@oh-my-pi/pi-ai 18.2.7 → 18.2.8

package/src/auth-gateway/routes/embeddings.ts

@@ -0,0 +1,98 @@
+import { logger } from "@oh-my-pi/pi-utils";
+import { embed } from "../../embeddings";
+import { classifyGatewayError } from "../../error/gateway";
+import * as embeddings from "../../providers/embeddings-server";
+import { deterministicUuid } from "../../utils/deterministic-id";
+import {
+	type AuthGatewayBootOptions,
+	buildGatewayApiKeyResolver,
+	mirrorRequestAbort,
+	recordGatewayUsage,
+	resolveGatewayApiKey,
+} from "../dispatch";
+import { gatewayResponseHeaders, json, resolveClientIdentity } from "../http";
+
+/** OpenAI-compatible `POST /v1/embeddings` gateway handler. */
+export async function handleEmbeddings(
+	bootOpts: AuthGatewayBootOptions,
+	req: Request,
+	peer: string,
+): Promise<Response> {
+	const startedAt = performance.now();
+	const requestId = crypto.randomUUID();
+	const controller = mirrorRequestAbort(req);
+	const aborted = (): Response => embeddings.formatError(499, "request_aborted", "client closed request");
+	if (controller.signal.aborted) return aborted();
+
+	let parsed: embeddings.EmbeddingsParsedRequest;
+	try {
+		parsed = await embeddings.parseRequest(req);
+	} catch (error) {
+		if (controller.signal.aborted) return aborted();
+		const message = error instanceof Error ? error.message : String(error);
+		const status = error instanceof embeddings.EmbeddingsWireError ? error.status : 400;
+		return embeddings.formatError(status, "invalid_request_error", message);
+	}
+	if (controller.signal.aborted) return aborted();
+
+	const model = bootOpts.resolveModel(parsed.modelId);
+	if (!model) {
+		return embeddings.formatError(404, "invalid_request_error", `Unknown model: ${parsed.modelId}`);
+	}
+	if (model.api !== "openai-embeddings") {
+		return embeddings.formatError(
+			400,
+			"invalid_request_error",
+			`Model ${parsed.modelId} does not support embeddings`,
+		);
+	}
+
+	const client = resolveClientIdentity(req.headers);
+	const sessionId = deterministicUuid(`embeddings\u0000${model.provider}/${model.id}`);
+	const apiKey = await resolveGatewayApiKey(bootOpts.storage, model, sessionId, controller.signal, peer);
+	if (controller.signal.aborted) return aborted();
+	if (typeof apiKey !== "string") {
+		return embeddings.formatError(apiKey.status, apiKey.type, apiKey.message);
+	}
+
+	logger.info("auth-gateway request", {
+		requestId,
+		format: "embeddings",
+		model: parsed.modelId,
+		resolvedProvider: model.provider,
+		resolvedModel: model.id,
+		stream: false,
+		peer,
+	});
+
+	try {
+		const result = await embed(model, parsed.request, {
+			apiKey: buildGatewayApiKeyResolver(
+				bootOpts.storage,
+				model,
+				sessionId,
+				apiKey,
+				controller.signal,
+				"embeddings",
+				peer,
+			),
+			fetch: bootOpts.fetch,
+			signal: controller.signal,
+		});
+		recordGatewayUsage(bootOpts.storage, model, client, result.usage);
+		return json(
+			200,
+			embeddings.encodeResponse(result, parsed.modelId),
+			gatewayResponseHeaders(model, { requestId, costUsd: result.usage.cost.total, startedAt }),
+		);
+	} catch (error) {
+		if (controller.signal.aborted) return aborted();
+		const classified = classifyGatewayError(error);
+		logger.warn("auth-gateway embeddings failed", {
+			format: "embeddings",
+			error: classified.message,
+			peer,
+		});
+		return embeddings.formatError(classified.status, classified.type, classified.message);
+	}
+}

package/src/auth-gateway/routes/images.ts

@@ -0,0 +1,131 @@
+import { calculateCost } from "@oh-my-pi/pi-catalog/models";
+import { logger } from "@oh-my-pi/pi-utils";
+import { classifyGatewayError } from "../../error/gateway";
+import { generateImage } from "../../images";
+import * as imagesServer from "../../providers/images-server";
+import { deterministicUuid } from "../../utils/deterministic-id";
+import {
+	type AuthGatewayBootOptions,
+	buildGatewayApiKeyResolver,
+	mirrorRequestAbort,
+	recordGatewayUsage,
+	resolveGatewayApiKey,
+} from "../dispatch";
+import { gatewayResponseHeaders, json, resolveClientIdentity } from "../http";
+
+function isGatewayImageApi(api: string): boolean {
+	return (
+		api === "openai-images" ||
+		api === "openrouter-images" ||
+		api === "google-generative-ai" ||
+		api === "google-gemini-cli"
+	);
+}
+
+async function handleImages(
+	bootOpts: AuthGatewayBootOptions,
+	req: Request,
+	peer: string,
+	kind: imagesServer.ImageRequestKind,
+): Promise<Response> {
+	const startedAt = performance.now();
+	const requestId = crypto.randomUUID();
+	const controller = mirrorRequestAbort(req);
+	const aborted = (): Response => imagesServer.formatError(499, "request_aborted", "client closed request");
+	if (controller.signal.aborted) return aborted();
+
+	let body: unknown | FormData;
+	try {
+		body =
+			kind === "edits" && req.headers.get("content-type")?.includes("multipart/form-data")
+				? await req.formData()
+				: await req.json();
+	} catch (error) {
+		if (controller.signal.aborted) return aborted();
+		return imagesServer.formatError(400, "invalid_request_error", `Invalid request body: ${String(error)}`);
+	}
+	if (controller.signal.aborted) return aborted();
+
+	let parsed: imagesServer.ImagesParsedRequest;
+	try {
+		parsed = await imagesServer.parseRequest(body, kind);
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		return imagesServer.formatError(400, "invalid_request_error", message);
+	}
+
+	const model = bootOpts.resolveModel(parsed.modelId);
+	if (!model) {
+		return imagesServer.formatError(404, "invalid_request_error", `Unknown model: ${parsed.modelId}`);
+	}
+	if (model.api === "openai-responses" || model.api === "openai-codex-responses") {
+		return imagesServer.formatError(
+			400,
+			"invalid_request_error",
+			`Model ${parsed.modelId} requires a hosted image carrier, which the auth gateway cannot resolve`,
+		);
+	}
+	if (!isGatewayImageApi(model.api)) {
+		return imagesServer.formatError(
+			400,
+			"invalid_request_error",
+			`Model ${parsed.modelId} does not support image generation`,
+		);
+	}
+
+	const client = resolveClientIdentity(req.headers);
+	const sessionId = deterministicUuid(`images\u0000${model.provider}/${model.id}`);
+	const apiKey = await resolveGatewayApiKey(bootOpts.storage, model, sessionId, controller.signal, peer);
+	if (controller.signal.aborted) return aborted();
+	if (typeof apiKey !== "string") return imagesServer.formatError(apiKey.status, apiKey.type, apiKey.message);
+
+	logger.info("auth-gateway request", {
+		requestId,
+		format: "images",
+		model: parsed.modelId,
+		resolvedProvider: model.provider,
+		resolvedModel: model.id,
+		stream: false,
+		peer,
+	});
+
+	try {
+		const result = await generateImage(model, parsed.request, {
+			apiKey: buildGatewayApiKeyResolver(
+				bootOpts.storage,
+				model,
+				sessionId,
+				apiKey,
+				controller.signal,
+				"images",
+				peer,
+			),
+			fetch: bootOpts.fetch,
+			signal: controller.signal,
+		});
+		if (result.usage.cost.total === 0) calculateCost(model, result.usage);
+		recordGatewayUsage(bootOpts.storage, model, client, result.usage);
+		return json(
+			200,
+			imagesServer.encodeResponse(result, parsed.modelId),
+			gatewayResponseHeaders(model, { requestId, costUsd: result.usage.cost.total, startedAt }),
+		);
+	} catch (error) {
+		if (controller.signal.aborted) return aborted();
+		const classified = classifyGatewayError(error);
+		logger.warn("auth-gateway image generation failed", { format: "images", error: classified.message, peer });
+		return imagesServer.formatError(classified.status, classified.type, classified.message);
+	}
+}
+
+export function handleImageGenerations(
+	bootOpts: AuthGatewayBootOptions,
+	req: Request,
+	peer: string,
+): Promise<Response> {
+	return handleImages(bootOpts, req, peer, "generations");
+}
+
+export function handleImageEdits(bootOpts: AuthGatewayBootOptions, req: Request, peer: string): Promise<Response> {
+	return handleImages(bootOpts, req, peer, "edits");
+}

package/src/auth-gateway/routes/rerank.ts

@@ -0,0 +1,87 @@
+import { logger } from "@oh-my-pi/pi-utils";
+import { classifyGatewayError } from "../../error/gateway";
+import * as rerankWire from "../../providers/rerank-server";
+import { rerank } from "../../rerank";
+import { deterministicUuid } from "../../utils/deterministic-id";
+import {
+	type AuthGatewayBootOptions,
+	buildGatewayApiKeyResolver,
+	mirrorRequestAbort,
+	recordGatewayUsage,
+	resolveGatewayApiKey,
+} from "../dispatch";
+import { gatewayResponseHeaders, json, resolveClientIdentity } from "../http";
+
+/** OpenRouter-compatible `POST /v1/rerank` gateway handler. */
+export async function handleRerank(bootOpts: AuthGatewayBootOptions, req: Request, peer: string): Promise<Response> {
+	const startedAt = performance.now();
+	const requestId = crypto.randomUUID();
+	const controller = mirrorRequestAbort(req);
+	const aborted = (): Response => rerankWire.formatError(499, "request_aborted", "client closed request");
+	if (controller.signal.aborted) return aborted();
+
+	let parsed: rerankWire.RerankParsedRequest;
+	try {
+		parsed = await rerankWire.parseRequest(req);
+	} catch (error) {
+		if (controller.signal.aborted) return aborted();
+		const message = error instanceof Error ? error.message : String(error);
+		const status = error instanceof rerankWire.RerankWireError ? error.status : 400;
+		return rerankWire.formatError(status, "invalid_request_error", message);
+	}
+	if (controller.signal.aborted) return aborted();
+
+	const model = bootOpts.resolveModel(parsed.modelId);
+	if (!model) return rerankWire.formatError(404, "invalid_request_error", `Unknown model: ${parsed.modelId}`);
+	if (model.api !== "openrouter-rerank") {
+		return rerankWire.formatError(400, "invalid_request_error", `Model ${parsed.modelId} does not support reranking`);
+	}
+
+	const client = resolveClientIdentity(req.headers);
+	const sessionId = deterministicUuid(`rerank\u0000${model.provider}/${model.id}`);
+	const apiKey = await resolveGatewayApiKey(bootOpts.storage, model, sessionId, controller.signal, peer);
+	if (controller.signal.aborted) return aborted();
+	if (typeof apiKey !== "string") return rerankWire.formatError(apiKey.status, apiKey.type, apiKey.message);
+
+	logger.info("auth-gateway request", {
+		requestId,
+		format: "rerank",
+		model: parsed.modelId,
+		resolvedProvider: model.provider,
+		resolvedModel: model.id,
+		stream: false,
+		peer,
+	});
+
+	try {
+		const result = await rerank(model, parsed.request, {
+			apiKey: buildGatewayApiKeyResolver(
+				bootOpts.storage,
+				model,
+				sessionId,
+				apiKey,
+				controller.signal,
+				"rerank",
+				peer,
+			),
+			fetch: bootOpts.fetch,
+			signal: controller.signal,
+		});
+		recordGatewayUsage(bootOpts.storage, model, client, result.usage);
+		return json(
+			200,
+			rerankWire.encodeResponse(
+				result,
+				parsed.modelId,
+				parsed.originalDocuments,
+				parsed.request.returnDocuments ?? false,
+			),
+			gatewayResponseHeaders(model, { requestId, costUsd: result.usage.cost.total, startedAt }),
+		);
+	} catch (error) {
+		if (controller.signal.aborted) return aborted();
+		const classified = classifyGatewayError(error);
+		logger.warn("auth-gateway rerank failed", { format: "rerank", error: classified.message, peer });
+		return rerankWire.formatError(classified.status, classified.type, classified.message);
+	}
+}

package/src/auth-gateway/routes/speech.ts

@@ -0,0 +1,101 @@
+import { logger } from "@oh-my-pi/pi-utils";
+import { classifyGatewayError } from "../../error/gateway";
+import * as speechWire from "../../providers/speech-server";
+import { isSpeechApi, synthesizeSpeech } from "../../speech";
+import { deterministicUuid } from "../../utils/deterministic-id";
+import {
+	type AuthGatewayBootOptions,
+	buildGatewayApiKeyResolver,
+	mirrorRequestAbort,
+	recordGatewayUsage,
+	resolveGatewayApiKey,
+} from "../dispatch";
+import { gatewayResponseHeaders, resolveClientIdentity } from "../http";
+
+export async function handleSpeech(bootOpts: AuthGatewayBootOptions, req: Request, peer: string): Promise<Response> {
+	const startedAt = performance.now();
+	const requestId = crypto.randomUUID();
+	const controller = mirrorRequestAbort(req);
+	const aborted = (): Response => speechWire.formatError(499, "request_aborted", "client closed request");
+	if (controller.signal.aborted) return aborted();
+
+	let body: unknown;
+	try {
+		body = await req.json();
+	} catch (error) {
+		if (controller.signal.aborted) return aborted();
+		return speechWire.formatError(400, "invalid_request_error", `Invalid JSON body: ${String(error)}`);
+	}
+	if (controller.signal.aborted) return aborted();
+
+	let parsed: speechWire.SpeechParsedRequest;
+	try {
+		parsed = speechWire.parseRequest(body, req.headers);
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		return speechWire.formatError(400, "invalid_request_error", message);
+	}
+
+	const model = bootOpts.resolveModel(parsed.modelId);
+	if (!model) return speechWire.formatError(404, "invalid_request_error", `Unknown model: ${parsed.modelId}`);
+	if (!isSpeechApi(model.api)) {
+		const route =
+			model.kind === "image"
+				? "/v1/images/generations"
+				: model.kind === "stt"
+					? "/v1/audio/transcriptions"
+					: model.kind === "judge"
+						? "/v1/systemone"
+						: undefined;
+		const message = route
+			? `Model ${parsed.modelId} does not synthesize speech; use POST ${route}`
+			: `Model ${parsed.modelId} does not synthesize speech`;
+		return speechWire.formatError(400, "invalid_request_error", message);
+	}
+
+	const client = resolveClientIdentity(req.headers);
+	const sessionId = deterministicUuid(`speech\u0000${model.provider}/${model.id}`);
+	const apiKey = await resolveGatewayApiKey(bootOpts.storage, model, sessionId, controller.signal, peer);
+	if (controller.signal.aborted) return aborted();
+	if (typeof apiKey !== "string") return speechWire.formatError(apiKey.status, apiKey.type, apiKey.message);
+
+	logger.info("auth-gateway request", {
+		requestId,
+		format: "speech",
+		model: parsed.modelId,
+		resolvedProvider: model.provider,
+		resolvedModel: model.id,
+		stream: false,
+		peer,
+	});
+
+	try {
+		const result = await synthesizeSpeech(model, parsed.request, {
+			apiKey: buildGatewayApiKeyResolver(
+				bootOpts.storage,
+				model,
+				sessionId,
+				apiKey,
+				controller.signal,
+				"speech",
+				peer,
+			),
+			fetch: bootOpts.fetch,
+			signal: controller.signal,
+		});
+		recordGatewayUsage(bootOpts.storage, model, client, result.usage);
+		const response = speechWire.encodeResponse(result, parsed.modelId);
+		const responseHeaders = gatewayResponseHeaders(model, {
+			requestId,
+			costUsd: result.usage.cost.total,
+			startedAt,
+		});
+		for (const name in responseHeaders) response.headers.set(name, responseHeaders[name]);
+		return response;
+	} catch (error) {
+		if (controller.signal.aborted) return aborted();
+		const classified = classifyGatewayError(error);
+		logger.warn("auth-gateway speech failed", { format: "speech", error: classified.message, peer });
+		return speechWire.formatError(classified.status, classified.type, classified.message);
+	}
+}

package/src/auth-gateway/routes/systemone.ts

@@ -0,0 +1,116 @@
+/**
+ * TypeSafe System One judgments: `POST /v1/systemone` (TypeSafe's path) and
+ * `POST /alpha/decisions` (OpenRouter's Decisions path, same wire).
+ *
+ * Same bearer auth, model resolution, broker credential lookup, and a/b/c
+ * credential rotation as the chat routes, dispatched through
+ * {@link TypeSafeJudge} — pi-ai's client for this wire — so 401 rotation and
+ * 429/529 backoff match omp's own judgments. A judgment is one JSON
+ * round-trip: no stream, no provider session state. TypeSafe reports tokens
+ * only, so the cost is priced from the catalog model for the response header
+ * and the broker's observed-usage ledger.
+ */
+import { calculateCost } from "@oh-my-pi/pi-catalog/models";
+import { logger } from "@oh-my-pi/pi-utils";
+import { classifyGatewayError } from "../../error/gateway";
+import { isJudgmentApi, TypeSafeJudge } from "../../judgment/typesafe";
+import * as systemOne from "../../providers/systemone-server";
+import { deterministicUuid } from "../../utils/deterministic-id";
+import {
+	type AuthGatewayBootOptions,
+	buildGatewayApiKeyResolver,
+	mirrorRequestAbort,
+	recordGatewayUsage,
+	resolveGatewayApiKey,
+} from "../dispatch";
+import { gatewayResponseHeaders, json, resolveClientIdentity } from "../http";
+
+export async function handleSystemOne(bootOpts: AuthGatewayBootOptions, req: Request, peer: string): Promise<Response> {
+	const startedAt = performance.now();
+	const requestId = crypto.randomUUID();
+	const controller = mirrorRequestAbort(req);
+	const aborted = (): Response => systemOne.formatError(499, "request_aborted", "client closed request");
+	if (controller.signal.aborted) return aborted();
+
+	let body: unknown;
+	try {
+		body = await req.json();
+	} catch (error) {
+		if (controller.signal.aborted) return aborted();
+		return systemOne.formatError(400, "invalid_request_error", `Invalid JSON body: ${String(error)}`);
+	}
+	if (controller.signal.aborted) return aborted();
+
+	let parsed: systemOne.SystemOneParsedRequest;
+	try {
+		parsed = systemOne.parseRequest(body);
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		// TypeSafe answers body validation failures with 422.
+		return systemOne.formatError(422, "invalid_request_error", message);
+	}
+
+	const model = bootOpts.resolveModel(parsed.modelId);
+	if (!model) {
+		return systemOne.formatError(404, "invalid_request_error", `Unknown model: ${parsed.modelId}`);
+	}
+	if (!isJudgmentApi(model.api)) {
+		return systemOne.formatError(
+			422,
+			"invalid_request_error",
+			`Model ${parsed.modelId} does not answer System One judgments`,
+		);
+	}
+	const client = resolveClientIdentity(req.headers);
+	// Judgments carry no conversation to derive a session from. One sticky
+	// session per model keeps credential selection stable across calls and
+	// still lets `markUsageLimitReached` hand off to a sibling account.
+	const sessionId = deterministicUuid(`systemone\u0000${model.provider}/${model.id}`);
+
+	const apiKey = await resolveGatewayApiKey(bootOpts.storage, model, sessionId, controller.signal, peer);
+	if (controller.signal.aborted) return aborted();
+	if (typeof apiKey !== "string") return systemOne.formatError(apiKey.status, apiKey.type, apiKey.message);
+
+	const judge = new TypeSafeJudge({
+		apiKey: buildGatewayApiKeyResolver(
+			bootOpts.storage,
+			model,
+			sessionId,
+			apiKey,
+			controller.signal,
+			"systemone",
+			peer,
+		),
+		api: model.api,
+		provider: model.provider,
+		model: model.id,
+		baseUrl: model.baseUrl,
+		fetch: bootOpts.fetch,
+	});
+
+	logger.info("auth-gateway request", {
+		requestId,
+		format: "systemone",
+		model: parsed.modelId,
+		resolvedProvider: model.provider,
+		resolvedModel: model.id,
+		stream: false,
+		peer,
+	});
+
+	try {
+		const result = await judge.judge(parsed.request, { signal: controller.signal });
+		// Encode before pricing: the body's `cost` means "upstream billed this"
+		// (OpenRouter), while the header and ledger carry the catalog estimate
+		// when the upstream reported tokens only (TypeSafe).
+		const body = systemOne.encodeResponse(result);
+		if (result.usage.cost.total === 0) calculateCost(model, result.usage);
+		recordGatewayUsage(bootOpts.storage, model, client, result.usage);
+		return json(200, body, gatewayResponseHeaders(model, { requestId, costUsd: result.usage.cost.total, startedAt }));
+	} catch (error) {
+		if (controller.signal.aborted) return aborted();
+		const classified = classifyGatewayError(error);
+		logger.warn("auth-gateway judgment failed", { format: "systemone", error: classified.message, peer });
+		return systemOne.formatError(classified.status, classified.type, classified.message);
+	}
+}

package/src/auth-gateway/routes/transcriptions.ts

@@ -0,0 +1,98 @@
+import { logger } from "@oh-my-pi/pi-utils";
+import { classifyGatewayError } from "../../error/gateway";
+import * as transcriptions from "../../providers/transcriptions-server";
+import { transcribeAudio } from "../../transcription";
+import { deterministicUuid } from "../../utils/deterministic-id";
+import {
+	type AuthGatewayBootOptions,
+	buildGatewayApiKeyResolver,
+	mirrorRequestAbort,
+	recordGatewayUsage,
+	resolveGatewayApiKey,
+} from "../dispatch";
+import { gatewayResponseHeaders, json, resolveClientIdentity } from "../http";
+
+/** OpenAI-compatible `POST /v1/audio/transcriptions` gateway handler. */
+export async function handleTranscriptions(
+	bootOpts: AuthGatewayBootOptions,
+	req: Request,
+	peer: string,
+): Promise<Response> {
+	const startedAt = performance.now();
+	const requestId = crypto.randomUUID();
+	const controller = mirrorRequestAbort(req);
+	const aborted = (): Response => transcriptions.formatError(499, "request_aborted", "client closed request");
+	if (controller.signal.aborted) return aborted();
+
+	let parsed: transcriptions.TranscriptionParsedRequest;
+	try {
+		parsed = await transcriptions.parseRequest(req);
+	} catch (error) {
+		if (controller.signal.aborted) return aborted();
+		const message = error instanceof Error ? error.message : String(error);
+		const status = error instanceof transcriptions.TranscriptionWireError ? error.status : 400;
+		return transcriptions.formatError(status, "invalid_request_error", message);
+	}
+	if (controller.signal.aborted) return aborted();
+
+	const model = bootOpts.resolveModel(parsed.modelId);
+	if (!model) {
+		return transcriptions.formatError(404, "invalid_request_error", `Unknown model: ${parsed.modelId}`);
+	}
+	if (model.api !== "openai-transcriptions") {
+		const detail =
+			model.api === "local-inference"
+				? `Model ${parsed.modelId} runs on-device only and cannot be served by the auth gateway`
+				: `Model ${parsed.modelId} does not support audio transcription`;
+		return transcriptions.formatError(400, "invalid_request_error", detail);
+	}
+
+	const client = resolveClientIdentity(req.headers);
+	const sessionId = deterministicUuid(`transcriptions\u0000${model.provider}/${model.id}`);
+	const apiKey = await resolveGatewayApiKey(bootOpts.storage, model, sessionId, controller.signal, peer);
+	if (controller.signal.aborted) return aborted();
+	if (typeof apiKey !== "string") {
+		return transcriptions.formatError(apiKey.status, apiKey.type, apiKey.message);
+	}
+
+	logger.info("auth-gateway request", {
+		requestId,
+		format: "transcriptions",
+		model: parsed.modelId,
+		resolvedProvider: model.provider,
+		resolvedModel: model.id,
+		stream: false,
+		peer,
+	});
+
+	try {
+		const result = await transcribeAudio(model, parsed.request, {
+			apiKey: buildGatewayApiKeyResolver(
+				bootOpts.storage,
+				model,
+				sessionId,
+				apiKey,
+				controller.signal,
+				"transcriptions",
+				peer,
+			),
+			fetch: bootOpts.fetch,
+			signal: controller.signal,
+		});
+		recordGatewayUsage(bootOpts.storage, model, client, result.usage);
+		return json(
+			200,
+			transcriptions.encodeResponse(result),
+			gatewayResponseHeaders(model, { requestId, costUsd: result.usage.cost.total, startedAt }),
+		);
+	} catch (error) {
+		if (controller.signal.aborted) return aborted();
+		const classified = classifyGatewayError(error);
+		logger.warn("auth-gateway transcription failed", {
+			format: "transcriptions",
+			error: classified.message,
+			peer,
+		});
+		return transcriptions.formatError(classified.status, classified.type, classified.message);
+	}
+}