// CRITICALimport { Hono } from "hono";import { swaggerUI } from "@hono/swagger-ui";import { cors } from "hono/cors";import type { AppContext } from "../types/context";import { isHttpStatus } from "../core/errors";import { registerEngineRoutes } from "../modules/engines/routes";import { registerSystemRoutes } from "../modules/system/routes";import { registerModelsRoutes } from "../modules/models/routes"; import { registerAllProxyRoutes } from "../modules/proxy/routes";import { registerStudioRoutes } from "../modules/studio/routes";import { registerAudioRoutes } from "../modules/audio/routes";import { createOpenApiSpec } from "./openapi-spec";import { createMutatingAuthMiddleware, createMutatingRateLimitMiddleware,} from "./security-middleware"; /** * Create the Hono application. * @param context - App context. * @returns Hono app instance. */export const createApp = (context: AppContext): Hono => { const app = new Hono(); const allowedCorsOrigins = context.config.cors_origins ?? []; app.use( "*", cors({ origin: (origin) => (allowedCorsOrigins.includes(origin) ? origin : null), allowMethods: ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"], allowHeaders: ["Authorization", "Content-Type", "X-API-Key"], exposeHeaders: [ "X-RateLimit-Limit", "X-RateLimit-Remaining", "X-RateLimit-Reset", "Retry-After", ], maxAge: 600, }) ); app.use("*", async (ctx, next) => { const skip = new Set(["/metrics", "/events", "/status", "/api/docs", "/api/spec"]); if (!skip.has(ctx.req.path)) { context.logger.debug(`${ctx.req.method} ${ctx.req.path}`); } await next(); }); app.use("*", createMutatingRateLimitMiddleware(context)); app.use("*", createMutatingAuthMiddleware(context)); // Register all routes registerSystemRoutes(app, context); registerEngineRoutes(app, context); registerModelsRoutes(app, context); registerStudioRoutes(app, context); registerAudioRoutes(app, context); registerAllProxyRoutes(app, context); app.all("/controllers/route/*", async (ctx) => { const target = ctx.req.query("target") || ctx.req.header("x-vllm-target-controller") || ""; if (!target) return ctx.json({ detail: "target controller is required" }, { status: 400 }); let targetUrl: URL; try { targetUrl = new URL(target); if (targetUrl.protocol !== "http:" && targetUrl.protocol !== "https:") { throw new Error("unsupported protocol"); } } catch { return ctx.json({ detail: "target must be an http(s) controller URL" }, { status: 400 }); } const suffix = ctx.req.path.replace(/^\/controllers\/route\/?/, ""); const upstream = new URL(suffix, `${targetUrl.toString().replace(/\/+$/, "")}/`); for (const [key, value] of new URL(ctx.req.url).searchParams.entries()) { if (key !== "target") upstream.searchParams.append(key, value); } const init: RequestInit = { method: ctx.req.method, headers: { "content-type": ctx.req.header("content-type") ?? "application/json", authorization: ctx.req.header("authorization") ?? "", }, }; if (ctx.req.method !== "GET" && ctx.req.method !== "HEAD") { init.body = await ctx.req.raw.clone().arrayBuffer(); } const response = await fetch(upstream, init); return new Response(response.body, { status: response.status, headers: { "content-type": response.headers.get("content-type") ?? "application/json", "x-vllm-routed-controller": targetUrl.origin, }, }); }); // OpenAPI documentation endpoints app.get("/api/spec", (ctx) => ctx.json(createOpenApiSpec(context))); app.get("/api/docs", swaggerUI({ url: "/api/spec" })); app.notFound((ctx) => ctx.json({ detail: "Not Found" }, { status: 404 })); app.onError((error, ctx) => { if (isHttpStatus(error)) { return ctx.json({ detail: error.detail }, { status: error.status }); } // Client-initiated disconnects (stream cancel, page close, Droid // cancelling an in-flight request to start a new turn) are not our // bug. They must NEVER surface as 500 "Internal Server Error" or log // as "Unhandled error". The client's socket is already closed so the // response body will never reach them anyway; emit a terminal 499 // (client closed request) and move on. const name = (error as { name?: string })?.name ?? ""; const message = String(error); if ( name === "AbortError" || message.includes("AbortError") || message.includes("connection was closed") || message.includes("ERR_STREAM_PREMATURE_CLOSE") || message.includes("Stream was cancelled") || message.includes("stream was cancelled") || message.includes("The operation was aborted") || message.includes("readable stream is cancelled") ) { context.logger.debug("client disconnected mid-request", { method: ctx.req.method, path: ctx.req.path, }); return ctx.body(null, { status: 499 }); } context.logger.error("Unhandled error", { error: message }); return ctx.json({ detail: "Internal Server Error" }, { status: 500 }); }); return app;};
// CRITICAL
import { Hono } from "hono";
import { swaggerUI } from "@hono/swagger-ui";
import { cors } from "hono/cors";
import type { AppContext } from "../types/context";
import { isHttpStatus } from "../core/errors";
import { registerEngineRoutes } from "../modules/engines/routes";
import { registerSystemRoutes } from "../modules/system/routes";
import { registerModelsRoutes } from "../modules/models/routes";
import { registerAllProxyRoutes } from "../modules/proxy/routes";
import { registerStudioRoutes } from "../modules/studio/routes";
import { registerAudioRoutes } from "../modules/audio/routes";
import { createOpenApiSpec } from "./openapi-spec";
import {
createMutatingAuthMiddleware,
createMutatingRateLimitMiddleware,
} from "./security-middleware";
/**
* Create the Hono application.
* @param context - App context.
* @returns Hono app instance.
*/
export const createApp = (context: AppContext): Hono => {
const app = new Hono();
const allowedCorsOrigins = context.config.cors_origins ?? [];
app.use(
"*",
cors({
origin: (origin) => (allowedCorsOrigins.includes(origin) ? origin : null),
allowMethods: ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"],
allowHeaders: ["Authorization", "Content-Type", "X-API-Key"],
exposeHeaders: [
"X-RateLimit-Limit",
"X-RateLimit-Remaining",
"X-RateLimit-Reset",
"Retry-After",
],
maxAge: 600,
})
);
app.use("*", async (ctx, next) => {
const skip = new Set(["/metrics", "/events", "/status", "/api/docs", "/api/spec"]);
if (!skip.has(ctx.req.path)) {
context.logger.debug(`${ctx.req.method} ${ctx.req.path}`);
}
await next();
});
app.use("*", createMutatingRateLimitMiddleware(context));
app.use("*", createMutatingAuthMiddleware(context));
// Register all routes
registerSystemRoutes(app, context);
registerEngineRoutes(app, context);
registerModelsRoutes(app, context);
registerStudioRoutes(app, context);
registerAudioRoutes(app, context);
registerAllProxyRoutes(app, context);
app.all("/controllers/route/*", async (ctx) => {
const target = ctx.req.query("target") || ctx.req.header("x-vllm-target-controller") || "";
if (!target) return ctx.json({ detail: "target controller is required" }, { status: 400 });
let targetUrl: URL;
try {
targetUrl = new URL(target);
if (targetUrl.protocol !== "http:" && targetUrl.protocol !== "https:") {
throw new Error("unsupported protocol");
}
} catch {
return ctx.json({ detail: "target must be an http(s) controller URL" }, { status: 400 });
}
const suffix = ctx.req.path.replace(/^\/controllers\/route\/?/, "");
const upstream = new URL(suffix, `${targetUrl.toString().replace(/\/+$/, "")}/`);
for (const [key, value] of new URL(ctx.req.url).searchParams.entries()) {
if (key !== "target") upstream.searchParams.append(key, value);
}
const init: RequestInit = {
method: ctx.req.method,
headers: {
"content-type": ctx.req.header("content-type") ?? "application/json",
authorization: ctx.req.header("authorization") ?? "",
},
};
if (ctx.req.method !== "GET" && ctx.req.method !== "HEAD") {
init.body = await ctx.req.raw.clone().arrayBuffer();
}
const response = await fetch(upstream, init);
return new Response(response.body, {
status: response.status,
headers: {
"content-type": response.headers.get("content-type") ?? "application/json",
"x-vllm-routed-controller": targetUrl.origin,
},
});
});
// OpenAPI documentation endpoints
app.get("/api/spec", (ctx) => ctx.json(createOpenApiSpec(context)));
app.get("/api/docs", swaggerUI({ url: "/api/spec" }));
app.notFound((ctx) => ctx.json({ detail: "Not Found" }, { status: 404 }));
app.onError((error, ctx) => {
if (isHttpStatus(error)) {
return ctx.json({ detail: error.detail }, { status: error.status });
}
// Client-initiated disconnects (stream cancel, page close, Droid
// cancelling an in-flight request to start a new turn) are not our
// bug. They must NEVER surface as 500 "Internal Server Error" or log
// as "Unhandled error". The client's socket is already closed so the
// response body will never reach them anyway; emit a terminal 499
// (client closed request) and move on.
const name = (error as { name?: string })?.name ?? "";
const message = String(error);
if (
name === "AbortError" ||
message.includes("AbortError") ||
message.includes("connection was closed") ||
message.includes("ERR_STREAM_PREMATURE_CLOSE") ||
message.includes("Stream was cancelled") ||
message.includes("stream was cancelled") ||
message.includes("The operation was aborted") ||
message.includes("readable stream is cancelled")
) {
context.logger.debug("client disconnected mid-request", {
method: ctx.req.method,
path: ctx.req.path,
});
return ctx.body(null, { status: 499 });
}
context.logger.error("Unhandled error", { error: message });
return ctx.json({ detail: "Internal Server Error" }, { status: 500 });
});
return app;
};