@qoniai/qoni 0.4.1 → 0.4.3

package/CHANGELOG.md

@@ -6,6 +6,37 @@ This project follows semantic versioning. Before `1.0.0`, minor versions may
 include SDK API changes, while patch versions are reserved for backward
 compatible fixes.
 
+## 0.4.3 - 2026-09-09
+
+### Fixed
+
+- Treat malformed or empty screenshot data URIs as undecodable instead of
+  emitting invalid screenshot bytes or interrupting `wait()`. Preserve the
+  existing progress/raw fallback with screenshot capture enabled or disabled.
+- Keep valid padded, unpadded, whitespace-containing and URL-safe base64
+  screenshots compatible.
+
+## 0.4.2 - 2026-09-09
+
+### Fixed
+
+- Require authoritative run details when settling `wait()`: preserve detail
+  errors and reject unconfirmed terminal states instead of inventing success.
+- Reuse terminal details read after a clean stream close and resume from every
+  wire event cursor, including frames filtered from semantic events.
+- Propagate wait cancellation to detail and artifact-list GETs. Bound complete
+  JSON, NDJSON, binary, and HTTP error body reads by the request timeout, cancel
+  stalled readers, and discard late responses without starting replacement runs.
+- Clean up wait timers and SSE abort listeners. Cancel idle SSE readers directly
+  and release their locks without waiting indefinitely for source cancellation.
+- Retry HTTP 408 stream failures within the configured reconnect budget and stop
+  delivering buffered events after cancellation.
+
+### Added
+
+- Optional abort signals on product run-detail and artifact-list wire reads;
+  existing calls without a signal remain compatible.
+
 ## Unreleased
 
 ### Breaking

package/README.md

@@ -161,6 +161,8 @@ console.log(result.output);
 
 `run()` returns a `RunHandle` typed to the product: `qoni.deepResearch.run()` is a `RunHandle<DeepResearchEvent>`, so its events are narrowed to what Deep Research actually emits. `capture: { screenshots: true }` opts into per-step screenshots, decoded to bytes for you. `wait()` drives the run to its terminal state and settles the result (`result.raw` carries cost, step counts, token usage).
 
+Undecodable or empty screenshot data URIs never interrupt `wait()` or invoke `onScreenshot`, regardless of capture settings. They follow the existing progress fallback when a human-readable message is available; `onWireEvent` always retains the original payload, including frames with no progress text.
+
 > **Best practice — match `event.type` against the `QoniEventTypes` constants.**
 > Each product handle is typed to its own event set, so in TypeScript a case
 > for another product's event is a compile error and autocomplete shows only
@@ -512,7 +514,7 @@ const qoni = new Qoni({
 | `secretKey` | `string` | Yes | Qoni secret key from Qoni Console. |
 | `host` | `string` | No | Optional Qoni Console/SDK gateway override for private or local deployments. |
 | `fetch` | `typeof fetch` | No | Custom transport implementation. |
-| `timeoutMs` | `number` | No | Per-request timeout (connect + response headers). Defaults to `30000`. |
+| `timeoutMs` | `number` | No | Per-request timeout (connect + headers + body for one-shot requests; headers only for successful SSE connections). Defaults to `30000`. |
 
 > **`timeoutMs` does not bound a long-running run.** It applies to individual
 > one-shot HTTP requests (delegation, `status()`, a single POST). The live
@@ -550,6 +552,26 @@ await run.cancel(reason?)               // idempotent
 
 `await run.wait(...)` settles to a `RunResult`:
 
+The run-detail response must confirm a terminal state. Detail read errors propagate
+unchanged; `wait()` never substitutes an SSE completion payload for the authoritative
+result. A nonterminal or incomplete detail rejects with a retryable `upstream.failed`
+error; use `status()` or re-attach to recover.
+
+`timeoutMs` and `signal` stop waiting for detail/artifact reads and promises returned
+by `onEvent`, `onWireEvent`, `onInteraction`, and `onScreenshot`. They cannot preempt
+synchronous JavaScript or stop work already started inside a callback. `onReconnect`
+is synchronous telemetry: its return value is not awaited and returned promise
+rejections are not handled. Do not pass an async callback there; synchronous throws
+propagate. Reconnect backoff remains abortable and subject to the wait deadline.
+
+Detail/artifact-list GETs receive the wait signal: aborting or timing out a wait aborts
+the request and cancels its body reader. The client's per-request timer also covers
+complete JSON/NDJSON and binary body reads, including HTTP error bodies. A late response
+from a custom fetch that ignores abort has its body canceled and cannot resume settlement
+or start subsequent run requests. Custom transports must honor `RequestInit.signal` to
+stop their own in-flight network work. Stopping a wait neither cancels the server-side
+run nor creates a replacement task; use `cancel()` explicitly to stop the existing run.
+
 ```ts
 interface RunResult {
   runId: string;

package/README.zh-CN.md

@@ -154,6 +154,8 @@ console.log(result.output);
 
 `run()` 返回一个 `RunHandle`。核心事件（状态、动作、交互、完成）始终默认推送；`capture: { screenshots: true }` 开启逐步截图，并且 SDK 已经把图片解码成字节。`wait()` 把任务跑到终态，并从权威 run envelope 结算结果（成本、步数、token 用量都在 `result.raw` 上）。
 
+无论是否开启 capture，不可解码或空的截图 data URI 都不会中断 `wait()`，也不会触发 `onScreenshot`。有可读消息时按既有契约降级为 progress；`onWireEvent` 始终保留原始 payload，包括没有 progress 文本的帧。
+
 需要逐步控制时，直接消费事件流，`switch (event.type)` 用 `QoniEventTypes` 常量匹配。每个产品的 handle 按产品分型（`qoni.deepResearch.run()` 出来是 `RunHandle<DeepResearchEvent>`），TS 里写错产品的事件会编译报错、补全只列本产品的。内部细节（supervisor 编排、子 agent 点击/输入、telemetry）统一折叠成 `QoniEventTypes.Progress`；匹配到 `case` 后 `event.data` 就是该类型的固定形状。原始 wire 类型不导出。
 
 ```ts
@@ -482,7 +484,7 @@ const qoni = new Qoni({
 | `secretKey` | `string` | 是 | Qoni Console 创建的 secret key。 |
 | `host` | `string` | 否 | 私有化或本地部署时可选的 Qoni Console/SDK 网关覆盖地址。 |
 | `fetch` | `typeof fetch` | 否 | 自定义传输实现。 |
-| `timeoutMs` | `number` | 否 | 单次请求超时（连接 + 响应头），默认 `30000`。 |
+| `timeoutMs` | `number` | 否 | 单次请求超时（一次性请求覆盖连接、响应头及响应体；成功建立的 SSE 仅覆盖到响应头），默认 `30000`。 |
 
 > **`timeoutMs` 不会限制长任务。** 它只作用于单次一次性 HTTP 请求（委托、`status()`、单个 POST）。事件流（`events()` / `wait()`）**不受它约束**——流的响应头一到，这个单次计时器就被清掉了,所以一个跑一小时的 Deep Research 在默认 30s 客户端超时下也能正常流式。要限制等待时长用 `wait({ timeoutMs })`；不传则 `wait()` 一直等到终态。`wait()` 超时**不会停止 run**——它在服务端继续跑，可以再 `attach()` 回去。
 
@@ -512,6 +514,19 @@ await run.cancel(reason?)               // 幂等
 
 `await run.wait(...)` 结算成一个 `RunResult`：
 
+必须由 run-detail 响应确认终态。详情读取错误原样抛出，`wait()` 不会用 SSE 完成事件替代权威结果。
+详情仍为非终态或缺少终态信息时，抛出可重试的 `upstream.failed`；可通过 `status()` 或重新 `attach()` 恢复。
+
+`timeoutMs` 与 `signal` 会结束详情、交付物读取及 `onEvent`、`onWireEvent`、`onInteraction`、
+`onScreenshot` 返回的 Promise 的等待，但不能抢占同步 JavaScript，也不能停止回调内部已启动的工作。
+`onReconnect` 是同步遥测通知：返回值不被等待，返回的 Promise 的 rejection 也不被处理，因此不要传 async
+回调；同步抛错会向上传播。重连退避等待仍可被 signal 或 wait 超时中断。
+
+详情/交付物列表 GET 会接收 wait signal：wait 中止或超时时会中止请求、取消并释放响应体 reader。
+客户端单次请求计时器也覆盖完整 JSON/NDJSON、二进制响应体及 HTTP 错误体读取。即使自定义 fetch 忽略
+abort，SDK 也会取消其迟到响应体，不恢复结算或启动后续 run 请求；自定义传输须遵守 `RequestInit.signal`
+才能停止其内部网络工作。停止 wait 既不会取消服务端 run，也不会创建替代任务；需要停止原 run 时须显式调用 `cancel()`。
+
 ```ts
 interface RunResult {
   runId: string;

package/dist/index.cjs

@@ -397,8 +397,14 @@ function decodeDataUri(uri) {
   const match = /^data:([^;,]*)?(;base64)?,(.*)$/s.exec(uri);
   if (!match) return void 0;
   const [, mime, isBase64, body] = match;
-  const bytes = isBase64 ? new Uint8Array(Buffer.from(body, "base64")) : new TextEncoder().encode(decodeURIComponent(body));
-  return { bytes, mime: mime || "application/octet-stream" };
+  const encoded = isBase64 ? body.replace(/\s/g, "") : body;
+  if (isBase64 && (!/^[A-Za-z0-9+/_-]+={0,2}$/.test(encoded) || encoded.length % 4 === 1 || encoded.includes("=") && encoded.length % 4 !== 0)) return void 0;
+  try {
+    const bytes = isBase64 ? new Uint8Array(Buffer.from(encoded, "base64")) : new TextEncoder().encode(decodeURIComponent(encoded));
+    return bytes.length ? { bytes, mime: mime || "application/octet-stream" } : void 0;
+  } catch {
+    return void 0;
+  }
 }
 function asString(value) {
   return typeof value === "string" && value ? value : void 0;
@@ -816,11 +822,11 @@ var RunHandle = class {
   }
   /** Drive the run to a terminal state and return the settled result. */
   async wait(opts = {}) {
-    const { signal, timedOut } = withTimeout(opts.signal, opts.timeoutMs);
+    const { signal, timedOut, dispose } = withTimeout(opts.signal, opts.timeoutMs);
     let lastEventId;
     let eventIdAtLastClose;
     let sawCleanClose = false;
-    let terminalPayload;
+    let terminalDetail;
     let terminalDoneReason;
     let screenshotIndex = 0;
     try {
@@ -828,24 +834,28 @@ var RunHandle = class {
         for await (const event of this.events({
           signal,
           lastEventId,
-          onWireEvent: opts.onWireEvent,
+          onWireEvent: (wire) => waitWithSignal(() => {
+            if (wire.id !== void 0) lastEventId = wire.id;
+            return opts.onWireEvent?.(wire);
+          }, signal),
           onReconnect: opts.onReconnect
         })) {
-          if (event.raw.id) lastEventId = event.raw.id;
-          await opts.onEvent?.(event);
+          await waitWithSignal(() => opts.onEvent?.(event), signal);
           if (event.type === "screenshot") {
-            await opts.onScreenshot?.(event.image, screenshotIndex++);
+            await waitWithSignal(() => opts.onScreenshot?.(event.image, screenshotIndex++), signal);
           } else if (event.type === "interaction") {
-            await opts.onInteraction?.(this.interactionHandle(event.data), event);
+            await waitWithSignal(() => opts.onInteraction?.(this.interactionHandle(event.data), event), signal);
           }
           if (event.isTerminal) {
-            terminalPayload = isJsonObject(event.raw.data) ? event.raw.data : void 0;
             if (event.type === "done") terminalDoneReason = event.data.terminalReason || void 0;
             break settled;
           }
         }
-        const detail2 = await this.ops.getDetail();
-        if (isTerminalRunStatus(detail2.status)) break;
+        const detail2 = await waitWithSignal(() => this.ops.getDetail(signal), signal);
+        if (isTerminalRunStatus(normalizeRunStatus(this.id, detail2).status)) {
+          terminalDetail = detail2;
+          break;
+        }
         if (sawCleanClose && lastEventId === eventIdAtLastClose) {
           throw new QoniError(
             `run event stream ended before a terminal event while the run is still "${String(detail2.status)}" \u2014 re-attach or poll status()`,
@@ -855,6 +865,11 @@ var RunHandle = class {
         sawCleanClose = true;
         eventIdAtLastClose = lastEventId;
       }
+      const detail = terminalDetail ?? await waitWithSignal(() => this.ops.getDetail(signal), signal);
+      this.#adoptSessionRef(detail);
+      const result = settleRunResult(this.id, detail, [], terminalDoneReason);
+      result.artifacts = this.ops.listArtifacts ? await waitWithSignal(() => this.ops.listArtifacts(signal), signal) : [];
+      return result;
     } catch (err) {
       if (timedOut() && !opts.signal?.aborted) {
         throw new QoniTimeoutError(
@@ -863,17 +878,9 @@ var RunHandle = class {
         );
       }
       throw err;
+    } finally {
+      dispose();
     }
-    let detail;
-    try {
-      detail = await this.ops.getDetail();
-    } catch (err) {
-      if (!terminalPayload) throw err;
-      detail = terminalPayload;
-    }
-    this.#adoptSessionRef(detail);
-    const artifacts = this.ops.listArtifacts ? await this.ops.listArtifacts() : [];
-    return settleRunResult(this.id, detail, artifacts, terminalDoneReason);
   }
   /**
    * Wrap an {@link Interaction} (from `event.data` of an `interaction` event)
@@ -926,15 +933,12 @@ function normalizeRunStatus(id, detail) {
 function settleRunResult(runId, detail, artifacts, fallbackTerminalReason) {
   const terminalReason = (typeof detail.terminal_reason === "string" ? detail.terminal_reason : void 0) ?? fallbackTerminalReason;
   const isTaskSuccessful = typeof detail.is_task_successful === "boolean" ? detail.is_task_successful : void 0;
-  let status;
-  if (isTerminalRunStatus(detail.status)) {
-    status = detail.status;
-  } else if (terminalReason === "canceled") {
-    status = "canceled";
-  } else if (terminalReason === "failed" || terminalReason === "expired" || isTaskSuccessful === false) {
-    status = "failed";
-  } else {
-    status = "succeeded";
+  const status = normalizeRunStatus(runId, detail).status;
+  if (!isTerminalRunStatus(status)) {
+    throw new QoniError(
+      "run detail did not confirm a terminal state \u2014 re-attach or poll status()",
+      { code: "upstream.failed", retryable: true, body: detail }
+    );
   }
   return {
     runId,
@@ -961,19 +965,40 @@ function isVideoFrame(wire) {
   return type === "browser_video_frame" || type === "run.browser_video_frame";
 }
 function withTimeout(signal, timeoutMs) {
-  if (!timeoutMs) return { signal, timedOut: () => false };
+  if (!timeoutMs) return { signal, timedOut: () => false, dispose: () => {
+  } };
   const controller = new AbortController();
   let fired = false;
   const timer = setTimeout(() => {
     fired = true;
     controller.abort();
   }, timeoutMs);
-  controller.signal.addEventListener("abort", () => clearTimeout(timer), { once: true });
+  const onAbort = () => controller.abort(signal?.reason);
+  const dispose = () => {
+    clearTimeout(timer);
+    signal?.removeEventListener("abort", onAbort);
+  };
+  controller.signal.addEventListener("abort", dispose, { once: true });
   if (signal) {
-    if (signal.aborted) controller.abort();
-    else signal.addEventListener("abort", () => controller.abort(), { once: true });
+    if (signal.aborted) onAbort();
+    else signal.addEventListener("abort", onAbort, { once: true });
   }
-  return { signal: controller.signal, timedOut: () => fired };
+  return { signal: controller.signal, timedOut: () => fired, dispose };
+}
+function waitWithSignal(operation, signal) {
+  if (!signal) return Promise.resolve().then(operation);
+  return new Promise((resolve, reject) => {
+    const onAbort = () => reject(signal.reason ?? new DOMException("Aborted", "AbortError"));
+    if (signal.aborted) {
+      onAbort();
+      return;
+    }
+    signal.addEventListener("abort", onAbort, { once: true });
+    Promise.resolve().then(() => {
+      signal.throwIfAborted();
+      return operation();
+    }).then(resolve, reject).finally(() => signal.removeEventListener("abort", onAbort));
+  });
 }
 
 // src/deep-research.ts
@@ -988,6 +1013,7 @@ function createDeepResearchNamespace(transport) {
       `/deep_research/runs/${encodeURIComponent(input.runId)}`,
       input.token,
       {
+        signal: input.signal,
         requiredScopes: ["webagent.deep_research:read"]
       }
     ),
@@ -1033,6 +1059,7 @@ function createDeepResearchNamespace(transport) {
       `/deep_research/runs/${encodeURIComponent(input.runId)}/artifacts`,
       input.token,
       {
+        signal: input.signal,
         requiredScopes: ["webagent.deep_research:read"]
       }
     ),
@@ -1047,7 +1074,7 @@ function createDeepResearchNamespace(transport) {
   };
   function buildOps(token, runId) {
     return {
-      getDetail: async () => asRecord((await api.get({ token, runId })).data),
+      getDetail: async (signal) => asRecord((await api.get({ token, runId, signal })).data),
       streamEvents: (opts) => api.events({
         token,
         runId,
@@ -1067,8 +1094,8 @@ function createDeepResearchNamespace(transport) {
         );
       },
       cancel: async () => asRecord((await api.cancel({ token, runId })).data),
-      listArtifacts: async () => {
-        const res = await api.listArtifacts({ token, runId });
+      listArtifacts: async (signal) => {
+        const res = await api.listArtifacts({ token, runId, signal });
         const items = Array.isArray(res.data?.items) ? res.data.items : [];
         return items.filter(isJsonObject).map((item) => toArtifact(item, token, runId));
       }
@@ -1188,6 +1215,7 @@ function createDoAnythingNamespace(transport) {
       `/do_anything/runs/${encodeURIComponent(input.runId)}`,
       input.token,
       {
+        signal: input.signal,
         requiredScopes: ["webagent.do_anything:read"]
       }
     ),
@@ -1245,7 +1273,7 @@ function createDoAnythingNamespace(transport) {
   };
   function buildOps(token, runId, capture) {
     return {
-      getDetail: async () => asRecord2((await api.getRun({ token, runId })).data),
+      getDetail: async (signal) => asRecord2((await api.getRun({ token, runId, signal })).data),
       streamEvents: (opts) => api.events({
         token,
         runId,
@@ -1839,6 +1867,7 @@ function createWebSearchNamespace(transport) {
       `/web_search/runs/${encodeURIComponent(input.runId)}`,
       input.token,
       {
+        signal: input.signal,
         requiredScopes: ["webagent.web_search:read"]
       }
     ),
@@ -1864,7 +1893,7 @@ function createWebSearchNamespace(transport) {
   };
   function buildOps(token, runId) {
     return {
-      getDetail: async () => asRecord4((await api.get({ token, runId })).data),
+      getDetail: async (signal) => asRecord4((await api.get({ token, runId, signal })).data),
       streamEvents: (opts) => api.events({
         token,
         runId,
@@ -2137,7 +2166,9 @@ var Qoni = class {
     }
   }
   async webAgentJson(method, path, token, payload = {}) {
+    payload.signal?.throwIfAborted();
     const runtimeToken = await this.productTokenFor("webagent", token, payload.requiredScopes);
+    payload.signal?.throwIfAborted();
     const baseUrl = await this.baseUrlFor("webagent");
     return this.jsonRequest(
       baseUrl,
@@ -2148,9 +2179,11 @@ var Qoni = class {
   // Binary GET against the WebAgent API — artifact content downloads. JSON
   // error payloads still map to typed QoniErrors.
   async webAgentBytes(path, token, payload = {}) {
+    payload.signal?.throwIfAborted();
     const runtimeToken = await this.productTokenFor("webagent", token, payload.requiredScopes);
+    payload.signal?.throwIfAborted();
     const baseUrl = await this.baseUrlFor("webagent");
-    const response = await this.fetchWithTimeout(
+    return this.fetchWithTimeout(
       urlWithBasePath(baseUrl, this.webAgentPath(runtimeToken, path), payload.query),
       {
         method: "GET",
@@ -2159,20 +2192,22 @@ var Qoni = class {
           authorization: `Bearer ${runtimeToken}`,
           ...payload.headers || {}
         }
-      }
+      },
+      async (response, signal) => {
+        if (!response.ok) {
+          throw errorFromPayload(
+            response.status,
+            await readJson(response, signal),
+            `Qoni request failed with HTTP ${response.status}`
+          );
+        }
+        return {
+          bytes: await readBody(response, signal),
+          mime: response.headers.get("content-type") || "application/octet-stream"
+        };
+      },
+      payload.signal
     );
-    if (!response.ok) {
-      throw errorFromPayload(
-        response.status,
-        await readJson(response),
-        `Qoni request failed with HTTP ${response.status}`
-      );
-    }
-    const buffer = await response.arrayBuffer();
-    return {
-      bytes: new Uint8Array(buffer),
-      mime: response.headers.get("content-type") || "application/octet-stream"
-    };
   }
   async *webAgentSSE(path, token, payload = {}) {
     const runtimeToken = await this.productTokenFor("webagent", token, payload.requiredScopes);
@@ -2212,15 +2247,16 @@ var Qoni = class {
     });
   }
   async jsonRequest(baseUrl, pathname, options) {
-    const response = await this.fetchWithTimeout(
+    const { response, payload } = await this.fetchWithTimeout(
       urlWithBasePath(baseUrl, pathname, options.query),
       {
         method: options.method,
         headers: requestHeaders(options),
         body: requestBody(options.body)
-      }
+      },
+      async (response2, signal) => ({ response: response2, payload: await readJson(response2, signal) }),
+      options.signal
     );
-    const payload = await readJson(response);
     if (!response.ok) {
       throw errorFromPayload(
         response.status,
@@ -2270,45 +2306,55 @@ var Qoni = class {
     }
   }
   async *sseConnectOnce(baseUrl, pathname, options) {
-    const response = await this.fetchWithTimeout(
-      urlWithBasePath(baseUrl, pathname, options.query),
-      {
-        method: "GET",
-        headers: {
-          accept: "text/event-stream",
-          authorization: `Bearer ${options.token}`,
-          ...options.headers || {},
-          ...options.lastEventId ? { "last-event-id": options.lastEventId } : {}
-        }
-      },
-      options.signal,
-      { streamBody: true }
-    );
-    if (!response.ok) {
-      throw errorFromPayload(
-        response.status,
-        await readJson(response),
-        `Qoni stream failed with HTTP ${response.status}`
-      );
-    }
-    if (!response.body) {
-      throw errorFromPayload(502, void 0, "Qoni stream response has no body");
-    }
-    const reader = response.body.getReader();
+    let cleanup;
+    let reader;
+    const onAbort = () => {
+      void reader?.cancel(options.signal?.reason).catch(() => void 0);
+    };
     const decoder = new TextDecoder();
     let buffer = "";
     try {
+      const response = await this.fetchWithTimeout(
+        urlWithBasePath(baseUrl, pathname, options.query),
+        {
+          method: "GET",
+          headers: {
+            accept: "text/event-stream",
+            authorization: `Bearer ${options.token}`,
+            ...options.headers || {},
+            ...options.lastEventId ? { "last-event-id": options.lastEventId } : {}
+          }
+        },
+        async (response2, signal) => {
+          if (!response2.ok) {
+            throw errorFromPayload(
+              response2.status,
+              await readJson(response2, signal),
+              `Qoni stream failed with HTTP ${response2.status}`
+            );
+          }
+          return response2;
+        },
+        options.signal,
+        { streamCleanup: (dispose) => {
+          cleanup = dispose;
+        } }
+      );
+      if (!response.body) {
+        throw errorFromPayload(502, void 0, "Qoni stream response has no body");
+      }
+      reader = response.body.getReader();
+      options.signal?.addEventListener("abort", onAbort, { once: true });
       while (true) {
-        if (options.signal?.aborted) {
-          await reader.cancel().catch(() => void 0);
-          throw options.signal.reason || new DOMException("Aborted", "AbortError");
-        }
+        options.signal?.throwIfAborted();
         const { done, value } = await reader.read();
+        options.signal?.throwIfAborted();
         if (done) break;
         buffer += decoder.decode(value, { stream: true });
         const chunks = buffer.split(/\r?\n\r?\n/);
         buffer = chunks.pop() || "";
         for (const chunk of chunks) {
+          options.signal?.throwIfAborted();
           const event = parseSSEEvent(chunk);
           if (event) yield event;
         }
@@ -2316,14 +2362,16 @@ var Qoni = class {
       const finalEvent = parseSSEEvent(buffer);
       if (finalEvent) yield finalEvent;
     } finally {
-      await reader.cancel().catch(() => void 0);
+      cleanup?.();
+      options.signal?.removeEventListener("abort", onAbort);
+      void reader?.cancel().catch(() => void 0);
       try {
-        reader.releaseLock();
+        reader?.releaseLock();
       } catch {
       }
     }
   }
-  async fetchWithTimeout(input, init, signal, opts) {
+  async fetchWithTimeout(input, init, consume, signal, opts) {
     if (signal?.aborted) throw signal.reason || new DOMException("Aborted", "AbortError");
     const controller = new AbortController();
     const resolved = resolveLocalGenauthRequest(input);
@@ -2338,17 +2386,39 @@ var Qoni = class {
       didTimeout = true;
       controller.abort();
     }, this.timeoutMs);
+    let response;
     try {
-      return await this.fetchImpl(resolved.url, { ...requestInit, signal: controller.signal });
+      response = await new Promise((resolve, reject) => {
+        const onAbort = () => reject(controller.signal.reason);
+        controller.signal.addEventListener("abort", onAbort, { once: true });
+        Promise.resolve().then(() => {
+          controller.signal.throwIfAborted();
+          return this.fetchImpl(resolved.url, { ...requestInit, signal: controller.signal });
+        }).then((response2) => {
+          if (controller.signal.aborted) {
+            void response2.body?.cancel(controller.signal.reason).catch(() => void 0);
+            reject(controller.signal.reason);
+          } else {
+            resolve(response2);
+          }
+        }, reject).finally(() => controller.signal.removeEventListener("abort", onAbort));
+      });
+      const result = await consume(response, controller.signal);
+      controller.signal.throwIfAborted();
+      return result;
     } catch (error) {
-      if (isAbortError(error) && didTimeout || isConnectTimeoutError(error)) {
+      void response?.body?.cancel().catch(() => void 0);
+      if (signal?.aborted) throw signal.reason;
+      if (didTimeout || isConnectTimeoutError(error)) {
         throw timeoutError(error);
       }
       if (isFetchNetworkError(error)) throw networkError(error);
       throw error;
     } finally {
       clearTimeout(timeout);
-      if (!opts?.streamBody) signal?.removeEventListener("abort", abortFromSignal);
+      const cleanup = () => signal?.removeEventListener("abort", abortFromSignal);
+      if (opts?.streamCleanup) opts.streamCleanup(cleanup);
+      else cleanup();
     }
   }
   async baseUrlFor(service) {
@@ -2404,7 +2474,7 @@ var Qoni = class {
       pathname,
       {}
     );
-    const response = await this.fetchWithTimeout(
+    const { response, payload } = await this.fetchWithTimeout(
       urlWithBasePath(this.host, pathname),
       {
         method: "GET",
@@ -2412,9 +2482,9 @@ var Qoni = class {
           accept: "application/json",
           ...headers
         }
-      }
+      },
+      async (response2, signal) => ({ response: response2, payload: await readJson(response2, signal) })
     );
-    const payload = await readJson(response);
     if (!response.ok) {
       throw errorFromPayload(
         response.status,
@@ -2508,18 +2578,52 @@ function requestBody(body) {
 function isBodyInit(value) {
   return typeof value === "string" || value instanceof ArrayBuffer || value instanceof Blob || value instanceof FormData || value instanceof URLSearchParams;
 }
-async function readJson(response) {
+async function readBody(response, signal) {
+  if (!response.body) {
+    signal.throwIfAborted();
+    return new Uint8Array();
+  }
+  const reader = response.body.getReader();
+  const onAbort = () => {
+    void reader.cancel(signal.reason).catch(() => void 0);
+  };
+  signal.addEventListener("abort", onAbort, { once: true });
+  try {
+    const chunks = [];
+    let size = 0;
+    for (; ; ) {
+      signal.throwIfAborted();
+      const { done, value } = await reader.read();
+      signal.throwIfAborted();
+      if (done) break;
+      chunks.push(value);
+      size += value.byteLength;
+    }
+    const bytes = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+      bytes.set(chunk, offset);
+      offset += chunk.byteLength;
+    }
+    return bytes;
+  } finally {
+    signal.removeEventListener("abort", onAbort);
+    void reader.cancel().catch(() => void 0);
+    reader.releaseLock();
+  }
+}
+async function readJson(response, signal) {
   const contentType = response.headers.get("content-type")?.toLowerCase() || "";
-  if (contentType.includes("ndjson") || contentType.includes("jsonl")) {
-    const body = await response.text();
-    if (!body.trim()) return [];
-    try {
+  const body = new TextDecoder().decode(await readBody(response, signal));
+  try {
+    if (contentType.includes("ndjson") || contentType.includes("jsonl")) {
+      if (!body.trim()) return [];
       return body.split(/\r?\n/).filter((line) => line.trim().length > 0).map((line) => JSON.parse(line));
-    } catch {
-      return void 0;
     }
+    return JSON.parse(body);
+  } catch {
+    return void 0;
   }
-  return response.json().catch(() => void 0);
 }
 function normalizeResponse(payload, _service) {
   if (isJsonObject(payload) && ("data" in payload || "meta" in payload)) {
@@ -2762,6 +2866,7 @@ function isRetryableStreamError(err) {
   if (err && typeof err === "object") {
     const e = err;
     if (e.name === "AbortError") return false;
+    if (e.status === 408) return true;
     if (typeof e.retryable === "boolean") return e.retryable;
     if (typeof e.status === "number") {
       return e.status >= 500 || e.status === 408 || e.status === 429;
@@ -2868,9 +2973,6 @@ function normalizeDelegateAgentTokenResponse(response) {
     }
   };
 }
-function isAbortError(error) {
-  return error instanceof DOMException && error.name === "AbortError";
-}
 function isConnectTimeoutError(error) {
   const cause = errorCause(error);
   return errorCode(cause) === "UND_ERR_CONNECT_TIMEOUT" || errorName(cause) === "ConnectTimeoutError";