@steve31415/baselib 3.8.1 → 3.8.3

package/dist/llm/complete.js

@@ -126,7 +126,13 @@ export async function llmComplete(request) {
             request.logger?.warn('llm.failover_attempt', {
                 failedModel: modelName,
                 failedProvider: modelEntry.provider,
-                error: errorMessage,
+                // Provider/network/parse errors can echo prompts, credentials or private
+                // response bodies. Keep their text in the returned API only, never logs.
+                errorClass: err instanceof LLMError ? 'LLMError' : err instanceof Error ? 'Error' : 'NonError',
+                ...(err instanceof LLMError && typeof err.statusCode === 'number' && Number.isFinite(err.statusCode)
+                    ? { statusCode: err.statusCode } : {}),
+                isRetryable: err instanceof LLMError && err.isRetryable === true,
+                declined: err instanceof LLMError && err.declined === true,
                 attemptNumber: failedAttempts.length,
                 nextModel: modelsToTry[failedAttempts.length] ?? 'none',
             });

package/dist/llm/providers/anthropic.js

@@ -54,6 +54,7 @@ export const anthropicProvider = {
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), request.timeoutMs);
         let response;
+        let responseText;
         try {
             response = await fetch(endpoint, {
                 method: 'POST',
@@ -65,6 +66,9 @@ export const anthropicProvider = {
                 body: JSON.stringify(body),
                 signal: controller.signal,
             });
+            // fetch resolves at headers; keep the attempt deadline active until the
+            // body finishes, including error responses, so failover cannot hang.
+            responseText = await response.text();
         }
         catch (err) {
             const message = err instanceof Error && err.name === 'AbortError'
@@ -81,7 +85,7 @@ export const anthropicProvider = {
             clearTimeout(timer);
         }
         if (!response.ok) {
-            const errorText = await response.text();
+            const errorText = responseText;
             throw new LLMError({
                 message: `Anthropic API error: ${response.status} - ${errorText.slice(0, 500)}`,
                 provider: 'anthropic',
@@ -90,7 +94,7 @@ export const anthropicProvider = {
                 isRetryable: response.status >= 500 || response.status === 429,
             });
         }
-        const data = await response.json();
+        const data = JSON.parse(responseText);
         const latencyMs = Date.now() - startTime;
         const outputTokens = data.usage?.output_tokens ?? undefined;
         const tokensUsed = (data.usage?.input_tokens || 0) + (data.usage?.output_tokens || 0);

package/dist/llm/providers/gemini.js

@@ -73,6 +73,7 @@ export const geminiProvider = {
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), request.timeoutMs);
         let response;
+        let responseText;
         try {
             response = await fetch(`${endpoint}?key=${request.apiKey}`, {
                 method: 'POST',
@@ -80,6 +81,9 @@ export const geminiProvider = {
                 body: JSON.stringify(body),
                 signal: controller.signal,
             });
+            // fetch resolves at headers; keep the attempt deadline active until the
+            // body finishes, including error responses, so failover cannot hang.
+            responseText = await response.text();
         }
         catch (err) {
             const message = err instanceof Error && err.name === 'AbortError'
@@ -96,7 +100,7 @@ export const geminiProvider = {
             clearTimeout(timer);
         }
         if (!response.ok) {
-            const errorText = await response.text();
+            const errorText = responseText;
             throw new LLMError({
                 message: `Gemini API error: ${response.status} - ${errorText.slice(0, 500)}`,
                 provider: 'gemini',
@@ -105,7 +109,7 @@ export const geminiProvider = {
                 isRetryable: response.status >= 500 || response.status === 429,
             });
         }
-        const data = await response.json();
+        const data = JSON.parse(responseText);
         const latencyMs = Date.now() - startTime;
         const text = data.candidates?.[0]?.content?.parts?.[0]?.text || '';
         const tokensUsed = data.usageMetadata?.totalTokenCount || 0;

package/dist/llm/providers/openai.js

@@ -125,6 +125,7 @@ export const openaiProvider = {
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), request.timeoutMs);
         let response;
+        let responseText;
         try {
             response = await fetch(endpoint, {
                 method: 'POST',
@@ -135,6 +136,9 @@ export const openaiProvider = {
                 body: JSON.stringify(body),
                 signal: controller.signal,
             });
+            // fetch resolves at headers; keep the attempt deadline active until the
+            // body finishes, including error responses, so failover cannot hang.
+            responseText = await response.text();
         }
         catch (err) {
             const message = err instanceof Error && err.name === 'AbortError'
@@ -151,7 +155,7 @@ export const openaiProvider = {
             clearTimeout(timer);
         }
         if (!response.ok) {
-            const errorText = await response.text();
+            const errorText = responseText;
             throw new LLMError({
                 message: `OpenAI API error: ${response.status} - ${errorText.slice(0, 500)}`,
                 provider: 'openai',
@@ -160,7 +164,7 @@ export const openaiProvider = {
                 isRetryable: response.status >= 500 || response.status === 429,
             });
         }
-        const data = await response.json();
+        const data = JSON.parse(responseText);
         const latencyMs = Date.now() - startTime;
         const text = data.choices?.[0]?.message?.content || '';
         const outputTokens = data.usage?.completion_tokens ?? undefined;

package/dist/llm/types.d.ts

@@ -32,7 +32,7 @@ export interface LLMRequest {
     apiKeys: ApiKeys;
     /** Logger instance for structured logging. */
     logger?: Logger;
-    /** Timeout per provider attempt in ms. Default: 60000. */
+    /** Timeout per provider attempt, including response body download, in ms. Default: 60000. */
     timeoutMs?: number;
     /**
      * Cap on reasoning/thinking tokens for models that support hidden reasoning
@@ -116,18 +116,19 @@ export interface LLMResponse {
     latencyMs: number;
     /** True if the primary model failed and a fallback was used. */
     failedOver: boolean;
-    /** Details of each failed attempt before the successful one. */
+    /** Details of each failed attempt before success; error text can contain private input. Do not log verbatim. */
     failedAttempts: FailedAttempt[];
 }
 /** Details of a failed provider attempt. */
 export interface FailedAttempt {
     provider: ProviderName;
     model: string;
+    /** Provider detail may echo private input or credentials. Do not log verbatim. */
     error: string;
     /** True when this attempt failed because the model declined (vs. an infra error). */
     declined?: boolean;
 }
-/** Error thrown when an LLM provider call fails. */
+/** Error thrown when an LLM provider call fails. Its message may contain private input; do not log verbatim. */
 export declare class LLMError extends Error {
     provider: ProviderName;
     model: string;

package/dist/llm/types.js

@@ -1,4 +1,4 @@
-/** Error thrown when an LLM provider call fails. */
+/** Error thrown when an LLM provider call fails. Its message may contain private input; do not log verbatim. */
 export class LLMError extends Error {
     provider;
     model;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@steve31415/baselib",
-  "version": "3.8.1",
+  "version": "3.8.3",
   "description": "Plasticine new-world shared platform library: logging, auth, service-to-service auth, db, HTTP, sync, app updates",
   "type": "module",
   "license": "MIT",