@juspay/neurolink 11.0.0 → 11.1.1

package/dist/lib/utils/providerHealth.js

@@ -4,10 +4,11 @@
  */
 import { logger } from "./logger.js";
 import { AIProviderName, OpenAIModels, GoogleAIModels, AnthropicModels, BedrockModels, } from "../constants/enums.js";
-import { API_KEY_LENGTHS, PROJECT_ID_FORMAT } from "./providerConfig.js";
+import { PROJECT_ID_FORMAT, satisfiesFallbacks } from "./providerConfig.js";
 import { basename } from "path";
 import { createProxyFetch } from "../proxy/proxyFetch.js";
 import { DEFAULT_OLLAMA_MODEL } from "../providers/ollama/constants.js";
+import { ProviderFactory } from "../factories/providerFactory.js";
 export class ProviderHealthChecker {
     static healthCache = new Map();
     static DEFAULT_TIMEOUT = 5000; // 5 seconds
@@ -172,55 +173,36 @@ export class ProviderHealthChecker {
             logger.debug("Vertex AI authentication check starting", {
                 providerName,
             });
-            // Method 1: Check GOOGLE_APPLICATION_CREDENTIALS (file-based)
-            const credentialsFile = process.env.GOOGLE_APPLICATION_CREDENTIALS;
-            let fileBasedAuthValid = false;
-            if (credentialsFile) {
-                logger.debug("Checking GOOGLE_APPLICATION_CREDENTIALS file");
-                try {
-                    const { promises: fs } = await import("fs");
-                    try {
-                        await fs.access(credentialsFile);
-                        fileBasedAuthValid = true;
-                    }
-                    catch {
-                        fileBasedAuthValid = false;
-                    }
-                    logger.debug("File auth check result", {
-                        fileExists: fileBasedAuthValid,
-                    });
-                }
-                catch (error) {
-                    logger.debug("File auth check error", {
-                        error: String(error),
-                    });
-                    fileBasedAuthValid = false;
-                }
-            }
-            // Method 2: Check individual environment variables
-            const hasIndividualAuth = !!(process.env.GOOGLE_AUTH_CLIENT_EMAIL &&
-                process.env.GOOGLE_AUTH_PRIVATE_KEY);
-            logger.debug("Individual auth check", {
-                hasClientEmail: !!process.env.GOOGLE_AUTH_CLIENT_EMAIL,
-                hasPrivateKey: !!process.env.GOOGLE_AUTH_PRIVATE_KEY,
-                hasIndividualAuth,
-            });
-            // Vertex is valid if EITHER auth method works
-            const hasValidAuth = fileBasedAuthValid || hasIndividualAuth;
-            logger.debug("Vertex auth final result", {
-                fileBasedAuthValid,
-                hasIndividualAuth,
-                hasValidAuth,
-            });
+            // Derive auth-var acceptance from the vertex descriptor instead of a
+            // hand-maintained var list, so this stays in sync with the real
+            // gating logic (hasGoogleCredentials() in googleVertex/client.ts and
+            // googleVertex/utils.ts): extraRequired.every(...) ||
+            // extraRequiredFallbacks.some(...), the same pattern used by
+            // hasProviderEnvVars() (providerUtils.ts), setup.ts, and
+            // environmentManager.ts. The old two-method check here only
+            // recognized GOOGLE_APPLICATION_CREDENTIALS or the
+            // GOOGLE_AUTH_CLIENT_EMAIL + GOOGLE_AUTH_PRIVATE_KEY pair — missing
+            // GOOGLE_SERVICE_ACCOUNT_KEY and, most importantly,
+            // GOOGLE_APPLICATION_CREDENTIALS_NEUROLINK, the descriptor's
+            // documented first-priority fallback. A user configured via that
+            // var alone had a fully working Vertex provider but was reported
+            // unhealthy here. Note: this is a presence-only check — it no
+            // longer verifies the GOOGLE_APPLICATION_CREDENTIALS file actually
+            // exists on disk (the old file-based method did via fs.access),
+            // matching the presence-only semantics already used by the other
+            // three callers of this pattern.
+            const descriptor = ProviderFactory.getDescriptor(AIProviderName.VERTEX);
+            const { extraRequired, extraRequiredFallbacks } = descriptor?.envVars ?? {};
+            const hasValidAuth = (extraRequired ?? []).every((v) => !!process.env[v]) ||
+                satisfiesFallbacks(extraRequiredFallbacks, process.env);
+            logger.debug("Vertex auth final result", { hasValidAuth });
             if (hasValidAuth) {
                 healthStatus.hasApiKey = true;
-                logger.debug("Vertex auth SUCCESS", {
-                    authMethod: fileBasedAuthValid ? "file-based" : "individual-env-vars",
-                });
+                logger.debug("Vertex auth SUCCESS");
             }
             else {
                 healthStatus.hasApiKey = false;
-                healthStatus.configurationIssues.push(`Vertex AI authentication not found: neither GOOGLE_APPLICATION_CREDENTIALS file nor individual credentials (GOOGLE_AUTH_CLIENT_EMAIL + GOOGLE_AUTH_PRIVATE_KEY) are properly configured`);
+                healthStatus.configurationIssues.push("Vertex AI authentication not found: set GOOGLE_APPLICATION_CREDENTIALS, GOOGLE_APPLICATION_CREDENTIALS_NEUROLINK, GOOGLE_SERVICE_ACCOUNT_KEY, or both GOOGLE_AUTH_CLIENT_EMAIL and GOOGLE_AUTH_PRIVATE_KEY");
                 logger.debug("Vertex auth FAILED", {
                     reason: "No valid auth method found",
                 });
@@ -360,103 +342,108 @@ export class ProviderHealthChecker {
         }
     }
     /**
-     * Get required environment variables for a provider
+     * Get required environment variables for a provider.
+     *
+     * Returns `[]` for providers with `descriptor.credentialsResolvedExternally
+     * === true` (Vertex, Bedrock, LiteLLM) — the check in
+     * checkEnvironmentConfiguration() below ANDs every entry in the returned
+     * list together, which can't express Vertex's file-OR-individual-creds-
+     * OR-service-account auth, Bedrock's AWS SDK default provider chain
+     * (profile / IAM role, no env vars at all), or LiteLLM's documented
+     * zero-config local proxy. Their real requirement is validated by
+     * checkProviderSpecificConfig()'s dedicated per-provider checks instead.
+     * Naively deriving [apiKey, ...extraRequired] from the descriptor for
+     * these three (as for the other 27 providers) would make
+     * checkEnvironmentConfiguration() push a false "missing environment
+     * variables" issue — and therefore isHealthy=false — for legitimate
+     * fallback-based Vertex auth, AWS_PROFILE/IAM-role Bedrock auth, and
+     * unauthenticated local LiteLLM proxies. See hasProviderEnvVars() in
+     * providerUtils.ts for the equivalent OR-aware check used for
+     * auto-select gating. See `ProviderDescriptor.credentialsResolvedExternally`
+     * (types/providers.ts) for the field's full documentation.
      */
     static getRequiredEnvironmentVariables(providerName) {
-        switch (providerName) {
-            case AIProviderName.ANTHROPIC:
-                return ["ANTHROPIC_API_KEY"];
-            case AIProviderName.OPENAI:
-                return ["OPENAI_API_KEY"];
-            case AIProviderName.VERTEX:
-                // Vertex AI requires authentication, but not via a single environment variable.
-                // Authentication can be provided via a credential file or individual credentials + project.
-                // The required authentication is checked in checkProviderSpecificConfig instead of here.
-                // Returning an empty array here does NOT mean authentication is not required.
-                return [];
-            case AIProviderName.GOOGLE_AI:
-                return ["GOOGLE_AI_API_KEY"];
-            case AIProviderName.BEDROCK:
-                // Bedrock credentials are resolved via AWS SDK default provider chain.
-                // Region/auth validated in provider-specific checks.
-                return [];
-            case AIProviderName.AZURE:
-                return ["AZURE_OPENAI_API_KEY", "AZURE_OPENAI_ENDPOINT"];
-            case AIProviderName.LITELLM:
-                return [];
-            case AIProviderName.OLLAMA:
-                return []; // Ollama typically doesn't require API keys
-            default:
-                return [];
-        }
+        // Resolve the descriptor FIRST so the field check below is keyed on
+        // the canonical, alias-resolved `descriptor.credentialsResolvedExternally`
+        // — not the raw, possibly-aliased `providerName` argument. Checking the
+        // raw input here would let documented aliases (e.g. "googleVertex" for
+        // vertex, "aws" for bedrock) skip the delegation and fall through to
+        // the naive [apiKey, ...extraRequired] derivation below, reproducing
+        // the exact false "missing environment variables" regression this
+        // field exists to prevent.
+        const descriptor = ProviderFactory.getDescriptor(providerName);
+        if (!descriptor) {
+            return [];
+        }
+        if (descriptor.credentialsResolvedExternally) {
+            return [];
+        }
+        const { apiKey, extraRequired } = descriptor.envVars;
+        return [...(apiKey ? [apiKey] : []), ...(extraRequired ?? [])];
     }
     /**
-     * Get API key environment variable for a provider
+     * Get API key environment variable for a provider.
+     *
+     * Dead code at its sole call site today (checkApiKeyValidity() early-
+     * returns for VERTEX/OLLAMA/BEDROCK/LITELLM before reaching this), but
+     * now `static` (public) so a future direct caller is plausible — hence
+     * the two intentional diffs from the original hand-written switch are
+     * documented here rather than left silent:
+     *   - vertex: old switch returned "GOOGLE_APPLICATION_CREDENTIALS"
+     *     (one of several valid auth vars); the descriptor's `envVars.apiKey`
+     *     is "GOOGLE_CLOUD_PROJECT_ID" instead — the actual identity var for
+     *     the provider, not one specific credential-supply mechanism.
+     *   - ollama: old switch returned "OLLAMA_BASE_URL"; the descriptor has
+     *     no `envVars.apiKey` for ollama (it's a local, unauthenticated
+     *     runtime), so this now returns "".
+     * Both are kept deliberately (semantically truer identity vars) rather
+     * than reproduced byte-for-byte from the old switch.
      */
     static getApiKeyEnvironmentVariable(providerName) {
-        switch (providerName) {
-            case AIProviderName.ANTHROPIC:
-                return "ANTHROPIC_API_KEY";
-            case AIProviderName.OPENAI:
-                return "OPENAI_API_KEY";
-            case AIProviderName.VERTEX:
-                return "GOOGLE_APPLICATION_CREDENTIALS";
-            case AIProviderName.GOOGLE_AI:
-                return "GOOGLE_AI_API_KEY";
-            case AIProviderName.BEDROCK:
-                return "AWS_ACCESS_KEY_ID";
-            case AIProviderName.AZURE:
-                return "AZURE_OPENAI_API_KEY";
-            case AIProviderName.LITELLM:
-                return "LITELLM_API_KEY";
-            case AIProviderName.OLLAMA:
-                return "OLLAMA_BASE_URL";
-            default:
-                return "";
-        }
+        return ProviderFactory.getDescriptor(providerName)?.envVars.apiKey ?? "";
     }
     /**
      * Validate API key format for a provider
      */
     static validateApiKeyFormat(providerName, apiKey) {
-        switch (providerName) {
-            case AIProviderName.ANTHROPIC:
-                return (apiKey.startsWith("sk-ant-") &&
-                    apiKey.length >= API_KEY_LENGTHS.ANTHROPIC_MIN);
-            case AIProviderName.OPENAI:
-                return (apiKey.startsWith("sk-") &&
-                    apiKey.length >= API_KEY_LENGTHS.OPENAI_MIN);
-            case AIProviderName.GOOGLE_AI:
-                return apiKey.length >= API_KEY_LENGTHS.GOOGLE_AI_EXACT; // Basic length check
-            case AIProviderName.VERTEX:
-                return apiKey.endsWith(".json") || apiKey.includes("type"); // JSON key format
-            case AIProviderName.BEDROCK:
-                return apiKey.length >= API_KEY_LENGTHS.AWS_ACCESS_KEY; // AWS access key length
-            case AIProviderName.AZURE:
-                return apiKey.length >= API_KEY_LENGTHS.AZURE_MIN; // Azure OpenAI API key length
-            case AIProviderName.LITELLM:
-                return apiKey.length > 0;
-            case AIProviderName.OLLAMA:
-                return true; // Ollama usually doesn't require specific format
-            default:
-                return true; // Default to true for unknown providers
+        // Vertex's "API key" is really a credentials file path (or an inline
+        // JSON blob via GOOGLE_SERVICE_ACCOUNT_KEY) — never governed by the
+        // shared API_KEY_FORMATS regexes. Preserved exactly from the original
+        // switch even though checkApiKeyValidity() early-returns before ever
+        // reaching this call for Vertex today; kept correct for any other/
+        // future caller.
+        if (providerName === AIProviderName.VERTEX) {
+            return apiKey.endsWith(".json") || apiKey.includes("type");
+        }
+        const descriptor = ProviderFactory.getDescriptor(providerName);
+        if (!descriptor?.apiKeyFormatPattern) {
+            // Providers with no documented format (or local runtimes / providers
+            // usable with zero configuration) are accepted as-is — matches the
+            // old switch's per-provider `default: true`/no-format-check branches
+            // (ollama, litellm).
+            if (descriptor?.localRuntime || descriptor?.envVars.optional) {
+                return true;
+            }
+            return apiKey.length > 0;
         }
+        return descriptor.apiKeyFormatPattern.test(apiKey);
     }
     /**
      * Get health check endpoint for connectivity testing
      */
     static getProviderHealthEndpoint(providerName) {
-        switch (providerName) {
-            case AIProviderName.ANTHROPIC:
-                return null; // Anthropic doesn't have a public health endpoint
+        const descriptor = ProviderFactory.getDescriptor(providerName);
+        if (descriptor?.healthCheck !== "models-probe") {
+            return null;
+        }
+        // OpenAI/LiteLLM/Ollama each need a provider-specific URL builder that
+        // isn't pure descriptor data (LiteLLM/Ollama depend on the configured
+        // base URL) — keep the existing per-provider dispatch for the 3
+        // models-probe providers, now gated on the descriptor instead of a
+        // hardcoded name list.
+        switch (descriptor.name) {
             case AIProviderName.OPENAI:
                 return "https://api.openai.com/v1/models";
-            case AIProviderName.GOOGLE_AI:
-                return null; // No public health endpoint
-            case AIProviderName.VERTEX:
-                return null; // Complex authentication required
-            case AIProviderName.BEDROCK:
-                return null; // AWS endpoints vary by region
             case AIProviderName.LITELLM:
                 return this.getLiteLLMModelsUrl();
             case AIProviderName.OLLAMA:
@@ -525,11 +512,11 @@ export class ProviderHealthChecker {
             hasValidAuth = await this.checkGoogleApplicationCredentials(healthStatus);
         }
         if (!hasValidAuth) {
-            hasValidAuth = this.checkIndividualGoogleCredentials(healthStatus);
+            hasValidAuth = this.checkExtraRequiredFallbackCredentials(healthStatus);
         }
         if (!hasValidAuth) {
             healthStatus.configurationIssues.push("Google Cloud authentication not configured or credentials file missing");
-            healthStatus.recommendations.push("Set either GOOGLE_APPLICATION_CREDENTIALS (valid file path), GOOGLE_SERVICE_ACCOUNT_KEY (base64), or both GOOGLE_AUTH_CLIENT_EMAIL and GOOGLE_AUTH_PRIVATE_KEY");
+            healthStatus.recommendations.push("Set either GOOGLE_APPLICATION_CREDENTIALS (valid file path), GOOGLE_APPLICATION_CREDENTIALS_NEUROLINK, GOOGLE_SERVICE_ACCOUNT_KEY (base64), or both GOOGLE_AUTH_CLIENT_EMAIL and GOOGLE_AUTH_PRIVATE_KEY");
         }
         return hasValidAuth;
     }
@@ -561,13 +548,20 @@ export class ProviderHealthChecker {
         }
     }
     /**
-     * Check individual Google credentials
+     * Check Vertex's non-file auth fallbacks (GOOGLE_APPLICATION_CREDENTIALS_
+     * NEUROLINK, GOOGLE_SERVICE_ACCOUNT_KEY, or the GOOGLE_AUTH_CLIENT_EMAIL +
+     * GOOGLE_AUTH_PRIVATE_KEY pair) via the descriptor's extraRequiredFallbacks
+     * instead of a hand-maintained env-var list, so this stays in sync with
+     * the real gating logic (hasGoogleCredentials()) the same way
+     * checkApiKeyValidity()'s vertex branch does. The previous hand-rolled
+     * version only recognized GOOGLE_SERVICE_ACCOUNT_KEY or the email+key
+     * pair — missing GOOGLE_APPLICATION_CREDENTIALS_NEUROLINK, the
+     * descriptor's documented first-priority fallback.
      */
-    static checkIndividualGoogleCredentials(healthStatus) {
-        const hasServiceAccountKey = !!process.env.GOOGLE_SERVICE_ACCOUNT_KEY;
-        const hasIndividualCredentials = !!(process.env.GOOGLE_AUTH_CLIENT_EMAIL &&
-            process.env.GOOGLE_AUTH_PRIVATE_KEY);
-        if (hasServiceAccountKey || hasIndividualCredentials) {
+    static checkExtraRequiredFallbackCredentials(healthStatus) {
+        const descriptor = ProviderFactory.getDescriptor(AIProviderName.VERTEX);
+        const hasValidAuth = satisfiesFallbacks(descriptor?.envVars.extraRequiredFallbacks, process.env);
+        if (hasValidAuth) {
             healthStatus.hasApiKey = true;
             return true;
         }

package/dist/lib/utils/providerUtils.js

@@ -6,8 +6,10 @@ import { AIProviderFactory } from "../core/factory.js";
 import { logger } from "./logger.js";
 import { AIProviderName } from "../constants/enums.js";
 import { ProviderHealthChecker } from "./providerHealth.js";
-import { API_KEY_FORMATS, API_KEY_LENGTHS, PROJECT_ID_FORMAT, } from "./providerConfig.js";
+import { API_KEY_FORMATS, API_KEY_LENGTHS, PROJECT_ID_FORMAT, satisfiesFallbacks, } from "./providerConfig.js";
 import { DEFAULT_OLLAMA_MODEL } from "../providers/ollama/constants.js";
+import { ProviderFactory } from "../factories/providerFactory.js";
+import { PROVIDER_DESCRIPTORS } from "../factories/providerDescriptors.js";
 /**
  * Get the best available provider based on real-time availability checks
  * Enhanced version consolidated from providerUtils-fixed.ts
@@ -60,18 +62,9 @@ export async function getBestProvider(requestedProvider) {
      * - Other providers are ordered based on a combination of reliability, feature set, and historical performance.
      * Please update this comment if the order is changed in the future, and document the rationale for maintainability.
      */
-    const providers = [
-        "litellm", // Prioritize self-hosted proxy deployments first
-        "ollama", // Local models when the configured runtime target is installed
-        "vertex", // Google Cloud AI (enterprise)
-        "google-ai", // Google AI ecosystem support
-        "openai", // Reliable with broad model support
-        "anthropic",
-        "bedrock",
-        "azure",
-        "mistral",
-        "huggingface",
-    ];
+    const providers = PROVIDER_DESCRIPTORS.filter((d) => d.autoSelectPriority !== undefined)
+        .sort((a, b) => (a.autoSelectPriority ?? 0) - (b.autoSelectPriority ?? 0))
+        .map((d) => d.name);
     for (const provider of providers) {
         if (await isProviderAvailable(provider)) {
             logger.debug(`[getBestProvider] Selected provider: ${provider}`);
@@ -332,64 +325,29 @@ function isValidUrl(url) {
  * @returns True if the provider has required environment variables
  */
 export function hasProviderEnvVars(provider) {
-    switch (provider.toLowerCase()) {
-        case "bedrock":
-        case "amazon":
-        case "aws":
-            return !!(process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SECRET_ACCESS_KEY);
-        case "vertex":
-        case "googlevertex":
-        case "google":
-        case "gemini":
-            return !!((process.env.GOOGLE_CLOUD_PROJECT_ID ||
-                process.env.VERTEX_PROJECT_ID ||
-                process.env.GOOGLE_VERTEX_PROJECT ||
-                process.env.GOOGLE_CLOUD_PROJECT) &&
-                (process.env.GOOGLE_APPLICATION_CREDENTIALS ||
-                    process.env.GOOGLE_SERVICE_ACCOUNT_KEY ||
-                    (process.env.GOOGLE_AUTH_CLIENT_EMAIL &&
-                        process.env.GOOGLE_AUTH_PRIVATE_KEY)));
-        case "openai":
-        case "gpt":
-            return !!process.env.OPENAI_API_KEY;
-        case "anthropic":
-        case "claude":
-            return !!process.env.ANTHROPIC_API_KEY;
-        case "azure":
-        case "azureopenai":
-            return !!process.env.AZURE_OPENAI_API_KEY;
-        case "google-ai":
-        case "google-studio":
-            return !!(process.env.GOOGLE_AI_API_KEY ||
-                process.env.GOOGLE_GENERATIVE_AI_API_KEY);
-        case "huggingface":
-        case "hugging-face":
-        case "hf":
-            return !!(process.env.HUGGINGFACE_API_KEY || process.env.HF_TOKEN);
-        case "ollama":
-        case "local":
-        case "local-ollama":
-            // For Ollama, we check if the service is potentially available
-            // This is a basic check - actual connectivity will be verified during usage
-            return true; // Ollama doesn't require environment variables, just local service
-        case "mistral":
-        case "mistral-ai":
-        case "mistralai":
-            return !!process.env.MISTRAL_API_KEY;
-        case "litellm":
-            // LiteLLM requires a proxy server, which can be checked for availability
-            // Default base URL is assumed, or can be configured via environment
-            return true; // LiteLLM proxy availability will be checked during usage
-        default:
-            return false;
+    const descriptor = ProviderFactory.getDescriptor(provider);
+    if (!descriptor) {
+        return false;
+    }
+    if (descriptor.envVars.optional || descriptor.localRuntime) {
+        // Ollama / LiteLLM / LM Studio / llama.cpp: usable with defaults.
+        return true;
+    }
+    const { apiKey, fallbacks, extraRequired, extraRequiredFallbacks } = descriptor.envVars;
+    const hasPrimary = !!apiKey &&
+        (!!process.env[apiKey] || (fallbacks ?? []).some((v) => !!process.env[v]));
+    if (!hasPrimary) {
+        return false;
     }
+    return ((extraRequired ?? []).every((v) => !!process.env[v]) ||
+        satisfiesFallbacks(extraRequiredFallbacks, process.env));
 }
 /**
  * Get available provider names
  * @returns Array of available provider names
  */
 export function getAvailableProviders() {
-    return Object.values(AIProviderName).filter((name) => name !== AIProviderName.AUTO);
+    return PROVIDER_DESCRIPTORS.map((d) => d.name);
 }
 /**
  * Validate provider name

package/dist/neurolink.js

@@ -35,6 +35,7 @@ import { ToolRoutingCache } from "./core/toolRoutingCache.js";
 import { DEFAULT_RECENT_TURNS, KnowledgeGroundingEngine, } from "./knowledge/index.js";
 import { AIProviderFactory } from "./core/factory.js";
 import { createToolEventPayload } from "./core/toolEvents.js";
+import { ProviderFactory } from "./factories/providerFactory.js";
 import { ProviderRegistry } from "./factories/providerRegistry.js";
 import { FileReferenceRegistry } from "./files/fileReferenceRegistry.js";
 import { createFileTools } from "./files/fileTools.js";
@@ -298,30 +299,24 @@ export function markStreamProviderEmittedGenerationEnd(options) {
  */
 export const NEUROLINK_BRAND = Symbol.for("@juspay/neurolink/sdk-brand");
 /**
- * Providers whose native tool-calling support is model-dependent or absent —
- * i.e. every provider that overrides `supportsTools()` and can return false
- * (verified against src/lib/providers: ollama and openrouter are
- * model-dependent; huggingface is deployment-dependent; the rest are
- * image/embedding providers). Only these still receive the full tool listing
- * in the system prompt on the generate path, where no provider instance
- * exists yet to ask directly; every other provider gets tool definitions
- * natively via its `tools` parameter, so repeating them in the prompt was
- * pure token duplication. The stream path asks the provider instance
- * (`provider.supportsTools()`) instead of this list. BaseProvider resolves its
- * default through MODEL_REGISTRY's `modelSupports()` facade; keep this list in
- * sync with provider-specific `supportsTools()` overrides when adding providers.
+ * True when a provider needs tools described in the prompt rather than
+ * passed via the API's native tool-calling parameter (ollama/openrouter
+ * are model-dependent; huggingface is deployment-dependent; the
+ * image/embedding providers don't support tool calling at all). Only these
+ * still receive the full tool listing in the system prompt on the generate
+ * path, where no provider instance exists yet to ask directly; every other
+ * provider gets tool definitions natively via its `tools` parameter, so
+ * repeating them in the prompt was pure token duplication. The stream path
+ * asks the provider instance (`provider.supportsTools()`) instead of this
+ * check. Derived from ProviderDescriptor.toolSupport instead of a
+ * hand-maintained Set — see PROVIDER_DESCRIPTORS in
+ * src/lib/factories/providerDescriptors.ts for the underlying data;
+ * BaseProvider resolves its own runtime default through MODEL_REGISTRY's
+ * `modelSupports()` facade.
  */
-const PROMPT_ONLY_TOOL_PROVIDERS = new Set([
-    "ollama",
-    "huggingface",
-    "openrouter",
-    "ideogram",
-    "recraft",
-    "replicate",
-    "stability",
-    "jina",
-    "voyage",
-]);
+function isPromptOnlyToolProvider(providerName) {
+    return ProviderFactory.getDescriptor(providerName)?.toolSupport !== "native";
+}
 /**
  * Type-guard for opaque values that should be a {@link NeuroLink} instance.
  *
@@ -5452,7 +5447,7 @@ Current user's request: ${currentInput}`;
         }
         // Providers with native tool calling receive full definitions via their
         // `tools` parameter; only prompt-based providers still get the listing.
-        const nativeToolSupport = !PROMPT_ONLY_TOOL_PROVIDERS.has(String(providerName).toLowerCase());
+        const nativeToolSupport = !isPromptOnlyToolProvider(String(providerName).toLowerCase());
         const enhancedSystemPrompt = options.skipToolPromptInjection
             ? (options.systemPrompt || "") + circuitBreakerNote
             : this.createToolAwareSystemPrompt(options.systemPrompt, availableTools, nativeToolSupport) + circuitBreakerNote;
@@ -10351,19 +10346,12 @@ Current user's request: ${currentInput}`;
         // Keep references to prevent unused variable warnings
         void AIProviderFactory;
         void hasProviderEnvVars;
-        const providers = [
-            "openai",
-            "bedrock",
-            "vertex",
-            "googleVertex",
-            "anthropic",
-            "azure",
-            "google-ai",
-            "huggingface",
-            "ollama",
-            "mistral",
-            "litellm",
-        ];
+        // Derived from the descriptor registry instead of a hand-maintained
+        // list — covers all real providers (was previously hardcoded to 11,
+        // including "googleVertex" as a duplicate entry alongside "vertex";
+        // that alias remains resolvable via PROVIDER_ALIAS_INDEX/CLI choices,
+        // it just no longer gets its own separate status-check entry).
+        const providers = ProviderFactory.getAllDescriptors().map((d) => d.name);
         // Test providers with controlled concurrency
         // This reduces total time from 16s (sequential) to ~3s (parallel) while preventing resource exhaustion
         const limit = pLimit(SYSTEM_LIMITS.DEFAULT_CONCURRENCY_LIMIT);

package/dist/processors/base/BaseFileProcessor.d.ts

@@ -45,6 +45,23 @@
  */
 import { FileErrorCode } from "../errors/index.js";
 import type { BatchProcessingSummary, FileInfo, FileProcessingError, ProcessorFileProcessingResult, FileProcessorConfig, ProcessorOperationResult, ProcessedFileBase, ProcessOptions } from "../../types/index.js";
+/**
+ * Marker on the error raised when a processor refuses content for exceeding
+ * the size limit *after* the download — a ZIP entry that expands past the
+ * bound, say.
+ *
+ * Separate from DOWNLOAD_TOO_LARGE because the two fire at different stages,
+ * but it exists for the same reason. Without it a bound that fires reaches
+ * `buildProcessedResultWithResult` as a plain Error and becomes
+ * PROCESSING_FAILED, which is `retryable: true` — so a caller retries a
+ * deterministic refusal three times and gets the identical answer each time.
+ * FILE_TOO_LARGE is `retryable: false`, which is the truth about this failure.
+ */
+export declare const CONTENT_TOO_LARGE_CODE = "CONTENT_TOO_LARGE";
+/** An error that a processor's own size bound was exceeded. */
+export declare function contentTooLargeError(message: string): Error;
+/** Whether `error` is a processor size bound firing rather than a fault. */
+export declare function isContentTooLarge(error: unknown): boolean;
 /**
  * Abstract base class for file processors.
  * Provides common download, validation, and error handling functionality.

package/dist/processors/base/BaseFileProcessor.js

@@ -72,6 +72,29 @@ function downloadTooLargeError(maxSizeMB, typeName) {
 function isDownloadTooLarge(error) {
     return (error?.code === DOWNLOAD_TOO_LARGE_CODE);
 }
+/**
+ * Marker on the error raised when a processor refuses content for exceeding
+ * the size limit *after* the download — a ZIP entry that expands past the
+ * bound, say.
+ *
+ * Separate from DOWNLOAD_TOO_LARGE because the two fire at different stages,
+ * but it exists for the same reason. Without it a bound that fires reaches
+ * `buildProcessedResultWithResult` as a plain Error and becomes
+ * PROCESSING_FAILED, which is `retryable: true` — so a caller retries a
+ * deterministic refusal three times and gets the identical answer each time.
+ * FILE_TOO_LARGE is `retryable: false`, which is the truth about this failure.
+ */
+export const CONTENT_TOO_LARGE_CODE = "CONTENT_TOO_LARGE";
+/** An error that a processor's own size bound was exceeded. */
+export function contentTooLargeError(message) {
+    const error = new Error(message);
+    error.code = CONTENT_TOO_LARGE_CODE;
+    return error;
+}
+/** Whether `error` is a processor size bound firing rather than a fault. */
+export function isContentTooLarge(error) {
+    return (error?.code === CONTENT_TOO_LARGE_CODE);
+}
 /** Node's signal that a zlib output bound was reached. */
 function isBufferTooLargeError(error) {
     return (error?.code === "ERR_BUFFER_TOO_LARGE");
@@ -360,6 +383,23 @@ export class BaseFileProcessor {
             return { success: true, data: result };
         }
         catch (error) {
+            // A size bound firing is a verdict, not a fault: PROCESSING_FAILED is
+            // retryable, and re-running a decompression that will hit the same
+            // ceiling is the one thing worth not doing three times.
+            if (isContentTooLarge(error)) {
+                return {
+                    success: false,
+                    // Same detail keys as the other FILE_TOO_LARGE sites, so anything
+                    // reading them does not have to special-case where the verdict came
+                    // from. `sizeMB` is absent on purpose: the decompressed size is the
+                    // number this bound exists to never find out.
+                    error: this.createError(FileErrorCode.FILE_TOO_LARGE, {
+                        maxMB: this.config.maxSizeMB,
+                        type: this.config.fileTypeName,
+                        reason: error instanceof Error ? error.message : undefined,
+                    }),
+                };
+            }
             return {
                 success: false,
                 error: this.createError(FileErrorCode.PROCESSING_FAILED, { fileType: this.config.fileTypeName }, error instanceof Error ? error : undefined),