ai-gateway-proxy 0.1.0 → 0.3.0

package/dist/index.cjs

@@ -1,97 +1,184 @@
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var _async_to_generator = require('@swc/helpers/_/_async_to_generator');
 var oidc = require('@vercel/oidc');
-var _extends = require('@swc/helpers/_/_extends');
 var providerUtils = require('@ai-sdk/provider-utils');
 
 /**
  * Get authentication token for the AI Gateway.
  * Tries API key first (AI_GATEWAY_API_KEY env var), then falls back to Vercel OIDC.
- */ function getGatewayAuthToken() {
-    return _async_to_generator._(function*() {
-        const apiKey = process.env.AI_GATEWAY_API_KEY;
-        if (apiKey) {
-            return {
-                token: apiKey,
-                authMethod: "api-key"
-            };
+ * Returns `null` when neither is available, after logging why OIDC failed, and the proxy then answers 500.
+ */ async function getGatewayAuthToken() {
+    const apiKey = process.env.AI_GATEWAY_API_KEY;
+    if (apiKey) {
+        return {
+            token: apiKey,
+            authMethod: "api-key"
+        };
+    }
+    try {
+        const oidcToken = await oidc.getVercelOidcToken();
+        return {
+            token: oidcToken,
+            authMethod: "oidc"
+        };
+    } catch (error) {
+        // Only the message: the error object could carry token material.
+        console.error("AI Gateway auth: no AI_GATEWAY_API_KEY and Vercel OIDC token unavailable:", error instanceof Error ? error.message : String(error));
+        return null;
+    }
+}
+
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+// JSON has no undefined, so null stands in for it wherever the type allows undefined.
+function isNullish(value) {
+    return value === undefined || value === null;
+}
+function tokenCountsProblem(name, value, fields) {
+    if (!isRecord(value)) {
+        return `${name} must be an object`;
+    }
+    for (const field of fields){
+        if (!isNullish(value[field]) && typeof value[field] !== "number") {
+            return `${name}.${field} must be a number or undefined`;
         }
-        try {
-            const oidcToken = yield oidc.getVercelOidcToken();
-            return {
-                token: oidcToken,
-                authMethod: "oidc"
-            };
-        } catch (unused) {
-            return null;
+    }
+    return undefined;
+}
+/**
+ * Returns why an `afterResponse` result is not a `GatewayResponse`, or undefined when it is one.
+ */ function gatewayResponseProblem(value) {
+    if (!isRecord(value)) {
+        return "the result must be an object";
+    }
+    const { content, finishReason, usage, warnings, providerMetadata } = value;
+    if (!Array.isArray(content)) {
+        return "content must be an array";
+    }
+    if (!content.every((part)=>isRecord(part) && typeof part.type === "string")) {
+        return "content must hold objects with a string type";
+    }
+    if (!isRecord(finishReason) || typeof finishReason.unified !== "string") {
+        return "finishReason must be an object with a string unified";
+    }
+    if (!isNullish(finishReason.raw) && typeof finishReason.raw !== "string") {
+        return "finishReason.raw must be a string or undefined";
+    }
+    if (!isNullish(usage)) {
+        if (!isRecord(usage)) {
+            return "usage must be an object or undefined";
+        }
+        const problem = tokenCountsProblem("usage.inputTokens", usage.inputTokens, [
+            "total",
+            "noCache",
+            "cacheRead",
+            "cacheWrite"
+        ]) ?? tokenCountsProblem("usage.outputTokens", usage.outputTokens, [
+            "total",
+            "text",
+            "reasoning"
+        ]);
+        if (problem) {
+            return problem;
         }
-    })();
+    }
+    // @ai-sdk/gateway reads a missing warnings field as none, so only a wrong type is rejected.
+    if (!isNullish(warnings) && !Array.isArray(warnings)) {
+        return "warnings must be an array";
+    }
+    if (!isNullish(providerMetadata) && !isRecord(providerMetadata)) {
+        return "providerMetadata must be an object or undefined";
+    }
+    return undefined;
+}
+/**
+ * Returns why an `onError` result that is not a `Response` is not a `GatewayError`, or undefined when it is one.
+ */ function gatewayErrorProblem(value) {
+    if (!isRecord(value)) {
+        return "the result must be an object or a Response";
+    }
+    const { error } = value;
+    if (!isRecord(error)) {
+        return "error must be an object";
+    }
+    if (typeof error.message !== "string") {
+        return "error.message must be a string";
+    }
+    // @ai-sdk/gateway accepts a missing type, so only a wrong type is rejected.
+    if (!isNullish(error.type) && typeof error.type !== "string") {
+        return "error.type must be a string or undefined";
+    }
+    if (!isNullish(error.code) && typeof error.code !== "string" && typeof error.code !== "number") {
+        return "error.code must be a string, a number or undefined";
+    }
+    if (!isNullish(value.generationId) && typeof value.generationId !== "string") {
+        return "generationId must be a string or undefined";
+    }
+    return undefined;
 }
 
 /**
  * Aggregator for collecting stream content.
  * Tracks text deltas, reasoning, tool calls, and other content to build the final GatewayResponse.
  *
- * Uses AI SDK V3 protocol types.
- * @see https://github.com/vercel/ai/blob/main/packages/provider/src/language-model/v3/language-model-v3-stream-part.ts
+ * Uses AI SDK V4 protocol types.
+ * @see https://github.com/vercel/ai/blob/main/packages/provider/src/language-model/v4/language-model-v4-stream-part.ts
  */ class StreamContentAggregator {
     /**
 	 * Process a stream part and update aggregated state.
-	 * Uses LanguageModelV3StreamPart type from @ai-sdk/provider.
+	 * Uses LanguageModelV4StreamPart type from @ai-sdk/provider.
 	 *
-	 * @see https://github.com/vercel/ai/blob/main/packages/provider/src/language-model/v3/language-model-v3-stream-part.ts
+	 * @see https://github.com/vercel/ai/blob/main/packages/provider/src/language-model/v4/language-model-v4-stream-part.ts
 	 */ process(part) {
         switch(part.type){
             case "stream-start":
-                this.warnings.push(...part.warnings);
+                // The part comes off the wire, so a missing or malformed warnings field adds none.
+                if (Array.isArray(part.warnings)) {
+                    this.warnings.push(...part.warnings);
+                }
                 break;
             case "text-start":
-                this.textContent.set(part.id, {
-                    type: "text",
-                    text: ""
-                });
+                keepProviderMetadata(this.openText(part.id), part.providerMetadata);
                 break;
             case "text-delta":
                 {
-                    const text = this.textContent.get(part.id);
-                    if (text) {
-                        text.text += part.delta;
-                    }
+                    const block = this.textContent.get(part.id) ?? this.openText(part.id);
+                    block.text += part.delta;
+                    keepProviderMetadata(block, part.providerMetadata);
+                    break;
                 }
-                break;
             case "text-end":
                 {
-                    const text = this.textContent.get(part.id);
-                    if (text) {
-                        this.content.push(text);
-                        this.textContent.delete(part.id);
+                    const block = this.textContent.get(part.id);
+                    if (block) {
+                        keepProviderMetadata(block, part.providerMetadata);
+                        if (Array.isArray(part.citations)) {
+                            block.citations = part.citations;
+                        }
                     }
+                    this.textContent.delete(part.id);
+                    break;
                 }
-                break;
             case "reasoning-start":
-                this.reasoningContent.set(part.id, {
-                    type: "reasoning",
-                    text: ""
-                });
+                keepProviderMetadata(this.openReasoning(part.id), part.providerMetadata);
                 break;
             case "reasoning-delta":
                 {
-                    const reasoning = this.reasoningContent.get(part.id);
-                    if (reasoning) {
-                        reasoning.text += part.delta;
-                    }
+                    const block = this.reasoningContent.get(part.id) ?? this.openReasoning(part.id);
+                    block.text += part.delta;
+                    keepProviderMetadata(block, part.providerMetadata);
+                    break;
                 }
-                break;
             case "reasoning-end":
                 {
-                    const reasoning = this.reasoningContent.get(part.id);
-                    if (reasoning) {
-                        this.content.push(reasoning);
-                        this.reasoningContent.delete(part.id);
+                    const block = this.reasoningContent.get(part.id);
+                    if (block) {
+                        keepProviderMetadata(block, part.providerMetadata);
                     }
+                    this.reasoningContent.delete(part.id);
+                    break;
                 }
-                break;
             case "tool-input-start":
             case "tool-input-delta":
             case "tool-input-end":
@@ -106,20 +193,25 @@ var providerUtils = require('@ai-sdk/provider-utils');
                 this.content.push(part);
                 break;
             case "file":
+            case "custom":
+            case "reasoning-file":
                 this.content.push(part);
                 break;
             case "source":
                 this.content.push(part);
                 break;
+            case "response-metadata":
+                this.recordResponseMetadata(part);
+                break;
+            case "error":
+                // A later finish part still sets its own reason; this one stands only if none comes.
+                this.finishReason = {
+                    unified: "error",
+                    raw: undefined
+                };
+                break;
             case "finish":
-                // Finalize any remaining content
-                for (const [, text] of this.textContent){
-                    this.content.push(text);
-                }
                 this.textContent.clear();
-                for (const [, reasoning] of this.reasoningContent){
-                    this.content.push(reasoning);
-                }
                 this.reasoningContent.clear();
                 this.finishReason = part.finishReason;
                 this.usage = part.usage;
@@ -127,204 +219,542 @@ var providerUtils = require('@ai-sdk/provider-utils');
                 break;
         }
     }
+    // Each field keeps its last string value, as in `ai`'s streamText; the timestamp is still the wire string.
+    recordResponseMetadata(part) {
+        for (const field of [
+            "id",
+            "modelId",
+            "timestamp"
+        ]){
+            const value = part[field];
+            if (typeof value === "string") {
+                this.response = {
+                    ...this.response,
+                    [field]: value
+                };
+            }
+        }
+    }
+    openText(id) {
+        const block = {
+            type: "text",
+            text: ""
+        };
+        this.textContent.set(id, block);
+        this.content.push(block);
+        return block;
+    }
+    openReasoning(id) {
+        const block = {
+            type: "reasoning",
+            text: ""
+        };
+        this.reasoningContent.set(id, block);
+        this.content.push(block);
+        return block;
+    }
     /**
-	 * Get the aggregated response.
+	 * Get the aggregated response. Before a `finish` part, `usage` is undefined and
+	 * `finishReason` is `error` after an `error` part and `other` otherwise.
 	 */ getResponse() {
         return {
             content: this.content,
             finishReason: this.finishReason,
             usage: this.usage,
             warnings: this.warnings,
-            providerMetadata: this.providerMetadata
+            providerMetadata: this.providerMetadata,
+            ...this.response && {
+                response: this.response
+            }
         };
     }
     constructor(){
         this.content = [];
         this.warnings = [];
-        // Text content being built (keyed by id)
+        // Open text and reasoning blocks by id. Each block already holds its slot in `content`.
         this.textContent = new Map();
-        // Reasoning content being built (keyed by id)
         this.reasoningContent = new Map();
         this.finishReason = {
-            unified: "stop",
+            unified: "other",
             raw: undefined
         };
-        this.usage = {
-            inputTokens: {
-                total: undefined,
-                noCache: undefined,
-                cacheRead: undefined,
-                cacheWrite: undefined
-            },
-            outputTokens: {
-                total: undefined,
-                text: undefined,
-                reasoning: undefined
-            }
-        };
     }
 }
+// The latest part with metadata wins, as in `ai`'s streamText.
+function keepProviderMetadata(block, providerMetadata) {
+    if (providerMetadata != null) {
+        block.providerMetadata = providerMetadata;
+    }
+}
+/**
+ * Encodes event data as an SSE event. The parser joins multi-line data with "\n",
+ * so each line needs its own `data:` field to reach the client intact.
+ */ function sseEvent(data) {
+    return `${data.split("\n").map((line)=>`data: ${line}`).join("\n")}\n\n`;
+}
 /**
  * Creates a transform stream that:
  * 1. Passes through all SSE events immediately
  * 2. Aggregates content using StreamContentAggregator
- * 3. Calls afterResponse when finish event is received
- * 4. Modifies the finish event based on afterResponse result
+ * 3. Calls afterResponse once: on the first finish event, or with partial content if the
+ *    stream ends, fails or is cancelled first
+ * 4. Modifies every finish event based on that afterResponse result
+ *
+ * Pass the client request's `signal` when it is also the upstream fetch's signal: a read that
+ * fails because it aborted is then reported as a cancel rather than an upstream failure.
  *
  * Uses EventSourceParserStream from @ai-sdk/provider-utils for SSE parsing.
  * EventSourceParserStream is re-exported from the eventsource-parser package.
  * @see https://github.com/vercel/ai/blob/main/packages/provider-utils/src/parse-json-event-stream.ts
  * @see https://github.com/rexxars/eventsource-parser
- */ function createStreamTransformer(body, requestBody, afterResponse) {
+ */ function createStreamTransformer(body, requestBody, afterResponse, signal) {
     const encoder = new TextEncoder();
     const aggregator = new StreamContentAggregator();
-    // Use EventSourceParserStream for SSE parsing (re-exported from eventsource-parser via @ai-sdk/provider-utils)
     const eventStream = body.pipeThrough(new TextDecoderStream()).pipeThrough(new providerUtils.EventSourceParserStream());
+    const reader = eventStream.getReader();
+    let cancelled = false;
+    let finishSeen = false;
+    let hookResult;
+    let incompleteReported = false;
+    let warnedNonJson = false;
+    /**
+	 * Returns the data to forward for one upstream event, calling afterResponse on finish.
+	 */ async function transformEvent(data) {
+        // Handle DONE marker (end of stream)
+        if (data === "DONE" || data === "[DONE]") {
+            return data;
+        }
+        // Parse the JSON event data. Data that is not a JSON object, such as `null`, is not a stream
+        // part either, so it passes through like non-JSON data rather than reaching the aggregator.
+        let json;
+        try {
+            json = JSON.parse(data);
+        } catch  {}
+        if (typeof json !== "object" || json === null) {
+            if (!warnedNonJson) {
+                warnedNonJson = true;
+                console.warn("upstream stream event is not a JSON object, passing it through unparsed");
+            }
+            return data;
+        }
+        const parsed = json;
+        // Track content for aggregation
+        aggregator.process(parsed);
+        // Pass through every event but finish unchanged
+        if (parsed.type !== "finish") {
+            return data;
+        }
+        // A later finish reuses the first result, so a metering hook counts the stream once.
+        if (!finishSeen) {
+            finishSeen = true;
+            hookResult = await runAfterResponse();
+        }
+        if (!hookResult) {
+            return data;
+        }
+        const modifiedFinish = {
+            type: "finish",
+            finishReason: hookResult.finishReason,
+            usage: hookResult.usage ?? parsed.usage,
+            providerMetadata: hookResult.providerMetadata ?? undefined
+        };
+        return JSON.stringify(modifiedFinish);
+    }
+    /**
+	 * Calls afterResponse on finish and returns its result, or undefined when it threw or is invalid.
+	 */ async function runAfterResponse() {
+        let modifiedResponse;
+        try {
+            modifiedResponse = await afterResponse({
+                request: requestBody,
+                response: aggregator.getResponse()
+            });
+        } catch (error) {
+            console.error("afterResponse hook failed, forwarding original finish event:", error);
+            return undefined;
+        }
+        const problem = gatewayResponseProblem(modifiedResponse);
+        if (problem) {
+            console.error(`afterResponse hook returned an invalid response, forwarding original finish event: ${problem}`);
+            return undefined;
+        }
+        return modifiedResponse;
+    }
+    // No finish event is left to rewrite, so the result is ignored and a throw only logged.
+    async function reportIncomplete(incomplete) {
+        if (finishSeen || incompleteReported) {
+            return;
+        }
+        incompleteReported = true;
+        const response = aggregator.getResponse();
+        if (incomplete.reason === "error") {
+            response.finishReason = {
+                unified: "error",
+                raw: undefined
+            };
+        }
+        try {
+            await afterResponse({
+                request: requestBody,
+                response,
+                incomplete
+            });
+        } catch (error) {
+            console.error("afterResponse hook failed on an unfinished stream:", error);
+        }
+    }
+    // Reading in pull rather than start keeps backpressure: one upstream event per client read,
+    // so a slow client does not make the proxy buffer the whole response.
     return new ReadableStream({
-        start (controller) {
-            return _async_to_generator._(function*() {
-                const reader = eventStream.getReader();
-                try {
-                    while(true){
-                        const { done, value } = yield reader.read();
-                        if (done) break;
-                        const { data } = value;
-                        // Handle DONE marker (end of stream)
-                        if (data === "DONE" || data === "[DONE]") {
-                            controller.enqueue(encoder.encode(`data: ${data}\n\n`));
-                            continue;
-                        }
-                        // Parse the JSON event data
-                        let parsed;
-                        try {
-                            parsed = JSON.parse(data);
-                        } catch (unused) {
-                            // Not valid JSON, pass through as-is
-                            controller.enqueue(encoder.encode(`data: ${data}\n\n`));
-                            continue;
-                        }
-                        // Track content for aggregation
-                        aggregator.process(parsed);
-                        // Handle finish event specially - call afterResponse hook
-                        if (parsed.type === "finish") {
-                            const modifiedResponse = yield afterResponse({
-                                request: requestBody,
-                                response: aggregator.getResponse()
-                            });
-                            // Emit modified finish event
-                            const modifiedFinish = {
-                                type: "finish",
-                                finishReason: modifiedResponse.finishReason,
-                                usage: modifiedResponse.usage,
-                                providerMetadata: modifiedResponse.providerMetadata
-                            };
-                            controller.enqueue(encoder.encode(`data: ${JSON.stringify(modifiedFinish)}\n\n`));
-                            continue;
-                        }
-                        // Pass through event unchanged
-                        controller.enqueue(encoder.encode(`data: ${data}\n\n`));
+        async pull (controller) {
+            try {
+                const { done, value } = await reader.read();
+                if (done) {
+                    // Awaited before close so a serverless handler stays alive until the hook finishes.
+                    if (!cancelled) {
+                        await reportIncomplete({
+                            reason: "ended"
+                        });
                     }
                     controller.close();
-                } catch (error) {
-                    controller.error(error);
-                } finally{
                     reader.releaseLock();
+                    return;
                 }
-            })();
+                controller.enqueue(encoder.encode(sseEvent(await transformEvent(value.data))));
+            } catch (error) {
+                // Aborting the fetch signal errors the upstream body, so the client left rather than the upstream failing.
+                if (!cancelled && signal?.aborted) {
+                    cancelled = true;
+                    await reportIncomplete({
+                        reason: "cancelled",
+                        cancelReason: signal.reason
+                    });
+                } else if (!cancelled) {
+                    console.error("upstream stream failed, erroring the client stream:", error);
+                    await reportIncomplete({
+                        reason: "error",
+                        error
+                    });
+                }
+                controller.error(error);
+                reader.releaseLock();
+            }
+        },
+        async cancel (reason) {
+            cancelled = true;
+            const upstream = reader.cancel(reason);
+            upstream.catch(()=>{});
+            await reportIncomplete({
+                reason: "cancelled",
+                cancelReason: reason
+            });
+            return upstream;
         }
     });
 }
 
-const DEFAULT_BASE_URL = "https://ai-gateway.vercel.sh/v1/ai";
+const DEFAULT_BASE_URL = "https://ai-gateway.vercel.sh/v4/ai";
 const PROTOCOL_VERSION = "0.0.1";
+const MAX_ERROR_EXCERPT_LENGTH = 200;
+// Request ids for matching gateway-side logs, and the rate limit headers the AI SDK backs off on.
+const FORWARDED_RESPONSE_HEADER = /^(?:x-vercel-id|x-request-id|retry-after|retry-after-ms|x-ratelimit-.+)$/;
+// Headers @ai-sdk/gateway sets to describe the model call; they must match the body the client built.
+const MODEL_CALL_HEADER = /^(?:ai-language-model-.+|ai-model-id|ai-[a-z]+-model-specification-version)$/;
+const REQUEST_METADATA_HEADER = /^(?:ai-o11y-.+|idempotency-key|accept)$/;
+// Paths relative to baseUrl where @ai-sdk/gateway 4.x posts a call that is not a language model call.
+const NON_LANGUAGE_MODEL_PATHS = new Map([
+    [
+        "embedding-model",
+        "embedding"
+    ],
+    [
+        "image-model",
+        "image"
+    ],
+    [
+        "video-model",
+        "video"
+    ],
+    [
+        "video-model/start",
+        "video"
+    ],
+    [
+        "speech-model",
+        "speech"
+    ],
+    [
+        "transcription-model",
+        "transcription"
+    ],
+    [
+        "reranking-model",
+        "reranking"
+    ],
+    [
+        "decision-model",
+        "decision"
+    ],
+    [
+        "batch/start",
+        "batch"
+    ]
+]);
+// @ai-sdk/gateway's calls that read or cancel a job rather than start a model call.
+const READ_PATHS = new Set([
+    "batch/status",
+    "batch/results",
+    "batch/cancel",
+    "video-model/status"
+]);
+const NULL_BODY_STATUS = new Set([
+    204,
+    205
+]);
+// AI SDK clients retry 408, 409, 429 and any 5xx, which would pay for the answered call again.
+const ANSWERED_CALL_FAILURE_STATUS = 424;
+// Successful bodies that are a sequence of values rather than one JSON value: event streams and JSON Lines.
+const STREAM_CONTENT_TYPE = /^\s*(?:text\/event-stream|application\/(?:x-ndjson|jsonl|jsonlines|x-jsonlines))\s*(?:;|$)/i;
 /**
  * Extracts the path from the request using either a custom extractor or route params.
- */ function extractPathFromRequest(request, context, options) {
-    return _async_to_generator._(function*() {
-        if (options.extractPath) {
-            return options.extractPath(request);
+ */ async function extractPathFromRequest(request, context, options) {
+    if (options.extractPath) {
+        return options.extractPath(request);
+    }
+    if (context?.params) {
+        const params = await context.params;
+        const segments = params[options.segmentsParam];
+        return Array.isArray(segments) ? segments.join("/") : segments ?? "";
+    }
+    return "";
+}
+function isSafePath(path) {
+    if (path.startsWith("/") || path.includes("://")) {
+        return false;
+    }
+    for (const segment of path.split("/")){
+        let decoded;
+        try {
+            decoded = decodeURIComponent(segment);
+        } catch  {
+            return false;
         }
-        if (context == null ? void 0 : context.params) {
-            const params = yield context.params;
-            const segments = params[options.segmentsParam];
-            return Array.isArray(segments) ? segments.join("/") : segments != null ? segments : "";
+        if (decoded === "." || decoded === ".." || /[/\\\0]/.test(decoded)) {
+            return false;
         }
-        return "";
-    })();
+    }
+    return true;
 }
 /**
- * Builds the upstream URL from base URL, path, and query params.
+ * Builds the upstream URL from base URL, path, and query params, with its pathname relative to
+ * the base URL. Returns null when the path would leave the base URL.
  */ function buildUpstreamUrl(baseUrl, path, requestUrl) {
-    const searchParams = new URL(requestUrl).searchParams;
-    const queryString = searchParams.toString();
-    return `${baseUrl}/${path}${queryString ? `?${queryString}` : ""}`;
+    if (!isSafePath(path)) {
+        return null;
+    }
+    const base = new URL(baseUrl.replace(/\/?$/, "/"));
+    // The "./" prefix keeps a segment containing ":" from being parsed as a scheme.
+    const url = new URL(`./${path}`, base);
+    if (url.origin !== base.origin || !url.pathname.startsWith(base.pathname)) {
+        return null;
+    }
+    const queryString = new URL(requestUrl).searchParams.toString();
+    if (queryString) {
+        url.search = queryString;
+    }
+    return {
+        url: url.toString(),
+        relativePath: url.pathname.slice(base.pathname.length)
+    };
+}
+/**
+ * Applies the proxy's own headers over the caller's `headers`. `Headers` matches names
+ * case-insensitively, so a custom `Authorization` cannot sit beside the gateway's `authorization`.
+ */ function withGatewayHeaders(customHeaders, gatewayHeaders) {
+    const headers = new Headers(customHeaders);
+    for (const [name, value] of Object.entries(gatewayHeaders)){
+        headers.set(name, value);
+    }
+    return Object.fromEntries(headers);
 }
 /**
- * Builds the headers for the upstream request.
- */ function buildRequestHeaders(auth, isStreaming, modelId, customHeaders) {
-    return _extends._({
-        "content-type": "application/json"
-    }, customHeaders, {
+ * Builds the headers for the upstream request: the caller's `headers`, then the model call and
+ * request metadata headers from the incoming request, then the proxy's own.
+ */ function buildRequestHeaders(auth, request, customHeaders) {
+    const headers = new Headers(customHeaders);
+    for (const name of [
+        ...headers.keys()
+    ]){
+        if (MODEL_CALL_HEADER.test(name)) {
+            headers.delete(name);
+        }
+    }
+    for (const [name, value] of request.headers){
+        if (MODEL_CALL_HEADER.test(name) || REQUEST_METADATA_HEADER.test(name)) {
+            headers.set(name, value);
+        }
+    }
+    return withGatewayHeaders(headers, {
+        "content-type": "application/json",
         authorization: `Bearer ${auth.token}`,
         "ai-gateway-auth-method": auth.authMethod,
-        "ai-gateway-protocol-version": PROTOCOL_VERSION,
-        "ai-language-model-id": modelId != null ? modelId : "",
-        "ai-language-model-streaming": isStreaming ? "true" : "false"
+        "ai-gateway-protocol-version": PROTOCOL_VERSION
     });
 }
 /**
- * Parses the error response from the gateway.
- */ function parseErrorBody(res) {
-    return _async_to_generator._(function*() {
-        try {
-            return yield res.json();
-        } catch (unused) {
-            return {
-                error: {
-                    message: res.statusText || "Unknown error",
-                    type: "gateway_error"
-                }
-            };
+ * Builds a response for an error the proxy raises itself, in the same shape as upstream errors.
+ */ function proxyErrorResponse(status, type, message) {
+    const body = {
+        error: {
+            message,
+            type
+        }
+    };
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: {
+            "content-type": "application/json"
         }
-    })();
+    });
+}
+function isRedirect(res) {
+    return res.type === "opaqueredirect" || res.status >= 300 && res.status < 400;
+}
+function redirectRefusedResponse(res) {
+    res.body?.cancel().catch(()=>{});
+    return proxyErrorResponse(502, "proxy_error", "Upstream redirected, the proxy does not follow redirects");
+}
+function proxyFailureResponse(request, error) {
+    if (request.signal.aborted) {
+        return new Response(null, {
+            status: 499
+        });
+    }
+    console.error("AI Gateway proxy request failed:", error);
+    return proxyErrorResponse(500, "proxy_error", "Error proxying request to AI Gateway");
 }
 /**
- * Creates an error response, optionally applying the onError hook.
- */ function createErrorResponse(res, errorBody, requestBody, onError) {
-    return _async_to_generator._(function*() {
-        if (onError) {
-            const result = yield onError({
-                request: requestBody,
-                error: errorBody,
-                status: res.status
-            });
-            if (result instanceof Response) {
-                return result;
-            }
-            return new Response(JSON.stringify(result), {
-                status: res.status,
-                statusText: res.statusText,
-                headers: {
-                    "content-type": "application/json"
-                }
-            });
+ * Forwards a GET or HEAD request, such as the gateway's `/config` model list, or a request whose
+ * body is missing or empty, without a body.
+ * The hooks are typed for language model calls, so none of them run here.
+ */ async function forwardBodylessRequest(request, upstream, auth, customHeaders) {
+    try {
+        const res = await fetch(upstream, {
+            method: request.method,
+            signal: request.signal,
+            headers: withGatewayHeaders(customHeaders, {
+                authorization: `Bearer ${auth.token}`,
+                "ai-gateway-auth-method": auth.authMethod,
+                "ai-gateway-protocol-version": PROTOCOL_VERSION
+            }),
+            redirect: "manual"
+        });
+        if (isRedirect(res)) {
+            return redirectRefusedResponse(res);
         }
-        return new Response(JSON.stringify(errorBody), {
-            status: res.status,
-            statusText: res.statusText,
-            headers: {
-                "content-type": "application/json"
-            }
+        return passThroughResponse(res);
+    } catch (error) {
+        return proxyFailureResponse(request, error);
+    }
+}
+function isGatewayError(value) {
+    if (typeof value !== "object" || value === null) {
+        return false;
+    }
+    const { error } = value;
+    return typeof error === "object" && error !== null && typeof error.message === "string";
+}
+/**
+ * Parses the error response from the gateway. A body that is not a JSON `{ error: { message } }`,
+ * such as an HTML page from an edge or load balancer, becomes a `gateway_error` naming the status
+ * and a short excerpt, so `onError` always receives the `GatewayError` shape.
+ */ async function parseErrorBody(res) {
+    const text = await res.text().catch(()=>"");
+    try {
+        const parsed = JSON.parse(text);
+        if (isGatewayError(parsed)) {
+            return parsed;
+        }
+    } catch  {}
+    const excerpt = text.replace(/\s+/g, " ").trim().slice(0, MAX_ERROR_EXCERPT_LENGTH);
+    const message = excerpt ? `AI Gateway returned ${res.status}: ${excerpt}` : `AI Gateway returned ${res.status} ${res.statusText}`.trimEnd();
+    return {
+        error: {
+            message,
+            type: "gateway_error"
+        }
+    };
+}
+/**
+ * Builds response headers with the given content type, if any, plus the allowlisted upstream headers.
+ */ function responseHeaders(res, contentType) {
+    const headers = new Headers(contentType ? {
+        "content-type": contentType
+    } : undefined);
+    for (const [name, value] of res.headers){
+        if (FORWARDED_RESPONSE_HEADER.test(name)) {
+            headers.set(name, value);
+        }
+    }
+    return headers;
+}
+/**
+ * Sends the upstream body unread, with its `content-type` and the allowlisted upstream headers.
+ */ function passThroughResponse(res) {
+    return new Response(res.body, {
+        status: res.status,
+        statusText: res.statusText,
+        headers: responseHeaders(res, res.headers.get("content-type") ?? "application/json")
+    });
+}
+/**
+ * Runs onError and returns the body or Response to send, falling back to the upstream error body.
+ */ async function runOnError(onError, res, upstreamError, requestBody) {
+    let result;
+    try {
+        result = await onError({
+            request: requestBody,
+            error: upstreamError,
+            status: res.status
         });
-    })();
+    } catch (error) {
+        // A 500 would hide the upstream status and its retry-after, and make a 400 look retryable.
+        console.error("onError hook failed, forwarding the upstream error body:", error);
+        return upstreamError;
+    }
+    if (result instanceof Response) {
+        return result;
+    }
+    // A JavaScript caller can return nothing, such as a hook that only logs.
+    if (result === undefined || result === null) {
+        console.error("onError hook returned no response, forwarding the upstream error body");
+        return upstreamError;
+    }
+    const problem = gatewayErrorProblem(result);
+    if (problem) {
+        console.error(`onError hook returned an invalid error, forwarding the upstream error body: ${problem}`);
+        return upstreamError;
+    }
+    return result;
+}
+/**
+ * Creates an error response, optionally applying the onError hook.
+ */ async function createErrorResponse(res, upstreamError, requestBody, onError) {
+    const errorBody = onError ? await runOnError(onError, res, upstreamError, requestBody) : upstreamError;
+    if (errorBody instanceof Response) {
+        return errorBody;
+    }
+    return new Response(JSON.stringify(errorBody), {
+        status: res.status,
+        statusText: res.statusText,
+        headers: responseHeaders(res, "application/json")
+    });
 }
 /**
  * Handles a streaming response from the gateway.
- */ function handleStreamingResponse(res, requestBody, afterResponse) {
+ */ function handleStreamingResponse(res, requestBody, afterResponse, signal) {
     if (!res.body) {
-        return new Response("No response body", {
-            status: 500
-        });
+        return proxyErrorResponse(500, "proxy_error", "No response body");
     }
     const contentType = res.headers.get("content-type") || "text/event-stream";
     // Pass through directly if no afterResponse hook
@@ -332,100 +762,248 @@ const PROTOCOL_VERSION = "0.0.1";
         return new Response(res.body, {
             status: res.status,
             statusText: res.statusText,
-            headers: {
-                "content-type": contentType
-            }
+            headers: responseHeaders(res, contentType)
         });
     }
     // Transform stream to call afterResponse on finish
-    const transformedStream = createStreamTransformer(res.body, requestBody, afterResponse);
+    const transformedStream = createStreamTransformer(res.body, requestBody, afterResponse, signal);
     return new Response(transformedStream, {
         status: res.status,
         statusText: res.statusText,
-        headers: {
-            "content-type": contentType
-        }
+        headers: responseHeaders(res, contentType)
     });
 }
 /**
- * Handles a non-streaming JSON response from the gateway.
- */ function handleJsonResponse(res, requestBody, afterResponse) {
-    return _async_to_generator._(function*() {
-        let responseBody = yield res.json();
-        if (afterResponse) {
-            responseBody = yield afterResponse({
-                request: requestBody,
-                response: responseBody
-            });
+ * Runs afterResponse on a non-streaming JSON response from the gateway.
+ * The gateway has answered, and billed, the call, so a failure here gets a status clients do not retry.
+ */ async function handleJsonResponse(res, requestBody, afterResponse, signal) {
+    try {
+        return await runAfterResponse(res, requestBody, afterResponse);
+    } catch (error) {
+        // The handler answers a client abort with 499.
+        if (signal.aborted) {
+            throw error;
+        }
+        console.error("AI Gateway proxy failed after the gateway answered:", error);
+        return proxyErrorResponse(ANSWERED_CALL_FAILURE_STATUS, "proxy_error", "Error processing the AI Gateway response");
+    }
+}
+async function runAfterResponse(res, requestBody, afterResponse) {
+    const parsed = await res.json();
+    if (!isRecord(parsed)) {
+        throw new TypeError("AI Gateway returned a successful body that is not a JSON object");
+    }
+    let responseBody = parsed;
+    // Read before the hook, which may delete it from the object it receives.
+    const upstreamUsage = responseBody.usage;
+    const modified = await afterResponse({
+        request: requestBody,
+        response: responseBody
+    });
+    // A JavaScript caller can return nothing.
+    if (modified === undefined || modified === null) {
+        console.error("afterResponse hook returned no response, forwarding the upstream body");
+    } else {
+        const problem = gatewayResponseProblem(modified);
+        if (problem) {
+            const message = `afterResponse hook returned an invalid response: ${problem}`;
+            console.error(message);
+            return proxyErrorResponse(ANSWERED_CALL_FAILURE_STATUS, "proxy_error", message);
         }
-        return new Response(JSON.stringify(responseBody), {
+        // As on a stream's finish event: the AI SDK reads usage from every generate result, so it cannot be stripped.
+        responseBody = {
+            ...modified,
+            usage: modified.usage ?? upstreamUsage
+        };
+    }
+    return new Response(JSON.stringify(responseBody), {
+        status: res.status,
+        statusText: res.statusText,
+        headers: responseHeaders(res, "application/json")
+    });
+}
+/**
+ * Wraps the hooks so each call also receives the model id, which the stream transformer does not know.
+ */ function withModelId({ afterResponse, onError }, modelId) {
+    return {
+        afterResponse: afterResponse && ((context)=>afterResponse({
+                ...context,
+                modelId
+            })),
+        onError: onError && ((context)=>onError({
+                ...context,
+                modelId
+            }))
+    };
+}
+/**
+ * Builds the client response for a non-redirect upstream response, running the language model hooks given.
+ */ async function forwardUpstreamResponse(res, requestBody, isStreaming, { afterResponse, onError }, signal) {
+    if (!res.ok) {
+        const errorBody = await parseErrorBody(res);
+        return await createErrorResponse(res, errorBody, requestBody, onError);
+    }
+    // A 204 or 205 has no body to parse or hand to afterResponse, and a Response with it cannot carry one.
+    if (NULL_BODY_STATUS.has(res.status)) {
+        return new Response(null, {
             status: res.status,
             statusText: res.statusText,
-            headers: {
-                "content-type": "application/json"
-            }
+            headers: responseHeaders(res)
         });
-    })();
+    }
+    if (isStreaming) {
+        return handleStreamingResponse(res, requestBody, afterResponse, signal);
+    }
+    // Only afterResponse reads a success body; without it, or for an event stream or JSON Lines, it streams through.
+    if (!afterResponse || STREAM_CONTENT_TYPE.test(res.headers.get("content-type") ?? "")) {
+        return passThroughResponse(res);
+    }
+    return await handleJsonResponse(res, requestBody, afterResponse, signal);
+}
+/**
+ * Cancels a body nothing will read, since an unread fetch body holds its upstream connection.
+ */ function discardUnreadBody(response) {
+    if (response.body && !response.bodyUsed && !response.body.locked) {
+        response.body.cancel().catch(()=>{});
+    }
+}
+/**
+ * Runs afterRawResponse and returns the response to send.
+ */ async function applyAfterRawResponse(afterRawResponse, context) {
+    let result;
+    try {
+        result = await afterRawResponse(context);
+    } catch (error) {
+        discardUnreadBody(context.response);
+        throw error;
+    }
+    if (result instanceof Response) {
+        // A replacement built on response.body still needs it.
+        if (result.body !== context.response.body) {
+            discardUnreadBody(context.response);
+        }
+        return result;
+    }
+    if (result !== undefined && result !== null) {
+        discardUnreadBody(context.response);
+        throw new TypeError("afterRawResponse hook must return a Response or nothing");
+    }
+    if (context.response.bodyUsed) {
+        throw new TypeError("afterRawResponse hook read the response body and returned no Response; read response.clone() instead");
+    }
+    return context.response;
 }
 /**
  * Creates a proxy handler for the Vercel AI Gateway.
  *
- * Uses AI SDK V3 Language Model.
+ * Uses AI SDK V4 Language Model.
  * @see https://github.com/vercel/ai/blob/main/packages/gateway/src/gateway-language-model.ts
- */ const createGatewayProxy = ({ baseUrl = DEFAULT_BASE_URL, headers, segmentsParam = "segments", extractPath, beforeRequest, afterResponse, onError } = {})=>{
-    const handler = (request, context)=>_async_to_generator._(function*() {
-            // Authenticate with the gateway
-            const auth = yield getGatewayAuthToken();
-            if (!auth) {
-                return new Response("AI Gateway authentication not configured", {
-                    status: 500
-                });
-            }
+ */ const createGatewayProxy = ({ baseUrl = DEFAULT_BASE_URL, headers, segmentsParam = "segments", extractPath, beforeRequest, afterResponse, onError, beforeRawRequest, afterRawResponse } = {})=>{
+    const handler = async (request, context)=>{
+        // Authenticate with the gateway
+        const auth = await getGatewayAuthToken();
+        if (!auth) {
+            // Not authentication_error: @ai-sdk/gateway replaces that message with advice about the client's own key.
+            return proxyErrorResponse(500, "proxy_error", "AI Gateway authentication not configured: set AI_GATEWAY_API_KEY or deploy on Vercel with OIDC enabled");
+        }
+        try {
             // Build upstream URL
-            const path = yield extractPathFromRequest(request, context, {
+            const path = await extractPathFromRequest(request, context, {
                 extractPath,
                 segmentsParam
             });
-            const upstream = buildUpstreamUrl(baseUrl, path, request.url);
+            const resolved = buildUpstreamUrl(baseUrl, path, request.url);
+            if (!resolved) {
+                return proxyErrorResponse(400, "invalid_request_error", "Invalid path");
+            }
+            const upstream = resolved.url;
+            if (request.method === "GET" || request.method === "HEAD" || request.body === null) {
+                return await forwardBodylessRequest(request, upstream, auth, headers);
+            }
+            // Node adapters give every method but GET and HEAD a body stream, so an empty one is bodyless too
+            const text = await request.text();
+            if (text === "") {
+                return await forwardBodylessRequest(request, upstream, auth, headers);
+            }
             // Parse request body
             let requestBody;
             try {
-                requestBody = yield request.clone().json();
-            } catch (unused) {
-                return new Response("Invalid JSON body", {
-                    status: 400
+                requestBody = JSON.parse(text);
+            } catch  {
+                return proxyErrorResponse(400, "invalid_request_error", "Invalid JSON body");
+            }
+            // Fail closed: only an exact listed path, after "?" and "#" are resolved away, skips the hooks.
+            const kind = NON_LANGUAGE_MODEL_PATHS.get(resolved.relativePath);
+            const runsHooks = kind === undefined && !READ_PATHS.has(resolved.relativePath);
+            // The language model hooks are typed for call options, so they never receive another JSON value.
+            if (runsHooks && (beforeRequest || afterResponse || onError) && !isRecord(requestBody)) {
+                return proxyErrorResponse(400, "invalid_request_error", "Invalid request body: a language model call must be a JSON object");
+            }
+            const rawContext = kind && {
+                kind,
+                path: resolved.relativePath,
+                modelId: request.headers.get("ai-model-id") ?? undefined
+            };
+            // A hook can replace or mutate the parsed body, so only then is it serialised again.
+            let bodyHandedToHook = false;
+            // The body does not name the model; @ai-sdk/gateway sends it in this header.
+            const modelId = request.headers.get("ai-language-model-id") ?? undefined;
+            if (beforeRequest && runsHooks) {
+                bodyHandedToHook = true;
+                const replaced = await beforeRequest({
+                    request: requestBody,
+                    modelId
                 });
+                // A JavaScript caller can return nothing, such as a hook that only logs.
+                if (replaced === undefined || replaced === null) {
+                    console.error("beforeRequest hook returned no request, sending the original body");
+                } else if (!isRecord(replaced)) {
+                    const message = "beforeRequest hook returned an invalid request: the result must be an object";
+                    console.error(message);
+                    return proxyErrorResponse(500, "proxy_error", message);
+                } else {
+                    requestBody = replaced;
+                }
             }
-            // Apply beforeRequest hook
-            if (beforeRequest) {
-                requestBody = yield beforeRequest({
+            if (beforeRawRequest && rawContext) {
+                bodyHandedToHook = true;
+                const replaced = await beforeRawRequest({
+                    ...rawContext,
                     request: requestBody
                 });
+                // null, like undefined, keeps the body rather than sending the literal null upstream.
+                if (replaced !== undefined && replaced !== null) {
+                    requestBody = replaced;
+                }
             }
             const isStreaming = request.headers.get("ai-language-model-streaming") === "true";
-            try {
-                const res = yield fetch(upstream, {
-                    method: request.method,
-                    body: JSON.stringify(requestBody),
-                    duplex: "half",
-                    headers: buildRequestHeaders(auth, isStreaming, request.headers.get("ai-language-model-id"), headers)
-                });
-                // Handle error responses
-                if (!res.ok) {
-                    const errorBody = yield parseErrorBody(res);
-                    return createErrorResponse(res, errorBody, requestBody, onError);
-                }
-                // Handle successful responses
-                if (isStreaming) {
-                    return handleStreamingResponse(res, requestBody, afterResponse);
-                }
-                return handleJsonResponse(res, requestBody, afterResponse);
-            } catch (unused) {
-                return new Response("Error proxying request to AI Gateway", {
-                    status: 500
+            const res = await fetch(upstream, {
+                method: request.method,
+                body: bodyHandedToHook ? JSON.stringify(requestBody) : text,
+                duplex: "half",
+                signal: request.signal,
+                headers: buildRequestHeaders(auth, request, headers),
+                redirect: "manual"
+            });
+            if (isRedirect(res)) {
+                return redirectRefusedResponse(res);
+            }
+            const response = await forwardUpstreamResponse(res, requestBody, isStreaming, runsHooks ? withModelId({
+                afterResponse,
+                onError
+            }, modelId) : {}, request.signal);
+            if (afterRawResponse && rawContext) {
+                return await applyAfterRawResponse(afterRawResponse, {
+                    ...rawContext,
+                    request: requestBody,
+                    response
                 });
             }
-        })();
+            return response;
+        } catch (error) {
+            return proxyFailureResponse(request, error);
+        }
+    };
     // Export handler for all HTTP methods
     handler.GET = handler;
     handler.POST = handler;