@superjackfruitlabs/salaam 0.0.1 → 0.0.2

package/dist/src/host.js

@@ -4,6 +4,8 @@ import { readFileSync, readdirSync, mkdirSync, openSync, writeFileSync, fsyncSyn
 import { join, resolve, isAbsolute, sep } from 'node:path';
 import { ROOT, bundleDigest } from './config.js';
 import { digest, object, string, ServiceError } from './protocol.js';
+import { bindProviderConfiguration } from './provider-model.js';
+import { resolveProviderAuth } from './provider-auth.js';
 import { providerRoute } from './provider-config.js';
 import { engineRequest } from './execution-boundary.js';
 import { DockerCodingExecutor } from './coding-executor.js';
@@ -41,6 +43,9 @@ export async function planHost(input) {
     mkdirSync(coding_root, { recursive: true, mode: 0o700 });
     const executor = new DockerCodingExecutor(engineRequest(coding_socket));
     await executor.prepare(coding_root);
+    let route = providerRoute(c.provider === undefined ? 'offline' : String(c.provider), c.model, c.max_output_tokens, c.workspace_id);
+    if (route.provider !== 'salaam-proof')
+        route = bindProviderConfiguration(route, await resolveProviderAuth(route));
     return {
         schema: 1,
         node: realpathSync(process.execPath),
@@ -50,7 +55,7 @@ export async function planHost(input) {
         state,
         coding_root: realpathSync(coding_root),
         coding_socket,
-        provider: providerRoute(c.provider === undefined ? 'offline' : String(c.provider), c.model, c.max_output_tokens, c.workspace_id),
+        provider: route,
         profile_digest: executor.profileDigest,
         engine_id: executor.engineId,
     };

package/dist/src/house-extension.js

@@ -11,7 +11,7 @@ export default function house(pi) {
         throw new Error('Missing Salaam worker configuration');
     const c = config;
     const route = c.route ?? { ...OFFLINE_ROUTE };
-    const bridge = (method, data = {}) => call(c.socket, `/worker/${c.session}/${method}`, { epoch: c.epoch, ...data }, c.token, 2000);
+    const bridge = (method, data = {}) => call(c.socket, `/worker/${c.session}/${method}`, { epoch: c.epoch, ...data }, c.token, method === 'provider.auth' ? 120000 : 2000);
     let timer;
     let shutdown;
     const fail = async () => {
@@ -23,28 +23,29 @@ export default function house(pi) {
         }
         shutdown?.();
     };
-    pi.registerTool({
-        name: 'salaam_probe',
-        label: 'Salaam readiness probe',
-        description: 'Verify the managed tool gate without external effects.',
-        parameters: Type.Object({ nested: Type.Optional(Type.Boolean()) }),
-        annotations: { readOnlyHint: true, openWorldHint: false },
-        async execute(toolCallId, params, signal, _update, ctx) {
-            if (params.nested) {
-                const outcome = await ctx.executeTool('salaam_probe', {}, { signal });
-                if (outcome.isError) {
-                    await fail();
-                    throw new Error('Nested managed probe failed');
+    if (workerTools(!!c.effects, !!c.child, c.coding, c.worker_binding?.binding.tools).includes('salaam_probe'))
+        pi.registerTool({
+            name: 'salaam_probe',
+            label: 'Salaam readiness probe',
+            description: 'Verify the managed tool gate without external effects.',
+            parameters: Type.Object({ nested: Type.Optional(Type.Boolean()) }),
+            annotations: { readOnlyHint: true, openWorldHint: false },
+            async execute(toolCallId, params, signal, _update, ctx) {
+                if (params.nested) {
+                    const outcome = await ctx.executeTool('salaam_probe', {}, { signal });
+                    if (outcome.isError) {
+                        await fail();
+                        throw new Error('Nested managed probe failed');
+                    }
+                    return { ...outcome.result, isError: outcome.isError };
                 }
-                return { ...outcome.result, isError: outcome.isError };
-            }
-            await bridge('tool', { tool: 'salaam_probe', tool_call_id: toolCallId });
-            return {
-                content: [{ type: 'text', text: 'managed probe granted' }],
-                details: { granted: true },
-            };
-        },
-    });
+                await bridge('tool', { tool: 'salaam_probe', tool_call_id: toolCallId });
+                return {
+                    content: [{ type: 'text', text: 'managed probe granted' }],
+                    details: { granted: true },
+                };
+            },
+        });
     const managedTool = (name, kind) => pi.registerTool({
         name,
         label: kind === 'review' ? 'Approved read-only review' : 'Approved fixture effect',
@@ -124,6 +125,7 @@ export default function house(pi) {
                 prompt: Type.Optional(Type.String({ maxLength: 32768 })),
                 budget: Type.Optional(Type.Integer({ minimum: 1, maximum: 8 })),
                 authority: Type.Optional(Type.Array(Type.String())),
+                profile: Type.Optional(Type.String({ maxLength: 128 })),
                 tasks: Type.Optional(Type.Array(Type.Object({ step_key: Type.String(), prompt: Type.String() }), {
                     maxItems: 2,
                 })),
@@ -136,7 +138,8 @@ export default function house(pi) {
                 let children = await Promise.all(tasks.map((task) => bridge('child.spawn', {
                     ...task,
                     budget: params.budget ?? 2,
-                    authority: params.authority ?? ['salaam_probe'],
+                    authority: params.authority ?? (params.profile ? [] : ['salaam_probe']),
+                    ...(params.profile ? { profile: params.profile } : {}),
                 })));
                 while (params.wait && children.some((x) => x.state === 'accepted')) {
                     if (signal?.aborted)
@@ -180,7 +183,85 @@ export default function house(pi) {
     }
     if (c.effects)
         managedTool('salaam_effect', 'effect');
-    if (c.coding && !c.child) {
+    if (c.worker_binding?.binding.tools.includes('salaam_repository')) {
+        pi.registerTool({
+            name: 'salaam_repository',
+            label: 'Repository snapshot',
+            description: 'Inspect, list, search or read the exact admitted immutable repository snapshot. Reviewers may also inspect its diff. Paths and line references refer to this snapshot; no host file access, edits or commands are available.',
+            parameters: Type.Object({
+                action: Type.Union(['inspect', 'list', 'search', 'read', 'diff'].map((x) => Type.Literal(x))),
+                path: Type.Optional(Type.String({ maxLength: 512 })),
+                query: Type.Optional(Type.String({ maxLength: 256 })),
+                offset: Type.Optional(Type.Integer({ minimum: 0 })),
+            }),
+            async execute(id, args) {
+                try {
+                    const result = await bridge('specialist.read', { tool_call_id: id, args });
+                    return {
+                        content: [{ type: 'text', text: JSON.stringify(result) }],
+                        details: result,
+                    };
+                }
+                catch (error) {
+                    if (error instanceof ServiceError &&
+                        ['not_found', 'binary_file', 'line_limit', 'unsafe_path', 'invalid_field'].includes(error.code))
+                        return {
+                            content: [{ type: 'text', text: error.message }],
+                            details: { error: error.code },
+                            isError: true,
+                        };
+                    await fail();
+                    throw error;
+                }
+            },
+        });
+    }
+    if (c.worker_binding?.binding.tools.includes('salaam_team')) {
+        pi.registerTool({
+            name: 'salaam_team',
+            label: 'Team inbox',
+            description: 'Send, receive or acknowledge durable messages within this task. Messages never start or continue workers; delivery and acknowledgement are distinct.',
+            parameters: Type.Object({
+                action: Type.Union(['send', 'receive', 'ack'].map((a) => Type.Literal(a))),
+                request_id: Type.String({ maxLength: 128 }),
+                recipient: Type.Optional(Type.String()),
+                text: Type.Optional(Type.String({ maxLength: 4096 })),
+                message_id: Type.Optional(Type.String()),
+            }),
+            async execute(_id, args) {
+                const { action, ...body } = args;
+                const result = await bridge('team.' + action, body);
+                return {
+                    content: [{ type: 'text', text: JSON.stringify(result) }],
+                    details: result,
+                };
+            },
+        });
+    }
+    if (c.worker_binding?.binding.tools.includes('salaam_findings')) {
+        pi.registerTool({
+            name: 'salaam_findings',
+            label: 'Record review findings',
+            description: 'Publish final structured analysis over the admitted snapshot. Locations and source evidence are checked. Analysis cannot complete or verify a task.',
+            parameters: Type.Object({
+                findings: Type.Array(Type.Object({
+                    path: Type.String({ maxLength: 512 }),
+                    line: Type.Integer({ minimum: 1 }),
+                    end_line: Type.Optional(Type.Integer({ minimum: 1 })),
+                    severity: Type.Union(['critical', 'high', 'medium', 'low'].map((x) => Type.Literal(x))),
+                    message: Type.String({ maxLength: 2048 }),
+                }), { maxItems: 32 }),
+            }),
+            async execute(_id, args) {
+                const result = await bridge('specialist.report', args);
+                return {
+                    content: [{ type: 'text', text: JSON.stringify(result) }],
+                    details: result,
+                };
+            },
+        });
+    }
+    if (c.coding) {
         const normal = (error) => error instanceof ServiceError &&
             [
                 'unsafe_path',
@@ -197,44 +278,45 @@ export default function house(pi) {
                 'command_limit',
                 'invalid_cursor',
             ].includes(error.code);
-        pi.registerTool({
-            name: 'salaam_files',
-            label: 'Guarded workspace files',
-            description: 'Inspect/list/search/read an owned workspace or patch one UTF-8 file. Read returns one-based line references and a file hash. Before patching, inspect/read current revision and hash. expected_hash=null creates a new file, content=null deletes one. The source checkout and Git metadata stay outside this workspace.',
-            parameters: Type.Object({
-                action: Type.Union(['inspect', 'list', 'search', 'read', 'patch'].map((value) => Type.Literal(value))),
-                path: Type.Optional(Type.String({ maxLength: 512 })),
-                query: Type.Optional(Type.String({ maxLength: 256 })),
-                offset: Type.Optional(Type.Integer({ minimum: 0 })),
-                expected_revision: Type.Optional(Type.Integer({ minimum: 0 })),
-                expected_hash: Type.Optional(Type.Union([Type.String(), Type.Null()])),
-                content: Type.Optional(Type.Union([Type.String({ maxLength: 262144 }), Type.Null()])),
-            }),
-            async execute(id, params) {
-                try {
-                    const result = await bridge('coding.files', {
-                        tool_call_id: id,
-                        args: params,
-                    });
-                    return {
-                        content: [{ type: 'text', text: JSON.stringify(result) }],
-                        details: result,
-                        isError: params.action === 'patch' && result.state !== 'applied',
-                    };
-                }
-                catch (error) {
-                    if (!normal(error)) {
-                        await fail();
-                        throw error;
+        if (c.coding.files)
+            pi.registerTool({
+                name: 'salaam_files',
+                label: 'Guarded workspace files',
+                description: 'Inspect/list/search/read an owned workspace or patch one UTF-8 file. Read returns one-based line references and a file hash. Before patching, inspect/read current revision and hash. expected_hash=null creates a new file, content=null deletes one. The source checkout and Git metadata stay outside this workspace.',
+                parameters: Type.Object({
+                    action: Type.Union(['inspect', 'list', 'search', 'read', 'patch'].map((value) => Type.Literal(value))),
+                    path: Type.Optional(Type.String({ maxLength: 512 })),
+                    query: Type.Optional(Type.String({ maxLength: 256 })),
+                    offset: Type.Optional(Type.Integer({ minimum: 0 })),
+                    expected_revision: Type.Optional(Type.Integer({ minimum: 0 })),
+                    expected_hash: Type.Optional(Type.Union([Type.String(), Type.Null()])),
+                    content: Type.Optional(Type.Union([Type.String({ maxLength: 262144 }), Type.Null()])),
+                }),
+                async execute(id, params) {
+                    try {
+                        const result = await bridge('coding.files', {
+                            tool_call_id: id,
+                            args: params,
+                        });
+                        return {
+                            content: [{ type: 'text', text: JSON.stringify(result) }],
+                            details: result,
+                            isError: params.action === 'patch' && result.state !== 'applied',
+                        };
                     }
-                    return {
-                        content: [{ type: 'text', text: error.message }],
-                        details: { error: error.code },
-                        isError: true,
-                    };
-                }
-            },
-        });
+                    catch (error) {
+                        if (!normal(error)) {
+                            await fail();
+                            throw error;
+                        }
+                        return {
+                            content: [{ type: 'text', text: error.message }],
+                            details: { error: error.code },
+                            isError: true,
+                        };
+                    }
+                },
+            });
         if (c.coding.commands)
             pi.registerTool({
                 name: 'salaam_command',
@@ -375,8 +457,8 @@ export default function house(pi) {
             ],
         };
     });
-    if (route.provider === 'anthropic')
-        registerClaude(pi, route, () => c.frame, workerTools(!!c.effects, !!c.child, c.coding), bridge, fail);
+    if (route.provider !== 'salaam-proof')
+        registerClaude(pi, route, () => c.frame, workerTools(!!c.effects, !!c.child, c.coding, c.worker_binding?.binding.tools), bridge, fail);
     else
         pi.registerProvider('salaam-proof', {
             baseUrl: 'http://unused.invalid',
@@ -579,7 +661,7 @@ export default function house(pi) {
             session_id: c.session,
             epoch: c.epoch,
             pi_session_id: ctx.sessionManager.getSessionId(),
-            capabilities: workerCapabilities(c.coding),
+            capabilities: workerCapabilities(c.coding, c.worker_binding?.binding.tools),
             ...(c.coding ? { coding: c.coding } : {}),
             tools: pi
                 .getAllTools()
@@ -590,6 +672,7 @@ export default function house(pi) {
             provider: route.provider,
             route,
             context_digest: textDigest(c.frame),
+            ...(c.worker_binding ? { worker_binding: c.worker_binding } : {}),
         });
         timer = setInterval(() => {
             void bridge('heartbeat').catch(() => {

package/dist/src/live-provider.js

@@ -0,0 +1,301 @@
+import { createAssistantMessageEventStream, } from '@earendil-works/pi-ai';
+import { zstdDecompressSync } from 'node:zlib';
+import { randomUUID } from 'node:crypto';
+import { digest, object, textDigest, canonical } from './protocol.js';
+import { getProvider, getProviderModel, providerHasOutputCap, } from './provider-config.js';
+import { ProviderUsageReceipt } from './provider-usage.js';
+import { materialize, generationOptions } from './provider-model.js';
+import { validateProviderPayload } from './provider-payload.js';
+import { installProviderTransport, withProviderTransport } from './provider-transport.js';
+function freezeModel(value) {
+    const copy = structuredClone(value);
+    const freeze = (item) => {
+        if (item && typeof item === 'object' && !Object.isFrozen(item)) {
+            Object.values(item).forEach(freeze);
+            Object.freeze(item);
+        }
+    };
+    freeze(copy);
+    return copy;
+}
+function jsonBody(value, encoding) {
+    if (encoding) {
+        if (encoding !== 'zstd' || !(value instanceof Uint8Array))
+            throw new Error('Unsupported provider body encoding');
+        value = zstdDecompressSync(value, { maxOutputLength: 1048576 });
+    }
+    if (typeof value === 'string')
+        return JSON.parse(value);
+    if (value instanceof Uint8Array)
+        return JSON.parse(Buffer.from(value).toString('utf8'));
+    throw new Error('Provider JSON body missing');
+}
+export function registerLiveProvider(pi, route, frame, tools, bridge, fail) {
+    const catalog = getProviderModel(route), provider = getProvider(route.provider);
+    if (!catalog || !provider)
+        throw new Error('Pinned provider model missing');
+    const rawFetch = installProviderTransport() ?? globalThis.fetch;
+    pi.registerProvider(route.provider, {
+        baseUrl: route.connection?.endpoint || catalog.baseUrl || 'https://salaam-configured.invalid',
+        apiKey: 'salaam-resolves-auth',
+        api: catalog.api,
+        models: [
+            {
+                ...catalog,
+                baseUrl: route.connection?.endpoint || catalog.baseUrl || 'https://salaam-configured.invalid',
+                maxTokens: route.max_tokens,
+            },
+        ],
+        streamSimple(model, context, options) {
+            const output = createAssistantMessageEventStream(), source = 'salaam-request:' + randomUUID(), receipt = new ProviderUsageReceipt();
+            let failed = false, dispatched = false, status, last;
+            const normalize = (message) => ({
+                ...message,
+                responseId: source,
+            });
+            void (async () => {
+                try {
+                    if (model.provider !== route.provider || model.id !== route.model)
+                        throw new Error('Unapproved provider route');
+                    const auth = (await bridge('provider.auth', {}));
+                    if (route.provider === 'amazon-bedrock') {
+                        for (const name of Object.keys(process.env))
+                            if (name.startsWith('AWS_'))
+                                delete process.env[name];
+                        Object.assign(process.env, Object.fromEntries(Object.entries(auth.env ?? {}).filter(([key]) => key.startsWith('AWS_'))));
+                    }
+                    const native = freezeModel(materialize({ ...catalog, maxTokens: route.max_tokens }, auth));
+                    let approved, approvedDigest;
+                    const validate = (payload) => validateProviderPayload(payload, route, frame(), tools, !providerHasOutputCap(route, auth));
+                    const admit = async (payload) => {
+                        if (dispatched)
+                            throw new Error('Provider request replay denied');
+                        validate(payload);
+                        if (!approvedDigest)
+                            throw new Error('Provider payload not approved');
+                        dispatched = true;
+                        await bridge('model', {
+                            source_key: source,
+                            provider: route.provider,
+                            model: route.model,
+                            context_digest: textDigest(frame()),
+                            payload_digest: digest(payload),
+                            payload,
+                        });
+                    };
+                    const endpoint = (url) => {
+                        const base = new URL(native.baseUrl);
+                        if (url.origin !== base.origin || url.username || url.password || url.hash)
+                            throw new Error('Unapproved provider endpoint');
+                        const prefix = base.pathname.replace(/\/$/, '');
+                        if (native.api === 'google-generative-ai' || native.api === 'google-vertex') {
+                            if (!url.pathname.startsWith(prefix + '/') ||
+                                !url.pathname.endsWith('/' + route.model + ':streamGenerateContent') ||
+                                url.searchParams.get('alt') !== 'sse')
+                                throw new Error('Unapproved Google endpoint');
+                        }
+                        else if (native.api === 'bedrock-converse-stream') {
+                            if (decodeURIComponent(url.pathname) !== '/model/' + route.model + '/converse-stream')
+                                throw new Error('Unapproved Bedrock endpoint');
+                        }
+                        else {
+                            const suffixes = native.api === 'anthropic-messages'
+                                ? ['/v1/messages', '/messages']
+                                : native.api === 'mistral-conversations'
+                                    ? ['/v1/chat/completions']
+                                    : native.api === 'openai-completions'
+                                        ? ['/chat/completions']
+                                        : native.api === 'pi-messages'
+                                            ? ['/messages']
+                                            : native.api === 'openai-codex-responses'
+                                                ? ['/codex/responses']
+                                                : ['/responses'];
+                            if (!suffixes.some((suffix) => url.pathname === prefix + suffix))
+                                throw new Error('Unapproved provider path');
+                        }
+                    };
+                    const wirePayload = (payload) => {
+                        if (native.api === 'google-generative-ai' || native.api === 'google-vertex') {
+                            const p = object(payload);
+                            if (p.cachedContent !== undefined)
+                                throw new Error('Cached Google context disabled');
+                            return {
+                                model: route.model,
+                                contents: p.contents,
+                                config: { ...object(p.generationConfig), tools: p.tools, toolConfig: p.toolConfig },
+                            };
+                        }
+                        if (native.api === 'bedrock-converse-stream')
+                            return { ...object(payload), modelId: route.model };
+                        return payload;
+                    };
+                    const transport = {
+                        fetch: async (input, init) => {
+                            try {
+                                const url = new URL(input instanceof Request ? input.url : String(input));
+                                endpoint(url);
+                                const request = input instanceof Request ? input : undefined;
+                                if ((init?.method ?? request?.method) !== 'POST')
+                                    throw new Error('Provider POST required');
+                                const raw = init?.body ?? (request ? await request.clone().text() : undefined);
+                                const payload = jsonBody(raw, new Headers(init?.headers ?? request?.headers).get('content-encoding'));
+                                validate(wirePayload(payload));
+                                const expectedWire = native.api === 'anthropic-messages'
+                                    ? Object.fromEntries(Object.entries(object(approved)).filter(([key]) => key !== 'betas'))
+                                    : approved;
+                                if (!['google-generative-ai', 'google-vertex', 'mistral-conversations'].includes(native.api) &&
+                                    digest(payload) !== digest(expectedWire))
+                                    throw new Error('Provider payload changed after validation');
+                                // The SDK translates Google/Mistral parameters. Validate the final wire controls too.
+                                await admit(approved);
+                            }
+                            catch {
+                                failed = true;
+                                throw new Error('Provider request denied by Salaam');
+                            }
+                            return rawFetch(input, { ...init, redirect: 'error' });
+                        },
+                        bedrock: async (request) => {
+                            try {
+                                endpoint(new URL(request.protocol + '//' + request.hostname + request.path));
+                                if (request.method !== 'POST')
+                                    throw new Error('Provider POST required');
+                                const payload = wirePayload(jsonBody(request.body));
+                                validate(payload);
+                                // AWS serializes undefined fields away. Compare the canonical JSON representation.
+                                if (canonical(payload) !== canonical(JSON.parse(JSON.stringify(approved))))
+                                    throw new Error('Bedrock payload changed after validation');
+                                await admit(approved);
+                            }
+                            catch {
+                                failed = true;
+                                throw new Error('Provider request denied by Salaam');
+                            }
+                        },
+                    };
+                    const headers = { ...options?.headers };
+                    for (const name of Object.keys(headers))
+                        if ([
+                            'authorization',
+                            'x-api-key',
+                            'api-key',
+                            'x-goog-api-key',
+                            'cf-aig-authorization',
+                            'anthropic-workspace-id',
+                        ].includes(name.toLowerCase()))
+                            delete headers[name];
+                    Object.assign(headers, auth.auth.headers);
+                    if (route.workspace_id)
+                        headers['anthropic-workspace-id'] = route.workspace_id;
+                    const upstream = withProviderTransport(transport, () => provider.streamSimple(native, context, {
+                        ...options,
+                        headers,
+                        apiKey: auth.auth.apiKey,
+                        env: auth.env ?? {},
+                        ...generationOptions(native, context, route.max_tokens),
+                        transport: 'sse',
+                        maxRetries: 0,
+                        timeoutMs: 120000,
+                        fetch: ['google-generative-ai', 'google-vertex', 'bedrock-converse-stream'].includes(native.api)
+                            ? undefined
+                            : transport.fetch,
+                        onPayload: async (payload, rawModel) => {
+                            try {
+                                const replacement = await options?.onPayload?.(payload, rawModel);
+                                const actual = replacement === undefined ? payload : replacement;
+                                validate(actual);
+                                if (native.api === 'google-generative-ai' || native.api === 'google-vertex')
+                                    object(actual).config = {
+                                        ...object(object(actual).config),
+                                        httpOptions: { retryOptions: { attempts: 1 }, timeout: 120000 },
+                                    };
+                                approved = JSON.parse(JSON.stringify(actual));
+                                approvedDigest = digest(approved);
+                                return actual;
+                            }
+                            catch {
+                                failed = true;
+                                throw new Error('Provider payload denied');
+                            }
+                        },
+                        onProviderStreamEvent: async (event, rawModel) => {
+                            receipt.observe(catalog.api, event);
+                            await options?.onProviderStreamEvent?.(event, rawModel);
+                        },
+                        onResponse: async (response, rawModel) => {
+                            status = response.status;
+                            await options?.onResponse?.(response, rawModel);
+                        },
+                    }));
+                    for await (const event of upstream) {
+                        if ('partial' in event)
+                            last = normalize(event.partial);
+                        if (event.type === 'done') {
+                            if (!dispatched)
+                                throw new Error('Provider returned without admission');
+                            const message = normalize(event.message);
+                            last = message;
+                            if (receipt.complete)
+                                await bridge('usage', {
+                                    source_key: source,
+                                    usage: message.usage,
+                                    provider_response_id: event.message.responseId ?? null,
+                                });
+                            output.push({ ...event, message });
+                        }
+                        else if (event.type === 'error') {
+                            const message = normalize(event.error);
+                            const code = /^(?:Error:\s*)?(\d{3})\b/.exec(message.errorMessage ?? '')?.[1];
+                            status ??= code ? Number(code) : undefined;
+                            delete message.diagnostics;
+                            message.content = [];
+                            message.errorMessage = options?.signal?.aborted
+                                ? 'Provider request cancelled'
+                                : `Provider request failed${status ? ` (HTTP ${status})` : ''}`;
+                            output.push({ ...event, error: message });
+                        }
+                        else
+                            output.push(('partial' in event
+                                ? { ...event, partial: last }
+                                : event));
+                    }
+                    output.end();
+                    if (failed)
+                        await fail();
+                }
+                catch {
+                    const error = {
+                        role: 'assistant',
+                        content: [],
+                        api: catalog.api,
+                        provider: route.provider,
+                        model: route.model,
+                        timestamp: Date.now(),
+                        responseId: source,
+                        stopReason: options?.signal?.aborted ? 'aborted' : 'error',
+                        usage: last?.usage ?? {
+                            input: 0,
+                            output: 0,
+                            cacheRead: 0,
+                            cacheWrite: 0,
+                            totalTokens: 0,
+                            cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 },
+                        },
+                        errorMessage: options?.signal?.aborted
+                            ? 'Provider request cancelled'
+                            : 'Provider required control failed',
+                    };
+                    output.push({
+                        type: 'error',
+                        reason: error.stopReason === 'aborted' ? 'aborted' : 'error',
+                        error,
+                    });
+                    output.end();
+                    if (!options?.signal?.aborted)
+                        await fail();
+                }
+            })();
+            return output;
+        },
+    });
+}