@juspay/neurolink 10.12.1 → 10.12.3

package/dist/cli/commands/proxy.d.ts

@@ -11,7 +11,7 @@
  */
 import type { CommandModule } from "yargs";
 import type { Hono } from "hono";
-import type { AccountAllowlist, LoadedProxyConfig, ModelRouterInterface, ProxyGuardArgs, ProxyNeurolinkRuntime, ProxyStartArgs, ProxyStartStrategy, ProxySupervisorState, ProxyStatusArgs, ProxyTelemetryArgs, ProxyReadinessState } from "../../lib/types/index.js";
+import type { AccountAllowlist, LoadedProxyConfig, ModelRouterInterface, ProxyGuardArgs, ProxyHealthProbe, ProxyNeurolinkRuntime, ProxyStartArgs, ProxyStartStrategy, ProxySupervisorState, ProxyStatusArgs, ProxyTelemetryArgs, ProxyReadinessState } from "../../lib/types/index.js";
 import { ProxyRuntimeConfigStore } from "../../lib/proxy/runtimeConfig.js";
 /**
  * Drop a supervisor `version` that is not a string.
@@ -58,6 +58,7 @@ export declare function isRollingHandoffCapable(state: ProxySupervisorState | nu
  *   confirm a mismatch" and falls through to the args-only result.
  */
 export declare function processLooksLikeProxySupervisor(pid: number, expectedStartTimeIso?: string): Promise<boolean>;
+export declare function probeProxyHealth(host: string, port: number, timeoutMs: number): Promise<ProxyHealthProbe>;
 export declare function mapClaudeErrorTypeToStatus(errorType?: string): number;
 export declare function createProxyStartApp(params: {
     neurolink: ProxyNeurolinkRuntime["neurolink"];

package/dist/cli/commands/proxy.js

@@ -41,6 +41,7 @@ import packageJson from "../../../package.json" with { type: "json" };
 const _require = createRequire(import.meta.url);
 const PROXY_VERSION = packageJson.version;
 const PROXY_INTERNAL_ACCOUNT_LABEL = "proxy/internal";
+const PROXY_INTERNAL_ACCOUNT_TYPE = "internal";
 const PROXY_TELEMETRY_SCRIPT_PATH = fileURLToPath(new URL("../../../scripts/observability/manage-local-openobserve.sh", import.meta.url));
 const PROXY_LIFECYCLE_SHUTDOWN_TIMEOUT_MS = 5_000;
 const LEGACY_STATUS_ACCOUNT_CACHE_TTL_MS = 5_000;
@@ -623,17 +624,51 @@ async function clearOpenCodeProxySettings(expectedBaseUrl) {
     fs.writeFileSync(OPENCODE_CONFIG_PATH, JSON.stringify(config, null, 2));
     return hadNeurolink;
 }
-async function isProxyHealthy(host, port, timeoutMs) {
+export async function probeProxyHealth(host, port, timeoutMs) {
+    const startedAt = Date.now();
     try {
         const response = await fetch(`http://${host}:${port}/health`, {
             signal: AbortSignal.timeout(timeoutMs),
         });
-        return response.ok;
+        return {
+            healthy: response.ok,
+            durationMs: Date.now() - startedAt,
+            failure: response.ok ? null : "http_status",
+            statusCode: response.status,
+            errorCode: null,
+        };
     }
-    catch {
-        return false;
+    catch (error) {
+        const candidate = error;
+        const cause = candidate?.cause;
+        const errorCode = typeof candidate?.code === "string"
+            ? candidate.code
+            : typeof cause?.code === "string"
+                ? cause.code
+                : typeof candidate?.name === "string"
+                    ? candidate.name
+                    : null;
+        const isTimeout = candidate?.name === "TimeoutError" || candidate?.name === "AbortError";
+        return {
+            healthy: false,
+            durationMs: Date.now() - startedAt,
+            failure: isTimeout ? "timeout" : "network",
+            statusCode: null,
+            errorCode,
+        };
     }
 }
+function formatProxyHealthProbe(probe) {
+    const details = [
+        `reason=${probe.failure ?? "none"}`,
+        `durationMs=${probe.durationMs}`,
+        probe.statusCode === null ? null : `status=${probe.statusCode}`,
+        probe.errorCode === null
+            ? null
+            : `errorCode=${sanitizeForLog(probe.errorCode)}`,
+    ].filter((detail) => detail !== null);
+    return details.join(" ");
+}
 async function getProxyRuntimeActivity(host, port, timeoutMs = 3_000) {
     try {
         const response = await fetch(`http://${host}:${port}/status`, {
@@ -1312,7 +1347,7 @@ export async function createProxyStartApp(params) {
     const recordRuntimeError = async (metadata, status, errorType, errorMessage, options) => {
         const clientMessage = options?.clientMessage ?? errorMessage;
         const clientErrorType = options?.clientErrorType ?? errorType;
-        recordFinalError(status, undefined, undefined, {
+        recordFinalError(status, PROXY_INTERNAL_ACCOUNT_LABEL, PROXY_INTERNAL_ACCOUNT_TYPE, {
             requestId: metadata.requestId,
             errorType,
             errorCode: options?.errorCode,
@@ -3730,19 +3765,23 @@ export const proxyGuardCommand = {
         const startedAt = Date.now();
         let parentStatus = getProcessStatus(parentPid);
         let consecutiveUnhealthy = 0;
+        let lastUnhealthyProbe = null;
         // Keep monitoring for as long as the parent can affect Claude settings.
         while (true) {
-            const healthy = await isProxyHealthy(host, port, 1_500);
+            const healthProbe = await probeProxyHealth(host, port, 1_500);
+            const healthy = healthProbe.healthy;
             if (healthy) {
                 if (updaterOnly && consecutiveUnhealthy >= failureThreshold) {
-                    logger.always(`[updater] proxy health recovered after ${consecutiveUnhealthy} failed checks`);
+                    logger.always(`[updater] proxy health recovered after ${consecutiveUnhealthy} failed checks; ${formatProxyHealthProbe(lastUnhealthyProbe ?? healthProbe)}`);
                 }
                 consecutiveUnhealthy = 0;
+                lastUnhealthyProbe = null;
             }
             else {
                 consecutiveUnhealthy += 1;
+                lastUnhealthyProbe = healthProbe;
                 if (updaterOnly && consecutiveUnhealthy === failureThreshold) {
-                    logger.always(`[updater] proxy health unavailable after ${consecutiveUnhealthy} checks; worker remains active`);
+                    logger.always(`[updater] proxy health unavailable after ${consecutiveUnhealthy} checks; worker remains active; ${formatProxyHealthProbe(healthProbe)}`);
                 }
             }
             if (parentStatus === "not_running" && !updateRestartInProgress) {

package/dist/lib/proxy/accountQuota.d.ts

@@ -14,12 +14,13 @@ import type { AccountQuota } from "../types/index.js";
 export declare function getUnifiedRateLimitStatus(headers: Headers | Record<string, string>): string | undefined;
 /**
  * Whether Anthropic explicitly permits a request to use overage after a
- * subscription window is exhausted. Fresh responses require all three
- * provider signals. Older persisted snapshots predate the raw fallback and
- * upgrade-path fields, but retain a positive fallback percentage together with
- * an allowed overage status, which is the equivalent provider state.
+ * subscription window is exhausted. An active overage signal is authoritative;
+ * otherwise fresh responses require explicit fallback and upgrade-path signals.
+ * Older persisted snapshots predate those raw fields, but retain a positive
+ * fallback percentage together with an allowed overage status, which is the
+ * equivalent provider state.
  */
-export declare function isQuotaOverageAvailable(quota: Pick<AccountQuota, "fallbackPercentage" | "fallbackStatus" | "overageStatus" | "upgradePaths"> | null | undefined): boolean;
+export declare function isQuotaOverageAvailable(quota: Pick<AccountQuota, "fallbackPercentage" | "fallbackStatus" | "overageStatus" | "overageInUse" | "upgradePaths"> | null | undefined): boolean;
 /**
  * Parse Anthropic rate-limit / quota headers into an `AccountQuota`.
  * Returns `null` when key headers are absent.

package/dist/lib/proxy/accountQuota.js

@@ -41,15 +41,19 @@ export function getUnifiedRateLimitStatus(headers) {
 }
 /**
  * Whether Anthropic explicitly permits a request to use overage after a
- * subscription window is exhausted. Fresh responses require all three
- * provider signals. Older persisted snapshots predate the raw fallback and
- * upgrade-path fields, but retain a positive fallback percentage together with
- * an allowed overage status, which is the equivalent provider state.
+ * subscription window is exhausted. An active overage signal is authoritative;
+ * otherwise fresh responses require explicit fallback and upgrade-path signals.
+ * Older persisted snapshots predate those raw fields, but retain a positive
+ * fallback percentage together with an allowed overage status, which is the
+ * equivalent provider state.
  */
 export function isQuotaOverageAvailable(quota) {
     if (quota?.overageStatus?.trim().toLowerCase() !== "allowed") {
         return false;
     }
+    if (quota.overageInUse === true) {
+        return true;
+    }
     const explicitFallback = quota.fallbackStatus?.trim().toLowerCase();
     const hasExplicitOveragePath = (quota.upgradePaths ?? "")
         .split(",")
@@ -93,6 +97,8 @@ export function parseQuotaHeaders(headers) {
         fallbackStatus: getHeader(headers, `${P}unified-fallback`) ?? "unknown",
         upgradePaths: getHeader(headers, `${P}unified-upgrade-paths`),
         overageStatus: getHeader(headers, `${P}unified-overage-status`) ?? "unknown",
+        overageInUse: getHeader(headers, `${P}unified-overage-in-use`)?.trim().toLowerCase() ===
+            "true",
         lastUpdated: Date.now(),
         source: "headers",
     };

package/dist/lib/proxy/proxyAnalysis.js

@@ -101,6 +101,9 @@ function routingCandidateValue(value) {
         optionalNullableStringFields.some((field) => field in candidate &&
             candidate[field] !== undefined &&
             !isNullableString(candidate[field])) ||
+        ("quotaStale" in candidate &&
+            candidate.quotaStale !== undefined &&
+            typeof candidate.quotaStale !== "boolean") ||
         ("overageEligible" in candidate &&
             candidate.overageEligible !== undefined &&
             typeof candidate.overageEligible !== "boolean") ||
@@ -118,6 +121,7 @@ function routingCandidateValue(value) {
         usable: candidate.usable,
         saturated: candidate.saturated,
         quotaObserved: candidate.quotaObserved,
+        quotaStale: candidate.quotaStale === true,
         quotaLastUpdated: candidate.quotaLastUpdated,
         quotaAgeMs: candidate.quotaAgeMs,
         coolingActive: candidate.coolingActive,

package/dist/lib/server/routes/claudeProxyRoutes.d.ts

@@ -70,8 +70,9 @@ declare function reconcileCooldownFromQuota(state: RuntimeAccountState, quota: A
  * proxy restart: all accounts tie, selection falls back to token-store
  * enumeration order, and the first account served becomes self-reinforcing
  * (it alone has data) — starving the others regardless of their resets.
- * Never overwrites fresher in-memory quota; stale disk snapshots degrade
- * gracefully because past reset timestamps are ignored by resetEpochToMs.
+ * Never overwrites fresher in-memory quota. Persisted quota cannot create or
+ * clear a cooldown: only an existing cooldown or fresh upstream response
+ * headers can change admission state.
  */
 declare function seedRuntimeQuotasFromDisk(accounts: ProxyPassthroughAccount[]): Promise<void>;
 /**

package/dist/lib/server/routes/claudeProxyRoutes.js

@@ -110,6 +110,9 @@ function fetchAnthropicUpstream(url, init) {
     });
 }
 const accountRuntimeState = new Map();
+/** Persisted quota is advisory after a restart. Older snapshots cannot reject
+ * an account or create a new cooldown because the provider may have reset it. */
+const QUOTA_SNAPSHOT_FRESHNESS_MS = 15 * 60 * 1000;
 /** Shared across requests so a concurrent burst gets at most two retries for
  *  the account/window, rather than every request starting its own retry chain. */
 const transientRateLimitRetryBudgets = new Map();
@@ -603,8 +606,9 @@ function reconcileCooldownFromQuota(state, quota, now) {
  * proxy restart: all accounts tie, selection falls back to token-store
  * enumeration order, and the first account served becomes self-reinforcing
  * (it alone has data) — starving the others regardless of their resets.
- * Never overwrites fresher in-memory quota; stale disk snapshots degrade
- * gracefully because past reset timestamps are ignored by resetEpochToMs.
+ * Never overwrites fresher in-memory quota. Persisted quota cannot create or
+ * clear a cooldown: only an existing cooldown or fresh upstream response
+ * headers can change admission state.
  */
 async function seedRuntimeQuotasFromDisk(accounts) {
     try {
@@ -625,15 +629,6 @@ async function seedRuntimeQuotasFromDisk(accounts) {
                 state.coolingUntil = persistedCooldown.coolingUntil;
                 state.coolingReason = persistedCooldown.reason;
             }
-            if (state.quota) {
-                const cooldownUpdate = reconcileCooldownFromQuota(state, state.quota, now);
-                if (cooldownUpdate?.kind === "cooled") {
-                    await saveAccountCooldown(account.key, cooldownUpdate.coolingUntil, cooldownUpdate.coolingReason);
-                }
-                else if (cooldownUpdate?.kind === "cleared") {
-                    await clearAccountCooldown(account.key, cooldownUpdate.coolingUntil);
-                }
-            }
         }
     }
     catch {
@@ -802,47 +797,59 @@ function getSessionResetToleranceMs() {
 function accountSortMetrics(accountKey, now, sessionSoftLimit, sessionResetToleranceMs) {
     const st = accountRuntimeState.get(accountKey);
     const q = st?.quota;
+    const quotaLastUpdated = q && Number.isFinite(q.lastUpdated) ? q.lastUpdated : null;
+    const quotaAgeMs = quotaLastUpdated === null ? null : Math.max(0, now - quotaLastUpdated);
+    const quotaStale = quotaAgeMs !== null && quotaAgeMs > QUOTA_SNAPSHOT_FRESHNESS_MS;
+    const routingQuota = quotaStale ? undefined : q;
     const coolingActive = !!st?.coolingUntil && now < st.coolingUntil;
     // resetEpochToMs returns undefined for absent OR passed resets, so a
     // ticking window is exactly "reset !== undefined".
-    const weeklyReset = resetEpochToMs(q?.weeklyResetAt, now);
-    const sessionReset = resetEpochToMs(q?.sessionResetAt, now);
+    const weeklyReset = resetEpochToMs(routingQuota?.weeklyResetAt, now);
+    const sessionReset = resetEpochToMs(routingQuota?.sessionResetAt, now);
     const sessionTicking = sessionReset !== undefined;
     const weeklyTicking = weeklyReset !== undefined;
-    const sessionUsed = q ? (sessionTicking ? (q.sessionUsed ?? 0) : 0) : null;
-    const weeklyUsed = q ? (weeklyTicking ? (q.weeklyUsed ?? null) : 0) : null;
-    const sessionStatus = q
+    const sessionUsed = routingQuota
         ? sessionTicking
-            ? (q.sessionStatus ?? "unknown")
+            ? (routingQuota.sessionUsed ?? 0)
+            : 0
+        : null;
+    const weeklyUsed = routingQuota
+        ? weeklyTicking
+            ? (routingQuota.weeklyUsed ?? null)
+            : 0
+        : null;
+    const sessionStatus = routingQuota
+        ? sessionTicking
+            ? (routingQuota.sessionStatus ?? "unknown")
             : "allowed"
         : null;
-    const weeklyStatus = q
+    const weeklyStatus = routingQuota
         ? weeklyTicking
-            ? (q.weeklyStatus ?? "unknown")
+            ? (routingQuota.weeklyStatus ?? "unknown")
             : "allowed"
         : null;
-    const overageEligible = isQuotaOverageAvailable(q);
+    const overageEligible = isQuotaOverageAvailable(routingQuota);
     const saturated = sessionStatus === "throttled" ||
         (sessionTicking && (sessionUsed ?? 0) >= sessionSoftLimit);
-    const quotaLastUpdated = q && Number.isFinite(q.lastUpdated) ? q.lastUpdated : null;
     return {
         usable: !coolingActive &&
             weeklyStatus !== "rejected" &&
             (sessionStatus !== "rejected" || overageEligible) &&
-            (q?.unifiedStatus?.trim().toLowerCase() !== "rejected" ||
+            (routingQuota?.unifiedStatus?.trim().toLowerCase() !== "rejected" ||
                 overageEligible),
-        saturated,
-        hasQuota: !!q,
+        saturated: !quotaStale && saturated,
+        hasQuota: !!routingQuota,
+        quotaStale,
         quotaLastUpdated,
-        quotaAgeMs: quotaLastUpdated === null ? null : Math.max(0, now - quotaLastUpdated),
+        quotaAgeMs,
         coolingActive,
         coolingReason: st?.coolingReason ?? null,
         coolingUntil: st?.coolingUntil ?? 0,
-        unifiedStatus: q?.unifiedStatus ?? null,
-        fallbackStatus: q?.fallbackStatus ?? null,
-        upgradePaths: q?.upgradePaths ?? null,
+        unifiedStatus: routingQuota?.unifiedStatus ?? null,
+        fallbackStatus: routingQuota?.fallbackStatus ?? null,
+        upgradePaths: routingQuota?.upgradePaths ?? null,
         overageEligible,
-        overageStatus: q?.overageStatus ?? null,
+        overageStatus: routingQuota?.overageStatus ?? null,
         sessionStatus,
         sessionUsed,
         sessionResetBucket: sessionTicking
@@ -960,6 +967,7 @@ function buildRoutingDecision(args) {
             usable: metrics.usable,
             saturated: metrics.saturated,
             quotaObserved: metrics.hasQuota,
+            quotaStale: metrics.quotaStale,
             quotaLastUpdated: metrics.quotaLastUpdated,
             quotaAgeMs: metrics.quotaAgeMs,
             coolingActive: metrics.coolingActive,

package/dist/lib/types/proxy.d.ts

@@ -439,6 +439,7 @@ export type ProxyAccountRoutingCandidate = {
     usable: boolean;
     saturated: boolean;
     quotaObserved: boolean;
+    quotaStale: boolean;
     quotaLastUpdated: number | null;
     quotaAgeMs: number | null;
     coolingActive: boolean;
@@ -477,6 +478,7 @@ export type ProxyAccountSortMetrics = {
     usable: boolean;
     saturated: boolean;
     hasQuota: boolean;
+    quotaStale: boolean;
     quotaLastUpdated: number | null;
     quotaAgeMs: number | null;
     coolingActive: boolean;
@@ -941,6 +943,8 @@ export type AccountQuota = {
     upgradePaths?: string;
     /** "allowed" | "rejected" */
     overageStatus: string;
+    /** Whether Anthropic reports that paid overage is actively serving traffic. */
+    overageInUse?: boolean;
     /** Epoch ms when we last captured this data */
     lastUpdated: number;
     /** Dynamic per-plan limit buckets from the usage API `limits[]` array
@@ -1857,6 +1861,14 @@ export type UpdateCheckResult = {
     latestVersion: string;
     updateAvailable: boolean;
 };
+/** Result of one local proxy health probe by the updater or fail-open guard. */
+export type ProxyHealthProbe = {
+    healthy: boolean;
+    durationMs: number;
+    failure: "http_status" | "network" | "timeout" | null;
+    statusCode: number | null;
+    errorCode: string | null;
+};
 /** Parsed major.minor.patch components of a semver string. */
 export type SemVer = {
     major: number;

package/dist/proxy/accountQuota.d.ts

@@ -14,12 +14,13 @@ import type { AccountQuota } from "../types/index.js";
 export declare function getUnifiedRateLimitStatus(headers: Headers | Record<string, string>): string | undefined;
 /**
  * Whether Anthropic explicitly permits a request to use overage after a
- * subscription window is exhausted. Fresh responses require all three
- * provider signals. Older persisted snapshots predate the raw fallback and
- * upgrade-path fields, but retain a positive fallback percentage together with
- * an allowed overage status, which is the equivalent provider state.
+ * subscription window is exhausted. An active overage signal is authoritative;
+ * otherwise fresh responses require explicit fallback and upgrade-path signals.
+ * Older persisted snapshots predate those raw fields, but retain a positive
+ * fallback percentage together with an allowed overage status, which is the
+ * equivalent provider state.
  */
-export declare function isQuotaOverageAvailable(quota: Pick<AccountQuota, "fallbackPercentage" | "fallbackStatus" | "overageStatus" | "upgradePaths"> | null | undefined): boolean;
+export declare function isQuotaOverageAvailable(quota: Pick<AccountQuota, "fallbackPercentage" | "fallbackStatus" | "overageStatus" | "overageInUse" | "upgradePaths"> | null | undefined): boolean;
 /**
  * Parse Anthropic rate-limit / quota headers into an `AccountQuota`.
  * Returns `null` when key headers are absent.

package/dist/proxy/accountQuota.js

@@ -41,15 +41,19 @@ export function getUnifiedRateLimitStatus(headers) {
 }
 /**
  * Whether Anthropic explicitly permits a request to use overage after a
- * subscription window is exhausted. Fresh responses require all three
- * provider signals. Older persisted snapshots predate the raw fallback and
- * upgrade-path fields, but retain a positive fallback percentage together with
- * an allowed overage status, which is the equivalent provider state.
+ * subscription window is exhausted. An active overage signal is authoritative;
+ * otherwise fresh responses require explicit fallback and upgrade-path signals.
+ * Older persisted snapshots predate those raw fields, but retain a positive
+ * fallback percentage together with an allowed overage status, which is the
+ * equivalent provider state.
  */
 export function isQuotaOverageAvailable(quota) {
     if (quota?.overageStatus?.trim().toLowerCase() !== "allowed") {
         return false;
     }
+    if (quota.overageInUse === true) {
+        return true;
+    }
     const explicitFallback = quota.fallbackStatus?.trim().toLowerCase();
     const hasExplicitOveragePath = (quota.upgradePaths ?? "")
         .split(",")
@@ -93,6 +97,8 @@ export function parseQuotaHeaders(headers) {
         fallbackStatus: getHeader(headers, `${P}unified-fallback`) ?? "unknown",
         upgradePaths: getHeader(headers, `${P}unified-upgrade-paths`),
         overageStatus: getHeader(headers, `${P}unified-overage-status`) ?? "unknown",
+        overageInUse: getHeader(headers, `${P}unified-overage-in-use`)?.trim().toLowerCase() ===
+            "true",
         lastUpdated: Date.now(),
         source: "headers",
     };

package/dist/proxy/proxyAnalysis.js

@@ -101,6 +101,9 @@ function routingCandidateValue(value) {
         optionalNullableStringFields.some((field) => field in candidate &&
             candidate[field] !== undefined &&
             !isNullableString(candidate[field])) ||
+        ("quotaStale" in candidate &&
+            candidate.quotaStale !== undefined &&
+            typeof candidate.quotaStale !== "boolean") ||
         ("overageEligible" in candidate &&
             candidate.overageEligible !== undefined &&
             typeof candidate.overageEligible !== "boolean") ||
@@ -118,6 +121,7 @@ function routingCandidateValue(value) {
         usable: candidate.usable,
         saturated: candidate.saturated,
         quotaObserved: candidate.quotaObserved,
+        quotaStale: candidate.quotaStale === true,
         quotaLastUpdated: candidate.quotaLastUpdated,
         quotaAgeMs: candidate.quotaAgeMs,
         coolingActive: candidate.coolingActive,

package/dist/server/routes/claudeProxyRoutes.d.ts

@@ -70,8 +70,9 @@ declare function reconcileCooldownFromQuota(state: RuntimeAccountState, quota: A
  * proxy restart: all accounts tie, selection falls back to token-store
  * enumeration order, and the first account served becomes self-reinforcing
  * (it alone has data) — starving the others regardless of their resets.
- * Never overwrites fresher in-memory quota; stale disk snapshots degrade
- * gracefully because past reset timestamps are ignored by resetEpochToMs.
+ * Never overwrites fresher in-memory quota. Persisted quota cannot create or
+ * clear a cooldown: only an existing cooldown or fresh upstream response
+ * headers can change admission state.
  */
 declare function seedRuntimeQuotasFromDisk(accounts: ProxyPassthroughAccount[]): Promise<void>;
 /**

package/dist/server/routes/claudeProxyRoutes.js

@@ -110,6 +110,9 @@ function fetchAnthropicUpstream(url, init) {
     });
 }
 const accountRuntimeState = new Map();
+/** Persisted quota is advisory after a restart. Older snapshots cannot reject
+ * an account or create a new cooldown because the provider may have reset it. */
+const QUOTA_SNAPSHOT_FRESHNESS_MS = 15 * 60 * 1000;
 /** Shared across requests so a concurrent burst gets at most two retries for
  *  the account/window, rather than every request starting its own retry chain. */
 const transientRateLimitRetryBudgets = new Map();
@@ -603,8 +606,9 @@ function reconcileCooldownFromQuota(state, quota, now) {
  * proxy restart: all accounts tie, selection falls back to token-store
  * enumeration order, and the first account served becomes self-reinforcing
  * (it alone has data) — starving the others regardless of their resets.
- * Never overwrites fresher in-memory quota; stale disk snapshots degrade
- * gracefully because past reset timestamps are ignored by resetEpochToMs.
+ * Never overwrites fresher in-memory quota. Persisted quota cannot create or
+ * clear a cooldown: only an existing cooldown or fresh upstream response
+ * headers can change admission state.
  */
 async function seedRuntimeQuotasFromDisk(accounts) {
     try {
@@ -625,15 +629,6 @@ async function seedRuntimeQuotasFromDisk(accounts) {
                 state.coolingUntil = persistedCooldown.coolingUntil;
                 state.coolingReason = persistedCooldown.reason;
             }
-            if (state.quota) {
-                const cooldownUpdate = reconcileCooldownFromQuota(state, state.quota, now);
-                if (cooldownUpdate?.kind === "cooled") {
-                    await saveAccountCooldown(account.key, cooldownUpdate.coolingUntil, cooldownUpdate.coolingReason);
-                }
-                else if (cooldownUpdate?.kind === "cleared") {
-                    await clearAccountCooldown(account.key, cooldownUpdate.coolingUntil);
-                }
-            }
         }
     }
     catch {
@@ -802,47 +797,59 @@ function getSessionResetToleranceMs() {
 function accountSortMetrics(accountKey, now, sessionSoftLimit, sessionResetToleranceMs) {
     const st = accountRuntimeState.get(accountKey);
     const q = st?.quota;
+    const quotaLastUpdated = q && Number.isFinite(q.lastUpdated) ? q.lastUpdated : null;
+    const quotaAgeMs = quotaLastUpdated === null ? null : Math.max(0, now - quotaLastUpdated);
+    const quotaStale = quotaAgeMs !== null && quotaAgeMs > QUOTA_SNAPSHOT_FRESHNESS_MS;
+    const routingQuota = quotaStale ? undefined : q;
     const coolingActive = !!st?.coolingUntil && now < st.coolingUntil;
     // resetEpochToMs returns undefined for absent OR passed resets, so a
     // ticking window is exactly "reset !== undefined".
-    const weeklyReset = resetEpochToMs(q?.weeklyResetAt, now);
-    const sessionReset = resetEpochToMs(q?.sessionResetAt, now);
+    const weeklyReset = resetEpochToMs(routingQuota?.weeklyResetAt, now);
+    const sessionReset = resetEpochToMs(routingQuota?.sessionResetAt, now);
     const sessionTicking = sessionReset !== undefined;
     const weeklyTicking = weeklyReset !== undefined;
-    const sessionUsed = q ? (sessionTicking ? (q.sessionUsed ?? 0) : 0) : null;
-    const weeklyUsed = q ? (weeklyTicking ? (q.weeklyUsed ?? null) : 0) : null;
-    const sessionStatus = q
+    const sessionUsed = routingQuota
         ? sessionTicking
-            ? (q.sessionStatus ?? "unknown")
+            ? (routingQuota.sessionUsed ?? 0)
+            : 0
+        : null;
+    const weeklyUsed = routingQuota
+        ? weeklyTicking
+            ? (routingQuota.weeklyUsed ?? null)
+            : 0
+        : null;
+    const sessionStatus = routingQuota
+        ? sessionTicking
+            ? (routingQuota.sessionStatus ?? "unknown")
             : "allowed"
         : null;
-    const weeklyStatus = q
+    const weeklyStatus = routingQuota
         ? weeklyTicking
-            ? (q.weeklyStatus ?? "unknown")
+            ? (routingQuota.weeklyStatus ?? "unknown")
             : "allowed"
         : null;
-    const overageEligible = isQuotaOverageAvailable(q);
+    const overageEligible = isQuotaOverageAvailable(routingQuota);
     const saturated = sessionStatus === "throttled" ||
         (sessionTicking && (sessionUsed ?? 0) >= sessionSoftLimit);
-    const quotaLastUpdated = q && Number.isFinite(q.lastUpdated) ? q.lastUpdated : null;
     return {
         usable: !coolingActive &&
             weeklyStatus !== "rejected" &&
             (sessionStatus !== "rejected" || overageEligible) &&
-            (q?.unifiedStatus?.trim().toLowerCase() !== "rejected" ||
+            (routingQuota?.unifiedStatus?.trim().toLowerCase() !== "rejected" ||
                 overageEligible),
-        saturated,
-        hasQuota: !!q,
+        saturated: !quotaStale && saturated,
+        hasQuota: !!routingQuota,
+        quotaStale,
         quotaLastUpdated,
-        quotaAgeMs: quotaLastUpdated === null ? null : Math.max(0, now - quotaLastUpdated),
+        quotaAgeMs,
         coolingActive,
         coolingReason: st?.coolingReason ?? null,
         coolingUntil: st?.coolingUntil ?? 0,
-        unifiedStatus: q?.unifiedStatus ?? null,
-        fallbackStatus: q?.fallbackStatus ?? null,
-        upgradePaths: q?.upgradePaths ?? null,
+        unifiedStatus: routingQuota?.unifiedStatus ?? null,
+        fallbackStatus: routingQuota?.fallbackStatus ?? null,
+        upgradePaths: routingQuota?.upgradePaths ?? null,
         overageEligible,
-        overageStatus: q?.overageStatus ?? null,
+        overageStatus: routingQuota?.overageStatus ?? null,
         sessionStatus,
         sessionUsed,
         sessionResetBucket: sessionTicking
@@ -960,6 +967,7 @@ function buildRoutingDecision(args) {
             usable: metrics.usable,
             saturated: metrics.saturated,
             quotaObserved: metrics.hasQuota,
+            quotaStale: metrics.quotaStale,
             quotaLastUpdated: metrics.quotaLastUpdated,
             quotaAgeMs: metrics.quotaAgeMs,
             coolingActive: metrics.coolingActive,

package/dist/types/proxy.d.ts

@@ -439,6 +439,7 @@ export type ProxyAccountRoutingCandidate = {
     usable: boolean;
     saturated: boolean;
     quotaObserved: boolean;
+    quotaStale: boolean;
     quotaLastUpdated: number | null;
     quotaAgeMs: number | null;
     coolingActive: boolean;
@@ -477,6 +478,7 @@ export type ProxyAccountSortMetrics = {
     usable: boolean;
     saturated: boolean;
     hasQuota: boolean;
+    quotaStale: boolean;
     quotaLastUpdated: number | null;
     quotaAgeMs: number | null;
     coolingActive: boolean;
@@ -941,6 +943,8 @@ export type AccountQuota = {
     upgradePaths?: string;
     /** "allowed" | "rejected" */
     overageStatus: string;
+    /** Whether Anthropic reports that paid overage is actively serving traffic. */
+    overageInUse?: boolean;
     /** Epoch ms when we last captured this data */
     lastUpdated: number;
     /** Dynamic per-plan limit buckets from the usage API `limits[]` array
@@ -1857,6 +1861,14 @@ export type UpdateCheckResult = {
     latestVersion: string;
     updateAvailable: boolean;
 };
+/** Result of one local proxy health probe by the updater or fail-open guard. */
+export type ProxyHealthProbe = {
+    healthy: boolean;
+    durationMs: number;
+    failure: "http_status" | "network" | "timeout" | null;
+    statusCode: number | null;
+    errorCode: string | null;
+};
 /** Parsed major.minor.patch components of a semver string. */
 export type SemVer = {
     major: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@juspay/neurolink",
-  "version": "10.12.1",
+  "version": "10.12.3",
   "packageManager": "pnpm@10.15.1",
   "description": "TypeScript AI SDK with 24+ LLM providers behind one consistent API. MCP-native (connect any MCP server), voice TTS/STT/realtime, RAG, agents, memory, context compaction. OpenAI · Anthropic · Gemini · Bedrock · Azure · Ollama · DeepSeek · NVIDIA NIM and more.",
   "author": {