ldrouter 1.6.0 → 1.6.2

package/dist/server/routing/ratelimit.js

@@ -0,0 +1,58 @@
+// In-memory rate limiter: token bucket per key for RPM, TPM, concurrency.
+const rpmBuckets = new Map();
+const tpmBuckets = new Map();
+const concurrentCounters = new Map();
+export function checkRpm(keyId, rpmLimit) {
+    if (rpmLimit == null || rpmLimit <= 0)
+        return { allowed: true };
+    const now = Date.now();
+    const bucket = rpmBuckets.get(keyId) ?? { tokens: rpmLimit, lastRefill: now };
+    // Refill 1 token per (60_000 / rpm) ms
+    const elapsed = now - bucket.lastRefill;
+    const refillPerMs = rpmLimit / 60_000;
+    const newTokens = Math.min(rpmLimit, bucket.tokens + elapsed * refillPerMs);
+    if (newTokens < 1) {
+        rpmBuckets.set(keyId, { tokens: newTokens, lastRefill: now });
+        const wait = (1 - newTokens) / refillPerMs / 1000;
+        return { allowed: false, reason: 'rpm', retryAfterSeconds: Math.ceil(wait) };
+    }
+    rpmBuckets.set(keyId, { tokens: newTokens - 1, lastRefill: now });
+    return { allowed: true };
+}
+export function checkTpm(keyId, tpmLimit, tokensToConsume) {
+    if (tpmLimit == null || tpmLimit <= 0)
+        return { allowed: true };
+    const now = Date.now();
+    const bucket = tpmBuckets.get(keyId) ?? { tokens: tpmLimit, lastRefill: now };
+    const elapsed = now - bucket.lastRefill;
+    const refillPerMs = tpmLimit / 60_000;
+    const newTokens = Math.min(tpmLimit, bucket.tokens + elapsed * refillPerMs);
+    if (newTokens < tokensToConsume) {
+        tpmBuckets.set(keyId, { tokens: newTokens, lastRefill: now });
+        const wait = (tokensToConsume - newTokens) / refillPerMs / 1000;
+        return { allowed: false, reason: 'tpm', retryAfterSeconds: Math.ceil(wait) };
+    }
+    tpmBuckets.set(keyId, { tokens: newTokens - tokensToConsume, lastRefill: now });
+    return { allowed: true };
+}
+export function acquireConcurrent(keyId, max) {
+    if (max == null || max <= 0) {
+        concurrentCounters.set(keyId, (concurrentCounters.get(keyId) ?? 0) + 1);
+        return true;
+    }
+    const cur = concurrentCounters.get(keyId) ?? 0;
+    if (cur >= max)
+        return false;
+    concurrentCounters.set(keyId, cur + 1);
+    return true;
+}
+export function releaseConcurrent(keyId) {
+    const cur = concurrentCounters.get(keyId) ?? 0;
+    concurrentCounters.set(keyId, Math.max(0, cur - 1));
+}
+export function activeRequests() {
+    let total = 0;
+    for (const v of concurrentCounters.values())
+        total += v;
+    return total;
+}

package/dist/server/routing/resolver.js

@@ -0,0 +1,43 @@
+// Model resolution: physical model, combo, or alias (one hop only).
+import { eq, and } from 'drizzle-orm';
+import { getDb, schema } from '../db/index.js';
+import { GatewayError } from '../errors.js';
+export function resolveRequestedModel(requested) {
+    const db = getDb();
+    // Physical model
+    const model = db.select().from(schema.models).where(eq(schema.models.publicModelId, requested)).get();
+    if (model && model.enabled) {
+        return { kind: 'model', modelId: model.id, publicModelId: model.publicModelId };
+    }
+    // Combo by exact public ID — with-prefix ("combo/<slug>") or the
+    // prefix-less default (<slug>).
+    const combo = db.select().from(schema.combos).where(eq(schema.combos.publicModelId, requested)).get();
+    if (combo && combo.enabled)
+        return { kind: 'combo', comboId: combo.id, publicModelId: combo.publicModelId };
+    // Alias (one hop only)
+    const alias = db.select().from(schema.modelAliases).where(and(eq(schema.modelAliases.alias, requested), eq(schema.modelAliases.enabled, true))).get();
+    if (alias) {
+        if (alias.targetKind === 'model') {
+            const m = db.select().from(schema.models).where(eq(schema.models.id, alias.targetId)).get();
+            if (m && m.enabled)
+                return { kind: 'alias', aliasId: alias.id, alias: alias.alias, resolved: { kind: 'model', modelId: m.id, publicModelId: m.publicModelId } };
+        }
+        else {
+            const c = db.select().from(schema.combos).where(eq(schema.combos.id, alias.targetId)).get();
+            if (c && c.enabled)
+                return { kind: 'alias', aliasId: alias.id, alias: alias.alias, resolved: { kind: 'combo', comboId: c.id, publicModelId: c.publicModelId } };
+        }
+    }
+    // Maybe the user typed the combo slug without the prefix
+    if (!requested.includes('/')) {
+        const c = db.select().from(schema.combos).where(eq(schema.combos.slug, requested)).get();
+        if (c && c.enabled)
+            return { kind: 'combo', comboId: c.id, publicModelId: c.publicModelId };
+    }
+    throw new GatewayError('model_not_found', `Unknown model: ${requested}`, { status: 404 });
+}
+export function unwrapAlias(t) {
+    if (t.kind === 'alias')
+        return t.resolved;
+    return t;
+}

package/dist/server/security/redact.js

@@ -0,0 +1,111 @@
+// Recursive structured redaction + defensive string redaction.
+// Never let secrets reach logs, audit metadata, or error responses.
+const DEFAULT_SECRET_KEYS = [
+    'authorization',
+    'authorizationheader',
+    'x-api-key',
+    'xapikey',
+    'api-key',
+    'apikey',
+    'api_key',
+    'apiKey',
+    'api_key_plain',
+    'apiKeyPlain',
+    'cookie',
+    'set-cookie',
+    'setcookie',
+    'session',
+    'sessiontoken',
+    'token',
+    'accesstoken',
+    'refresh_token',
+    'password',
+    'passwd',
+    'currentpassword',
+    'newpassword',
+    'masterkey',
+    'master_key',
+    'encrypted_api_key',
+    'apiKeyNonce',
+    'api_key_nonce',
+    'totpsecret',
+    'totp_secret',
+    'recoverycode',
+    'recoverycodes',
+    'secret',
+    'client_secret',
+    'privatekey',
+    'x-goog-api-key',
+];
+const SECRET_KEY_REGEX = /(authorization|api[-_]?key|api[-_]?secret|password|passwd|secret|token|cookie|master[-_]?key|totp|recovery|private[-_]?key|session)/i;
+const PLAINTEXT_PATTERNS = [
+    /\bld-[A-Za-z0-9_-]{20,}\b/g, // gateway api keys
+    /(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]{8,}/gi,
+    /sk-[A-Za-z0-9_-]{12,}/g, // OpenAI-style
+    /anthropic[_-]?[A-Za-z0-9_-]{20,}/gi,
+    /sk-ant-[A-Za-z0-9_-]{10,}/g,
+    /x-api-key[":= ]+[A-Za-z0-9._~+/=-]{8,}/gi,
+    /Authorization[":= ]+[A-Za-z0-9._~+/=-]{8,}/gi,
+];
+const REDACTED = '[REDACTED]';
+export function redactValue(value, opts = {}) {
+    const { secrets = [], keyMarker = REDACTED, secretKeys = DEFAULT_SECRET_KEYS } = opts;
+    const allSecrets = new Set(secrets.filter((s) => s && s.length >= 6));
+    return redactInternal(value, allSecrets, keyMarker, secretKeys);
+}
+function redactInternal(value, secrets, marker, secretKeys) {
+    if (value === null || value === undefined)
+        return value;
+    if (typeof value === 'string') {
+        let out = value;
+        for (const s of secrets) {
+            if (s && out.includes(s))
+                out = out.split(s).join(marker);
+        }
+        for (const re of PLAINTEXT_PATTERNS) {
+            out = out.replace(re, marker);
+        }
+        return out;
+    }
+    if (typeof value === 'number' || typeof value === 'boolean')
+        return value;
+    if (Array.isArray(value))
+        return value.map((v) => redactInternal(v, secrets, marker, secretKeys));
+    if (typeof value === 'object') {
+        const out = {};
+        for (const [k, v] of Object.entries(value)) {
+            if (secretKeys.includes(k) || SECRET_KEY_REGEX.test(k)) {
+                out[k] = v === null || v === undefined ? v : marker;
+            }
+            else {
+                out[k] = redactInternal(v, secrets, marker, secretKeys);
+            }
+        }
+        return out;
+    }
+    return value;
+}
+/** Redact any known secrets from a string (for error messages). */
+export function redactString(input, opts = {}) {
+    const { secrets = [] } = opts;
+    let out = input;
+    for (const s of secrets) {
+        if (s && out.includes(s))
+            out = out.split(s).join(REDACTED);
+    }
+    for (const re of PLAINTEXT_PATTERNS) {
+        out = out.replace(re, REDACTED);
+    }
+    return out;
+}
+export function redactJsonString(json, opts) {
+    if (!json)
+        return json ?? null;
+    try {
+        const parsed = JSON.parse(json);
+        return JSON.stringify(redactValue(parsed, opts));
+    }
+    catch {
+        return redactString(json, opts);
+    }
+}

package/dist/server/selfupdate/index.js

@@ -0,0 +1,208 @@
+// Self-update: check the npm registry for newer versions and apply them.
+//
+// Two deployment modes:
+// - npm global install: `run()` installs <pkg>@latest globally with the
+//   detected package manager, then signals SIGTERM to itself so the regular
+//   graceful-shutdown path (app.close + closeDb) runs and the supervisor
+//   (systemd/pm2/…) restarts the new version.
+// - Docker: `run()` asks a Watchtower sidecar (HTTP API, label-enable mode)
+//   to pull the new image and recreate this container. The registry is the
+//   source of truth for "latest" in both modes — npm and the GHCR image are
+//   published together from the same release.
+import fs from 'node:fs';
+import path from 'node:path';
+import process from 'node:process';
+import { execa } from 'execa';
+import semver from 'semver';
+import { getLogger } from '../logging/logger.js';
+import { getAppVersion } from '../version.js';
+// Pure: compare two semver versions. Returns null when either side is not a
+// valid semver string (e.g. dev builds), which callers treat as "no update".
+export function compareUpdate(currentVersion, latestVersion) {
+    const cur = semver.valid(semver.coerce(currentVersion));
+    const latest = semver.valid(semver.coerce(latestVersion));
+    if (!cur || !latest)
+        return null;
+    return semver.gt(latest, cur);
+}
+// Pure: derive the global-install command from where npm resolves its own
+// executable. When the gateway was installed globally with pnpm/yarn/bun,
+// those tools still run `npm exec`/npx under the hood, so
+// process.env.npm_execpath carries the invoking package manager's script.
+export function resolvePackageManager(npmExecPath) {
+    const pm = npmExecPath ? path.basename(npmExecPath).toLowerCase() : '';
+    if (pm.startsWith('pnpm'))
+        return { pm: 'pnpm', installArgs: (pkg) => ['add', '-g', pkg] };
+    if (pm.startsWith('yarn'))
+        return { pm: 'yarn', installArgs: (pkg) => ['global', 'add', pkg] };
+    if (pm.startsWith('bun'))
+        return { pm: 'bun', installArgs: (pkg) => ['add', '-g', pkg] };
+    return { pm: 'npm', installArgs: (pkg) => ['install', '-g', pkg] };
+}
+export class SelfUpdater {
+    packageName;
+    currentVersion;
+    inDocker;
+    cached = null;
+    updating = false;
+    constructor(packageName, currentVersion, inDocker = fs.existsSync('/.dockerenv')) {
+        this.packageName = packageName;
+        this.currentVersion = currentVersion;
+        this.inDocker = inDocker;
+    }
+    watchtowerEnabled() {
+        return Boolean(process.env.LATEDEV_WATCHTOWER_URL);
+    }
+    status() {
+        const docker = this.inDocker;
+        const watchtower = docker && this.watchtowerEnabled();
+        if (this.updating)
+            return { available: false, reason: 'Update already running', updating: true, docker, watchtower };
+        if (docker && !watchtower) {
+            return {
+                available: false,
+                reason: 'Docker deployment without a Watchtower updater — enable the watchtower compose service, or run `docker compose pull && docker compose up -d` on the host',
+                updating: false,
+                docker: true,
+                watchtower: false,
+            };
+        }
+        return { available: true, reason: null, updating: false, docker, watchtower };
+    }
+    // Checks the npm registry (10s timeout). Cached for 15 minutes; a failed
+    // check never raises — it just reports no update.
+    async check(force = false) {
+        const fresh = !force &&
+            this.cached &&
+            Date.now() - new Date(this.cached.checkedAt).getTime() < 15 * 60 * 1000;
+        if (fresh)
+            return this.cached;
+        try {
+            const controller = new AbortController();
+            const timer = setTimeout(() => controller.abort(), 10_000);
+            const res = await fetch(`https://registry.npmjs.org/${this.packageName}/latest`, {
+                signal: controller.signal,
+                headers: { accept: 'application/json' },
+            });
+            clearTimeout(timer);
+            const meta = (res.ok ? (await res.json()) : {});
+            const coerced = typeof meta.version === 'string' ? semver.coerce(meta.version) : null;
+            const latest = coerced && semver.valid(coerced) ? coerced.version : null;
+            const tarball = meta.dist?.tarball ?? null;
+            const result = {
+                currentVersion: this.currentVersion,
+                latestVersion: latest,
+                hasUpdate: latest ? compareUpdate(this.currentVersion, latest) === true : false,
+                // registry.npmjs.org serves package files (including CHANGELOG.md)
+                // straight from the tarball URL.
+                changelogUrl: tarball ? tarball.replace(/\/-\/.+$/, '/-/CHANGELOG.md') : null,
+                checkedAt: new Date().toISOString(),
+                watchtowerReachable: null,
+            };
+            result.watchtowerReachable = this.inDocker && this.watchtowerEnabled() ? await this.probeWatchtower() : null;
+            this.cached = result;
+            return result;
+        }
+        catch (e) {
+            getLogger().warn({ err: e.message }, 'update check failed');
+            return {
+                currentVersion: this.currentVersion,
+                latestVersion: null,
+                hasUpdate: false,
+                changelogUrl: null,
+                checkedAt: new Date().toISOString(),
+                watchtowerReachable: null,
+            };
+        }
+    }
+    // Cheap reachability probe (3s): any HTTP answer means the Watchtower API
+    // is up; a connection error means the sidecar service is not running.
+    async probeWatchtower() {
+        const url = process.env.LATEDEV_WATCHTOWER_URL;
+        if (!url)
+            return false;
+        const headers = {};
+        if (process.env.LATEDEV_WATCHTOWER_TOKEN)
+            headers.authorization = `Bearer ${process.env.LATEDEV_WATCHTOWER_TOKEN}`;
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), 3_000);
+        try {
+            // GET on the update endpoint: 404/405 is fine — it proves the API listens.
+            await fetch(`${url.replace(/\/$/, '')}/v1/update`, { headers, signal: controller.signal });
+            return true;
+        }
+        catch {
+            return false;
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    async run() {
+        const st = this.status();
+        if (!st.available)
+            throw new Error(st.reason ?? 'Update not available');
+        const check = await this.check(true);
+        if (!check.latestVersion || !check.hasUpdate)
+            throw new Error('No update available');
+        this.updating = true;
+        const log = getLogger();
+        try {
+            if (this.inDocker) {
+                await this.runWatchtower(check.latestVersion);
+                return { ok: true, message: `Watchtower is pulling version ${check.latestVersion} — the container will restart automatically.` };
+            }
+            const { pm, installArgs } = resolvePackageManager(process.env.npm_execpath);
+            log.info({ pm, pkg: this.packageName, to: check.latestVersion }, 'self-update: installing new version');
+            await execa(pm, installArgs(`${this.packageName}@${check.latestVersion}`), {
+                stdio: 'inherit',
+                timeout: 5 * 60 * 1000,
+            });
+            log.info({ from: this.currentVersion, to: check.latestVersion }, 'self-update: installed, restarting');
+            // Signal SIGTERM to ourselves: startApp's handler runs the graceful
+            // shutdown (app.close + closeDb), then the supervisor restarts the new
+            // version. With no supervisor the process simply stops — the install
+            // already succeeded.
+            setTimeout(() => process.kill(process.pid, 'SIGTERM'), 500).unref();
+            return { ok: true, message: `Updated ${this.currentVersion} → ${check.latestVersion}. Restarting…` };
+        }
+        finally {
+            // If the update failed, allow retries.
+            setTimeout(() => { this.updating = false; }, 2000).unref();
+        }
+    }
+    // Ask the Watchtower sidecar (HTTP API, label-enable mode) to update the
+    // containers that carry the com.centurylinklabs.watchtower.enable=true
+    // label — which includes this one. Watchtower pulls the new image and
+    // recreates the container; /data survives via the named volume.
+    async runWatchtower(latestVersion) {
+        const url = process.env.LATEDEV_WATCHTOWER_URL;
+        if (!url)
+            throw new Error('LATEDEV_WATCHTOWER_URL is not configured');
+        const headers = {};
+        if (process.env.LATEDEV_WATCHTOWER_TOKEN)
+            headers.authorization = `Bearer ${process.env.LATEDEV_WATCHTOWER_TOKEN}`;
+        getLogger().info({ to: latestVersion }, 'self-update: requesting Watchtower update');
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), 60_000);
+        let res;
+        try {
+            res = await fetch(`${url.replace(/\/$/, '')}/v1/update`, { method: 'POST', headers, signal: controller.signal });
+        }
+        catch (e) {
+            clearTimeout(timer);
+            throw new Error(`Watchtower is unreachable at ${url}: ${e.message}. Start the watchtower compose service first.`, { cause: e });
+        }
+        clearTimeout(timer);
+        if (!res.ok) {
+            const body = await res.text().catch(() => '');
+            throw new Error(`Watchtower rejected the update (HTTP ${res.status})${body ? `: ${body.slice(0, 200)}` : ''}`);
+        }
+    }
+}
+let updater = null;
+export function getSelfUpdater() {
+    if (!updater)
+        updater = new SelfUpdater('ldrouter', getAppVersion());
+    return updater;
+}

package/dist/server/upstream/client.js

@@ -0,0 +1,179 @@
+// Upstream HTTP client: streaming + non-streaming with timeouts and error normalization.
+import { decryptSecret, decryptCustomHeaders } from '../auth/crypto.js';
+import { GatewayError } from '../errors.js';
+import { buildHeaders, stripSlash } from '../providers/index.js';
+export function providerToUpstreamConfig(p) {
+    return {
+        type: p.type,
+        baseUrl: p.baseUrl,
+        apiKey: decryptSecret({ ciphertext: p.encryptedApiKey, nonce: p.apiKeyNonce, version: p.apiKeyVersion }),
+        customHeaders: decryptCustomHeaders(p.customHeadersEncrypted && p.customHeadersNonce
+            ? { ciphertext: p.customHeadersEncrypted, nonce: p.customHeadersNonce, version: 1 }
+            : null),
+        connectTimeoutMs: p.connectTimeoutMs,
+        firstTokenTimeoutMs: p.firstTokenTimeoutMs,
+        streamIdleTimeoutMs: p.streamIdleTimeoutMs,
+        totalTimeoutMs: p.totalTimeoutMs,
+    };
+}
+export async function callUpstreamNonStreaming(cfg, url, payload) {
+    const ctl = new AbortController();
+    const timer = setTimeout(() => ctl.abort(), cfg.totalTimeoutMs);
+    const start = Date.now();
+    try {
+        const res = await fetch(url, {
+            method: 'POST',
+            headers: { ...buildHeaders(cfg), 'content-type': 'application/json', accept: 'application/json' },
+            body: JSON.stringify(payload),
+            signal: ctl.signal,
+        });
+        const text = await res.text();
+        const ttft = Date.now() - start;
+        return {
+            status: res.status,
+            ok: res.ok,
+            text,
+            headers: Object.fromEntries(res.headers.entries()),
+            upstreamRequestId: extractUpstreamRequestId(res.headers),
+            ttftMs: ttft,
+        };
+    }
+    catch (e) {
+        const err = e;
+        if (err.name === 'AbortError') {
+            throw new GatewayError('timeout_error', 'Upstream request timed out', { status: 504, cause: e });
+        }
+        throw new GatewayError('upstream_unavailable', `Upstream connection failed: ${err.message}`, { status: 502, cause: e });
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+export function extractUpstreamRequestId(headers) {
+    if (headers instanceof Headers) {
+        return headers.get('x-request-id') ?? headers.get('request-id') ?? headers.get('x-amzn-requestid') ?? null;
+    }
+    return headers['x-request-id'] ?? headers['request-id'] ?? headers['x-amzn-requestid'] ?? null;
+}
+/**
+ * Call upstream with SSE streaming. Invokes onChunk for each SSE event.
+ * Returns a promise resolving when the stream completes or rejects on failure.
+ */
+export async function callUpstreamStreaming(cfg, url, payload, onChunk) {
+    const ctl = new AbortController();
+    const totalTimer = setTimeout(() => ctl.abort(), cfg.totalTimeoutMs);
+    const start = Date.now();
+    let ttft = null;
+    let firstTokenTimer = null;
+    let idleTimer = null;
+    const resetIdle = () => {
+        if (idleTimer)
+            clearTimeout(idleTimer);
+        idleTimer = setTimeout(() => ctl.abort(), cfg.streamIdleTimeoutMs);
+    };
+    try {
+        const res = await fetch(url, {
+            method: 'POST',
+            headers: { ...buildHeaders(cfg), 'content-type': 'application/json', accept: 'text/event-stream' },
+            body: JSON.stringify(payload),
+            signal: ctl.signal,
+        });
+        if (!res.ok || !res.body) {
+            const text = await res.text();
+            throw new UpstreamHttpError(res.status, text, extractUpstreamRequestId(res.headers));
+        }
+        // First-token watchdog
+        firstTokenTimer = setTimeout(() => ctl.abort(), cfg.firstTokenTimeoutMs);
+        resetIdle();
+        const reader = res.body.getReader();
+        const decoder = new TextDecoder();
+        let buffer = '';
+        let isFirst = true;
+        let done = false;
+        while (!done) {
+            const { value, done: streamDone } = await reader.read();
+            done = streamDone;
+            if (done)
+                break;
+            buffer += decoder.decode(value, { stream: true });
+            // Process complete SSE events (split on blank line)
+            let idx;
+            while ((idx = buffer.indexOf('\n\n')) >= 0) {
+                const rawEvent = buffer.slice(0, idx);
+                buffer = buffer.slice(idx + 2);
+                const lines = rawEvent.split('\n');
+                let data = '';
+                let event = 'message';
+                for (const line of lines) {
+                    if (line.startsWith('data:'))
+                        data = line.slice(5).trimStart();
+                    else if (line.startsWith('event:'))
+                        event = line.slice(6).trimStart();
+                }
+                if (data === '[DONE]') {
+                    done = true;
+                    break;
+                }
+                if (data) {
+                    if (ttft === null) {
+                        ttft = Date.now() - start;
+                        if (firstTokenTimer)
+                            clearTimeout(firstTokenTimer);
+                    }
+                    resetIdle();
+                    onChunk({ data, event }, isFirst);
+                    isFirst = false;
+                }
+            }
+        }
+        return {
+            headers: Object.fromEntries(res.headers.entries()),
+            upstreamRequestId: extractUpstreamRequestId(res.headers),
+            ttftMs: ttft ?? Date.now() - start,
+        };
+    }
+    catch (e) {
+        if (e instanceof UpstreamHttpError) {
+            if (e.status >= 500)
+                throw new GatewayError('upstream_error', `Upstream HTTP ${e.status}`, { status: 502, cause: e, code: 'upstream_http_' + e.status });
+            if (e.status === 429)
+                throw new GatewayError('upstream_rate_limit', 'Upstream rate limited', { status: 529, cause: e });
+            if (e.status === 401 || e.status === 403)
+                throw new GatewayError('upstream_auth_error', 'Upstream authentication failed', { status: 502, cause: e });
+            throw new GatewayError('upstream_error', `Upstream HTTP ${e.status}: ${e.bodyExcerpt}`, { status: 502, cause: e });
+        }
+        const err = e;
+        if (err.name === 'AbortError') {
+            if (ttft === null && firstTokenTimer) {
+                throw new GatewayError('timeout_error', 'Upstream first token timeout', { status: 504, cause: e });
+            }
+            throw new GatewayError('timeout_error', 'Upstream stream idle timeout', { status: 504, cause: e });
+        }
+        throw new GatewayError('upstream_unavailable', `Upstream connection failed: ${err.message}`, { status: 502, cause: e });
+    }
+    finally {
+        clearTimeout(totalTimer);
+        if (firstTokenTimer)
+            clearTimeout(firstTokenTimer);
+        if (idleTimer)
+            clearTimeout(idleTimer);
+    }
+}
+export class UpstreamHttpError extends Error {
+    status;
+    body;
+    requestId;
+    constructor(status, body, requestId) {
+        super(`Upstream HTTP ${status}`);
+        this.status = status;
+        this.body = body;
+        this.requestId = requestId;
+        this.name = 'UpstreamHttpError';
+    }
+    get bodyExcerpt() {
+        return this.body.slice(0, 500);
+    }
+}
+export function upstreamUrl(cfg, path) {
+    return `${stripSlash(cfg.baseUrl)}${path.startsWith('/') ? path : '/' + path}`;
+}