@skaile/transform-proxy 0.5.1 → 0.6.0

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.6.0
+
+### Minor Changes
+
+- 84c02a9: Less detection work behind the transform proxy, with the same protection.
+  
+  forge-anon: an `AnonSession` caches each text's detection and no longer discards it when the mapping grows; earlier texts are finished again against the new mapping without a detector run. Detection of overlapping `anonymize` calls runs in parallel, placeholder allocation stays serialized. New `session.anonymize(text, { detectors })` restricts the detectors per call, and `session.remember(raw)` restores a model reply and lets its resend skip detection. The `onnx` and `llm` detectors cache model results per chunk text in memory. The proxy module restores through `remember` and takes an optional `leafDetectors` map (detectors per text leaf kind).
+  
+  transform-proxy: the walkers rewrite all text leaves of a request concurrently; refusals are raised before any transform call. Transforms must accept overlapping `outbound` calls.
+
 ## 0.5.1
 
 ### Patch Changes

package/README.md

@@ -197,6 +197,7 @@ A module default-exports a `TransformModule`:
 - It returns a `TransformFactory`, which runs once per `(session, pipeline)`: `(ctx: { sessionId, facts, log }) => Transform`.
 - A `Transform` has `instruction?`, `outbound(text, leaf)`, `inbound(text)`, `inboundStream()`, `dispose?()`, `inspect?()` (host-only state, read through `proxy.inspect`; the walkers never call it) and `knownOriginals?()`.
 - `knownOriginals?(): Iterable<{ kind, value }>` returns the originals the instance has already replaced in this session, each with its kind (forge-anon: its mapping). Only the [leak check](#leak-check) reads them, as source `pipeline`; the values are never sent or logged. `composeTransforms` returns the union of all stages that implement it; a stage that throws is logged and skipped.
+- The walkers first check the whole request (refusals such as attachments or malformed slots come before any `outbound` call), then call `outbound` for every text leaf of the request at once and assemble the body in its original order. A transform must therefore accept overlapping `outbound` calls of one session; a stage that needs ordering (forge-anon allocates placeholders one call at a time) serializes internally. One rejected `outbound` fails the request.
 
 The Anthropic walker appends the pipeline `instruction` after the host's system prompt: a string `system` gets it after a blank line, a block array gets it as one more text block at the end, and an absent `system` becomes the instruction. The host's leading blocks stay first, because Claude Code gateways (TeamClaude) refuse Sonnet requests with 429 `rate_limit_error` when the system prompt does not start with the Claude Code blocks. The OpenAI walkers still put the instruction first: a leading `system` message in chat completions, a prefix of `instructions` in responses.
 

package/dist/cli.d.mts

@@ -1,4 +1,4 @@
-import { i as TransformProxy } from "./server-gwJGHF82.mjs";
+import { i as TransformProxy } from "./server-BWc1mocm.mjs";
 /** Environment variable that supplies the client token when `--token` is absent. */
 export declare const TOKEN_ENV = "SKAILE_TRANSFORM_PROXY_TOKEN";
 /** Environment variable with the trace directory (relative to cwd); overrides `--trace-dir` and the config's `trace.dir`. */

package/dist/cli.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { a as createTransformProxy, s as createFileTraceSink, x as errorMessage, y as resolveProxyConfig } from "./server-BR1dDA8S.mjs";
+import { a as createTransformProxy, s as createFileTraceSink, x as errorMessage, y as resolveProxyConfig } from "./server-DTSaU_aK.mjs";
 import { realpathSync } from "node:fs";
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { _ as TraceSink, a as TransformProxyOptions, b as TransformModule, c as TransformSpec, d as SessionFactPublisher, f as SessionFacts, g as TraceLeak, h as TraceEvent, i as TransformProxy, l as Logger, m as TextLeafKind, n as SESSION_HEADER, o as UPSTREAM_HEADER, p as TextLeaf, r as TOKEN_HEADER, s as createTransformProxy, t as PIPELINE_HEADER, u as SessionFact, v as Transform, x as TransformSessionContext, y as TransformFactory } from "./server-gwJGHF82.mjs";
+import { _ as TraceSink, a as TransformProxyOptions, b as TransformModule, c as TransformSpec, d as SessionFactPublisher, f as SessionFacts, g as TraceLeak, h as TraceEvent, i as TransformProxy, l as Logger, m as TextLeafKind, n as SESSION_HEADER, o as UPSTREAM_HEADER, p as TextLeaf, r as TOKEN_HEADER, s as createTransformProxy, t as PIPELINE_HEADER, u as SessionFact, v as Transform, x as TransformSessionContext, y as TransformFactory } from "./server-BWc1mocm.mjs";
 /** One stage's streamed inbound transformer, as returned by `Transform.inboundStream()`. */
 interface InboundStream {
   push(chunk: string): string;

package/dist/index.mjs

@@ -1 +1 @@
-export { m as CONFIG_FILE_NAME, o as DEFAULT_TRACE_MAX_CHARS, t as PIPELINE_HEADER, n as SESSION_HEADER, r as TOKEN_HEADER, i as UPSTREAM_HEADER, f as UnsupportedContentError, d as anthropicWalker, b as composeTransforms, h as configCandidates, s as createFileTraceSink, p as createSessionFacts, a as createTransformProxy, g as findProxyConfig, _ as loadProxyConfig, u as openaiChatWalker, l as openaiResponsesWalker, v as parseProxyConfig, y as resolveProxyConfig, c as serializeTraceEvent, S as silentLogger } from "./server-BR1dDA8S.mjs";
+export { m as CONFIG_FILE_NAME, o as DEFAULT_TRACE_MAX_CHARS, t as PIPELINE_HEADER, n as SESSION_HEADER, r as TOKEN_HEADER, i as UPSTREAM_HEADER, f as UnsupportedContentError, d as anthropicWalker, b as composeTransforms, h as configCandidates, s as createFileTraceSink, p as createSessionFacts, a as createTransformProxy, g as findProxyConfig, _ as loadProxyConfig, u as openaiChatWalker, l as openaiResponsesWalker, v as parseProxyConfig, y as resolveProxyConfig, c as serializeTraceEvent, S as silentLogger } from "./server-DTSaU_aK.mjs";

package/dist/omp/index.mjs

@@ -1,4 +1,4 @@
-import { _ as loadProxyConfig, g as findProxyConfig, h as configCandidates, i as UPSTREAM_HEADER, n as SESSION_HEADER, r as TOKEN_HEADER, x as errorMessage } from "../server-BR1dDA8S.mjs";
+import { _ as loadProxyConfig, g as findProxyConfig, h as configCandidates, i as UPSTREAM_HEADER, n as SESSION_HEADER, r as TOKEN_HEADER, x as errorMessage } from "../server-DTSaU_aK.mjs";
 import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { randomBytes, randomUUID } from "node:crypto";

package/dist/{server-gwJGHF82.d.mts → server-BWc1mocm.d.mts}

@@ -14,7 +14,10 @@ interface TextLeaf {
 interface Transform {
   /** Added to the system prompt by each wire walker (Anthropic: appended last; OpenAI: placed first); omit when the model needs no instruction. */
   readonly instruction?: string;
-  /** Host -> model, one text leaf. A throw refuses the request (502 `transform_failed`); nothing is sent. */
+  /**
+   * Host -> model, one text leaf. The leaves of one request are rewritten concurrently, so calls of one instance may
+   * overlap. A throw refuses the request (502 `transform_failed`); nothing is sent.
+   */
   outbound(text: string, leaf: TextLeaf): Promise<string>;
   /** Model -> host, one complete text. */
   inbound(text: string): string;

package/dist/{server-BR1dDA8S.mjs → server-DTSaU_aK.mjs}

@@ -516,28 +516,37 @@ function refuse$1(block) {
 function malformed$2(slot) {
 	throw new UnsupportedContentError(`Anthropic ${slot} has an unexpected shape`);
 }
-async function outbound$2(transform, text, leaf) {
-	return text === "" ? text : transform.outbound(text, leaf);
+/** Starts every queued rewrite at once; resolves when all results are written back, rejects on the first failure. */
+async function runAll$2(pending) {
+	await Promise.all(pending.map((run) => run()));
+}
+/** Queues the rewrite of one text leaf; `set` later replaces the original, which stays in place until then. */
+function queue$2(pending, transform, text, leaf, set) {
+	if (text !== "") pending.push(async () => set(await transform.outbound(text, leaf)));
 }
 /** A string, or an array of blocks whose `text` blocks are rewritten; anything else is refused. */
-async function rewriteText(content, slot, rewrite) {
-	if (typeof content === "string") return rewrite(content);
-	if (!Array.isArray(content)) return malformed$2(slot);
+function rewriteText(content, slot, rewrite, set) {
+	if (typeof content === "string") {
+		rewrite(content, set);
+		return;
+	}
+	if (!Array.isArray(content)) malformed$2(slot);
 	const out = [];
 	for (const block of content) {
-		if (!isObj$2(block)) return malformed$2(`${slot} block`);
+		if (!isObj$2(block)) malformed$2(`${slot} block`);
 		refuse$1(block);
 		if (block.type !== "text") {
 			out.push(block);
 			continue;
 		}
-		if (typeof block.text !== "string") return malformed$2(`${slot} text block`);
-		out.push({
-			...block,
-			text: await rewrite(block.text)
+		if (typeof block.text !== "string") malformed$2(`${slot} text block`);
+		const copy = { ...block };
+		out.push(copy);
+		rewrite(block.text, (text) => {
+			copy.text = text;
 		});
 	}
-	return out;
+	set(out);
 }
 /**
 * Host-written system text that Anthropic's Claude subscription (OAuth) check reads verbatim: the
@@ -554,24 +563,37 @@ function gatePrefix(text) {
 	const end = text.indexOf("\n");
 	return end === -1 ? text : text.slice(0, end);
 }
-async function rewriteSystemText(text, transform) {
+function rewriteSystemText(text, transform, pending, set) {
 	const kept = gatePrefix(text);
-	return kept + await outbound$2(transform, text.slice(kept.length), { kind: "system" });
+	queue$2(pending, transform, text.slice(kept.length), { kind: "system" }, (rest) => set(kept + rest));
 }
 /** Every string leaf of a JSON value (tool-call input); keys stay as they are. */
-async function rewriteStrings$2(value, leaf, transform) {
-	if (typeof value === "string") return outbound$2(transform, value, leaf);
+function rewriteStrings$2(value, leaf, transform, pending, set) {
+	if (typeof value === "string") {
+		queue$2(pending, transform, value, leaf, set);
+		return;
+	}
 	if (Array.isArray(value)) {
 		const out = [];
-		for (const item of value) out.push(await rewriteStrings$2(item, leaf, transform));
-		return out;
+		for (const item of value) {
+			const index = out.push(item) - 1;
+			rewriteStrings$2(item, leaf, transform, pending, (rewritten) => {
+				out[index] = rewritten;
+			});
+		}
+		set(out);
+		return;
 	}
 	if (isObj$2(value)) {
 		const out = {};
-		for (const [key, item] of Object.entries(value)) out[key] = await rewriteStrings$2(item, leaf, transform);
-		return out;
+		for (const [key, item] of Object.entries(value)) {
+			out[key] = item;
+			rewriteStrings$2(item, leaf, transform, pending, (rewritten) => {
+				out[key] = rewritten;
+			});
+		}
+		set(out);
 	}
-	return value;
 }
 /** Every string leaf of a JSON value, restored inbound. */
 function restoreStrings$1(value, transform) {
@@ -585,7 +607,7 @@ function restoreStrings$1(value, transform) {
 	return value;
 }
 /** A thinking block: swaps in the cached model text when its signature is known, else rewrites it. */
-async function rewriteThinking(block, ctx) {
+function rewriteThinking(block, ctx, pending) {
 	if (typeof block.thinking !== "string") return malformed$2("thinking block");
 	if (typeof block.signature === "string") {
 		const cached = ctx.signatures.get(signatureKey$1(block.signature));
@@ -594,38 +616,48 @@ async function rewriteThinking(block, ctx) {
 			thinking: cached
 		};
 	}
-	return {
-		...block,
-		thinking: await outbound$2(ctx.transform, block.thinking, { kind: "thinking" })
-	};
+	const copy = { ...block };
+	queue$2(pending, ctx.transform, block.thinking, { kind: "thinking" }, (text) => {
+		copy.thinking = text;
+	});
+	return copy;
 }
-async function rewriteContent$2(content, role, toolNames, ctx) {
+function rewriteContent$2(content, role, toolNames, ctx, pending, set) {
 	const textKind = role === "assistant" ? "assistant" : "user";
-	if (typeof content === "string") return outbound$2(ctx.transform, content, { kind: textKind });
-	if (!Array.isArray(content)) return malformed$2("message content");
+	if (typeof content === "string") {
+		queue$2(pending, ctx.transform, content, { kind: textKind }, set);
+		return;
+	}
+	if (!Array.isArray(content)) malformed$2("message content");
 	const out = [];
 	for (const block of content) {
-		if (!isObj$2(block)) return malformed$2("message content block");
+		if (!isObj$2(block)) malformed$2("message content block");
 		refuse$1(block);
 		switch (block.type) {
-			case "text":
-				if (typeof block.text !== "string") return malformed$2("text block");
-				out.push({
-					...block,
-					text: await outbound$2(ctx.transform, block.text, { kind: textKind })
+			case "text": {
+				if (typeof block.text !== "string") malformed$2("text block");
+				const copy = { ...block };
+				out.push(copy);
+				queue$2(pending, ctx.transform, block.text, { kind: textKind }, (text) => {
+					copy.text = text;
 				});
 				break;
+			}
 			case "thinking":
-				out.push(await rewriteThinking(block, ctx));
+				out.push(rewriteThinking(block, ctx, pending));
 				break;
 			case "tool_use": {
 				const toolName = typeof block.name === "string" ? block.name : void 0;
-				out.push({
+				const copy = {
 					...block,
-					input: await rewriteStrings$2(block.input, {
-						kind: "toolCall",
-						toolName
-					}, ctx.transform)
+					input: block.input
+				};
+				out.push(copy);
+				rewriteStrings$2(block.input, {
+					kind: "toolCall",
+					toolName
+				}, ctx.transform, pending, (input) => {
+					copy.input = input;
 				});
 				break;
 			}
@@ -635,19 +667,20 @@ async function rewriteContent$2(content, role, toolNames, ctx) {
 					break;
 				}
 				const toolName = typeof block.tool_use_id === "string" ? toolNames.get(block.tool_use_id) : void 0;
-				out.push({
-					...block,
-					content: await rewriteText(block.content, "tool_result content", (text) => outbound$2(ctx.transform, text, {
-						kind: "toolResult",
-						toolName
-					}))
+				const copy = { ...block };
+				out.push(copy);
+				rewriteText(block.content, "tool_result content", (text, setText) => queue$2(pending, ctx.transform, text, {
+					kind: "toolResult",
+					toolName
+				}, setText), (rewritten) => {
+					copy.content = rewritten;
 				});
 				break;
 			}
 			default: out.push(block);
 		}
 	}
-	return out;
+	set(out);
 }
 /** Maps each `tool_use` id to its tool name, so tool results can name their tool. */
 function toolNamesById(messages) {
@@ -858,21 +891,26 @@ const anthropicWalker = {
 	async request(body, ctx) {
 		if (!isObj$2(body)) return malformed$2("request body");
 		const out = { ...body };
-		if (body.system !== void 0) out.system = await rewriteText(body.system, "system", (text) => rewriteSystemText(text, ctx.transform));
-		if (ctx.transform.instruction !== void 0) out.system = withInstruction(out.system, ctx.transform.instruction);
+		const pending = [];
+		if (body.system !== void 0) rewriteText(body.system, "system", (text, set) => rewriteSystemText(text, ctx.transform, pending, set), (system) => {
+			out.system = system;
+		});
 		if (body.messages !== void 0) {
 			if (!Array.isArray(body.messages)) return malformed$2("messages");
 			const toolNames = toolNamesById(body.messages);
 			const messages = [];
 			for (const message of body.messages) {
 				if (!isObj$2(message)) return malformed$2("message");
-				messages.push({
-					...message,
-					content: await rewriteContent$2(message.content, message.role, toolNames, ctx)
+				const copy = { ...message };
+				messages.push(copy);
+				rewriteContent$2(message.content, message.role, toolNames, ctx, pending, (content) => {
+					copy.content = content;
 				});
 			}
 			out.messages = messages;
 		}
+		await runAll$2(pending);
+		if (ctx.transform.instruction !== void 0) out.system = withInstruction(out.system, ctx.transform.instruction);
 		return out;
 	},
 	response(body, ctx) {
@@ -915,47 +953,69 @@ const REFUSED_PARTS$1 = {
 };
 /** Reasoning fields used by OpenAI-compatible providers. */
 const REASONING_FIELDS = ["reasoning_content", "reasoning"];
-async function outbound$1(transform, text, leaf) {
-	return text === "" ? text : transform.outbound(text, leaf);
+/** Starts every queued rewrite at once; resolves when all results are written back, rejects on the first failure. */
+async function runAll$1(pending) {
+	await Promise.all(pending.map((run) => run()));
+}
+/** Queues the rewrite of one text leaf; `set` later replaces the original, which stays in place until then. */
+function queue$1(pending, transform, text, leaf, set) {
+	if (text !== "") pending.push(async () => set(await transform.outbound(text, leaf)));
 }
 /** A slot the walker reads holds a value it cannot classify: refused, never forwarded untransformed. */
 function malformed$1(slot) {
 	throw new UnsupportedContentError(`OpenAI chat ${slot} has an unexpected shape`);
 }
 /** A string, or an array of parts whose `text` parts are rewritten; `null`/absent carries no text; anything else is refused. */
-async function rewriteContent$1(content, leaf, transform) {
-	if (typeof content === "string") return outbound$1(transform, content, leaf);
-	if (content === void 0 || content === null) return content;
-	if (!Array.isArray(content)) return malformed$1("message content");
+function rewriteContent$1(content, leaf, transform, pending, set) {
+	if (typeof content === "string") {
+		queue$1(pending, transform, content, leaf, set);
+		return;
+	}
+	if (content === void 0 || content === null) return;
+	if (!Array.isArray(content)) malformed$1("message content");
 	const out = [];
 	for (const part of content) {
-		if (!isObj$1(part)) return malformed$1("content part");
+		if (!isObj$1(part)) malformed$1("content part");
 		if (typeof part.type === "string" && REFUSED_PARTS$1[part.type] === true) throw new UnsupportedContentError(`OpenAI chat ${part.type} content cannot be transformed`);
 		if (part.type !== "text") {
 			out.push(part);
 			continue;
 		}
-		if (typeof part.text !== "string") return malformed$1("text part");
-		out.push({
-			...part,
-			text: await outbound$1(transform, part.text, leaf)
+		if (typeof part.text !== "string") malformed$1("text part");
+		const copy = { ...part };
+		out.push(copy);
+		queue$1(pending, transform, part.text, leaf, (text) => {
+			copy.text = text;
 		});
 	}
-	return out;
+	set(out);
 }
-async function rewriteStrings$1(value, leaf, transform) {
-	if (typeof value === "string") return outbound$1(transform, value, leaf);
+function rewriteStrings$1(value, leaf, transform, pending, set) {
+	if (typeof value === "string") {
+		queue$1(pending, transform, value, leaf, set);
+		return;
+	}
 	if (Array.isArray(value)) {
 		const out = [];
-		for (const item of value) out.push(await rewriteStrings$1(item, leaf, transform));
-		return out;
+		for (const item of value) {
+			const index = out.push(item) - 1;
+			rewriteStrings$1(item, leaf, transform, pending, (rewritten) => {
+				out[index] = rewritten;
+			});
+		}
+		set(out);
+		return;
 	}
 	if (isObj$1(value)) {
 		const out = {};
-		for (const [key, item] of Object.entries(value)) out[key] = await rewriteStrings$1(item, leaf, transform);
-		return out;
+		for (const [key, item] of Object.entries(value)) {
+			out[key] = item;
+			rewriteStrings$1(item, leaf, transform, pending, (rewritten) => {
+				out[key] = rewritten;
+			});
+		}
+		set(out);
 	}
-	return value;
 }
 function restoreStrings(value, transform) {
 	if (typeof value === "string") return transform.inbound(value);
@@ -968,14 +1028,23 @@ function restoreStrings(value, transform) {
 	return value;
 }
 /** Tool-call arguments are a JSON string: rewrite its string leaves, or the raw text when it is not JSON. */
-async function rewriteArguments$1(args, leaf, transform) {
+function rewriteArguments$1(args, leaf, transform, pending, set) {
 	let parsed;
 	try {
 		parsed = JSON.parse(args);
 	} catch {
-		return outbound$1(transform, args, leaf);
+		queue$1(pending, transform, args, leaf, set);
+		return;
 	}
-	return JSON.stringify(await rewriteStrings$1(parsed, leaf, transform));
+	const leaves = [];
+	let rewritten = parsed;
+	rewriteStrings$1(parsed, leaf, transform, leaves, (value) => {
+		rewritten = value;
+	});
+	pending.push(async () => {
+		await runAll$1(leaves);
+		set(JSON.stringify(rewritten));
+	});
 }
 function restoreArguments$1(args, transform) {
 	let parsed;
@@ -986,7 +1055,7 @@ function restoreArguments$1(args, transform) {
 	}
 	return JSON.stringify(restoreStrings(parsed, transform));
 }
-async function rewriteToolCalls(calls, transform, names) {
+function rewriteToolCalls(calls, transform, names, pending) {
 	if (calls === void 0 || calls === null) return calls;
 	if (!Array.isArray(calls)) return malformed$1("tool_calls");
 	const out = [];
@@ -1000,53 +1069,59 @@ async function rewriteToolCalls(calls, transform, names) {
 		if (!isObj$1(fn) || typeof fn.arguments !== "string") return malformed$1("function tool call");
 		const toolName = typeof fn.name === "string" ? fn.name : void 0;
 		if (typeof call.id === "string" && toolName !== void 0) names.set(call.id, toolName);
+		const fnCopy = { ...fn };
 		out.push({
 			...call,
-			function: {
-				...fn,
-				arguments: await rewriteArguments$1(fn.arguments, {
-					kind: "toolCall",
-					toolName
-				}, transform)
-			}
+			function: fnCopy
+		});
+		rewriteArguments$1(fn.arguments, {
+			kind: "toolCall",
+			toolName
+		}, transform, pending, (args) => {
+			fnCopy.arguments = args;
 		});
 	}
 	return out;
 }
-async function rewriteMessage(message, transform, names) {
+function rewriteMessage(message, transform, names, pending) {
 	const out = { ...message };
+	const setContent = (content) => {
+		out.content = content;
+	};
 	switch (message.role) {
 		case "system":
 		case "developer":
-			out.content = await rewriteContent$1(message.content, { kind: "system" }, transform);
+			rewriteContent$1(message.content, { kind: "system" }, transform, pending, setContent);
 			break;
 		case "user":
-			out.content = await rewriteContent$1(message.content, { kind: "user" }, transform);
+			rewriteContent$1(message.content, { kind: "user" }, transform, pending, setContent);
 			break;
 		case "assistant":
 			for (const field of REASONING_FIELDS) {
 				const value = message[field];
-				if (typeof value === "string") out[field] = await outbound$1(transform, value, { kind: "thinking" });
+				if (typeof value === "string") queue$1(pending, transform, value, { kind: "thinking" }, (text) => {
+					out[field] = text;
+				});
 				else if (value !== void 0 && value !== null) return malformed$1(`assistant ${field}`);
 			}
-			out.content = await rewriteContent$1(message.content, { kind: "assistant" }, transform);
-			out.tool_calls = await rewriteToolCalls(message.tool_calls, transform, names);
+			rewriteContent$1(message.content, { kind: "assistant" }, transform, pending, setContent);
+			out.tool_calls = rewriteToolCalls(message.tool_calls, transform, names, pending);
 			if (message.tool_calls === void 0) delete out.tool_calls;
 			break;
 		case "tool": {
 			const toolName = typeof message.tool_call_id === "string" ? names.get(message.tool_call_id) : void 0;
-			out.content = await rewriteContent$1(message.content, {
+			rewriteContent$1(message.content, {
 				kind: "toolResult",
 				toolName
-			}, transform);
+			}, transform, pending, setContent);
 			break;
 		}
 		case "function": {
 			const toolName = typeof message.name === "string" ? message.name : void 0;
-			out.content = await rewriteContent$1(message.content, {
+			rewriteContent$1(message.content, {
 				kind: "toolResult",
 				toolName
-			}, transform);
+			}, transform, pending, setContent);
 			break;
 		}
 		default: return malformed$1("message role");
@@ -1298,11 +1373,13 @@ const openaiChatWalker = {
 		if (body.messages !== void 0) {
 			if (!Array.isArray(body.messages)) return malformed$1("messages");
 			const names = /* @__PURE__ */ new Map();
+			const pending = [];
 			const messages = [];
 			for (const message of body.messages) {
 				if (!isObj$1(message)) return malformed$1("message");
-				messages.push(await rewriteMessage(message, ctx.transform, names));
+				messages.push(rewriteMessage(message, ctx.transform, names, pending));
 			}
+			await runAll$1(pending);
 			if (ctx.transform.instruction !== void 0) messages.unshift({
 				role: "system",
 				content: ctx.transform.instruction
@@ -1357,56 +1434,87 @@ const signatureKey = (itemId) => `responses:${itemId}`;
 function refuse(part) {
 	if (typeof part.type === "string" && REFUSED_PARTS[part.type] === true) throw new UnsupportedContentError(`OpenAI responses ${part.type} content cannot be transformed`);
 }
-async function outbound(transform, text, leaf) {
-	return text === "" ? text : transform.outbound(text, leaf);
+/** Starts every queued rewrite at once; resolves when all results are written back, rejects on the first failure. */
+async function runAll(pending) {
+	await Promise.all(pending.map((run) => run()));
+}
+/** Queues the rewrite of one text leaf; `set` later replaces the original, which stays in place until then. */
+function queue(pending, transform, text, leaf, set) {
+	if (text !== "") pending.push(async () => set(await transform.outbound(text, leaf)));
 }
 /** A slot the walker reads holds a value it cannot classify: refused, never forwarded untransformed. */
 function malformed(slot) {
 	throw new UnsupportedContentError(`OpenAI responses ${slot} has an unexpected shape`);
 }
 /** A string, or an array of parts whose `input_text`/`output_text` parts are rewritten; anything else is refused. */
-async function rewriteContent(content, slot, leaf, transform) {
-	if (typeof content === "string") return outbound(transform, content, leaf);
-	if (!Array.isArray(content)) return malformed(slot);
+function rewriteContent(content, slot, leaf, transform, pending, set) {
+	if (typeof content === "string") {
+		queue(pending, transform, content, leaf, set);
+		return;
+	}
+	if (!Array.isArray(content)) malformed(slot);
 	const out = [];
 	for (const part of content) {
-		if (!isObj(part)) return malformed(`${slot} part`);
+		if (!isObj(part)) malformed(`${slot} part`);
 		refuse(part);
 		if (part.type !== "input_text" && part.type !== "output_text") {
 			out.push(part);
 			continue;
 		}
-		if (typeof part.text !== "string") return malformed(`${slot} ${part.type} part`);
-		out.push({
-			...part,
-			text: await outbound(transform, part.text, leaf)
+		if (typeof part.text !== "string") malformed(`${slot} ${part.type} part`);
+		const copy = { ...part };
+		out.push(copy);
+		queue(pending, transform, part.text, leaf, (text) => {
+			copy.text = text;
 		});
 	}
-	return out;
+	set(out);
 }
-async function rewriteStrings(value, leaf, transform) {
-	if (typeof value === "string") return outbound(transform, value, leaf);
+function rewriteStrings(value, leaf, transform, pending, set) {
+	if (typeof value === "string") {
+		queue(pending, transform, value, leaf, set);
+		return;
+	}
 	if (Array.isArray(value)) {
 		const out = [];
-		for (const item of value) out.push(await rewriteStrings(item, leaf, transform));
-		return out;
+		for (const item of value) {
+			const index = out.push(item) - 1;
+			rewriteStrings(item, leaf, transform, pending, (rewritten) => {
+				out[index] = rewritten;
+			});
+		}
+		set(out);
+		return;
 	}
 	if (isObj(value)) {
 		const out = {};
-		for (const [key, item] of Object.entries(value)) out[key] = await rewriteStrings(item, leaf, transform);
-		return out;
+		for (const [key, item] of Object.entries(value)) {
+			out[key] = item;
+			rewriteStrings(item, leaf, transform, pending, (rewritten) => {
+				out[key] = rewritten;
+			});
+		}
+		set(out);
 	}
-	return value;
 }
 /** Tool-call arguments: a JSON string whose string leaves are rewritten; raw text when it is not JSON. */
-async function rewriteArguments(args, leaf, transform) {
+function rewriteArguments(args, leaf, transform, pending, set) {
 	let parsed;
 	try {
 		parsed = JSON.parse(args);
 	} catch {
-		return outbound(transform, args, leaf);
+		queue(pending, transform, args, leaf, set);
+		return;
 	}
-	return JSON.stringify(await rewriteStrings(parsed, leaf, transform));
+	const leaves = [];
+	let rewritten = parsed;
+	rewriteStrings(parsed, leaf, transform, leaves, (value) => {
+		rewritten = value;
+	});
+	pending.push(async () => {
+		await runAll(leaves);
+		set(JSON.stringify(rewritten));
+	});
 }
 /** Restores the string values of a JSON text, keeping its formatting; restored originals are JSON-escaped. */
 function restoreArguments(args, transform) {
@@ -1430,16 +1538,26 @@ function cachedSummary(item, ctx) {
 	if (!Array.isArray(texts) || !Array.isArray(item.summary) || texts.length !== item.summary.length) return void 0;
 	return texts;
 }
-async function rewriteReasoning(item, ctx) {
+function rewriteReasoning(item, ctx, pending) {
 	if (item.summary === void 0) return item;
 	if (!Array.isArray(item.summary)) return malformed("reasoning summary");
 	for (const part of item.summary) if (!isObj(part) || typeof part.text !== "string") return malformed("reasoning summary part");
 	const cached = cachedSummary(item, ctx);
 	const summary = [];
-	for (const [i, part] of item.summary.entries()) summary.push({
-		...part,
-		text: cached !== void 0 ? cached[i] : await outbound(ctx.transform, part.text, { kind: "thinking" })
-	});
+	for (const [i, part] of item.summary.entries()) {
+		if (cached !== void 0) {
+			summary.push({
+				...part,
+				text: cached[i]
+			});
+			continue;
+		}
+		const copy = { ...part };
+		summary.push(copy);
+		queue(pending, ctx.transform, part.text, { kind: "thinking" }, (text) => {
+			copy.text = text;
+		});
+	}
 	return {
 		...item,
 		summary
@@ -1455,38 +1573,39 @@ function toolNamesByCallId(items) {
 	for (const item of items) if (isObj(item) && item.type === "function_call" && typeof item.call_id === "string" && typeof item.name === "string") names.set(item.call_id, item.name);
 	return names;
 }
-async function rewriteItem(item, toolNames, ctx) {
+function rewriteItem(item, toolNames, ctx, pending) {
+	const out = { ...item };
 	if (item.type === "message" || item.type === void 0 && item.role !== void 0) {
 		const kind = roleKind(item.role);
 		if (kind === void 0) return malformed("message role");
-		return {
-			...item,
-			content: await rewriteContent(item.content, "message content", { kind }, ctx.transform)
-		};
+		rewriteContent(item.content, "message content", { kind }, ctx.transform, pending, (content) => {
+			out.content = content;
+		});
+		return out;
 	}
 	switch (item.type) {
 		case "function_call": {
 			if (typeof item.arguments !== "string") return malformed("function_call arguments");
 			const toolName = typeof item.name === "string" ? item.name : void 0;
-			return {
-				...item,
-				arguments: await rewriteArguments(item.arguments, {
-					kind: "toolCall",
-					toolName
-				}, ctx.transform)
-			};
+			rewriteArguments(item.arguments, {
+				kind: "toolCall",
+				toolName
+			}, ctx.transform, pending, (args) => {
+				out.arguments = args;
+			});
+			return out;
 		}
 		case "function_call_output": {
 			const toolName = typeof item.call_id === "string" ? toolNames.get(item.call_id) : void 0;
-			return {
-				...item,
-				output: await rewriteContent(item.output, "function_call_output output", {
-					kind: "toolResult",
-					toolName
-				}, ctx.transform)
-			};
+			rewriteContent(item.output, "function_call_output output", {
+				kind: "toolResult",
+				toolName
+			}, ctx.transform, pending, (output) => {
+				out.output = output;
+			});
+			return out;
 		}
-		case "reasoning": return rewriteReasoning(item, ctx);
+		case "reasoning": return rewriteReasoning(item, ctx, pending);
 		default: return item;
 	}
 }
@@ -1676,20 +1795,26 @@ const openaiResponsesWalker = {
 	async request(body, ctx) {
 		if (!isObj(body)) return malformed("request body");
 		const out = { ...body };
-		if (typeof body.instructions === "string") out.instructions = await outbound(ctx.transform, body.instructions, { kind: "system" });
+		const pending = [];
+		if (typeof body.instructions === "string") queue(pending, ctx.transform, body.instructions, { kind: "system" }, (text) => {
+			out.instructions = text;
+		});
 		else if (body.instructions !== void 0 && body.instructions !== null) return malformed("instructions");
-		const instruction = ctx.transform.instruction;
-		if (instruction !== void 0) out.instructions = typeof out.instructions === "string" && out.instructions !== "" ? `${instruction}\n\n${out.instructions}` : instruction;
-		if (typeof body.input === "string") out.input = await outbound(ctx.transform, body.input, { kind: "user" });
+		if (typeof body.input === "string") queue(pending, ctx.transform, body.input, { kind: "user" }, (text) => {
+			out.input = text;
+		});
 		else if (Array.isArray(body.input)) {
 			const toolNames = toolNamesByCallId(body.input);
 			const input = [];
 			for (const item of body.input) {
 				if (!isObj(item)) return malformed("input item");
-				input.push(await rewriteItem(item, toolNames, ctx));
+				input.push(rewriteItem(item, toolNames, ctx, pending));
 			}
 			out.input = input;
 		} else if (body.input !== void 0) return malformed("input");
+		await runAll(pending);
+		const instruction = ctx.transform.instruction;
+		if (instruction !== void 0) out.instructions = typeof out.instructions === "string" && out.instructions !== "" ? `${instruction}\n\n${out.instructions}` : instruction;
 		return out;
 	},
 	response(body, ctx) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skaile/transform-proxy",
-  "version": "0.5.1",
+  "version": "0.6.0",
   "type": "module",
   "description": "Same-protocol passthrough proxy that runs model requests and replies through a chain of text transforms (Anthropic Messages, OpenAI chat, OpenAI responses)",
   "license": "MIT",