@juspay/neurolink 11.13.2 → 11.14.0

package/dist/server/routes/claudeProxyRoutes.js

@@ -5759,6 +5759,59 @@ function buildEarlyClaudeRequestError(args) {
  * @param basePath    - Base path prefix (default: "" since Claude API uses /v1/...).
  * @returns RouteGroup with Claude-compatible endpoints.
  */
+/**
+ * Quota timestamps arrive in two units. `sessionResetAt`, `weeklyResetAt` and
+ * each window's `resetsAt` are unix SECONDS; `lastUpdated`, `updatedAt` and
+ * `coolingUntil` are already MILLISECONDS. Blanket-multiplying would push the
+ * millisecond fields tens of thousands of years into the future, so only the
+ * seconds fields are converted, and 0 becomes null rather than epoch zero.
+ */
+/**
+ * Account types that represent a real credential rather than proxy plumbing.
+ * Mirrors the Anthropic pool's own account types.
+ */
+const REAL_ACCOUNT_TYPES = new Set(["oauth", "api_key"]);
+function toMillis(value) {
+    return typeof value === "number" && Number.isFinite(value) && value > 0
+        ? Math.round(value * 1000)
+        : null;
+}
+/**
+ * Normalise one account's quota for a dashboard consumer.
+ *
+ * `severity` and `isActive` are absent on header-sourced windows — a
+ * structural property of how those rows are parsed, not a transient gap — so
+ * every consumer would otherwise need the same fallback branch.
+ */
+function normalizeQuotaForAccounts(quota) {
+    if (!quota || typeof quota !== "object") {
+        return null;
+    }
+    const q = { ...quota };
+    q.sessionResetAtMs = toMillis(q.sessionResetAt);
+    q.weeklyResetAtMs = toMillis(q.weeklyResetAt);
+    if (Array.isArray(q.windows)) {
+        q.windows = q.windows.map((raw) => {
+            const w = { ...raw };
+            w.resetsAtMs = toMillis(w.resetsAt);
+            w.severity =
+                w.severity ?? (w.status === "rejected" ? "critical" : "normal");
+            w.isActive = w.isActive ?? false;
+            return w;
+        });
+    }
+    return q;
+}
+/** "rejected" and "throttled" both mean degraded; unknown strings stay unknown. */
+function quotaHealth(status) {
+    if (status === "allowed") {
+        return "ok";
+    }
+    if (status === "rejected" || status === "throttled") {
+        return "degraded";
+    }
+    return "unknown";
+}
 export function createClaudeProxyRoutes(modelRouter, basePath = "", accountStrategy = "fill-first", passthroughMode = false, primaryAccountKey, accountAllowlistOrRuntimeOptions) {
     const accountAllowlist = isClaudeProxyRouteRuntimeOptions(accountAllowlistOrRuntimeOptions)
         ? accountAllowlistOrRuntimeOptions.accountAllowlist
@@ -5991,6 +6044,199 @@ export function createClaudeProxyRoutes(modelRouter, basePath = "", accountStrat
                     "?account=<label> for one account, ?snapshot=true for stored state",
                 tags: ["claude-proxy", "limits"],
             },
+            // =====================================================================
+            // GET /accounts -- One dashboard-shaped row per account
+            // =====================================================================
+            // Joins what previously took two calls with incompatible schemas plus a
+            // client-side merge: request counters from the usage snapshot, quota from
+            // the limits snapshot, and today's tokens and cost from the request log.
+            {
+                method: "GET",
+                path: `${basePath}/accounts`,
+                handler: async (ctx) => {
+                    const routing = runtimeConfigProvider?.();
+                    const effectiveAllowlist = routing?.accountAllowlist ?? accountAllowlist;
+                    // Cached by default. This endpoint is built to be polled, and a live
+                    // refresh spends the user's own OAuth credentials against Anthropic's
+                    // usage API — one dashboard on a short interval would hammer it.
+                    const live = ctx.query?.refresh === "true";
+                    // A live refresh reconciles cooldowns from the fetched quota, so it
+                    // makes the same overage judgement the request path does and needs
+                    // the same operator policy in scope — exactly as /limits sets it.
+                    if (live) {
+                        setOveragePolicy(routing?.useOverage);
+                    }
+                    // Every other source in this handler degrades to a partial row on
+                    // failure; quota must too, or one upstream hiccup 500s a dashboard.
+                    let limits = {
+                        fetchedAt: Date.now(),
+                        snapshot: !live,
+                        results: [],
+                    };
+                    let quotaError = null;
+                    try {
+                        limits = await refreshAccountLimits({
+                            accountAllowlist: effectiveAllowlist,
+                            snapshotOnly: !live,
+                        });
+                    }
+                    catch (error) {
+                        quotaError = error instanceof Error ? error.message : String(error);
+                    }
+                    const { getUsageSnapshot } = await import("../../proxy/usageStats.js");
+                    const statsAccounts = getUsageSnapshot().stats.accounts;
+                    // `cooling` is the field an operator actually acts on, and one small
+                    // file read answers it. `allowed`/`expired` additionally need the
+                    // token store, which /status guards behind its own timeouts — this
+                    // route reports them as null rather than taking that latency.
+                    const now = Date.now();
+                    // Typed from the loader, NOT re-asserted into a local shape. The
+                    // first version cast this to `{ until?: number }` and read
+                    // `.until` — a field PersistedAccountCooldown does not have, so
+                    // every row reported cooling: false and the assertion is precisely
+                    // what stopped the compiler from saying so.
+                    let cooldowns = {};
+                    try {
+                        cooldowns = await loadAccountCooldowns();
+                    }
+                    catch {
+                        // Non-fatal: every row simply reports cooling: false.
+                    }
+                    const isCooling = (key) => {
+                        if (!key) {
+                            return false;
+                        }
+                        const until = cooldowns[key]?.coolingUntil;
+                        return typeof until === "number" && until > now;
+                    };
+                    let usageByAccount = new Map();
+                    let usageError = null;
+                    let usageDate = "";
+                    try {
+                        const { readAccountUsage, currentUsageDate } = await import("../../proxy/accountLedger.js");
+                        usageDate = currentUsageDate();
+                        usageByAccount = await readAccountUsage(usageDate);
+                    }
+                    catch (error) {
+                        // Usage is the optional half; quota and status must still render.
+                        usageError = error instanceof Error ? error.message : String(error);
+                    }
+                    const statsByLabel = new Map();
+                    for (const entry of Object.values(statsAccounts)) {
+                        statsByLabel.set(entry.label, entry);
+                    }
+                    const rows = [];
+                    const claimed = new Set();
+                    // Real logins drive the row set. Building it from the log instead
+                    // would silently drop any account that happened to serve no traffic
+                    // today, which is exactly when an operator most wants to see it.
+                    for (const result of limits.results) {
+                        const label = result.account;
+                        claimed.add(label);
+                        const stat = statsByLabel.get(label);
+                        const quota = normalizeQuotaForAccounts(result.quota);
+                        const cooling = isCooling(result.key ?? null);
+                        rows.push({
+                            label,
+                            key: result.key ?? null,
+                            kind: "account",
+                            type: result.type ?? stat?.type ?? "oauth",
+                            // result.status describes how the quota was obtained
+                            // ("snapshot"/"fetched"), not the account's health, so it must
+                            // not leak into a field consumers read as health.
+                            // BOTH quota windows, not just the weekly one. A session
+                            // window that is rejected or throttled stops the account
+                            // serving right now — this same file gates routing on
+                            // `sessionStatus` (see the overage checks above) — so an
+                            // account with a healthy weekly window and a degraded session
+                            // window would otherwise be reported "active" while being
+                            // unable to take work.
+                            status: cooling
+                                ? "cooling"
+                                : quotaHealth(quota?.weeklyStatus) === "degraded" ||
+                                    quotaHealth(quota?.sessionStatus) === "degraded"
+                                    ? "exhausted"
+                                    : "active",
+                            cooling,
+                            allowed: null,
+                            expired: null,
+                            isPrimary: false,
+                            requests: stat ? stat.successCount + stat.errorCount : null,
+                            errors: stat?.errorCount ?? null,
+                            rateLimits: stat?.rateLimitCount ?? null,
+                            quotaRateLimits: stat?.quotaRateLimitCount ?? null,
+                            quota: quota
+                                ? {
+                                    ...quota,
+                                    sessionHealth: quotaHealth(quota.sessionStatus),
+                                    weeklyHealth: quotaHealth(quota.weeklyStatus),
+                                }
+                                : null,
+                            usage: usageByAccount.get(label) ?? null,
+                        });
+                    }
+                    // Plumbing rows are still reported, but tagged, so a consumer can
+                    // show or hide them rather than rendering them as credentials.
+                    //
+                    // A real login can land here too: listAnthropicAccountsForUsage
+                    // skips accounts the token store has disabled or the allowlist
+                    // excludes, so an account with real usage history but no current
+                    // route is absent from limits.results. Tagging that as plumbing hid
+                    // the one account an operator is looking for when they ask why
+                    // traffic stopped — the docs tell consumers to filter internal rows
+                    // out. It stays kind "account", with a status saying why it has no
+                    // quota block.
+                    for (const entry of Object.values(statsAccounts)) {
+                        if (claimed.has(entry.label)) {
+                            continue;
+                        }
+                        const isRealAccount = REAL_ACCOUNT_TYPES.has(entry.type);
+                        rows.push({
+                            label: entry.label,
+                            key: null,
+                            kind: isRealAccount
+                                ? "account"
+                                : entry.type === "translation"
+                                    ? "translation"
+                                    : "internal",
+                            type: entry.type,
+                            status: isRealAccount ? "unrouted" : null,
+                            cooling: false,
+                            allowed: null,
+                            expired: null,
+                            isPrimary: false,
+                            requests: entry.successCount + entry.errorCount,
+                            errors: entry.errorCount,
+                            rateLimits: entry.rateLimitCount,
+                            quotaRateLimits: entry.quotaRateLimitCount,
+                            quota: null,
+                            // Looked up the same way the routed rows do. These accounts are
+                            // built FROM today's usage stats, so an account that served
+                            // requests and was then disabled or excluded still has tokens
+                            // and cost in the ledger — hardcoding null here discarded
+                            // exactly the usage an operator is looking for when they ask
+                            // why traffic stopped.
+                            usage: usageByAccount.get(entry.label) ?? null,
+                        });
+                    }
+                    const response = {
+                        generatedAt: Date.now(),
+                        usageDate,
+                        quotaFromSnapshot: !live,
+                        usageError,
+                        quotaError,
+                        // Pooled accounts bill by subscription. This is what the recorded
+                        // tokens would have cost at published rates — a value estimate, not
+                        // an invoice — and consumers must label it that way.
+                        costBasis: "api-equivalent",
+                        accounts: rows,
+                    };
+                    return response;
+                },
+                description: "One row per account: status, quota, and today's tokens and " +
+                    "API-equivalent cost. ?refresh=true forces a live quota fetch",
+                tags: ["claude-proxy", "accounts"],
+            },
         ],
     };
 }
@@ -6354,6 +6600,7 @@ export function redactProviderErrorMessage(message) {
 // spinning up a full proxy. Keep this surface small.
 // ---------------------------------------------------------------------------
 export const __testHooks = {
+    normalizeQuotaForAccounts,
     resolveHomeIndex,
     maybeResetPrimaryToHome,
     planCooldownFor429,

package/dist/types/proxyClient.d.ts

@@ -1,3 +1,4 @@
+import type { JsonObject } from "./common.js";
 /**
  * One AI coding CLI the proxy can point at itself.
  *
@@ -52,3 +53,83 @@ export type CliProxyClientRestoreResult = {
  * key the user has set, including ones this repo does not know about.
  */
 export type CliQwenSettings = Record<string, unknown>;
+/**
+ * Per-account token and cost totals derived from the proxy's own request log.
+ *
+ * `costUsd` is an **API-equivalent** figure: what the recorded tokens would
+ * have cost at published per-token rates. Pooled OAuth accounts are billed by
+ * subscription, so this is a value estimate, never an invoice. Consumers must
+ * label it as such.
+ */
+export type CliAccountUsageTotals = {
+    requests: number;
+    inputTokens: number;
+    outputTokens: number;
+    cacheReadTokens: number;
+    cacheCreationTokens: number;
+    costUsd: number;
+    /** Requests whose model carried no pricing row, so contributed no cost. */
+    unpricedRequests: number;
+    /** Distinct models with no pricing row, so an operator can chase them. */
+    unpricedModels: string[];
+};
+/** One row of GET /accounts. */
+export type CliAccountsRow = {
+    /** Bare label, e.g. "someone@example.com". The join key across all sources. */
+    label: string;
+    /** Full pool key, e.g. "anthropic:someone@example.com". */
+    key: string | null;
+    /**
+     * What this row actually is. Only "account" rows are real logins; the proxy
+     * also tracks internal and translation pseudo-accounts, which have no quota
+     * and should not be rendered as credentials.
+     */
+    kind: "account" | "internal" | "translation";
+    type: string;
+    status: string | null;
+    cooling: boolean;
+    allowed: boolean | null;
+    expired: boolean | null;
+    isPrimary: boolean;
+    requests: number | null;
+    errors: number | null;
+    rateLimits: number | null;
+    quotaRateLimits: number | null;
+    /** Quota block from the limits snapshot, timestamps normalised to ms. */
+    quota: JsonObject | null;
+    /** Today's usage from the request log, or null when the log is unreadable. */
+    usage: CliAccountUsageTotals | null;
+};
+/** Response body of GET /accounts. */
+export type CliAccountsResponse = {
+    generatedAt: number;
+    /** UTC date whose request log the usage totals cover. */
+    usageDate: string;
+    /** True when quota came from the stored snapshot rather than a live fetch. */
+    quotaFromSnapshot: boolean;
+    /** Set when the usage totals could not be read at all. */
+    usageError: string | null;
+    /** Set when the quota snapshot could not be read; rows still carry status. */
+    quotaError: string | null;
+    costBasis: "api-equivalent";
+    accounts: CliAccountsRow[];
+};
+/** One request as recorded in the proxy request log, reduced to what costing needs. */
+export type ProxyLedgerEntry = {
+    account: string;
+    accountType: string;
+    model: string;
+    provider?: string;
+    inputTokens: number;
+    outputTokens: number;
+    cacheReadTokens: number;
+    cacheCreationTokens: number;
+};
+/** Incremental read position and accumulated entries for one request-log file. */
+export type ProxyLedgerFileCursor = {
+    /** Byte offset just past the last complete line consumed. */
+    offset: number;
+    size: number;
+    /** requestId -> latest known entry, so a re-logged request cannot double count. */
+    entries: Map<string, ProxyLedgerEntry>;
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@juspay/neurolink",
-  "version": "11.13.2",
+  "version": "11.14.0",
   "packageManager": "pnpm@10.15.1",
   "description": "TypeScript AI SDK with 24+ LLM providers behind one consistent API. MCP-native (connect any MCP server), voice TTS/STT/realtime, RAG, agents, memory, context compaction. OpenAI · Anthropic · Gemini · Bedrock · Azure · Ollama · DeepSeek · NVIDIA NIM and more.",
   "author": {
@@ -32,8 +32,6 @@
     "build:browser": "node scripts/build-browser.mjs",
     "build:browser:dev": "node scripts/build-browser.mjs --dev",
     "build:cli": "echo 'Building CLI...' && svelte-kit sync && tsc --project tsconfig.cli.json && node scripts/collapse-cli-lib-duplicate.mjs",
-    "build:cli:bundle": "node scripts/bundle-cli.mjs",
-    "build:cli:bundle:minify": "node scripts/bundle-cli.mjs --minify",
     "build:action": "ncc build src/action/index.ts -o action-dist --source-map",
     "build:cli:link": "pnpm run build:cli && pnpm link --global",
     "check:deps": "tsx scripts/check-banned-deps.ts",
@@ -154,9 +152,6 @@
     "// Documentation Automation (Legacy MkDocs)": "",
     "docs:api": "typedoc",
     "docs:sync": "bash scripts/sync-readme.sh",
-    "docs:build:mkdocs": "pnpm run docs:api && bash scripts/sync-readme.sh && mkdocs build --strict --clean",
-    "docs:serve:mkdocs": "bash scripts/sync-readme.sh && mkdocs serve",
-    "docs:gh-deploy:mkdocs": "bash scripts/sync-readme.sh && mkdocs gh-deploy --force",
     "docs:validate": "tsx tools/content/documentationSync.ts --validate",
     "docs:generate": "pnpm run docs:validate",
     "// Documentation (Docusaurus)": "",
@@ -200,7 +195,6 @@
     "validate:commit": "tsx scripts/commit-validation.ts",
     "quality:metrics": "tsx scripts/quality-metrics.ts",
     "quality:report": "pnpm run quality:metrics && echo 'Quality metrics saved to quality-metrics.json'",
-    "pre-commit": "lint-staged",
     "pre-push": "pnpm run check:deps && pnpm run build && pnpm run test:providers-mocked && pnpm run test:provider-structure && pnpm run test:model-manifests",
     "check:all": "pnpm run lint && pnpm run format --check && pnpm run validate && pnpm run validate:commit",
     "test:file-formats": "npx tsx test/continuous-test-suite-file-formats.ts",
@@ -383,9 +377,7 @@
     "js-yaml": "^4.3.1",
     "json-schema-to-zod": "^2.7.0",
     "jsonrepair": "^3.14.0",
-    "minisearch": "^7.2.0",
     "nanoid": "^5.1.16",
-    "open": "^11.0.0",
     "ora": "^9.3.0",
     "p-limit": "^7.3.0",
     "redis": "^5.11.0",
@@ -424,9 +416,7 @@
     "@fastify/cors": "^11.2.0",
     "@fastify/rate-limit": "^10.3.0",
     "@google-cloud/text-to-speech": "^6.4.0",
-    "@google-cloud/vertexai": "^1.10.0",
     "@hono/node-server": "^1.19.15",
-    "@huggingface/inference": "^4.13.14",
     "@koa/cors": "^5.0.0",
     "@koa/router": "^15.3.1",
     "@langfuse/otel": "^5.0.1",
@@ -463,7 +453,6 @@
     "@actions/core": "^3.0.0",
     "@actions/exec": "^3.0.0",
     "@actions/github": "^9.0.0",
-    "@biomejs/biome": "^2.4.4",
     "@changesets/changelog-github": "^0.6.0",
     "@changesets/cli": "^2.29.8",
     "@electric-sql/pglite": "^0.4.6",
@@ -474,7 +463,6 @@
     "@opentelemetry/sdk-trace-node": "^2.6.0",
     "@semantic-release/changelog": "^6.0.3",
     "@semantic-release/commit-analyzer": "^13.0.1",
-    "@semantic-release/git": "^10.0.1",
     "@semantic-release/github": "^12.0.6",
     "@semantic-release/npm": "^13.1.4",
     "@semantic-release/release-notes-generator": "^14.1.0",
@@ -483,11 +471,9 @@
     "@sveltejs/kit": "^2.70.3",
     "@sveltejs/package": "^2.5.7",
     "@sveltejs/vite-plugin-svelte": "^7.0.0",
-    "@types/adm-zip": "^0.5.7",
     "@types/cors": "^2.8.19",
     "@types/express": "^5.0.6",
     "@types/fluent-ffmpeg": "^2.1.28",
-    "@types/inquirer": "^9.0.9",
     "@types/js-yaml": "^4.0.9",
     "@types/koa": "^3.0.1",
     "@types/koa-bodyparser": "^4.3.13",
@@ -500,32 +486,25 @@
     "@typescript-eslint/eslint-plugin": "^8.57.2",
     "@typescript-eslint/parser": "^8.57.2",
     "@vercel/ncc": "^0.38.4",
-    "@vitest/coverage-v8": "^4.1.0",
     "concurrently": "^9.2.1",
     "conventional-changelog-conventionalcommits": "^9.1.0",
     "esbuild": "^0.28.1",
     "eslint": "^10.0.2",
     "husky": "^9.1.7",
-    "lint-staged": "^16.3.0",
     "playwright": "^1.58.2",
     "prettier": "^3.8.1",
     "publint": "^0.3.17",
-    "puppeteer": "^24.37.5",
     "react": "^19.2.4",
     "react-dom": "^19.2.4",
     "semantic-release": "^25.0.3",
-    "shell-quote": "^1.9.0",
     "svelte": "^5.55.7",
     "svelte-check": "^4.4.4",
-    "ts-morph": "^24.0.0",
-    "tslib": "^2.8.1",
     "tsx": "^4.21.0",
     "typedoc": "^0.28.17",
     "typedoc-plugin-markdown": "^4.10.0",
     "typescript": "^5.9.3",
     "vite": "^8.2.2",
-    "vitest": "^4.1.0",
-    "why-is-node-running": "^3.2.2"
+    "vitest": "^4.1.0"
   },
   "keywords": [
     "ai",
@@ -650,18 +629,5 @@
     "tabWidth": 2,
     "useTabs": false,
     "proseWrap": "preserve"
-  },
-  "lint-staged": {
-    "src/**/*.{ts,tsx}": [
-      "eslint --fix --max-warnings=50",
-      "prettier --write"
-    ],
-    "test/**/*.{ts,tsx}": [
-      "eslint --fix --max-warnings=0",
-      "prettier --write"
-    ],
-    "*.{json,md}": [
-      "prettier --write"
-    ]
   }
 }