@pyric/cli 0.1.0-alpha.30.1 → 0.1.0-alpha.30.2

package/src/serve/ai-diagnostics-relay.ts

@@ -11,7 +11,8 @@ import { capTerminalText } from './ai-terminal-text.js';
  * agent driving `pyric dev` in process therefore saw NOTHING.
  *
  *   - `request_rejected`: a bad role, empty `contents`, a missing thought
- *     signature, or an engine that answered an error envelope.
+ *     signature, a request without a valid App Check token, or an engine
+ *     that answered an error envelope.
  *   - `response_blocked`: the SILENT refusal. A safety / recitation /
  *     blocklist filter answers HTTP 200 with an empty candidate, so nothing
  *     throws anywhere and the app simply renders nothing.
@@ -73,6 +74,8 @@ interface AiRejectionRelayPayload {
   code?: number;
   /** The rejection reason: production's own message for shape errors. */
   message: string;
+  /** Pyric's guidance beside production's message, such as the App Check gate's. */
+  hint?: string;
 }
 
 /** Shape POSTed for a `response_blocked` event. Carries the wire's own
@@ -148,6 +151,8 @@ function toRejectionPayload(event: ServiceMutation): AiRejectionRelayPayload | n
   payload.engine = detailText(detail, 'engine');
   payload.status = detailText(detail, 'status');
   if (typeof detail.code === 'number') payload.code = detail.code;
+  const hint = detailText(detail, 'hint');
+  if (hint !== undefined) payload.hint = hint;
   return payload;
 }
 

package/src/serve/ai-proxy.ts

@@ -16,6 +16,8 @@ import type { AiEngineConfigWire } from './worker/protocol.js';
 import { permitGuardHost } from '../register/net-guard.js';
 import { FIREBASE_AI_LOGIC_HOST } from '../google-endpoints.js';
 import type { AiMode } from './firebase-module-swap.js';
+import { HOSTED_METHOD_BODY_LIMIT } from './hosted/method-protocol.js';
+import { BODY_TOO_LARGE_CODE, collectRawBody } from '../bridge/server/peer.js';
 
 /** The dev server's diagnostics throttle, as this module needs it: the
  *  denials route owns the instance, and the proxy shares it so a failing
@@ -30,6 +32,10 @@ export const AI_PROXY_DEFAULT_UPSTREAM = 'http://localhost:11434/v1';
 /** The route the dev server mounts for OpenAI-compatible traffic. */
 export const AI_PROXY_ROUTE = '/__pyric/ai-proxy';
 
+/** Largest request body the proxy forwards: the hosted method route's limit,
+ *  which already carries AI requests with inline images. */
+export const AI_PROXY_BODY_LIMIT_BYTES = HOSTED_METHOD_BODY_LIMIT;
+
 /**
  * Request headers that must NOT be forwarded upstream: origin-sensitive
  * browser context (`origin`/`referer`/`cookie`, since the upstream is a
@@ -280,6 +286,25 @@ export async function fetchAiUpstream(
   });
 }
 
+/**
+ * Read an AI proxy request's body, at most {@link AI_PROXY_BODY_LIMIT_BYTES}.
+ * Past the limit it answers 413, and on a broken upload 400, and returns
+ * null: the caller sends nothing upstream. Both proxy routes read through it.
+ */
+export async function readAiProxyBody(
+  req: IncomingMessage,
+  res: ServerResponse,
+): Promise<Uint8Array<ArrayBuffer> | null> {
+  try {
+    return await collectRawBody(req, AI_PROXY_BODY_LIMIT_BYTES);
+  } catch (error) {
+    const tooLarge = (error as { code?: unknown }).code === BODY_TOO_LARGE_CODE;
+    const status = tooLarge ? 413 : 400;
+    res.writeHead(status, { 'content-type': 'text/plain' }).end(tooLarge ? 'Payload Too Large' : 'Bad Request');
+    return null;
+  }
+}
+
 /**
  * Handle `POST /__pyric/ai-proxy/<suffix>`: a same-origin passthrough to the
  * configured OpenAI-compatible upstream, so the browser openai engine
@@ -290,7 +315,11 @@ export async function fetchAiUpstream(
  *   - POST only (the OpenAI chat-completions surface is POST); 405 otherwise.
  *   - the path suffix + query ride through verbatim
  *     (`/__pyric/ai-proxy/chat/completions` becomes `<upstream>/chat/completions`).
- *   - the request body is forwarded verbatim; headers minus the
+ *   - the caller must pass the namespace's loopback guard (Host, and an
+ *     Origin naming this server when one is sent), which the namespace runs
+ *     before this handler: the upstream may carry the developer's key.
+ *   - the request body is forwarded verbatim, up to
+ *     {@link AI_PROXY_BODY_LIMIT_BYTES} (413 past it); headers minus the
  *     origin-sensitive/hop-by-hop set above (`authorization` DOES forward,
  *     since upstreams may require a key).
  *   - the response body is STREAMED through chunk-by-chunk. SSE passthrough
@@ -319,17 +348,9 @@ export async function handleAiProxy(
   const suffix = url.pathname.slice(AI_PROXY_ROUTE.length);
   const target = `${upstreamBase}${suffix}${url.search}`;
 
-  // Buffer the REQUEST body (small JSON payloads); the RESPONSE streams.
-  const raw = await new Promise<Buffer>((resolve, reject) => {
-    const chunks: Buffer[] = [];
-    req.on('data', (c: Buffer) => chunks.push(c));
-    req.on('end', () => resolve(Buffer.concat(chunks)));
-    req.on('error', reject);
-  });
-  // Copy into a plain-ArrayBuffer view; fetch's BodyInit typing rejects
-  // Buffer's ArrayBufferLike backing.
-  const body = new Uint8Array(raw.byteLength);
-  body.set(raw);
+  // The request body is a bounded JSON payload, read once; the RESPONSE streams.
+  const body = await readAiProxyBody(req, res);
+  if (body === null) return;
 
   const headers: Record<string, string> = {};
   for (const [key, value] of Object.entries(req.headers)) {
@@ -355,6 +376,16 @@ export async function handleAiProxy(
     return;
   }
 
+  await relayAiUpstream(upstream, res);
+}
+
+/**
+ * Send an upstream's answer to the caller: its status and content type, then
+ * the body chunk by chunk. SSE passthrough must never buffer. A dropped
+ * client cancels the upstream read so an abandoned stream doesn't keep the
+ * upstream generating.
+ */
+export async function relayAiUpstream(upstream: Response, res: ServerResponse): Promise<void> {
   const responseHeaders: Record<string, string> = { 'cache-control': 'no-store' };
   const contentType = upstream.headers.get('content-type');
   if (contentType) responseHeaders['content-type'] = contentType;
@@ -365,8 +396,6 @@ export async function handleAiProxy(
   }
   (res as ServerResponse & { flushHeaders?: () => void }).flushHeaders?.();
 
-  // Chunk-by-chunk passthrough. A dropped client cancels the upstream read
-  // so an abandoned SSE stream doesn't keep the upstream generating.
   const reader = upstream.body.getReader();
   res.on('close', () => {
     void reader.cancel().catch(() => {});

package/src/serve/ai-terminal-blocks.ts

@@ -30,6 +30,8 @@ export interface AiRejectionPayload {
   code?: unknown;
   /** The rejection reason: production's own message for shape errors. */
   message?: unknown;
+  /** Pyric's guidance beside production's message, such as the App Check gate's. */
+  hint?: unknown;
 }
 
 /** Loosely-typed mirror of the AI blocked-response payload. Unlike a
@@ -99,10 +101,10 @@ function formatModelLine(model: unknown, engine: unknown): string | null {
 /**
  * Format a relayed AI broker rejection into the compact terminal block, the
  * same `  [pyric] ...` idiom the denial relay and the ai-proxy warning print.
- * Three lines at most: the reason production itself gives, then the model
- * (with the resolved engine, since a rejection reads very differently for
- * `scripted` than for a real upstream), then the wire status. Exported for
- * unit tests.
+ * The reason production itself gives, then the model (with the resolved
+ * engine, since a rejection reads very differently for `scripted` than for a
+ * real upstream), then the wire status, then pyric's guidance when the broker
+ * gave one (the App Check gate does). Exported for unit tests.
  */
 export function formatAiRejectionBlock(payload: AiRejectionPayload): string {
   const message = readText(payload.message) ?? 'request rejected';
@@ -117,6 +119,8 @@ export function formatAiRejectionBlock(payload: AiRejectionPayload): string {
     if (code !== null) suffix = ` (${code})`;
     lines.push(`      ${label}${suffix}`);
   }
+  const hint = readText(payload.hint);
+  if (hint !== null) lines.push(`      ${hint}`);
   return lines.join('\n');
 }
 

package/src/serve/ai-terminal-text.ts

@@ -37,6 +37,17 @@ export function capTerminalText(text: string): string {
 const TERMINAL_UNSAFE_CHARS =
   /[\u0000-\u001f\u007f-\u009f\u061c\u200e\u200f\u2028-\u202e\u2066-\u2069\ufeff]/g;
 
+/**
+ * Replace control, bidi-override and line-separator characters with spaces,
+ * and change nothing else: no flattening, no whitespace collapsing, no cut.
+ * For one line of text a reader copies out of the terminal, such as a
+ * pasteable command or JSON fixture, where the exact spacing and the whole
+ * length matter. The caller splits lines first and bounds the total.
+ */
+export function stripTerminalControls(text: string): string {
+  return text.replace(TERMINAL_UNSAFE_CHARS, ' ');
+}
+
 /**
  * Flatten an upstream-authored string into ONE terminal-safe line.
  *

package/src/serve/entries/ai.ts

@@ -16,8 +16,11 @@
  * config with no `baseUrl` targets serve's same-origin `/__pyric/ai-proxy`
  * route (which forwards to the configured upstream, default
  * `http://localhost:11434/v1`) — so a localhost Ollama needs no CORS setup
- * on EITHER path. A custom AnswerEngine OBJECT can't cross the port and is
- * rejected in worker mode rather than creating a second page-local backend.
+ * on EITHER path. A gemini config without its own `apiKey` sends through
+ * `/__pyric/ai-proxy/gemini`, where the server attaches the key from its
+ * environment, so the key never reaches the page. A custom AnswerEngine
+ * OBJECT can't cross the port and is rejected in worker mode rather than
+ * creating a second page-local backend.
  * Direct/in-process `pyric/ai` sandboxes still accept custom engines.
  *
  * Engine config is per-sandbox (#98.4) and first-call-wins at the worker
@@ -27,12 +30,14 @@
  */
 import * as ipAi from 'pyric/ai';
 import { aiErrorFromEnvelope, unpackAiEvidence, getAiEvidence, setAiEvidence } from 'pyric/ai/internal';
+import type { AppCheckClaim } from 'pyric/ai/internal';
 import { getAI as pyricGetAI } from 'pyric/ai';
 import { createTransportAI } from 'pyric/ai/internal';
 import { FirebaseError, getApp, type FirebaseApp } from 'pyric/app';
 import { isSandboxAppDeleted } from 'pyric/app/internal';
 import type { AiEngineConfigWire } from '../worker/protocol.js';
 import { aiGenerateContent, aiCountTokens, aiStreamGenerateContent } from '../worker/client.js';
+import { AI_PROXY_PATH, browserGeminiEngine } from '../worker/ai-proxy-paths.js';
 import { useWorker } from './worker-runtime.js';
 import { workerClientForApp } from './app-client.js';
 
@@ -80,9 +85,6 @@ export {
 type EngineOption = NonNullable<ipAi.AIOptions['engine']>;
 type AnswerTransport = Parameters<typeof createTransportAI>[2];
 
-/** The serve proxy route the browser openai engine defaults to (#98.2). */
-const AI_PROXY_PATH = '/__pyric/ai-proxy';
-
 /** A custom AnswerEngine object (vs a plain, worker-cloneable EngineConfig). */
 function isAnswerEngine(engine: EngineOption): boolean {
   return typeof (engine as { generateContent?: unknown }).generateContent === 'function';
@@ -150,20 +152,7 @@ function wireToEngineOption(wire: AiEngineConfigWire): EngineOption {
     } as EngineOption;
   }
   const isGeminiWire = wire.kind === 'gemini';
-  if (isGeminiWire) {
-    const result: Record<string, unknown> = {
-      kind: 'gemini',
-    };
-    const hasBaseUrl = wire.baseUrl !== undefined;
-    if (hasBaseUrl) {
-      result.baseUrl = wire.baseUrl;
-    }
-    const hasApiKey = wire.apiKey !== undefined;
-    if (hasApiKey) {
-      result.apiKey = wire.apiKey;
-    }
-    return result as unknown as EngineOption;
-  }
+  if (isGeminiWire) return browserGeminiEngine(wire) as EngineOption;
   return {
     kind: 'scripted',
     ...(wire.script !== undefined
@@ -172,7 +161,10 @@ function wireToEngineOption(wire: AiEngineConfigWire): EngineOption {
   } as EngineOption;
 }
 
-/** In-page path: default an openai config's absent baseUrl to the proxy. */
+/**
+ * In-page path: default an openai config's absent baseUrl to the proxy, and
+ * send a gemini config without its own key through the gemini proxy.
+ */
 function withProxyDefault(options?: ipAi.AIOptions): ipAi.AIOptions | undefined {
   const engine = options?.engine;
   if (!engine || isAnswerEngine(engine)) return options;
@@ -180,6 +172,10 @@ function withProxyDefault(options?: ipAi.AIOptions): ipAi.AIOptions | undefined
   if (config.kind === 'openai' && config.baseUrl === undefined) {
     return { ...options, engine: { ...config, baseUrl: AI_PROXY_PATH } as EngineOption };
   }
+  const isKeylessGemini = config.kind === 'gemini' && (engine as { apiKey?: string }).apiKey === undefined;
+  if (isKeylessGemini) {
+    return { ...options, engine: browserGeminiEngine({ kind: 'gemini' }) as EngineOption };
+  }
   return options;
 }
 
@@ -191,22 +187,27 @@ function aiErrorFromWire(err: unknown, modelResource: string, op: string): unkno
 
 // ── The port-forwarding AnswerEngine (worker path) ─────────────────────────
 
+/**
+ * The handle's App Check claim rides every request to the worker broker,
+ * which plays AI Logic's gate (`pyric/ai`'s `app-check-gate.ts`).
+ */
 function portEngine(db: ReturnType<typeof workerClientForApp>, engineWire: AiEngineConfigWire | undefined): AnswerTransport {
-  const params = (model: string, request: Record<string, unknown>) => ({
+  const params = (model: string, request: Record<string, unknown>, appCheck: AppCheckClaim | undefined) => ({
     model,
     request,
     ...(engineWire !== undefined ? { engine: engineWire } : {}),
+    ...(appCheck !== undefined ? { appCheck } : {}),
   });
   const engine = {
-    async generateContent(req: Record<string, unknown>, model: string): Promise<Record<string, unknown>> {
+    async generateContent(req: Record<string, unknown>, model: string, appCheck?: AppCheckClaim): Promise<Record<string, unknown>> {
       try {
-        return unpackAiEvidence(await aiGenerateContent(db, params(model, req)));
+        return unpackAiEvidence(await aiGenerateContent(db, params(model, req, appCheck)));
       } catch (err) {
         throw aiErrorFromWire(err, model, 'generateContent');
       }
     },
-    streamGenerateContent(req: Record<string, unknown>, model: string): AsyncIterable<Record<string, unknown>> {
-      const inner = aiStreamGenerateContent(db, params(model, req));
+    streamGenerateContent(req: Record<string, unknown>, model: string, appCheck?: AppCheckClaim): AsyncIterable<Record<string, unknown>> {
+      const inner = aiStreamGenerateContent(db, params(model, req, appCheck));
       return (async function* mapped(): AsyncGenerator<Record<string, unknown>> {
         try {
           for await (const chunk of inner) yield unpackAiEvidence(chunk);
@@ -215,9 +216,9 @@ function portEngine(db: ReturnType<typeof workerClientForApp>, engineWire: AiEng
         }
       })();
     },
-    async countTokens(req: Record<string, unknown>, model: string): Promise<Record<string, unknown>> {
+    async countTokens(req: Record<string, unknown>, model: string, appCheck?: AppCheckClaim): Promise<Record<string, unknown>> {
       try {
-        return unpackAiEvidence(await aiCountTokens(db, params(model, req)));
+        return unpackAiEvidence(await aiCountTokens(db, params(model, req, appCheck)));
       } catch (err) {
         throw aiErrorFromWire(err, model, 'countTokens');
       }

package/src/serve/gemini-error-redaction.ts

@@ -0,0 +1,60 @@
+/**
+ * Masking an upstream Gemini error before the gemini proxy relays it to the
+ * browser (#1584). An upstream or a gateway can quote the credential it was
+ * sent in any form: in the URL (`?key=`, `&key=`, JSON-escaped or
+ * percent-encoded), in plain text, or in an echoed header such as
+ * `x-goog-api-key` or `Authorization: Bearer`. So the proxy removes the exact
+ * credentials the request carried, raw and percent-encoded, then runs
+ * `redactUrl` as a second pass for any other credential parameter.
+ *
+ * A JSON body is masked value by value and serialized again, so the
+ * browser engine still reads Gemini's own status and message. Text
+ * redaction over the raw JSON could eat a closing quote and leave the
+ * envelope unparseable.
+ */
+import { redactUrl } from 'pyric/ai/internal';
+
+const MASK = '***';
+
+/** The forms a credential can appear in, longest first. */
+function quotedForms(credential: string): string[] {
+  const forms = new Set([encodeURIComponent(credential), credential]);
+  return [...forms].sort((a, b) => b.length - a.length);
+}
+
+function redactText(text: string, credentials: readonly string[]): string {
+  let masked = text;
+  for (const credential of credentials) {
+    for (const form of quotedForms(credential)) masked = masked.split(form).join(MASK);
+  }
+  return redactUrl(masked);
+}
+
+function redactValue(value: unknown, credentials: readonly string[]): unknown {
+  if (typeof value === 'string') return redactText(value, credentials);
+  if (Array.isArray(value)) return value.map((item) => redactValue(item, credentials));
+  const isObject = value !== null && typeof value === 'object';
+  if (!isObject) return value;
+  const entries = Object.entries(value as Record<string, unknown>)
+    .map(([key, item]) => [redactText(key, credentials), redactValue(item, credentials)]);
+  return Object.fromEntries(entries);
+}
+
+/** The JSON value `text` holds, or undefined when it is not JSON. */
+function parseJson(text: string): { value: unknown } | undefined {
+  try {
+    return { value: JSON.parse(text) as unknown };
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * `text` with every credential in `credentials` removed, and every
+ * credential URL parameter masked. A JSON body stays JSON.
+ */
+export function redactUpstreamError(text: string, credentials: readonly string[]): string {
+  const json = parseJson(text);
+  if (json === undefined) return redactText(text, credentials);
+  return JSON.stringify(redactValue(json.value, credentials));
+}

package/src/serve/gemini-proxy.ts

@@ -0,0 +1,140 @@
+/**
+ * `/__pyric/ai-proxy/gemini`: where a browser gemini engine sends (#1584).
+ *
+ * A page or SharedWorker has no server environment, and the Gemini API key
+ * must never reach it. The browser engine sends each request here with no
+ * credentials. The dev server sends it on with the gemini engine's own
+ * request code (`GeminiUpstream` from `pyric/ai/internal`): the key from the
+ * server's environment or ADC, to the server's configured base URL. A
+ * successful answer streams back unchanged. An error comes back with its
+ * status and with any credential it quotes masked, so the browser engine
+ * reads Gemini's own error and never the key. The body is bounded as the
+ * openai route's is.
+ *
+ * The browser chooses only the model and the call. The target and the
+ * credentials are the server's, so no page can send the key anywhere else.
+ * The App Check gate runs before any of this, in the broker that owns the
+ * browser engine.
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { GeminiUpstream, type GeminiUpstreamOptions } from 'pyric/ai/internal';
+import { redactUpstreamError } from './gemini-error-redaction.js';
+import type { ServeLogger } from './server.js';
+import { fetchAiUpstream, readAiProxyBody, relayAiUpstream, type AiDiagnosticThrottle } from './ai-proxy.js';
+import { GEMINI_PROXY_PATH } from './worker/ai-proxy-paths.js';
+import { serializeError, type AiEngineConfigWire } from './worker/protocol.js';
+
+export { GEMINI_PROXY_PATH } from './worker/ai-proxy-paths.js';
+
+/** The server's gemini engine config: the Vite plugin's `ai.engine`, when it is gemini. */
+export interface GeminiProxyConfig {
+  baseUrl?: string;
+  apiKey?: string;
+}
+
+/** The gemini proxy's config from a configured engine, when that engine is gemini. */
+export function geminiProxyConfig(engine: AiEngineConfigWire | undefined): GeminiProxyConfig | undefined {
+  const isGemini = engine?.kind === 'gemini';
+  if (!isGemini) return undefined;
+  return {
+    ...(engine.baseUrl !== undefined ? { baseUrl: engine.baseUrl } : {}),
+    ...(engine.apiKey !== undefined ? { apiKey: engine.apiKey } : {}),
+  };
+}
+
+/** `/v1beta/models/<model>:<call>`, for the three calls the browser engine makes. */
+const GEMINI_CALL_PATH = /^\/v1beta\/(models\/[A-Za-z0-9._-]+):(generateContent|streamGenerateContent|countTokens)$/;
+
+/** The query each call may carry: only the stream asks for server-sent events. */
+const CALL_QUERY: Record<string, string> = {
+  generateContent: '',
+  countTokens: '',
+  streamGenerateContent: '?alt=sse',
+};
+
+/** Is this request for the gemini proxy (and not the OpenAI-compatible one)? */
+export function isGeminiProxyPath(pathname: string): boolean {
+  return pathname.startsWith(`${GEMINI_PROXY_PATH}/`);
+}
+
+/** The resource and the action `GeminiUpstream.send` takes, or null for anything else. */
+function geminiCall(url: URL): { resource: string; action: string } | null {
+  const match = url.pathname.slice(GEMINI_PROXY_PATH.length).match(GEMINI_CALL_PATH);
+  if (match === null) return null;
+  const [, resource, call] = match as unknown as [string, string, string];
+  const isExpectedQuery = url.search === CALL_QUERY[call];
+  if (!isExpectedQuery) return null;
+  return { resource, action: `${call}${url.search}` };
+}
+
+/** Answer with a Gemini error envelope, as the upstream would. */
+function sendEnvelope(res: ServerResponse, code: number, message: string, status: string): void {
+  res.writeHead(code, { 'content-type': 'application/json', 'cache-control': 'no-store' });
+  res.end(JSON.stringify({ error: { code, message, status } }));
+}
+
+/**
+ * Send a non-2xx upstream answer with the credentials the request carried
+ * removed, in whatever form the upstream quotes them, and a JSON envelope
+ * kept parseable (`gemini-error-redaction.ts`).
+ */
+async function relayRedactedError(upstream: Response, credentials: readonly string[], res: ServerResponse): Promise<void> {
+  const text = redactUpstreamError(await upstream.text().catch(() => ''), credentials);
+  const headers: Record<string, string> = { 'cache-control': 'no-store' };
+  const contentType = upstream.headers.get('content-type');
+  if (contentType) headers['content-type'] = contentType;
+  res.writeHead(upstream.status, headers);
+  res.end(text);
+}
+
+/**
+ * The gemini proxy handler. One `GeminiUpstream` serves every request, so an
+ * ADC token is looked up once and reused, as the engine itself does.
+ * `seams` replaces the ADC lookup in tests.
+ */
+export function createGeminiProxy(
+  config: GeminiProxyConfig | undefined,
+  throttle: AiDiagnosticThrottle,
+  logger?: ServeLogger,
+  seams: Pick<GeminiUpstreamOptions, 'printAdcToken'> = {},
+): (req: IncomingMessage, res: ServerResponse, url: URL) => Promise<void> {
+  const upstream = new GeminiUpstream({
+    ...seams,
+    ...(config?.baseUrl !== undefined ? { baseUrl: config.baseUrl } : {}),
+    ...(config?.apiKey !== undefined ? { apiKey: config.apiKey } : {}),
+    fetch: Object.assign(
+      (input: Parameters<typeof fetch>[0], init?: RequestInit) => fetchAiUpstream(input, init, throttle, logger),
+      { preconnect: fetch.preconnect },
+    ),
+  });
+  return async (req, res, url) => {
+    if (req.method !== 'POST') {
+      res.writeHead(405, { allow: 'POST' }).end('method not allowed');
+      return;
+    }
+    const call = geminiCall(url);
+    if (call === null) {
+      sendEnvelope(res, 404, `pyric dev ai-proxy: ${url.pathname} is not a Gemini call the proxy sends.`, 'NOT_FOUND');
+      return;
+    }
+    const body = await readAiProxyBody(req, res);
+    if (body === null) return;
+    let response: Response;
+    let credentials: string[];
+    try {
+      ({ response, credentials } = await upstream.sendWithCredentials(call.resource, call.action, body));
+    } catch (error) {
+      // Missing credentials (401) and an unreachable upstream (502) come as
+      // the engine's own envelopes, already redacted.
+      const envelope = serializeError(error).aiEnvelope;
+      if (envelope === undefined) throw error;
+      sendEnvelope(res, envelope.error.code, envelope.error.message, envelope.error.status);
+      return;
+    }
+    if (response.ok) {
+      await relayAiUpstream(response, res);
+      return;
+    }
+    await relayRedactedError(response, credentials, res);
+  };
+}