fix(api): bound /api/grade on slow or failing Gemini calls

[lautaropaske]

Summary

Fixes found in 7 days of open-silver logs in Dash0: a /api/grade call that ran 235s, a Gemini gateway 503 reported as our own 500, pdf.js warnings logged as INFO, and Vercel installing with npm.

 POST /api/grade
+  deadline = AbortSignal.timeout(60s)
-  pdf(buffer)
+  parseResume(buffer)            # pdf.js "Warning: …" → console.warn
-  generateObject(...)
+  generateObject(..., abortSignal: deadline)
   catch
     ResumeFetchError      → 4xx
     invalid PDF           → 400
+    deadline.aborted      → 504 GradingTimeout
+    gateway 5xx           → 503 GradingUnavailable
     anything else         → 500 GradingError

• The AI SDK only retries APICallError, and GatewayError isn't one. So a gateway 503 failed on the first attempt.
• A timed-out request comes back from the gateway as a GatewayResponseError with status 500. That's why the timeout check runs before the gateway-5xx check.
• The client shows Spanish messages for both new codes.
• package-lock.json is deleted, so Vercel builds with bun the same way CI does. @ai-sdk/gateway is now a direct dependency so the route can check GatewayError.isInstance.

Evidence

• Before (Dash0, last 7 days): POST /api/grade took 235s, 96s and 61s on its slowest calls. On Oct 3 20:33 a GatewayInternalServerError (503) was returned to the user as 500 GradingError. Warning: TT: undefined function was logged about 100 times at INFO. Vercel build logs show npm warn ERESOLVE for typescript.
  After (local dev server):

  deadline set to 1ms + fake gateway key  → 504 {"error":"GradingTimeout"}
  PDF with corrupted xref                 → "Warning: Indexing all PDF objects" on stderr, nothing on stdout
  no gateway key (401)                    → 500 GradingError (unchanged; a 4xx is a config problem)
  

• Tests: 73 pass (bun run test), plus bun tsc and lint.

  gateway 503 rejection        → 503 GradingUnavailable
  gateway 429 rejection        → 500 GradingError
  deadline already aborted     → 504 GradingTimeout, signal passed to generateObject
  parseResume                  → "Warning: …" goes to console.warn, other output stays on console.log
  concurrent parses            → console.log restored only after the last one finishes
  

• I didn't check the error message in a browser: the connected Chrome couldn't reach the local dev server.

Merge Danger

Door: two-way

Revert the commits to undo everything. Restoring package-lock.json on its own would put Vercel back on npm.

Blast Radius: resume-checker

• Gradings that used to finish between 60s and 300s now return 504. In the last 7 days that was 3 of 618 requests.
• The first Vercel build after merge installs with bun instead of npm. Watch that deploy.
• While a resume is being parsed, console.log is patched for the whole process. Only lines starting with Warning: are redirected.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
open-silver	Ready	Preview	Oct 5, 2026 12:52pm UTC