@plurnk/plurnk-providers 1.14.2 → 1.16.0

package/src/AiSdkProvider.ts

@@ -6,38 +6,18 @@
 // ordinary vendor protocol. The compatible URL path remains only for PLURNK
 // extensions and local endpoint probes the SDK cannot represent.
 
-import type {
-    ChatMessage,
-    GrammarEvidence,
-    PromptTokenMeasurement,
-    Provider,
-    ProviderAttempt,
-    ProviderCostNormalizer,
-    ProviderCallKind,
-    ProviderGenerateArgs,
-    ProviderRequestAccounting,
-    ProviderRequestCapacity,
-    ProviderRequestSettlement,
-    ProviderResponse,
-    ProviderUsage,
-    ReasoningPolicy,
-} from "./types.ts";
+import type { ChatMessage, GrammarEvidence, PromptTokenMeasurement, Provider, ProviderAttempt, ProviderCostNormalizer, ProviderGenerateArgs, ProviderRequestAccounting, ProviderRequestCapacity, ProviderRequestSettlement, ProviderResponse, ProviderUsage, ReasoningPolicy } from "./types.ts";
 import type { ProviderCost } from "@plurnk/plurnk-contracts";
 import { REASONING_POLICIES } from "@plurnk/plurnk-contracts";
 import type { CallWarning, JSONValue } from "ai";
 import { MAX_PROVIDER_TIMEOUT_MS, type Reasoning, type ReasoningResponseStyle } from "./env.ts";
 import { UnsupportedReasoningPolicyError } from "./types.ts";
-import {
-    executeAiSdkModel,
-    executeOpenAICompatible,
-    transportFailureOutputObserved,
-    transportFailureEvidence,
-} from "./aiSdkTransport.ts";
+import type { InputModality } from "./types.ts";
+import { executeAiSdkModel, executeOpenAICompatible, transportFailureOutputObserved, transportFailureEvidence } from "./aiSdkTransport.ts";
 import type { LanguageModel } from "ai";
 import { prepareRetries } from "ai/internal";
 import { toProviderError, ProviderError, ProviderTimeoutError } from "./errors.ts";
 import type { ProviderNotice } from "./notices.ts";
-import { validateGbnf } from "@plurnk/gbnf";
 import { assertPromptTokenMeasurement, estimatePromptTokens } from "./promptTokens.ts";
 import { emitWarningOnce } from "./warnings.ts";
 import type { PluginAttribution, PluginAttributionContext } from "@plurnk/plurnk-meta";
@@ -45,9 +25,33 @@ import { resolveProviderCost } from "./cost.ts";
 import { validateProviderRequestAccounting } from "./accounting.ts";
 import { validateProviderUsage } from "./usage.ts";
 import { assessRequestCapacity, effectiveInputCapacity, effectiveOutputBudget, effectiveReasoningBudget } from "./capacity.ts";
+import { nativeFixedEffort } from "./reasoning-effort.ts";
+import AiSdkRequestBody from "./AiSdkRequestBody.ts";
 
 export type ProviderFetch = typeof globalThis.fetch;
 
+// {§provider-connectivity} — an AbortSignal is advisory: a wedged transport that never observes it can
+// hang the await past the deadline (#505). This backstops the deadline the same way an embedding request
+// bounds a wedged adapter (#463): once the signal fires, a well-behaved transport unwinds and settles its
+// own attempt (and accounting) within a short grace, and that path wins the race untouched; only a
+// transport still wedged after the grace is force-rejected with the signal's own reason, so the existing
+// operation/cancellation classification is unchanged. The grace is unwind slack, not a second deadline.
+const OPERATION_DEADLINE_UNWIND_GRACE_MS = 1_000;
+
+const raceAgainstDeadline = async <T>(work: PromiseLike<T>, signal: AbortSignal): Promise<T> => {
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    const backstop = new Promise<never>((_resolve, reject) => {
+        const arm = (): void => { timer = setTimeout(() => reject(signal.reason), OPERATION_DEADLINE_UNWIND_GRACE_MS); };
+        if (signal.aborted) arm();
+        else signal.addEventListener("abort", arm, { once: true });
+    });
+    try {
+        return await Promise.race([work, backstop]);
+    } finally {
+        if (timer !== undefined) clearTimeout(timer);
+    }
+};
+
 // Backend wire spellings for the resolved reasoning intent. The switch beside each
 // mapping retains any backend-specific omission/explicit-disable constraint.
 export type ReasoningStyle = "none" | "think" | "include_reasoning" | "effort" | "effort_explicit" | "effort_required" | "thinking_effort" | "template" | "anthropic";
@@ -65,24 +69,7 @@ export type CacheAffinity =
 
 export type AiSdkProviderOptions = Record<string, Record<string, JSONValue | undefined>>;
 
-const isJsonObject = (value: JSONValue | undefined): value is Record<string, JSONValue> =>
-    typeof value === "object" && value !== null && !Array.isArray(value);
 
-const mergeJsonObjects = (
-    left: Record<string, JSONValue | undefined>,
-    right: Record<string, JSONValue | undefined>,
-): Record<string, JSONValue | undefined> => Object.fromEntries(
-    [...new Set([...Object.keys(left), ...Object.keys(right)])].map((key) => {
-        const leftValue = left[key];
-        const rightValue = right[key];
-        return [
-            key,
-            isJsonObject(leftValue) && isJsonObject(rightValue)
-                ? mergeJsonObjects(leftValue, rightValue)
-                : rightValue ?? leftValue,
-        ];
-    }),
-);
 
 export type AiSdkProviderConfig = {
     model: string;
@@ -96,6 +83,7 @@ export type AiSdkProviderConfig = {
     headers?: Record<string, string>;         // fully-resolved request headers (incl. auth); default {}
     fetch?: ProviderFetch;                    // per-instance request executor; default globalThis.fetch
     contextWindow?: number | null;              // default null; caller resolves-or-fails, narrows to required with the interface
+    inputModalities?: ReadonlySet<InputModality>; // {§provider-input-modalities} — native parts the route's model accepts; default none
     maxInputTokens?: number | null;
     maxOutputTokens?: number | null;
     outputBudget?: number | null;
@@ -310,32 +298,6 @@ const projectTemplateReasoning = (content: string): TaggedReasoningProjection =>
     return { content, reasoning: "", projected: false, contentStart: 0 };
 };
 
-const fixedEffort = (mode: ReasoningPolicy): "low" | "medium" | "high" | "xhigh" | "max" => {
-    if (mode === "low" || mode === "medium" || mode === "high" || mode === "xhigh" || mode === "max") return mode;
-    throw new TypeError(`reasoning policy '${mode}' is not a fixed effort`);
-};
-
-// The native SDK effort surface tops at xhigh; admission never grants a native
-// route "max", so reaching it here is a contract violation, not a fallback site.
-const nativeFixedEffort = (mode: ReasoningPolicy): "low" | "medium" | "high" | "xhigh" => {
-    const effort = fixedEffort(mode);
-    if (effort === "max") throw new TypeError(`reasoning policy 'max' has no native SDK effort surface`);
-    return effort;
-};
-
-// Anthropic's older manual-reasoning protocol needs an absolute allowance while
-// PLURNK's durable contract names an effort. These fractions match the native
-// SDK's policy projection, but apply to PLURNK's total envelope rather than the
-// model's physical maximum. The minimum is imposed by the provider protocol.
-const MANUAL_REASONING_FRACTIONS = Object.freeze({
-    adaptive: 0.6,
-    low: 0.1,
-    medium: 0.3,
-    high: 0.6,
-    xhigh: 0.75,
-    max: 0.85,
-} satisfies Record<Exclude<ReasoningPolicy, "off">, number>);
-const MANUAL_REASONING_MINIMUM = 1024;
 
 const providerWarningMessage = (warning: CallWarning): string => {
     switch (warning.type) {
@@ -347,27 +309,6 @@ const providerWarningMessage = (warning: CallWarning): string => {
     }
 };
 
-// Body keys the provider owns — a caller's `sampling` passthrough may not set
-// these. Two families:
-//   transport/managed — grammar transport, the stream/JSON choice, slot pinning,
-//     data capture ({§provider-evidence}: backend-specific fields never cross the contract);
-//   contract invariants — `n` (atomic single completion: choices[0] is the
-//     response; n>1 = paid, dropped output), the tool-calling family (tools-in-
-//     body doctrine, §2: native tool_calls return null content = a broken turn),
-//     modalities/audio (text-only contract), prediction (decode semantics, not
-//     sampling), and the token caps (the envelope is the managed maxOutputTokens —
-//     sampling must not bypass the consumer's cap).
-// Sampling intent (temperature, top_p, penalties, stop, seed, logit_bias) and
-// platform knobs (user, service_tier, prompt_cache_*, safety_identifier,
-// metadata, store, verbosity) pass through; the managed floors spread UNDER
-// sampling stay deliberately caller-overridable.
-const RESERVED_BODY_KEYS: ReadonlySet<string> = new Set([
-    "model", "messages", "stream", "stream_options", "grammar", "response_format", "id_slot", "logprobs", "top_logprobs",
-    "reasoning_format", "reasoning_effort", "thinking", "think", "include_reasoning", "chat_template_kwargs", "thinking_budget_tokens", // lexicon-allow: backend wire fields
-    "n", "tools", "tool_choice", "functions", "function_call", "parallel_tool_calls",
-    "modalities", "audio", "prediction", "max_tokens", "max_completion_tokens",
-    "prompt_cache_key",
-]);
 
 export default class AiSdkProvider implements Provider {
     #model: string;
@@ -383,6 +324,7 @@ export default class AiSdkProvider implements Provider {
     #apiKeyRejectedMessage: string | undefined;
     #eosText: string | undefined;
     #contextWindow: number | null;
+    #inputModalities: ReadonlySet<InputModality>;
     #maxInputTokens: number | null;
     #maxOutputTokens: number | null;
     #outputBudget: number | null;
@@ -433,6 +375,7 @@ export default class AiSdkProvider implements Provider {
     // tokenizeUrl (llama-server), so `provider.tokenize === undefined` remains
     // the honest capability signal for every other backend.
     tokenize?: (text: string) => Promise<number[]>;
+    readonly #requestBody: AiSdkRequestBody;
     constructor(config: AiSdkProviderConfig) {
         this.#model = config.model;
         this.#url = config.url;
@@ -458,6 +401,7 @@ export default class AiSdkProvider implements Provider {
         this.#headers = config.headers ?? {};
         this.#fetch = config.fetch ?? ((input, init) => globalThis.fetch(input, init));
         this.#contextWindow = config.contextWindow ?? null;
+        this.#inputModalities = config.inputModalities ?? new Set();
         this.#maxInputTokens = config.maxInputTokens ?? null;
         this.#maxOutputTokens = config.maxOutputTokens ?? null;
         this.#outputBudget = config.outputBudget ?? null;
@@ -596,9 +540,11 @@ export default class AiSdkProvider implements Provider {
                 return tokens;
             };
         }
+        this.#requestBody = new AiSdkRequestBody({ reasoningBudget: this.#reasoningBudget, additiveReasoningProvider: this.#additiveReasoningProvider, reasoning: this.#reasoning, reasoningToggle: this.#reasoningToggle, compatibleAdaptiveReasoning: this.#compatibleAdaptiveReasoning, compatibleOffReasoning: this.#compatibleOffReasoning, adaptiveReasoningProviderOptions: this.#adaptiveReasoningProviderOptions, repeatPenalty: this.#repeatPenalty, frequencyPenalty: this.#frequencyPenalty, dryMultiplier: this.#dryMultiplier, dryBase: this.#dryBase, dryAllowedLength: this.#dryAllowedLength, repeatLastN: this.#repeatLastN, reasoningStyle: this.#reasoningStyle, source: this.#source, grammarStyle: this.#grammarStyle, cacheAffinity: this.#cacheAffinity, reasoningResponseProviderOptions: this.#reasoningResponseProviderOptions, firstPartyMetadata: this.#firstPartyMetadata, supportsSlotPinning: this.#supportsSlotPinning, slotCount: this.#slotCount });
     }
 
     get contextWindow(): number | null { return this.#contextWindow; }
+    get inputModalities(): ReadonlySet<InputModality> { return this.#inputModalities; }
     get maxInputTokens(): number | null { return this.#maxInputTokens; }
     get maxOutputTokens(): number | null { return this.#maxOutputTokens; }
     get outputBudget(): number | null { return this.#outputBudget; }
@@ -648,7 +594,7 @@ export default class AiSdkProvider implements Provider {
                 body: JSON.stringify({
                     model: this.#model,
                     messages,
-                    ...this.#reasoningBody(),
+                    ...this.#requestBody.reasoningBody(),
                 }),
                 ...(requestSignal === undefined ? {} : { signal: requestSignal }),
             });
@@ -703,204 +649,6 @@ export default class AiSdkProvider implements Provider {
             measurement: await this.countPromptTokens(messages, signal),
         });
     }
-    // Reasoning activation and allowance are independent of grammar transport;
-    // only the response representation becomes lossless when evidence is needed.
-    // The llama-server template mapping is owned by {§llama-reasoning-request}.
-    #reasoningBody(
-        preserveGrammarSentence = false,
-        reasoningBudget = this.#reasoningBudget,
-    ): Record<string, unknown> {
-        const { mode } = this.#reasoning;
-        const budget = reasoningBudget;
-        const on = mode !== "off";
-        switch (this.#reasoningStyle) {
-            case "template": {
-                const allowance = mode === "off"
-                    ? 0
-                    : budget;
-                // A fixed effort rides into the template as its own variable; adaptive
-                // and off send none and leave the template's default in force.
-                const templateEffort = mode === "off" || mode === "adaptive" ? {} : { reasoning_effort: fixedEffort(mode) };
-                return {
-                    chat_template_kwargs: { enable_thinking: on, ...templateEffort },
-                    reasoning_format: preserveGrammarSentence ? "none" : "auto",
-                    ...(allowance === null ? {} : { thinking_budget_tokens: allowance }),
-                };
-            }
-            case "think": return on ? { think: true } : {};
-            case "include_reasoning": return on ? { include_reasoning: true } : {};
-            case "effort": return mode === "off"
-                ? this.#compatibleOffReasoning === undefined
-                    ? {}
-                    : { reasoning_effort: this.#compatibleOffReasoning }
-                : mode === "adaptive"
-                    ? this.#compatibleAdaptiveReasoning === "provider-default"
-                        ? {}
-                        : { reasoning_effort: this.#compatibleAdaptiveReasoning }
-                    : { reasoning_effort: fixedEffort(mode) };
-            // Graded reasoning is mandatory when the route advertises an effort
-            // value. Cataloged routes supply the exact strongest legal value;
-            // construction rejects an unsupported off or fixed policy.
-            case "effort_required": {
-                if (mode === "off") {
-                    if (this.#compatibleOffReasoning === undefined) {
-                        throw new TypeError(`${this.#source}: required reasoning effort has no off projection`);
-                    }
-                    return { reasoning_effort: this.#compatibleOffReasoning };
-                }
-                if (mode === "adaptive") {
-                    return this.#compatibleAdaptiveReasoning === "provider-default"
-                        ? {}
-                        : { reasoning_effort: this.#compatibleAdaptiveReasoning };
-                }
-                return { reasoning_effort: fixedEffort(mode) };
-            }
-            // Fireworks enum: OFF is sent EXPLICITLY ("none") — omission leaves a
-            // reason-by-default model (DeepSeek V4: default 'high') reasoning.
-            // ADAPTIVE omits the field UNLESS the catalog declares a toggle control:
-            // toggle routes (nemotron-lightning) default reasoning OFF, so adaptive
-            // sends the documented Fireworks Boolean enable (#457). The literal
-            // "adaptive" is MiniMax-M3-only — Fireworks 400s it for every other
-            // model (wire-verified; the 1.0.2 adaptive default refused to boot on
-            // it). V4 gotcha: integer efforts 400.
-            case "effort_explicit": return mode === "off"
-                ? { reasoning_effort: "none" }
-                : mode === "adaptive"
-                    ? this.#reasoningToggle ? { reasoning_effort: true } : {}
-                    : { reasoning_effort: fixedEffort(mode) };
-            // {§deepseek-reasoning-request}
-            case "thinking_effort": return mode === "off"
-                ? { thinking: { type: "disabled" } }
-                : mode === "adaptive" ? { thinking: { type: "enabled" } } : {
-                    thinking: { type: "enabled" },
-                    reasoning_effort: fixedEffort(mode),
-                };
-            // Anthropic-compatible native dynamic or manual budget mode.
-            case "anthropic": return mode === "off"
-                ? { thinking: { type: "disabled" } }
-                : mode === "adaptive" ? { thinking: { type: "adaptive" } } : {
-                    thinking: {
-                        type: "enabled",
-                        budget_tokens: budget!,
-                    },
-                };
-            case "none": return {};
-        }
-    }
-
-    // Per-worker slot affinity: the consumer passes which worker this is; the
-    // provider owns WHICH slot serves it. Sticky per workerId, round-robin across
-    // new runs (distinct runs → distinct slots while slots last), LRU-bounded
-    // bookkeeping so a long-lived daemon never grows the map unboundedly —
-    // an evicted-and-returning run simply re-pins, worst case one cold prefill.
-    #runSlots = new Map<string, number>();
-    #nextSlot = 0;
-
-    #slotBody(workerId: string): Record<string, unknown> {
-        if (!this.#supportsSlotPinning || this.#slotCount === null || this.#slotCount < 1) return {};
-        let slot = this.#runSlots.get(workerId);
-        if (slot === undefined) {
-            slot = this.#nextSlot++ % this.#slotCount;
-            if (this.#runSlots.size >= this.#slotCount * 8) {
-                this.#runSlots.delete(this.#runSlots.keys().next().value as string);
-            }
-        } else {
-            this.#runSlots.delete(workerId); // re-insert to refresh LRU recency
-        }
-        this.#runSlots.set(workerId, slot);
-        return { id_slot: slot };
-    }
-
-    // Optional local llama-server GBNF transport ({§gbnf-response-observation}). Unsupported
-    // backends receive no grammar-related field.
-    #grammarBody(grammar: string | undefined): Record<string, unknown> {
-        if (grammar === undefined) return {};
-        switch (this.#grammarStyle) {
-            // Grammar-constrained decoding can loop under the mask; a configured
-            // per-alias repeat_penalty is the measured remedy ({§provider-sampling-passthrough}).
-            case "llamacpp": return { grammar, ...(this.#repeatPenalty !== null ? { repeat_penalty: this.#repeatPenalty } : {}) };
-            case "none": return {};
-        }
-    }
-
-    // Anti-degeneration default on every request, keyed to the backend's wire
-    // convention - NOT grammar-bound. GBNF is a local constraint, so a cloud
-    // alias runs the sampler bare: firefast (deepseek/fireworks) ran 4/86 bench turns
-    // straight to the token cap on pure looped repetition (run52). Ships next to
-    // temperature so caller `sampling` can tune it; the grammar path re-asserts it as a
-    // managed FLOOR in #grammarBody. llama.cpp takes the repeat_penalty
-    // MULTIPLIER; the plain cloud path ("none") can't, so it gets
-    // frequency_penalty - OpenAI-standard, accepted by every OpenAI-compat backend (verified
-    // live: together/deepinfra/fireworks; it is OpenAI's own param, so real OpenAI takes it too).
-    #repetitionPenaltyBody(): Record<string, unknown> {
-        switch (this.#grammarStyle) {
-            // repeat_penalty + optional DRY (repeated-sequence penalty) + a wider
-            // repeat_last_n window — the loop-breaking tools a llama.cpp backend serves.
-            // Each rides only when its operator knob is set; absent = the box's default.
-            case "llamacpp": return {
-                ...(this.#repeatPenalty !== null ? { repeat_penalty: this.#repeatPenalty } : {}),
-                ...(this.#repeatLastN !== undefined ? { repeat_last_n: this.#repeatLastN } : {}),
-                ...(this.#dryMultiplier !== undefined && this.#dryMultiplier > 0 ? {
-                    dry_multiplier: this.#dryMultiplier,
-                    ...(this.#dryBase !== undefined ? { dry_base: this.#dryBase } : {}),
-                    ...(this.#dryAllowedLength !== undefined ? { dry_allowed_length: this.#dryAllowedLength } : {}),
-                } : {}),
-            };
-            case "none": return this.#frequencyPenalty > 0 ? { frequency_penalty: this.#frequencyPenalty } : {};
-        }
-    }
-
-    // First-party telemetry headers ({§provider-request-authority} {§provider-call-kind}): forwarded only when the spec
-    // opted in (the plurnk endpoint). The gate is here, not at the call site, so
-    // attributions/client/strikes can never reach a third-party backend even if
-    // the consumer passes them to the wrong provider. Empty values emit no header
-    // — EXCEPT strikes, where 0 is a real value (clean streak) distinct from
-    // absent (consumer didn't report); contract {§strikes-first-party-metadata}. Strikes
-    // ride HTTP headers only — the packet never carries them (the model must
-    // never see strike state; engine accounting is not a metric to game).
-    #metadataHeaders(attributions: string[] | undefined, client: string | undefined, strikes: number | undefined, workerId: string, primaryWorkerId: string | undefined, workspaceId: string | undefined, loop: number | undefined, turn: number | undefined, callKind: ProviderCallKind | undefined): Record<string, string> {
-        if (!this.#firstPartyMetadata) return {};
-        const h: Record<string, string> = {};
-        if (attributions !== undefined && attributions.length > 0) h["Plurnk-Attribution"] = JSON.stringify(attributions);
-        if (client !== undefined && client.length > 0) h["Plurnk-Client"] = client;
-        if (strikes !== undefined && Number.isInteger(strikes) && strikes >= 0) h["Plurnk-Strikes"] = String(strikes);
-        // Worker identity: the opaque workerId
-        // the consumer already supplies, forwarded so the endpoint can key
-        // per-worker affinity/telemetry — same gate as every first-party signal.
-        h["Plurnk-Worker-Id"] = workerId;
-        // Root worker of the lineage ({§worker-primary}): the no-parent ancestor of this turn's
-        // worker tree. The consumer classifies primary-vs-spawned by equality
-        // (primaryWorkerId == workerId ⇒ the primary/root worker). The provider
-        // EMITS what the consumer supplies and never invents a primary; the
-        // consumer's contract is to stamp it EVERY turn (including the primary's
-        // own, where it equals workerId). Absence is the consumer's violation for
-        // the endpoint to surface, not a provider default.
-        if (primaryWorkerId !== undefined && primaryWorkerId.length > 0) h["Plurnk-Worker-Primary"] = primaryWorkerId;
-        // Turn coordinate ({§lifecycle-terms}): workspace/loop/turn, the
-        // daemon-side sequence the endpoint can never scrape from the wire.
-        // Coordinates are 1-based — 0 is not a real value, so no strikes-style
-        // zero exception; absent/empty/0 emits no header.
-        if (workspaceId !== undefined && workspaceId.length > 0) h["Plurnk-Workspace-Id"] = workspaceId;
-        if (loop !== undefined && Number.isInteger(loop) && loop >= 1) h["Plurnk-Loop"] = String(loop);
-        if (turn !== undefined && Number.isInteger(turn) && turn >= 1) h["Plurnk-Turn"] = String(turn);
-        if (callKind !== undefined) h["Plurnk-Call-Kind"] = callKind;
-        return h;
-    }
-
-    // PLURNK_PROVIDERS_GBNF_DEBUG ({§gbnf-response-observation}): validate the supplied GBNF locally and fail
-    // hard if it's malformed, BEFORE any wire call — and the grammar is NOT
-    // transported, so the request runs unconstrained. A debug aid to catch invalid
-    // grammars (e.g. while editing the plurnk grammar) without a model round-trip;
-    // off in production. `validateGbnf(grammar, "")` parses the grammar + resolves
-    // its root, throwing iff the grammar itself is invalid (the empty input's
-    // verdict is irrelevant — we only care that parsing succeeded).
-    #assertGrammarValid(grammar: string): void {
-        try {
-            validateGbnf(grammar, "");
-        } catch (cause) {
-            throw new Error(`grammar validation (PLURNK_PROVIDERS_GBNF_DEBUG): invalid GBNF — ${(cause as Error).message}`, { cause });
-        }
-    }
 
     // Per-turn metadata bag: pass the backend's non-standard top-level fields
     // through verbatim. Providers do not reinterpret vendor currency or account
@@ -910,84 +658,6 @@ export default class AiSdkProvider implements Provider {
         return Object.keys(meta).length > 0 ? meta : undefined;
     }
 
-    // Caller-supplied OpenAI-compat sampling params (temperature, top_p, top_k,
-    // penalties, stop, seed, …) merged UNDER the managed body: model, messages,
-    // reasoning, grammar (+ its repeat-penalty floor), max_tokens and slot always
-    // win, and reserved transport/protocol keys are stripped so the passthrough
-    // can't smuggle a grammar, a stream toggle, or a backend slot
-    // ({§provider-request-authority}).
-    #samplingBody(sampling: Record<string, unknown> | undefined): Record<string, unknown> {
-        if (sampling === undefined) return {};
-        const out: Record<string, unknown> = {};
-        for (const [k, v] of Object.entries(sampling)) if (!RESERVED_BODY_KEYS.has(k)) out[k] = v;
-        return out;
-    }
-
-    #requestProviderOptions(
-        workerId: string,
-        nativeReasoningBudget: number | null,
-    ): AiSdkProviderOptions | undefined {
-        const responseOptions = this.#reasoning.mode === "off"
-            ? undefined
-            : this.#reasoningResponseProviderOptions;
-        const adaptiveOptions = this.#reasoning.mode === "adaptive"
-            && nativeReasoningBudget === null
-            ? this.#adaptiveReasoningProviderOptions
-            : undefined;
-        const nativeReasoning = nativeReasoningBudget !== null
-            ? this.#additiveReasoningProvider === "anthropic"
-                ? { anthropic: { thinking: { type: "enabled", budgetTokens: nativeReasoningBudget } } }
-                : this.#additiveReasoningProvider === "bedrock"
-                    ? { bedrock: { reasoningConfig: { type: "enabled", budgetTokens: nativeReasoningBudget } } }
-                    : undefined
-            : undefined;
-        const options: AiSdkProviderOptions = {};
-        for (const part of [responseOptions, adaptiveOptions, nativeReasoning]) {
-            for (const [provider, values] of Object.entries(part ?? {})) {
-                options[provider] = mergeJsonObjects(options[provider] ?? {}, values);
-            }
-        }
-        if (this.#cacheAffinity?.target === "provider-option") {
-            const { provider, name } = this.#cacheAffinity;
-            options[provider] = { ...options[provider], [name]: workerId };
-        }
-        return Object.keys(options).length === 0 ? undefined : options;
-    }
-
-    #nativeMaxOutputTokens(
-        outputBudget: number | null,
-        nativeReasoningBudget: number | null,
-    ): number | undefined {
-        if (outputBudget === null) return undefined;
-        return nativeReasoningBudget !== null
-            ? outputBudget - nativeReasoningBudget
-            : outputBudget;
-    }
-
-    #nativeReasoningBudget(
-        outputBudget: number | null,
-        configuredReasoningBudget: number | null,
-    ): number | null {
-        if (this.#additiveReasoningProvider === undefined || this.#reasoning.mode === "off") return null;
-        if (configuredReasoningBudget !== null) return configuredReasoningBudget;
-        if (this.#adaptiveReasoningProviderOptions !== undefined) return null;
-        if (outputBudget === null) {
-            throw new TypeError(
-                `${this.#source}: manual provider reasoning requires a resolved total output budget`,
-            );
-        }
-        if (outputBudget <= MANUAL_REASONING_MINIMUM) {
-            throw new TypeError(
-                `${this.#source}: total output budget must exceed the provider's ${MANUAL_REASONING_MINIMUM}-token minimum reasoning allowance`,
-            );
-        }
-        const fraction = MANUAL_REASONING_FRACTIONS[this.#reasoning.mode];
-        return Math.min(
-            outputBudget - 1,
-            Math.max(MANUAL_REASONING_MINIMUM, Math.round(outputBudget * fraction)),
-        );
-    }
-
     #accounting(
         outcome: ProviderRequestAccounting["outcome"],
         usage: ProviderUsage | undefined,
@@ -1019,7 +689,7 @@ export default class AiSdkProvider implements Provider {
         // Grammar handling ({§gbnf-response-observation}). Debug validates the
         // supplied grammar before the call but withholds it from the backend.
         const wantGrammar = grammar !== undefined && this.#grammarStyle !== "none";
-        if (wantGrammar && this.#gbnfDebug) this.#assertGrammarValid(grammar!);
+        if (wantGrammar && this.#gbnfDebug) this.#requestBody.assertGrammarValid(grammar!);
         const sendGrammar = wantGrammar && !this.#gbnfDebug ? grammar : undefined;
         const preserveGrammarSentence = wantGrammar
             && this.#reasoningStyle === "template";
@@ -1039,7 +709,7 @@ export default class AiSdkProvider implements Provider {
         // {§provider-flexed-allowance} (#482): the wire grants the flexed
         // allowance — the floor, or the exactly-measured slack above it.
         const effectiveMaxOutputTokens = capacity.responseMax ?? capacity.outputBudget ?? undefined;
-        const nativeReasoningBudget = this.#nativeReasoningBudget(
+        const nativeReasoningBudget = this.#requestBody.nativeReasoningBudget(
             capacity.outputBudget,
             capacity.reasoningBudget,
         );
@@ -1051,25 +721,25 @@ export default class AiSdkProvider implements Provider {
         const body: Record<string, unknown> = {
             // Floors are suppressed on router-owned-tuning providers (plurnk) —
             // the router's per-model tuning must not be overridden by client floors.
-            ...(this.#tuningFloors ? { ...(this.#temperature !== null ? { temperature: this.#temperature } : {}), ...this.#repetitionPenaltyBody() } : {}),
-            ...this.#samplingBody(sampling),
+            ...(this.#tuningFloors ? { ...(this.#temperature !== null ? { temperature: this.#temperature } : {}), ...this.#requestBody.repetitionPenaltyBody() } : {}),
+            ...this.#requestBody.samplingBody(sampling),
             ...(this.#serviceTier !== undefined ? { service_tier: this.#serviceTier } : {}),
             model: this.#model,
             messages,
-            ...this.#reasoningBody(preserveGrammarSentence, capacity.reasoningBudget),
-            ...this.#grammarBody(sendGrammar),
+            ...this.#requestBody.reasoningBody(preserveGrammarSentence, capacity.reasoningBudget),
+            ...this.#requestBody.grammarBody(sendGrammar),
             ...(effectiveMaxOutputTokens !== undefined ? { max_tokens: effectiveMaxOutputTokens } : {}),
             // Request per-token logprobs only when enabled (managed field —
             // reserved from caller sampling; the env flag is the single control).
             ...(this.#topLogprobs !== null ? { logprobs: true, top_logprobs: this.#topLogprobs } : {}),
-            ...this.#slotBody(workerId),
+            ...this.#requestBody.slotBody(workerId),
             ...(this.#cacheAffinity?.target === "body"
                 ? { [this.#cacheAffinity.name]: workerId }
                 : {}),
         };
 
         // Per-request headers = static auth/routing + any first-party telemetry.
-        const metaHeaders = this.#metadataHeaders(attributions, client, strikes, workerId, primaryWorkerId, workspaceId, loop, turn, callKind);
+        const metaHeaders = this.#requestBody.metadataHeaders(attributions, client, strikes, workerId, primaryWorkerId, workspaceId, loop, turn, callKind);
         const headers = new Headers(this.#headers);
         if (this.#cacheAffinity?.target === "header") {
             headers.set(this.#cacheAffinity.name, workerId);
@@ -1176,7 +846,7 @@ export default class AiSdkProvider implements Provider {
                     : await executeAiSdkModel({
                         languageModel: this.#languageModel,
                         headers: requestHeaders,
-                        providerOptions: this.#requestProviderOptions(workerId, nativeReasoningBudget),
+                        providerOptions: this.#requestBody.requestProviderOptions(workerId, nativeReasoningBudget),
                         systemProviderOptions: this.#systemCacheProviderOptions,
                         messages,
                         signal: operationSignal,
@@ -1201,7 +871,7 @@ export default class AiSdkProvider implements Provider {
                                 ? sampling.stop
                                 : undefined,
                         seed: typeof sampling?.seed === "number" ? sampling.seed : undefined,
-                        maxOutputTokens: this.#nativeMaxOutputTokens(capacity.outputBudget, nativeReasoningBudget),
+                        maxOutputTokens: this.#requestBody.nativeMaxOutputTokens(capacity.outputBudget, nativeReasoningBudget),
                         reasoning: this.#reasoning.mode === "off"
                             ? "none"
                             : this.#reasoning.mode === "adaptive"
@@ -1234,7 +904,13 @@ export default class AiSdkProvider implements Provider {
                 maxRetries: this.#retryAttempts,
                 abortSignal: operationSignal,
             });
-            raw = await retry(executeRequest);
+            // {§provider-connectivity} — the operation deadline and caller cancellation are backstopped by
+            // racing, not only by the advisory operationSignal, so a transport that ignores the abort still
+            // surfaces the deadline (→ the operationTimeout/caller branches below) rather than hanging the
+            // loop (#505). A well-behaved transport settles first and wins the race with its own evidence.
+            raw = operationSignal === undefined
+                ? await retry(executeRequest)
+                : await raceAgainstDeadline(retry(executeRequest), operationSignal);
         } catch (err) {
             if (err instanceof ProviderRequestObserverError
                 || err instanceof ProviderRequestAccountingError