@oh-my-pi/pi-ai 18.2.7 → 18.2.9

package/src/auth-gateway/routes/speech.ts

@@ -0,0 +1,101 @@
+import { logger } from "@oh-my-pi/pi-utils";
+import { classifyGatewayError } from "../../error/gateway";
+import * as speechWire from "../../providers/speech-server";
+import { isSpeechApi, synthesizeSpeech } from "../../speech";
+import { deterministicUuid } from "../../utils/deterministic-id";
+import {
+	type AuthGatewayBootOptions,
+	buildGatewayApiKeyResolver,
+	mirrorRequestAbort,
+	recordGatewayUsage,
+	resolveGatewayApiKey,
+} from "../dispatch";
+import { gatewayResponseHeaders, resolveClientIdentity } from "../http";
+
+export async function handleSpeech(bootOpts: AuthGatewayBootOptions, req: Request, peer: string): Promise<Response> {
+	const startedAt = performance.now();
+	const requestId = crypto.randomUUID();
+	const controller = mirrorRequestAbort(req);
+	const aborted = (): Response => speechWire.formatError(499, "request_aborted", "client closed request");
+	if (controller.signal.aborted) return aborted();
+
+	let body: unknown;
+	try {
+		body = await req.json();
+	} catch (error) {
+		if (controller.signal.aborted) return aborted();
+		return speechWire.formatError(400, "invalid_request_error", `Invalid JSON body: ${String(error)}`);
+	}
+	if (controller.signal.aborted) return aborted();
+
+	let parsed: speechWire.SpeechParsedRequest;
+	try {
+		parsed = speechWire.parseRequest(body, req.headers);
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		return speechWire.formatError(400, "invalid_request_error", message);
+	}
+
+	const model = bootOpts.resolveModel(parsed.modelId);
+	if (!model) return speechWire.formatError(404, "invalid_request_error", `Unknown model: ${parsed.modelId}`);
+	if (!isSpeechApi(model.api)) {
+		const route =
+			model.kind === "image"
+				? "/v1/images/generations"
+				: model.kind === "stt"
+					? "/v1/audio/transcriptions"
+					: model.kind === "judge"
+						? "/v1/systemone"
+						: undefined;
+		const message = route
+			? `Model ${parsed.modelId} does not synthesize speech; use POST ${route}`
+			: `Model ${parsed.modelId} does not synthesize speech`;
+		return speechWire.formatError(400, "invalid_request_error", message);
+	}
+
+	const client = resolveClientIdentity(req.headers);
+	const sessionId = deterministicUuid(`speech\u0000${model.provider}/${model.id}`);
+	const apiKey = await resolveGatewayApiKey(bootOpts.storage, model, sessionId, controller.signal, peer);
+	if (controller.signal.aborted) return aborted();
+	if (typeof apiKey !== "string") return speechWire.formatError(apiKey.status, apiKey.type, apiKey.message);
+
+	logger.info("auth-gateway request", {
+		requestId,
+		format: "speech",
+		model: parsed.modelId,
+		resolvedProvider: model.provider,
+		resolvedModel: model.id,
+		stream: false,
+		peer,
+	});
+
+	try {
+		const result = await synthesizeSpeech(model, parsed.request, {
+			apiKey: buildGatewayApiKeyResolver(
+				bootOpts.storage,
+				model,
+				sessionId,
+				apiKey,
+				controller.signal,
+				"speech",
+				peer,
+			),
+			fetch: bootOpts.fetch,
+			signal: controller.signal,
+		});
+		recordGatewayUsage(bootOpts.storage, model, client, result.usage);
+		const response = speechWire.encodeResponse(result, parsed.modelId);
+		const responseHeaders = gatewayResponseHeaders(model, {
+			requestId,
+			costUsd: result.usage.cost.total,
+			startedAt,
+		});
+		for (const name in responseHeaders) response.headers.set(name, responseHeaders[name]);
+		return response;
+	} catch (error) {
+		if (controller.signal.aborted) return aborted();
+		const classified = classifyGatewayError(error);
+		logger.warn("auth-gateway speech failed", { format: "speech", error: classified.message, peer });
+		return speechWire.formatError(classified.status, classified.type, classified.message);
+	}
+}

package/src/auth-gateway/routes/systemone.ts

@@ -0,0 +1,116 @@
+/**
+ * TypeSafe System One judgments: `POST /v1/systemone` (TypeSafe's path) and
+ * `POST /alpha/decisions` (OpenRouter's Decisions path, same wire).
+ *
+ * Same bearer auth, model resolution, broker credential lookup, and a/b/c
+ * credential rotation as the chat routes, dispatched through
+ * {@link TypeSafeJudge} — pi-ai's client for this wire — so 401 rotation and
+ * 429/529 backoff match omp's own judgments. A judgment is one JSON
+ * round-trip: no stream, no provider session state. TypeSafe reports tokens
+ * only, so the cost is priced from the catalog model for the response header
+ * and the broker's observed-usage ledger.
+ */
+import { calculateCost } from "@oh-my-pi/pi-catalog/models";
+import { logger } from "@oh-my-pi/pi-utils";
+import { classifyGatewayError } from "../../error/gateway";
+import { isJudgmentApi, TypeSafeJudge } from "../../judgment/typesafe";
+import * as systemOne from "../../providers/systemone-server";
+import { deterministicUuid } from "../../utils/deterministic-id";
+import {
+	type AuthGatewayBootOptions,
+	buildGatewayApiKeyResolver,
+	mirrorRequestAbort,
+	recordGatewayUsage,
+	resolveGatewayApiKey,
+} from "../dispatch";
+import { gatewayResponseHeaders, json, resolveClientIdentity } from "../http";
+
+export async function handleSystemOne(bootOpts: AuthGatewayBootOptions, req: Request, peer: string): Promise<Response> {
+	const startedAt = performance.now();
+	const requestId = crypto.randomUUID();
+	const controller = mirrorRequestAbort(req);
+	const aborted = (): Response => systemOne.formatError(499, "request_aborted", "client closed request");
+	if (controller.signal.aborted) return aborted();
+
+	let body: unknown;
+	try {
+		body = await req.json();
+	} catch (error) {
+		if (controller.signal.aborted) return aborted();
+		return systemOne.formatError(400, "invalid_request_error", `Invalid JSON body: ${String(error)}`);
+	}
+	if (controller.signal.aborted) return aborted();
+
+	let parsed: systemOne.SystemOneParsedRequest;
+	try {
+		parsed = systemOne.parseRequest(body);
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		// TypeSafe answers body validation failures with 422.
+		return systemOne.formatError(422, "invalid_request_error", message);
+	}
+
+	const model = bootOpts.resolveModel(parsed.modelId);
+	if (!model) {
+		return systemOne.formatError(404, "invalid_request_error", `Unknown model: ${parsed.modelId}`);
+	}
+	if (!isJudgmentApi(model.api)) {
+		return systemOne.formatError(
+			422,
+			"invalid_request_error",
+			`Model ${parsed.modelId} does not answer System One judgments`,
+		);
+	}
+	const client = resolveClientIdentity(req.headers);
+	// Judgments carry no conversation to derive a session from. One sticky
+	// session per model keeps credential selection stable across calls and
+	// still lets `markUsageLimitReached` hand off to a sibling account.
+	const sessionId = deterministicUuid(`systemone\u0000${model.provider}/${model.id}`);
+
+	const apiKey = await resolveGatewayApiKey(bootOpts.storage, model, sessionId, controller.signal, peer);
+	if (controller.signal.aborted) return aborted();
+	if (typeof apiKey !== "string") return systemOne.formatError(apiKey.status, apiKey.type, apiKey.message);
+
+	const judge = new TypeSafeJudge({
+		apiKey: buildGatewayApiKeyResolver(
+			bootOpts.storage,
+			model,
+			sessionId,
+			apiKey,
+			controller.signal,
+			"systemone",
+			peer,
+		),
+		api: model.api,
+		provider: model.provider,
+		model: model.id,
+		baseUrl: model.baseUrl,
+		fetch: bootOpts.fetch,
+	});
+
+	logger.info("auth-gateway request", {
+		requestId,
+		format: "systemone",
+		model: parsed.modelId,
+		resolvedProvider: model.provider,
+		resolvedModel: model.id,
+		stream: false,
+		peer,
+	});
+
+	try {
+		const result = await judge.judge(parsed.request, { signal: controller.signal });
+		// Encode before pricing: the body's `cost` means "upstream billed this"
+		// (OpenRouter), while the header and ledger carry the catalog estimate
+		// when the upstream reported tokens only (TypeSafe).
+		const body = systemOne.encodeResponse(result);
+		if (result.usage.cost.total === 0) calculateCost(model, result.usage);
+		recordGatewayUsage(bootOpts.storage, model, client, result.usage);
+		return json(200, body, gatewayResponseHeaders(model, { requestId, costUsd: result.usage.cost.total, startedAt }));
+	} catch (error) {
+		if (controller.signal.aborted) return aborted();
+		const classified = classifyGatewayError(error);
+		logger.warn("auth-gateway judgment failed", { format: "systemone", error: classified.message, peer });
+		return systemOne.formatError(classified.status, classified.type, classified.message);
+	}
+}

package/src/auth-gateway/routes/transcriptions.ts

@@ -0,0 +1,98 @@
+import { logger } from "@oh-my-pi/pi-utils";
+import { classifyGatewayError } from "../../error/gateway";
+import * as transcriptions from "../../providers/transcriptions-server";
+import { transcribeAudio } from "../../transcription";
+import { deterministicUuid } from "../../utils/deterministic-id";
+import {
+	type AuthGatewayBootOptions,
+	buildGatewayApiKeyResolver,
+	mirrorRequestAbort,
+	recordGatewayUsage,
+	resolveGatewayApiKey,
+} from "../dispatch";
+import { gatewayResponseHeaders, json, resolveClientIdentity } from "../http";
+
+/** OpenAI-compatible `POST /v1/audio/transcriptions` gateway handler. */
+export async function handleTranscriptions(
+	bootOpts: AuthGatewayBootOptions,
+	req: Request,
+	peer: string,
+): Promise<Response> {
+	const startedAt = performance.now();
+	const requestId = crypto.randomUUID();
+	const controller = mirrorRequestAbort(req);
+	const aborted = (): Response => transcriptions.formatError(499, "request_aborted", "client closed request");
+	if (controller.signal.aborted) return aborted();
+
+	let parsed: transcriptions.TranscriptionParsedRequest;
+	try {
+		parsed = await transcriptions.parseRequest(req);
+	} catch (error) {
+		if (controller.signal.aborted) return aborted();
+		const message = error instanceof Error ? error.message : String(error);
+		const status = error instanceof transcriptions.TranscriptionWireError ? error.status : 400;
+		return transcriptions.formatError(status, "invalid_request_error", message);
+	}
+	if (controller.signal.aborted) return aborted();
+
+	const model = bootOpts.resolveModel(parsed.modelId);
+	if (!model) {
+		return transcriptions.formatError(404, "invalid_request_error", `Unknown model: ${parsed.modelId}`);
+	}
+	if (model.api !== "openai-transcriptions") {
+		const detail =
+			model.api === "local-inference"
+				? `Model ${parsed.modelId} runs on-device only and cannot be served by the auth gateway`
+				: `Model ${parsed.modelId} does not support audio transcription`;
+		return transcriptions.formatError(400, "invalid_request_error", detail);
+	}
+
+	const client = resolveClientIdentity(req.headers);
+	const sessionId = deterministicUuid(`transcriptions\u0000${model.provider}/${model.id}`);
+	const apiKey = await resolveGatewayApiKey(bootOpts.storage, model, sessionId, controller.signal, peer);
+	if (controller.signal.aborted) return aborted();
+	if (typeof apiKey !== "string") {
+		return transcriptions.formatError(apiKey.status, apiKey.type, apiKey.message);
+	}
+
+	logger.info("auth-gateway request", {
+		requestId,
+		format: "transcriptions",
+		model: parsed.modelId,
+		resolvedProvider: model.provider,
+		resolvedModel: model.id,
+		stream: false,
+		peer,
+	});
+
+	try {
+		const result = await transcribeAudio(model, parsed.request, {
+			apiKey: buildGatewayApiKeyResolver(
+				bootOpts.storage,
+				model,
+				sessionId,
+				apiKey,
+				controller.signal,
+				"transcriptions",
+				peer,
+			),
+			fetch: bootOpts.fetch,
+			signal: controller.signal,
+		});
+		recordGatewayUsage(bootOpts.storage, model, client, result.usage);
+		return json(
+			200,
+			transcriptions.encodeResponse(result),
+			gatewayResponseHeaders(model, { requestId, costUsd: result.usage.cost.total, startedAt }),
+		);
+	} catch (error) {
+		if (controller.signal.aborted) return aborted();
+		const classified = classifyGatewayError(error);
+		logger.warn("auth-gateway transcription failed", {
+			format: "transcriptions",
+			error: classified.message,
+			peer,
+		});
+		return transcriptions.formatError(classified.status, classified.type, classified.message);
+	}
+}

package/src/auth-gateway/routes/video.ts

@@ -0,0 +1,243 @@
+import type { Api, Model } from "@oh-my-pi/pi-catalog/types";
+import { logger } from "@oh-my-pi/pi-utils";
+import { classifyGatewayError } from "../../error/gateway";
+import * as videoServer from "../../providers/video-server";
+import { downloadVideo, pollVideo, submitVideo } from "../../video";
+import type { VideoJob } from "../../video/types";
+import { deterministicUuid } from "../../utils/deterministic-id";
+import {
+	type AuthGatewayBootOptions,
+	buildGatewayApiKeyResolver,
+	mirrorRequestAbort,
+	resolveGatewayApiKey,
+} from "../dispatch";
+import { gatewayResponseHeaders, json, resolveClientIdentity } from "../http";
+
+interface ResolvedVideoRequest {
+	model: Model<Api>;
+	upstreamId: string;
+	sessionId: string;
+	apiKey: string;
+	controller: AbortController;
+}
+
+function aborted(): Response {
+	return videoServer.formatError(499, "request_aborted", "client closed request");
+}
+
+async function resolveVideoJob(
+	bootOpts: AuthGatewayBootOptions,
+	req: Request,
+	peer: string,
+	gatewayId: string,
+): Promise<ResolvedVideoRequest | Response> {
+	const controller = mirrorRequestAbort(req);
+	if (controller.signal.aborted) return aborted();
+	let identity: videoServer.GatewayJobIdentity;
+	try {
+		identity = videoServer.decodeGatewayJobId(gatewayId);
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		return videoServer.formatError(400, "invalid_request_error", message);
+	}
+	const model = bootOpts.resolveModel(`${identity.provider}/${identity.modelId}`);
+	if (!model) {
+		return videoServer.formatError(
+			404,
+			"invalid_request_error",
+			`Unknown model: ${identity.provider}/${identity.modelId}`,
+		);
+	}
+	if (model.api !== "openrouter-video") {
+		return videoServer.formatError(
+			400,
+			"invalid_request_error",
+			`Model ${model.id} does not support video generation`,
+		);
+	}
+	const sessionId = deterministicUuid(`video\u0000${model.provider}/${model.id}`);
+	const apiKey = await resolveGatewayApiKey(bootOpts.storage, model, sessionId, controller.signal, peer);
+	if (controller.signal.aborted) return aborted();
+	if (typeof apiKey !== "string") return videoServer.formatError(apiKey.status, apiKey.type, apiKey.message);
+	return { model, upstreamId: identity.upstreamId, sessionId, apiKey, controller };
+}
+
+function videoOptions(bootOpts: AuthGatewayBootOptions, resolved: ResolvedVideoRequest, peer: string) {
+	return {
+		apiKey: buildGatewayApiKeyResolver(
+			bootOpts.storage,
+			resolved.model,
+			resolved.sessionId,
+			resolved.apiKey,
+			resolved.controller.signal,
+			"video",
+			peer,
+		),
+		fetch: bootOpts.fetch,
+		signal: resolved.controller.signal,
+	};
+}
+
+function logVideoRequest(
+	requestId: string,
+	operation: "submit" | "poll" | "content",
+	model: ResolvedVideoRequest["model"],
+	peer: string,
+): void {
+	logger.info("auth-gateway request", {
+		requestId,
+		format: `video-${operation}`,
+		model: model.id,
+		resolvedProvider: model.provider,
+		resolvedModel: model.id,
+		stream: operation === "content",
+		peer,
+	});
+}
+
+function recordCompletedUsage(
+	bootOpts: AuthGatewayBootOptions,
+	resolved: ResolvedVideoRequest,
+	req: Request,
+	job: VideoJob,
+): void {
+	if (job.status !== "completed" || job.usage === undefined) return;
+	bootOpts.storage.recordObservedUsage({
+		provider: resolved.model.provider,
+		model: resolved.model.id,
+		usage: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+		costUsd: job.usage.cost.total,
+		client: resolveClientIdentity(req.headers),
+	});
+}
+
+/** OpenRouter-compatible `POST /v1/videos` asynchronous video submit handler. */
+export async function handleVideoSubmit(
+	bootOpts: AuthGatewayBootOptions,
+	req: Request,
+	peer: string,
+): Promise<Response> {
+	const startedAt = performance.now();
+	const requestId = crypto.randomUUID();
+	const controller = mirrorRequestAbort(req);
+	if (controller.signal.aborted) return aborted();
+	let parsed: videoServer.VideoParsedRequest;
+	try {
+		parsed = videoServer.parseRequest(await req.json());
+	} catch (error) {
+		if (controller.signal.aborted) return aborted();
+		const message = error instanceof Error ? error.message : String(error);
+		return videoServer.formatError(400, "invalid_request_error", message);
+	}
+	const model = bootOpts.resolveModel(parsed.modelId);
+	if (!model) return videoServer.formatError(404, "invalid_request_error", `Unknown model: ${parsed.modelId}`);
+	if (model.api !== "openrouter-video") {
+		return videoServer.formatError(
+			400,
+			"invalid_request_error",
+			`Model ${parsed.modelId} does not support video generation`,
+		);
+	}
+	const sessionId = deterministicUuid(`video\u0000${model.provider}/${model.id}`);
+	const apiKey = await resolveGatewayApiKey(bootOpts.storage, model, sessionId, controller.signal, peer);
+	if (controller.signal.aborted) return aborted();
+	if (typeof apiKey !== "string") return videoServer.formatError(apiKey.status, apiKey.type, apiKey.message);
+	logger.info("auth-gateway request", {
+		requestId,
+		format: "video-submit",
+		model: parsed.modelId,
+		resolvedProvider: model.provider,
+		resolvedModel: model.id,
+		stream: false,
+		peer,
+	});
+	try {
+		const job = await submitVideo(model, parsed.request, {
+			apiKey: buildGatewayApiKeyResolver(
+				bootOpts.storage,
+				model,
+				sessionId,
+				apiKey,
+				controller.signal,
+				"video",
+				peer,
+			),
+			fetch: bootOpts.fetch,
+			signal: controller.signal,
+		});
+		const gatewayId = videoServer.encodeGatewayJobId({
+			provider: model.provider,
+			modelId: model.id,
+			upstreamId: job.id,
+		});
+		return json(
+			202,
+			videoServer.encodeSubmitResponse(job, req, gatewayId),
+			gatewayResponseHeaders(model, { requestId, startedAt }),
+		);
+	} catch (error) {
+		if (controller.signal.aborted) return aborted();
+		const classified = classifyGatewayError(error);
+		logger.warn("auth-gateway video submit failed", { format: "video-submit", error: classified.message, peer });
+		return videoServer.formatError(classified.status, classified.type, classified.message);
+	}
+}
+
+/** OpenRouter-compatible `GET /v1/videos/:id` asynchronous video poll handler. */
+export async function handleVideoPoll(
+	bootOpts: AuthGatewayBootOptions,
+	req: Request,
+	peer: string,
+	gatewayId: string,
+): Promise<Response> {
+	const startedAt = performance.now();
+	const requestId = crypto.randomUUID();
+	const resolved = await resolveVideoJob(bootOpts, req, peer, gatewayId);
+	if (resolved instanceof Response) return resolved;
+	logVideoRequest(requestId, "poll", resolved.model, peer);
+	try {
+		const job = await pollVideo(resolved.model, resolved.upstreamId, videoOptions(bootOpts, resolved, peer));
+		recordCompletedUsage(bootOpts, resolved, req, job);
+		return json(
+			200,
+			videoServer.encodePollResponse(job, req, gatewayId),
+			gatewayResponseHeaders(resolved.model, {
+				requestId,
+				...(job.usage !== undefined && { costUsd: job.usage.cost.total }),
+				startedAt,
+			}),
+		);
+	} catch (error) {
+		if (resolved.controller.signal.aborted) return aborted();
+		const classified = classifyGatewayError(error);
+		logger.warn("auth-gateway video poll failed", { format: "video-poll", error: classified.message, peer });
+		return videoServer.formatError(classified.status, classified.type, classified.message);
+	}
+}
+
+/** OpenRouter-compatible `GET /v1/videos/:id/content` streaming video content handler. */
+export async function handleVideoContent(
+	bootOpts: AuthGatewayBootOptions,
+	req: Request,
+	peer: string,
+	gatewayId: string,
+): Promise<Response> {
+	const startedAt = performance.now();
+	const requestId = crypto.randomUUID();
+	const resolved = await resolveVideoJob(bootOpts, req, peer, gatewayId);
+	if (resolved instanceof Response) return resolved;
+	logVideoRequest(requestId, "content", resolved.model, peer);
+	try {
+		const content = await downloadVideo(resolved.model, resolved.upstreamId, videoOptions(bootOpts, resolved, peer));
+		const headers = new Headers(gatewayResponseHeaders(resolved.model, { requestId, startedAt }));
+		headers.set("Content-Type", content.contentType);
+		headers.set("X-Content-Type-Options", "nosniff");
+		if (content.contentLength !== undefined) headers.set("Content-Length", String(content.contentLength));
+		return new Response(content.body, { status: 200, headers });
+	} catch (error) {
+		if (resolved.controller.signal.aborted) return aborted();
+		const classified = classifyGatewayError(error);
+		logger.warn("auth-gateway video content failed", { format: "video-content", error: classified.message, peer });
+		return videoServer.formatError(classified.status, classified.type, classified.message);
+	}
+}