{"record":{"id":"296ff1820cd7a2d1","repo":"earendil-works/pi","slug":"creategatewaybindingfetch-method-url-is-out","errorCode":null,"errorMessage":"createGatewayBindingFetch: ${method} ${url} is outside the configured gateway prefix (${base.origin}${basePath}); this fetch only serves its gateway-bound client","messagePattern":"createGatewayBindingFetch: (.+?) (.+?) is outside the configured gateway prefix \\((.+?)(.+?)\\); this fetch only serves its gateway-bound client","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/ai/src/api/cloudflare-gateway-binding.ts","lineNumber":100,"sourceCode":"\t// dot segments resolve away and fragments drop, matching what real fetch would put on the\n\t// wire, so a lexical variant can't split provider/endpoint differently than HTTPS would.\n\tconst base = new URL(options.baseUrl);\n\tconst basePath = base.pathname.endsWith(\"/\") ? base.pathname : `${base.pathname}/`;\n\n\treturn async (input: FetchInput, init?: RequestInit): Promise<Response> => {\n\t\tconst request = input instanceof Request ? input : undefined;\n\t\tconst url = request ? request.url : input.toString();\n\t\tconst method = (init?.method ?? request?.method ?? \"GET\").toUpperCase();\n\t\tlet parsed: URL | undefined;\n\t\ttry {\n\t\t\tparsed = new URL(url);\n\t\t} catch {\n\t\t\tparsed = undefined;\n\t\t}\n\t\t// Out-of-prefix URLs are a configuration bug, not passthrough traffic: silently\n\t\t// forwarding would ship the auth sentinel to whatever host the URL names.\n\t\tif (parsed === undefined || parsed.origin !== base.origin || !parsed.pathname.startsWith(basePath)) {\n\t\t\tthrow new Error(\n\t\t\t\t`createGatewayBindingFetch: ${method} ${url} is outside the configured gateway ` +\n\t\t\t\t\t`prefix (${base.origin}${basePath}); this fetch only serves its gateway-bound client`,\n\t\t\t);\n\t\t}\n\n\t\t// In-prefix requests the universal endpoint cannot express always reject: forwarding\n\t\t// them over HTTPS would send the sentinel to the gateway and fail with a misleading\n\t\t// auth error instead of naming the real problem. Callers that need such endpoints\n\t\t// route them over HTTPS with real gateway auth themselves.\n\t\tconst unexpressible = (reason: string): never => {\n\t\t\tthrow new Error(\n\t\t\t\t`createGatewayBindingFetch: cannot express ${method} ${url} as a universal ` +\n\t\t\t\t\t`gateway request (${reason}); route it over HTTPS with gateway auth instead`,\n\t\t\t);\n\t\t};\n\t\tif (method !== \"POST\") return unexpressible(\"only POST is supported\");\n\n\t\tconst rest = parsed.pathname.slice(basePath.length);","sourceCodeStart":82,"sourceCodeEnd":118,"githubUrl":"https://github.com/earendil-works/pi/blob/4af9d21d3b4d664e4a29fcabfec85171077248e3/packages/ai/src/api/cloudflare-gateway-binding.ts#L82-L118","documentation":"Error \"createGatewayBindingFetch: ${method} ${url} is outside the configured gateway prefix (${base.origin}${basePath}); this fetch only serves its gateway-bound client\" thrown in earendil-works/pi.","triggerScenarios":"Thrown at packages/ai/src/api/cloudflare-gateway-binding.ts:100 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Only request URLs under the configured gateway prefix with this fetch; use a normal authenticated fetch for other URLs."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4af9d21d3b4d664e4a29fcabfec85171077248e3","analyzedAt":"2026-08-24T13:07:14.692Z","schemaVersion":2},"datasetVersion":"2026-08-24T17:17:21.512Z"}