machine-bridge-mcp 3.0.0-beta.20 → 3.0.0-beta.21

package/src/local/relay-connection.mjs

@@ -167,7 +167,7 @@ export class RelayConnection {
     this.logger.debug?.("remote relay welcome received");
     Promise.resolve(this.helloMessage(message)).then((hello) => {
       if (this.socket !== socket || this.closed || this.authenticated) return;
-      if (!this.sendOnSocket(socket, hello)) this.failPermanently("relay_authentication_failed");
+      this.sendOnSocket(socket, hello);
     }).catch((error) => {
       this.logger.debug?.("could not create daemon authentication proof", { error_class: classifyOperationalError(error) });
       this.failPermanently("relay_authentication_failed");
@@ -256,18 +256,18 @@ export class RelayConnection {
 
   handleServerError(message = {}) {
     const errorCode = sanitizeProtocolErrorCode(message?.error);
-    this.logger.debug?.("remote relay reported a protocol error", { error_code: errorCode });
-    if (errorCode === "daemon_hello_timeout" && !this.authenticated) {
-      const socket = this.socket;
-      if (this.closed || !socket) return true;
-      this.pendingCloseCategory = "relay_handshake_timeout";
-      terminateSocket(socket);
-      return true;
-    }
-    if (errorCode === "daemon_ready_timeout" && this.authenticated && !this.ready) {
+    const reconnectCategory = relayServerErrorReconnectCategory(errorCode, {
+      authenticated: this.authenticated,
+      ready: this.ready,
+    });
+    this.logger.debug?.(
+      reconnectCategory ? "remote relay requested connection recovery" : "remote relay reported a protocol error",
+      { error_code: errorCode, reconnect_category: reconnectCategory || "none" },
+    );
+    if (reconnectCategory) {
       const socket = this.socket;
       if (this.closed || !socket) return true;
-      this.pendingCloseCategory = "relay_readiness_timeout";
+      this.pendingCloseCategory = reconnectCategory;
       terminateSocket(socket);
       return true;
     }
@@ -587,12 +587,25 @@ export class RelayConnection {
   }
 }
 
+export function relayServerErrorReconnectCategory(errorCode, state = {}) {
+  const code = sanitizeProtocolErrorCode(errorCode);
+  const authenticated = state?.authenticated === true;
+  const ready = state?.ready === true;
+  if (code === "daemon_hello_timeout" && !authenticated) return "relay_handshake_timeout";
+  if (code === "daemon_ready_timeout" && authenticated && !ready) return "relay_readiness_timeout";
+  if (code === "daemon_transport_error") return "relay_transport_error";
+  if (code === "daemon_liveness_timeout") return "relay_heartbeat_timeout";
+  return "";
+}
+
 export function relayCloseCategory(code, reason = "") {
   const numeric = Number(code);
   const reasonText = String(reason || "");
   if (isSupersededClose(numeric, reasonText)) return "superseded";
   if (numeric === 1008 && reasonText === "daemon hello timeout") return "relay_handshake_timeout";
   if (numeric === 1008 && reasonText === "daemon ready timeout") return "relay_readiness_timeout";
+  if ([1008, 1012].includes(numeric) && ["daemon pong failed", "daemon send failed"].includes(reasonText)) return "relay_transport_error";
+  if ([1008, 1012].includes(numeric) && reasonText === "daemon liveness timeout") return "relay_heartbeat_timeout";
   if (numeric === 1008 && ["stale daemon candidate", "expired daemon candidate"].includes(reasonText)) return "relay_restarting_or_unavailable";
   if (numeric === 1008 && ["daemon hello required", "missing daemon attachment", "invalid daemon candidate timestamp"].includes(reasonText)) return "relay_protocol_error";
   if (numeric === 1000) return "normal_close";

package/src/local/runtime-activation.mjs

@@ -19,11 +19,14 @@ export async function activatePersistentRuntime(options = {}) {
   let daemonLock = null;
   let candidateRuntime = null;
   let candidateRelayVerified = false;
+  let providerStopped = false;
+  let serviceStarted = false;
   try {
     const providerStop = await options.stopAutostart();
     if (providerStop?.ok === false && providerStop?.active === true) {
       throw new Error("the existing autostart service could not be stopped before activation");
     }
+    providerStopped = providerStop?.active_before === true && providerStop?.active === false;
 
     daemonLock = await options.acquireDaemonLock();
     if (!daemonLock?.acquired) {
@@ -60,6 +63,7 @@ export async function activatePersistentRuntime(options = {}) {
     if (serviceStart?.ok === false) {
       throw new Error(`autostart start failed (${serviceStart.provider || "unknown"})`);
     }
+    serviceStarted = true;
 
     const convergence = await waitForActivatedRuntime({
       expectedVersion: options.expectedVersion,
@@ -85,6 +89,9 @@ export async function activatePersistentRuntime(options = {}) {
       try { startupLock.release(); }
       catch (failure) { cleanupErrors.push(failure); }
     }
+    try {
+      await restoreStoppedProvider(options.startAutostart, { providerStopped, serviceStarted });
+    } catch (failure) { cleanupErrors.push(failure); }
     if (cleanupErrors.length) {
       throw new AggregateError(
         [error, ...cleanupErrors],
@@ -95,6 +102,15 @@ export async function activatePersistentRuntime(options = {}) {
   }
 }
 
+
+async function restoreStoppedProvider(startAutostart, { providerStopped, serviceStarted }) {
+  if (!providerStopped || serviceStarted) return;
+  const restored = await startAutostart();
+  if (restored?.ok === false) {
+    throw new Error(`previous autostart service could not be restored (${restored.provider || "unknown"})`);
+  }
+}
+
 export async function waitForActivatedRuntime({
   inspectDaemon,
   checkWorker,

package/src/local/runtime.mjs

@@ -359,7 +359,9 @@ export class LocalRuntime {
     const relaySessionId = Number(relayContext.sessionId) || 0;
     if (!id || !relaySessionId) return this.handleRelayProtocolViolation("invalid_relay_probe");
     const outcome = this.relay?.sendForSession?.({ type: "relay_probe_result", id }, relaySessionId);
-    if (!outcome?.ok) this.handleRelayProtocolViolation("relay_probe_delivery_failed");
+    if (!outcome?.ok && !["send_failed", "transport_unavailable", "session_ended"].includes(outcome?.reason)) {
+      this.handleRelayProtocolViolation("relay_probe_delivery_failed");
+    }
   }
 
   async handleRelayToolCall(message) {

package/src/local/worker-deployment.mjs

@@ -12,6 +12,8 @@ import {
   workerHealthUserReason,
 } from "./worker-health.mjs";
 
+const DEFAULT_DEPLOYMENT_HEALTH_ATTEMPTS = 20;
+
 export async function ensureWorkerDeployment(state, args = {}, options = {}) {
   const logger = options.logger || console;
   const expectedVersion = options.expectedVersion || currentPackageVersion(options.packageRoot || packageRoot);
@@ -24,18 +26,24 @@ export async function ensureWorkerDeployment(state, args = {}, options = {}) {
   const complete = hasCompleteWorkerState(state.worker);
 
   if (!args.forceWorker && !args.rotateSecrets && complete && state.worker.deployHash === desiredHash) {
-    const health = await retryHealthFn(state.worker.url, expectedVersion, options.existingHealthAttempts || 2, healthOptions);
+    const recordedCurrentDeployment = state.worker.deployedVersion === expectedVersion;
+    const attempts = recordedCurrentDeployment
+      ? (options.recordedDeploymentHealthAttempts ?? DEFAULT_DEPLOYMENT_HEALTH_ATTEMPTS)
+      : (options.existingHealthAttempts ?? 2);
+    const health = await retryHealthFn(state.worker.url, expectedVersion, attempts, healthOptions);
     if (health.ok) {
       logger.success?.("Worker unchanged and healthy", { url: state.worker.url });
       logger.debug?.("Worker health route", { network_route: health.networkRoute || "unknown" });
       return state.worker;
     }
+    logger.debug?.("Worker health check detail", { health_error: health.error, network_route: health.networkRoute || "unknown" });
+    if (recordedCurrentDeployment) {
+      throw workerVerificationError(health.error, { deploymentSucceeded: false, recordedCurrentDeployment: true });
+    }
     if (!workerHealthRequiresRedeploy(health.error)) {
-      logger.debug?.("Worker health check detail", { health_error: health.error, network_route: health.networkRoute || "unknown" });
       throw workerVerificationError(health.error, { deploymentSucceeded: false });
     }
     logger.warn?.("Recorded Worker is stale; redeploying the same Worker", { reason: workerHealthUserReason(health.error) });
-    logger.debug?.("Worker health check detail", { health_error: health.error, network_route: health.networkRoute || "unknown" });
   }
 
   logger.info?.("Checking Cloudflare Wrangler login");
@@ -68,7 +76,7 @@ export async function ensureWorkerDeployment(state, args = {}, options = {}) {
   state.worker.updatedAt = new Date().toISOString();
   saveStateFn(state);
 
-  const health = await retryHealthFn(state.worker.url, expectedVersion, options.deploymentHealthAttempts || 8, healthOptions);
+  const health = await retryHealthFn(state.worker.url, expectedVersion, options.deploymentHealthAttempts ?? DEFAULT_DEPLOYMENT_HEALTH_ATTEMPTS, healthOptions);
   if (!health.ok) {
     logger.debug?.("Worker post-deployment health detail", { health_error: health.error, network_route: health.networkRoute || "unknown" });
     throw workerVerificationError(health.error, { deploymentSucceeded: true });
@@ -143,12 +151,14 @@ function collectHashFiles(target, out) {
   }
 }
 
-function workerVerificationError(reason, { deploymentSucceeded }) {
+function workerVerificationError(reason, { deploymentSucceeded, recordedCurrentDeployment = false }) {
   const readable = workerHealthUserReason(reason);
   const guidance = workerVerificationGuidance(reason);
   const message = deploymentSucceeded
     ? `Cloudflare reported the Worker deployment succeeded, but ${readable}. The deployment fingerprint was saved, so retrying will verify the same Worker instead of deploying again. ${guidance}`
-    : `The recorded Worker could not be verified because ${readable}. No deployment was attempted. ${guidance}`;
+    : recordedCurrentDeployment
+      ? `The current Worker deployment fingerprint is already recorded, but ${readable}. No deployment was attempted because duplicating the recorded deployment is unsafe; use --force-worker only after diagnosis. ${guidance}`
+      : `The recorded Worker could not be verified because ${readable}. No deployment was attempted. ${guidance}`;
   const error = new Error(message);
   error.code = "worker_health_unverified";
   error.healthError = reason;

package/src/worker/daemon-socket-attachment.ts

@@ -0,0 +1,52 @@
+import { sanitizeDaemonChallengeAttachment } from "./daemon-auth.ts";
+import type { DaemonRole } from "./daemon-liveness.ts";
+import { sanitizeMetadataText } from "./http.ts";
+import { sanitizeDaemonPolicy, sanitizeDaemonTools, type DaemonPolicy } from "./policy.ts";
+
+export interface DaemonAttachment {
+  role: DaemonRole;
+  connectedAt: string;
+  lastSeenAt?: string;
+  probeId?: string;
+  instanceId?: string;
+  connectionId?: string;
+  policy?: DaemonPolicy;
+  tools?: string[];
+  authChallenge?: string;
+  authIssuedAt?: number;
+  authExpiresAt?: number;
+  workerOrigin?: string;
+  authSessionPublicKeyJson?: string;
+  authSessionKeyId?: string;
+  authCertificateExpiresAt?: number;
+}
+
+export function sanitizeDaemonAttachment(value: unknown): DaemonAttachment | undefined {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return undefined;
+  const candidate = value as Partial<DaemonAttachment>;
+  if (!["candidate", "probing", "expired", "daemon"].includes(String(candidate.role))) return undefined;
+  const policy = sanitizeDaemonPolicy(candidate.policy);
+  return {
+    role: candidate.role as DaemonRole,
+    connectedAt: sanitizeMetadataText(candidate.connectedAt, 64) ?? "",
+    lastSeenAt: sanitizeMetadataText(candidate.lastSeenAt, 64),
+    probeId: sanitizeProbeId(candidate.probeId),
+    instanceId: sanitizeDaemonInstanceId(candidate.instanceId),
+    connectionId: sanitizeConnectionId(candidate.connectionId),
+    policy,
+    tools: sanitizeDaemonTools(candidate.tools, policy),
+    ...sanitizeDaemonChallengeAttachment(candidate as Record<string, unknown>),
+  };
+}
+
+function sanitizeProbeId(value: unknown): string | undefined {
+  return typeof value === "string" && /^probe_[A-Za-z0-9_-]{8,240}$/.test(value) ? value : undefined;
+}
+
+function sanitizeDaemonInstanceId(value: unknown): string | undefined {
+  return typeof value === "string" && /^daemon_[A-Za-z0-9_-]{16,96}$/.test(value) ? value : undefined;
+}
+
+function sanitizeConnectionId(value: unknown): string | undefined {
+  return typeof value === "string" && /^connection_[A-Za-z0-9_-]{43}$/.test(value) ? value : undefined;
+}

package/src/worker/daemon-sockets.ts

@@ -1,24 +1,7 @@
 import { isLiveDaemonAttachment, withDaemonLastSeenAt, type DaemonRole } from "./daemon-liveness.ts";
-import { sanitizeMetadataText } from "./http.ts";
-import { sanitizeDaemonPolicy, sanitizeDaemonTools, type DaemonPolicy } from "./policy.ts";
-import { sanitizeDaemonChallengeAttachment, type DaemonChallenge } from "./daemon-auth.ts";
-export interface DaemonAttachment {
-  role: DaemonRole;
-  connectedAt: string;
-  lastSeenAt?: string;
-  probeId?: string;
-  instanceId?: string;
-  policy?: DaemonPolicy;
-  tools?: string[];
-  authChallenge?: string;
-  authIssuedAt?: number;
-  authExpiresAt?: number;
-  workerOrigin?: string;
-  authSessionPublicKeyJson?: string;
-  authSessionKeyId?: string;
-  authCertificateExpiresAt?: number;
-}
-
+import type { DaemonPolicy } from "./policy.ts";
+import type { DaemonChallenge } from "./daemon-auth.ts";
+import { sanitizeDaemonAttachment, type DaemonAttachment } from "./daemon-socket-attachment.ts";
 interface WebSocketContext {
   getWebSockets(): WebSocket[];
 }
@@ -28,21 +11,7 @@ export class DaemonSocketRegistry {
   constructor(context: WebSocketContext) { this.context = context; }
 
   attachment(socket: WebSocket): DaemonAttachment | undefined {
-    const raw = socket.deserializeAttachment();
-    if (!raw || typeof raw !== "object") return undefined;
-    const candidate = raw as Partial<DaemonAttachment>;
-    if (!["candidate", "probing", "expired", "daemon"].includes(String(candidate.role))) return undefined;
-    const policy = sanitizeDaemonPolicy(candidate.policy);
-    return {
-      role: candidate.role as DaemonRole,
-      connectedAt: sanitizeMetadataText(candidate.connectedAt, 64) ?? "",
-      lastSeenAt: sanitizeMetadataText(candidate.lastSeenAt, 64),
-      probeId: sanitizeProbeId(candidate.probeId),
-      instanceId: sanitizeDaemonInstanceId(candidate.instanceId),
-      policy,
-      tools: sanitizeDaemonTools(candidate.tools, policy),
-      ...sanitizeDaemonChallengeAttachment(candidate as Record<string, unknown>),
-    };
+    return sanitizeDaemonAttachment(socket.deserializeAttachment());
   }
 
   readyAttachment(socket: WebSocket): DaemonAttachment | undefined {
@@ -68,11 +37,13 @@ export class DaemonSocketRegistry {
     socket: WebSocket,
     challenge: DaemonChallenge,
     preflight: { sessionPublicKeyJson: string; sessionKeyId: string; certificateExpiresAt: number },
+    connectionId: string,
     connectedAt = new Date().toISOString(),
   ): void {
     socket.serializeAttachment({
       role: "candidate",
       connectedAt,
+      connectionId,
       authChallenge: challenge.challenge,
       authIssuedAt: challenge.issuedAt,
       authExpiresAt: challenge.expiresAt,
@@ -83,10 +54,11 @@ export class DaemonSocketRegistry {
     } satisfies DaemonAttachment);
   }
 
-  beginProbe(socket: WebSocket, values: { connectedAt: string; probeId: string; instanceId: string; policy: DaemonPolicy; tools: string[] }): void {
+  beginProbe(socket: WebSocket, values: { connectedAt: string; probeId: string; instanceId: string; connectionId: string; policy: DaemonPolicy; tools: string[] }): void {
     socket.serializeAttachment({
       role: "probing", connectedAt: values.connectedAt, lastSeenAt: values.connectedAt,
-      probeId: values.probeId, instanceId: values.instanceId, policy: values.policy, tools: values.tools,
+      probeId: values.probeId, instanceId: values.instanceId, connectionId: values.connectionId,
+      policy: values.policy, tools: values.tools,
     } satisfies DaemonAttachment);
   }
 
@@ -111,10 +83,17 @@ export class DaemonSocketRegistry {
     const attachment = this.attachment(socket);
     if (!attachment) return;
     socket.serializeAttachment({
-      role: "expired", connectedAt: attachment.connectedAt, lastSeenAt: attachment.lastSeenAt, instanceId: attachment.instanceId,
+      role: "expired", connectedAt: attachment.connectedAt, lastSeenAt: attachment.lastSeenAt,
+      instanceId: attachment.instanceId, connectionId: attachment.connectionId,
     } satisfies DaemonAttachment);
   }
 
+  socketForConnectionId(connectionId: string): WebSocket | undefined {
+    if (!connectionId) return undefined;
+    return this.context.getWebSockets().find((socket) =>
+      this.attachment(socket)?.connectionId === connectionId && socket.readyState === WebSocket.OPEN);
+  }
+
   private openSockets(role: DaemonRole): WebSocket[] {
     return this.context.getWebSockets().filter((socket) => this.attachment(socket)?.role === role && socket.readyState === WebSocket.OPEN);
   }
@@ -123,13 +102,3 @@ export class DaemonSocketRegistry {
     return Date.parse(this.attachment(socket)?.connectedAt ?? "") || 0;
   }
 }
-
-function sanitizeProbeId(value: unknown): string | undefined {
-  if (typeof value !== "string" || !/^probe_[A-Za-z0-9_-]{8,240}$/.test(value)) return undefined;
-  return value;
-}
-
-function sanitizeDaemonInstanceId(value: unknown): string | undefined {
-  if (typeof value !== "string" || !/^daemon_[A-Za-z0-9_-]{16,96}$/.test(value)) return undefined;
-  return value;
-}

package/src/worker/durable-stream-calls.ts

@@ -0,0 +1,129 @@
+import { daemonLastSeenMs } from "./daemon-liveness.ts";
+import type { DaemonSocketRegistry } from "./daemon-sockets.ts";
+import { publicWorkerToolError, WorkerToolError } from "./errors.ts";
+import { workerErrorClass } from "./http.ts";
+import type { PendingCallOutcome } from "./pending-call-contract.ts";
+import type { McpPendingCallStore, PendingStreamCallView } from "./mcp-pending-call-store.ts";
+import { streamTerminalMessage } from "./mcp-stream-dispatch.ts";
+import { transformDurableStreamOutcome } from "./durable-stream-result.ts";
+import type { WorkerObservability } from "./observability.ts";
+import { sendWebSocketQuietly } from "./websocket-protocol.ts";
+
+type InvalidateDaemonSocket = (
+  socket: WebSocket,
+  message: string,
+  closeReason: string,
+  errorCode?: string,
+) => Promise<void>;
+
+type TransientPendingSnapshot = {
+  active: number;
+  detached: number;
+  request_keys: number;
+  oldest_ms: number;
+  by_tool: Record<string, number>;
+};
+
+export class DurableStreamCallCoordinator {
+  private readonly calls: McpPendingCallStore;
+  private readonly daemonRegistry: DaemonSocketRegistry;
+  private readonly observability: WorkerObservability;
+  private readonly maximumPendingCalls: number;
+  private readonly invalidateDaemonSocket: InvalidateDaemonSocket;
+
+  constructor(
+    calls: McpPendingCallStore,
+    daemonRegistry: DaemonSocketRegistry,
+    observability: WorkerObservability,
+    maximumPendingCalls: number,
+    invalidateDaemonSocket: InvalidateDaemonSocket,
+  ) {
+    this.calls = calls;
+    this.daemonRegistry = daemonRegistry;
+    this.observability = observability;
+    this.maximumPendingCalls = maximumPendingCalls;
+    this.invalidateDaemonSocket = invalidateDaemonSocket;
+  }
+
+  async snapshot(transient: TransientPendingSnapshot): Promise<Record<string, unknown>> {
+    const durable = await this.calls.snapshot(this.maximumPendingCalls);
+    const byTool = Object.assign(Object.create(null) as Record<string, number>, transient.by_tool);
+    for (const [tool, count] of Object.entries(durable.by_tool)) byTool[tool] = (byTool[tool] ?? 0) + count;
+    return {
+      active: transient.active + durable.active,
+      detached: transient.detached + durable.detached,
+      request_keys: transient.request_keys + durable.request_keys,
+      maximum: this.maximumPendingCalls,
+      oldest_ms: Math.max(transient.oldest_ms, durable.oldest_ms),
+      by_tool: byTool,
+      transient: transient.active,
+      durable_streams: durable.active,
+    };
+  }
+
+  async settle(
+    callId: string,
+    connectionId: string,
+    outcome: PendingCallOutcome,
+    knownCall?: PendingStreamCallView,
+  ): Promise<boolean> {
+    const call = knownCall ?? await this.calls.get(callId);
+    if (!call || call.connection_id !== connectionId) return false;
+    const normalized = transformDurableStreamOutcome(call, outcome);
+    const code = normalized.ok ? "" : publicWorkerToolError(normalized.error).code;
+    try {
+      const completed = await this.calls.complete(
+        callId,
+        connectionId,
+        streamTerminalMessage(call.requestId, normalized),
+      );
+      if (!completed) return false;
+    } catch (error) {
+      this.observability.event("error", "mcp.stream.persist.failed", { error_class: workerErrorClass(error) });
+    }
+    this.observability.callFinished(call.tool, code);
+    return true;
+  }
+
+  async expire(call: PendingStreamCallView): Promise<void> {
+    const socket = call.state === "attached" ? this.daemonRegistry.socketForConnectionId(call.connection_id) : undefined;
+    if (socket) {
+      sendWebSocketQuietly(socket, { type: "cancel_call", id: call.call_id });
+      const silentForMs = Date.now() - daemonLastSeenMs(this.daemonRegistry.readyAttachment(socket));
+      if (!Number.isFinite(silentForMs) || silentForMs > 45_000) {
+        void this.invalidateDaemonSocket(socket, "daemon became unresponsive", "daemon liveness timeout");
+      }
+    }
+    const error = call.state === "attached"
+      ? new WorkerToolError("timeout", `daemon tool timed out: ${call.tool}`, true)
+      : new WorkerToolError("unavailable", "daemon disconnected; reconnect grace expired", true);
+    await this.settle(call.call_id, call.connection_id, { ok: false, error }, call);
+  }
+
+  async expireDue(now = Date.now()): Promise<number> {
+    const due = await this.calls.due(now);
+    for (const call of due) await this.expire(call);
+    return due.length;
+  }
+
+  async cancel(requestKey: string): Promise<boolean> {
+    const call = await this.calls.getByRequestKey(requestKey);
+    if (!call) return false;
+    const socket = call.state === "attached" ? this.daemonRegistry.socketForConnectionId(call.connection_id) : undefined;
+    if (socket) sendWebSocketQuietly(socket, { type: "cancel_call", id: call.call_id });
+    return this.settle(
+      call.call_id,
+      call.connection_id,
+      { ok: false, error: new WorkerToolError("cancelled", "tool call cancelled by client") },
+      call,
+    );
+  }
+
+  detach(connectionId: string, graceMs: number): Promise<number> {
+    return this.calls.detach(connectionId, graceMs);
+  }
+
+  rebind(daemonInstanceId: string, connectionId: string): Promise<string[]> {
+    return this.calls.rebind(daemonInstanceId, connectionId);
+  }
+}

package/src/worker/durable-stream-result.ts

@@ -0,0 +1,22 @@
+import { decorateProjectOverview } from "./authority.ts";
+import type { PendingCallOutcome } from "./pending-call-contract.ts";
+import type { PendingStreamCallView } from "./mcp-pending-call-store.ts";
+
+export function transformDurableStreamOutcome(
+  call: PendingStreamCallView,
+  outcome: PendingCallOutcome,
+): PendingCallOutcome {
+  if (!outcome.ok || call.transform?.kind !== "project_overview") return outcome;
+  try {
+    return {
+      ok: true,
+      value: decorateProjectOverview(outcome.value, {
+        accountId: call.transform.account_id,
+        accountVersion: call.transform.account_version,
+        role: call.transform.role,
+      }),
+    };
+  } catch (error) {
+    return { ok: false, error: error instanceof Error ? error : new Error("stream result transformation failed") };
+  }
+}