nanocodex 0.6.4 → 0.6.6

package/cloudflare/managed-auth.mjs

@@ -0,0 +1,119 @@
+const USER_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+export const API_KEY = /^ncx_live_([A-Za-z0-9_-]{12})_([A-Za-z0-9_-]{43})$/;
+const CONNECT_USER_HEADER = "x-nanocodex-connect-user";
+const CONNECT_GRANT_ID_HEADER = "x-nanocodex-connect-grant-id";
+const CONNECT_CAPABILITIES_HEADER = "x-nanocodex-connect-capabilities";
+const CONNECT_CONNECTORS_HEADER = "x-nanocodex-connect-connectors";
+const CONNECT_CONNECTOR_CONNECTIONS_HEADER = "x-nanocodex-connect-connector-connections";
+const CONNECT_MCP_IDS_HEADER = "x-nanocodex-connect-mcp-ids";
+const CONNECT_APP_TOOL_CATALOG_DIGEST_HEADER = "x-nanocodex-connect-app-tool-catalog-digest";
+const SESSION_OWNER_ASSERTION = "x-nanocodex-owner-id";
+const SESSION_ORGANIZATION_ASSERTION = "x-nanocodex-session-organization-id";
+const SESSION_TEAM_ASSERTION = "x-nanocodex-session-team-id";
+const SESSION_AUTHORIZATION_EPOCH_ASSERTION = "x-nanocodex-authorization-epoch";
+const SESSION_CAPABILITIES_ASSERTION = "x-nanocodex-capabilities";
+export function isUserId(value) {
+    return typeof value === "string" && USER_ID.test(value);
+}
+function isUuid(value) {
+    return typeof value === "string" && UUID.test(value);
+}
+function isOrganizationRole(value) {
+    return value === "owner" || value === "writer" || value === "reader";
+}
+export function isOrganizationCapabilities(value) {
+    if (!Array.isArray(value) || new Set(value).size !== value.length)
+        return false;
+    return value.every((capability) => capability === "agents:read"
+        || capability === "agents:portability"
+        || capability === "agents:write"
+        || capability === "api_keys:read"
+        || capability === "api_keys:write"
+        || capability === "history:read"
+        || capability === "memory:read"
+        || capability === "memory:write"
+        || capability === "tools:use"
+        || capability === "organization:read"
+        || capability === "organization:write");
+}
+export function isApiKeyBase(value) {
+    if (typeof value !== "object" || value === null)
+        return false;
+    const record = value;
+    return typeof record.id === "string"
+        && /^[A-Za-z0-9_-]{12}$/.test(record.id)
+        && typeof record.label === "string"
+        && record.label.length <= 120
+        && record.prefix === `ncx_live_${record.id}`
+        && Number.isFinite(record.createdAt)
+        && typeof record.digest === "string"
+        && /^[A-Za-z0-9_-]{43}$/.test(record.digest)
+        && isUserId(record.userId);
+}
+export function isStoredApiKey(value) {
+    if (!isApiKeyBase(value))
+        return false;
+    const record = value;
+    return isUuid(record.organizationId)
+        && isUuid(record.teamId)
+        && isOrganizationRole(record.role)
+        && isOrganizationCapabilities(record.capabilities)
+        && Number.isSafeInteger(record.authorizationEpoch)
+        && Number(record.authorizationEpoch) >= 1;
+}
+export function forwardPrincipalAssertions(headers, principal) {
+    headers.set("x-nanocodex-request-principal", JSON.stringify({ kind: principal.kind, user_id: principal.userId }));
+    headers.set(SESSION_OWNER_ASSERTION, principal.userId);
+    headers.set(SESSION_ORGANIZATION_ASSERTION, principal.organizationId);
+    headers.set(SESSION_TEAM_ASSERTION, principal.teamId);
+    headers.set(SESSION_AUTHORIZATION_EPOCH_ASSERTION, String(principal.authorizationEpoch));
+    headers.set(SESSION_CAPABILITIES_ASSERTION, JSON.stringify(principal.capabilities));
+    for (const name of [
+        CONNECT_USER_HEADER,
+        CONNECT_GRANT_ID_HEADER,
+        CONNECT_CAPABILITIES_HEADER,
+        CONNECT_CONNECTORS_HEADER,
+        CONNECT_CONNECTOR_CONNECTIONS_HEADER,
+        CONNECT_MCP_IDS_HEADER,
+        CONNECT_APP_TOOL_CATALOG_DIGEST_HEADER,
+        "x-nanocodex-connect-sandbox-execution",
+        "x-nanocodex-connect-output-checkpoints",
+    ]) {
+        headers.delete(name);
+    }
+    if (principal.connectGrant) {
+        if (principal.connectGrant.outputCheckpoints === true) headers.set("x-nanocodex-connect-output-checkpoints", "true");
+        if (principal.connectGrant.sandboxExecution === true) {
+            headers.set("x-nanocodex-connect-sandbox-execution", "true");
+        }
+        headers.set(CONNECT_GRANT_ID_HEADER, principal.connectGrant.grantId);
+        headers.set(CONNECT_CONNECTORS_HEADER, JSON.stringify(principal.connectGrant.connectors));
+        if (principal.connectGrant.connectorConnections !== undefined) {
+            headers.set(CONNECT_CONNECTOR_CONNECTIONS_HEADER, JSON.stringify(principal.connectGrant.connectorConnections));
+        }
+        headers.set(CONNECT_MCP_IDS_HEADER, JSON.stringify(principal.connectGrant.mcpIds));
+        if (principal.connectGrant.appToolCatalogDigest !== undefined) {
+            headers.set(CONNECT_APP_TOOL_CATALOG_DIGEST_HEADER, principal.connectGrant.appToolCatalogDigest);
+        }
+    }
+}
+async function sha256(value) {
+    const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value)));
+    let binary = "";
+    for (const byte of digest)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+export async function apiKeyDigest(request) {
+    const authorization = request.headers.get("authorization");
+    if (!authorization?.startsWith("Bearer "))
+        return;
+    const token = authorization.slice("Bearer ".length);
+    return API_KEY.test(token) ? sha256(token) : undefined;
+}
+export function apiKeyPrincipal(record, digest) {
+    if (!isStoredApiKey(record) || record.digest !== digest)
+        return;
+    return { kind: "api_key", userId: record.userId, organizationId: record.organizationId, teamId: record.teamId, role: record.role, subjectId: `api_key:${record.id}`, credentialId: record.id, authorizationEpoch: record.authorizationEpoch, capabilities: record.capabilities };
+}

package/cloudflare/managed-live.d.mts

@@ -0,0 +1,7 @@
+import type { ManagedAgentSettings } from "./agent-settings.mjs";
+import type { AdmissionPrincipal } from "./managed-auth.mjs";
+export function nativeLiveRequest(request: Request): boolean;
+export function liveAgentSettings(request: Request): ManagedAgentSettings | Response;
+export function liveAgentFailure(request: Request, principal: AdmissionPrincipal | undefined): Response | undefined;
+export function liveAgentRequest(request: Request, principal: AdmissionPrincipal, settings: ManagedAgentSettings, agentId: string, clientIngressColo: string | null): Request;
+export function newManagedAgentId(): string;

package/cloudflare/managed-live.mjs

@@ -0,0 +1,56 @@
+import { parseAgentSettingsQuery, agentSettingsQuery } from "./agent-settings.mjs";
+import { API_KEY, forwardPrincipalAssertions } from "./managed-auth.mjs";
+import { ingressColo } from "./durable-placement.mjs";
+
+/** Narrow profile only; cookies and Connect retain the full authenticator's precedence. */
+export function nativeLiveRequest(request) {
+  return request.method === "GET" && new URL(request.url).pathname === "/v1/agents/live"
+    && !request.headers.has("cookie")
+    && ![...request.headers.keys()].some(name => name.startsWith("x-nanocodex-connect-"))
+    && request.headers.get("authorization")?.startsWith("Bearer ") === true
+    && API_KEY.test(request.headers.get("authorization").slice("Bearer ".length));
+}
+function failure(error, status) {
+  return Response.json({ error }, { status, headers: { "cache-control": "no-store" } });
+}
+/** Preserve managed admission's query-before-upgrade-before-auth ordering. */
+export function liveAgentSettings(request) {
+  let settings;
+  try { settings = parseAgentSettingsQuery(new URL(request.url).searchParams); }
+  catch { return failure("invalid_request", 400); }
+  if (request.headers.get("upgrade")?.toLowerCase() !== "websocket") {
+    return new Response("Expected WebSocket upgrade", { status: 426 });
+  }
+  return settings;
+}
+export function liveAgentFailure(request, principal) {
+  if (!principal) return failure("unauthorized", 401);
+  if (!["agents:read", "agents:write", "tools:use"].every(c => principal.capabilities.includes(c))) return failure("forbidden", 403);
+  if (principal.connectGrant && !principal.connectGrant.connectors.includes("chatgpt")) return failure("connector_forbidden", 403);
+  if (principal.kind !== "api_key" && request.headers.get("origin") !== new URL(request.url).origin) return failure("forbidden_origin", 403);
+}
+/** Internal request only, after liveAgentFailure. Never accepts HTTP-supplied authority. */
+export function liveAgentRequest(request, principal, settings, agentId, clientIngressColo) {
+  const headers = new Headers(request.headers);
+  forwardPrincipalAssertions(headers, principal);
+  headers.delete("x-nanocodex-client-ingress-colo");
+  headers.delete("x-nanocodex-worker-colo");
+  const colo = ingressColo(clientIngressColo);
+  if (colo) headers.set("x-nanocodex-client-ingress-colo", colo);
+  headers.set("x-nanocodex-create-session-id", agentId);
+  const query = agentSettingsQuery(settings);
+  query.set("public_origin", new URL(request.url).origin);
+  return new Request(`https://session.internal/create-live?${query}`, new Request(request, { headers }));
+}
+export function newManagedAgentId() {
+  const bytes = crypto.getRandomValues(new Uint8Array(16));
+  let timestamp = BigInt(Date.now());
+  for (let index = 5; index >= 0; index -= 1) {
+    bytes[index] = Number(timestamp & 0xffn);
+    timestamp >>= 8n;
+  }
+  bytes[6] = (bytes[6] & 0x0f) | 0x70;
+  bytes[8] = (bytes[8] & 0x3f) | 0x80;
+  const hex = [...bytes].map(byte => byte.toString(16).padStart(2, "0")).join("");
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}

package/cloudflare/prepared-connection.mjs

@@ -0,0 +1,49 @@
+/** One construction-owned socket, transferred only to the matching root host. */
+export function prepareConnection(endpoint, sessionId, signal) {
+  signal?.throwIfAborted();
+  let transferred = false;
+  let disposed = false;
+  let opened;
+  let closing;
+  let rejectDisposed;
+  const disposedPromise = new Promise((_, reject) => { rejectDisposed = reject; });
+  const opening = Promise.resolve().then(() => {
+    signal?.throwIfAborted();
+    return endpoint.createWebSocket(endpoint.websocketUrl, sessionId, { authorization: "preconnect" });
+  }).then(value => {
+    opened = value;
+    if (disposed) {
+      void close().catch(() => {});
+      throw new Error("Cloudflare Agent preparation was disposed");
+    }
+    return value;
+  });
+  const promise = Promise.race([opening, disposedPromise]);
+  void promise.catch(() => {});
+  const abort = () => { void dispose().catch(() => {}); };
+  signal?.addEventListener("abort", abort, { once: true });
+  return { take, dispose };
+
+  function take(url, id, request) {
+    if (disposed || transferred || url !== endpoint.websocketUrl || id !== sessionId
+      || (request.threadId ?? id) !== sessionId || request.authorization !== "preconnect") {
+      throw new Error("Cloudflare Agent preparation does not match the root transport");
+    }
+    transferred = true;
+    signal?.removeEventListener("abort", abort);
+    return promise;
+  }
+  function close() {
+    if (opened !== undefined) closing ??= Promise.resolve().then(() => opened.socket.close());
+    return closing ?? Promise.resolve();
+  }
+  function dispose() {
+    if (transferred) return Promise.resolve();
+    if (!disposed) {
+      disposed = true;
+      signal?.removeEventListener("abort", abort);
+      rejectDisposed(new Error("Cloudflare Agent preparation was disposed"));
+    }
+    return close();
+  }
+}

package/cloudflare/provider-stream.mjs

@@ -0,0 +1,353 @@
+import { chatReasoningText } from "./chat-reasoning.mjs";
+import { fromBindingResponsesResult } from "./gateway-binding-responses.mjs";
+
+// Codes are local constants only. Never surface an upstream exception/message.
+class StreamProtocolError extends Error {
+  constructor(code) { super(`Responses: invalid provider stream\nProtocol invariant: ${code}`); this.code = code; }
+}
+const invalid = code => { throw new StreamProtocolError(code); };
+// The portable normalizer has static failures but can also throw arbitrary
+// exceptions. Only exact known messages map to public diagnostics.
+const normalizationCodes = new Map([
+  ["invalid chat completion or unsupported finish reason", "normalize_completion"],
+  ["unsupported completion content", "normalize_content"],
+  ["invalid completion tool calls", "normalize_tool_calls"],
+  ["provider refused completion", "normalize_refusal"],
+  ["incomplete completion cannot dispatch tool calls", "normalize_incomplete_tools"],
+  ["invalid reasoning details", "normalize_reasoning_details"],
+  ["reasoning details exceed limit", "normalize_reasoning_size"],
+  ["tool choice forbids calls", "normalize_tool_forbidden"],
+  ["required tool call missing", "normalize_tool_required"],
+  ["unsupported completion tool call", "normalize_tool_type"],
+  ["model returned an unknown tool alias", "normalize_tool_alias"],
+  ["model returned ambiguous original tool alias", "normalize_tool_alias_ambiguous"],
+  ["model returned namespaced wire tool alias", "normalize_tool_alias_namespace_wire"],
+  ["model returned flattened namespace tool alias", "normalize_tool_alias_namespace_flat"],
+  ["model returned repeated tool alias", "normalize_tool_alias_repeated"],
+  ["model returned unregistered wire tool alias", "normalize_tool_alias_unregistered_wire"],
+  ["model returned parallel wrapper tool alias", "normalize_tool_alias_parallel_wrapper"],
+  ["model returned a different forced tool", "normalize_forced_tool"],
+  ["model returned invalid tool JSON", "normalize_tool_json"],
+  ["model returned unwrapped custom tool input", "normalize_custom_raw_input"],
+  ["invalid tool call ID", "normalize_tool_id"],
+  ["tool arguments must be a JSON object", "normalize_tool_arguments"],
+  ["model returned duplicate tool call IDs", "normalize_tool_duplicate_id"],
+  ["custom tool arguments must contain a string input", "normalize_custom_input"],
+  ["tool_calls finish reason omitted tool calls", "normalize_missing_tools"],
+].map(([message, code]) => [`Workers AI Responses: ${message}`, code]));
+for (const [message, code] of [
+  ["invalid reasoning text", "normalize_reasoning_text"],
+  ["invalid reasoning details", "normalize_reasoning_details"],
+  ["invalid reasoning detail text", "normalize_reasoning_detail_text"],
+]) normalizationCodes.set(`Responses: ${message}`, code);
+class StreamReadError extends Error {}
+const encoder = new TextEncoder();
+const frame = event => encoder.encode(`event: ${event.type}\ndata: ${JSON.stringify(event)}\n\n`);
+export const providerStream = (body, format = "chat", hooks = {}) => ({ providerStream: true, body, format, ...hooks });
+
+// Streaming UTF-8/SSE framing, including split CRLF, multiline data and comments.
+// Bound each frame and the full wire stream, including endless keepalives.
+async function* records(reader) {
+  const decoder = new TextDecoder("utf-8", { fatal: true });
+  let buffer = "", data = [], event = "", size = 0, total = 0;
+  const line = value => {
+    if (!value) {
+      const record = data.length ? { data: data.join("\n"), event } : null;
+      data = []; event = ""; size = 0;
+      return record;
+    }
+    size += value.length;
+    if (size > 4 * 1024 * 1024) invalid("frame_size");
+    const colon = value.indexOf(":");
+    const field = colon < 0 ? value : value.slice(0, colon);
+    let valueText = colon < 0 ? "" : value.slice(colon + 1);
+    if (valueText.startsWith(" ")) valueText = valueText.slice(1);
+    if (field === "data") data.push(valueText);
+    else if (field === "event") event = valueText;
+    return null;
+  };
+  while (true) {
+    let read;
+    try { read = await reader.read(); } catch { throw new StreamReadError(); }
+    const { value, done } = read;
+    total += value?.byteLength ?? 0;
+    if (total > 32 * 1024 * 1024) invalid("wire_size");
+    try { buffer += done ? decoder.decode() : decoder.decode(value, { stream: true }); }
+    catch { invalid("frame_utf8"); }
+    if (buffer.length > 4 * 1024 * 1024) invalid("frame_buffer_size");
+    let match;
+    while ((match = /\r\n|\r|\n/.exec(buffer))) {
+      if (!done && match[0] === "\r" && match.index === buffer.length - 1) break;
+      const record = line(buffer.slice(0, match.index));
+      buffer = buffer.slice(match.index + match[0].length);
+      if (record) yield record;
+    }
+    if (done) {
+      // A terminal event must be fully framed; never accept a truncated last frame.
+      if (buffer || data.length) invalid("frame_truncated");
+      return;
+    }
+  }
+}
+
+export function streamResponse(source, normalize, responseEvents, signal) {
+  if (!(source.body instanceof ReadableStream)) invalid("body_type");
+  const checkedNormalize = (result, prologue) => {
+    try { return normalize(result, prologue); }
+    catch (error) { invalid(normalizationCodes.get(error instanceof Error ? error.message : undefined) ?? "normalize_unknown"); }
+  };
+  const reader = source.body.getReader();
+  const iterator = records(reader);
+  let controller, settled = false, first = false, sequence = 0, finalSeen = false;
+  const id = `resp_${crypto.randomUUID()}`;
+  const reasoningDetails = [];
+  let retainedSize = 0;
+  const retain = text => {
+    retainedSize += encoder.encode(text).byteLength;
+    if (retainedSize > 8 * 1024 * 1024) invalid("retained_size");
+  };
+  const live = new Map();
+  const calls = new Map();
+  const nativeItems = new Map();
+  const nativeParts = new Map();
+  let usage, finishReason, started = false, bindingUsageSeen = false;
+  const emit = (type, fields) => controller.enqueue(frame({ type, sequence_number: sequence++, ...fields }));
+  const firstToken = () => { if (!first) { first = true; try { source.firstToken?.(); } catch { /* best effort */ } } };
+  const finish = async outcome => {
+    if (settled) return;
+    settled = true;
+    signal?.removeEventListener("abort", abort);
+    try { await source.finish?.(outcome); } catch { /* best effort */ }
+  };
+  let readerCancelled = false;
+  const cancelReader = () => {
+    if (readerCancelled) return;
+    readerCancelled = true;
+    void reader.cancel().catch(() => {}).finally(() => { reader.releaseLock(); });
+  };
+  const abort = () => {
+    if (settled) return;
+    cancelReader();
+    controller.error(new DOMException("Provider stream cancelled", signal?.reason?.name === "TimeoutError" ? "TimeoutError" : "AbortError"));
+    void finish(signal?.reason?.name === "TimeoutError" ? "timeout" : "cancelled");
+  };
+  const delta = (kind, text) => {
+    if (typeof text !== "string") invalid("text_type");
+    if (!text) return;
+    retain(text);
+    if (kind === "message") firstToken();
+    let entry = live.get(kind);
+    if (!entry) {
+      const item = kind === "message"
+        ? { type: kind, id: `msg_${crypto.randomUUID()}`, role: "assistant", status: "in_progress", content: [] }
+        : { type: kind, id: `rs_${crypto.randomUUID()}`, status: "in_progress", summary: [], content: [] };
+      entry = { item, index: live.size, text: "" };
+      live.set(kind, entry);
+      emit("response.output_item.added", { output_index: entry.index, item });
+      emit("response.content_part.added", { output_index: entry.index, item_id: item.id, content_index: 0,
+        part: kind === "message" ? { type: "output_text", text: "", annotations: [] } : { type: "reasoning_text", text: "" } });
+    }
+    entry.text += text;
+    emit(kind === "message" ? "response.output_text.delta" : "response.reasoning_text.delta",
+      { output_index: entry.index, item_id: entry.item.id, content_index: 0, delta: text });
+  };
+  // Tool declarations/arguments stay private until the existing normalizer has
+  // checked aliases, JSON, IDs and completeness. The parallel request bit is a
+  // generation preference; the host scheduler owns execution concurrency.
+  const complete = async result => {
+    const response = checkedNormalize(result);
+    response.id = id;
+    const output = [];
+    for (const [kind, entry] of live) {
+      const item = response.output.find(value => value.type === kind);
+      if (item?.content?.[0]?.text !== entry.text) invalid("output_text_mismatch");
+      item.id = entry.item.id;
+      output.push(item);
+    }
+    output.push(...response.output.filter(item => !live.has(item.type)));
+    response.output = output;
+    for (const event of responseEvents(response)) {
+      if (event.type === "response.created") continue;
+      const entry = [...live.values()].find(value => value.index === event.output_index);
+      if (entry && (event.type.endsWith(".added") || event.type.endsWith(".delta"))) continue;
+      const { type, sequence_number: _sequence, ...fields } = event;
+      if ((["response.output_text.delta", "response.function_call_arguments.delta", "response.custom_tool_call_input.delta"].includes(type) && fields.delta)
+        || (type === "response.output_item.added" && ["function_call", "custom_tool_call", "tool_search_call"].includes(fields.item?.type))) firstToken();
+      emit(type, fields);
+    }
+    finalSeen = true;
+    cancelReader();
+    await finish("success");
+    controller.close();
+  };
+  const chat = async value => {
+    // Workers AI appends its aggregate usage as a binding-specific envelope,
+    // after the Chat finish chunk and before [DONE]. It is metadata, not output.
+    if (source.format === "workers_ai_chat" && value && Object.hasOwn(value, "response")) {
+      if (!finishReason || bindingUsageSeen || value.response !== "" || !value.usage
+        || typeof value.usage !== "object" || Array.isArray(value.usage)
+        || Object.keys(value).some(key => !["response", "usage"].includes(key))) invalid("binding_usage_trailer");
+      bindingUsageSeen = true;
+      usage = value.usage;
+      return;
+    }
+    if (bindingUsageSeen || !value || value.error || !Array.isArray(value.choices) || value.choices.length > 1) invalid("chat_envelope");
+    if (value.usage != null) usage = value.usage;
+    const choice = value.choices[0];
+    if (!choice) { if (!finishReason || value.usage == null) invalid("chat_empty_choice"); return; }
+    if (choice.index !== undefined && choice.index !== 0) invalid("chat_choice_index");
+    const part = choice.delta;
+    if (!part || typeof part !== "object" || Array.isArray(part) || part.refusal
+      || (part.role != null && part.role !== "assistant")) invalid("chat_delta");
+    if (finishReason) {
+      // OpenRouter repeats its finish choice with an empty delta on the usage
+      // trailer before [DONE]. Admit metadata only, never additional output or
+      // a changed terminal reason after the first finish chunk.
+      if (value.usage == null || choice.finish_reason !== finishReason
+        || Object.entries(part).some(([field, fragment]) => field === "role" ? fragment != null && fragment !== "assistant"
+          : !["content", "reasoning_content", "reasoning"].includes(field) || (fragment !== null && fragment !== ""))) invalid("chat_usage_trailer");
+      return;
+    }
+    if (part.content != null) delta("message", part.content);
+    let reasoning;
+    try { reasoning = chatReasoningText(part); } catch { invalid("chat_reasoning"); }
+    delta("reasoning", reasoning);
+    if (part.reasoning_details != null) {
+      if (!Array.isArray(part.reasoning_details) || part.reasoning_details.some(d => !d || typeof d !== "object" || Array.isArray(d))) invalid("chat_reasoning_details");
+      retain(JSON.stringify(part.reasoning_details));
+      reasoningDetails.push(...part.reasoning_details);
+    }
+    if (part.tool_calls != null) {
+      if (!Array.isArray(part.tool_calls)) invalid("tool_calls_type");
+      for (const fragment of part.tool_calls) {
+        if (!Number.isSafeInteger(fragment?.index) || fragment.index < 0 || fragment.index >= 1024) invalid("tool_fragment_index");
+        if (fragment.type != null && fragment.type !== "function") invalid("tool_fragment_type");
+        let call = calls.get(fragment.index);
+        if (!call) { call = { type: "function", function: { name: "", arguments: "" } }; calls.set(fragment.index, call); }
+        if (fragment.id != null) {
+          if (typeof fragment.id !== "string" || !fragment.id) invalid("tool_fragment_id");
+          if (call.id && call.id !== fragment.id) invalid("tool_fragment_id_changed");
+          call.id = fragment.id;
+        }
+        for (const field of ["name", "arguments"]) if (fragment.function?.[field] != null) {
+          if (typeof fragment.function[field] !== "string") invalid("tool_fragment_field_type");
+          retain(fragment.function[field]);
+          call.function[field] += fragment.function[field];
+          if (call.function[field].length > 4 * 1024 * 1024) invalid("tool_fragment_size");
+
+        }
+      }
+    }
+    if (choice.finish_reason != null) {
+      if (!["stop", "tool_calls", "length", "content_filter"].includes(choice.finish_reason)) invalid("chat_finish_reason");
+      finishReason = choice.finish_reason;
+    }
+  };
+  const native = async value => {
+    if (!value || typeof value.type !== "string" || value.error) invalid("native_envelope");
+    if (value.type === "response.output_item.added") {
+      if (!Number.isSafeInteger(value.output_index) || value.output_index < 0 || value.output_index >= 1024 || nativeItems.has(value.output_index)
+        || !value.item || typeof value.item.id !== "string" || !value.item.id || !["message", "reasoning", "function_call"].includes(value.item.type)
+        || [...nativeItems.values()].some(item => item.id === value.item.id)
+        || (value.item.type === "message" && value.item.role !== "assistant")) invalid("native_item");
+      nativeItems.set(value.output_index, { ...value.item, streamedText: "", streamedArguments: "" });
+    } else if (["response.output_text.delta", "response.reasoning_text.delta", "response.reasoning_summary_text.delta", "response.function_call_arguments.delta"].includes(value.type)) {
+      const item = nativeItems.get(value.output_index);
+      if (!item || value.item_id !== item.id || typeof value.delta !== "string") invalid("native_delta");
+      if (value.type === "response.function_call_arguments.delta") {
+        if (item.type !== "function_call") invalid("native_tool_type");
+        retain(value.delta);
+        item.streamedArguments += value.delta;
+        if (item.streamedArguments.length > 4 * 1024 * 1024) invalid("native_arguments_size");
+
+      } else {
+        const kind = value.type === "response.output_text.delta" ? "message" : "reasoning";
+        if (item.type !== kind || (value.content_index !== undefined && (!Number.isSafeInteger(value.content_index) || value.content_index < 0))
+          || (value.summary_index !== undefined && (!Number.isSafeInteger(value.summary_index) || value.summary_index < 0))) invalid("native_text_part");
+        if (value.delta) {
+          const part = `${value.output_index}:${value.type}:${value.content_index ?? value.summary_index ?? 0}`;
+          if (nativeParts.get(kind) !== part) {
+            if (nativeParts.has(kind)) delta(kind, "\n");
+            if (item.streamedText) item.streamedText += "\n";
+            nativeParts.set(kind, part);
+          }
+          item.streamedText += value.delta;
+          delta(kind, value.delta);
+        }
+      }
+    } else if (["response.completed", "response.incomplete"].includes(value.type)) {
+      if (value.response?.status !== value.type.slice("response.".length)) invalid("native_terminal_status");
+      for (const [index, item] of nativeItems) {
+        const final = value.response?.output?.[index];
+        if (!final || item.id !== final.id || item.type !== final.type) invalid("native_terminal_item");
+        if (item.streamedText) {
+          const parts = item.type === "message" ? final.content : [...(final.summary ?? []), ...(final.content ?? [])];
+          if (!Array.isArray(parts) || parts.map(part => part?.text).join("\n") !== item.streamedText) invalid("native_terminal_text");
+        }
+        if (item.type === "function_call" && (item.streamedArguments !== final.arguments
+          || item.call_id !== final.call_id || item.name !== final.name)) invalid("native_terminal_tool");
+      }
+      let result;
+      try { result = fromBindingResponsesResult(value.response); }
+      catch { invalid("native_normalization"); }
+      await complete(result);
+    } else if (!["response.created", "response.in_progress", "response.queued", "response.output_item.done",
+      "response.content_part.added", "response.content_part.done", "response.output_text.done", "response.reasoning_text.done",
+      "response.reasoning_summary_part.added", "response.reasoning_summary_part.done", "response.reasoning_summary_text.done",
+      "response.function_call_arguments.done"].includes(value.type)) invalid("native_event_type");
+  };
+  const body = new ReadableStream({
+    start(value) {
+      controller = value;
+      signal?.addEventListener("abort", abort, { once: true });
+      if (signal?.aborted) abort();
+    },
+    async pull() {
+      if (settled) return;
+      try {
+        if (!started) {
+          started = true;
+          // Obtain canonical model identity without admitting provider data.
+          const base = checkedNormalize({ choices: [{ message: { content: "" }, finish_reason: "stop" }] }, true);
+          emit("response.created", { response: { ...base, id, status: "in_progress", output: [], usage: null, end_turn: false } });
+          return;
+        }
+        const before = sequence;
+        do {
+          const record = await iterator.next();
+          if (settled) return;
+          if (record.done) invalid("terminal_missing");
+          if (record.value.data === "[DONE]") {
+            if (!["chat", "workers_ai_chat"].includes(source.format) || !finishReason) invalid("terminal_done");
+            const tool_calls = [...calls].sort(([a], [b]) => a - b).map(([index, call], position) => {
+              if (index !== position) invalid("tool_terminal_index");
+              if (!call.id) invalid("tool_terminal_id_missing");
+              return call;
+            });
+            await complete({ choices: [{ message: { content: live.get("message")?.text ?? "",
+              reasoning_content: live.get("reasoning")?.text ?? "", ...(reasoningDetails.length ? { reasoning_details: reasoningDetails } : {}), tool_calls }, finish_reason: finishReason }], usage });
+          } else {
+            let value;
+            try { value = JSON.parse(record.value.data); } catch { invalid("frame_json"); }
+            if (source.format === "responses") {
+              if (record.value.event && record.value.event !== value.type) invalid("native_event_mismatch");
+              await native(value);
+            } else await chat(value);
+          }
+        } while (!settled && sequence === before);
+      } catch (error) {
+        if (settled) return;
+        cancelReader();
+        controller.error(new Error(error instanceof StreamReadError
+          ? "Responses: provider stream read failed"
+          : `Responses: invalid provider stream\nProtocol invariant: ${error instanceof StreamProtocolError ? error.code : "unknown"}`));
+        await finish(error instanceof StreamReadError ? "network_error" : "protocol_error");
+      }
+    },
+    async cancel() {
+      cancelReader();
+      if (!finalSeen) await finish("cancelled");
+    },
+  });
+  return new Response(body, { headers: { "content-type": "text/event-stream", "cache-control": "no-cache", "x-nanocodex-inference-buffering": "streaming" } });
+}

package/cloudflare/rpc.d.mts

@@ -0,0 +1,9 @@
+/// <reference lib="esnext.disposable" />
+
+/**
+ * Copy a data-only RPC result and dispose its owner, including on clone failure.
+ * Returns detached structured data; rejects RPC stubs/functions. Do not use for
+ * streams or capabilities that must survive the result (use dup/dispose there).
+ * Plain local adapters and primitive/undefined results are also accepted.
+ */
+export declare function consumeRpcData<T>(value: T): T extends object ? Omit<T, typeof Symbol.dispose> : T;

package/cloudflare/rpc.mjs

@@ -0,0 +1,14 @@
+/**
+ * Consume a data-only RPC result before returning or caching its detached data.
+ * Each receiving hop owns its result, even when the payload has no stubs.
+ * structuredClone rejects RPC capabilities; callers retaining capabilities must
+ * instead manage their lifetime explicitly (dup/dispose).
+ */
+export function consumeRpcData(value) {
+  try {
+    return structuredClone(value);
+  } finally {
+    // Plain local adapters and primitive/undefined RPC results have no disposer.
+    value?.[Symbol.dispose]?.();
+  }
+}

package/cloudflare/tool-alias-diagnostic.mjs

@@ -0,0 +1,21 @@
+// Diagnostic classification only: never resolve or dispatch a new tool identity.
+// Return local constants, never provider names, arguments or registry contents.
+export function toolAliasFailure(returnedName, registry) {
+  if (typeof returnedName !== "string" || returnedName.length > 512) return "unknown tool alias";
+  const entries = [...registry.values()];
+  const original = entry => entry.namespace ? `${entry.namespace}.${entry.name}` : entry.name;
+  if (entries.filter(entry => returnedName === entry.name || returnedName === original(entry)).length > 1) {
+    return "ambiguous original tool alias";
+  }
+  if (entries.some(entry => entry.namespace && returnedName === `${entry.namespace}.${entry.alias}`)) return "namespaced wire tool alias";
+  if (entries.some(entry => entry.namespace && ["_", "__"].some(separator => returnedName === `${entry.namespace}${separator}${entry.name}`))) {
+    return "flattened namespace tool alias";
+  }
+  if (entries.some(entry => [entry.alias, entry.name, original(entry)].some(name => name && returnedName.length > name.length
+    && returnedName.length % name.length === 0 && returnedName === name.repeat(returnedName.length / name.length)))) {
+    return "repeated tool alias";
+  }
+  if (/^tool_[0-9]+$/.test(returnedName)) return "unregistered wire tool alias";
+  if (returnedName === "multi_tool_use.parallel") return "parallel wrapper tool alias";
+  return "unknown tool alias";
+}

package/cloudflare/tracing.d.mts

@@ -0,0 +1,16 @@
+export type SpanAttributes = Record<string, string | number | boolean | undefined>;
+export interface TraceSpan {
+  setAttribute(key: string, value: string | number | boolean): unknown;
+  setAttributes?(attributes: SpanAttributes): unknown;
+  recordException?(exception: { code: string }): void;
+}
+/** Only content-free metadata may be supplied. Uses individual attributes on older workerd. */
+export declare function setSpanAttributes(span: TraceSpan, attributes: SpanAttributes): void;
+/** Annotates the active native span when supported; does not create a span. */
+export declare function annotateActiveSpan(attributes: SpanAttributes): void;
+/** code must be a static operation label, never derived from a caught error. */
+export declare function recordSpanException(span: TraceSpan, code: string): void;
+/** Native nested spans that record sanitized failures and rethrow the original error. */
+export declare const tracing: {
+  enterSpan<T, A extends unknown[]>(name: string, callback: (span: TraceSpan, ...args: A) => T, ...args: A): T;
+};