@oh-my-pi/pi-ai 18.2.7 → 18.2.9

package/src/auth-gateway/dispatch.ts

@@ -0,0 +1,273 @@
+/**
+ * Per-request plumbing shared by every auth-gateway route.
+ *
+ * A route module (`server.ts` chat/pi-native handlers, `routes/*.ts` for
+ * judgments, images, speech, transcription, …) owns only its wire format:
+ * parse the body, pick a model, call the pi-ai client, encode the reply.
+ * Everything credential-shaped lives here so each route drives the same
+ * broker-backed rotation policy and the same usage ledger.
+ */
+import { extractHttpStatusFromError, logger } from "@oh-my-pi/pi-utils";
+import type { ApiKeyResolver } from "../auth-retry";
+import type { AuthStorage } from "../auth-storage";
+import * as AIError from "../error";
+import { classifyGatewayError, type GatewayErrorClassification } from "../error/gateway";
+import { isUsageLimitOutcome } from "../error/rate-limit";
+import type { Api, FetchImpl, Model, Usage } from "../types";
+import type { ClientUsageIdentity } from "../usage";
+import { extractProviderRetryHint } from "../utils/retry-after";
+import type { AuthGatewayServerOptions } from "./types";
+
+export type ModelResolver = (modelId: string) => Model<Api> | undefined;
+
+export interface AuthGatewayBootOptions extends AuthGatewayServerOptions {
+	/** Source of credentials. Caller wires this to a broker-backed AuthStorage. */
+	storage: AuthStorage;
+	/**
+	 * Resolve a client-requested model id to a pi-ai Model. Caller supplies
+	 * this from a ModelRegistry (lives in `coding-agent` to avoid an inverse
+	 * dependency in `pi-ai`).
+	 */
+	resolveModel: ModelResolver;
+	/** Optional supplier for `/v1/models` listing. Returns the full model array. */
+	listModels?: () => Iterable<Model<Api>>;
+	/** Upstream transport for every provider call; defaults to global `fetch`. Test seam. */
+	fetch?: FetchImpl;
+}
+
+/**
+ * The client's own session key, or `undefined` when it sent none. A blank key
+ * counts as none: honouring it would collapse every caller that sends an empty
+ * key into one shared credential-sticky, prefix-cache and provider-session
+ * bucket.
+ */
+export function normalizeClientSessionKey(clientKey: string | undefined): string | undefined {
+	return clientKey !== undefined && clientKey.trim().length > 0 ? clientKey : undefined;
+}
+
+/**
+ * Stable identity of the account a request's credential belongs to.
+ *
+ * `markUsageLimitReached` and the auth-retry resolver switch a session to a
+ * sibling credential, so the provider state retained for that session can
+ * outlive the account that taught it. OAuth rows expose an account id / email
+ * that survives token refresh — fingerprinting the bearer instead would look
+ * like a rotation every time a token refreshes and discard the retained
+ * lessons for nothing. Key-based rows fall back to a hash of the key, never
+ * the key itself: this value is held for the lifetime of the entry.
+ */
+export function resolveGatewayAccount(
+	storage: AuthStorage,
+	provider: string,
+	sessionId: string,
+	apiKey: string,
+): string {
+	const identity = storage.getOAuthAccountIdentity(provider, sessionId);
+	if (identity) {
+		return `oauth:${JSON.stringify([
+			identity.accountId ?? "",
+			identity.email ?? "",
+			identity.projectId ?? "",
+			identity.orgId ?? "",
+		])}`;
+	}
+	return `key:${Bun.hash(apiKey).toString(36)}`;
+}
+
+/**
+ * Resolve the credential for one request from broker-backed storage.
+ *
+ * pi-ai clients never consult `AuthStorage`; the gateway resolves the bearer
+ * (an OAuth access token refreshed through the broker when needed) and hands
+ * it to the client. Returns the key, or the error classification the route
+ * should encode in its own envelope: storage failures map through
+ * {@link classifyGatewayError}, a provider without any credential is a 401.
+ */
+export async function resolveGatewayApiKey(
+	storage: AuthStorage,
+	model: Model<Api>,
+	sessionId: string,
+	signal: AbortSignal,
+	peer: string,
+): Promise<string | GatewayErrorClassification> {
+	let apiKey: string | undefined;
+	try {
+		apiKey = await storage.getApiKey(model.provider, sessionId, { modelId: model.id, signal });
+	} catch (error) {
+		const classified = classifyGatewayError(error);
+		logger.warn("auth-gateway getApiKey threw", { provider: model.provider, peer, error: classified.message });
+		return classified;
+	}
+	if (apiKey) return apiKey;
+	return {
+		status: 401,
+		type: "authentication_error",
+		message: `No credential available for provider ${model.provider}`,
+	};
+}
+
+/**
+ * Hook fired by a pi-ai client when the upstream request fails in a way
+ * that's rotatable — today that's HTTP 401 (credential is bad) and
+ * usage-limit phrasing matched by {@link isUsageLimitError} (Codex's
+ * `usage_limit_reached`, Anthropic's `usage_limit_reached`, Google's
+ * `resource_exhausted`, …). The two cases need different storage actions:
+ *
+ * - **usage-limit** → {@link AuthStorage.markUsageLimitReached}. Marks just
+ *   the current session's credential as temporarily blocked (honouring
+ *   `retry-after` / `resets_at` hints when present) and returns `true` only
+ *   when a sibling credential is still available. Burning the credential
+ *   with `invalidateCredentialMatching` here would orphan accounts whose
+ *   reset window is several hours away — exactly the bug this helper exists
+ *   to avoid.
+ * - **auth-failure** → {@link AuthStorage.invalidateCredentialMatching}.
+ *   Suspect/delete the row so it doesn't get re-picked next request.
+ *
+ * In both branches we return the next `getApiKey` result (sticky on the
+ * same `sessionId`) so the client can transparently retry the pre-emit
+ * failure with a fresh credential. Returning `undefined` aborts the retry
+ * and surfaces the original error to the caller.
+ */
+async function refreshGatewayApiKeyAfterAuthError(
+	storage: AuthStorage,
+	model: Model<Api>,
+	sessionId: string,
+	provider: string,
+	oldKey: string,
+	error: unknown,
+	signal: AbortSignal,
+	format: string,
+	peer: string,
+): Promise<string | undefined> {
+	const message = error instanceof Error ? error.message : String(error);
+	const status = extractHttpStatusFromError(error);
+	if (AIError.isUsageLimit(error) || isUsageLimitOutcome(status, message)) {
+		const retryAfterMs = extractProviderRetryHint(provider, message);
+		const { switched, retryAtMs } = await storage.markUsageLimitReached(provider, sessionId, {
+			retryAfterMs,
+			providerTimed: retryAfterMs !== undefined,
+			baseUrl: model.baseUrl,
+			modelId: model.id,
+			apiKey: oldKey,
+			signal,
+		});
+		logger.debug("auth-gateway retrying provider request after usage-limit block", {
+			format,
+			provider,
+			peer,
+			switched,
+			retryAfterMs,
+			retryAtMs,
+			error: message,
+		});
+		if (!switched) return undefined;
+		return storage.getApiKey(provider, sessionId, { modelId: model.id, signal });
+	}
+	await storage.invalidateCredentialMatching(provider, oldKey, { sessionId, signal });
+	logger.debug("auth-gateway retrying provider request after credential invalidation", {
+		format,
+		provider,
+		peer,
+		error: message,
+	});
+	return storage.getApiKey(provider, sessionId, { modelId: model.id, signal });
+}
+
+/**
+ * Build the {@link ApiKeyResolver} handed to a pi-ai client for a gateway
+ * request. Drives the central a/b/c auth-retry policy server-side:
+ *
+ * - initial resolve → the credential already resolved for this request.
+ * - step (b) `!lastChance` → force-refresh the SAME session-sticky credential
+ *   (a peer/broker may have rotated its token out from under our cached copy).
+ * - step (c) `lastChance` → {@link refreshGatewayApiKeyAfterAuthError} switches
+ *   to a sibling (usage-limit block vs credential invalidation by error class).
+ *
+ * `lastKey` tracks the most recent bearer so the switch step invalidates the
+ * credential that actually failed. `onResolvedKey` observes every rotation;
+ * routes that retain provider session state use it to re-key the account
+ * lease, one-shot routes pass `undefined`.
+ */
+export function buildGatewayApiKeyResolver(
+	storage: AuthStorage,
+	model: Model<Api>,
+	sessionId: string,
+	initialKey: string,
+	requestSignal: AbortSignal,
+	format: string,
+	peer: string,
+	onResolvedKey?: (apiKey: string) => void,
+): ApiKeyResolver {
+	let lastKey = initialKey;
+	return async ({ lastChance, error, signal }) => {
+		const sig = signal ?? requestSignal;
+		if (error === undefined) {
+			lastKey = initialKey;
+			return initialKey;
+		}
+		if (!lastChance) {
+			const refreshed = await storage.getApiKey(model.provider, sessionId, {
+				modelId: model.id,
+				signal: sig,
+				forceRefresh: true,
+			});
+			lastKey = refreshed ?? lastKey;
+			if (refreshed) onResolvedKey?.(refreshed);
+			return refreshed;
+		}
+		const next = await refreshGatewayApiKeyAfterAuthError(
+			storage,
+			model,
+			sessionId,
+			model.provider,
+			lastKey,
+			error,
+			sig,
+			format,
+			peer,
+		);
+		lastKey = next ?? lastKey;
+		if (next) onResolvedKey?.(next);
+		return next;
+	};
+}
+
+/**
+ * Attribute one settled upstream request to the originating client via the
+ * broker's observed-usage channel (`AuthStorage.recordObservedUsage`, batched
+ * by the remote store). Error/aborted turns still record — the provider
+ * billed whatever tokens the partial turn consumed; zero-usage results
+ * (pre-flight failures) are skipped. `at` defaults to now.
+ */
+export function recordGatewayUsage(
+	storage: AuthStorage,
+	model: Model<Api>,
+	client: ClientUsageIdentity,
+	usage: Usage,
+	at?: number,
+): void {
+	if (usage.input + usage.output + usage.cacheRead + usage.cacheWrite === 0) return;
+	storage.recordObservedUsage({
+		provider: model.provider,
+		model: model.id,
+		at,
+		usage: { input: usage.input, output: usage.output, cacheRead: usage.cacheRead, cacheWrite: usage.cacheWrite },
+		costUsd: usage.cost.total,
+		client,
+	});
+}
+
+/**
+ * An `AbortController` that follows the inbound request's abort signal. Routes
+ * abort it themselves when the response body is cancelled mid-stream, which
+ * `req.signal` alone does not observe.
+ */
+export function mirrorRequestAbort(req: Request): AbortController {
+	const controller = new AbortController();
+	if (req.signal.aborted) {
+		controller.abort(req.signal.reason);
+	} else {
+		req.signal.addEventListener("abort", () => controller.abort(req.signal.reason), { once: true });
+	}
+	return controller;
+}

package/src/auth-gateway/http.ts

@@ -7,7 +7,7 @@
 import { timingSafeEqual as nodeTimingSafeEqual } from "node:crypto";
 import * as os from "node:os";
 import { getInstallId } from "@oh-my-pi/pi-utils";
-import type { Api, AssistantMessage, Model } from "../types";
+import type { Api, Model } from "../types";
 import type { ClientUsageIdentity } from "../usage";
 
 const JSON_HEADERS = {
@@ -28,14 +28,13 @@ export function json(status: number, body: unknown, headers?: Record<string, str
  * `request-id` (surfaced as `_request_id` by the OpenAI and Anthropic SDKs,
  * matches the gateway log line), LiteLLM's model-resolution and cost headers,
  * and OpenAI's `openai-processing-ms`. Model/request-id headers are always
- * present; `message` — the final assistant message, available only on
- * non-streaming responses — adds the computed cost, and `startedAt` the wall
- * time. Streaming responses send headers before usage exists, so they carry
- * only the identity headers.
+ * present; `costUsd` — known only once a non-streaming response has settled —
+ * adds the computed cost, and `startedAt` the wall time. Streaming responses
+ * send headers before usage exists, so they carry only the identity headers.
  */
 export function gatewayResponseHeaders(
 	model: Model<Api>,
-	info: { requestId: string; message?: AssistantMessage; startedAt?: number },
+	info: { requestId: string; costUsd?: number; startedAt?: number },
 ): Record<string, string> {
 	const headers: Record<string, string> = {
 		"x-request-id": info.requestId,
@@ -43,7 +42,7 @@ export function gatewayResponseHeaders(
 		"x-litellm-model-id": model.id,
 	};
 	if (model.baseUrl) headers["x-litellm-model-api-base"] = model.baseUrl;
-	if (info.message) headers["x-litellm-response-cost"] = info.message.usage.cost.total.toString();
+	if (info.costUsd !== undefined) headers["x-litellm-response-cost"] = info.costUsd.toString();
 	if (info.startedAt !== undefined) {
 		const elapsed = (performance.now() - info.startedAt).toFixed(0);
 		headers["x-litellm-response-duration-ms"] = elapsed;

package/src/auth-gateway/index.ts

@@ -1,3 +1,4 @@
+export * from "./dispatch";
 export * from "./http";
 export * from "./session-state";
 export * from "./server";

package/src/auth-gateway/routes/embeddings.ts

@@ -0,0 +1,98 @@
+import { logger } from "@oh-my-pi/pi-utils";
+import { embed } from "../../embeddings";
+import { classifyGatewayError } from "../../error/gateway";
+import * as embeddings from "../../providers/embeddings-server";
+import { deterministicUuid } from "../../utils/deterministic-id";
+import {
+	type AuthGatewayBootOptions,
+	buildGatewayApiKeyResolver,
+	mirrorRequestAbort,
+	recordGatewayUsage,
+	resolveGatewayApiKey,
+} from "../dispatch";
+import { gatewayResponseHeaders, json, resolveClientIdentity } from "../http";
+
+/** OpenAI-compatible `POST /v1/embeddings` gateway handler. */
+export async function handleEmbeddings(
+	bootOpts: AuthGatewayBootOptions,
+	req: Request,
+	peer: string,
+): Promise<Response> {
+	const startedAt = performance.now();
+	const requestId = crypto.randomUUID();
+	const controller = mirrorRequestAbort(req);
+	const aborted = (): Response => embeddings.formatError(499, "request_aborted", "client closed request");
+	if (controller.signal.aborted) return aborted();
+
+	let parsed: embeddings.EmbeddingsParsedRequest;
+	try {
+		parsed = await embeddings.parseRequest(req);
+	} catch (error) {
+		if (controller.signal.aborted) return aborted();
+		const message = error instanceof Error ? error.message : String(error);
+		const status = error instanceof embeddings.EmbeddingsWireError ? error.status : 400;
+		return embeddings.formatError(status, "invalid_request_error", message);
+	}
+	if (controller.signal.aborted) return aborted();
+
+	const model = bootOpts.resolveModel(parsed.modelId);
+	if (!model) {
+		return embeddings.formatError(404, "invalid_request_error", `Unknown model: ${parsed.modelId}`);
+	}
+	if (model.api !== "openai-embeddings") {
+		return embeddings.formatError(
+			400,
+			"invalid_request_error",
+			`Model ${parsed.modelId} does not support embeddings`,
+		);
+	}
+
+	const client = resolveClientIdentity(req.headers);
+	const sessionId = deterministicUuid(`embeddings\u0000${model.provider}/${model.id}`);
+	const apiKey = await resolveGatewayApiKey(bootOpts.storage, model, sessionId, controller.signal, peer);
+	if (controller.signal.aborted) return aborted();
+	if (typeof apiKey !== "string") {
+		return embeddings.formatError(apiKey.status, apiKey.type, apiKey.message);
+	}
+
+	logger.info("auth-gateway request", {
+		requestId,
+		format: "embeddings",
+		model: parsed.modelId,
+		resolvedProvider: model.provider,
+		resolvedModel: model.id,
+		stream: false,
+		peer,
+	});
+
+	try {
+		const result = await embed(model, parsed.request, {
+			apiKey: buildGatewayApiKeyResolver(
+				bootOpts.storage,
+				model,
+				sessionId,
+				apiKey,
+				controller.signal,
+				"embeddings",
+				peer,
+			),
+			fetch: bootOpts.fetch,
+			signal: controller.signal,
+		});
+		recordGatewayUsage(bootOpts.storage, model, client, result.usage);
+		return json(
+			200,
+			embeddings.encodeResponse(result, parsed.modelId),
+			gatewayResponseHeaders(model, { requestId, costUsd: result.usage.cost.total, startedAt }),
+		);
+	} catch (error) {
+		if (controller.signal.aborted) return aborted();
+		const classified = classifyGatewayError(error);
+		logger.warn("auth-gateway embeddings failed", {
+			format: "embeddings",
+			error: classified.message,
+			peer,
+		});
+		return embeddings.formatError(classified.status, classified.type, classified.message);
+	}
+}

package/src/auth-gateway/routes/images.ts

@@ -0,0 +1,131 @@
+import { calculateCost } from "@oh-my-pi/pi-catalog/models";
+import { logger } from "@oh-my-pi/pi-utils";
+import { classifyGatewayError } from "../../error/gateway";
+import { generateImage } from "../../images";
+import * as imagesServer from "../../providers/images-server";
+import { deterministicUuid } from "../../utils/deterministic-id";
+import {
+	type AuthGatewayBootOptions,
+	buildGatewayApiKeyResolver,
+	mirrorRequestAbort,
+	recordGatewayUsage,
+	resolveGatewayApiKey,
+} from "../dispatch";
+import { gatewayResponseHeaders, json, resolveClientIdentity } from "../http";
+
+function isGatewayImageApi(api: string): boolean {
+	return (
+		api === "openai-images" ||
+		api === "openrouter-images" ||
+		api === "google-generative-ai" ||
+		api === "google-gemini-cli"
+	);
+}
+
+async function handleImages(
+	bootOpts: AuthGatewayBootOptions,
+	req: Request,
+	peer: string,
+	kind: imagesServer.ImageRequestKind,
+): Promise<Response> {
+	const startedAt = performance.now();
+	const requestId = crypto.randomUUID();
+	const controller = mirrorRequestAbort(req);
+	const aborted = (): Response => imagesServer.formatError(499, "request_aborted", "client closed request");
+	if (controller.signal.aborted) return aborted();
+
+	let body: unknown | FormData;
+	try {
+		body =
+			kind === "edits" && req.headers.get("content-type")?.includes("multipart/form-data")
+				? await req.formData()
+				: await req.json();
+	} catch (error) {
+		if (controller.signal.aborted) return aborted();
+		return imagesServer.formatError(400, "invalid_request_error", `Invalid request body: ${String(error)}`);
+	}
+	if (controller.signal.aborted) return aborted();
+
+	let parsed: imagesServer.ImagesParsedRequest;
+	try {
+		parsed = await imagesServer.parseRequest(body, kind);
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		return imagesServer.formatError(400, "invalid_request_error", message);
+	}
+
+	const model = bootOpts.resolveModel(parsed.modelId);
+	if (!model) {
+		return imagesServer.formatError(404, "invalid_request_error", `Unknown model: ${parsed.modelId}`);
+	}
+	if (model.api === "openai-responses" || model.api === "openai-codex-responses") {
+		return imagesServer.formatError(
+			400,
+			"invalid_request_error",
+			`Model ${parsed.modelId} requires a hosted image carrier, which the auth gateway cannot resolve`,
+		);
+	}
+	if (!isGatewayImageApi(model.api)) {
+		return imagesServer.formatError(
+			400,
+			"invalid_request_error",
+			`Model ${parsed.modelId} does not support image generation`,
+		);
+	}
+
+	const client = resolveClientIdentity(req.headers);
+	const sessionId = deterministicUuid(`images\u0000${model.provider}/${model.id}`);
+	const apiKey = await resolveGatewayApiKey(bootOpts.storage, model, sessionId, controller.signal, peer);
+	if (controller.signal.aborted) return aborted();
+	if (typeof apiKey !== "string") return imagesServer.formatError(apiKey.status, apiKey.type, apiKey.message);
+
+	logger.info("auth-gateway request", {
+		requestId,
+		format: "images",
+		model: parsed.modelId,
+		resolvedProvider: model.provider,
+		resolvedModel: model.id,
+		stream: false,
+		peer,
+	});
+
+	try {
+		const result = await generateImage(model, parsed.request, {
+			apiKey: buildGatewayApiKeyResolver(
+				bootOpts.storage,
+				model,
+				sessionId,
+				apiKey,
+				controller.signal,
+				"images",
+				peer,
+			),
+			fetch: bootOpts.fetch,
+			signal: controller.signal,
+		});
+		if (result.usage.cost.total === 0) calculateCost(model, result.usage);
+		recordGatewayUsage(bootOpts.storage, model, client, result.usage);
+		return json(
+			200,
+			imagesServer.encodeResponse(result, parsed.modelId),
+			gatewayResponseHeaders(model, { requestId, costUsd: result.usage.cost.total, startedAt }),
+		);
+	} catch (error) {
+		if (controller.signal.aborted) return aborted();
+		const classified = classifyGatewayError(error);
+		logger.warn("auth-gateway image generation failed", { format: "images", error: classified.message, peer });
+		return imagesServer.formatError(classified.status, classified.type, classified.message);
+	}
+}
+
+export function handleImageGenerations(
+	bootOpts: AuthGatewayBootOptions,
+	req: Request,
+	peer: string,
+): Promise<Response> {
+	return handleImages(bootOpts, req, peer, "generations");
+}
+
+export function handleImageEdits(bootOpts: AuthGatewayBootOptions, req: Request, peer: string): Promise<Response> {
+	return handleImages(bootOpts, req, peer, "edits");
+}

package/src/auth-gateway/routes/rerank.ts

@@ -0,0 +1,87 @@
+import { logger } from "@oh-my-pi/pi-utils";
+import { classifyGatewayError } from "../../error/gateway";
+import * as rerankWire from "../../providers/rerank-server";
+import { rerank } from "../../rerank";
+import { deterministicUuid } from "../../utils/deterministic-id";
+import {
+	type AuthGatewayBootOptions,
+	buildGatewayApiKeyResolver,
+	mirrorRequestAbort,
+	recordGatewayUsage,
+	resolveGatewayApiKey,
+} from "../dispatch";
+import { gatewayResponseHeaders, json, resolveClientIdentity } from "../http";
+
+/** OpenRouter-compatible `POST /v1/rerank` gateway handler. */
+export async function handleRerank(bootOpts: AuthGatewayBootOptions, req: Request, peer: string): Promise<Response> {
+	const startedAt = performance.now();
+	const requestId = crypto.randomUUID();
+	const controller = mirrorRequestAbort(req);
+	const aborted = (): Response => rerankWire.formatError(499, "request_aborted", "client closed request");
+	if (controller.signal.aborted) return aborted();
+
+	let parsed: rerankWire.RerankParsedRequest;
+	try {
+		parsed = await rerankWire.parseRequest(req);
+	} catch (error) {
+		if (controller.signal.aborted) return aborted();
+		const message = error instanceof Error ? error.message : String(error);
+		const status = error instanceof rerankWire.RerankWireError ? error.status : 400;
+		return rerankWire.formatError(status, "invalid_request_error", message);
+	}
+	if (controller.signal.aborted) return aborted();
+
+	const model = bootOpts.resolveModel(parsed.modelId);
+	if (!model) return rerankWire.formatError(404, "invalid_request_error", `Unknown model: ${parsed.modelId}`);
+	if (model.api !== "openrouter-rerank") {
+		return rerankWire.formatError(400, "invalid_request_error", `Model ${parsed.modelId} does not support reranking`);
+	}
+
+	const client = resolveClientIdentity(req.headers);
+	const sessionId = deterministicUuid(`rerank\u0000${model.provider}/${model.id}`);
+	const apiKey = await resolveGatewayApiKey(bootOpts.storage, model, sessionId, controller.signal, peer);
+	if (controller.signal.aborted) return aborted();
+	if (typeof apiKey !== "string") return rerankWire.formatError(apiKey.status, apiKey.type, apiKey.message);
+
+	logger.info("auth-gateway request", {
+		requestId,
+		format: "rerank",
+		model: parsed.modelId,
+		resolvedProvider: model.provider,
+		resolvedModel: model.id,
+		stream: false,
+		peer,
+	});
+
+	try {
+		const result = await rerank(model, parsed.request, {
+			apiKey: buildGatewayApiKeyResolver(
+				bootOpts.storage,
+				model,
+				sessionId,
+				apiKey,
+				controller.signal,
+				"rerank",
+				peer,
+			),
+			fetch: bootOpts.fetch,
+			signal: controller.signal,
+		});
+		recordGatewayUsage(bootOpts.storage, model, client, result.usage);
+		return json(
+			200,
+			rerankWire.encodeResponse(
+				result,
+				parsed.modelId,
+				parsed.originalDocuments,
+				parsed.request.returnDocuments ?? false,
+			),
+			gatewayResponseHeaders(model, { requestId, costUsd: result.usage.cost.total, startedAt }),
+		);
+	} catch (error) {
+		if (controller.signal.aborted) return aborted();
+		const classified = classifyGatewayError(error);
+		logger.warn("auth-gateway rerank failed", { format: "rerank", error: classified.message, peer });
+		return rerankWire.formatError(classified.status, classified.type, classified.message);
+	}
+}