cartethyia 2.7.4 → 2.7.6

package/src/transport/dispatch/capture-policy.ts

@@ -1,8 +1,35 @@
 // Tenant payload-capture policy resolved once and shared by dispatch attempts.
 import type { CartethyiaDatabase } from "../../persistence/db-handle";
-import { payloadRetentionMs, resolvePayloadCapture } from "../../observability/payload-capture";
+import { resolvePayloadCapture } from "../../observability/payload-capture";
 import type { TelemetryPayloadDepth, TelemetryPayloadMode } from "../../console/settings/contracts";
 
+/** The resolved payload-capture preference, memoized on the request state. */
+export type PayloadCapturePreference =
+  | {
+      readonly ok: true;
+      readonly mode: TelemetryPayloadMode;
+      readonly depth: TelemetryPayloadDepth;
+      readonly retentionMs: number;
+    }
+  | { readonly ok: false };
+
+/** The slice of request state that memoizes the capture preference. */
+export type CapturePreferenceState = { payloadCapturePreference?: PayloadCapturePreference };
+
+/** Resolves the tenant's capture preference once, memoized on the request state. */
+async function resolveCapturePreference(
+  db: CartethyiaDatabase,
+  tenantId: string | null,
+  state: CapturePreferenceState,
+): Promise<PayloadCapturePreference> {
+  let preference = state.payloadCapturePreference;
+  if (preference === undefined) {
+    preference = await resolvePayloadCapture(db, tenantId);
+    state.payloadCapturePreference = preference;
+  }
+  return preference;
+}
+
 /** Per-stage body cap for the provider request/response tee. */
 export function providerCaptureMaxBytes(depth?: TelemetryPayloadDepth): number {
   if (depth === "moderate") return 2 * 1024 * 1024;
@@ -14,14 +41,9 @@ export function providerCaptureMaxBytes(depth?: TelemetryPayloadDepth): number {
 export async function shouldCaptureProviderBodyForRequest(
   db: CartethyiaDatabase,
   tenantId: string | null,
-  state: { payloadCapturePreference?: unknown },
+  state: CapturePreferenceState,
 ): Promise<boolean> {
-  if (state.payloadCapturePreference === undefined) {
-    state.payloadCapturePreference = await resolvePayloadCapture(db, tenantId);
-  }
-  const resolved = state.payloadCapturePreference as
-    | { readonly ok: true; readonly mode: string }
-    | { readonly ok: false };
+  const resolved = await resolveCapturePreference(db, tenantId, state);
   return resolved.ok === true && resolved.mode === "full";
 }
 
@@ -29,14 +51,9 @@ export async function shouldCaptureProviderBodyForRequest(
 export async function resolveCaptureModeForRequest(
   db: CartethyiaDatabase,
   tenantId: string | null,
-  state: { payloadCapturePreference?: unknown },
+  state: CapturePreferenceState,
 ): Promise<TelemetryPayloadMode> {
-  if (state.payloadCapturePreference === undefined) {
-    state.payloadCapturePreference = await resolvePayloadCapture(db, tenantId);
-  }
-  const resolved = state.payloadCapturePreference as
-    | { readonly ok: true; readonly mode: TelemetryPayloadMode }
-    | { readonly ok: false };
+  const resolved = await resolveCapturePreference(db, tenantId, state);
   return resolved.ok === true ? resolved.mode : "none";
 }
 
@@ -44,32 +61,12 @@ export async function resolveCaptureModeForRequest(
 export async function resolveCaptureDepthForRequest(
   db: CartethyiaDatabase,
   tenantId: string | null,
-  state: { payloadCapturePreference?: unknown },
+  state: CapturePreferenceState,
 ): Promise<TelemetryPayloadDepth> {
-  if (state.payloadCapturePreference === undefined) {
-    state.payloadCapturePreference = await resolvePayloadCapture(db, tenantId);
-  }
-  const resolved = state.payloadCapturePreference as
-    | { readonly ok: true; readonly depth: TelemetryPayloadDepth }
-    | { readonly ok: false };
+  const resolved = await resolveCapturePreference(db, tenantId, state);
   return resolved.ok === true ? resolved.depth : "minimum";
 }
 
-/** Resolve the tenant's payload retention once per request. */
-export async function resolveCaptureRetentionForRequest(
-  db: CartethyiaDatabase,
-  tenantId: string | null,
-  state: { payloadCapturePreference?: unknown },
-): Promise<number> {
-  if (state.payloadCapturePreference === undefined) {
-    state.payloadCapturePreference = await resolvePayloadCapture(db, tenantId);
-  }
-  const resolved = state.payloadCapturePreference as
-    | { readonly ok: true; readonly retentionMs: number }
-    | { readonly ok: false };
-  return resolved.ok === true ? resolved.retentionMs : payloadRetentionMs();
-}
-
 /** Combined body cap for the four payload panels at one configured depth. */
 export function captureDepthMaxBytes(depth: TelemetryPayloadDepth): number {
   if (depth === "moderate") return 8 * 1024 * 1024;

package/src/transport/dispatch/empty-stream.ts

@@ -52,13 +52,13 @@ export type EmptyStreamFetch = (
  * unjittered, so a provider returning 200-with-no-events could drive an
  * unbounded wait, and concurrent clients could resynchronize their retries.
  */
-export interface EmptyStreamPolicy {
+interface EmptyStreamPolicy {
   readonly maxEmptyReplays?: number;
   readonly firstEventTimeoutMs?: number;
   readonly sleep?: (ms: number, signal: AbortSignal) => Promise<void>;
 }
 
-export interface EmptyStreamResult {
+interface EmptyStreamResult {
   readonly response: Response;
   readonly tally: StreamTally;
   readonly endpoint: string;
@@ -112,8 +112,7 @@ export async function fetchWithEmptyStreamRecovery(
 
   for (let endpointIndex = 0; endpointIndex < endpoints.length; endpointIndex++) {
     const endpoint = endpoints[endpointIndex]!;
-    const isLastEndpoint = endpointIndex === endpoints.length - 1;
-    const replaysAllowed = isLastEndpoint ? maxReplays : maxReplays;
+    const replaysAllowed = maxReplays;
 
     for (let replay = 0; replay <= replaysAllowed; replay++) {
       // Check abort before each fetch
@@ -167,12 +166,7 @@ export async function fetchWithEmptyStreamRecovery(
       // Empty — replay if we haven't exhausted this endpoint's budget
       if (replay < replaysAllowed) {
         const delay = fallbackRetryDelayMs(replay);
-        try {
-          await sleep(delay, deps.signal);
-        } catch (error) {
-          if (error instanceof GatewayError) throw error;
-          throw error;
-        }
+        await sleep(delay, deps.signal);
       }
     }
   }
@@ -196,9 +190,22 @@ async function fetchWithTimeout(
   signal: AbortSignal,
   timeoutMs: number,
 ): Promise<Response> {
-  // Race the fetch against a first-event timeout
+  // Race the fetch against a first-event timeout. The timer and the abort
+  // listener are both cleaned up once the race settles, so a successful fetch
+  // leaves neither behind.
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  const onAbort = (): void => {
+    if (timer !== undefined) clearTimeout(timer);
+    // A client cancellation is the caller's signal; the fetch already races the
+    // same abort signal, so rejecting here only surfaces the 499 envelope.
+    timeoutPromiseReject(
+      new GatewayError("transport_closed", 499, "The request was aborted (request {requestId}). Send it again whenever ready 🙃"),
+    );
+  };
+  let timeoutPromiseReject!: (reason: unknown) => void;
   const timeoutPromise = new Promise<never>((_, reject) => {
-    const timer = setTimeout(() => {
+    timeoutPromiseReject = reject;
+    timer = setTimeout(() => {
       // A first-event timeout is the gateway waiting on a silent upstream (e.g.
       // a provider that holds the request in a queue), not the client leaving.
       // It must surface as a deadline failure, never as a `transport_closed`
@@ -206,19 +213,15 @@ async function fetchWithTimeout(
       // otherwise hide a real upstream wait behind "cancelled by client".
       reject(new GatewayError("deadline_exceeded", 504, "First event timeout (request {requestId}). Some things just take longer 🐢", {}, "upstream"));
     }, timeoutMs);
-    signal.addEventListener("abort", () => {
-      clearTimeout(timer);
-      reject(new GatewayError("transport_closed", 499, "The request was aborted (request {requestId}). Send it again whenever ready 🙃"));
-    }, { once: true });
   });
-
+  signal.addEventListener("abort", onAbort, { once: true });
   try {
     return await Promise.race([
       fetch(url, { headers: request.headers, body: request.body, signal }),
       timeoutPromise,
     ]);
-  } catch (error) {
-    if (error instanceof GatewayError) throw error;
-    throw error;
+  } finally {
+    if (timer !== undefined) clearTimeout(timer);
+    signal.removeEventListener("abort", onAbort);
   }
 }

package/src/transport/dispatch/generation.ts

@@ -20,20 +20,26 @@
  */
 import type { ImageGenerationOutcome, ProviderAdapter, ProviderDispatchTarget } from "../../providers/provider-contracts";
 import { GatewayError } from "../../protocol/gateway-error";
-import { resolveCredentialForAccount } from "../../providers/operations/provider-credential-service";
 import type { ServiceKind } from "../../protocol/canonical-model";
 import { metrics } from "../../observability/metrics";
 import type { ProxyRequestState } from "../request/state";
 import { completeAttempt, estimatedUsage, nativeCompletionBase } from "./attempt-finalize";
 import { runAttemptLoop } from "./attempt-loop";
 import { captureProviderRateLimit } from "./ratelimit-capture";
+import {
+  hasScope,
+  jsonResponse,
+  networkFetchContext,
+  requireRecordBody,
+  resolveAttemptCredential,
+} from "./native-shared";
 
 import type { GatewayHandlerDeps } from "./handler-deps";
 
-export type GenerationHandlerDeps = GatewayHandlerDeps;
+type GenerationHandlerDeps = GatewayHandlerDeps;
 
 /** Which surface a handler serves. Drives candidate filtering and error copy. */
-export type GenerationKind = Extract<ServiceKind, "imageGeneration" | "videoGeneration">;
+type GenerationKind = Extract<ServiceKind, "imageGeneration" | "videoGeneration">;
 
 /**
  * Surfaces the gateway routes but does not model.
@@ -44,7 +50,7 @@ export type GenerationKind = Extract<ServiceKind, "imageGeneration" | "videoGene
  * is the whole feature: routing, admission, failover, and accounting still
  * apply, and the upstream's own bytes come back untouched.
  */
-export type PassthroughKind = Extract<ServiceKind, "embedding" | "audioTranscription" | "audioSpeech">;
+type PassthroughKind = Extract<ServiceKind, "embedding" | "audioTranscription" | "audioSpeech">;
 
 /** Error-copy noun per surface, so a refusal names what the caller asked for. */
 const SURFACE_NOUNS: Record<GenerationKind | PassthroughKind, string> = {
@@ -74,13 +80,6 @@ function isMediaKind(kind: GenerationKind | PassthroughKind): kind is Generation
  */
 const MAX_ITEMS_PER_REQUEST = 10;
 
-function jsonResponse(payload: unknown, status: number, requestId: string): Response {
-  return new Response(JSON.stringify(payload), {
-    status,
-    headers: { "content-type": "application/json", "x-request-id": requestId },
-  });
-}
-
 /**
  * Forwards a streaming upstream response to the client and accounts for it.
  *
@@ -145,12 +144,12 @@ async function passThrough(
 }
 
 /** Builds the handler for one generation surface. */
-export function createGenerationHandler(kind: GenerationKind, deps: GenerationHandlerDeps) {
+function createGenerationHandler(kind: GenerationKind, deps: GenerationHandlerDeps) {
   return createNativeSurfaceHandler(kind, deps);
 }
 
 /** Builds the handler for one routed surface, media or passthrough. */
-export function createNativeSurfaceHandler(
+function createNativeSurfaceHandler(
   kind: GenerationKind | PassthroughKind,
   deps: GenerationHandlerDeps,
 ) {
@@ -158,19 +157,14 @@ export function createNativeSurfaceHandler(
   return async ({ request }: { request: Request }): Promise<Response> => {
     const state = deps.stateStore.require(request);
     const authorization = state.authorization;
-    const body = state.ingressBody;
-    if (!authorization || body === null || typeof body !== "object" || Array.isArray(body)) {
-      throw new GatewayError(
-        "invalid_request",
-        400,
-        `The ${noun} body must be a JSON object (request {requestId}). Send one with at least a model and a prompt. Check the shape of what you sent — then resend 🪞`,
-      );
-    }
-    const generation = body as Record<string, unknown>;
+    const generation = requireRecordBody(
+      state,
+      `The ${noun} body must be a JSON object (request {requestId}). Send one with at least a model and a prompt. Check the shape of what you sent — then resend 🪞`,
+    );
     if (typeof generation.model !== "string" || generation.model.trim().length === 0) {
       throw new GatewayError("invalid_request", 400, `A model is required (request {requestId}): it names the ${noun} provider to use. Check the shape of what you sent — then resend 🪞`);
     }
-    if (!authorization.snapshot.scopes?.includes("routing:invoke" as never)) {
+    if (!hasScope(authorization?.snapshot.scopes, "routing:invoke")) {
       throw new GatewayError(
         "policy_rejected",
         403,
@@ -200,10 +194,15 @@ export function createNativeSurfaceHandler(
     const prepared = await deps.proxyPreparer.prepareNativeService({
       model: generation.model,
       serviceKind: kind,
-      authorization,
+      // `requireRecordBody` already refused a missing authorization; this guard
+      // exists only to narrow the type for the code below.
+      authorization: authorization!,
       ...(state.abortController.signal ? { signal: state.abortController.signal } : {}),
       ...(state.clientUserAgent === undefined ? {} : { clientUserAgent: state.clientUserAgent }),
     });
+    if (!authorization) {
+      throw new GatewayError("invalid_request", 400, "authentication required (request {requestId})");
+    }
 
     return runAttemptLoop<Response, ProviderAdapter>({
       state,
@@ -221,19 +220,7 @@ export function createNativeSurfaceHandler(
       strictPoolSelection: false,
       exhaustedError: new GatewayError("route_unavailable", 503, `no eligible ${noun} generation route (request {requestId}). The bouncer stepped out — come back shortly 🚪`),
       prepare: async (candidate) => {
-        const credential = candidate.provider_account_id
-          ? await resolveCredentialForAccount(
-              deps.db,
-              candidate.provider_id,
-              candidate.provider_account_id,
-              deps.oauthRefreshService && deps.resolveOAuthRefresher
-                ? { refreshService: deps.oauthRefreshService, resolveRefresher: deps.resolveOAuthRefresher }
-                : undefined,
-            )
-          : {
-              provider_id: candidate.provider_id as ProviderAdapter["provider_id"],
-              credential_kind: "none" as const,
-            };
+        const credential = await resolveAttemptCredential(deps, candidate);
         const adapter = await deps.resolveProviderAdapter?.(candidate.provider_id);
         if (!adapter) {
           throw new GatewayError(
@@ -309,14 +296,7 @@ export function createNativeSurfaceHandler(
           abort_signal: state.abortController.signal,
           request_headers: inboundHeaders,
           ...(candidate.user_agent === undefined ? {} : { user_agent: candidate.user_agent }),
-          ...(deps.networkBindingFactory
-            ? {
-                outbound_fetch: deps.networkBindingFactory.fetch(
-                  leases.proxySlot?.poolId,
-                  authorization.tenantId,
-                ),
-              }
-            : {}),
+          ...networkFetchContext(deps, leases.proxySlot?.poolId, authorization.tenantId),
         };
         // Prefer the provider's own method for this kind; otherwise post the
         // body to the candidate's endpoint through the adapter, which owns the

package/src/transport/dispatch/native-shared.ts

@@ -0,0 +1,127 @@
+/**
+ * Shared helpers for the native dispatch handlers (web search, token count,
+ * System One, responses-compact, generation). The handlers previously spelled
+ * the same credential-resolution, outbound-fetch, body-validation, thinking-
+ * suffix, response-serialization, and usage-clone blocks by hand, and the
+ * copies could drift (generation's `jsonResponse` lost the `cache-control`
+ * header). One home here keeps them in step.
+ */
+import { GatewayError } from "../../protocol/gateway-error";
+import type { ProviderId, ResolvedCredential, ValidatedOutboundFetch } from "../../providers/provider-contracts";
+import { resolveCredentialForAccount } from "../../providers/operations/provider-credential-service";
+import { repriceUsage, usageFromProvider } from "../../providers/provider-usage";
+import type { UsageRecord } from "../../protocol/canonical-model";
+import { parseThinkingSuffix } from "../../protocol/translation/thinking";
+import type { GatewayHandlerDeps } from "./handler-deps";
+
+/**
+ * Whether a scope list contains the named scope. The native handlers used to
+ * force `scopes?.includes(name as never)` — a type-loop hole that bypassed
+ * the `AccessScope` union only to compare runtime strings. The check is the
+ * same, with a real `readonly string[]` receiver.
+ */
+export function hasScope(scopes: readonly string[] | undefined, name: string): boolean {
+  return scopes?.includes(name) === true;
+}
+
+/**
+ * Resolves the credential for one candidate: a real account credential when
+ * the candidate carries an account, otherwise the credential-less `"none"`
+ * credential. Shared by every native handler's `prepare`.
+ */
+export async function resolveAttemptCredential(
+  deps: Pick<GatewayHandlerDeps, "db" | "oauthRefreshService" | "resolveOAuthRefresher">,
+  candidate: { readonly provider_id: string; readonly provider_account_id?: string },
+): Promise<ResolvedCredential> {
+  if (!candidate.provider_account_id) {
+    return {
+      provider_id: candidate.provider_id as ProviderId,
+      credential_kind: "none" as const,
+    };
+  }
+  return resolveCredentialForAccount(
+    deps.db,
+    candidate.provider_id,
+    candidate.provider_account_id,
+    deps.oauthRefreshService && deps.resolveOAuthRefresher
+      ? { refreshService: deps.oauthRefreshService, resolveRefresher: deps.resolveOAuthRefresher }
+      : undefined,
+  );
+}
+
+/** The outbound-fetch context fragment native handlers spread into the dispatch context. */
+export function networkFetchContext(
+  deps: { readonly networkBindingFactory?: GatewayHandlerDeps["networkBindingFactory"] },
+  poolId: string | undefined,
+  tenantId: string | null,
+): { outbound_fetch?: ValidatedOutboundFetch } {
+  if (!deps.networkBindingFactory) return {};
+  return { outbound_fetch: deps.networkBindingFactory.fetch(poolId, tenantId ?? undefined) };
+}
+
+/** Serializes a JSON payload with the shared native-response header set. */
+export function jsonResponse(payload: unknown, status: number, requestId: string): Response {
+  return new Response(JSON.stringify(payload), {
+    status,
+    headers: {
+      "content-type": "application/json",
+      "cache-control": "no-store",
+      "x-request-id": requestId,
+    },
+  });
+}
+
+/**
+ * Strips a thinking suffix (`model(high)`) from the model name and rebuilds
+ * the body with the bare model when it changed. Returns the bare model and
+ * the body to forward upstream.
+ */
+export function stripThinkingSuffix(
+  model: string,
+  body: Record<string, unknown>,
+): { bareModel: string; body: Record<string, unknown> } {
+  const { model: bareModel } = parseThinkingSuffix(model);
+  return { bareModel, body: bareModel === model ? body : { ...body, model: bareModel } };
+}
+
+/**
+ * Validates the ingress body is a non-null object and returns it as a record.
+ * Throws the standard `invalid_request` with the caller's message (kept
+ * per-route so the wire text is unchanged).
+ */
+export function requireRecordBody(
+  state: { readonly authorization?: unknown; readonly ingressBody?: unknown },
+  message: string,
+): Record<string, unknown> {
+  const { authorization, ingressBody } = state;
+  if (!authorization || ingressBody === null || typeof ingressBody !== "object" || Array.isArray(ingressBody))
+    throw new GatewayError("invalid_request", 400, message);
+  return ingressBody as Record<string, unknown>;
+}
+
+/**
+ * Reads usage from an upstream response clone, repricing the reported value (or
+ * the caller's estimate) for the routed provider/model. Shared by the native
+ * handlers that proxy an upstream JSON body verbatim.
+ */
+export async function usageFromUpstreamClone(
+  response: Response,
+  estimate: UsageRecord,
+  providerId: string,
+  modelId: string,
+): Promise<UsageRecord> {
+  let reportedUsage: ReturnType<typeof usageFromProvider>;
+  try {
+    const parsed: unknown = await response.clone().json();
+    reportedUsage = usageFromProvider(
+      typeof parsed === "object" && parsed !== null
+        ? (parsed as Record<string, unknown>)["usage"]
+        : undefined,
+    );
+  } catch {
+    reportedUsage = undefined;
+  }
+  return repriceUsage(reportedUsage ?? estimate, providerId, modelId);
+}
+
+

package/src/transport/dispatch/proxy-request.ts

@@ -41,7 +41,7 @@ import type { PreparedProxyRequest } from "../request/preparer";
 
 import type { GatewayHandlerDeps } from "./handler-deps";
 
-export type ProviderProxyHandlerDeps = GatewayHandlerDeps & {
+type ProviderProxyHandlerDeps = GatewayHandlerDeps & {
   /** Live lookup of a provider's SSRF-validated upstream host. */
   readonly byokUpstreamHosts?: { readonly get: (providerId: string) => ByokUpstreamHost | undefined };
 };
@@ -135,6 +135,7 @@ export async function handleProviderProxyRequest(
         {
           providerId: candidateForPrompt.provider_id,
           modelId: candidateForPrompt.model_id,
+          requestedModel: prepared.plan?.requested_model ?? candidateForPrompt.model_id,
         },
       )?.text
     : undefined;
@@ -239,6 +240,7 @@ export async function handleProviderProxyRequest(
         ...(candidate.output_limit == null ? {} : { output_limit: candidate.output_limit }),
         capabilities: candidate.capability_profile,
         user_agent: candidate.user_agent,
+        ...(candidate.dialect === undefined ? {} : { dialect: candidate.dialect }),
       };
       const candidateRequest =
         candidate.model_id === dispatchRequest.model

package/src/transport/dispatch/responses-compact.ts

@@ -1,11 +1,15 @@
 import { GatewayError } from "../../protocol/gateway-error";
-import { resolveCredentialForAccount } from "../../providers/operations/provider-credential-service";
 import { metrics } from "../../observability/metrics";
-import { parseThinkingSuffix } from "../../protocol/translation/thinking";
 import type { CodexCompactAdapter } from "../../providers/integrations/codex/codex";
 import { completeAttempt, estimatedUsage, nativeCompletionBase } from "./attempt-finalize";
-import { repriceUsage, usageFromProvider } from "../../providers/provider-usage";
 import { runAttemptLoop } from "./attempt-loop";
+import {
+  networkFetchContext,
+  requireRecordBody,
+  resolveAttemptCredential,
+  stripThinkingSuffix,
+  usageFromUpstreamClone,
+} from "./native-shared";
 
 /**
  * The native Codex compaction route (`POST /v1/responses/compact`) and the
@@ -13,7 +17,7 @@ import { runAttemptLoop } from "./attempt-loop";
  */
 import type { GatewayHandlerDeps } from "./handler-deps";
 
-export type ResponsesCompactHandlerDeps = GatewayHandlerDeps;
+type ResponsesCompactHandlerDeps = GatewayHandlerDeps;
 
 /**
  * Handles `POST /v1/responses/compact`: the native Codex compaction proxy. The
@@ -25,10 +29,10 @@ export function createResponsesCompactHandler(deps: ResponsesCompactHandlerDeps)
   return async ({ request }: { request: Request }): Promise<Response> => {
     const state = deps.stateStore.require(request);
     const authorization = state.authorization;
-    const body = state.ingressBody;
-    if (!authorization || body === null || typeof body !== "object" || Array.isArray(body))
-      throw new GatewayError("invalid_request", 400, "compact request body must be a JSON object (request {requestId}). Check the shape of what you sent — then resend 🪞");
-    const compact = body as Record<string, unknown>;
+    const compact = requireRecordBody(
+      state,
+      "compact request body must be a JSON object (request {requestId}). Check the shape of what you sent — then resend 🪞",
+    );
     if (typeof compact.model !== "string" || compact.model.trim().length === 0)
       throw new GatewayError("invalid_request", 400, "model is required (request {requestId}). Check the shape of what you sent — then resend 🪞");
     // A thinking suffix (`model(high)`) is stripped here for the same reason the
@@ -39,9 +43,7 @@ export function createResponsesCompactHandler(deps: ResponsesCompactHandlerDeps)
     // reasoning effort to shape, and the body is passed upstream verbatim.
     // Stripping keeps a client that appends the suffix to every request working
     // here instead of failing with a misleading model-not-found.
-    const { model: compactModel } = parseThinkingSuffix(compact.model);
-    const compactBody: Record<string, unknown> =
-      compactModel === compact.model ? compact : { ...compact, model: compactModel };
+    const { bareModel: compactModel, body: compactBody } = stripThinkingSuffix(compact.model, compact);
     if (!(typeof compact.input === "string" || Array.isArray(compact.input)))
       throw new GatewayError("invalid_request", 400, "input must be a string or array (request {requestId}). Check the shape of what you sent — then resend 🪞");
     if ("instructions" in compact && typeof compact.instructions !== "string")
@@ -57,7 +59,7 @@ export function createResponsesCompactHandler(deps: ResponsesCompactHandlerDeps)
       throw new GatewayError("admission_unavailable", 503, "Codex compact transport unavailable (request {requestId}). The bouncer stepped out — come back shortly 🚪");
     const prepared = await deps.proxyPreparer.prepareNativeCompact({
       model: compactModel,
-      authorization,
+      authorization: authorization!,
       signal: state.abortController.signal,
       ...(state.clientUserAgent === undefined ? {} : { clientUserAgent: state.clientUserAgent }),
     });
@@ -88,14 +90,10 @@ export function createResponsesCompactHandler(deps: ResponsesCompactHandlerDeps)
             503,
             "Codex compact requires an OAuth account (request {requestId}). Wrong key, right door — check the credential 🔑",
           );
-        const credential = await resolveCredentialForAccount(
-          deps.db,
-          "codex",
-          candidate.provider_account_id,
-          deps.oauthRefreshService && deps.resolveOAuthRefresher
-            ? { refreshService: deps.oauthRefreshService, resolveRefresher: deps.resolveOAuthRefresher }
-            : undefined,
-        );
+        const credential = await resolveAttemptCredential(deps, {
+          ...candidate,
+          provider_id: "codex",
+        });
         if (credential.credential_kind !== "oauth")
           throw new GatewayError(
             "capability_unsupported",
@@ -110,36 +108,17 @@ export function createResponsesCompactHandler(deps: ResponsesCompactHandlerDeps)
           credential,
           deadline: state.deadlineMs,
           abort_signal: state.abortController.signal,
-          ...(deps.networkBindingFactory
-            ? {
-                outbound_fetch: deps.networkBindingFactory.fetch(
-                  leases.proxySlot?.poolId,
-                  authorization.tenantId,
-                ),
-              }
-            : {}),
+          ...networkFetchContext(deps, leases.proxySlot?.poolId, authorization!.tenantId),
         });
         // Prefer the usage the compaction endpoint actually reported. The
         // estimate is a fixed 1024+1024 reserve, and compaction is by
         // construction a large-input operation, so charging it unconditionally
-        // let real spend run far past the counter. `usageFromProvider` returns
-        // undefined when the body reported nothing, which keeps the estimate as
-        // the fallback. `response.clone()` leaves the body readable for the
-        // client.
-        let reportedUsage: ReturnType<typeof usageFromProvider>;
-        try {
-          const parsed: unknown = await response.clone().json();
-          reportedUsage = usageFromProvider(
-            typeof parsed === "object" && parsed !== null
-              ? (parsed as Record<string, unknown>)["usage"]
-              : undefined,
-          );
-        } catch {
-          reportedUsage = undefined;
-        }
-        const usage = repriceUsage(
-          reportedUsage ??
-            estimatedUsage(prepared.estimatedInputTokens, prepared.estimatedOutputTokens),
+        // let real spend run far past the counter. `usageFromUpstreamClone`
+        // falls back to the estimate when the body reported nothing, and
+        // `response.clone()` leaves the body readable for the client.
+        const usage = await usageFromUpstreamClone(
+          response,
+          estimatedUsage(prepared.estimatedInputTokens, prepared.estimatedOutputTokens),
           candidate.provider_id,
           candidate.model_id,
         );