@juspay/neurolink 12.12.1 → 12.12.3

package/dist/cli/loop/optionsSchema.js

@@ -118,6 +118,10 @@ export const textGenerationOptionsSchema = {
         type: "boolean",
         description: "Disable tool result caching for this request (overrides global mcp.cache.enabled).",
     },
+    disableInternalFallback: {
+        type: "boolean",
+        description: "Own fallback order yourself: skip NeuroLink's provider-priority walk and the catalog model fallback, so an invalid model or unavailable provider surfaces as its own error.",
+    },
     disableToolCallRepair: {
         type: "boolean",
         description: "Disable the schema-driven tool call repair mechanism (near-miss tool names, mis-typed arguments). Repair is enabled by default.",

package/dist/core/baseProvider.js

@@ -1299,11 +1299,10 @@ export class BaseProvider {
             const otelSpanState = { ended: false };
             return await context.with(activeCtx, async () => this.runGenerateInActiveContext(options, startTime, otelSpan, otelSpanState));
         };
-        // TextGenerationOptions does not declare the flag (it lives on
-        // StreamOptions), but callers that own fallback order pass it on both
-        // paths, so honour it here as well.
-        const callerOwnsFallback = "disableInternalFallback" in options &&
-            options.disableInternalFallback === true;
+        // Callers that own fallback order (providerFallback / modelChain callers,
+        // or a router that retries on its own) pass the flag on both paths;
+        // TextGenerationOptions declares it, so a plain read is enough here.
+        const callerOwnsFallback = options.disableInternalFallback === true;
         return await this.runGenerateWithModelFallback(attempt, callerOwnsFallback);
     }
     /**

package/dist/neurolink.js

@@ -4121,6 +4121,11 @@ Current user's request: ${currentInput}`;
             disableTools: options.disableTools,
             toolFilter: options.toolFilter,
             excludeTools: options.excludeTools,
+            // This explicit field list is the only road into the provider, so a
+            // flag left out here never reaches BaseProvider — which is exactly how
+            // disableInternalFallback was dropped on generate() while stream()
+            // (which spreads its options) honoured it.
+            disableInternalFallback: options.disableInternalFallback,
             maxSteps: options.maxSteps,
             toolChoice: options.toolChoice,
             prepareStep: options.prepareStep,
@@ -5930,11 +5935,23 @@ Current user's request: ${currentInput}`;
             : requestedProvider
                 ? [requestedProvider]
                 : providerPriority;
+        // The caller owns fallback order (a providerFallback / modelChain caller,
+        // or a router that retries on its own): bound the walk to its first
+        // candidate so an unavailable provider surfaces as its own error instead
+        // of a silent switch. An explicit provider is already a one-element
+        // list; this only changes the "auto" and orchestrated-preference walks.
+        const providersToTry = options.disableInternalFallback === true
+            ? tryProviders.slice(0, 1)
+            : tryProviders;
+        // Caller-owned fallback never enters tryProviders: providerFallback and
+        // modelChain are walked by runWithFallbackOrchestration around the public
+        // generate() call, and a configured ModelPool is consumed by the block
+        // above. Slicing here therefore never clips a caller's own list.
         logger.debug(`[${functionTag}] Starting direct generation`, {
             requestedProvider: requestedProvider || "auto",
             preferredOrchestrated: preferredOrchestrated || "none",
-            tryProviders,
-            allowFallback: !requestedProvider || !!preferredOrchestrated,
+            tryProviders: providersToTry,
+            allowFallback: providersToTry.length > 1,
         });
         // ─── ModelPool path ──────────────────────────────────────────────────────
         // When a ModelPool is configured, source the candidate sequence from the
@@ -6080,7 +6097,7 @@ Current user's request: ${currentInput}`;
         // ─── End ModelPool path ───────────────────────────────────────────────────
         let lastError = null;
         // Try each provider in order
-        for (const providerName of tryProviders) {
+        for (const providerName of providersToTry) {
             if (options.abortSignal?.aborted) {
                 throw new DOMException("The operation was aborted", "AbortError");
             }
@@ -6437,7 +6454,7 @@ Current user's request: ${currentInput}`;
         // All providers failed
         const responseTime = Date.now() - startTime;
         logger.error(`[${functionTag}] All providers failed`, {
-            triedProviders: tryProviders,
+            triedProviders: providersToTry,
             lastError: lastError?.message,
             responseTime,
         });

package/dist/server/routes/claudeProxyRoutes.d.ts

@@ -55,7 +55,7 @@ declare function resetEpochToMs(resetEpoch: number | undefined, now: number): nu
  * burst / acceleration limit) is transient: honor retry-after as a floor,
  * allow a couple of jittered same-account retries, then a short cooldown.
  */
-declare function planCooldownFor429(quota: AccountQuota | null, retryAfterMs: number, now: number, unifiedStatus?: string | undefined, policy?: ProxyOveragePolicy): AccountCooldownPlan;
+declare function planCooldownFor429(quota: AccountQuota | null, retryAfterMs: number, now: number, unifiedStatus?: string | undefined, policy?: ProxyOveragePolicy, requestedModel?: string): AccountCooldownPlan;
 /**
  * Reconcile quota-backed cooldowns against a fresh provider observation. A
  * rejected window parks the account until its reset; an allowed observation for

package/dist/server/routes/claudeProxyRoutes.js

@@ -553,6 +553,45 @@ function clampCooldownUntil(untilMs, now, reason) {
     const ceiling = Math.min(MAX_COOLDOWN_MS, (reason && MAX_COOLDOWN_MS_BY_REASON[reason]) ?? MAX_COOLDOWN_MS);
     return Math.min(Math.max(untilMs, now + MIN_COOLDOWN_MS), now + ceiling);
 }
+function isAllowedQuotaStatus(status) {
+    return status?.trim().toLowerCase() === "allowed";
+}
+function isScopedWindowExhausted(window, now) {
+    if (!window || resetEpochToMs(window.resetsAt, now) === undefined) {
+        return false;
+    }
+    return (window.status?.trim().toLowerCase() === "rejected" ||
+        (window.used ?? 0) >= 1);
+}
+/**
+ * Anthropic represents some model-specific limits through a rejected top-level
+ * unified status. The scope window is the authoritative discriminator: only
+ * treat that response as model-scoped when both account-wide windows remain
+ * explicitly allowed and the requested model's window is exhausted.
+ */
+function getScopedOnlyExhaustion(quota, requestedModel, now, policy = overagePolicy) {
+    if (!quota ||
+        !requestedModel ||
+        !isAllowedQuotaStatus(quota.sessionStatus) ||
+        !isAllowedQuotaStatus(quota.weeklyStatus) ||
+        isOverageUsable(quota, policy)) {
+        return null;
+    }
+    const scopedWindow = matchScopedQuotaWindow(quota, requestedModel, now);
+    return isScopedWindowExhausted(scopedWindow, now) ? scopedWindow : null;
+}
+function hasScopedOnlyExhaustion(quota, now, policy = overagePolicy) {
+    if (!isAllowedQuotaStatus(quota.sessionStatus) ||
+        !isAllowedQuotaStatus(quota.weeklyStatus) ||
+        isOverageUsable(quota, policy)) {
+        return false;
+    }
+    return (quota.windows ?? []).some((window) => window.kind === "weekly_scoped" &&
+        typeof window.scopeModel === "string" &&
+        now - scopedWindowObservedAt(quota, window) <=
+            QUOTA_SNAPSHOT_FRESHNESS_MS &&
+        isScopedWindowExhausted(window, now));
+}
 /**
  * Decide how to cool an account after a genuine (non-anti-abuse) 429.
  *
@@ -567,13 +606,14 @@ function clampCooldownUntil(untilMs, now, reason) {
  * burst / acceleration limit) is transient: honor retry-after as a floor,
  * allow a couple of jittered same-account retries, then a short cooldown.
  */
-function planCooldownFor429(quota, retryAfterMs, now, unifiedStatus = quota?.unifiedStatus, policy = overagePolicy) {
+function planCooldownFor429(quota, retryAfterMs, now, unifiedStatus = quota?.unifiedStatus, policy = overagePolicy, requestedModel) {
     // Weekly exhaustion takes precedence — it's the longest, hardest ceiling.
     if (quota && quota.weeklyStatus === "rejected") {
         const reset = resetEpochToMs(quota.weeklyResetAt, now) ??
             (retryAfterMs > 0 ? now + retryAfterMs : now + DEFAULT_COOLING_PERIOD_MS);
         return {
             reason: "weekly",
+            scope: "account",
             coolingUntil: clampCooldownUntil(reset, now, "weekly"),
             rotateImmediately: true,
         };
@@ -584,10 +624,25 @@ function planCooldownFor429(quota, retryAfterMs, now, unifiedStatus = quota?.uni
             (retryAfterMs > 0 ? now + retryAfterMs : now + DEFAULT_COOLING_PERIOD_MS);
         return {
             reason: "session",
+            scope: "account",
             coolingUntil: clampCooldownUntil(reset, now, "session"),
             rotateImmediately: true,
         };
     }
+    const scopedOnlyExhaustion = getScopedOnlyExhaustion(quota, requestedModel, now, policy);
+    if (scopedOnlyExhaustion) {
+        const reset = resetEpochToMs(scopedOnlyExhaustion.resetsAt, now) ??
+            (retryAfterMs > 0 ? now + retryAfterMs : now + DEFAULT_HARD_COOLDOWN_MS);
+        return {
+            // Keep the provider's top-level classification for logs, but do not
+            // persist it as an account cooldown. The scoped quota window gates only
+            // this model on subsequent requests.
+            reason: "unified",
+            scope: "model",
+            coolingUntil: reset,
+            rotateImmediately: true,
+        };
+    }
     // Anthropic may reject the authoritative top-level unified limit while both
     // 5h and 7d sub-window statuses still say "allowed". Treating this as a
     // transient burst retries a known-exhausted account and delays failover.
@@ -595,6 +650,7 @@ function planCooldownFor429(quota, retryAfterMs, now, unifiedStatus = quota?.uni
         const reset = retryAfterMs > 0 ? now + retryAfterMs : now + DEFAULT_HARD_COOLDOWN_MS;
         return {
             reason: "unified",
+            scope: "account",
             coolingUntil: clampCooldownUntil(reset, now, "unified"),
             rotateImmediately: true,
         };
@@ -605,6 +661,7 @@ function planCooldownFor429(quota, retryAfterMs, now, unifiedStatus = quota?.uni
     const base = retryAfterMs > 0 ? retryAfterMs : DEFAULT_COOLING_PERIOD_MS;
     return {
         reason: "transient",
+        scope: "account",
         coolingUntil: now +
             Math.max(MIN_COOLDOWN_MS, Math.min(base, TRANSIENT_MAX_COOLDOWN_MS)),
         rotateImmediately: false,
@@ -622,6 +679,7 @@ function minutesUntil(untilMs, now) {
  */
 function reconcileCooldownFromQuota(state, quota, now, policy = overagePolicy) {
     const overageAvailable = isOverageUsable(quota, policy);
+    const scopedOnlyExhaustion = hasScopedOnlyExhaustion(quota, now, policy);
     let until;
     let reason;
     if (quota.weeklyStatus === "rejected") {
@@ -646,7 +704,8 @@ function reconcileCooldownFromQuota(state, quota, now, policy = overagePolicy) {
     }
     else if (until === undefined &&
         quota.unifiedStatus === "rejected" &&
-        !overageAvailable) {
+        !overageAvailable &&
+        !scopedOnlyExhaustion) {
         until = now + DEFAULT_HARD_COOLDOWN_MS;
         reason = "unified";
     }
@@ -656,7 +715,7 @@ function reconcileCooldownFromQuota(state, quota, now, policy = overagePolicy) {
                 (state.coolingReason === "session" &&
                     quota.sessionStatus === "allowed") ||
                 (state.coolingReason === "unified" &&
-                    quota.unifiedStatus === "allowed"));
+                    (quota.unifiedStatus === "allowed" || scopedOnlyExhaustion)));
         if (recoveredQuotaCooldown && state.coolingUntil) {
             const previousCoolingUntil = state.coolingUntil;
             const previousCoolingReason = state.coolingReason;
@@ -4348,13 +4407,14 @@ async function handleAnthropicStreamingSuccessResponse(args) {
         const quota = parseQuotaHeaders(responseHeaders, { model: body.model });
         const now = Date.now();
         if (isRateLimit) {
-            const cooldownPlan = planCooldownFor429(quota, parseRetryAfterMs(responseHeaders["retry-after"] ?? null), now, getUnifiedRateLimitStatus(responseHeaders));
+            const cooldownPlan = planCooldownFor429(quota, parseRetryAfterMs(responseHeaders["retry-after"] ?? null), now, getUnifiedRateLimitStatus(responseHeaders), overagePolicy, typeof body.model === "string" ? body.model : undefined);
             accountState.quota = quota
                 ? mergeQuotaSnapshot(accountState.quota, quota)
                 : accountState.quota;
             const rateLimitKind = cooldownPlan.reason === "transient" ? "transient" : "quota";
-            if (!accountState.coolingUntil ||
-                cooldownPlan.coolingUntil > accountState.coolingUntil) {
+            if (cooldownPlan.scope === "account" &&
+                (!accountState.coolingUntil ||
+                    cooldownPlan.coolingUntil > accountState.coolingUntil)) {
                 accountState.coolingUntil = cooldownPlan.coolingUntil;
                 accountState.coolingReason = cooldownPlan.reason;
                 await saveAccountCooldown(account.key, cooldownPlan.coolingUntil, cooldownPlan.reason).catch(() => {
@@ -5132,7 +5192,7 @@ async function handleAnthropicAuthRetry(args) {
                 if (retryQuota429) {
                     accountState.quota = mergeQuotaSnapshot(accountState.quota, retryQuota429);
                 }
-                const retryPlan = planCooldownFor429(retryQuota429, parseRetryAfterMs(retryRespHeaders["retry-after"] ?? null), nowRetry, getUnifiedRateLimitStatus(retryRespHeaders));
+                const retryPlan = planCooldownFor429(retryQuota429, parseRetryAfterMs(retryRespHeaders["retry-after"] ?? null), nowRetry, getUnifiedRateLimitStatus(retryRespHeaders), overagePolicy, typeof body.model === "string" ? body.model : undefined);
                 const rateLimitKind = retryPlan.reason === "transient" ? "transient" : "quota";
                 recordAttemptError(account.label, account.type, retryStatus, rateLimitKind);
                 retryLogAttempt(429, "rate_limit_error", retryBody, {
@@ -5140,8 +5200,9 @@ async function handleAnthropicAuthRetry(args) {
                     rateLimitKind,
                     cooldownReason: retryPlan.reason,
                 });
-                if (!accountState.coolingUntil ||
-                    retryPlan.coolingUntil > accountState.coolingUntil) {
+                if (retryPlan.scope === "account" &&
+                    (!accountState.coolingUntil ||
+                        retryPlan.coolingUntil > accountState.coolingUntil)) {
                     accountState.coolingUntil = retryPlan.coolingUntil;
                     accountState.coolingReason = retryPlan.reason;
                 }
@@ -5150,9 +5211,11 @@ async function handleAnthropicAuthRetry(args) {
                         // Non-fatal: routing already has the in-memory snapshot.
                     });
                 }
-                await saveAccountCooldown(account.key, accountState.coolingUntil ?? retryPlan.coolingUntil, accountState.coolingReason ?? retryPlan.reason).catch(() => {
-                    // Non-fatal: routing already has the in-memory cooldown.
-                });
+                if (retryPlan.scope === "account") {
+                    await saveAccountCooldown(account.key, accountState.coolingUntil ?? retryPlan.coolingUntil, accountState.coolingReason ?? retryPlan.reason).catch(() => {
+                        // Non-fatal: routing already has the in-memory cooldown.
+                    });
+                }
                 advancePrimaryIfCurrent(account.key, enabledAccounts.length, orderedAccounts[0]?.key);
                 break;
             }
@@ -6149,10 +6212,10 @@ async function fetchAnthropicAccountResponse(args) {
         const now = Date.now();
         const quota = parseQuotaHeaders(errRespHeaders, { model: requestedModel });
         const unifiedStatus = getUnifiedRateLimitStatus(errRespHeaders);
-        const cooldownPlan = planCooldownFor429(quota, retryAfterMs, now, unifiedStatus);
+        const cooldownPlan = planCooldownFor429(quota, retryAfterMs, now, unifiedStatus, overagePolicy, requestedModel);
         const rateLimitKind = cooldownPlan.reason === "transient" ? "transient" : "quota";
         recordAttemptError(account.label, account.type, 429, rateLimitKind);
-        logger.always(`[proxy] ← 429 account=${account.label} reason=${cooldownPlan.reason} ` +
+        logger.always(`[proxy] ← 429 account=${account.label} reason=${cooldownPlan.reason} scope=${cooldownPlan.scope} ` +
             `retry-after=${retryAfterMs}ms 5h-status=${errRespHeaders["anthropic-ratelimit-unified-5h-status"] ?? "unknown"} ` +
             `7d-status=${errRespHeaders["anthropic-ratelimit-unified-7d-status"] ?? "unknown"} ` +
             `unified-status=${unifiedStatus ?? "unknown"} ` +
@@ -6507,14 +6570,15 @@ async function handleAnthropicRoutedClaudeRequest(args) {
                         // Publish the cooldown before retrying so requests arriving behind
                         // this one skip the throttled account instead of joining the burst.
                         let cooldownExtended = false;
-                        if (!accountState.coolingUntil ||
-                            plan.coolingUntil > accountState.coolingUntil) {
+                        if (plan.scope === "account" &&
+                            (!accountState.coolingUntil ||
+                                plan.coolingUntil > accountState.coolingUntil)) {
                             accountState.coolingUntil = plan.coolingUntil;
                             accountState.coolingReason = plan.reason;
                             cooldownExtended = true;
                         }
-                        if (cooldownExtended) {
-                            await saveAccountCooldown(account.key, accountState.coolingUntil, accountState.coolingReason ?? plan.reason).catch(() => {
+                        if (cooldownExtended && plan.scope === "account") {
+                            await saveAccountCooldown(account.key, accountState.coolingUntil ?? plan.coolingUntil, accountState.coolingReason ?? plan.reason).catch(() => {
                                 // Non-fatal: routing already has the in-memory cooldown.
                             });
                         }

package/dist/types/generate.d.ts

@@ -459,6 +459,19 @@ export type GenerateOptions = {
     skipToolPromptInjection?: boolean;
     /** Disable tool result caching for this request (overrides global mcp.cache.enabled) */
     disableToolCache?: boolean;
+    /**
+     * Disable NeuroLink's internal fallback for this request: the static
+     * provider-priority walk that runs when no provider was requested, and the
+     * catalog model-fallback walk a provider performs when its model is
+     * rejected as invalid. Callers that own fallback order (a caller-supplied
+     * `providerFallback` / `modelChain`, or a router that retries on its own,
+     * as the Claude proxy does for its streams) set this so an invalid model
+     * or an unavailable provider surfaces as exactly that.
+     * A configured `ModelPool`, `providerFallback` and `modelChain` are the
+     * caller's own fallback and are unaffected. Mirrors the same flag on
+     * `StreamOptions`.
+     */
+    disableInternalFallback?: boolean;
     /** Maximum number of tool execution steps (default: 200) */
     maxSteps?: number;
     /**
@@ -1204,6 +1217,14 @@ export type TextGenerationOptions = {
     excludeTools?: string[];
     /** Disable tool result caching for this request (overrides global mcp.cache.enabled) */
     disableToolCache?: boolean;
+    /**
+     * Caller owns fallback order. Read in two places: `directProviderGeneration`
+     * bounds its static provider-priority walk to one candidate, and
+     * `BaseProvider.generate()` skips the catalog model-fallback walk so an
+     * invalid-model error surfaces as itself. Mapped from
+     * `GenerateOptions.disableInternalFallback`.
+     */
+    disableInternalFallback?: boolean;
     /**
      * Tool choice configuration for the generation.
      * Controls whether and which tools the model must call.

package/dist/types/proxy.d.ts

@@ -856,7 +856,13 @@ export type PreparedAnthropicAccountAttempt = {
 export type RateLimitCoolingReason = Exclude<AccountCoolingReason, "auth">;
 export type AccountCooldownPlan = {
     reason: RateLimitCoolingReason;
-    /** Epoch-ms until which the account should not be used. */
+    /**
+     * Whether this limit applies to every request on the account or only to the
+     * requested model. Model scope must never be persisted as an account
+     * cooldown; the quota window itself remains the routing evidence.
+     */
+    scope: "account" | "model";
+    /** Epoch-ms until which the limiting window is expected to recover. */
     coolingUntil: number;
     /** When true (unified/5h/7d rejected), rotate immediately — retrying the
      *  same account is futile until its window resets. When false (transient

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@juspay/neurolink",
-  "version": "12.12.1",
+  "version": "12.12.3",
   "packageManager": "pnpm@10.15.1",
   "description": "TypeScript AI SDK with 24+ LLM providers behind one consistent API. MCP-native (connect any MCP server), voice TTS/STT/realtime, RAG, agents, memory, context compaction. OpenAI · Anthropic · Gemini · Bedrock · Azure · Ollama · DeepSeek · NVIDIA NIM and more.",
   "author": {