@juspay/neurolink 13.8.17 → 13.8.19

package/dist/auth/tokenStore.js

@@ -15,13 +15,33 @@
 import { promises as fs } from "fs";
 import { join } from "path";
 import { homedir } from "os";
-import { createHash } from "crypto";
+import { createHash, randomUUID } from "crypto";
 import { logger } from "../utils/logger.js";
 import { TokenStoreError } from "../types/index.js";
 import { AsyncMutex } from "../utils/asyncMutex.js";
 import { withSpan } from "../telemetry/withSpan.js";
 import { tracers } from "../telemetry/tracers.js";
-const { readFile, writeFile, mkdir, unlink, access, chmod, rename } = fs;
+import { ensurePrivateDirectory, writePrivateFileAtomically, } from "./secureFiles.js";
+const { readFile, unlink, access, rename, open, rm, stat } = fs;
+/** Marks a store written with the UTF-8-safe codec; older files carry no prefix. */
+const OBFUSCATION_V2_PREFIX = "nlts2:";
+/** Cross-process lock: how long a writer waits for another process's turn. */
+const FILE_LOCK_TIMEOUT_MS = 5_000;
+/** A lock older than this whose owner is gone is abandoned and removed. */
+const FILE_LOCK_STALE_MS = 30_000;
+const FILE_LOCK_RETRY_MS = 25;
+function processIsRunning(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === "EPERM";
+    }
+}
+async function sleep(ms) {
+    await new Promise((resolve) => setTimeout(resolve, ms));
+}
 // =============================================================================
 // TOKEN STORE CLASS
 // =============================================================================
@@ -62,12 +82,12 @@ export class TokenStore {
     static NEUROLINK_DIR = ".neurolink";
     static TOKEN_FILE = "tokens.json";
     static FILE_PERMISSIONS = 0o600;
-    static DIR_PERMISSIONS = 0o700;
     /** Default expiration buffer: 1 hour (proactive refresh before actual expiry) */
     static DEFAULT_EXPIRY_BUFFER_MS = 60 * 60 * 1000;
     storagePath;
     encryptionEnabled;
     encryptionKey;
+    encryptionKeyBytes;
     tokenRefreshers = new Map();
     inFlightRefreshes = new Map();
     _mutex = new AsyncMutex();
@@ -83,6 +103,7 @@ export class TokenStore {
         const { encryptionEnabled = true, customStoragePath } = options;
         this.encryptionEnabled = encryptionEnabled;
         this.encryptionKey = this.deriveEncryptionKey();
+        this.encryptionKeyBytes = this.deriveEncryptionKeyBytes();
         if (customStoragePath) {
             this.storagePath = customStoragePath;
         }
@@ -117,7 +138,7 @@ export class TokenStore {
                 "auth.has_refresh_token": Boolean(tokens.refreshToken),
                 "auth.token_type": tokens.tokenType,
             },
-        }, async () => this._mutex.runExclusive(async () => {
+        }, async () => this.runExclusiveLocked(async () => {
             await this._saveTokensInternal(provider, tokens);
         }));
     }
@@ -127,8 +148,7 @@ export class TokenStore {
     async _saveTokensInternal(provider, tokens) {
         // Validate tokens before saving
         this.validateTokens(tokens);
-        const storageDir = join(this.storagePath, "..");
-        await this.ensureDirectory(storageDir);
+        await this.ensureDirectory(join(this.storagePath, ".."));
         // Load existing data or create new
         let storageData;
         try {
@@ -165,17 +185,7 @@ export class TokenStore {
         };
         storageData.lastModified = now;
         try {
-            const content = this.encryptionEnabled
-                ? this.obfuscate(JSON.stringify(storageData))
-                : JSON.stringify(storageData, null, 2);
-            // Write to temporary file first for atomic operation
-            // Use PID-scoped temp file to avoid cross-process race conditions
-            const tempPath = `${this.storagePath}.tmp.${process.pid}`;
-            await writeFile(tempPath, content, "utf-8");
-            // Set restrictive permissions before moving to final location
-            await chmod(tempPath, TokenStore.FILE_PERMISSIONS);
-            // Rename to final location (atomic on most filesystems)
-            await fs.rename(tempPath, this.storagePath);
+            await this.writeStorageFile(storageData);
             logger.debug("OAuth tokens saved successfully", {
                 provider,
                 path: this.storagePath,
@@ -269,9 +279,10 @@ export class TokenStore {
                 logger.debug("No stored tokens found for provider", { provider });
                 return null;
             }
-            // Update last accessed time
+            // Access time is bookkeeping, not state: rewriting the whole store on
+            // every read raced other processes' writes (a stale snapshot written late
+            // reverted a rotated refresh token or a disable flag).
             providerData.lastAccessed = Date.now();
-            await this.saveStorageData(storageData);
             logger.debug("OAuth tokens retrieved successfully", {
                 provider,
                 expiresAt: new Date(providerData.tokens.expiresAt).toISOString(),
@@ -300,7 +311,7 @@ export class TokenStore {
         }, async () => this._clearTokensImpl(provider));
     }
     async _clearTokensImpl(provider) {
-        return this._mutex.runExclusive(async () => {
+        return this.runExclusiveLocked(async () => {
             // Clear in-memory refresh state so re-adding an account starts fresh
             this.inFlightRefreshes.delete(provider);
             this.tokenRefreshers.delete(provider);
@@ -430,7 +441,7 @@ export class TokenStore {
             // Also guard against resurrecting cleared/disabled entries:
             // if the entry was removed or disabled during the in-flight refresh,
             // skip the save to avoid re-creating a dead entry.
-            const persistedTokens = await this._mutex.runExclusive(async () => {
+            const persistedTokens = await this.runExclusiveLocked(async () => {
                 // Guard: do not resurrect cleared entries
                 const current = await this._loadTokensInternal(provider);
                 if (!current) {
@@ -552,7 +563,7 @@ export class TokenStore {
      * @param reason - Optional human-readable reason (e.g., "refresh_failed")
      */
     async markDisabled(provider, reason) {
-        return this._mutex.runExclusive(async () => {
+        return this.runExclusiveLocked(async () => {
             let storageData;
             try {
                 storageData = await this.loadStorageData();
@@ -589,7 +600,7 @@ export class TokenStore {
      * request that observed the authentication failure.
      */
     async markDisabledIfCurrent(provider, expectedTokens, reason) {
-        return this._mutex.runExclusive(async () => {
+        return this.runExclusiveLocked(async () => {
             let storageData;
             try {
                 storageData = await this.loadStorageData();
@@ -631,7 +642,7 @@ export class TokenStore {
      * @param provider - The provider key (e.g., "anthropic:user@example.com")
      */
     async markEnabled(provider) {
-        return this._mutex.runExclusive(async () => {
+        return this.runExclusiveLocked(async () => {
             let storageData;
             try {
                 storageData = await this.loadStorageData();
@@ -738,7 +749,7 @@ export class TokenStore {
      * @returns Array of provider keys that were removed
      */
     async pruneExpired(bufferMs = 0) {
-        return this._mutex.runExclusive(async () => {
+        return this.runExclusiveLocked(async () => {
             let storageData;
             try {
                 storageData = await this.loadStorageData();
@@ -783,7 +794,7 @@ export class TokenStore {
      * @throws TokenStoreError if deletion fails
      */
     async clearAllTokens() {
-        return this._mutex.runExclusive(async () => {
+        return this.runExclusiveLocked(async () => {
             // Clear all in-memory refresh state so re-adding accounts starts fresh
             this.inFlightRefreshes.clear();
             this.tokenRefreshers.clear();
@@ -805,50 +816,222 @@ export class TokenStore {
             // File doesn't exist, return empty storage
             throw new TokenStoreError("Token storage file not found", "NOT_FOUND");
         }
+        let content;
         try {
-            const content = await readFile(this.storagePath, "utf-8");
-            let storageData;
-            if (this.encryptionEnabled) {
-                const decrypted = this.deobfuscate(content);
-                storageData = JSON.parse(decrypted);
-            }
-            else {
-                storageData = JSON.parse(content);
-            }
-            // Validate storage data structure
-            if (!storageData.providers || !storageData.version) {
-                throw new TokenStoreError("Invalid token storage format", "VALIDATION_ERROR");
-            }
-            return storageData;
+            content = await readFile(this.storagePath, "utf-8");
         }
         catch (error) {
-            if (error instanceof TokenStoreError) {
-                throw error;
-            }
             const errorMessage = error instanceof Error ? error.message : String(error);
             logger.error("Failed to read token storage", { error: errorMessage });
             throw new TokenStoreError(`Failed to read token storage: ${errorMessage}`, "STORAGE_ERROR");
         }
+        const storageData = this.encryptionEnabled
+            ? this.parseObfuscatedStorage(content)
+            : this.parseStorageJson(content);
+        if (storageData) {
+            return storageData;
+        }
+        // An unreadable store used to throw from every caller, which took the whole
+        // pool offline with no repair path short of deleting the file by hand. Set
+        // it aside under a dated name instead: the proxy starts with an empty pool,
+        // `auth login` can repopulate it, and the bytes are still there to inspect.
+        await this.quarantineStorageFile();
+        throw new TokenStoreError("Token storage file not found", "NOT_FOUND");
+    }
+    /** Parse plain-JSON storage; null when it is not a usable store. */
+    parseStorageJson(content) {
+        try {
+            const parsed = JSON.parse(content);
+            if (!parsed ||
+                typeof parsed !== "object" ||
+                !parsed.providers ||
+                typeof parsed.providers !== "object" ||
+                !parsed.version) {
+                return null;
+            }
+            return parsed;
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Decode a store written by either codec.
+     *
+     * The current codec is prefixed and XORs UTF-8 bytes. The older one XORed
+     * UTF-16 code units and then truncated each to a byte, so a store holding a
+     * single non-Latin-1 character (an emoji in a label, a smart quote in a
+     * disable reason) could never be read back. Older files carry no prefix and
+     * are read the old way; the next save rewrites them with the new codec.
+     */
+    parseObfuscatedStorage(content) {
+        const trimmed = content.trim();
+        if (trimmed.startsWith(OBFUSCATION_V2_PREFIX)) {
+            try {
+                return this.parseStorageJson(this.deobfuscateV2(trimmed));
+            }
+            catch {
+                return null;
+            }
+        }
+        try {
+            const legacy = this.parseStorageJson(this.deobfuscateLegacy(trimmed));
+            if (legacy) {
+                return legacy;
+            }
+        }
+        catch {
+            // Fall through to the other codec and the plain-JSON reading.
+        }
+        try {
+            const current = this.parseStorageJson(this.deobfuscateV2(trimmed));
+            if (current) {
+                return current;
+            }
+        }
+        catch {
+            // Not the current codec either.
+        }
+        return this.parseStorageJson(trimmed);
+    }
+    async quarantineStorageFile() {
+        const quarantinePath = `${this.storagePath}.corrupt-${Date.now()}`;
+        try {
+            await rename(this.storagePath, quarantinePath);
+            logger.error("Token storage could not be parsed and was quarantined; the pool starts empty", { path: this.storagePath, quarantinedTo: quarantinePath });
+        }
+        catch (error) {
+            logger.error("Token storage could not be parsed or quarantined", {
+                path: this.storagePath,
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
     }
     /**
      * Saves storage data to file
      */
     async saveStorageData(data) {
         try {
-            const content = this.encryptionEnabled
-                ? this.obfuscate(JSON.stringify(data))
-                : JSON.stringify(data, null, 2);
-            // Use PID-scoped temp file to avoid cross-process race conditions
-            const tmpPath = `${this.storagePath}.tmp.${process.pid}`;
-            await writeFile(tmpPath, content, "utf-8");
-            await chmod(tmpPath, TokenStore.FILE_PERMISSIONS);
-            await rename(tmpPath, this.storagePath);
+            await this.writeStorageFile(data);
         }
         catch (error) {
             const errorMessage = error instanceof Error ? error.message : String(error);
             throw new TokenStoreError(`Failed to save token storage: ${errorMessage}`, "STORAGE_ERROR");
         }
     }
+    /**
+     * Serialize and write the store: owner-only from creation, under an
+     * unpredictable temp name, renamed into place. See `secureFiles`.
+     */
+    async writeStorageFile(data) {
+        const content = this.encryptionEnabled
+            ? this.obfuscate(JSON.stringify(data))
+            : JSON.stringify(data, null, 2);
+        await writePrivateFileAtomically(this.storagePath, content);
+    }
+    /**
+     * Take the in-process mutex, then the cross-process file lock, around a
+     * read-modify-write. The CLI and a running proxy share one file; without
+     * the second lock a stale snapshot written late reverted the other's
+     * rotated refresh token or disable flag.
+     */
+    runExclusiveLocked(fn) {
+        return this._mutex.runExclusive(async () => {
+            const release = await this.acquireFileLock();
+            try {
+                return await fn();
+            }
+            finally {
+                await release();
+            }
+        });
+    }
+    get lockPath() {
+        return `${this.storagePath}.lock`;
+    }
+    async readLockOwner() {
+        try {
+            const parsed = JSON.parse(await readFile(this.lockPath, "utf8"));
+            if (typeof parsed.pid !== "number" ||
+                typeof parsed.token !== "string" ||
+                typeof parsed.acquiredAt !== "number") {
+                return null;
+            }
+            return {
+                pid: parsed.pid,
+                token: parsed.token,
+                acquiredAt: parsed.acquiredAt,
+            };
+        }
+        catch {
+            return null;
+        }
+    }
+    async removeAbandonedLock() {
+        const owner = await this.readLockOwner();
+        try {
+            const lockStat = await stat(this.lockPath);
+            const oldEnough = Date.now() - lockStat.mtimeMs >= FILE_LOCK_STALE_MS;
+            const ownerRunning = owner ? processIsRunning(owner.pid) : false;
+            if ((owner && !ownerRunning) || oldEnough) {
+                await rm(this.lockPath, { force: true });
+                return true;
+            }
+            return false;
+        }
+        catch (error) {
+            return error.code === "ENOENT";
+        }
+    }
+    /**
+     * Best-effort cross-process lock. When another process holds it past the
+     * timeout the write proceeds anyway with a warning: a stuck lock must not
+     * take the pool offline, which is worse than the race it guards against.
+     */
+    async acquireFileLock() {
+        await ensurePrivateDirectory(join(this.storagePath, ".."));
+        const deadline = Date.now() + FILE_LOCK_TIMEOUT_MS;
+        for (;;) {
+            const owner = {
+                pid: process.pid,
+                token: randomUUID(),
+                acquiredAt: Date.now(),
+            };
+            let handle;
+            try {
+                handle = await open(this.lockPath, "wx", TokenStore.FILE_PERMISSIONS);
+                await handle.writeFile(JSON.stringify(owner));
+                const acquired = handle;
+                return async () => {
+                    await acquired.close().catch(() => undefined);
+                    const current = await this.readLockOwner();
+                    if (current?.token === owner.token) {
+                        await rm(this.lockPath, { force: true }).catch(() => undefined);
+                    }
+                };
+            }
+            catch (error) {
+                if (handle) {
+                    await handle.close().catch(() => undefined);
+                    await rm(this.lockPath, { force: true }).catch(() => undefined);
+                }
+                if (error.code !== "EEXIST") {
+                    logger.debug("Token store lock unavailable; proceeding unlocked", {
+                        error: error instanceof Error ? error.message : String(error),
+                    });
+                    return async () => undefined;
+                }
+            }
+            if (await this.removeAbandonedLock()) {
+                continue;
+            }
+            if (Date.now() >= deadline) {
+                logger.warn("Token store lock held by another process past the timeout; proceeding unlocked", { lockPath: this.lockPath });
+                return async () => undefined;
+            }
+            await sleep(FILE_LOCK_RETRY_MS);
+        }
+    }
     /**
      * Deletes the storage file
      */
@@ -887,21 +1070,9 @@ export class TokenStore {
      * Ensures the storage directory exists with proper permissions
      */
     async ensureDirectory(dirPath) {
-        try {
-            await mkdir(dirPath, {
-                recursive: true,
-                mode: TokenStore.DIR_PERMISSIONS,
-            });
-        }
-        catch {
-            // Directory might already exist, try to set permissions
-            try {
-                await chmod(dirPath, TokenStore.DIR_PERMISSIONS);
-            }
-            catch {
-                // Ignore permission errors on existing directories
-            }
-        }
+        // `mkdir({recursive})` never throws for an existing directory, so the mode
+        // must be re-asserted every time rather than only on first creation.
+        await ensurePrivateDirectory(dirPath);
     }
     /**
      * Derives an encoding key from machine-specific information
@@ -912,27 +1083,37 @@ export class TokenStore {
         const machineInfo = `${homedir()}-neurolink-token-store`;
         return createHash("sha256").update(machineInfo).digest("hex");
     }
+    deriveEncryptionKeyBytes() {
+        const machineInfo = `${homedir()}-neurolink-token-store`;
+        return createHash("sha256").update(machineInfo).digest();
+    }
     /**
-     * Simple XOR-based obfuscation
-     * Note: This is NOT cryptographically secure, just basic obfuscation
-     * For production use, consider using node:crypto with proper encryption
+     * XOR obfuscation over the UTF-8 bytes of the document, base64-encoded and
+     * prefixed so a reader can tell it from the older code-unit codec.
+     * Note: this is NOT cryptographically secure, just basic obfuscation.
      */
     obfuscate(data) {
-        const key = this.encryptionKey;
-        let result = "";
-        for (let i = 0; i < data.length; i++) {
-            const charCode = data.charCodeAt(i) ^ key.charCodeAt(i % key.length);
-            result += String.fromCharCode(charCode);
+        const key = this.encryptionKeyBytes;
+        const bytes = Buffer.from(data, "utf8");
+        for (let i = 0; i < bytes.length; i++) {
+            bytes[i] ^= key[i % key.length];
+        }
+        return `${OBFUSCATION_V2_PREFIX}${bytes.toString("base64")}`;
+    }
+    deobfuscateV2(data) {
+        const key = this.encryptionKeyBytes;
+        const bytes = Buffer.from(data.slice(OBFUSCATION_V2_PREFIX.length), "base64");
+        for (let i = 0; i < bytes.length; i++) {
+            bytes[i] ^= key[i % key.length];
         }
-        // Encode as base64 for safe storage
-        return Buffer.from(result, "binary").toString("base64");
+        return bytes.toString("utf8");
     }
     /**
-     * Reverses the XOR obfuscation
+     * The pre-UTF-8 codec, kept only to read stores written before it existed.
+     * It cannot round-trip any character above U+00FF.
      */
-    deobfuscate(data) {
+    deobfuscateLegacy(data) {
         const key = this.encryptionKey;
-        // Decode from base64
         const decoded = Buffer.from(data, "base64").toString("binary");
         let result = "";
         for (let i = 0; i < decoded.length; i++) {

package/dist/avatar/providers/DIDAvatar.js

@@ -13,7 +13,8 @@ import { logger } from "../../utils/logger.js";
 import { sanitizeForLog } from "../../utils/logSanitize.js";
 import { AVATAR_ERROR_CODES, AvatarError, } from "../../utils/avatarProcessor.js";
 import { assertSafeUrl } from "../../utils/ssrfGuard.js";
-import { MAX_AUDIO_BYTES, MAX_IMAGE_BYTES, MAX_VIDEO_BYTES, readBoundedBuffer, } from "../../utils/sizeGuard.js";
+import { safeDownload } from "../../utils/safeFetch.js";
+import { MAX_AUDIO_BYTES, MAX_IMAGE_BYTES, MAX_VIDEO_BYTES, } from "../../utils/sizeGuard.js";
 const DEFAULT_BASE_URL = "https://api.d-id.com";
 const REQUEST_TIMEOUT_MS = 30_000;
 const POLL_INTERVAL_MS = 3_000;
@@ -281,27 +282,26 @@ export class DIDAvatar {
         });
     }
     async downloadResult(url) {
-        const response = await this.fetchWithTimeout(url, { method: "GET" });
-        if (!response.ok) {
-            throw new AvatarError({
-                code: AVATAR_ERROR_CODES.GENERATION_FAILED,
-                message: `D-ID result download failed: ${response.status}`,
-                category: ErrorCategory.NETWORK,
-                severity: ErrorSeverity.MEDIUM,
-                retriable: response.status >= 500,
-                context: { status: response.status, url },
-            });
-        }
+        // `safeDownload` re-validates the provider-returned URL, pins the
+        // connection to the vetted addresses, refuses redirects and bounds the
+        // body while it streams. The URL pre-check the caller already ran covered
+        // the URL text only, not the connection it produced.
         try {
-            return await readBoundedBuffer(response, MAX_VIDEO_BYTES, "D-ID result");
+            return await safeDownload(url, {
+                maxBytes: MAX_VIDEO_BYTES,
+                label: "D-ID result",
+                timeoutMs: REQUEST_TIMEOUT_MS,
+            });
         }
         catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            const status = /HTTP (\d{3})/.exec(message)?.[1];
             throw new AvatarError({
                 code: AVATAR_ERROR_CODES.GENERATION_FAILED,
-                message: `D-ID result download rejected: ${err instanceof Error ? err.message : String(err)}`,
+                message: `D-ID result download failed: ${message}`,
                 category: ErrorCategory.NETWORK,
-                severity: ErrorSeverity.HIGH,
-                retriable: false,
+                severity: status !== undefined ? ErrorSeverity.MEDIUM : ErrorSeverity.HIGH,
+                retriable: status !== undefined && Number(status) >= 500,
                 context: { url },
                 originalError: err instanceof Error ? err : undefined,
             });
@@ -321,45 +321,49 @@ export class DIDAvatar {
                 retriable: false,
             });
         }
-        try {
-            await assertSafeUrl(input);
-        }
-        catch (err) {
-            throw new AvatarError({
-                code: AVATAR_ERROR_CODES.INVALID_INPUT,
-                message: `Unsafe URL rejected: ${err instanceof Error ? err.message : String(err)}`,
-                category: ErrorCategory.VALIDATION,
-                severity: ErrorSeverity.HIGH,
-                retriable: false,
-                context: { url: input },
-            });
-        }
-        const response = await this.fetchWithTimeout(input, { method: "GET" });
-        if (!response.ok) {
-            throw new AvatarError({
-                code: AVATAR_ERROR_CODES.INVALID_INPUT,
-                message: `Failed to fetch input from ${input}: ${response.status}`,
-                category: ErrorCategory.NETWORK,
-                severity: ErrorSeverity.MEDIUM,
-                retriable: response.status >= 500,
-                context: { url: input, status: response.status },
-            });
-        }
         // Use the larger of the two input caps (audio 50 MiB > image 25 MiB) so
         // both audio and image URLs are bounded without falsely rejecting valid audio.
         const inputCap = Math.max(MAX_AUDIO_BYTES, MAX_IMAGE_BYTES);
+        // `safeDownload`: URL vetted (HTTPS, public host), connection pinned to
+        // the vetted addresses, redirects refused, body bounded while streaming.
         try {
-            return await readBoundedBuffer(response, inputCap, "D-ID input");
+            return await safeDownload(input, {
+                maxBytes: inputCap,
+                label: "D-ID input",
+                timeoutMs: REQUEST_TIMEOUT_MS,
+            });
         }
         catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            if (/rejected|permitted|blocked range|redirect/i.test(message)) {
+                throw new AvatarError({
+                    code: AVATAR_ERROR_CODES.INVALID_INPUT,
+                    message: `Unsafe URL rejected: ${message}`,
+                    category: ErrorCategory.VALIDATION,
+                    severity: ErrorSeverity.HIGH,
+                    retriable: false,
+                    context: { url: input },
+                });
+            }
+            if (/too large|size cap/i.test(message)) {
+                throw new AvatarError({
+                    code: AVATAR_ERROR_CODES.INVALID_INPUT,
+                    message: `D-ID input download rejected: ${message}`,
+                    category: ErrorCategory.NETWORK,
+                    severity: ErrorSeverity.HIGH,
+                    retriable: false,
+                    context: { url: input },
+                    originalError: err instanceof Error ? err : undefined,
+                });
+            }
+            const status = /HTTP (\d{3})/.exec(message)?.[1];
             throw new AvatarError({
                 code: AVATAR_ERROR_CODES.INVALID_INPUT,
-                message: `D-ID input download rejected: ${err instanceof Error ? err.message : String(err)}`,
+                message: `Failed to fetch input from ${input}: ${message}`,
                 category: ErrorCategory.NETWORK,
-                severity: ErrorSeverity.HIGH,
-                retriable: false,
+                severity: ErrorSeverity.MEDIUM,
+                retriable: status === undefined || Number(status) >= 500,
                 context: { url: input },
-                originalError: err instanceof Error ? err : undefined,
             });
         }
     }