createGatewayBindingFetch: ${method} ${url} is outside the c

Error message

createGatewayBindingFetch: ${method} ${url} is outside the configured gateway prefix (${base.origin}${basePath}); this fetch only serves its gateway-bound client

What it means

Error "createGatewayBindingFetch: ${method} ${url} is outside the configured gateway prefix (${base.origin}${basePath}); this fetch only serves its gateway-bound client" thrown in earendil-works/pi.

Source

Thrown at packages/ai/src/api/cloudflare-gateway-binding.ts:100

	// dot segments resolve away and fragments drop, matching what real fetch would put on the
	// wire, so a lexical variant can't split provider/endpoint differently than HTTPS would.
	const base = new URL(options.baseUrl);
	const basePath = base.pathname.endsWith("/") ? base.pathname : `${base.pathname}/`;

	return async (input: FetchInput, init?: RequestInit): Promise<Response> => {
		const request = input instanceof Request ? input : undefined;
		const url = request ? request.url : input.toString();
		const method = (init?.method ?? request?.method ?? "GET").toUpperCase();
		let parsed: URL | undefined;
		try {
			parsed = new URL(url);
		} catch {
			parsed = undefined;
		}
		// Out-of-prefix URLs are a configuration bug, not passthrough traffic: silently
		// forwarding would ship the auth sentinel to whatever host the URL names.
		if (parsed === undefined || parsed.origin !== base.origin || !parsed.pathname.startsWith(basePath)) {
			throw new Error(
				`createGatewayBindingFetch: ${method} ${url} is outside the configured gateway ` +
					`prefix (${base.origin}${basePath}); this fetch only serves its gateway-bound client`,
			);
		}

		// In-prefix requests the universal endpoint cannot express always reject: forwarding
		// them over HTTPS would send the sentinel to the gateway and fail with a misleading
		// auth error instead of naming the real problem. Callers that need such endpoints
		// route them over HTTPS with real gateway auth themselves.
		const unexpressible = (reason: string): never => {
			throw new Error(
				`createGatewayBindingFetch: cannot express ${method} ${url} as a universal ` +
					`gateway request (${reason}); route it over HTTPS with gateway auth instead`,
			);
		};
		if (method !== "POST") return unexpressible("only POST is supported");

		const rest = parsed.pathname.slice(basePath.length);

View on GitHub (pinned to 4af9d21d3b)

Solutions

Only request URLs under the configured gateway prefix with this fetch; use a normal authenticated fetch for other URLs.

When it happens

Trigger: Thrown at packages/ai/src/api/cloudflare-gateway-binding.ts:100 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of earendil-works/pi@4af9d21d3b (2026-08-24). Data as JSON: /api/errors/296ff1820cd7a2d1. Report an issue: GitHub.