
+ * - `field: value` strips exactly one leading space from the value, and a line
+ *   with no colon is that field with an empty value;
+ * - `data` fields accumulate, joined by newlines;
+ * - a blank line dispatches the accumulated event, or resets without
+ *   dispatching if no data was accumulated;
+ * - a stream that ends mid-event does **not** dispatch the partial event, since
+ *   a truncated event must never be reported as a complete one.
+ *
+ * Chunk boundaries are meaningless: this decodes incrementally (`stream: true`)
+ * so a boundary may fall inside a multi-byte UTF-8 sequence or mid-line.
+ *
+ * Held to `contracts/fixtures/streaming/sse-framing.json` together with the
+ * Swift and Kotlin implementations of the same protocol.
+ *
+ * @param chunks - Raw response body chunks, in arrival order.
+ */
+export declare function parseSseStream(chunks: AsyncIterable<Uint8Array>): AsyncGenerator<SseEvent>;
+//# sourceMappingURL=sse.d.ts.map

package/dist/core/sse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse.d.ts","sourceRoot":"","sources":["../../src/core/sse.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,WAAW,QAAQ;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAuB,cAAc,CAAC,MAAM,EAAE,aAAa,CAAC,UAAU,CAAC,GAAG,cAAc,CAAC,QAAQ,CAAC,CAsFjG"}

package/dist/core/sse.js

@@ -0,0 +1,118 @@
+/**
+ * Frames a raw byte stream into server-sent events.
+ *
+ * Follows the WHATWG server-sent events stream parsing rules, minus
+ * reconnection: `retry` is parsed as a field and ignored, and there is no
+ * Last-Event-ID reconnect logic. Concretely that means:
+ *
+ * - lines end with LF, CRLF, or bare CR;
+ * - a line beginning with `:` is a comment (servers send these as keep-alives);
+ * - `field: value` strips exactly one leading space from the value, and a line
+ *   with no colon is that field with an empty value;
+ * - `data` fields accumulate, joined by newlines;
+ * - a blank line dispatches the accumulated event, or resets without
+ *   dispatching if no data was accumulated;
+ * - a stream that ends mid-event does **not** dispatch the partial event, since
+ *   a truncated event must never be reported as a complete one.
+ *
+ * Chunk boundaries are meaningless: this decodes incrementally (`stream: true`)
+ * so a boundary may fall inside a multi-byte UTF-8 sequence or mid-line.
+ *
+ * Held to `contracts/fixtures/streaming/sse-framing.json` together with the
+ * Swift and Kotlin implementations of the same protocol.
+ *
+ * @param chunks - Raw response body chunks, in arrival order.
+ */
+export async function* parseSseStream(chunks) {
+    const decoder = new TextDecoder("utf-8");
+    let buffer = "";
+    let eventType;
+    let data;
+    let id;
+    const takeEvent = () => {
+        const dispatched = data === undefined ? undefined : buildEvent(eventType, data, id);
+        eventType = undefined;
+        data = undefined;
+        id = undefined;
+        return dispatched;
+    };
+    const handleLine = (line) => {
+        if (line.length === 0)
+            return takeEvent();
+        if (line.startsWith(":"))
+            return undefined;
+        const colon = line.indexOf(":");
+        const field = colon === -1 ? line : line.slice(0, colon);
+        let value = colon === -1 ? "" : line.slice(colon + 1);
+        if (value.startsWith(" "))
+            value = value.slice(1);
+        switch (field) {
+            case "event":
+                eventType = value;
+                break;
+            case "data":
+                data = data === undefined ? value : `${data}\n${value}`;
+                break;
+            case "id":
+                // Per the SSE spec an id containing a NUL is ignored outright.
+                if (!value.includes("\0"))
+                    id = value;
+                break;
+            default:
+                // `retry` and anything unrecognized are dropped rather than erroring.
+                break;
+        }
+        return undefined;
+    };
+    for await (const chunk of chunks) {
+        buffer += decoder.decode(chunk, { stream: true });
+        for (;;) {
+            const line = takeLine();
+            if (line === undefined)
+                break;
+            const dispatched = handleLine(line);
+            if (dispatched)
+                yield dispatched;
+        }
+    }
+    // A trailing bare CR is ambiguous until the stream ends: it could still have
+    // been the first half of a CRLF.
+    buffer += decoder.decode();
+    for (;;) {
+        const line = takeLine(true);
+        if (line === undefined)
+            break;
+        const dispatched = handleLine(line);
+        if (dispatched)
+            yield dispatched;
+    }
+    function takeLine(atEnd = false) {
+        for (let index = 0; index < buffer.length; index += 1) {
+            const char = buffer[index];
+            if (char === "\n") {
+                const line = buffer.slice(0, index);
+                buffer = buffer.slice(index + 1);
+                return line;
+            }
+            if (char === "\r") {
+                const isLast = index === buffer.length - 1;
+                // Withhold a trailing CR until we know whether an LF follows, unless
+                // the stream is over and no LF can arrive.
+                if (isLast && !atEnd)
+                    return undefined;
+                const skip = buffer[index + 1] === "\n" ? 2 : 1;
+                const line = buffer.slice(0, index);
+                buffer = buffer.slice(index + skip);
+                return line;
+            }
+        }
+        return undefined;
+    }
+}
+function buildEvent(eventType, data, id) {
+    return {
+        ...(eventType !== undefined ? { event: eventType } : {}),
+        data,
+        ...(id !== undefined ? { id } : {})
+    };
+}

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-export { type ConnectivityService, type DeviceConstraintsService, type SecureStorageService, type ClockService, type HttpClientService, type HttpRequest, type HttpResponse, type HostServices, type ThermalState } from "./core/host.js";
-export { type ProviderDescriptor, type ProviderDynamicCapabilities, type ProviderCapabilitySnapshot, type RunContext, type ProviderAdapter, type ProviderStreamContext, type ProviderStreamEvent } from "./core/provider.js";
+export { type AbortSignalLike, type ConnectivityService, type DeviceConstraintsService, type SecureStorageService, type ClockService, type HttpClientService, type HttpRequest, type HttpResponse, type HttpStreamResponse, type HttpStreamingClientService, type HostServices, type ThermalState } from "./core/host.js";
+export { type ProviderDescriptor, type ProviderDynamicCapabilities, type ProviderCapabilitySnapshot, type RunContext, type ProviderAdapter, type ProviderStreamContext, type ProviderStreamEvent, type StreamRun } from "./core/provider.js";
 export { EventGate } from "./core/event-gate.js";
 export { ProviderRegistry } from "./core/registry.js";
 export { type RouteSelection, Router } from "./core/router.js";
@@ -8,6 +8,6 @@ export { type IndeRunExceptionParams, IndeRunException, createCapabilityMismatch
 export { IndeRun, type StreamHandleResult } from "./core/engine.js";
 export type { IndeRunApi } from "./core/generated/inderun-api.js";
 export { type TelemetryEventType, type TelemetryEvent, type TelemetryService, NoOpTelemetryService } from "./core/telemetry.js";
-export { BrowserConnectivityService, FetchHttpClient, SystemClockService, createBrowserHostServices, type CreateBrowserHostServicesOptions, type FetchHttpClientOptions } from "./core/browser-host.js";
+export { BrowserConnectivityService, FetchHttpClient, FetchStreamingHttpClient, SystemClockService, createBrowserHostServices, type CreateBrowserHostServicesOptions, type FetchHttpClientOptions } from "./core/browser-host.js";
 export { createIndeRunWeb, type CreateIndeRunWebOptions } from "./web-sdk.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,YAAY,EAClB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACzB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,gBAAgB,EACjB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,KAAK,sBAAsB,EAC3B,gBAAgB,EAChB,wBAAwB,EACxB,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EACnB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACpE,YAAY,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAElE,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,oBAAoB,EACrB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,0BAA0B,EAC1B,eAAe,EACf,kBAAkB,EAClB,yBAAyB,EACzB,KAAK,gCAAgC,EACrC,KAAK,sBAAsB,EAC5B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,gBAAgB,EAAE,KAAK,uBAAuB,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,EAC/B,KAAK,YAAY,EACjB,KAAK,YAAY,EAClB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,SAAS,EACf,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,gBAAgB,EACjB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,KAAK,sBAAsB,EAC3B,gBAAgB,EAChB,wBAAwB,EACxB,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EACnB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACpE,YAAY,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAElE,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,oBAAoB,EACrB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,0BAA0B,EAC1B,eAAe,EACf,wBAAwB,EACxB,kBAAkB,EAClB,yBAAyB,EACzB,KAAK,gCAAgC,EACrC,KAAK,sBAAsB,EAC5B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,gBAAgB,EAAE,KAAK,uBAAuB,EAAE,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -7,7 +7,7 @@ export { WasmRoutePlanner } from "./core/route-planner.js";
 export { IndeRunException, createCapabilityMismatch, createOffline, createAuthError, createRateLimited, createTimeout, createUnavailable, createInternal, toIndeRunException } from "./core/errors.js";
 export { IndeRun } from "./core/engine.js";
 export { NoOpTelemetryService } from "./core/telemetry.js";
-export { BrowserConnectivityService, FetchHttpClient, SystemClockService, createBrowserHostServices } from "./core/browser-host.js";
+export { BrowserConnectivityService, FetchHttpClient, FetchStreamingHttpClient, SystemClockService, createBrowserHostServices } from "./core/browser-host.js";
 export { createIndeRunWeb } from "./web-sdk.js";
 // The OpenAI Responses adapter is provider-specific and intentionally excluded
 // from this unified index. Import it from "@independo/inderun-web/openai".

package/dist/providers/openai/provider.d.ts

@@ -1,6 +1,6 @@
 import type { TaskRequest, TaskResult } from "@independo/inderun-contracts";
 import type { HostServices } from "../../core/host.js";
-import type { ProviderAdapter, ProviderDescriptor, ProviderDynamicCapabilities, RunContext } from "../../core/provider.js";
+import type { ProviderAdapter, ProviderDescriptor, ProviderDynamicCapabilities, ProviderStreamContext, ProviderStreamEvent, RunContext } from "../../core/provider.js";
 export declare const DEFAULT_OPENAI_RESPONSES_ENDPOINT = "https://api.openai.com/v1/responses";
 /**
  * Configuration for the OpenAI Responses provider.
@@ -84,6 +84,49 @@ export declare class OpenAIResponsesProvider implements ProviderAdapter {
      * @throws IndeRunException mapped to the standard error taxonomy.
      */
     run(request: TaskRequest, context: RunContext): Promise<TaskResult>;
+    /**
+     * Executes a normalized text-to-text task in Mode 2 against the OpenAI
+     * Responses API's server-sent event stream.
+     *
+     * The request is the Mode 1 body plus `"stream": true`, so both modes stay a
+     * single code path up to the transport. The response head is classified
+     * before the body is read: a non-2xx is drained to text and run through the
+     * same `mapHttpError` as Mode 1, because a 429 must surface as RateLimited
+     * rather than as a malformed event stream.
+     *
+     * Event mapping, from the Responses API's typed SSE events to the canonical
+     * provider vocabulary:
+     *
+     * - `response.output_text.delta` becomes a delta;
+     * - `response.completed` and `response.incomplete` become the terminal done,
+     *   with `finalText`, `usage`, and `finishReason` read off the embedded
+     *   response object by the same helpers Mode 1 uses — it has the same shape;
+     * - `response.failed` and `error` become a terminal error;
+     * - every other event type is ignored, since the set is open and additive.
+     *
+     * @param request - Canonical IndeRun task request.
+     * @param context - Engine stream context: run id, host services, abort signal.
+     */
+    stream(request: TaskRequest, context: ProviderStreamContext): AsyncGenerator<ProviderStreamEvent>;
+    /**
+     * Maps a `response.failed` / `error` stream event onto the error taxonomy.
+     * These arrive over an HTTP 200 body, so there is no status code to classify
+     * from; OpenAI reports rate limiting and auth failures here with the same
+     * `code` values it uses in unary error bodies.
+     *
+     * Two payload shapes exist and both are accepted: the standalone `error`
+     * event carries `code`/`message` at its root, while `response.failed` nests
+     * them under `response.error`. The root `type` is the event name rather than
+     * an error type, so it is never read as one.
+     */
+    private mapStreamError;
+    /**
+     * Resolves the request headers, including the bearer token behind
+     * `authContextRef`. Shared by `run` and `stream`: the credential never travels
+     * in the request payload, only the slot id does, so both modes must resolve it
+     * the same way.
+     */
+    private resolveHeaders;
     private createRequestBody;
     /**
      * Maps an OpenAI HTTP error response onto the IndeRun error taxonomy:

package/dist/providers/openai/provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../../src/providers/openai/provider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAQ5E,OAAO,KAAK,EAAE,YAAY,EAAe,MAAM,oBAAoB,CAAC;AACpE,OAAO,KAAK,EACV,eAAe,EACf,kBAAkB,EAClB,2BAA2B,EAC3B,UAAU,EACX,MAAM,wBAAwB,CAAC;AAEhC,eAAO,MAAM,iCAAiC,wCAAwC,CAAC;AAKvF;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,IAAI,CAAC,EAAE,gBAAgB,GAAG,MAAM,CAAC;IACjC;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAwBD;;;;;;GAMG;AACH,qBAAa,uBAAwB,YAAW,eAAe;IAUjD,OAAO,CAAC,QAAQ,CAAC,OAAO;IATpC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAS;IAC5B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA4B;IACjD,OAAO,CAAC,YAAY,CAAC,CAA6D;IAElF;;;OAGG;gBAC0B,OAAO,EAAE,qBAAqB;IAM3D;;OAEG;IACH,QAAQ,IAAI,kBAAkB;IAsB9B;;;;;;;;OAQG;IACG,YAAY,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,2BAA2B,CAAC;YAkB9D,sBAAsB;IAuCpC;;;;;;OAMG;IACG,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAkHzE,OAAO,CAAC,iBAAiB;IAuBzB;;;;;;;OAOG;IACH,OAAO,CAAC,YAAY;CAmErB"}
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../../src/providers/openai/provider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAQ5E,OAAO,KAAK,EAAE,YAAY,EAAe,MAAM,oBAAoB,CAAC;AACpE,OAAO,KAAK,EACV,eAAe,EACf,kBAAkB,EAClB,2BAA2B,EAC3B,qBAAqB,EACrB,mBAAmB,EACnB,UAAU,EACX,MAAM,wBAAwB,CAAC;AA4BhC,eAAO,MAAM,iCAAiC,wCAAwC,CAAC;AAKvF;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,IAAI,CAAC,EAAE,gBAAgB,GAAG,MAAM,CAAC;IACjC;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AA6BD;;;;;;GAMG;AACH,qBAAa,uBAAwB,YAAW,eAAe;IAUjD,OAAO,CAAC,QAAQ,CAAC,OAAO;IATpC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAS;IAC5B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA4B;IACjD,OAAO,CAAC,YAAY,CAAC,CAA6D;IAElF;;;OAGG;gBAC0B,OAAO,EAAE,qBAAqB;IAM3D;;OAEG;IACH,QAAQ,IAAI,kBAAkB;IAuB9B;;;;;;;;OAQG;IACG,YAAY,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,2BAA2B,CAAC;YA+B9D,sBAAsB;IAuCpC;;;;;;OAMG;IACG,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAiFzE;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACI,MAAM,CACX,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,qBAAqB,GAC7B,cAAc,CAAC,mBAAmB,CAAC;IAiGtC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,cAAc;IAmBtB;;;;;OAKG;YACW,cAAc;IA2C5B,OAAO,CAAC,iBAAiB;IA2BzB;;;;;;;OAOG;IACH,OAAO,CAAC,YAAY;CAmErB"}

package/dist/providers/openai/provider.js

@@ -1,4 +1,14 @@
 import { createAuthError, createInternal, createRateLimited, createTimeout, createUnavailable } from "../../core/errors.js";
+import { parseSseStream } from "../../core/sse.js";
+/** Buffers a body stream to text, for error responses that are not event streams. */
+async function drainToText(body) {
+    const decoder = new TextDecoder();
+    let text = "";
+    for await (const chunk of body) {
+        text += decoder.decode(chunk, { stream: true });
+    }
+    return text + decoder.decode();
+}
 export const DEFAULT_OPENAI_RESPONSES_ENDPOINT = "https://api.openai.com/v1/responses";
 const DEFAULT_HEALTH_CHECK_TIMEOUT_MS = 3000;
 const DEFAULT_HEALTH_CHECK_CACHE_MS = 5000;
@@ -33,9 +43,10 @@ export class OpenAIResponsesProvider {
             id: this.id,
             type: "cloud",
             transport: "http",
+            streamingStyle: "tokens",
             supports: {
                 run: true,
-                streaming: false,
+                streaming: true,
                 realtime: false,
                 tools: false,
                 reasoningEvents: false,
@@ -71,7 +82,18 @@ export class OpenAIResponsesProvider {
                 reason: "OpenAI Responses provider requires a SecureStorageService when auth is enabled."
             };
         }
-        return this.checkEndpointReachable(host.httpClient, host.clock);
+        const reachability = await this.checkEndpointReachable(host.httpClient, host.clock);
+        if (host.streamingHttpClient) {
+            return reachability;
+        }
+        // Mode 1 still works without it; only streaming is taken away, and the
+        // planner turns this into an inspectable `streaming_unavailable` rejection
+        // rather than an unexplained routing failure.
+        return {
+            ...reachability,
+            streamingAvailable: false,
+            streamingUnavailableReason: "Host does not provide an HttpStreamingClientService, which OpenAI streaming requires."
+        };
     }
     async checkEndpointReachable(httpClient, clock) {
         const now = clock ? clock.now() : Date.now();
@@ -120,33 +142,7 @@ export class OpenAIResponsesProvider {
                 runId: context.runId
             });
         }
-        const headers = {
-            "Content-Type": "application/json"
-        };
-        if (this.auth === "authContextRef") {
-            const slotId = request.authContextRef ?? this.options.authContextRef;
-            if (!slotId) {
-                throw createAuthError("OpenAI Responses provider requires authContextRef.", {
-                    providerId: this.id,
-                    runId: context.runId
-                });
-            }
-            const secureStorage = context.hostServices.secureStorage;
-            if (!secureStorage) {
-                throw createAuthError("OpenAI Responses provider requires a SecureStorageService when auth is enabled.", {
-                    providerId: this.id,
-                    runId: context.runId
-                });
-            }
-            const secret = await secureStorage.getSecret(slotId);
-            if (!secret) {
-                throw createAuthError(`No OpenAI credential found for authContextRef '${slotId}'.`, {
-                    providerId: this.id,
-                    runId: context.runId
-                });
-            }
-            headers.Authorization = `Bearer ${secret}`;
-        }
+        const headers = await this.resolveHeaders(request, context);
         let response;
         try {
             const httpRequest = {
@@ -203,11 +199,177 @@ export class OpenAIResponsesProvider {
         }
         return result;
     }
-    createRequestBody(request) {
+    /**
+     * Executes a normalized text-to-text task in Mode 2 against the OpenAI
+     * Responses API's server-sent event stream.
+     *
+     * The request is the Mode 1 body plus `"stream": true`, so both modes stay a
+     * single code path up to the transport. The response head is classified
+     * before the body is read: a non-2xx is drained to text and run through the
+     * same `mapHttpError` as Mode 1, because a 429 must surface as RateLimited
+     * rather than as a malformed event stream.
+     *
+     * Event mapping, from the Responses API's typed SSE events to the canonical
+     * provider vocabulary:
+     *
+     * - `response.output_text.delta` becomes a delta;
+     * - `response.completed` and `response.incomplete` become the terminal done,
+     *   with `finalText`, `usage`, and `finishReason` read off the embedded
+     *   response object by the same helpers Mode 1 uses — it has the same shape;
+     * - `response.failed` and `error` become a terminal error;
+     * - every other event type is ignored, since the set is open and additive.
+     *
+     * @param request - Canonical IndeRun task request.
+     * @param context - Engine stream context: run id, host services, abort signal.
+     */
+    async *stream(request, context) {
+        const streamingClient = context.hostServices.streamingHttpClient;
+        if (!streamingClient) {
+            throw createUnavailable("OpenAI Responses streaming requires an HttpStreamingClientService.", {
+                providerId: this.id,
+                runId: context.runId
+            });
+        }
+        const headers = await this.resolveHeaders(request, context);
+        headers.Accept = "text/event-stream";
+        let response;
+        try {
+            const httpRequest = {
+                method: "POST",
+                url: this.endpointUrl,
+                headers,
+                body: JSON.stringify(this.createRequestBody(request, true))
+            };
+            if (this.options.timeoutMs !== undefined) {
+                httpRequest.timeoutMs = this.options.timeoutMs;
+            }
+            response = await streamingClient.stream(httpRequest, context.signal);
+        }
+        catch (err) {
+            if (isAbortError(err)) {
+                throw createTimeout("OpenAI Responses stream timed out before the first byte.", {
+                    providerId: this.id,
+                    runId: context.runId
+                });
+            }
+            throw createUnavailable("OpenAI Responses stream failed before a response was received.", {
+                providerId: this.id,
+                runId: context.runId,
+                details: { originalError: getErrorSummary(err) }
+            });
+        }
+        if (response.status < 200 || response.status >= 300) {
+            throw this.mapHttpError(response.status, response.statusText, response.headers, await drainToText(response.body), context);
+        }
+        for await (const sseEvent of parseSseStream(response.body)) {
+            if (sseEvent.data === "[DONE]") {
+                continue;
+            }
+            const parsed = parseJson(sseEvent.data);
+            // The `event:` line and the payload's own `type` carry the same value;
+            // prefer the payload so a proxy that drops event names still works.
+            const type = parsed.type ?? sseEvent.event;
+            if (type === "response.output_text.delta") {
+                if (parsed.delta) {
+                    yield { kind: "delta", text: parsed.delta };
+                }
+                continue;
+            }
+            if (type === "response.completed" || type === "response.incomplete") {
+                const body = parsed.response ?? {};
+                const done = {
+                    kind: "done",
+                    finalText: extractOutputText(body) ?? "",
+                    finishReason: getFinishReason(body)
+                };
+                const usage = getUsage(body);
+                if (usage) {
+                    done.usage = usage;
+                }
+                yield done;
+                return;
+            }
+            if (type === "response.failed" || type === "error") {
+                yield { kind: "error", error: this.mapStreamError(parsed, context) };
+                return;
+            }
+        }
+        // Falling out of the loop means the stream ended without a terminal event.
+        // The engine reports that as a provider fault; inventing a completion from
+        // whatever deltas happened to arrive would hide a truncated response.
+    }
+    /**
+     * Maps a `response.failed` / `error` stream event onto the error taxonomy.
+     * These arrive over an HTTP 200 body, so there is no status code to classify
+     * from; OpenAI reports rate limiting and auth failures here with the same
+     * `code` values it uses in unary error bodies.
+     *
+     * Two payload shapes exist and both are accepted: the standalone `error`
+     * event carries `code`/`message` at its root, while `response.failed` nests
+     * them under `response.error`. The root `type` is the event name rather than
+     * an error type, so it is never read as one.
+     */
+    mapStreamError(event, context) {
+        const nested = event.error ?? event.response?.error;
+        const message = nested?.message ?? event.message ?? "OpenAI Responses stream reported a failure.";
+        const code = nested?.code ?? event.code;
+        const details = { errorType: nested?.type, errorCode: code };
+        const params = { providerId: this.id, runId: context.runId, details };
+        switch (code) {
+            case "rate_limit_exceeded":
+                return createRateLimited(message, { ...params, retryable: true });
+            case "invalid_api_key":
+            case "authentication_error":
+                return createAuthError(message, params);
+            default:
+                return createUnavailable(message, { ...params, retryable: true });
+        }
+    }
+    /**
+     * Resolves the request headers, including the bearer token behind
+     * `authContextRef`. Shared by `run` and `stream`: the credential never travels
+     * in the request payload, only the slot id does, so both modes must resolve it
+     * the same way.
+     */
+    async resolveHeaders(request, context) {
+        const headers = {
+            "Content-Type": "application/json"
+        };
+        if (this.auth !== "authContextRef") {
+            return headers;
+        }
+        const slotId = request.authContextRef ?? this.options.authContextRef;
+        if (!slotId) {
+            throw createAuthError("OpenAI Responses provider requires authContextRef.", {
+                providerId: this.id,
+                runId: context.runId
+            });
+        }
+        const secureStorage = context.hostServices.secureStorage;
+        if (!secureStorage) {
+            throw createAuthError("OpenAI Responses provider requires a SecureStorageService when auth is enabled.", {
+                providerId: this.id,
+                runId: context.runId
+            });
+        }
+        const secret = await secureStorage.getSecret(slotId);
+        if (!secret) {
+            throw createAuthError(`No OpenAI credential found for authContextRef '${slotId}'.`, {
+                providerId: this.id,
+                runId: context.runId
+            });
+        }
+        headers.Authorization = `Bearer ${secret}`;
+        return headers;
+    }
+    createRequestBody(request, stream = false) {
         const body = {
             model: this.options.model,
             input: createInput(request)
         };
+        if (stream) {
+            body.stream = true;
+        }
         const generation = request.generation;
         if (generation?.maxOutputTokens !== undefined) {
             body.max_output_tokens = generation.maxOutputTokens;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@independo/inderun-web",
-  "version": "0.3.0-dev.5",
+  "version": "0.3.0-dev.6",
   "description": "TypeScript/Web SDK for IndeRun.",
   "license": "MIT",
   "author": {
@@ -55,8 +55,8 @@
     "README.md"
   ],
   "dependencies": {
-    "@independo/inderun-contracts": "^0.3.0-dev.5",
-    "@independo/inderun-route-core-wasm": "^0.3.0-dev.5"
+    "@independo/inderun-contracts": "^0.3.0-dev.6",
+    "@independo/inderun-route-core-wasm": "^0.3.0-dev.6"
   },
   "peerDependencies": {
     "@huggingface/transformers": "^4.0.0"