@superjackfruitlabs/salaam 0.0.1 → 0.0.2

package/src/house-extension.ts

@@ -34,6 +34,7 @@ interface WorkerConfig {
   child?: boolean;
   route?: ProviderRoute;
   coding?: CodingBinding;
+  worker_binding?: import('./worker-boundary.js').WorkerBoundaryView;
 }
 export default function house(pi: ExtensionAPI): void {
   const config = JSON.parse(process.env.SALAAM_WORKER_CONFIG ?? 'null') as WorkerConfig | null;
@@ -46,7 +47,7 @@ export default function house(pi: ExtensionAPI): void {
       `/worker/${c.session}/${method}`,
       { epoch: c.epoch, ...(data as object) },
       c.token,
-      2000,
+      method === 'provider.auth' ? 120000 : 2000,
     );
   let timer: NodeJS.Timeout | undefined;
   let shutdown: (() => void) | undefined;
@@ -58,28 +59,33 @@ export default function house(pi: ExtensionAPI): void {
     }
     shutdown?.();
   };
-  pi.registerTool({
-    name: 'salaam_probe',
-    label: 'Salaam readiness probe',
-    description: 'Verify the managed tool gate without external effects.',
-    parameters: Type.Object({ nested: Type.Optional(Type.Boolean()) }),
-    annotations: { readOnlyHint: true, openWorldHint: false },
-    async execute(toolCallId, params, signal, _update, ctx) {
-      if (params.nested) {
-        const outcome = await ctx.executeTool('salaam_probe', {}, { signal });
-        if (outcome.isError) {
-          await fail();
-          throw new Error('Nested managed probe failed');
+  if (
+    workerTools(!!c.effects, !!c.child, c.coding, c.worker_binding?.binding.tools).includes(
+      'salaam_probe',
+    )
+  )
+    pi.registerTool({
+      name: 'salaam_probe',
+      label: 'Salaam readiness probe',
+      description: 'Verify the managed tool gate without external effects.',
+      parameters: Type.Object({ nested: Type.Optional(Type.Boolean()) }),
+      annotations: { readOnlyHint: true, openWorldHint: false },
+      async execute(toolCallId, params, signal, _update, ctx) {
+        if (params.nested) {
+          const outcome = await ctx.executeTool('salaam_probe', {}, { signal });
+          if (outcome.isError) {
+            await fail();
+            throw new Error('Nested managed probe failed');
+          }
+          return { ...outcome.result, isError: outcome.isError };
         }
-        return { ...outcome.result, isError: outcome.isError };
-      }
-      await bridge('tool', { tool: 'salaam_probe', tool_call_id: toolCallId });
-      return {
-        content: [{ type: 'text', text: 'managed probe granted' }],
-        details: { granted: true },
-      };
-    },
-  });
+        await bridge('tool', { tool: 'salaam_probe', tool_call_id: toolCallId });
+        return {
+          content: [{ type: 'text', text: 'managed probe granted' }],
+          details: { granted: true },
+        };
+      },
+    });
   const managedTool = (name: 'salaam_review' | 'salaam_effect', kind: 'review' | 'effect') =>
     pi.registerTool({
       name,
@@ -178,6 +184,7 @@ export default function house(pi: ExtensionAPI): void {
         prompt: Type.Optional(Type.String({ maxLength: 32768 })),
         budget: Type.Optional(Type.Integer({ minimum: 1, maximum: 8 })),
         authority: Type.Optional(Type.Array(Type.String())),
+        profile: Type.Optional(Type.String({ maxLength: 128 })),
         tasks: Type.Optional(
           Type.Array(Type.Object({ step_key: Type.String(), prompt: Type.String() }), {
             maxItems: 2,
@@ -194,7 +201,8 @@ export default function house(pi: ExtensionAPI): void {
             bridge<import('./protocol.js').ChildTask>('child.spawn', {
               ...task,
               budget: params.budget ?? 2,
-              authority: params.authority ?? ['salaam_probe'],
+              authority: params.authority ?? (params.profile ? [] : ['salaam_probe']),
+              ...(params.profile ? { profile: params.profile } : {}),
             }),
           ),
         );
@@ -243,7 +251,96 @@ export default function house(pi: ExtensionAPI): void {
     managedTool('salaam_review', 'review');
   }
   if (c.effects) managedTool('salaam_effect', 'effect');
-  if (c.coding && !c.child) {
+  if (c.worker_binding?.binding.tools.includes('salaam_repository')) {
+    pi.registerTool({
+      name: 'salaam_repository',
+      label: 'Repository snapshot',
+      description:
+        'Inspect, list, search or read the exact admitted immutable repository snapshot. Reviewers may also inspect its diff. Paths and line references refer to this snapshot; no host file access, edits or commands are available.',
+      parameters: Type.Object({
+        action: Type.Union(
+          ['inspect', 'list', 'search', 'read', 'diff'].map((x) => Type.Literal(x)),
+        ),
+        path: Type.Optional(Type.String({ maxLength: 512 })),
+        query: Type.Optional(Type.String({ maxLength: 256 })),
+        offset: Type.Optional(Type.Integer({ minimum: 0 })),
+      }),
+      async execute(id, args) {
+        try {
+          const result = await bridge('specialist.read', { tool_call_id: id, args });
+          return {
+            content: [{ type: 'text' as const, text: JSON.stringify(result) }],
+            details: result,
+          };
+        } catch (error) {
+          if (
+            error instanceof ServiceError &&
+            ['not_found', 'binary_file', 'line_limit', 'unsafe_path', 'invalid_field'].includes(
+              error.code,
+            )
+          )
+            return {
+              content: [{ type: 'text' as const, text: error.message }],
+              details: { error: error.code },
+              isError: true,
+            };
+          await fail();
+          throw error;
+        }
+      },
+    });
+  }
+  if (c.worker_binding?.binding.tools.includes('salaam_team')) {
+    pi.registerTool({
+      name: 'salaam_team',
+      label: 'Team inbox',
+      description:
+        'Send, receive or acknowledge durable messages within this task. Messages never start or continue workers; delivery and acknowledgement are distinct.',
+      parameters: Type.Object({
+        action: Type.Union(['send', 'receive', 'ack'].map((a) => Type.Literal(a))),
+        request_id: Type.String({ maxLength: 128 }),
+        recipient: Type.Optional(Type.String()),
+        text: Type.Optional(Type.String({ maxLength: 4096 })),
+        message_id: Type.Optional(Type.String()),
+      }),
+      async execute(_id, args) {
+        const { action, ...body } = args;
+        const result = await bridge('team.' + action, body);
+        return {
+          content: [{ type: 'text' as const, text: JSON.stringify(result) }],
+          details: result,
+        };
+      },
+    });
+  }
+  if (c.worker_binding?.binding.tools.includes('salaam_findings')) {
+    pi.registerTool({
+      name: 'salaam_findings',
+      label: 'Record review findings',
+      description:
+        'Publish final structured analysis over the admitted snapshot. Locations and source evidence are checked. Analysis cannot complete or verify a task.',
+      parameters: Type.Object({
+        findings: Type.Array(
+          Type.Object({
+            path: Type.String({ maxLength: 512 }),
+            line: Type.Integer({ minimum: 1 }),
+            end_line: Type.Optional(Type.Integer({ minimum: 1 })),
+            severity: Type.Union(['critical', 'high', 'medium', 'low'].map((x) => Type.Literal(x))),
+            message: Type.String({ maxLength: 2048 }),
+          }),
+          { maxItems: 32 },
+        ),
+      }),
+      async execute(_id, args) {
+        const result = await bridge('specialist.report', args);
+        return {
+          content: [{ type: 'text' as const, text: JSON.stringify(result) }],
+          details: result,
+        };
+      },
+    });
+  }
+  if (c.coding) {
     const normal = (error: unknown) =>
       error instanceof ServiceError &&
       [
@@ -261,46 +358,47 @@ export default function house(pi: ExtensionAPI): void {
         'command_limit',
         'invalid_cursor',
       ].includes(error.code);
-    pi.registerTool({
-      name: 'salaam_files',
-      label: 'Guarded workspace files',
-      description:
-        'Inspect/list/search/read an owned workspace or patch one UTF-8 file. Read returns one-based line references and a file hash. Before patching, inspect/read current revision and hash. expected_hash=null creates a new file, content=null deletes one. The source checkout and Git metadata stay outside this workspace.',
-      parameters: Type.Object({
-        action: Type.Union(
-          ['inspect', 'list', 'search', 'read', 'patch'].map((value) => Type.Literal(value)),
-        ),
-        path: Type.Optional(Type.String({ maxLength: 512 })),
-        query: Type.Optional(Type.String({ maxLength: 256 })),
-        offset: Type.Optional(Type.Integer({ minimum: 0 })),
-        expected_revision: Type.Optional(Type.Integer({ minimum: 0 })),
-        expected_hash: Type.Optional(Type.Union([Type.String(), Type.Null()])),
-        content: Type.Optional(Type.Union([Type.String({ maxLength: 262144 }), Type.Null()])),
-      }),
-      async execute(id, params) {
-        try {
-          const result = await bridge<Record<string, unknown>>('coding.files', {
-            tool_call_id: id,
-            args: params,
-          });
-          return {
-            content: [{ type: 'text', text: JSON.stringify(result) }],
-            details: result,
-            isError: params.action === 'patch' && result.state !== 'applied',
-          };
-        } catch (error) {
-          if (!normal(error)) {
-            await fail();
-            throw error;
+    if (c.coding.files)
+      pi.registerTool({
+        name: 'salaam_files',
+        label: 'Guarded workspace files',
+        description:
+          'Inspect/list/search/read an owned workspace or patch one UTF-8 file. Read returns one-based line references and a file hash. Before patching, inspect/read current revision and hash. expected_hash=null creates a new file, content=null deletes one. The source checkout and Git metadata stay outside this workspace.',
+        parameters: Type.Object({
+          action: Type.Union(
+            ['inspect', 'list', 'search', 'read', 'patch'].map((value) => Type.Literal(value)),
+          ),
+          path: Type.Optional(Type.String({ maxLength: 512 })),
+          query: Type.Optional(Type.String({ maxLength: 256 })),
+          offset: Type.Optional(Type.Integer({ minimum: 0 })),
+          expected_revision: Type.Optional(Type.Integer({ minimum: 0 })),
+          expected_hash: Type.Optional(Type.Union([Type.String(), Type.Null()])),
+          content: Type.Optional(Type.Union([Type.String({ maxLength: 262144 }), Type.Null()])),
+        }),
+        async execute(id, params) {
+          try {
+            const result = await bridge<Record<string, unknown>>('coding.files', {
+              tool_call_id: id,
+              args: params,
+            });
+            return {
+              content: [{ type: 'text', text: JSON.stringify(result) }],
+              details: result,
+              isError: params.action === 'patch' && result.state !== 'applied',
+            };
+          } catch (error) {
+            if (!normal(error)) {
+              await fail();
+              throw error;
+            }
+            return {
+              content: [{ type: 'text', text: (error as Error).message }],
+              details: { error: (error as ServiceError).code },
+              isError: true,
+            };
           }
-          return {
-            content: [{ type: 'text', text: (error as Error).message }],
-            details: { error: (error as ServiceError).code },
-            isError: true,
-          };
-        }
-      },
-    });
+        },
+      });
     if (c.coding.commands)
       pi.registerTool({
         name: 'salaam_command',
@@ -445,12 +543,12 @@ export default function house(pi: ExtensionAPI): void {
       ],
     };
   });
-  if (route.provider === 'anthropic')
+  if (route.provider !== 'salaam-proof')
     registerClaude(
       pi,
       route,
       () => c.frame,
-      workerTools(!!c.effects, !!c.child, c.coding),
+      workerTools(!!c.effects, !!c.child, c.coding, c.worker_binding?.binding.tools),
       bridge,
       fail,
     );
@@ -668,7 +766,7 @@ export default function house(pi: ExtensionAPI): void {
       session_id: c.session,
       epoch: c.epoch,
       pi_session_id: ctx.sessionManager.getSessionId(),
-      capabilities: workerCapabilities(c.coding),
+      capabilities: workerCapabilities(c.coding, c.worker_binding?.binding.tools),
       ...(c.coding ? { coding: c.coding } : {}),
       tools: pi
         .getAllTools()
@@ -679,6 +777,7 @@ export default function house(pi: ExtensionAPI): void {
       provider: route.provider,
       route,
       context_digest: textDigest(c.frame),
+      ...(c.worker_binding ? { worker_binding: c.worker_binding } : {}),
     });
     timer = setInterval(() => {
       void bridge('heartbeat').catch(() => {

package/src/live-provider.ts

@@ -0,0 +1,347 @@
+import type { ExtensionAPI } from '@earendil-works/pi-coding-agent';
+import {
+  createAssistantMessageEventStream,
+  type AssistantMessage,
+  type AssistantMessageEvent,
+  type AuthResult,
+} from '@earendil-works/pi-ai';
+import { zstdDecompressSync } from 'node:zlib';
+import { randomUUID } from 'node:crypto';
+import { digest, object, textDigest, canonical } from './protocol.js';
+import {
+  getProvider,
+  getProviderModel,
+  providerHasOutputCap,
+  type ProviderRoute,
+} from './provider-config.js';
+import { ProviderUsageReceipt } from './provider-usage.js';
+import { materialize, generationOptions } from './provider-model.js';
+import { validateProviderPayload } from './provider-payload.js';
+import { installProviderTransport, withProviderTransport } from './provider-transport.js';
+
+function freezeModel<T>(value: T): T {
+  const copy = structuredClone(value);
+  const freeze = (item: unknown) => {
+    if (item && typeof item === 'object' && !Object.isFrozen(item)) {
+      Object.values(item).forEach(freeze);
+      Object.freeze(item);
+    }
+  };
+  freeze(copy);
+  return copy;
+}
+function jsonBody(value: unknown, encoding?: string | null): unknown {
+  if (encoding) {
+    if (encoding !== 'zstd' || !(value instanceof Uint8Array))
+      throw new Error('Unsupported provider body encoding');
+    value = zstdDecompressSync(value, { maxOutputLength: 1048576 });
+  }
+  if (typeof value === 'string') return JSON.parse(value);
+  if (value instanceof Uint8Array) return JSON.parse(Buffer.from(value).toString('utf8'));
+  throw new Error('Provider JSON body missing');
+}
+export function registerLiveProvider(
+  pi: ExtensionAPI,
+  route: ProviderRoute,
+  frame: () => string,
+  tools: string[],
+  bridge: (method: string, data: unknown) => Promise<unknown>,
+  fail: () => Promise<void>,
+) {
+  const catalog = getProviderModel(route),
+    provider = getProvider(route.provider);
+  if (!catalog || !provider) throw new Error('Pinned provider model missing');
+  const rawFetch = installProviderTransport() ?? globalThis.fetch;
+  pi.registerProvider(route.provider, {
+    baseUrl: route.connection?.endpoint || catalog.baseUrl || 'https://salaam-configured.invalid',
+    apiKey: 'salaam-resolves-auth',
+    api: catalog.api,
+    models: [
+      {
+        ...catalog,
+        baseUrl:
+          route.connection?.endpoint || catalog.baseUrl || 'https://salaam-configured.invalid',
+        maxTokens: route.max_tokens,
+      },
+    ],
+    streamSimple(model, context, options) {
+      const output = createAssistantMessageEventStream(),
+        source = 'salaam-request:' + randomUUID(),
+        receipt = new ProviderUsageReceipt();
+      let failed = false,
+        dispatched = false,
+        status: number | undefined,
+        last: AssistantMessage | undefined;
+      const normalize = (message: AssistantMessage): AssistantMessage => ({
+        ...message,
+        responseId: source,
+      });
+      void (async () => {
+        try {
+          if (model.provider !== route.provider || model.id !== route.model)
+            throw new Error('Unapproved provider route');
+          const auth = (await bridge('provider.auth', {})) as AuthResult;
+          if (route.provider === 'amazon-bedrock') {
+            for (const name of Object.keys(process.env))
+              if (name.startsWith('AWS_')) delete process.env[name];
+            Object.assign(
+              process.env,
+              Object.fromEntries(
+                Object.entries(auth.env ?? {}).filter(([key]) => key.startsWith('AWS_')),
+              ),
+            );
+          }
+          const native = freezeModel(
+            materialize({ ...catalog, maxTokens: route.max_tokens }, auth),
+          );
+          let approved: unknown, approvedDigest: string | undefined;
+          const validate = (payload: unknown) =>
+            validateProviderPayload(
+              payload,
+              route,
+              frame(),
+              tools,
+              !providerHasOutputCap(route, auth),
+            );
+          const admit = async (payload: unknown) => {
+            if (dispatched) throw new Error('Provider request replay denied');
+            validate(payload);
+            if (!approvedDigest) throw new Error('Provider payload not approved');
+            dispatched = true;
+            await bridge('model', {
+              source_key: source,
+              provider: route.provider,
+              model: route.model,
+              context_digest: textDigest(frame()),
+              payload_digest: digest(payload),
+              payload,
+            });
+          };
+          const endpoint = (url: URL) => {
+            const base = new URL(native.baseUrl);
+            if (url.origin !== base.origin || url.username || url.password || url.hash)
+              throw new Error('Unapproved provider endpoint');
+            const prefix = base.pathname.replace(/\/$/, '');
+            if (native.api === 'google-generative-ai' || native.api === 'google-vertex') {
+              if (
+                !url.pathname.startsWith(prefix + '/') ||
+                !url.pathname.endsWith('/' + route.model + ':streamGenerateContent') ||
+                url.searchParams.get('alt') !== 'sse'
+              )
+                throw new Error('Unapproved Google endpoint');
+            } else if (native.api === 'bedrock-converse-stream') {
+              if (decodeURIComponent(url.pathname) !== '/model/' + route.model + '/converse-stream')
+                throw new Error('Unapproved Bedrock endpoint');
+            } else {
+              const suffixes =
+                native.api === 'anthropic-messages'
+                  ? ['/v1/messages', '/messages']
+                  : native.api === 'mistral-conversations'
+                    ? ['/v1/chat/completions']
+                    : native.api === 'openai-completions'
+                      ? ['/chat/completions']
+                      : native.api === 'pi-messages'
+                        ? ['/messages']
+                        : native.api === 'openai-codex-responses'
+                          ? ['/codex/responses']
+                          : ['/responses'];
+              if (!suffixes.some((suffix) => url.pathname === prefix + suffix))
+                throw new Error('Unapproved provider path');
+            }
+          };
+          const wirePayload = (payload: unknown): unknown => {
+            if (native.api === 'google-generative-ai' || native.api === 'google-vertex') {
+              const p = object(payload);
+              if (p.cachedContent !== undefined) throw new Error('Cached Google context disabled');
+              return {
+                model: route.model,
+                contents: p.contents,
+                config: { ...object(p.generationConfig), tools: p.tools, toolConfig: p.toolConfig },
+              };
+            }
+            if (native.api === 'bedrock-converse-stream')
+              return { ...object(payload), modelId: route.model };
+            return payload;
+          };
+          const transport = {
+            fetch: async (input: string | URL | Request, init?: RequestInit) => {
+              try {
+                const url = new URL(input instanceof Request ? input.url : String(input));
+                endpoint(url);
+                const request = input instanceof Request ? input : undefined;
+                if ((init?.method ?? request?.method) !== 'POST')
+                  throw new Error('Provider POST required');
+                const raw = init?.body ?? (request ? await request.clone().text() : undefined);
+                const payload = jsonBody(
+                  raw,
+                  new Headers(init?.headers ?? request?.headers).get('content-encoding'),
+                );
+                validate(wirePayload(payload));
+                const expectedWire =
+                  native.api === 'anthropic-messages'
+                    ? Object.fromEntries(
+                        Object.entries(object(approved)).filter(([key]) => key !== 'betas'),
+                      )
+                    : approved;
+                if (
+                  !['google-generative-ai', 'google-vertex', 'mistral-conversations'].includes(
+                    native.api,
+                  ) &&
+                  digest(payload) !== digest(expectedWire)
+                )
+                  throw new Error('Provider payload changed after validation');
+                // The SDK translates Google/Mistral parameters. Validate the final wire controls too.
+                await admit(approved);
+              } catch {
+                failed = true;
+                throw new Error('Provider request denied by Salaam');
+              }
+              return rawFetch(input, { ...init, redirect: 'error' });
+            },
+            bedrock: async (request: {
+              protocol: string;
+              hostname: string;
+              path: string;
+              method: string;
+              body?: unknown;
+            }) => {
+              try {
+                endpoint(new URL(request.protocol + '//' + request.hostname + request.path));
+                if (request.method !== 'POST') throw new Error('Provider POST required');
+                const payload = wirePayload(jsonBody(request.body));
+                validate(payload);
+                // AWS serializes undefined fields away. Compare the canonical JSON representation.
+                if (canonical(payload) !== canonical(JSON.parse(JSON.stringify(approved))))
+                  throw new Error('Bedrock payload changed after validation');
+                await admit(approved);
+              } catch {
+                failed = true;
+                throw new Error('Provider request denied by Salaam');
+              }
+            },
+          };
+          const headers = { ...options?.headers };
+          for (const name of Object.keys(headers))
+            if (
+              [
+                'authorization',
+                'x-api-key',
+                'api-key',
+                'x-goog-api-key',
+                'cf-aig-authorization',
+                'anthropic-workspace-id',
+              ].includes(name.toLowerCase())
+            )
+              delete headers[name];
+          Object.assign(headers, auth.auth.headers);
+          if (route.workspace_id) headers['anthropic-workspace-id'] = route.workspace_id;
+          const upstream = withProviderTransport(transport, () =>
+            provider.streamSimple(native, context, {
+              ...options,
+              headers,
+              apiKey: auth.auth.apiKey,
+              env: auth.env ?? {},
+              ...generationOptions(native, context, route.max_tokens),
+              transport: 'sse',
+              maxRetries: 0,
+              timeoutMs: 120000,
+              fetch: ['google-generative-ai', 'google-vertex', 'bedrock-converse-stream'].includes(
+                native.api,
+              )
+                ? undefined
+                : transport.fetch,
+              onPayload: async (payload, rawModel) => {
+                try {
+                  const replacement = await options?.onPayload?.(payload, rawModel);
+                  const actual = replacement === undefined ? payload : replacement;
+                  validate(actual);
+                  if (native.api === 'google-generative-ai' || native.api === 'google-vertex')
+                    object(actual).config = {
+                      ...object(object(actual).config),
+                      httpOptions: { retryOptions: { attempts: 1 }, timeout: 120000 },
+                    };
+                  approved = JSON.parse(JSON.stringify(actual));
+                  approvedDigest = digest(approved);
+                  return actual;
+                } catch {
+                  failed = true;
+                  throw new Error('Provider payload denied');
+                }
+              },
+              onProviderStreamEvent: async (event, rawModel) => {
+                receipt.observe(catalog.api, event);
+                await options?.onProviderStreamEvent?.(event, rawModel);
+              },
+              onResponse: async (response, rawModel) => {
+                status = response.status;
+                await options?.onResponse?.(response, rawModel);
+              },
+            }),
+          );
+          for await (const event of upstream) {
+            if ('partial' in event) last = normalize(event.partial);
+            if (event.type === 'done') {
+              if (!dispatched) throw new Error('Provider returned without admission');
+              const message = normalize(event.message);
+              last = message;
+              if (receipt.complete)
+                await bridge('usage', {
+                  source_key: source,
+                  usage: message.usage,
+                  provider_response_id: event.message.responseId ?? null,
+                });
+              output.push({ ...event, message });
+            } else if (event.type === 'error') {
+              const message = normalize(event.error);
+              const code = /^(?:Error:\s*)?(\d{3})\b/.exec(message.errorMessage ?? '')?.[1];
+              status ??= code ? Number(code) : undefined;
+              delete message.diagnostics;
+              message.content = [];
+              message.errorMessage = options?.signal?.aborted
+                ? 'Provider request cancelled'
+                : `Provider request failed${status ? ` (HTTP ${status})` : ''}`;
+              output.push({ ...event, error: message });
+            } else
+              output.push(
+                ('partial' in event
+                  ? { ...event, partial: last! }
+                  : event) as AssistantMessageEvent,
+              );
+          }
+          output.end();
+          if (failed) await fail();
+        } catch {
+          const error: AssistantMessage = {
+            role: 'assistant',
+            content: [],
+            api: catalog.api,
+            provider: route.provider,
+            model: route.model,
+            timestamp: Date.now(),
+            responseId: source,
+            stopReason: options?.signal?.aborted ? 'aborted' : 'error',
+            usage: last?.usage ?? {
+              input: 0,
+              output: 0,
+              cacheRead: 0,
+              cacheWrite: 0,
+              totalTokens: 0,
+              cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 },
+            },
+            errorMessage: options?.signal?.aborted
+              ? 'Provider request cancelled'
+              : 'Provider required control failed',
+          };
+          output.push({
+            type: 'error',
+            reason: error.stopReason === 'aborted' ? 'aborted' : 'error',
+            error,
+          });
+          output.end();
+          if (!options?.signal?.aborted) await fail();
+        }
+      })();
+      return output;
+    },
+  });
+}