@stage-labs/metro 0.1.0-beta.70 → 0.1.0-beta.72

package/runtime/node_modules/@metro-labs/mcp/src/gateway/codex-auth.ts

@@ -0,0 +1,231 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { isRecord } from '../daemon/is-record.js';
+
+export const CODEX_CLIENT_ID = 'app_EMoamEEZ73f0CkXaXp7hrann';
+export const CODEX_ISSUER = 'https://auth.openai.com';
+export const CODEX_REDIRECT = 'http://localhost:1455/auth/callback';
+const SCOPE = 'openid profile email offline_access api.connectors.read api.connectors.invoke';
+const AUTH_CLAIM = 'https://api.openai.com/auth';
+const PENDING_TTL_MS = 10 * 60_000;
+export const ACCESS_TOKEN_TTL_MS = 55 * 60_000;
+
+export interface CodexTokens {
+  accessToken: string;
+  refreshToken: string;
+  idToken: string;
+  accountId: string;
+  email: string | null;
+  plan: string | null;
+  savedAt: string;
+}
+
+export class CodexAuthError extends Error {}
+
+interface Pending {
+  verifier: string;
+  at: number;
+}
+
+const pending = new Map<string, Pending>();
+
+const b64url = (buf: Buffer): string => buf.toString('base64url');
+
+export function newPkce(): { verifier: string; challenge: string } {
+  const verifier = b64url(randomBytes(32));
+  const challenge = b64url(createHash('sha256').update(verifier).digest());
+  return { verifier, challenge };
+}
+
+export function authorizeUrl(state: string, challenge: string, issuer = CODEX_ISSUER): string {
+  const query = new URLSearchParams({
+    response_type: 'code',
+    client_id: CODEX_CLIENT_ID,
+    redirect_uri: CODEX_REDIRECT,
+    scope: SCOPE,
+    code_challenge: challenge,
+    code_challenge_method: 'S256',
+    id_token_add_organizations: 'true',
+    codex_cli_simplified_flow: 'true',
+    state,
+    originator: 'codex_cli_rs',
+  });
+  return `${issuer}/oauth/authorize?${query.toString()}`;
+}
+
+function sweep(now: number): void {
+  for (const [state, entry] of pending) if (now - entry.at > PENDING_TTL_MS) pending.delete(state);
+}
+
+export function beginLogin(issuer = CODEX_ISSUER, now = Date.now()): { url: string; state: string } {
+  sweep(now);
+  const { verifier, challenge } = newPkce();
+  const state = b64url(randomBytes(24));
+  pending.set(state, { verifier, at: now });
+  return { url: authorizeUrl(state, challenge, issuer), state };
+}
+
+export function parseCallback(raw: string): { code: string; state: string } {
+  const text = raw.trim();
+  let query: URLSearchParams;
+  try {
+    query = new URL(text).searchParams;
+  } catch {
+    query = new URLSearchParams(text.replace(/^\?/, ''));
+  }
+  const code = query.get('code')?.trim() ?? '';
+  const state = query.get('state')?.trim() ?? '';
+  if (code === '' || state === '')
+    throw new CodexAuthError('paste the whole address the browser landed on; it carries code= and state=');
+  return { code, state };
+}
+
+function decodeJwtPayload(jwt: string): Record<string, unknown> {
+  const part = jwt.split('.')[1] ?? '';
+  try {
+    const parsed: unknown = JSON.parse(Buffer.from(part, 'base64url').toString('utf8'));
+    return isRecord(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+
+const text = (value: unknown): string | null => (typeof value === 'string' && value !== '' ? value : null);
+
+export function claimsOf(idToken: string): { accountId: string | null; email: string | null; plan: string | null } {
+  const payload = decodeJwtPayload(idToken);
+  const auth = isRecord(payload[AUTH_CLAIM]) ? payload[AUTH_CLAIM] : {};
+  return { accountId: text(auth.chatgpt_account_id), email: text(payload.email), plan: text(auth.chatgpt_plan_type) };
+}
+
+interface TokenResponse {
+  id_token?: unknown;
+  access_token?: unknown;
+  refresh_token?: unknown;
+}
+
+const EMPTY_TOKENS: CodexTokens = { accessToken: '', refreshToken: '', idToken: '', accountId: '', email: null, plan: null, savedAt: '' };
+
+function assertUsable(next: CodexTokens): CodexTokens {
+  if (next.accessToken === '' || next.refreshToken === '') throw new CodexAuthError('the token endpoint returned no usable tokens');
+  if (next.accountId === '') throw new CodexAuthError('the id token carries no ChatGPT account id; sign in with a ChatGPT account that has Codex');
+  return next;
+}
+
+const pick = (fresh: string | null, kept: string | null): string | null => fresh ?? kept;
+
+export function tokensFrom(body: unknown, previous: CodexTokens | null, now = new Date()): CodexTokens {
+  const res = (isRecord(body) ? body : {}) as TokenResponse;
+  const kept = previous ?? EMPTY_TOKENS;
+  const idToken = pick(text(res.id_token), kept.idToken) ?? '';
+  const claims = claimsOf(idToken);
+  return assertUsable({
+    accessToken: text(res.access_token) ?? '',
+    refreshToken: pick(text(res.refresh_token), kept.refreshToken) ?? '',
+    idToken,
+    accountId: pick(claims.accountId, kept.accountId) ?? '',
+    email: pick(claims.email, kept.email),
+    plan: pick(claims.plan, kept.plan),
+    savedAt: now.toISOString(),
+  });
+}
+
+async function tokenCall(issuer: string, init: RequestInit, fetchImpl: typeof fetch): Promise<unknown> {
+  const res = await fetchImpl(`${issuer}/oauth/token`, init);
+  const raw = await res.text();
+  if (!res.ok) {
+    let detail = raw.slice(0, 300);
+    try {
+      const parsed: unknown = JSON.parse(raw);
+      if (isRecord(parsed)) detail = text(parsed.error_description) ?? text(parsed.error) ?? detail;
+    } catch {
+      detail = raw.slice(0, 300);
+    }
+    throw new CodexAuthError(`OpenAI refused the token request (${String(res.status)}): ${detail}`);
+  }
+  return JSON.parse(raw) as unknown;
+}
+
+export async function finishLogin(
+  callback: string,
+  issuer = CODEX_ISSUER,
+  fetchImpl: typeof fetch = fetch,
+  now = Date.now(),
+): Promise<CodexTokens> {
+  sweep(now);
+  const { code, state } = parseCallback(callback);
+  const entry = pending.get(state);
+  if (entry === undefined) throw new CodexAuthError('this sign-in link has expired or was started elsewhere; press Connect again');
+  pending.delete(state);
+  return exchangeCode(issuer, code, entry.verifier, CODEX_REDIRECT, fetchImpl, now);
+}
+
+export async function exchangeCode(
+  issuer: string,
+  code: string,
+  verifier: string,
+  redirectUri: string,
+  fetchImpl: typeof fetch,
+  now = Date.now(),
+): Promise<CodexTokens> {
+  const body = new URLSearchParams({
+    grant_type: 'authorization_code',
+    code,
+    redirect_uri: redirectUri,
+    client_id: CODEX_CLIENT_ID,
+    code_verifier: verifier,
+  });
+  const res = await tokenCall(
+    issuer,
+    { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: body.toString() },
+    fetchImpl,
+  );
+  return tokensFrom(res, null, new Date(now));
+}
+
+export async function refreshTokens(previous: CodexTokens, issuer = CODEX_ISSUER, fetchImpl: typeof fetch = fetch): Promise<CodexTokens> {
+  const res = await tokenCall(
+    issuer,
+    {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ client_id: CODEX_CLIENT_ID, grant_type: 'refresh_token', refresh_token: previous.refreshToken }),
+    },
+    fetchImpl,
+  );
+  return tokensFrom(res, previous);
+}
+
+export const tokensStale = (tokens: CodexTokens, now = Date.now()): boolean =>
+  now - Date.parse(tokens.savedAt) > ACCESS_TOKEN_TTL_MS;
+
+function readAuthFile(home: string): Record<string, unknown> {
+  let raw: unknown;
+  try {
+    raw = JSON.parse(readFileSync(join(home, '.codex', 'auth.json'), 'utf8'));
+  } catch {
+    throw new CodexAuthError('no Codex CLI login on this machine (~/.codex/auth.json); run codex login there first, or connect here');
+  }
+  return isRecord(raw) ? raw : {};
+}
+
+export function readCodexCliAuth(home = homedir()): CodexTokens {
+  const raw = readAuthFile(home);
+  if (!isRecord(raw.tokens)) throw new CodexAuthError('~/.codex/auth.json holds no ChatGPT tokens (an API-key login cannot be reused here)');
+  const stored = raw.tokens;
+  const idToken = text(stored.id_token) ?? '';
+  const claims = claimsOf(idToken);
+  const found: CodexTokens = {
+    accessToken: text(stored.access_token) ?? '',
+    refreshToken: text(stored.refresh_token) ?? '',
+    idToken,
+    accountId: text(stored.account_id) ?? claims.accountId ?? '',
+    email: claims.email,
+    plan: claims.plan,
+    savedAt: text(raw.last_refresh) ?? new Date(0).toISOString(),
+  };
+  if ([found.accessToken, found.refreshToken, found.accountId].includes('')) throw new CodexAuthError('~/.codex/auth.json is missing a token or the account id');
+  return found;
+}

package/runtime/node_modules/@metro-labs/mcp/src/gateway/codex-device.ts

@@ -0,0 +1,91 @@
+import { randomBytes } from 'node:crypto';
+import { isRecord } from '../daemon/is-record.js';
+import { errMsg } from '../daemon/log.js';
+import { CODEX_CLIENT_ID, CODEX_ISSUER, CodexAuthError, exchangeCode, type CodexTokens } from './codex-auth.js';
+
+const VERIFY_PATH = '/codex/device';
+const DEVICE_TTL_MS = 15 * 60_000;
+const DEFAULT_INTERVAL_S = 5;
+const ID_BYTES = 18;
+
+export interface DeviceLogin {
+  id: string;
+  userCode: string;
+  verifyUrl: string;
+  interval: number;
+}
+
+export type DeviceStatus = { status: 'pending' } | { status: 'done'; tokens: CodexTokens } | { status: 'failed'; error: string };
+
+interface Entry {
+  deviceAuthId: string;
+  userCode: string;
+  interval: number;
+  issuer: string;
+  startedAt: number;
+  polledAt: number | null;
+}
+
+const logins = new Map<string, Entry>();
+
+const str = (value: unknown): string => (typeof value === 'string' ? value : '');
+
+function intervalOf(value: unknown): number {
+  const n = typeof value === 'number' ? value : typeof value === 'string' ? Number(value) : NaN;
+  return Number.isFinite(n) && n >= 1 ? Math.round(n) : DEFAULT_INTERVAL_S;
+}
+
+function sweep(now: number): void {
+  for (const [id, entry] of logins) if (now - entry.startedAt > DEVICE_TTL_MS) logins.delete(id);
+}
+
+const post = (url: string, body: unknown, fetchImpl: typeof fetch): Promise<Response> =>
+  fetchImpl(url, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) });
+
+export async function beginDeviceLogin(issuer = CODEX_ISSUER, fetchImpl: typeof fetch = fetch, now = Date.now()): Promise<DeviceLogin> {
+  sweep(now);
+  const res = await post(`${issuer}/api/accounts/deviceauth/usercode`, { client_id: CODEX_CLIENT_ID }, fetchImpl);
+  if (res.status === 404) throw new CodexAuthError('OpenAI is not offering the device-code sign-in right now; use the browser sign-in instead');
+  if (!res.ok) throw new CodexAuthError(`OpenAI refused to start the device-code sign-in (${String(res.status)})`);
+  const body: unknown = await res.json();
+  const parsed = isRecord(body) ? body : {};
+  const deviceAuthId = str(parsed.device_auth_id);
+  const userCode = str(parsed.user_code) || str(parsed.usercode);
+  if (deviceAuthId === '' || userCode === '') throw new CodexAuthError('OpenAI answered without a device code');
+  const id = randomBytes(ID_BYTES).toString('base64url');
+  const interval = intervalOf(parsed.interval);
+  logins.set(id, { deviceAuthId, userCode, interval, issuer, startedAt: now, polledAt: null });
+  return { id, userCode, verifyUrl: `${issuer}${VERIFY_PATH}`, interval };
+}
+
+async function claim(entry: Entry, fetchImpl: typeof fetch, now: number): Promise<DeviceStatus> {
+  const res = await post(`${entry.issuer}/api/accounts/deviceauth/token`, { device_auth_id: entry.deviceAuthId, user_code: entry.userCode }, fetchImpl);
+  if (res.status === 403 || res.status === 404) {
+    await res.body?.cancel();
+    return { status: 'pending' };
+  }
+  if (!res.ok) return { status: 'failed', error: `OpenAI ended the device-code sign-in (${String(res.status)})` };
+  const body: unknown = await res.json();
+  const parsed = isRecord(body) ? body : {};
+  const code = str(parsed.authorization_code);
+  const verifier = str(parsed.code_verifier);
+  if (code === '' || verifier === '') return { status: 'failed', error: 'OpenAI approved the sign-in but sent no code back' };
+  const tokens = await exchangeCode(entry.issuer, code, verifier, `${entry.issuer}/deviceauth/callback`, fetchImpl, now);
+  return { status: 'done', tokens };
+}
+
+export async function pollDeviceLogin(id: string, fetchImpl: typeof fetch = fetch, now = Date.now()): Promise<DeviceStatus> {
+  sweep(now);
+  const entry = logins.get(id);
+  if (entry === undefined) throw new CodexAuthError('this sign-in has expired or already finished; press Connect again');
+  if (entry.polledAt !== null && now - entry.polledAt < entry.interval * 1000) return { status: 'pending' };
+  entry.polledAt = now;
+  let result: DeviceStatus;
+  try {
+    result = await claim(entry, fetchImpl, now);
+  } catch (err) {
+    result = { status: 'failed', error: errMsg(err) };
+  }
+  if (result.status !== 'pending') logins.delete(id);
+  return result;
+}

package/runtime/node_modules/@metro-labs/mcp/src/gateway/codex-stream.ts

@@ -0,0 +1,288 @@
+import { isRecord } from '../daemon/is-record.js';
+import { encodeSignature } from './codex-translate.js';
+
+type Item = Record<string, unknown>;
+
+interface Block {
+  index: number;
+  kind: 'text' | 'thinking' | 'tool_use';
+  deltas: number;
+}
+
+interface Usage {
+  input_tokens: number;
+  output_tokens: number;
+  cache_read_input_tokens: number;
+}
+
+const frame = (event: string, data: unknown): string => `event: ${event}\ndata: ${JSON.stringify(data)}\n\n`;
+const str = (value: unknown): string => (typeof value === 'string' ? value : '');
+const responseOf = (data: Item): Item => (isRecord(data.response) ? data.response : {});
+const itemOf = (data: Item): Item => (isRecord(data.item) ? data.item : {});
+
+function errorKind(code: string): string {
+  if (code === 'rate_limit_exceeded' || code === 'usage_limit_reached') return 'rate_limit_error';
+  if (code === 'context_length_exceeded' || code === 'invalid_prompt') return 'invalid_request_error';
+  if (code === 'insufficient_quota') return 'permission_error';
+  return 'api_error';
+}
+
+function usageOf(response: Item): Usage {
+  const usage = isRecord(response.usage) ? response.usage : {};
+  const details = isRecord(usage.input_tokens_details) ? usage.input_tokens_details : {};
+  const cached = typeof details.cached_tokens === 'number' ? details.cached_tokens : 0;
+  const input = typeof usage.input_tokens === 'number' ? usage.input_tokens : 0;
+  return {
+    input_tokens: Math.max(0, input - cached),
+    output_tokens: typeof usage.output_tokens === 'number' ? usage.output_tokens : 0,
+    cache_read_input_tokens: cached,
+  };
+}
+
+const startBlock = (kind: Block['kind'], id: string, name: string): Item =>
+  kind === 'text' ? { type: 'text', text: '' } : kind === 'thinking' ? { type: 'thinking', thinking: '' } : { type: 'tool_use', id, name, input: {} };
+
+const messageText = (item: Item): string =>
+  Array.isArray(item.content) ? item.content.filter(isRecord).map((part) => str(part.text)).join('') : '';
+
+export class CodexEventTranslator {
+  private readonly blocks = new Map<string, Block>();
+  private next = 0;
+  private started = false;
+  private toolCalls = 0;
+  private done = false;
+  private readonly model: string;
+  private readonly restore: (name: string) => string;
+  private readonly handlers: Record<string, (data: Item) => string> = {
+    'response.created': (d) => this.start(responseOf(d)),
+    'response.output_item.added': (d) => this.start({}) + this.itemAdded(itemOf(d)),
+    'response.output_text.delta': (d) => this.delta(str(d.item_id), 'text', str(d.delta)),
+    'response.reasoning_summary_text.delta': (d) => this.delta(str(d.item_id), 'thinking', str(d.delta)),
+    'response.reasoning_summary_part.added': (d) => this.partAdded(str(d.item_id)),
+    'response.function_call_arguments.delta': (d) => this.delta(str(d.item_id), 'tool_use', str(d.delta)),
+    'response.output_item.done': (d) => this.itemDone(itemOf(d)),
+    'response.completed': (d) => this.start(responseOf(d)) + this.completed(responseOf(d)),
+    'response.failed': (d) => this.failed(responseOf(d), 'Codex failed the response'),
+    'response.incomplete': (d) => this.incomplete(responseOf(d)),
+    error: (d) => this.failed({ error: d }, 'Codex stream error'),
+  };
+
+  constructor(model: string, restore: (name: string) => string = (name) => name) {
+    this.model = model;
+    this.restore = restore;
+  }
+
+  get finished(): boolean {
+    return this.done;
+  }
+
+  private open(key: string, kind: Block['kind'], id = '', name = ''): string {
+    const block: Block = { index: this.next, kind, deltas: 0 };
+    this.next += 1;
+    this.blocks.set(key, block);
+    return frame('content_block_start', { type: 'content_block_start', index: block.index, content_block: startBlock(kind, id, name) });
+  }
+
+  private start(response: Item): string {
+    if (this.started) return '';
+    this.started = true;
+    return frame('message_start', {
+      type: 'message_start',
+      message: {
+        id: str(response.id) || 'msg_codex',
+        type: 'message',
+        role: 'assistant',
+        model: this.model,
+        content: [],
+        stop_reason: null,
+        stop_sequence: null,
+        usage: { input_tokens: 0, output_tokens: 0 },
+      },
+    });
+  }
+
+  private openCall(key: string, item: Item): string {
+    this.toolCalls += 1;
+    return this.open(key, 'tool_use', str(item.call_id) || key, this.restore(str(item.name)));
+  }
+
+  private itemAdded(item: Item): string {
+    const key = str(item.id) || String(this.next);
+    if (item.type === 'function_call') return this.openCall(key, item);
+    if (item.type === 'reasoning') return this.open(key, 'thinking');
+    return '';
+  }
+
+  private partAdded(key: string): string {
+    const block = this.blocks.get(key);
+    return block !== undefined && block.deltas > 0 ? this.delta(key, 'thinking', '\n\n') : '';
+  }
+
+  private delta(key: string, kind: Block['kind'], text: string): string {
+    const opened = this.blocks.has(key) ? '' : this.open(key, kind);
+    const block = this.blocks.get(key);
+    if (block === undefined) return opened;
+    block.deltas += 1;
+    const delta =
+      kind === 'tool_use' ? { type: 'input_json_delta', partial_json: text } : kind === 'text' ? { type: 'text_delta', text } : { type: 'thinking_delta', thinking: text };
+    return opened + frame('content_block_delta', { type: 'content_block_delta', index: block.index, delta });
+  }
+
+  private stop(key: string): string {
+    const block = this.blocks.get(key);
+    if (block === undefined) return '';
+    this.blocks.delete(key);
+    return frame('content_block_stop', { type: 'content_block_stop', index: block.index });
+  }
+
+  private reasoningDone(key: string, item: Item): string {
+    const opened = this.blocks.has(key) ? '' : this.open(key, 'thinking');
+    const block = this.blocks.get(key);
+    if (block === undefined || typeof item.encrypted_content !== 'string') return opened + this.stop(key);
+    const signature = encodeSignature({ id: key, encrypted_content: item.encrypted_content });
+    return opened + frame('content_block_delta', { type: 'content_block_delta', index: block.index, delta: { type: 'signature_delta', signature } }) + this.stop(key);
+  }
+
+  private callDone(key: string, item: Item): string {
+    let out = this.blocks.has(key) ? '' : this.openCall(key, item);
+    if (this.blocks.get(key)?.deltas === 0 && str(item.arguments) !== '') out += this.delta(key, 'tool_use', str(item.arguments));
+    return out + this.stop(key);
+  }
+
+  private itemDone(item: Item): string {
+    const key = str(item.id);
+    if (item.type === 'reasoning') return this.reasoningDone(key, item);
+    if (item.type === 'function_call') return this.callDone(key, item);
+    if (item.type === 'message' && !this.blocks.has(key) && messageText(item) !== '') return this.delta(key, 'text', messageText(item)) + this.stop(key);
+    return this.stop(key);
+  }
+
+  private completed(response: Item, forced: string | null = null): string {
+    this.done = true;
+    let out = '';
+    for (const key of [...this.blocks.keys()]) out += this.stop(key);
+    const stop = forced ?? (this.toolCalls > 0 ? 'tool_use' : 'end_turn');
+    out += frame('message_delta', { type: 'message_delta', delta: { stop_reason: stop, stop_sequence: null }, usage: usageOf(response) });
+    return out + frame('message_stop', { type: 'message_stop' });
+  }
+
+  private incomplete(response: Item): string {
+    const details = isRecord(response.incomplete_details) ? response.incomplete_details : {};
+    if (details.reason === 'max_output_tokens') return this.start(response) + this.completed(response, 'max_tokens');
+    return this.failed(response, `Codex left the response incomplete (${str(details.reason) || 'no reason given'})`);
+  }
+
+  private failed(response: Item, fallback: string): string {
+    this.done = true;
+    const error = isRecord(response.error) ? response.error : {};
+    return frame('error', { type: 'error', error: { type: errorKind(str(error.code)), message: str(error.message) || fallback } });
+  }
+
+  push(event: string, data: Item): string {
+    const handler = this.handlers[event];
+    return handler === undefined ? '' : handler(data);
+  }
+
+  close(message = 'Codex ended the stream before completing the response'): string {
+    if (this.done) return '';
+    this.done = true;
+    return frame('error', { type: 'error', error: { type: 'api_error', message } });
+  }
+}
+
+export interface SseEvent {
+  event: string;
+  data: string;
+}
+
+export class SseParser {
+  private pending = '';
+
+  push(chunk: string): SseEvent[] {
+    this.pending += chunk;
+    const out: SseEvent[] = [];
+    for (;;) {
+      const at = this.pending.indexOf('\n\n');
+      if (at < 0) break;
+      const raw = this.pending.slice(0, at);
+      this.pending = this.pending.slice(at + 2);
+      let event = '';
+      const data: string[] = [];
+      for (const line of raw.split('\n')) {
+        if (line.startsWith('event:')) event = line.slice(6).trim();
+        else if (line.startsWith('data:')) data.push(line.slice(5).trimStart());
+      }
+      if (data.length > 0) out.push({ event, data: data.join('\n') });
+    }
+    return out;
+  }
+}
+
+export function parseEvent(raw: SseEvent): { event: string; data: Item } | null {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(raw.data);
+  } catch {
+    return null;
+  }
+  if (!isRecord(parsed)) return null;
+  const event = raw.event !== '' ? raw.event : str(parsed.type);
+  return event === '' ? null : { event, data: parsed };
+}
+
+interface Assembled {
+  message: Item;
+  blocks: Item[];
+}
+
+const FOLDS: Record<string, (state: Assembled, data: Item) => void> = {
+  message_start: (state, data) => {
+    if (isRecord(data.message)) state.message = { ...data.message };
+  },
+  content_block_start: (state, data) => {
+    if (isRecord(data.content_block)) state.blocks.push({ ...data.content_block });
+  },
+  content_block_delta: (state, data) => {
+    if (isRecord(data.delta)) applyDelta(state.blocks[typeof data.index === 'number' ? data.index : -1], data.delta);
+  },
+  message_delta: (state, data) => {
+    if (isRecord(data.delta)) state.message.stop_reason = data.delta.stop_reason ?? null;
+    if (isRecord(data.usage)) state.message.usage = data.usage;
+  },
+  error: (state, data) => {
+    state.message = { type: 'error', error: data.error };
+  },
+};
+
+function foldFrame(state: Assembled, event: string, data: Item): void {
+  FOLDS[event]?.(state, data);
+}
+
+function applyDelta(block: Item | undefined, delta: Item): void {
+  if (block === undefined) return;
+  if (delta.type === 'text_delta') block.text = str(block.text) + str(delta.text);
+  else if (delta.type === 'thinking_delta') block.thinking = str(block.thinking) + str(delta.thinking);
+  else if (delta.type === 'signature_delta') block.signature = str(delta.signature);
+  else if (delta.type === 'input_json_delta') block.json = str(block.json) + str(delta.partial_json);
+}
+
+export function assembleMessage(frames: string): Item {
+  const state: Assembled = { message: {}, blocks: [] };
+  for (const raw of new SseParser().push(frames)) {
+    const parsed = parseEvent(raw);
+    if (parsed !== null) foldFrame(state, parsed.event, parsed.data);
+  }
+  if (state.message.type === 'error') return state.message;
+  const content = state.blocks.map((block) => {
+    if (block.type !== 'tool_use') return block;
+    const { json, ...rest } = block;
+    let input: unknown = {};
+    try {
+      input = JSON.parse(str(json) || '{}');
+    } catch {
+      input = {};
+    }
+    return { ...rest, input };
+  });
+  return { ...state.message, content };
+}