@inflexa-ai/harness 0.45.1 → 0.46.2

package/dist/providers/ai-sdk.js

@@ -1,5 +1,7 @@
-import { createHash } from "node:crypto";
-import { streamText, wrapLanguageModel, } from "ai";
+import { errorOf, errorNameOf } from "../lib/thrown.js";
+import { textOf } from "../lib/unknown-text.js";
+import { createHash, randomUUID } from "node:crypto";
+import { wrapLanguageModel } from "ai";
 import { createAnthropic } from "@ai-sdk/anthropic";
 // Any `providerOptions.anthropic.thinking` bypasses this table's thinking
 // selection (see `thinkingWithBinding`).
@@ -10,11 +12,12 @@ import { OpenTelemetry } from "@ai-sdk/otel";
 import { APICallError } from "@ai-sdk/provider";
 import { retryWithExponentialBackoff } from "@ai-sdk/provider-utils";
 import { trace } from "@opentelemetry/api";
-import { ResultAsync, err, ok } from "neverthrow";
 import { scopeWorkloadId } from "../auth/types.js";
 import { createNoopLogger } from "../lib/console-logger.js";
-import { passThroughTracer } from "../lib/otel-spans.js";
-import { DEFAULT_SUSPEND_ON, classifyProviderError, RequestTimeoutError, toProviderError } from "./errors.js";
+import { ResultError } from "../lib/result.js";
+import { isUnknownArray } from "../lib/unknown-array.js";
+import { parseUnknownRecord } from "../lib/unknown-containers.js";
+import { DEFAULT_SUSPEND_ON, classifyProviderError, extractStatus, RequestTimeoutError, toProviderError, } from "./errors.js";
 import { DEFAULT_REASONING } from "./reasoning.js";
 import { headersRefusalError, requestHeadersFor } from "./request-headers.js";
 /**
@@ -55,14 +58,15 @@ export const DEFAULT_MAX_OUTPUT_TOKENS = 64_000;
  * provider over a boot shares one sink.
  */
 function routeSdkWarningsTo(logger) {
-    const g = globalThis;
-    if (g.AI_SDK_LOG_WARNINGS !== undefined)
+    // The SDK names a global that no declaration of `globalThis` describes, so the install reads and
+    // writes the key reflectively.
+    if (Reflect.get(globalThis, "AI_SDK_LOG_WARNINGS") !== undefined)
         return;
-    g.AI_SDK_LOG_WARNINGS = (options) => {
+    Reflect.set(globalThis, "AI_SDK_LOG_WARNINGS", (options) => {
         for (const warning of options.warnings) {
             logger.warn("ai sdk warning", { provider: options.provider, model: options.model, warning });
         }
-    };
+    });
 }
 function workloadOf(session) {
     return `${session.scope.kind}:${scopeWorkloadId(session.scope)}`;
@@ -108,55 +112,49 @@ function thinkingWithBinding(reasoning, mode) {
  * because the AI SDK has no part for a model hop, and it drops the block from the
  * content it returns (`anthropic-messages-language-model`, the `content_block_start`
  * case). Thus the turn the harness holds is not the turn the API produced, and every
- * signed thinking block of that turn is rejected from the next request on. This reader
- * is what lets {@link settleFallbackReply} see the hop the content no longer shows.
+ * signed thinking block of that turn is rejected from the next request on.
+ *
+ * The API holds the whole turn against the signature of each of its thinking blocks, so
+ * echoing that turn earns `thinking ... blocks in the latest assistant message cannot be
+ * modified`, which is a 400 that no retry can pass. A thinking block is optional on the
+ * way back, thus the loop records the reply of a hop with no thinking block, and the next
+ * request continues. The cost is the reasoning of this one turn and the cache write that
+ * its new prefix pays for.
+ *
+ * The response metadata of the package carries `message_start.message.model`, and that
+ * field keeps the REQUESTED model across a hop. The iteration names the model that
+ * answered, thus it wins for the usage record.
  */
-function fallbackModelOf(metadata) {
+export function fallbackModelOf(metadata) {
     const entries = metadata?.["anthropic"]?.["iterations"];
-    if (!Array.isArray(entries))
+    if (!isUnknownArray(entries))
         return undefined;
     for (const entry of entries) {
-        if (typeof entry !== "object" || entry === null)
+        const record = parseUnknownRecord(entry);
+        if (record === undefined || !("type" in record))
             continue;
-        const fields = entry;
-        if (fields["type"] !== "fallback_message")
+        if (record["type"] !== "fallback_message")
             continue;
-        return typeof fields["model"] === "string" ? fields["model"] : "";
+        return "model" in record && typeof record["model"] === "string" ? record["model"] : "";
     }
     return undefined;
 }
-/**
- * The assistant message with no thinking block, and with `""` for content when it held
- * nothing else. An empty message reaches no wire: `sanitizeMessages` drops it.
- */
-function withoutThinking(message) {
-    if (typeof message.content === "string")
-        return message;
-    const content = message.content.filter((part) => part.type !== "reasoning" && part.type !== "reasoning-file");
-    if (content.length === message.content.length)
-        return message;
-    return content.length === 0 ? { ...message, content: "" } : { ...message, content };
-}
 /** Reads `providerMetadata.anthropic.inputTransformations`; empty for another vendor. */
 function inputTransformationsOf(metadata) {
     const entries = metadata?.["anthropic"]?.["inputTransformations"];
-    if (!Array.isArray(entries))
+    if (!isUnknownArray(entries))
         return [];
     return entries.map((entry) => {
-        const fields = typeof entry === "object" && entry !== null ? entry : {};
+        const record = parseUnknownRecord(entry);
         const text = (key) => {
-            const value = fields[key];
+            const value = record?.[key];
             return typeof value === "string" ? value : undefined;
         };
         return { type: text("type"), path: text("path"), reason: text("reason") };
     });
 }
 function isAbortError(value) {
-    if (value instanceof DOMException && value.name === "AbortError")
-        return true;
-    if (value instanceof Error && value.name === "AbortError")
-        return true;
-    return false;
+    return errorNameOf(value) === "AbortError";
 }
 /**
  * Locate an `APICallError` on the throwable itself or one hop down its `cause`.
@@ -167,7 +165,9 @@ function isAbortError(value) {
 function apiCallErrorOf(error) {
     if (APICallError.isInstance(error))
         return error;
-    const cause = error?.cause;
+    if (error === null || typeof error !== "object" || !("cause" in error))
+        return undefined;
+    const cause = error.cause;
     if (APICallError.isInstance(cause))
         return cause;
     return undefined;
@@ -282,8 +282,9 @@ export function failureOf(e, workload, suspendOn) {
  * timeout. Without this guard the envelope would loop an expiry that the caller
  * itself declared.
  */
-export function createRetry(signal, logger, maxRetries, suspendOn, hookCall) {
+export function createRetry(signal, logger, maxRetries, suspendOn, hookCall, onRetry) {
     let retryCount = 0;
+    const requestId = randomUUID();
     return retryWithExponentialBackoff({
         maxRetries,
         initialDelayInMs: RETRY_INITIAL_DELAY_MS,
@@ -294,6 +295,8 @@ export function createRetry(signal, logger, maxRetries, suspendOn, hookCall) {
             const delayMs = computeRetryDelayMs(error, exponentialBackoffDelay);
             retryCount += 1;
             logger.debug("retrying provider call", { attempt: retryCount, delayMs, ...logger.errorFields(error) });
+            const status = extractStatus(error);
+            onRetry?.({ requestId, attempt: retryCount, maxRetries, delayMs, status: status !== undefined && status >= 400 ? status : undefined });
             return delayMs;
         },
         createRetryError: ({ message, errors }) => {
@@ -315,9 +318,7 @@ export function createRetry(signal, logger, maxRetries, suspendOn, hookCall) {
  * `@ai-sdk/openai-compatible` maps `prompt_tokens_details.cached_tokens` →
  * `cacheReadTokens` (it never reports a write — that family caches
  * server-side, with no billed write step). Reading the neutral field is
- * therefore both correct and vendor-agnostic; the raw vendor payload remains
- * available under `providerMetadata.anthropic.usage` for debugging, in the
- * vendor's own snake_case.
+ * therefore both correct and vendor-agnostic.
  *
  * `inputTokens` is the total billed prefix, cache reads included.
  *
@@ -325,134 +326,24 @@ export function createRetry(signal, logger, maxRetries, suspendOn, hookCall) {
  * count and is copied verbatim: providers disagree on whether reasoning tokens
  * are already inside the output total, so the harness reconciles nothing.
  */
-function toChatUsage(usage) {
+export function toChatUsage(usage) {
     if (usage === undefined)
         return undefined;
     return {
         inputTokens: usage.inputTokens,
         outputTokens: usage.outputTokens,
-        cacheCreationInputTokens: usage.inputTokenDetails?.cacheWriteTokens,
-        cacheReadInputTokens: usage.inputTokenDetails?.cacheReadTokens,
-        reasoningTokens: usage.outputTokenDetails?.reasoningTokens,
+        cacheCreationInputTokens: usage.inputTokenDetails.cacheWriteTokens,
+        cacheReadInputTokens: usage.inputTokenDetails.cacheReadTokens,
+        reasoningTokens: usage.outputTokenDetails.reasoningTokens,
     };
 }
-/** The id of the model bound into this provider — a bare id string is its own id. */
-function requestedModelIdOf(model) {
-    return typeof model === "string" ? model : model.modelId;
-}
-/** The provider id of the model bound into this provider, as the AI SDK names it — a bare id string names no provider. */
-function providerIdOf(model) {
-    return typeof model === "string" ? undefined : model.provider;
-}
-/**
- * Capture the served model id at the raw model boundary, because that is the
- * only place it is still distinguishable from the requested one: `streamText`
- * coalesces an unreported response model id to the bound model's own id, so
- * reading `result.response.modelId` would silently republish the requested id
- * as an endpoint's claim. A middleware sees the provider's
- * result before that fallback applies, so "reported nothing" stays absent.
- *
- * Built per call, never per provider: one provider instance serves concurrent
- * calls, and a shared mutable slot would hand one call another's answer. A bare
- * model-id string has no wire result to observe, so it captures nothing.
- */
-function captureServedModelId(model) {
-    if (typeof model === "string")
-        return { model, servedModelId: () => undefined };
-    let served;
-    const wrapped = wrapLanguageModel({
-        model,
-        middleware: {
-            wrapGenerate: async ({ doGenerate }) => {
-                const result = await doGenerate();
-                served = result.response?.modelId;
-                return result;
-            },
-            wrapStream: async ({ doStream }) => {
-                const result = await doStream();
-                return {
-                    ...result,
-                    stream: result.stream.pipeThrough(new TransformStream({
-                        transform(chunk, controller) {
-                            if (chunk.type === "response-metadata" && chunk.modelId !== undefined)
-                                served = chunk.modelId;
-                            controller.enqueue(chunk);
-                        },
-                    })),
-                };
-            },
-        },
-    });
-    return { model: wrapped, servedModelId: () => served };
-}
-function responseFromMessages(input) {
-    const { messages, fallbackText, finishReason, rawFinishReason, requestedModelId, servedModelId, provider } = input;
-    const usage = toChatUsage(input.usage);
-    const message = [...messages].reverse().find((m) => m.role === "assistant");
-    if (message === undefined) {
-        return { message: { role: "assistant", content: fallbackText }, finishReason, rawFinishReason, usage, requestedModelId, servedModelId, provider };
-    }
-    return { message, finishReason, rawFinishReason, usage, requestedModelId, servedModelId, provider };
-}
-/**
- * Drop empty text parts — and messages left with no content at all — before
- * the wire call. The Anthropic Messages API rejects any request containing an
- * empty text block, and the SDK's own response assembly legitimately produces
- * them: a turn that goes straight to tool calls yields an assistant message
- * carrying a ""-text part, which the agent loop then echoes back as history
- * on its next request. Filtering once at the outbound boundary covers every
- * source at once — loop echo, stored thread history, legacy backfill, and the
- * empty-string fallback in `responseFromMessages`.
- */
-function sanitizeMessages(messages) {
-    const out = [];
-    for (const m of messages) {
-        if (typeof m.content === "string") {
-            if (m.content !== "")
-                out.push(m);
-            continue;
-        }
-        const parts = m.content.filter((p) => p.type !== "text" || p.text !== "");
-        // The filtered parts are a subset of this message's own content, so the
-        // message remains valid for its role — the cast only re-associates the
-        // narrowed array with the union member TS can no longer correlate.
-        if (parts.length > 0)
-            out.push({ ...m, content: parts });
-    }
-    return out;
-}
-/**
- * Advance the SDK stream to the next text delta.
- *
- * The full stream carries one part for each event of a turn, and only a text
- * part reaches the consumer of the harness. Thus the pull skips each other part.
- * The `abort` part stops the pull, because the SDK closes the stream directly
- * after it. Thus a timeout can never end the stream in silence with the text
- * that arrived before it.
- */
-async function pullNextDelta(iterator) {
-    for (let next = await iterator.next(); next.done !== true; next = await iterator.next()) {
-        const part = next.value;
-        if (part.type === "text-delta")
-            return { kind: "delta", text: part.text };
-        if (part.type === "abort")
-            return { kind: "aborted", reason: part.reason };
-        // The SDK reports a wire failure as a part, not as a rejection, and it
-        // then closes the stream. Skipping it would turn a failed call into an
-        // empty assistant turn that the loop reads as a real answer.
-        if (part.type === "error")
-            return { kind: "failed", error: part.error };
-    }
-    return { kind: "end" };
-}
 /**
  * The HTTP status that each Anthropic stream error type stands for.
  *
  * A provider names a mid-stream failure in the payload, not in the status line:
  * a stream that carries `overloaded_error` reports the condition that a 529
  * names on the non-streaming wire. The classifier reads the status alone, thus
- * the part has to reach it as an error that names one, or the same condition
- * would classify one way on `chat` and another way on `chatStream`.
+ * the part has to reach it as an error that names one.
  */
 const STREAM_ERROR_STATUS = {
     invalid_request_error: 400,
@@ -466,20 +357,20 @@ const STREAM_ERROR_STATUS = {
     overloaded_error: 529,
 };
 /**
- * The failure that an `error` part of the SDK stream stands for.
+ * The failure that an `error` part of the model stream stands for.
  *
  * The part carries whatever the provider put on the wire, and that is often a
  * bare object rather than an `Error`. Left as it is, it reaches the message as
  * `[object Object]` and reaches the classifier with no status at all.
  */
 function streamPartFailure(error) {
-    if (error instanceof Error)
-        return error;
+    const thrownError = errorOf(error);
+    if (thrownError !== undefined)
+        return thrownError;
     if (typeof error !== "object" || error === null)
-        return new Error(String(error));
-    const reported = error;
-    const type = typeof reported.type === "string" ? reported.type : undefined;
-    const message = typeof reported.message === "string" ? reported.message : undefined;
+        return new Error(textOf(error));
+    const type = "type" in error && typeof error.type === "string" ? error.type : undefined;
+    const message = "message" in error && typeof error.message === "string" ? error.message : undefined;
     const failure = new Error(message ?? type ?? "The provider reported a stream error.", { cause: error });
     const status = type === undefined ? undefined : STREAM_ERROR_STATUS[type];
     // `extractStatus` walks the chain for this field, thus the named condition
@@ -489,344 +380,215 @@ function streamPartFailure(error) {
     return failure;
 }
 /**
- * The failure that an `abort` part of the SDK stream stands for.
- *
- * The part carries a message only, thus the caller signal is the one thing that
- * separates a cancellation from a timeout. When the caller signal is aborted,
- * the reason of that signal rides out, and the cancellation path applies
- * unchanged. Otherwise the SDK chunk bound stopped the stream, and the sentinel
- * names the configured value for the classifier.
+ * A part that the reader of a reply can see. A retry after one would show the
+ * reader the start of the reply again, thus a live call retries only before the
+ * first one. The same parts reset the silent-interval bound: a part that carries
+ * no content does not prove that the model writes.
  */
-function abortedStreamFailure(signal, reason, requestTimeoutMs) {
-    if (signal?.aborted === true)
-        return signal.reason;
-    if (requestTimeoutMs !== undefined)
-        return new RequestTimeoutError(requestTimeoutMs);
-    return new Error(reason ?? "The provider aborted the stream.");
+function isOutputPart(part) {
+    return part.type !== "stream-start" && part.type !== "response-metadata" && part.type !== "raw";
 }
-/** The `gen_ai.operation.name` of the operation span and of the step span that the AI SDK opens around each `chat` span. */
-function isSdkWrapperSpan(operation) {
-    return operation === "invoke_agent" || operation === "agent_step";
+/**
+ * A reader of one model stream under the silent-interval bound. The bound runs
+ * from the start of the read, and each output part resets it. A part with no
+ * content leaves the bound as it was.
+ */
+function boundedReader(stream, timeoutMs) {
+    const reader = stream.getReader();
+    let deadline = timeoutMs === undefined ? undefined : performance.now() + timeoutMs;
+    return {
+        async read() {
+            if (deadline === undefined || timeoutMs === undefined) {
+                const next = await reader.read();
+                return next.done ? { done: true } : { done: false, value: next.value };
+            }
+            const remaining = Math.max(deadline - performance.now(), 0);
+            let timer;
+            const expiry = new Promise((_resolve, reject) => {
+                // oxlint-disable-next-line eslint-js/no-restricted-syntax -- a guard, not a wait: it rejects the read of a silent stream at the bound, unrefs so an armed guard never holds a short-lived process, and the finally clears it.
+                timer = setTimeout(() => reject(new RequestTimeoutError(timeoutMs)), remaining);
+                timer.unref();
+            });
+            try {
+                const next = await Promise.race([reader.read(), expiry]);
+                if (next.done)
+                    return { done: true };
+                if (isOutputPart(next.value))
+                    deadline = performance.now() + timeoutMs;
+                return { done: false, value: next.value };
+            }
+            catch (e) {
+                void reader.cancel(e).catch(() => undefined);
+                throw e;
+            }
+            finally {
+                clearTimeout(timer);
+            }
+        },
+        cancel(reason) {
+            void reader.cancel(reason).catch(() => undefined);
+        },
+    };
+}
+/**
+ * The retry envelope of a model call, as a model middleware.
+ *
+ * Each attempt resolves the request headers of the host first: a host header can
+ * be time-limited, and the retry window can last minutes. A live call retries
+ * until its first output part, because a reader already saw each part after it.
+ * A call with no live reader takes the whole reply inside the attempt, thus a
+ * failure at any point of the stream runs the whole attempt again.
+ *
+ * After the last attempt, the failure leaves as a `ResultError` that carries the
+ * classified `ProviderError`. An abort and a rejection of the headers hook leave
+ * unchanged.
+ */
+function retryEnvelope(options) {
+    const { session, live, logger, maxRetries, suspendOn, requestTimeoutMs, onRetry } = options;
+    const workload = workloadOf(session);
+    /** The one record of a call that the envelope gave up on: the reply carries the failure, and the operator sees this. */
+    const failed = (thrown) => {
+        const failure = failureOf(thrown, workload, suspendOn);
+        logger.error("provider call failed", { workload, kind: failure.type, retryable: failure.retryable, ...logger.errorFields(thrown) });
+        return new ResultError(failure);
+    };
+    const observeFinish = (part) => {
+        if (part.type !== "finish")
+            return;
+        for (const drop of inputTransformationsOf(part.providerMetadata)) {
+            logger.warn("thinking block dropped", { workload, type: drop.type, path: drop.path, reason: drop.reason });
+        }
+        const servedBy = fallbackModelOf(part.providerMetadata);
+        if (servedBy !== undefined) {
+            logger.warn("reply served by a fallback model, thus the harness drops the thinking of that turn", {
+                workload,
+                servedBy: servedBy === "" ? undefined : servedBy,
+            });
+        }
+    };
+    return {
+        specificationVersion: "v4",
+        wrapStream: async ({ params, model }) => {
+            const signal = params.abortSignal;
+            const hookCall = { unsettled: false };
+            const retry = createRetry(signal, logger, maxRetries, suspendOn, hookCall, onRetry);
+            let opened;
+            try {
+                opened = await retry(async () => {
+                    const headers = await headersForAttempt(options.resolveRequestHeaders, session, hookCall);
+                    const { stream, ...rest } = await model.doStream({ ...params, headers: { ...params.headers, ...headers } });
+                    const reader = boundedReader(stream, requestTimeoutMs);
+                    const head = [];
+                    for (let next = await reader.read(); !next.done; next = await reader.read()) {
+                        const part = next.value;
+                        // The provider reports a wire failure as a part, and then it closes the stream.
+                        if (part.type === "error") {
+                            reader.cancel();
+                            throw streamPartFailure(part.error);
+                        }
+                        head.push(part);
+                        if (live && isOutputPart(part))
+                            return { rest, head, tail: reader };
+                    }
+                    return { rest, head };
+                });
+            }
+            catch (e) {
+                if (isAbortError(e) || signal?.aborted === true || hookCall.unsettled)
+                    throw e;
+                throw failed(e);
+            }
+            const { rest, head, tail } = opened;
+            const stream = new ReadableStream({
+                start(controller) {
+                    for (const part of head) {
+                        observeFinish(part);
+                        controller.enqueue(part);
+                    }
+                    if (tail === undefined)
+                        controller.close();
+                },
+                async pull(controller) {
+                    if (tail === undefined)
+                        return;
+                    try {
+                        const next = await tail.read();
+                        if (next.done) {
+                            controller.close();
+                            return;
+                        }
+                        const part = next.value;
+                        if (part.type === "error") {
+                            tail.cancel();
+                            controller.enqueue({ type: "error", error: failed(streamPartFailure(part.error)) });
+                            controller.close();
+                            return;
+                        }
+                        observeFinish(part);
+                        controller.enqueue(part);
+                    }
+                    catch (e) {
+                        // Past the first output part, a failure ends the reply with no retry: the reader saw its start.
+                        if (isAbortError(e) || signal?.aborted === true) {
+                            controller.error(e);
+                            return;
+                        }
+                        controller.enqueue({ type: "error", error: failed(e) });
+                        controller.close();
+                    }
+                },
+                cancel(reason) {
+                    tail?.cancel(reason);
+                },
+            });
+            return { ...rest, stream };
+        },
+    };
 }
 export function createAiSdkProvider(deps) {
     const capabilities = {
         toolCalling: deps.capabilities?.toolCalling ?? true,
         // Propagate a picture flag only when the caller states it. An absent
-        // flag stays absent, thus the loop degrades to the next placement for a
-        // wire that carries no picture there.
-        ...(deps.capabilities?.imageToolResults !== undefined ? { imageToolResults: deps.capabilities.imageToolResults } : {}),
-        ...(deps.capabilities?.imageUserMessages !== undefined ? { imageUserMessages: deps.capabilities.imageUserMessages } : {}),
-        ...(deps.capabilities?.contextWindow !== undefined ? { contextWindow: deps.capabilities.contextWindow } : {}),
+        // flag stays absent, thus the loop drops a picture for a wire that
+        // carries none in a tool result.
+        imageToolResults: deps.capabilities?.imageToolResults,
+        contextWindow: deps.capabilities?.contextWindow,
     };
     const logger = (deps.logger ?? createNoopLogger()).named("providers.ai-sdk");
     const maxOutputTokens = deps.maxOutputTokens ?? DEFAULT_MAX_OUTPUT_TOKENS;
     // The sentinel hands the SDK no ceiling, thus the request carries none and the
-    // server enforces the cap of the model. One binding feeds the call and the
-    // stream, thus the two cannot disagree about the ceiling of a request.
+    // server enforces the cap of the model.
     const outputCeiling = maxOutputTokens === "provider-maximum" ? {} : { maxOutputTokens };
     const maxRetries = deps.maxRetries ?? RETRY_MAX_RETRIES;
     const suspendOn = deps.suspendOn ?? DEFAULT_SUSPEND_ON;
     const requestTimeoutMs = deps.requestTimeoutMs;
-    const requestedModelId = requestedModelIdOf(deps.model);
-    const providerId = providerIdOf(deps.model);
-    const effortOf = (req) => req.reasoning ?? deps.reasoning ?? DEFAULT_REASONING;
-    // Each model call emits OpenTelemetry GenAI spans through the AI SDK, with no
-    // prompt or completion text on them. The integration rides on each call
-    // instead of the global registry, so the harness never traces the embedder's
-    // own AI SDK calls. Of the SDK spans only `chat` is written. The operation
-    // span and the step span around it repeat what `chat` and the span of the
-    // caller (the loop's `invoke_agent`) say already. Thus they pass through, and
-    // `chat` attaches to the span of the caller.
-    const tracer = passThroughTracer(trace.getTracer("gen_ai"), (_name, options) => isSdkWrapperSpan(options.attributes?.["gen_ai.operation.name"]));
-    const telemetry = { integrations: new OpenTelemetry({ tracer }), recordInputs: false, recordOutputs: false };
+    // Each model call and each tool call emits OpenTelemetry GenAI spans through the
+    // AI SDK, with no prompt or completion text on them. The integration rides on each
+    // call instead of the global registry, so the harness never traces the embedder's
+    // own AI SDK calls.
+    const telemetry = { integrations: new OpenTelemetry({ tracer: trace.getTracer("gen_ai") }), recordInputs: false, recordOutputs: false };
     routeSdkWarningsTo(logger);
-    /**
-     * Record a call that the envelope gave up on.
-     *
-     * The envelope reports one attempt at `debug`, thus a deployment that runs
-     * at `info` keeps no trace of a call that exhausted its retries: the reply
-     * carries the failure to the user and the operator sees nothing. This is the
-     * one record that names the outcome.
-     */
-    function logFailure(session, failure, thrown) {
-        logger.error("provider call failed", {
-            workload: workloadOf(session),
-            kind: failure.type,
-            retryable: failure.retryable,
-            ...logger.errorFields(thrown),
-        });
-    }
-    /**
-     * Logs each dropped thinking block; the drop does not fail the call.
-     * `reason` is `prefix_binding_mismatch` or `model_binding_mismatch`.
-     */
-    function logDroppedThinkingBlocks(session, metadata) {
-        for (const drop of inputTransformationsOf(metadata)) {
-            logger.warn("thinking block dropped", { workload: workloadOf(session), type: drop.type, path: drop.path, reason: drop.reason });
-        }
-    }
-    /**
-     * The reply as the harness must hold it when a fallback model served it: with no
-     * thinking block, and with the model that answered named.
-     *
-     * A reply that carries a fallback hop ({@link fallbackModelOf}) reaches the harness
-     * already short of the `fallback` content block the API put in the turn. The API holds
-     * the whole turn against the signature of each of its thinking blocks, so echoing that
-     * turn earns `thinking ... blocks in the latest assistant message cannot be modified`,
-     * which is a 400 that no retry can pass. The conversation is then dead: the loop sends
-     * its history on every request, and nothing downstream can repair a turn.
-     *
-     * A thinking block is optional on the way back, thus the reply without them is a valid
-     * turn, and the next request continues. The cost is the reasoning of this one turn and
-     * the cache write that its new prefix pays for. A reply of nothing but thinking carries
-     * no part at all, and `sanitizeMessages` drops such a message from the next request.
-     *
-     * `servedModelId` needs the same correction. {@link captureServedModelId} reads the id
-     * the response metadata of the package carries, which is `message_start.message.model`,
-     * and that field keeps the REQUESTED model across a hop. Published as it stands, it
-     * makes the usage ledger of an embedder attribute the tokens to the model that refused
-     * the work. The iteration names the model that answered, thus it wins. An iteration that
-     * names no model changes nothing: there is no better id to publish, and the record above
-     * is then the only account of the hop.
-     */
-    function settleFallbackReply(session, response, metadata) {
-        const servedBy = fallbackModelOf(metadata);
-        if (servedBy === undefined)
-            return response;
-        logger.warn("reply served by a fallback model, thus the harness drops the thinking of that turn", {
-            workload: workloadOf(session),
-            ...(servedBy === "" ? {} : { servedBy }),
+    function bind(call) {
+        const reasoning = call.reasoning ?? deps.reasoning ?? DEFAULT_REASONING;
+        const model = wrapLanguageModel({
+            model: deps.model,
+            middleware: retryEnvelope({
+                session: call.session,
+                live: call.live,
+                logger,
+                maxRetries,
+                suspendOn,
+                requestTimeoutMs,
+                resolveRequestHeaders: deps.resolveRequestHeaders,
+                onRetry: call.onRetry,
+            }),
         });
-        return {
-            ...response,
-            message: withoutThinking(response.message),
-            ...(servedBy === "" ? {} : { servedModelId: servedBy }),
-        };
-    }
-    function chat(req, session, signal) {
-        const reasoning = effortOf(req);
-        const providerOptions = deps.providerOptionsFor?.({ session, reasoning });
-        const run = async () => {
-            const hookCall = { unsettled: false };
-            const retry = createRetry(signal, logger, maxRetries, suspendOn, hookCall);
-            const capture = captureServedModelId(deps.model);
-            try {
-                const collected = await retry(async () => {
-                    // The hook runs before each attempt: a host header can be
-                    // time-limited, and the retry window can last minutes.
-                    const headers = await headersForAttempt(deps.resolveRequestHeaders, session, hookCall);
-                    // The call streams on the wire and collapses below.
-                    //
-                    // A non-streaming turn sends no header until the model completes,
-                    // thus the `headersTimeout` of the host HTTP client bounds the whole
-                    // generation. No option of the SDK lifts that bound, because it sits
-                    // under the fetch. Node defaults the field to 300s, and a turn near
-                    // 18k output tokens reaches it, while `DEFAULT_MAX_OUTPUT_TOKENS`
-                    // asks for up to 64k. A cut turn then costs twice: the envelope
-                    // starts the same generation again from zero.
-                    //
-                    // Anthropic states the rule for its own SDKs: a large `max_tokens`
-                    // makes streaming necessary, to prevent an HTTP timeout. Thus a
-                    // ceiling this size streams whether or not a consumer wants the
-                    // deltas, and `chatStream` stays the seam that forwards them.
-                    const result = streamText({
-                        model: capture.model,
-                        system: req.system,
-                        messages: sanitizeMessages(req.messages),
-                        tools: req.tools,
-                        toolChoice: req.toolChoice ?? "auto",
-                        ...outputCeiling,
-                        stopWhen: [],
-                        // The harness envelope owns retries; leaving the SDK default in
-                        // place would multiply attempts (10 outer × 3 inner).
-                        maxRetries: 0,
-                        headers,
-                        abortSignal: signal,
-                        telemetry,
-                        // `firstChunkMs` bounds the wait for the first content chunk,
-                        // and `chunkMs` bounds each later gap. Thus each silent interval
-                        // carries the one configured bound, and a turn that writes
-                        // steadily runs as long as it needs.
-                        ...(requestTimeoutMs !== undefined ? { timeout: { firstChunkMs: requestTimeoutMs, chunkMs: requestTimeoutMs } } : {}),
-                        providerOptions,
-                        reasoning,
-                    });
-                    // The drain sits inside the retried closure, thus a failure at any
-                    // point of the stream re-runs the whole attempt and the envelope
-                    // keeps its whole-call scope. No delta reaches a consumer here —
-                    // `chatStream` is the seam that forwards them.
-                    const iterator = result.fullStream[Symbol.asyncIterator]();
-                    let text = "";
-                    for (let pull = await pullNextDelta(iterator); pull.kind !== "end"; pull = await pullNextDelta(iterator)) {
-                        // A caller abort rides out as the reason of its own signal, thus
-                        // it stays a cancellation and reaches the caller as a throw.
-                        if (pull.kind === "aborted")
-                            throw abortedStreamFailure(signal, pull.reason, requestTimeoutMs);
-                        if (pull.kind === "failed")
-                            throw streamPartFailure(pull.error);
-                        text += pull.text;
-                    }
-                    // These promises settle only once the stream is fully drained, thus
-                    // the loop above must reach its end before this point.
-                    return {
-                        messages: await result.responseMessages,
-                        fallbackText: text,
-                        finishReason: await result.finishReason,
-                        rawFinishReason: await result.rawFinishReason,
-                        usage: await result.usage,
-                        providerMetadata: (await result.finalStep).providerMetadata,
-                    };
-                });
-                // Logged past the envelope, thus only the attempt that succeeded
-                // reports its drops.
-                const { providerMetadata: metadata, ...reply } = collected;
-                logDroppedThinkingBlocks(session, metadata);
-                return ok(settleFallbackReply(session, responseFromMessages({
-                    ...reply,
-                    requestedModelId,
-                    // Read after the drain: the metadata chunk that carries the
-                    // served id reaches the capture only as the stream is consumed.
-                    servedModelId: capture.servedModelId(),
-                    provider: providerId,
-                }), metadata));
-            }
-            catch (e) {
-                if (isAbortError(e) || signal?.aborted || hookCall.unsettled)
-                    throw e;
-                const failure = failureOf(e, workloadOf(session), suspendOn);
-                logFailure(session, failure, e);
-                return err(failure);
-            }
-        };
-        return new ResultAsync(run());
-    }
-    async function* chatStream(req, session, signal) {
-        const reasoning = effortOf(req);
-        const providerOptions = deps.providerOptionsFor?.({ session, reasoning });
-        const hookCall = { unsettled: false };
-        const retry = createRetry(signal, logger, maxRetries, suspendOn, hookCall);
-        const capture = captureServedModelId(deps.model);
-        try {
-            // Retry covers only stream establishment: streamText defers wire errors
-            // to consumption, so a failure is not visible until the stream is read.
-            // The retried closure resolves to one of two outcomes — the stream is
-            // live with a first delta in hand, or it finished without yielding any
-            // text — and a delta is only ever yielded OUTSIDE the closure, so a
-            // retried attempt can never re-emit a delta the consumer already saw.
-            const opened = await retry(async () => {
-                const headers = await headersForAttempt(deps.resolveRequestHeaders, session, hookCall);
-                const result = streamText({
-                    model: capture.model,
-                    system: req.system,
-                    messages: sanitizeMessages(req.messages),
-                    tools: req.tools,
-                    toolChoice: req.toolChoice ?? "auto",
-                    ...outputCeiling,
-                    stopWhen: [],
-                    maxRetries: 0,
-                    headers,
-                    abortSignal: signal,
-                    telemetry,
-                    // The fetch guard bounds the wait until the headers. Past the
-                    // headers the SDK owns two bounds: `firstChunkMs` covers the wait
-                    // for the first content chunk, and `chunkMs` covers each later
-                    // gap. The two take the same value, thus each silent interval of
-                    // the stream has the one configured bound. A chunk that carries
-                    // no content, for example a keep-alive comment, produces no part,
-                    // thus it feeds neither bound.
-                    ...(requestTimeoutMs !== undefined ? { timeout: { firstChunkMs: requestTimeoutMs, chunkMs: requestTimeoutMs } } : {}),
-                    providerOptions,
-                    reasoning,
-                });
-                const iterator = result.fullStream[Symbol.asyncIterator]();
-                const first = await pullNextDelta(iterator);
-                // The chunk bound can stop the stream before any content arrives. The
-                // throw carries the sentinel, thus the envelope gives the attempt a
-                // fresh window under the retry policy of a connection error.
-                if (first.kind === "aborted")
-                    throw abortedStreamFailure(signal, first.reason, requestTimeoutMs);
-                if (first.kind === "failed")
-                    throw streamPartFailure(first.error);
-                if (first.kind === "end") {
-                    // A doStream promise rejection — the shape a real connection
-                    // failure takes — does NOT surface at this first pull: streamText
-                    // resolves it `{ done: true }` and defers the rejection to the
-                    // deferred result promises. Awaiting them here brings that failure
-                    // inside the retry envelope so a text-less establishment error is
-                    // retried; a genuine text-less turn resolves them, and the terminal
-                    // event is built from these already-resolved values without a
-                    // second await. (These promises only settle once the stream is
-                    // fully drained, so they can be awaited here only because the pull
-                    // already reported the stream done.)
-                    return {
-                        kind: "completed",
-                        messages: await result.responseMessages,
-                        finishReason: await result.finishReason,
-                        rawFinishReason: await result.rawFinishReason,
-                        usage: await result.usage,
-                        providerMetadata: (await result.finalStep).providerMetadata,
-                    };
-                }
-                return { kind: "streaming", result, iterator, firstDelta: first.text };
-            });
-            if (opened.kind === "completed") {
-                logDroppedThinkingBlocks(session, opened.providerMetadata);
-                const response = settleFallbackReply(session, responseFromMessages({
-                    messages: opened.messages,
-                    fallbackText: "",
-                    finishReason: opened.finishReason,
-                    rawFinishReason: opened.rawFinishReason,
-                    usage: opened.usage,
-                    requestedModelId,
-                    servedModelId: capture.servedModelId(),
-                    provider: providerId,
-                }), opened.providerMetadata);
-                yield { type: "done", response };
-                return;
-            }
-            const { result, iterator, firstDelta } = opened;
-            let text = firstDelta;
-            yield { type: "text-delta", text: firstDelta };
-            // Drain the same iterator: past the first delta, errors propagate
-            // unchanged (no retry, no re-emit).
-            for (let pull = await pullNextDelta(iterator); pull.kind !== "end"; pull = await pullNextDelta(iterator)) {
-                // A mid-stream abort ends the turn with an error, never with the
-                // partial text that arrived before it. The catch below builds the
-                // terminal `ProviderError` from the throwable.
-                if (pull.kind === "aborted")
-                    throw abortedStreamFailure(signal, pull.reason, requestTimeoutMs);
-                if (pull.kind === "failed")
-                    throw streamPartFailure(pull.error);
-                text += pull.text;
-                yield { type: "text-delta", text: pull.text };
-            }
-            const metadata = (await result.finalStep).providerMetadata;
-            const response = settleFallbackReply(session, responseFromMessages({
-                messages: await result.responseMessages,
-                fallbackText: text,
-                finishReason: await result.finishReason,
-                rawFinishReason: await result.rawFinishReason,
-                usage: await result.usage,
-                requestedModelId,
-                // Read after the drain: the metadata chunk carrying the served id
-                // reaches the capture only as the stream is consumed.
-                servedModelId: capture.servedModelId(),
-                provider: providerId,
-            }), metadata);
-            logDroppedThinkingBlocks(session, metadata);
-            yield { type: "done", response };
-        }
-        catch (e) {
-            if (isAbortError(e) || signal?.aborted || hookCall.unsettled)
-                throw e;
-            const failure = failureOf(e, workloadOf(session), suspendOn);
-            logFailure(session, failure, e);
-            throw failure;
-        }
+        const providerOptions = deps.providerOptionsFor?.({ session: call.session, reasoning });
+        return { model, settings: { ...outputCeiling, reasoning, providerOptions }, telemetry };
     }
     // The provider advertises the guard limit on its own instance, thus a
     // consumer that scales a deadline reads it from the provider in its deps.
-    return { capabilities, chat, chatStream, ...(requestTimeoutMs !== undefined ? { requestTimeoutMs } : {}) };
+    return { capabilities, bind, requestTimeoutMs };
 }
 /**
  * Wrap a fetch so that the wait until the response starts does not exceed
@@ -837,24 +599,23 @@ export function createAiSdkProvider(deps) {
  * signal through `AbortSignal.any`. Thus the caller signal keeps its normal
  * effect, and a caller abort stays a cancellation.
  *
- * The guard bounds the response start only. The SDK bounds each later gap of a
- * streamed body with its own `chunkMs` setting, thus no timer of the wrapper
- * survives the headers. Thus a stream with steady content does not trip the
- * guard, whatever its total length. One fetch call is one attempt, because the
- * SDK retries are off, thus the window is per attempt.
+ * The guard bounds the response start only. The retry envelope bounds each later
+ * gap of a streamed body, thus no timer of the wrapper survives the headers. One
+ * fetch call is one attempt, because the SDK retries are off, thus the window is
+ * per attempt.
  *
  * When the field is absent, `createConfiguredAiSdkProvider` installs no wrapper,
  * and the behavior stays byte-identical.
  */
 export function wrapFetchWithRequestTimeout(fetchImpl, requestTimeoutMs) {
-    return async (input, init) => {
+    return Object.assign(async (input, init) => {
         const controller = new AbortController();
         const callerSignal = init?.signal ?? undefined;
+        // oxlint-disable-next-line eslint-js/no-restricted-syntax -- a guard, not a wait: it aborts the controller of the in-flight fetch at the deadline, unrefs so an armed guard never holds a short-lived process, and the finally clears it.
         const timer = setTimeout(() => controller.abort(new RequestTimeoutError(requestTimeoutMs)), requestTimeoutMs);
         // The harness runs on Node, where a timer has `unref`. Unref the guard
         // timer, thus an armed guard does not keep a short-lived process alive.
-        // The DOM type of `setTimeout` declares no `unref`, thus guard the call.
-        timer.unref?.();
+        timer.unref();
         const clear = () => {
             clearTimeout(timer);
             // The harness runs on Node, where a caller signal can outlive one fetch
@@ -874,7 +635,7 @@ export function wrapFetchWithRequestTimeout(fetchImpl, requestTimeoutMs) {
         // is inert there. A probe on Bun 1.4.2 proved both results: the cut fired
         // at 360 seconds, because Bun pads the timer to its minute wheel, and a
         // request with the key completed after 420 seconds. The `RequestInit` type
-        // declares no such member, thus the cast.
+        // declares no such member, thus the wider annotation.
         const forwarded = { ...init, signal, timeout: false };
         try {
             return await fetchImpl(input, forwarded);
@@ -882,7 +643,10 @@ export function wrapFetchWithRequestTimeout(fetchImpl, requestTimeoutMs) {
         finally {
             clear();
         }
-    };
+    }, 
+    // `typeof fetch` is a callable with the `preconnect` member of the Bun declaration, so the
+    // wrapper carries the member of the fetch it wraps.
+    { preconnect: fetchImpl.preconnect });
 }
 /**
  * Bind one explicit `store` directive onto each call of a model.
@@ -898,7 +662,7 @@ function withStoreDirective(model, store) {
     return wrapLanguageModel({
         model,
         middleware: {
-            transformParams: async ({ params }) => ({
+            transformParams: ({ params }) => Promise.resolve({
                 ...params,
                 providerOptions: { ...params.providerOptions, openai: { ...params.providerOptions?.openai, store } },
             }),
@@ -907,22 +671,21 @@ function withStoreDirective(model, store) {
 }
 export function hostPolicyOf(deps) {
     return {
-        ...(deps.resolveRequestHeaders !== undefined ? { resolveRequestHeaders: deps.resolveRequestHeaders } : {}),
-        ...(deps.suspendOn !== undefined ? { suspendOn: deps.suspendOn } : {}),
+        resolveRequestHeaders: deps.resolveRequestHeaders,
+        suspendOn: deps.suspendOn,
     };
 }
 /**
  * Realize an `AiSdkProviderConfig` into a `ChatProvider` bound to that config's
- * connection and model. The model is closed into the returned provider here (it
- * is never passed per `ChatRequest`), so N models require N provider
- * instances over one shared connection configuration — one instance serves the
- * single model it was built with.
+ * connection and model. The model is closed into the returned provider here, so
+ * N models require N provider instances over one shared connection
+ * configuration — one instance serves the single model it was built with.
  *
  * When the config sets `requestTimeoutMs`, the provider wraps the effective fetch
- * (`config.fetch ?? globalThis.fetch`) with the response-start guard, it hands
- * the value to the stream call as the SDK chunk bound, and it advertises the
- * value on the returned instance. When the field is absent, it installs no
- * wrapper, it hands the SDK no bound, and it advertises no value.
+ * (`config.fetch ?? globalThis.fetch`) with the response-start guard, the retry
+ * envelope bounds each later silent interval with the same value, and the
+ * provider advertises the value on the returned instance. When the field is
+ * absent, it installs no wrapper, it bounds nothing, and it advertises no value.
  */
 export function createConfiguredAiSdkProvider(deps) {
     const config = deps.config;
@@ -950,16 +713,16 @@ export function createConfiguredAiSdkProvider(deps) {
             ...hostPolicyOf(deps),
             capabilities: { ...pictureDefault, ...config.capabilities },
             logger: deps.logger,
-            ...(config.maxOutputTokens !== undefined ? { maxOutputTokens: config.maxOutputTokens } : {}),
-            ...(config.maxRetries !== undefined ? { maxRetries: config.maxRetries } : {}),
-            ...(requestTimeoutMs !== undefined ? { requestTimeoutMs } : {}),
-            ...(config.reasoning !== undefined ? { reasoning: config.reasoning } : {}),
+            maxOutputTokens: config.maxOutputTokens,
+            maxRetries: config.maxRetries,
+            requestTimeoutMs,
+            reasoning: config.reasoning,
             // The package sends the key as `metadata.user_id`, and the binding as
             // `thinking.block_binding`.
             providerOptionsFor: ({ session, reasoning }) => ({
                 anthropic: {
                     metadata: { userId: sessionKeyDigestOf(session) },
-                    ...(binding !== undefined ? { thinking: thinkingWithBinding(reasoning, binding) } : {}),
+                    thinking: binding === undefined ? undefined : thinkingWithBinding(reasoning, binding),
                 },
             }),
         });
@@ -992,9 +755,9 @@ export function createConfiguredAiSdkProvider(deps) {
             // unset config sends no ceiling, and the server holds the reply at the
             // cap of the model.
             maxOutputTokens: config.maxOutputTokens ?? "provider-maximum",
-            ...(config.maxRetries !== undefined ? { maxRetries: config.maxRetries } : {}),
-            ...(requestTimeoutMs !== undefined ? { requestTimeoutMs } : {}),
-            ...(config.reasoning !== undefined ? { reasoning: config.reasoning } : {}),
+            maxRetries: config.maxRetries,
+            requestTimeoutMs,
+            reasoning: config.reasoning,
             // The package sends the key as `prompt_cache_key`. The store
             // directive merges into the same namespace, and it keeps this key.
             providerOptionsFor: ({ session }) => ({ openai: { promptCacheKey: sessionKeyDigestOf(session) } }),
@@ -1005,10 +768,12 @@ export function createConfiguredAiSdkProvider(deps) {
         baseURL: config.baseURL,
         apiKey: config.apiKey,
         fetch: effectiveFetch,
-        // Each call of the provider streams, `chat` included. Without this flag
-        // the package asks for no usage on a stream, and the call reports none.
+        // Each call of the provider streams. Without this flag the package asks for
+        // no usage on a stream, and the call reports none.
         includeUsage: true,
+        supportsMultiPartToolContent: config.supportsMultiPartToolContent,
     });
+    const pictureDefault = config.supportsMultiPartToolContent === true ? { imageToolResults: true } : {};
     // The compatible wire has no standard field for a session key, thus this arm
     // gives no provider options of its own.
     return createAiSdkProvider({
@@ -1016,11 +781,11 @@ export function createConfiguredAiSdkProvider(deps) {
         // the seam needs no middleware to carry the depth into its namespace.
         model: provider.chatModel(config.model),
         ...hostPolicyOf(deps),
-        capabilities: config.capabilities,
+        capabilities: { ...pictureDefault, ...config.capabilities },
         logger: deps.logger,
-        ...(config.maxOutputTokens !== undefined ? { maxOutputTokens: config.maxOutputTokens } : {}),
-        ...(config.maxRetries !== undefined ? { maxRetries: config.maxRetries } : {}),
-        ...(requestTimeoutMs !== undefined ? { requestTimeoutMs } : {}),
-        ...(config.reasoning !== undefined ? { reasoning: config.reasoning } : {}),
+        maxOutputTokens: config.maxOutputTokens,
+        maxRetries: config.maxRetries,
+        requestTimeoutMs,
+        reasoning: config.reasoning,
     });
 }