sql-dialect-master 1.1.4__tar.gz → 1.1.6__tar.gz

{sql_dialect_master-1.1.4 → sql_dialect_master-1.1.6}/PKG-INFO

@@ -1,12 +1,11 @@
 Metadata-Version: 2.4
 Name: sql-dialect-master
-Version: 1.1.4
+Version: 1.1.6
 Summary: SQL Dialect Master - Multi-database SQL conversion engine
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: sqlglot<31.0.0,>=30.18.0
-Requires-Dist: streamlit>=1.38.0
 Requires-Dist: fastapi>=0.115.0
 Requires-Dist: uvicorn>=0.30.0
 Requires-Dist: pydantic>=2.9.0
@@ -36,12 +35,12 @@ Dynamic: license-file
 
 Enterprise-grade multi-database SQL conversion engine supporting 12 database dialects.
 
-Current release: 1.1.4
+Current release: 1.1.6
 
 [![Python 3.11+](https://img.shields.io/badge/python-3.11+-blue.svg)](https://www.python.org/downloads/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![FastAPI](https://img.shields.io/badge/FastAPI-0.115+-green.svg)](https://fastapi.tiangolo.com/)
-[![Streamlit](https://img.shields.io/badge/Streamlit-1.38+-red.svg)](https://streamlit.io/)
+[![React](https://img.shields.io/badge/React-19-61DAFB.svg)](https://react.dev/)
 
 ## ✨ Features
 
@@ -58,7 +57,7 @@ Current release: 1.1.4
 | 🔧 **Rule Engine** | Deterministic priority ordering, compiled patterns, dialect-aware conflict detection |
 | 🛡️ **Security Validation** | Statement-level stacked-query detection with configurable blocking policy |
 | ⚡ **Performance** | Rule-aware cache versioning, bounded async batch conversion, and reproducible benchmark |
-| 🎨 **Modern UI** | Streamlit developer workspace: dark / light theme system, sidebar navigation, command palette |
+| 🎨 **Modern UI** | React developer workspace with dark / light themes, responsive navigation, and command palette |
 
 ## 💾 Supported Databases
 
@@ -96,20 +95,24 @@ For database-backed semantic tests:
 .venv/bin/python -m pip install -e ".[dev,semantic]"
 ```
 
-### Run Streamlit UI (Recommended)
+### Run the React UI
 
-```bash
-streamlit run sdm_local_v2.py
-```
-
-After installing the package, the same workspace can be launched from any
-working directory with:
+The React workspace is the product frontend and runs independently from the
+Python package. Start the API first, then run:
 
 ```bash
-sdm-streamlit
+cd frontend-react
+npm install
+npm run dev
 ```
 
-Open http://localhost:8501 in your browser.
+Open http://localhost:5174. The Vite development proxy forwards `/api`,
+`/health`, and `/ready` to `http://127.0.0.1:8000`. Set `VITE_API_BASE_URL`
+for a separately deployed API, or configure the URL and optional API key in
+the React Settings page.
+
+React implementation goals and gates are tracked in
+[`docs/react-frontend-refactor-plan.md`](docs/react-frontend-refactor-plan.md).
 
 ### Run FastAPI Backend
 
@@ -270,42 +273,16 @@ sql-dialect-master/
 │   │   └── validators.py        # Input validation
 │   │
 │   └── tests/                   # Test suite and regression coverage
-├── frontend/                    # Streamlit UI Components (v2 architecture)
-│   ├── core/                    # Cross-cutting concerns
-│   │   ├── design_tokens.py     # Theme model (dark/light) + semantic status
-│   │   ├── navigation.py        # NavigationIntent contract
-│   │   ├── state.py             # SessionState adapter
-│   │   ├── themes.py            # Theme switching (dark/light only)
-│   │   ├── styles.py            # CSS generation from design tokens
-│   │   ├── escaping.py          # HTML-safe rendering helpers
-│   │   └── viewmodels.py        # Typed view models
-│   ├── pages/                   # One module per workspace page
-│   │   ├── convert.py
-│   │   ├── nl2sql.py
-│   │   ├── diff.py
-│   │   ├── lineage.py
-│   │   ├── runtime.py
-│   │   ├── functions.py
-│   │   ├── types.py
-│   │   ├── templates.py
-│   │   ├── history.py
-│   │   ├── settings.py
-│   │   └── query_analysis.py
-│   ├── ui/                      # Reusable UI widgets
-│   │   ├── command_palette.py
-│   │   ├── diff.py
-│   │   ├── editor.py
-│   │   └── status.py
-│   ├── app_context_v2.py        # Shared application context (v2)
-│   └── templates_v2.py          # SQL templates (v2)
 ├── examples/
 │   ├── api_client.py             # API usage examples
 │   └── basic_usage.py            # SDK usage examples
 ├── scripts/
 │   └── verify_readme_consistency.py # README source-of-truth checks
-├── sdm_local_v2.py             # Streamlit Application Entry (v2)
+├── frontend-react/              # React + TypeScript product frontend
+│   ├── src/
+│   ├── package.json
+│   └── vite.config.ts
 ├── pyproject.toml               # Project configuration
-├── requirements.txt              # Legacy/runtime dependency list
 ├── .env.example                 # Environment template
 ├── LICENSE                      # MIT License
 └── README.md

{sql_dialect_master-1.1.4 → sql_dialect_master-1.1.6}/README.md

@@ -2,12 +2,12 @@
 
 Enterprise-grade multi-database SQL conversion engine supporting 12 database dialects.
 
-Current release: 1.1.4
+Current release: 1.1.6
 
 [![Python 3.11+](https://img.shields.io/badge/python-3.11+-blue.svg)](https://www.python.org/downloads/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![FastAPI](https://img.shields.io/badge/FastAPI-0.115+-green.svg)](https://fastapi.tiangolo.com/)
-[![Streamlit](https://img.shields.io/badge/Streamlit-1.38+-red.svg)](https://streamlit.io/)
+[![React](https://img.shields.io/badge/React-19-61DAFB.svg)](https://react.dev/)
 
 ## ✨ Features
 
@@ -24,7 +24,7 @@ Current release: 1.1.4
 | 🔧 **Rule Engine** | Deterministic priority ordering, compiled patterns, dialect-aware conflict detection |
 | 🛡️ **Security Validation** | Statement-level stacked-query detection with configurable blocking policy |
 | ⚡ **Performance** | Rule-aware cache versioning, bounded async batch conversion, and reproducible benchmark |
-| 🎨 **Modern UI** | Streamlit developer workspace: dark / light theme system, sidebar navigation, command palette |
+| 🎨 **Modern UI** | React developer workspace with dark / light themes, responsive navigation, and command palette |
 
 ## 💾 Supported Databases
 
@@ -62,20 +62,24 @@ For database-backed semantic tests:
 .venv/bin/python -m pip install -e ".[dev,semantic]"
 ```
 
-### Run Streamlit UI (Recommended)
+### Run the React UI
 
-```bash
-streamlit run sdm_local_v2.py
-```
-
-After installing the package, the same workspace can be launched from any
-working directory with:
+The React workspace is the product frontend and runs independently from the
+Python package. Start the API first, then run:
 
 ```bash
-sdm-streamlit
+cd frontend-react
+npm install
+npm run dev
 ```
 
-Open http://localhost:8501 in your browser.
+Open http://localhost:5174. The Vite development proxy forwards `/api`,
+`/health`, and `/ready` to `http://127.0.0.1:8000`. Set `VITE_API_BASE_URL`
+for a separately deployed API, or configure the URL and optional API key in
+the React Settings page.
+
+React implementation goals and gates are tracked in
+[`docs/react-frontend-refactor-plan.md`](docs/react-frontend-refactor-plan.md).
 
 ### Run FastAPI Backend
 
@@ -236,42 +240,16 @@ sql-dialect-master/
 │   │   └── validators.py        # Input validation
 │   │
 │   └── tests/                   # Test suite and regression coverage
-├── frontend/                    # Streamlit UI Components (v2 architecture)
-│   ├── core/                    # Cross-cutting concerns
-│   │   ├── design_tokens.py     # Theme model (dark/light) + semantic status
-│   │   ├── navigation.py        # NavigationIntent contract
-│   │   ├── state.py             # SessionState adapter
-│   │   ├── themes.py            # Theme switching (dark/light only)
-│   │   ├── styles.py            # CSS generation from design tokens
-│   │   ├── escaping.py          # HTML-safe rendering helpers
-│   │   └── viewmodels.py        # Typed view models
-│   ├── pages/                   # One module per workspace page
-│   │   ├── convert.py
-│   │   ├── nl2sql.py
-│   │   ├── diff.py
-│   │   ├── lineage.py
-│   │   ├── runtime.py
-│   │   ├── functions.py
-│   │   ├── types.py
-│   │   ├── templates.py
-│   │   ├── history.py
-│   │   ├── settings.py
-│   │   └── query_analysis.py
-│   ├── ui/                      # Reusable UI widgets
-│   │   ├── command_palette.py
-│   │   ├── diff.py
-│   │   ├── editor.py
-│   │   └── status.py
-│   ├── app_context_v2.py        # Shared application context (v2)
-│   └── templates_v2.py          # SQL templates (v2)
 ├── examples/
 │   ├── api_client.py             # API usage examples
 │   └── basic_usage.py            # SDK usage examples
 ├── scripts/
 │   └── verify_readme_consistency.py # README source-of-truth checks
-├── sdm_local_v2.py             # Streamlit Application Entry (v2)
+├── frontend-react/              # React + TypeScript product frontend
+│   ├── src/
+│   ├── package.json
+│   └── vite.config.ts
 ├── pyproject.toml               # Project configuration
-├── requirements.txt              # Legacy/runtime dependency list
 ├── .env.example                 # Environment template
 ├── LICENSE                      # MIT License
 └── README.md

{sql_dialect_master-1.1.4 → sql_dialect_master-1.1.6}/backend/api/main.py

@@ -12,59 +12,135 @@ Exact counts are derived from the canonical data files at runtime —
 see backend.core.metadata — and must not be restated here.
 """
 import asyncio
+import atexit
+import copy
 import logging
 import time
 from contextlib import asynccontextmanager
+from dataclasses import asdict
 from datetime import datetime
+from functools import lru_cache
+from threading import Lock
 from typing import Any, Dict, List, Optional
 
 from fastapi import Depends, FastAPI, HTTPException, Query, Request
 from fastapi.middleware.cors import CORSMiddleware
+from fastapi.middleware.gzip import GZipMiddleware
 from fastapi.responses import JSONResponse
 from pydantic import BaseModel, ConfigDict, Field
 
-from backend.core.config import get_dialect_api_info, settings, setup_logging
+from backend.api.auth import require_api_access
+from backend.api.rate_limit_store import InMemoryRateLimitStore
+from backend.api.readiness import health_probe_response
+from backend.api.workers import BoundedWorkerPool, WorkerCapacityError
 from backend.core import metadata as meta
+from backend.core.config import get_dialect_api_info, settings, setup_logging
 from backend.core.functions_lookup import FunctionEncyclopedia
 from backend.core.nl2sql import NL2SQLGenerator
 from backend.core.nl2sql_pipeline.orchestrator import SAFE_TABLE_HINT
 from backend.core.parser import SUPPORTED_DIALECTS, SQLParser
+from backend.core.semantic_diff import diff_sql_ast
 from backend.core.transpiler import SQLTranspiler
 from backend.core.type_mapping import TypeMapper
 
-from backend.api.readiness import health_probe_response
-from backend.api.auth import require_api_access
-from backend.api.workers import BoundedWorkerPool, WorkerCapacityError
-from backend.api.rate_limit_store import InMemoryRateLimitStore
-
 # Configure logging for the application from the validated settings object.
 # Keep an INFO fallback for defensive compatibility with custom settings
 # objects, while normal AppSettings values are resolved from SDM_LOG_LEVEL.
 _log_level = getattr(logging, settings.log_level.upper(), logging.INFO)
 logger = setup_logging(level=_log_level, log_file=settings.log_file or None)
 api_logger = logging.getLogger(__name__)
-_worker_pool = BoundedWorkerPool(settings.api_workers, settings.api_queue_size)
+_worker_pool: BoundedWorkerPool | None = None
+_worker_pool_lock = Lock()
+_worker_pool_exit_hook = None
+
+
+def _get_worker_pool() -> BoundedWorkerPool:
+    """Return the process-wide pool, creating it lazily for non-ASGI callers.
+
+    ``app`` is intentionally resolved when this helper is called, after the
+    module-level FastAPI application has been initialized.  This keeps import
+    time free of executor creation while preserving the ASGI/non-ASGI split.
+    """
+    state_pool = getattr(app.state, "worker_pool", None)
+    if state_pool is not None:
+        return state_pool
+
+    global _worker_pool, _worker_pool_exit_hook
+    with _worker_pool_lock:
+        if _worker_pool is None:
+            _worker_pool = BoundedWorkerPool(settings.api_workers, settings.api_queue_size)
+            # Direct callers (benchmarks/tests/scripts) do not enter the ASGI
+            # lifespan, so give their lazily-created pool a process shutdown
+            # hook instead of leaving executor threads alive indefinitely.
+            _worker_pool_exit_hook = _worker_pool.shutdown
+            atexit.register(_worker_pool_exit_hook)
+        return _worker_pool
+
+
+def shutdown_worker_pool() -> None:
+    """Explicitly release a lazily-created non-ASGI worker pool.
+
+    Scripts and benchmarks should call this when their work is complete. The
+    atexit hook is retained only as a final safety net and is unregistered
+    before shutdown, so explicit and process-exit cleanup cannot run twice.
+    """
+    global _worker_pool, _worker_pool_exit_hook
+    with _worker_pool_lock:
+        pool = _worker_pool
+        hook = _worker_pool_exit_hook
+        _worker_pool = None
+        _worker_pool_exit_hook = None
+        if hook is not None:
+            atexit.unregister(hook)
+    if pool is not None:
+        pool.shutdown()
+
+
+@lru_cache(maxsize=len(SUPPORTED_DIALECTS))
+def _get_sql_parser(dialect: str) -> SQLParser:
+    """Return the immutable parser shell shared by parse requests.
+
+    ``SQLParser`` stores only the normalized dialect and stateless extraction
+    helpers.  Reusing one instance per dialect avoids constructing the same
+    object for every request while keeping request-specific AST/results local
+    to the worker that executes them.
+    """
+    return SQLParser(dialect)
+
+
+@lru_cache(maxsize=256)
+def _parse_elements_cached(dialect: str, sql: str) -> dict[str, Any]:
+    """Cache bounded parser extraction results for repeated API queries."""
+    return _get_sql_parser(dialect).extract_elements(sql)
 
 
 @asynccontextmanager
 async def lifespan(application: FastAPI):
     """Manage the service worker pool for a normal ASGI startup/shutdown."""
-    pool = BoundedWorkerPool(settings.api_workers, settings.api_queue_size)
+    pool = _get_worker_pool()
     application.state.worker_pool = pool
     try:
         yield
     finally:
-        pool.shutdown()
-        del application.state.worker_pool
+        if _worker_pool is pool:
+            shutdown_worker_pool()
+        else:
+            pool.shutdown()
+        if getattr(application.state, "worker_pool", None) is pool:
+            del application.state.worker_pool
 
 
 async def _run_cpu_bound(func, *args):
     """Run parser/transpiler work off-loop with the configured timeout."""
     try:
-        pool = getattr(app.state, "worker_pool", _worker_pool)
+        pool = _get_worker_pool()
         return await pool.run(func, *args, timeout=settings.request_timeout)
     except WorkerCapacityError as exc:
-        raise HTTPException(status_code=503, detail=str(exc), headers={"Retry-After": "1"}) from exc
+        raise HTTPException(
+            status_code=503,
+            detail=str(exc),
+            headers={"Retry-After": "1"},
+        ) from exc
     except asyncio.TimeoutError as exc:
         raise HTTPException(
             status_code=504,
@@ -174,9 +250,28 @@ app.add_middleware(
     allow_origins=ALLOWED_ORIGINS,
     allow_credentials=True,
     allow_methods=["GET", "POST", "OPTIONS"],  # Restrict to needed methods
-    allow_headers=["Content-Type", "Authorization", "X-API-Key", "X-Request-ID"],
+    # Keep preflight explicit so browser clients can send the correlation and
+    # API-key headers used by the React request layer.  Expose operational
+    # response headers as well: without this list browsers silently hide
+    # Retry-After and request timing/correlation metadata from JavaScript even
+    # though the server emits them correctly.
+    allow_headers=["Accept", "Content-Type", "Authorization", "X-API-Key", "X-Request-ID"],
+    expose_headers=[
+        "Retry-After",
+        "X-API-Version",
+        "X-Process-Time",
+        "X-RateLimit-Limit",
+        "X-RateLimit-Remaining",
+        "X-RateLimit-Reset",
+        "X-Request-ID",
+    ],
 )
 
+# Type/function matrices and conversion reports are often much larger than
+# the request itself.  Compress them at the ASGI boundary so browser clients
+# spend less time waiting on the network without changing response schemas.
+app.add_middleware(GZipMiddleware, minimum_size=1024, compresslevel=5)
+
 # Add security headers
 app.add_middleware(SecurityHeadersMiddleware)
 
@@ -204,9 +299,12 @@ nl2sql_generator = NL2SQLGenerator()
 # Request timing middleware with logging
 @app.middleware("http")
 async def add_process_time_header(request: Request, call_next):
-    start_time = time.time()
+    # ``perf_counter`` is monotonic and high resolution.  Wall-clock time can
+    # jump when NTP adjusts the host clock, which would otherwise produce a
+    # negative or wildly inflated duration header and log entry.
+    start_time = time.perf_counter()
     response = await call_next(request)
-    process_time = time.time() - start_time
+    process_time = time.perf_counter() - start_time
     response.headers["X-Process-Time"] = f"{process_time:.4f}s"
     response.headers["X-API-Version"] = API_VERSION
 
@@ -323,6 +421,15 @@ class ParseRequest(BaseModel):
     sql: str = Field(..., description="SQL statement to parse")
     dialect: str = Field("hive", description="SQL dialect")
 
+
+class DiffRequest(BaseModel):
+    """Semantic SQL comparison request."""
+
+    source_sql: str = Field(..., description="Source SQL statement")
+    target_sql: str = Field(..., description="Target SQL statement")
+    source_dialect: str = Field(..., description="Source SQL dialect")
+    target_dialect: str = Field(..., description="Target SQL dialect")
+
 class TypeMapRequest(BaseModel):
     """Type mapping request model."""
     type_name: str = Field(..., description="Source data type name")
@@ -487,8 +594,8 @@ async def parse_sql(request: ParseRequest):
     Extracts tables, columns, functions, and other elements from SQL.
     """
     dialect = normalize_dialect(request.dialect)
-    parser = SQLParser(dialect)
-    elements = await _run_cpu_bound(parser.extract_elements, request.sql)
+    elements = await _run_cpu_bound(_parse_elements_cached, dialect, request.sql)
+    elements = copy.deepcopy(elements)
     if "error" in elements:
         raise HTTPException(status_code=422, detail=elements["error"] or "SQL parsing failed")
     return {
@@ -498,6 +605,25 @@ async def parse_sql(request: ParseRequest):
         "timestamp": datetime.now().isoformat()
     }
 
+
+@app.post("/api/diff", tags=["conversion"])
+async def compare_semantic_diff(request: DiffRequest):
+    """Compare source and target SQL without executing either statement."""
+    source_dialect = normalize_dialect(request.source_dialect, "source dialect")
+    target_dialect = normalize_dialect(request.target_dialect, "target dialect")
+    result = await _run_cpu_bound(
+        diff_sql_ast,
+        request.source_sql,
+        request.target_sql,
+        source_dialect,
+        target_dialect,
+    )
+    payload = asdict(result)
+    payload["success"] = True
+    if result.parse_error:
+        payload["error"] = result.parse_error
+    return payload
+
 @app.get("/api/functions", tags=["functions"])
 async def list_functions(
     search: Optional[str] = Query(None, description="Search term for function name"),
@@ -523,7 +649,10 @@ async def list_functions(
                         + ", ".join(func_encyclopedia.CATEGORIES)),
             )
     if search:
-        functions = func_encyclopedia.search(search, limit)
+        # The search cache applies the category predicate before ranking and
+        # the public limit, so category-filtered queries do not scan or copy
+        # unrelated function records.
+        functions = func_encyclopedia.search(search, limit, normalized_category)
     elif category:
         functions = func_encyclopedia.list_by_category(normalized_category)[:limit]
     else:
@@ -594,9 +723,13 @@ async def list_types(
     if target is not None:
         target = normalize_dialect(target, "target dialect")
     matrix = type_mapper.get_matrix(source, target)
+    mappings = [
+        {"type": type_name, **mapping}
+        for type_name, mapping in matrix.items()
+    ] if isinstance(matrix, dict) else list(matrix)
     return {
         "success": True,
-        "mappings": matrix,
+        "mappings": mappings,
         "dialects": type_mapper.DIALECTS,
         "type_count": len(matrix),
         "precision_warnings": type_mapper.get_precision_warnings()
@@ -747,13 +880,17 @@ async def get_stats():
 # Custom exception handler for better error responses
 @app.exception_handler(HTTPException)
 async def custom_http_exception_handler(request: Request, exc: HTTPException):
+    error_code_by_status = {
+        503: ErrorCode.SERVICE_UNAVAILABLE.value,
+        504: ErrorCode.REQUEST_TIMEOUT.value,
+    }
     return JSONResponse(
         status_code=exc.status_code,
         headers=exc.headers,
         content={
             "success": False,
             "error": {
-                "code": exc.status_code,
+                "code": error_code_by_status.get(exc.status_code, exc.status_code),
                 "message": exc.detail,
                 "type": "HTTPException"
             },

{sql_dialect_master-1.1.4 → sql_dialect_master-1.1.6}/backend/api/middleware.py

@@ -3,6 +3,7 @@
 
 Provides rate limiting, request-size protection, logging, and security headers.
 """
+import gzip
 import json
 import logging
 import time
@@ -108,13 +109,22 @@ class RateLimitMiddleware(BaseHTTPMiddleware):
             request.url.path in {"/health", "/", "/ready", "/health/deep"}
             and request.method in {"GET", "HEAD"}
         )
+        # Browser CORS preflight requests carry no business payload and are
+        # generated automatically before the actual API call.  Counting them
+        # against the application rate limit can make an otherwise healthy
+        # client fail before it reaches the endpoint, especially when each
+        # request uses a non-simple X-Request-ID or X-API-Key header.
+        is_cors_preflight = request.method == "OPTIONS" and bool(
+            request.headers.get("origin")
+            and request.headers.get("access-control-request-method")
+        )
 
         # Apply rate limiting before JSON/body parsing.  This prevents a
         # client from spending unbounded CPU on invalid payloads while still
         # keeping the request-size guard active when rate limiting is disabled.
         rate_limit_checked = False
         remaining = reset_time = None
-        if self.enabled and not is_health_probe:
+        if self.enabled and not is_health_probe and not is_cors_preflight:
             client_id = self._get_client_id(request)
             # Redis checks use a synchronous client; a stalled store must not
             # block the event loop used by unrelated liveness/API requests.
@@ -173,11 +183,18 @@ class StructuredLoggingMiddleware(BaseHTTPMiddleware):
 
     @staticmethod
     def _get_request_id(request: Request) -> str:
-        """Reuse a valid RFC 4122 request ID; otherwise issue a fresh UUID."""
+        """Reuse a valid request ID; otherwise issue a fresh UUID.
+
+        The React client prefixes UUIDs with ``web-`` to identify browser
+        traffic.  Keep accepting the prefix while still validating the UUID
+        payload so arbitrary header values cannot be copied into logs or
+        response headers.
+        """
         candidate = request.headers.get("X-Request-ID")
         if candidate:
+            uuid_candidate = candidate.removeprefix("web-")
             try:
-                parsed = uuid.UUID(candidate)
+                parsed = uuid.UUID(uuid_candidate)
                 if parsed.variant == uuid.RFC_4122:
                     return candidate
             except (ValueError, AttributeError, TypeError):
@@ -203,6 +220,13 @@ class StructuredLoggingMiddleware(BaseHTTPMiddleware):
         if "json" not in response.headers.get("content-type", "").lower():
             return response
 
+        # BaseHTTPMiddleware often returns a streaming response even when the
+        # endpoint produced JSON.  Buffer that stream exactly once for
+        # normalization, but replay the original bytes when the payload is
+        # malformed so an error response is never silently emptied.
+        encoded_with_gzip = "gzip" in response.headers.get("content-encoding", "").lower()
+        streamed_body = not hasattr(response, "body")
+        raw_body = b""
         try:
             if hasattr(response, "body"):
                 raw_body = response.body
@@ -211,9 +235,44 @@ class StructuredLoggingMiddleware(BaseHTTPMiddleware):
                 async for chunk in response.body_iterator:
                     chunks.append(chunk)
                 raw_body = b"".join(chunks)
-            payload = json.loads(raw_body.decode("utf-8"))
-        except (AttributeError, UnicodeDecodeError, json.JSONDecodeError):
+            # GZipMiddleware is inside this middleware.  Error responses over
+            # its threshold therefore arrive compressed; decode them before
+            # applying the stable JSON envelope so large and small errors have
+            # identical browser-visible contracts.
+            if encoded_with_gzip:
+                raw_body = gzip.decompress(raw_body)
+        except (AttributeError, TypeError):
             return response
+        except (OSError, EOFError):
+            # A malformed compressed stream must remain observable to the
+            # caller.  If it was buffered from a streaming response, replay
+            # the original bytes instead of returning an already-consumed
+            # iterator.
+            if not streamed_body:
+                return response
+            headers = dict(response.headers)
+            headers.pop("content-length", None)
+            return Response(
+                content=raw_body,
+                status_code=response.status_code,
+                headers=headers,
+                background=response.background,
+            )
+        try:
+            payload = json.loads(raw_body.decode("utf-8"))
+        except (AttributeError, TypeError, UnicodeDecodeError, json.JSONDecodeError, OSError):
+            if hasattr(response, "body"):
+                return response
+            headers = dict(response.headers)
+            headers.pop("content-length", None)
+            if encoded_with_gzip:
+                headers.pop("content-encoding", None)
+            return Response(
+                content=raw_body,
+                status_code=response.status_code,
+                headers=headers,
+                background=response.background,
+            )
 
         if response.status_code == 503 and isinstance(payload, dict) and "checks" in payload:
             # Readiness has a public diagnostics schema of its own. Preserve
@@ -222,6 +281,7 @@ class StructuredLoggingMiddleware(BaseHTTPMiddleware):
             headers = dict(response.headers)
             headers.pop("content-length", None)
             headers.pop("content-type", None)
+            headers.pop("content-encoding", None)
             payload.setdefault("request_id", request_id)
             return JSONResponse(status_code=503, content=payload, headers=headers)
 
@@ -274,10 +334,14 @@ class StructuredLoggingMiddleware(BaseHTTPMiddleware):
         headers = dict(response.headers)
         headers.pop("content-length", None)
         headers.pop("content-type", None)
+        headers.pop("content-encoding", None)
         return JSONResponse(status_code=response.status_code, content=normalized, headers=headers)
 
     async def dispatch(self, request: Request, call_next) -> Response:
-        start_time = time.time()
+        # Request duration is an elapsed interval, so use a monotonic clock.
+        # ``time.time()`` may move backwards/forwards during a wall-clock
+        # correction and corrupt both logs and latency metrics.
+        start_time = time.perf_counter()
         request_id = self._get_request_id(request)
         request.state.request_id = request_id
         status_code = 500
@@ -292,7 +356,7 @@ class StructuredLoggingMiddleware(BaseHTTPMiddleware):
             error = _sanitize_log_value(str(exc))
             raise
         finally:
-            process_time = time.time() - start_time
+            process_time = time.perf_counter() - start_time
             log_data = {"event": "request_end", "request_id": request_id, "method": _sanitize_log_value(request.method), "path": _sanitize_log_value(request.url.path), "status_code": status_code, "process_time_ms": round(process_time * 1000, 2), "error": error, "timestamp": datetime.now().isoformat()}
             (logger.warning if status_code >= 400 else logger.info)(json.dumps(log_data))
         response.headers["X-Request-ID"] = request_id