@bitkyc08/opencodex 2.18.2 → 2.20.0

package/src/server/chat-native-sse.ts

@@ -0,0 +1,331 @@
+import { chatCompletionsErrorBody } from "../chat/outbound";
+import { classifyError, CYBER_POLICY_ERROR_CODE, isCyberPolicyCode } from "../lib/errors";
+import { redactSecretString } from "../lib/redact";
+import {
+  isTranslatorBudgetExceededError,
+  TRANSLATOR_MAX_SSE_EVENT_BYTES,
+  type TranslatorBudget,
+} from "../lib/translator-budget";
+import type { OcxUsage } from "../types";
+import { nextSseBlock, replaceSseDataPayload, sseDataPayload } from "./sse-payload-rewrite";
+
+type Rec = Record<string, unknown>;
+
+function isRec(value: unknown): value is Rec {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+export function usageFromChat(value: unknown): OcxUsage | undefined {
+  if (!isRec(value)) return undefined;
+  const prompt = typeof value.prompt_tokens === "number" ? value.prompt_tokens : undefined;
+  const completion = typeof value.completion_tokens === "number" ? value.completion_tokens : undefined;
+  if (prompt === undefined && completion === undefined) return undefined;
+  const promptDetails = isRec(value.prompt_tokens_details) ? value.prompt_tokens_details : undefined;
+  const completionDetails = isRec(value.completion_tokens_details) ? value.completion_tokens_details : undefined;
+  return {
+    inputTokens: prompt ?? 0,
+    outputTokens: completion ?? 0,
+    ...(typeof promptDetails?.cached_tokens === "number" ? { cachedInputTokens: promptDetails.cached_tokens } : {}),
+    ...(typeof completionDetails?.reasoning_tokens === "number"
+      ? { reasoningOutputTokens: completionDetails.reasoning_tokens }
+      : {}),
+  };
+}
+
+export function structuredError(value: unknown): {
+  message: string;
+  type?: string;
+  code?: string | null;
+  status?: number;
+} | null {
+  if (!isRec(value) || value.error === undefined || value.error === null) return null;
+  const error = value.error;
+  if (typeof error === "string") return { message: redactSecretString(error) };
+  if (!isRec(error)) return { message: "upstream error" };
+  const rawMessage = typeof error.message === "string" ? error.message : "upstream error";
+  return {
+    message: redactSecretString(rawMessage),
+    ...(typeof error.type === "string" ? { type: error.type } : {}),
+    ...(error.code === null || typeof error.code === "string" ? { code: error.code } : {}),
+    ...(typeof error.status === "number" && Number.isInteger(error.status) ? { status: error.status } : {}),
+  };
+}
+
+function normalizedChunk(value: Rec, requestedModel: string): Rec {
+  return {
+    ...value,
+    id: typeof value.id === "string" ? value.id : `chatcmpl-${crypto.randomUUID().replace(/-/g, "").slice(0, 24)}`,
+    object: "chat.completion.chunk",
+    created: typeof value.created === "number" ? value.created : Math.floor(Date.now() / 1000),
+    model: requestedModel,
+  };
+}
+
+export function jsonCompletionSse(value: Rec, requestedModel: string): string {
+  const id = typeof value.id === "string" ? value.id : `chatcmpl-${crypto.randomUUID().replace(/-/g, "").slice(0, 24)}`;
+  const created = typeof value.created === "number" ? value.created : Math.floor(Date.now() / 1000);
+  const model = requestedModel;
+  const choices = Array.isArray(value.choices) ? value.choices : [];
+  const choice = isRec(choices[0]) ? choices[0] : {};
+  const message = isRec(choice.message) ? choice.message : {};
+  const frames: Rec[] = [{
+    id,
+    object: "chat.completion.chunk",
+    created,
+    model,
+    choices: [{ index: 0, delta: { role: "assistant", content: "" }, finish_reason: null }],
+  }];
+  const delta: Rec = {};
+  if (typeof message.content === "string" && message.content.length > 0) delta.content = message.content;
+  if (typeof message.reasoning_content === "string" && message.reasoning_content.length > 0) {
+    delta.reasoning_content = message.reasoning_content;
+  }
+  if (Array.isArray(message.tool_calls) && message.tool_calls.length > 0) {
+    delta.tool_calls = message.tool_calls.map((tool, index) => isRec(tool) ? { index, ...tool } : tool);
+  }
+  if (Object.keys(delta).length > 0) {
+    frames.push({ id, object: "chat.completion.chunk", created, model, choices: [{ index: 0, delta, finish_reason: null }] });
+  }
+  frames.push({
+    id,
+    object: "chat.completion.chunk",
+    created,
+    model,
+    choices: [{ index: 0, delta: {}, finish_reason: typeof choice.finish_reason === "string" ? choice.finish_reason : "stop" }],
+    ...(value.usage !== undefined ? { usage: value.usage } : {}),
+  });
+  return `${frames.map(frame => `data: ${JSON.stringify(frame)}\n\n`).join("")}data: [DONE]\n\n`;
+}
+
+interface NativeChatSseOptions {
+  requestedModel: string;
+  translatorBudget: TranslatorBudget;
+  signal: AbortSignal;
+  onFirstOutput?: () => void;
+  onUsage: (usage: OcxUsage) => void;
+  onTerminal?: (status: number, message?: string) => void;
+  onCancel?: () => void;
+}
+
+export function nativeChatSse(
+  body: ReadableStream<Uint8Array>,
+  options: NativeChatSseOptions,
+): ReadableStream<Uint8Array> {
+  const reader = body.getReader();
+  const decoder = new TextDecoder();
+  const encoder = new TextEncoder();
+  const scope = { kind: "live_transient" as const };
+  let buffer = "";
+  let bufferBytes = 0;
+  let queuedBytes = 0;
+  let sawFinish = false;
+  let sawDone = false;
+  let firstOutput = false;
+  let settled = false;
+  let cancelled = false;
+  let cancelledBySignal = false;
+
+  const releaseQueued = () => {
+    if (queuedBytes === 0) return;
+    options.translatorBudget.releaseRetained(queuedBytes, scope);
+    queuedBytes = 0;
+  };
+  const replaceBuffer = (next: string) => {
+    const nextBytes = encoder.encode(next).byteLength;
+    const reservation = options.translatorBudget.reserveTransient(nextBytes, scope);
+    reservation.commitRetained();
+    options.translatorBudget.releaseRetained(bufferBytes, scope);
+    buffer = next;
+    bufferBytes = nextBytes;
+  };
+  const appendBuffer = (fragment: string) => {
+    if (!fragment) return;
+    const fragmentBytes = encoder.encode(fragment).byteLength;
+    const nextBytes = bufferBytes + fragmentBytes;
+    if (nextBytes > TRANSLATOR_MAX_SSE_EVENT_BYTES) {
+      throw new Error("upstream SSE event exceeded the safe limit", { cause: { code: "translation_buffer_limit" } });
+    }
+    const reservation = options.translatorBudget.reserveTransient(nextBytes, scope);
+    try {
+      buffer += fragment;
+      reservation.commitRetained();
+      options.translatorBudget.releaseRetained(bufferBytes, scope);
+      bufferBytes = nextBytes;
+    } catch (error) {
+      reservation.release();
+      throw error;
+    }
+  };
+  const enqueue = (controller: ReadableStreamDefaultController<Uint8Array>, text: string) => {
+    const bytes = encoder.encode(text);
+    const reservation = options.translatorBudget.reserveTransient(bytes.byteLength, scope);
+    controller.enqueue(bytes);
+    reservation.commitRetained();
+    queuedBytes += bytes.byteLength;
+  };
+  const releaseBuffer = () => {
+    options.translatorBudget.releaseRetained(bufferBytes, scope);
+    buffer = "";
+    bufferBytes = 0;
+  };
+  const settle = (status: number, message?: string) => {
+    if (settled) return;
+    settled = true;
+    options.signal.removeEventListener("abort", onAbort);
+    options.onTerminal?.(status, message);
+  };
+  const fail = (
+    controller: ReadableStreamDefaultController<Uint8Array>,
+    message: string,
+    code: string,
+    status = 502,
+    type = "upstream_error",
+  ) => {
+    const safeMessage = redactSecretString(message);
+    try {
+      const frame = `data: ${JSON.stringify(chatCompletionsErrorBody(status, safeMessage, type, code))}\n\n`;
+      if (code === "translation_buffer_limit") controller.enqueue(encoder.encode(frame));
+      else enqueue(controller, frame);
+    } catch { /* controller may already be closed */ }
+    releaseBuffer();
+    settle(status, safeMessage);
+    try { void reader.cancel(new Error(safeMessage)).catch(() => {}); } catch { /* already closed */ }
+    try { controller.close(); } catch { /* already closed */ }
+  };
+  const processBlock = (
+    controller: ReadableStreamDefaultController<Uint8Array>,
+    block: string,
+    delimiter: string,
+  ): void => {
+    const payload = sseDataPayload(block);
+    if (payload === null) {
+      enqueue(controller, block + delimiter);
+      return;
+    }
+    const trimmed = payload.trim();
+    if (trimmed === "[DONE]") {
+      sawDone = true;
+      enqueue(controller, replaceSseDataPayload(block, "[DONE]") + delimiter);
+      settle(200);
+      try { void reader.cancel().catch(() => {}); } catch { /* already closed */ }
+      controller.close();
+      return;
+    }
+    let parsed: unknown;
+    try {
+      parsed = JSON.parse(payload);
+    } catch {
+      fail(controller, "upstream returned malformed SSE JSON", "upstream_sse_invalid");
+      return;
+    }
+    if (!isRec(parsed)) {
+      fail(controller, "upstream returned an invalid SSE event", "upstream_sse_invalid");
+      return;
+    }
+    const error = structuredError(parsed);
+    if (error) {
+      const status = error.status ?? 502;
+      const classified = classifyError(status, error.type ?? "upstream_error", error.message);
+      if (isCyberPolicyCode(error.code)) {
+        classified.code = CYBER_POLICY_ERROR_CODE;
+        classified.type = "invalid_request_error";
+      } else if (error.code !== undefined && error.code !== null) {
+        classified.code = error.code;
+      }
+      const safe = chatCompletionsErrorBody(status, classified.message, classified.type, classified.code);
+      enqueue(controller, replaceSseDataPayload(block, JSON.stringify(safe)) + delimiter);
+      settle(isCyberPolicyCode(classified.code) ? 400 : status, classified.message);
+      try { void reader.cancel(new Error(classified.message)).catch(() => {}); } catch { /* already closed */ }
+      controller.close();
+      return;
+    }
+    const usage = usageFromChat(parsed.usage);
+    if (usage) options.onUsage(usage);
+    const choices = Array.isArray(parsed.choices) ? parsed.choices : [];
+    if (choices.some(choice => isRec(choice) && typeof choice.finish_reason === "string" && choice.finish_reason.length > 0)) {
+      sawFinish = true;
+    }
+    if (!firstOutput && choices.some(choice => {
+      if (!isRec(choice) || !isRec(choice.delta)) return false;
+      const delta = choice.delta;
+      return (typeof delta.content === "string" && delta.content.length > 0)
+        || (typeof delta.reasoning_content === "string" && delta.reasoning_content.length > 0)
+        || (Array.isArray(delta.tool_calls) && delta.tool_calls.length > 0);
+    })) {
+      firstOutput = true;
+      options.onFirstOutput?.();
+    }
+    enqueue(controller, replaceSseDataPayload(block, JSON.stringify(normalizedChunk(parsed, options.requestedModel))) + delimiter);
+  };
+
+  function onAbort() {
+    cancelledBySignal = true;
+    if (!settled) {
+      settled = true;
+      options.onCancel?.();
+    }
+    try { void reader.cancel(options.signal.reason).catch(() => {}); } catch { /* already closed */ }
+  }
+  if (options.signal.aborted) onAbort();
+  else options.signal.addEventListener("abort", onAbort, { once: true });
+
+  return new ReadableStream<Uint8Array>({
+    async pull(controller) {
+      releaseQueued();
+      try {
+        for (;;) {
+          const next = nextSseBlock(buffer);
+          if (next) {
+            replaceBuffer(next.rest);
+            processBlock(controller, next.block, next.delimiter);
+            return;
+          }
+          const { done, value } = await reader.read();
+          if (cancelled) return;
+          if (cancelledBySignal) {
+            releaseBuffer();
+            controller.close();
+            return;
+          }
+          if (!done) {
+            appendBuffer(decoder.decode(value, { stream: true }));
+            continue;
+          }
+          appendBuffer(decoder.decode());
+          if (buffer.trim().length > 0) {
+            fail(controller, "upstream SSE ended with an unterminated event", "upstream_sse_unterminated");
+            return;
+          }
+          releaseBuffer();
+          if (sawDone || sawFinish) {
+            if (!sawDone) enqueue(controller, "data: [DONE]\n\n");
+            settle(200);
+            controller.close();
+          } else {
+            fail(controller, "upstream SSE ended before a terminal event", "upstream_sse_truncated");
+          }
+          return;
+        }
+      } catch (error) {
+        const overflow = isTranslatorBudgetExceededError(error)
+          || (error instanceof Error && (error.cause as { code?: unknown } | undefined)?.code === "translation_buffer_limit");
+        fail(
+          controller,
+          overflow ? "upstream SSE event exceeded the safe limit" : error instanceof Error ? error.message : String(error),
+          overflow ? "translation_buffer_limit" : "upstream_sse_error",
+        );
+      }
+    },
+    cancel(reason) {
+      cancelled = true;
+      releaseQueued();
+      releaseBuffer();
+      options.signal.removeEventListener("abort", onAbort);
+      if (!settled) {
+        settled = true;
+        options.onCancel?.();
+      }
+      try { return reader.cancel(reason).then(() => undefined, () => undefined); } catch { return Promise.resolve(); }
+    },
+  });
+}

package/src/server/chat-native.ts

@@ -0,0 +1,371 @@
+import { buildOpenAIChatPassthroughRequest, createOpenAIChatAdapter } from "../adapters/openai-chat";
+import type { AdapterRequest, ProviderAdapter } from "../adapters/base";
+import {
+  chatCompletionsErrorBody,
+  chatCompletionsErrorResponse,
+  collectChatCompletion,
+  isChatCompletionsStreamError,
+} from "../chat/outbound";
+import { classifyError, CYBER_POLICY_ERROR_CODE, isCyberPolicyCode } from "../lib/errors";
+import { readBoundedResponseBody } from "../lib/bounded-body";
+import { redactSecretString } from "../lib/redact";
+import { resolveClientRetryAfter } from "../lib/retry-after";
+import {
+  applyUpstreamRecoveryInit,
+  fetchWithResetRetry,
+  prepareSameTarget429Wait,
+  type UpstreamSendRecovery,
+} from "../lib/upstream-retry";
+import {
+  isTranslatorBudgetExceededError,
+  type TranslatorBudget,
+} from "../lib/translator-budget";
+import {
+  hasKeyPoolFailover,
+  rateLimitRetryDelayMs,
+  rateLimitRetryPolicyFor,
+  rotateProviderTransportOn429,
+} from "../providers/key-failover";
+import type { RouteResult } from "../router";
+import type { OcxConfig, OcxProviderConfig } from "../types";
+import { fetchWithHeaderTimeout, providerFetch, safeHostLabel } from "./responses/fetch-helpers";
+import { linkAbortSignal } from "./responses";
+import {
+  addFinalRequestLog,
+  beginRequestAttempt,
+  noteAttemptSend,
+  recordFirstOutput,
+  sealRequestAttemptIdentity,
+  type RequestLogContext,
+} from "./request-log";
+import { jsonCompletionSse, nativeChatSse, structuredError, usageFromChat } from "./chat-native-sse";
+
+type Rec = Record<string, unknown>;
+
+const MAX_NATIVE_CHAT_JSON_BYTES = 32 * 1024 * 1024;
+const MAX_NATIVE_CHAT_ERROR_BYTES = 64 * 1024;
+
+function isRec(value: unknown): value is Rec {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+export function isNativeChatRouteEligible(route: RouteResult, rawBody: Rec): boolean {
+  const provider = route.provider;
+  if (provider.adapter !== "openai-chat") return false;
+  if (provider.authMode !== undefined && provider.authMode !== "key" && provider.authMode !== "local") return false;
+  // Combo and policy execution own multi-candidate retries in the Responses pipeline.
+  if (route.combo || route.routeKind === "combo" || route.routeKind === "policy") return false;
+  if (rawBody.store === true || rawBody.background === true) return false;
+  if (typeof rawBody.previous_response_id === "string" && rawBody.previous_response_id.length > 0) return false;
+  if (rawBody.compaction_trigger !== undefined) return false;
+  if (Array.isArray(rawBody.tools)) {
+    for (const tool of rawBody.tools) {
+      if (!isRec(tool)) continue;
+      if (tool.type === "web_search" || tool.type === "web_search_preview" || tool.type === "image_generation") {
+        return false;
+      }
+    }
+  }
+  return true;
+}
+
+function chatCompletionJson(value: unknown): Rec | null {
+  if (!isRec(value) || !Array.isArray(value.choices) || value.choices.length === 0) return null;
+  return value;
+}
+
+interface HandleNativeChatOptions {
+  req: Request;
+  config: OcxConfig;
+  logCtx: RequestLogContext;
+  logIds?: { requestId: string; start: number };
+  route: RouteResult;
+  chatBody: Rec;
+  requestedModel: string;
+  requestedStream: boolean;
+  translatorBudget: TranslatorBudget;
+}
+
+export async function handleNativeChatCompletions(options: HandleNativeChatOptions): Promise<Response> {
+  const { req, config, logCtx, logIds, route, requestedModel, requestedStream, translatorBudget } = options;
+  logCtx.inboundProtocol = "chat";
+  const attempt = beginRequestAttempt(
+    (logCtx.attempts?.length ?? 0) + 1,
+    route.providerName,
+    route.modelId,
+    "openai-chat",
+  );
+  logCtx.activeAttempt = attempt;
+  logCtx.activeAttemptStartedAt = Date.now();
+  (logCtx.attempts ??= []).push(attempt);
+  sealRequestAttemptIdentity(attempt, route.providerName, "openai-chat", logCtx.accountLogLabel);
+
+  let logged = false;
+  const finishLog = (status: number, message?: string, closeReason: "non_stream" | "terminal" | "client_cancel" = "non_stream") => {
+    if (logged) return;
+    logged = true;
+    if (message) logCtx.upstreamError = redactSecretString(message).slice(0, 500);
+    if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, status, { closeReason });
+  };
+  const fail = (status: number, message: string, type?: string, code?: string | null): Response => {
+    const safeMessage = redactSecretString(message);
+    finishLog(status, safeMessage);
+    return chatCompletionsErrorResponse(status, safeMessage, type, code);
+  };
+
+  logCtx.requestedEffort = typeof options.chatBody.reasoning_effort === "string"
+    ? options.chatBody.reasoning_effort
+    : undefined;
+  logCtx.requestedServiceTier = typeof options.chatBody.service_tier === "string"
+    ? options.chatBody.service_tier
+    : undefined;
+
+  const upstream = new AbortController();
+  const cleanupAbort = linkAbortSignal(upstream, req.signal);
+  const connectMs = config.connectTimeoutMs ?? 200_000;
+  let activeProvider: OcxProviderConfig = route.provider;
+  let activeAdapter: ProviderAdapter = createOpenAIChatAdapter(activeProvider);
+  let activeRequest: AdapterRequest;
+  let retainedRequestBytes = 0;
+  const releaseRetainedRequest = () => {
+    if (retainedRequestBytes === 0) return;
+    translatorBudget.releaseRetained(retainedRequestBytes, { kind: "request_copies" });
+    retainedRequestBytes = 0;
+  };
+  const retainRequest = (request: AdapterRequest) => {
+    const bytes = new TextEncoder().encode(request.body).byteLength;
+    translatorBudget.chargeRetained(bytes, { kind: "request_copies" });
+    retainedRequestBytes = bytes;
+  };
+  try {
+    activeRequest = buildOpenAIChatPassthroughRequest(activeProvider, options.chatBody, route.modelId, requestedStream);
+    retainRequest(activeRequest);
+  } catch (error) {
+    releaseRetainedRequest();
+    cleanupAbort();
+    upstream.abort();
+    if (isTranslatorBudgetExceededError(error)) {
+      return fail(413, "request translation buffer exceeded the safe limit", "request_too_large", "translation_buffer_limit");
+    }
+    return fail(400, error instanceof Error ? error.message : String(error), "invalid_request_error");
+  }
+
+  const send = async (request: AdapterRequest, recovery?: "rate-limit-429" | "key-429"): Promise<Response> => {
+    try {
+      return await fetchWithResetRetry(
+        (transportRecovery?: UpstreamSendRecovery) => {
+          noteAttemptSend(attempt, logCtx.usageLogInputTokens, transportRecovery ?? recovery);
+          return fetchWithHeaderTimeout(
+            request.url,
+            applyUpstreamRecoveryInit({
+              method: request.method,
+              headers: request.headers,
+              body: request.body,
+            }, transportRecovery),
+            upstream.signal,
+            connectMs,
+            requestedStream,
+            providerFetch(activeProvider, undefined, {
+              providerName: route.providerName,
+              modelId: route.modelId,
+            }),
+          );
+        },
+        { abortSignal: upstream.signal, label: safeHostLabel(request.url) },
+      );
+    } finally {
+      request.releaseBodyObservation?.();
+    }
+  };
+
+  let response: Response;
+  try {
+    response = await send(activeRequest);
+    const retryPolicy = rateLimitRetryPolicyFor(activeProvider);
+    let retries = 0;
+    while (response.status === 429 && retryPolicy && retries < retryPolicy.attempts) {
+      retries += 1;
+      for await (const _ of prepareSameTarget429Wait({
+        body: response.body,
+        signal: upstream.signal,
+        delayMs: rateLimitRetryDelayMs(retryPolicy, response.headers.get("retry-after"), Date.now()),
+      })) { /* pre-stream wait */ }
+      if (upstream.signal.aborted) throw upstream.signal.reason;
+      response = await send(activeRequest, "rate-limit-429");
+    }
+    while (response.status === 429 && hasKeyPoolFailover(activeProvider)) {
+      const rotated = rotateProviderTransportOn429(config, route.providerName, activeProvider, {
+        retryAfter: response.headers.get("retry-after"),
+        now: Date.now(),
+        attemptedKey: activeProvider.apiKey,
+        promptCacheKey: typeof options.chatBody.prompt_cache_key === "string" ? options.chatBody.prompt_cache_key : undefined,
+      });
+      if (!rotated) break;
+      try { void response.body?.cancel().catch(() => {}); } catch { /* already closed */ }
+      activeProvider = rotated;
+      activeAdapter = createOpenAIChatAdapter(activeProvider);
+      releaseRetainedRequest();
+      activeRequest = buildOpenAIChatPassthroughRequest(activeProvider, options.chatBody, route.modelId, requestedStream);
+      retainRequest(activeRequest);
+      response = await send(activeRequest, "key-429");
+    }
+  } catch (error) {
+    releaseRetainedRequest();
+    cleanupAbort();
+    upstream.abort();
+    if (req.signal.aborted) return fail(499, "Client cancelled request", "client_cancelled");
+    return fail(502, error instanceof Error ? error.message : String(error), "server_error");
+  }
+  releaseRetainedRequest();
+
+  if (!response.ok) {
+    let bodyText = "";
+    try {
+      const body = await readBoundedResponseBody(response, {
+        signal: upstream.signal,
+        maxBytes: MAX_NATIVE_CHAT_ERROR_BYTES,
+      });
+      if (body.displaySafe) bodyText = body.text;
+    } catch { /* status-only fallback */ }
+    cleanupAbort();
+    if (req.signal.aborted) {
+      upstream.abort();
+      return fail(499, "Client cancelled request", "client_cancelled");
+    }
+    const detail = activeAdapter.formatErrorBody?.(response.status, response.headers, bodyText) ?? "";
+    let upstreamType: string | undefined;
+    let upstreamCode: string | null | undefined;
+    try {
+      const parsedError = JSON.parse(bodyText) as Rec;
+      const nested = isRec(parsedError.error) ? parsedError.error : undefined;
+      if (typeof nested?.type === "string") upstreamType = nested.type;
+      if (nested?.code === null || typeof nested?.code === "string") upstreamCode = nested.code;
+    } catch { /* keep generic classification */ }
+    const message = detail ? `Provider error ${response.status}: ${detail}` : `Provider error ${response.status}`;
+    const classified = classifyError(
+      response.status,
+      upstreamType ?? (response.status === 401 ? "authentication_error"
+        : response.status === 429 ? "rate_limit_error"
+          : response.status >= 500 ? "server_error" : "invalid_request_error"),
+      message,
+    );
+    if (isCyberPolicyCode(upstreamCode)) {
+      classified.code = CYBER_POLICY_ERROR_CODE;
+      classified.type = "invalid_request_error";
+    } else if (upstreamCode === "model_not_found") {
+      classified.code = "model_not_found";
+      classified.type = "invalid_request_error";
+    } else if (upstreamCode !== undefined && upstreamCode !== null && classified.code == null) {
+      classified.code = upstreamCode;
+    }
+    const status = isCyberPolicyCode(classified.code) ? 400 : response.status;
+    const retryAfter = resolveClientRetryAfter({
+      status: response.status,
+      message: classified.message,
+      upstreamRetryAfter: response.headers.get("retry-after"),
+    });
+    finishLog(status, classified.message);
+    return new Response(JSON.stringify(chatCompletionsErrorBody(status, classified.message, classified.type, classified.code)), {
+      status,
+      headers: {
+        "Content-Type": "application/json",
+        ...(retryAfter ? { "Retry-After": retryAfter } : {}),
+      },
+    });
+  }
+
+  const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";
+  if (contentType.includes("text/event-stream") && response.body) {
+    const stream = nativeChatSse(response.body, {
+      requestedModel,
+      translatorBudget,
+      signal: upstream.signal,
+      onFirstOutput: logIds ? () => recordFirstOutput(logCtx, logIds.start) : undefined,
+      onUsage: usage => {
+        logCtx.usage = usage;
+        attempt.usage = usage;
+      },
+      ...(requestedStream ? {
+        onTerminal: (status: number, message?: string) => {
+          cleanupAbort();
+          finishLog(status, message, "terminal");
+        },
+        onCancel: () => {
+          cleanupAbort();
+          upstream.abort();
+          finishLog(499, undefined, "client_cancel");
+        },
+      } : {}),
+    });
+    if (requestedStream) {
+      return new Response(stream, {
+        status: 200,
+        headers: {
+          "Content-Type": "text/event-stream; charset=utf-8",
+          "Cache-Control": "no-cache",
+          Connection: "keep-alive",
+        },
+      });
+    }
+    try {
+      const completion = await collectChatCompletion(stream, requestedModel, translatorBudget);
+      cleanupAbort();
+      finishLog(200);
+      return Response.json(completion);
+    } catch (error) {
+      cleanupAbort();
+      upstream.abort();
+      if (isChatCompletionsStreamError(error)) {
+        return fail(error.status, error.message, error.type, error.code);
+      }
+      return fail(502, error instanceof Error ? error.message : String(error), "upstream_error");
+    }
+  }
+
+  let body;
+  try {
+    body = await readBoundedResponseBody(response, {
+      signal: upstream.signal,
+      maxBytes: MAX_NATIVE_CHAT_JSON_BYTES,
+      totalTimeoutMs: Math.max(connectMs, 5_000),
+      inactivityTimeoutMs: Math.max(connectMs, 5_000),
+    });
+  } catch (error) {
+    cleanupAbort();
+    upstream.abort();
+    if (req.signal.aborted) return fail(499, "Client cancelled request", "client_cancelled");
+    return fail(502, error instanceof Error ? error.message : String(error), "upstream_error");
+  }
+  cleanupAbort();
+  if (body.oversized) {
+    upstream.abort();
+    return fail(502, "upstream response exceeded the safe limit", "upstream_error", "translation_buffer_limit");
+  }
+  let parsedJson: unknown;
+  try {
+    parsedJson = JSON.parse(body.text);
+  } catch {
+    return fail(502, "upstream returned malformed Chat Completions JSON", "upstream_error");
+  }
+  const error = structuredError(parsedJson);
+  if (error) return fail(error.status ?? 502, error.message, error.type, error.code);
+  const completion = chatCompletionJson(parsedJson);
+  if (!completion) return fail(502, "upstream response contained no choices", "upstream_error");
+  const usage = usageFromChat(completion.usage);
+  if (usage) {
+    logCtx.usage = usage;
+    attempt.usage = usage;
+  }
+  if (logIds) recordFirstOutput(logCtx, logIds.start);
+  finishLog(200);
+  if (requestedStream) {
+    return new Response(jsonCompletionSse(completion, requestedModel), {
+      status: 200,
+      headers: { "Content-Type": "text/event-stream; charset=utf-8", "Cache-Control": "no-cache" },
+    });
+  }
+  return new Response(JSON.stringify(completion), {
+    status: 200,
+    headers: { "Content-Type": "application/json" },
+  });
+}