@juspay/neurolink 11.29.2 → 12.0.0

package/CHANGELOG.md

@@ -1,8 +1,60 @@
-## [11.29.2](https://github.com/juspay/neurolink/compare/v11.29.1...v11.29.2) (2026-08-25)
+## [12.0.0](https://github.com/juspay/neurolink/compare/v11.30.0...v12.0.0) (2026-08-25)
+
+### ⚠ BREAKING CHANGES
+
+- **(tts):** out of a TTS-enabled stream blocked the consumer permanently:
+
+  pnpm run test:tts:unit 2.95s user 1% cpu 5:09.80 total
+
+1% CPU over five minutes is not slow work — nothing was running. The
+process sat idle in teardown.
+
+interleaveTTSStream's finally awaited Promise.allSettled on the source
+and audio iterators' .return(). `.return()` on an async generator parked
+inside an `await` does not interrupt it: the request is queued behind the
+in-flight next() and only runs when the generator next suspends. A
+provider stream is wrapped several times — lifecycle in baseProvider, MCP
+and pool wrappers in neurolink — and during a pull every one of those
+layers sits in an `await` on the layer below. None can unwind, so those
+promises settle never, not late. Instrumented, at the hang:
+
+finally ENTERED completed=false nextSource=true nextAudio=true
+awaiting allSettled of 2 release(s)
+calling sourceIterator.return()
+calling audioIterator.return()
+<neither ever resolved>
+
+Two changes, because the generator protocol alone cannot express this.
+
+streamCancellation.ts adds an out-of-band channel. A wrapper registers a
+cancel callback on the stream object it returns; the callback closes its
+own upstream iterator and forwards the request downward. These are plain
+function calls, not generator protocol, so they run immediately and do not
+depend on any pending next() settling. baseProvider hoists its upstream
+iterator — iterating the hoisted handle is equivalent to iterating the
+original, it just leaves something reachable from outside the generator —
+and registers a hook. interleaveTTSStream fires it on abandonment before
+asking politely via .return().
+
+Registration is optional and reading it is defensive, so a stream that
+knows nothing about this behaves exactly as before.
+
+Teardown is also now bounded. Even with the channel, this module cannot
+assume every upstream cooperates, and a consumer's exit must not depend on
+one that may never answer. The releases are still issued and still
+propagate whenever the upstream is responsive.
+
+test:tts:unit 327s exit 0, 1 test skipped -> 83s exit 0, 43 passed
+
+That test had never passed. It and the cleanup it probes both arrived in
 
 ### Bug Fixes
 
-- **(media):** propagate cancellation through the video generation chain ([3bcaff8](https://github.com/juspay/neurolink/commit/3bcaff8876c85705383a8c59f5b4910138ea608b))
+- **(tts):** stop early stream break from hanging the caller forever ([c8f3d5b](https://github.com/juspay/neurolink/commit/c8f3d5b0ab71621916ec7d9d6970243ff916cae8)), closes [#1336](https://github.com/juspay/neurolink/issues/1336)
+
+### Performance Improvements
+
+- **(ci):** balance extended-suite shards by measured duration, not count ([ed7c300](https://github.com/juspay/neurolink/commit/ed7c300b4171dd2db4dab59e4ef18dfd9477110c))
 
 ## [11.2.3](https://github.com/juspay/neurolink/compare/v11.2.2...v11.2.3) (2026-08-19)
 

package/dist/auth/anthropicOAuth.d.ts

@@ -349,6 +349,56 @@ export declare function stopCallbackServer(server: Server): Promise<void>;
  * const authUrl = oauth.generateAuthUrl({ codeChallenge });
  * ```
  */
+/**
+ * The scopes a Claude Pro/Max subscription login asks for.
+ *
+ * Narrower than {@link DEFAULT_SCOPES}: the subscription flow does not create
+ * API keys, so `org:create_api_key` would be asking for a permission nothing
+ * downstream uses.
+ */
+export declare const SUBSCRIPTION_SCOPES = "user:profile user:inference";
+/**
+ * Build the Claude Pro/Max authorization URL for a caller-supplied challenge.
+ *
+ * Extracted so the subscription login and split-PKCE provisioning cannot drift
+ * apart: they must produce byte-identical URLs but for the challenge and state,
+ * and a second hand-rolled copy is how one of them ends up missing `code=true`
+ * and silently redirecting instead of showing a code.
+ *
+ * **`state` is not the verifier here.** The interactive login sets `state` to
+ * the verifier as a convenience, which is safe when one machine holds both. In
+ * split provisioning it would hand the verifier to the party that must not have
+ * it, so the caller supplies an unrelated random state and keeps its verifier.
+ */
+export declare function buildSubscriptionAuthUrl(params: {
+    codeChallenge: string;
+    state: string;
+    clientId?: string;
+    redirectUri?: string;
+    scope?: string;
+}): string;
+/**
+ * Exchange an authorization code for subscription tokens.
+ *
+ * The token endpoint wants a JSON body, not form encoding, and it wants the
+ * verifier that produced the challenge in the authorization URL. In split
+ * provisioning that verifier lives only on the borrower's machine, which is the
+ * entire point: the code alone buys nothing.
+ */
+export declare function exchangeSubscriptionCode(params: {
+    code: string;
+    state: string;
+    codeVerifier: string;
+    clientId?: string;
+    redirectUri?: string;
+}): Promise<{
+    accessToken: string;
+    refreshToken?: string;
+    expiresAt?: number;
+    tokenType: string;
+    scope?: string;
+    accountEmail?: string;
+}>;
 export declare function createAnthropicOAuth(overrides?: Partial<AnthropicOAuthConfig>): AnthropicOAuth;
 /**
  * Anthropic OAuth configuration creator for providerConfig pattern

package/dist/auth/anthropicOAuth.js

@@ -1046,6 +1046,84 @@ export async function stopCallbackServer(server) {
  * const authUrl = oauth.generateAuthUrl({ codeChallenge });
  * ```
  */
+/**
+ * The scopes a Claude Pro/Max subscription login asks for.
+ *
+ * Narrower than {@link DEFAULT_SCOPES}: the subscription flow does not create
+ * API keys, so `org:create_api_key` would be asking for a permission nothing
+ * downstream uses.
+ */
+export const SUBSCRIPTION_SCOPES = "user:profile user:inference";
+/**
+ * Build the Claude Pro/Max authorization URL for a caller-supplied challenge.
+ *
+ * Extracted so the subscription login and split-PKCE provisioning cannot drift
+ * apart: they must produce byte-identical URLs but for the challenge and state,
+ * and a second hand-rolled copy is how one of them ends up missing `code=true`
+ * and silently redirecting instead of showing a code.
+ *
+ * **`state` is not the verifier here.** The interactive login sets `state` to
+ * the verifier as a convenience, which is safe when one machine holds both. In
+ * split provisioning it would hand the verifier to the party that must not have
+ * it, so the caller supplies an unrelated random state and keeps its verifier.
+ */
+export function buildSubscriptionAuthUrl(params) {
+    const url = new URL(ANTHROPIC_AUTH_URL);
+    url.searchParams.set("code", "true");
+    url.searchParams.set("client_id", params.clientId ?? CLAUDE_CODE_CLIENT_ID);
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("redirect_uri", params.redirectUri ?? ANTHROPIC_REDIRECT_URI);
+    url.searchParams.set("scope", params.scope ?? SUBSCRIPTION_SCOPES);
+    url.searchParams.set("code_challenge", params.codeChallenge);
+    url.searchParams.set("code_challenge_method", "S256");
+    url.searchParams.set("state", params.state);
+    return url.toString();
+}
+/**
+ * Exchange an authorization code for subscription tokens.
+ *
+ * The token endpoint wants a JSON body, not form encoding, and it wants the
+ * verifier that produced the challenge in the authorization URL. In split
+ * provisioning that verifier lives only on the borrower's machine, which is the
+ * entire point: the code alone buys nothing.
+ */
+export async function exchangeSubscriptionCode(params) {
+    const response = await fetch(ANTHROPIC_TOKEN_URL, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+            code: params.code,
+            state: params.state,
+            grant_type: "authorization_code",
+            client_id: params.clientId ?? CLAUDE_CODE_CLIENT_ID,
+            redirect_uri: params.redirectUri ?? ANTHROPIC_REDIRECT_URI,
+            code_verifier: params.codeVerifier,
+        }),
+    });
+    if (!response.ok) {
+        const detail = await response.text().catch(() => "");
+        throw new OAuthError(`Token exchange failed: ${response.status} ${detail.slice(0, 300)}`, "TOKEN_EXCHANGE_FAILED");
+    }
+    const data = (await response.json());
+    // A 200 with no token is not a success. Returning `undefined` here would be
+    // written to the token store as a credential and only fail on first use, by
+    // which point the authorization code that could have fixed it is spent.
+    if (typeof data.access_token !== "string" || data.access_token === "") {
+        throw new OAuthError("Token exchange returned no access token.", "TOKEN_EXCHANGE_FAILED");
+    }
+    return {
+        accessToken: data.access_token,
+        ...(data.refresh_token ? { refreshToken: data.refresh_token } : {}),
+        ...(data.expires_in
+            ? { expiresAt: Date.now() + data.expires_in * 1000 }
+            : {}),
+        tokenType: data.token_type || "Bearer",
+        ...(data.scope ? { scope: data.scope } : {}),
+        ...(data.account?.email_address
+            ? { accountEmail: data.account.email_address }
+            : {}),
+    };
+}
 export function createAnthropicOAuth(overrides = {}) {
     return new AnthropicOAuth(overrides);
 }