@juspay/neurolink 12.14.6 → 12.14.8

package/dist/types/cli.d.ts

@@ -834,8 +834,14 @@ export type ProxyGuardArgs = {
 };
 /** Arguments accepted by `neurolink proxy telemetry <subcommand>` */
 export type ProxyTelemetryArgs = {
-    action?: "setup" | "start" | "stop" | "status" | "logs" | "import-dashboard";
+    action?: "setup" | "start" | "stop" | "status" | "logs" | "import-dashboard" | "doctor" | "query";
     quiet?: boolean;
+    since?: string;
+    until?: string;
+    kind?: string;
+    format?: "json" | "text";
+    maxRows?: number;
+    proxyUrl?: string;
 };
 /** A fallback chain entry (serialisable subset of FallbackEntry) */
 export type FallbackInfo = {

package/dist/types/proxy.d.ts

@@ -555,8 +555,16 @@ export type ProxyAccountSortMetrics = {
     scopedSaturated: boolean;
 };
 export type RequestLogEntry = {
-    /** First output text or tool-argument delta, excluding SSE control frames. */
+    /** First text, refusal or populated tool output, excluding SSE control frames. */
     firstUsefulOutputMs?: number;
+    /** Why first-useful-output timing is absent; never substitute a zero. */
+    firstUsefulOutputStatus?: "observed" | "no_useful_output" | "not_observed";
+    /** Native protocol event that established the first useful output. */
+    firstUsefulOutputEvent?: string;
+    /** Why first-output timing could not be established for this response. */
+    firstUsefulOutputUnavailableReason?: string;
+    /** Requested reasoning effort retained independently of body capture. */
+    reasoningEffort?: string;
     /** Small routing evidence retained even when response bodies are pruned. */
     fallbackPlan?: Array<{
         provider: string;
@@ -610,6 +618,8 @@ export type RequestLogEntry = {
     traceId?: string;
     /** OTel span ID for correlation with distributed traces */
     spanId?: string;
+    /** Original OTel sampling flags retained through deferred logging. */
+    traceFlags?: number;
     /** Exact secret-free inputs and result of initial account selection. */
     routingDecision?: ProxyAccountRoutingDecision;
 };
@@ -631,6 +641,18 @@ export type ProcessedProxyBodyCapture = {
     error?: string;
     queueWaitMs?: number;
     processingMs?: number;
+    admission?: ProxyBodyCaptureAdmission;
+};
+/** Exact bounded-admission state; records no request content. */
+export type ProxyBodyCaptureAdmission = {
+    limitingResource: "entry" | "captures" | "bytes" | "worker";
+    estimatedBytes?: number;
+    /** Per-entry clone ceiling, independent of the aggregate queue ceiling. */
+    maxEntryBytes?: number;
+    pending: number;
+    pendingBytes: number;
+    maxPending: number;
+    maxPendingBytes: number;
 };
 export type ProxyBodyCaptureWorkerSnapshot = {
     attempted: number;
@@ -641,9 +663,12 @@ export type ProxyBodyCaptureWorkerSnapshot = {
     pendingBytes: number;
     maxPending: number;
     maxPendingBytes: number;
+    highWaterPending: number;
+    highWaterBytes: number;
     /** Admission failures by exact guard, independent of processing failures. */
     rejectionReasons: Record<string, number>;
     lastError?: string;
+    lastRejectedAt?: string;
 };
 /** Collector transport evidence; acknowledgement does not prove backend storage. */
 export type ProxyBodyDeliveryResult = {
@@ -664,6 +689,82 @@ export type ProxyBodyPublicationProgress = {
     emitted: number;
     notify?: () => void;
 };
+/** Bounded metadata-only evidence for an unconfirmed or locally rejected OTLP batch. */
+export type ProxyOtelExportFailure = {
+    id: string;
+    at: string;
+    reason: "export_unconfirmed" | "queue_full";
+    error?: string;
+    records: Array<{
+        eventId: string;
+        kind?: string;
+        requestId?: string;
+        captureId?: string;
+    }>;
+};
+/** Read adapter configuration; credentials never appear in diagnostic reports. */
+export type ProxyTelemetryBackend = {
+    baseUrl: string;
+    organization: string;
+    stream: string;
+    authorization?: string;
+    collectorMetricsUrl?: string;
+};
+export type ProxyTelemetryNativeConfig = {
+    exporters?: Record<string, {
+        endpoint?: string;
+        headers?: Record<string, string>;
+    }>;
+};
+export type ProxyTelemetryQueryBudget = {
+    used: number;
+    limit: number;
+};
+export type ProxyTelemetryQueryOptions = {
+    sql: string;
+    signal?: string;
+    startTime: number;
+    endTime: number;
+    size?: number;
+    offset?: number;
+};
+export type ProxyTelemetryDoctorOptions = {
+    backend: ProxyTelemetryBackend;
+    startTime: number;
+    endTime: number;
+    proxyUrl?: string;
+    maxRows?: number;
+    fetchImpl?: typeof fetch;
+};
+export type ProxyTelemetryCheck = {
+    name: string;
+    status: "pass" | "fail" | "warn" | "unverified";
+    evidence: unknown;
+};
+/** Small stored metadata used by the doctor; bodies are queried separately. */
+export type ProxyTelemetryStoredRecord = Partial<RequestLogEntry> & {
+    recordedAtMicroseconds?: number;
+    captureId?: string;
+    bodySha256?: string;
+    redactedBodyBytes?: number;
+    bodyDelivery?: {
+        status?: string;
+    };
+    captureError?: string;
+    captureAdmission?: ProxyBodyCaptureAdmission;
+    bodyTruncated?: boolean;
+    phase?: string;
+    event?: string;
+    telemetryStatus?: string;
+    outcomeSource?: string;
+};
+export type ProxyTelemetryFieldCoverage = {
+    records: number;
+    traceMissing: number;
+    durationMissing: number;
+    outcomeMissing: number;
+    firstOutputUnexplained: number;
+};
 /** Chunk emission stays in the request logger, which owns request attributes. */
 export type ProxyBodyChunkEmitter = (chunk: string, index: number, count: number) => void;
 export type ProxyRequestLoggerSnapshot = {
@@ -721,9 +822,11 @@ export type RequestAttemptLogEntry = {
     traceId?: string;
     /** OTel span ID for correlation with distributed traces */
     spanId?: string;
+    /** Original OTel sampling flags retained through deferred logging. */
+    traceFlags?: number;
 };
 /** Additional fields recorded when a Codex response becomes client-final. */
-export type CodexFinalLogExtra = Partial<Pick<RequestLogEntry, "errorType" | "errorMessage" | "errorCode" | "transportScope" | "inputTokens" | "outputTokens" | "cacheReadTokens" | "cacheCreationTokens" | "terminalOutcome" | "firstUsefulOutputMs">>;
+export type CodexFinalLogExtra = Partial<Pick<RequestLogEntry, "errorType" | "errorMessage" | "errorCode" | "transportScope" | "inputTokens" | "outputTokens" | "cacheReadTokens" | "cacheCreationTokens" | "terminalOutcome" | "firstUsefulOutputMs" | "firstUsefulOutputStatus" | "firstUsefulOutputEvent">>;
 /** Additional fields recorded for each upstream Codex account attempt. */
 export type CodexAttemptLogExtra = Partial<Pick<RequestAttemptLogEntry, "errorType" | "errorMessage" | "errorCode" | "transportScope" | "retryable" | "rateLimitKind" | "cooldownReason">>;
 /** Minimal persistence contract needed by Codex rotating-token refreshes. */
@@ -739,6 +842,8 @@ export type CodexTokenRefresher = (refreshToken: string) => Promise<{
 }>;
 export type ProxyBodyCaptureInput = {
     phase: string;
+    /** The stream observer retained only a bounded prefix. */
+    sourceTruncated?: boolean;
     headers?: Record<string, string>;
     body?: unknown;
     bodySize?: number;
@@ -1562,6 +1667,8 @@ export type ProxyRequestContext = {
      * every non-Anthropic model prices to $0.
      */
     provider?: string;
+    /** An internal fallback is an attempt; its parent owns request/token metrics. */
+    recordRequestMetrics?: boolean;
 };
 /** Response-side details parsed from the upstream reply (model, finish, tools). */
 export type ResponseInfoContext = {
@@ -1998,7 +2105,10 @@ export type CodexStreamUsage = {
 export type CodexStreamEvidence = {
     completed: boolean;
     terminalBytes: number;
+    /** Malformed, oversized or undispatched frames prevent proving output absence. */
+    observationIncomplete?: boolean;
     firstUsefulOutputAt?: number;
+    firstUsefulOutputEvent?: string;
     errorType?: string;
     errorMessage?: string;
     errorCode?: string;
@@ -2017,6 +2127,11 @@ export type RuntimeRequestMetadata = {
     /** Last dispatched attempt, retained until this HTTP request terminates. */
     lastUpstreamAttempt?: RequestAttemptLogEntry;
     requestId: string;
+    /** Ingress OTel correlation survives detached stream/error callbacks. */
+    traceId?: string;
+    spanId?: string;
+    /** Original OTel sampling flags retained through deferred logging. */
+    traceFlags?: number;
     method: string;
     path: string;
     startedAt: number;
@@ -2057,6 +2172,8 @@ export type ProxyBodyCaptureEntry = {
     headers?: Record<string, string>;
     body?: unknown;
     bodySize?: number;
+    /** The bounded stream observer omitted a suffix before redaction/processing. */
+    sourceTruncated?: boolean;
     contentType?: string;
     responseStatus?: number;
     durationMs?: number;
@@ -2065,6 +2182,8 @@ export type ProxyBodyCaptureEntry = {
     attempt?: number;
     traceId?: string;
     spanId?: string;
+    /** Original OTel sampling flags retained through deferred logging. */
+    traceFlags?: number;
     metadata?: Record<string, unknown>;
 };
 /** JSON object retained in deterministic proxy replay artifacts. */
@@ -2225,6 +2344,8 @@ export type SSEContentBlock = {
 export type SSETelemetry = {
     messageStopReceived: boolean;
     firstUsefulOutputAt?: number;
+    firstUsefulOutputEvent?: string;
+    observationIncomplete?: boolean;
     messageId: string;
     model: string;
     usage: {
@@ -2248,6 +2369,7 @@ export type SSETelemetry = {
     /** Error carried as a terminal SSE `event: error`, if one was observed. */
     streamErrorMessage?: string;
     rawText?: string;
+    rawTextTruncated?: boolean;
 };
 /** Terminal outcome of a response body after the HTTP headers were sent. */
 export type StreamTerminalOutcome = {
@@ -2269,6 +2391,8 @@ export type StreamTerminalOutcomeTracker = {
 export type TelemetryAccumulator = {
     messageStopReceived: boolean;
     firstUsefulOutputAt?: number;
+    firstUsefulOutputEvent?: string;
+    observationIncomplete?: boolean;
     messageId: string;
     model: string;
     inputTokens: number;
@@ -2874,7 +2998,7 @@ export type StatusStats = {
     persistence?: ProxyStatsPersistenceStatus;
 };
 /** Sub-action of the `proxy telemetry` CLI command. */
-export type ProxyTelemetryAction = "setup" | "start" | "stop" | "status" | "logs" | "import-dashboard";
+export type ProxyTelemetryAction = "doctor" | "query" | "setup" | "start" | "stop" | "status" | "logs" | "import-dashboard";
 /** Wire format a proxy request is using. */
 export type ProxyFormat = "claude" | "openai" | "gemini";
 /**
@@ -3866,3 +3990,9 @@ export type ProxyShareProvisioningBundle = {
         expiresAt?: number;
     };
 };
+/** Log correlation retained independently of the current async context. */
+export type ProxyLogTraceContext = {
+    traceId: string;
+    spanId: string;
+    traceFlags: number;
+};

package/dist/types/proxyRestart.d.ts

@@ -44,6 +44,31 @@ export type ProxyRestartControlOptions = {
     getInstalledVersion: () => Promise<string | undefined>;
     isUpdatePending: () => boolean;
     getStatus: () => Promise<unknown>;
+    /** Current supervisor process evidence; never infer it from a worker/plist. */
+    getTelemetry?: () => ProxyProcessTelemetrySnapshot;
     /** Report control-server errors without stopping the serving listener. */
     log?: (message: string) => void;
 };
+/** Small read-only process evidence, excluding environment variables and log content. */
+export type ProxyProcessTelemetrySnapshot = {
+    pid: number;
+    checkedAt: string;
+    configuredSink: "otel" | "file";
+    lifecycleSink: string;
+    otelInitialized: boolean;
+    stdio: {
+        stdout: "file" | "non_file" | "unavailable";
+        stderr: "file" | "non_file" | "unavailable";
+    };
+    exportDropped: number;
+    exportUnconfirmed: number;
+};
+export type ProxySupervisorTelemetry = {
+    status: "available";
+    process: ProxyProcessTelemetrySnapshot;
+} | {
+    status: "unavailable";
+    reason: string;
+} | {
+    status: "not_applicable";
+};

package/dist/utils/logSanitize.js

@@ -47,7 +47,7 @@ const SECRET_PATTERN = new RegExp(
     // Bare tokens by known prefix (e.g. `sk-abc…`, `r8_xyz…`)
     `|\\b(?:${PREFIX_PATTERN})[_\\-][A-Za-z0-9_\\-\\.]{8,}\\b` +
     // Generic key=value pairs (URL params, JSON bodies, header dumps)
-    "|\\b(?:api[_-]?key|access[_-]?token|secret[_-]?key|refresh[_-]?token)\\s*[:=]\\s*['\"]?[^\\s,;'\"&]+", "gi");
+    "|\\b(?:api[_-]?key|access[_-]?token|secret[_-]?key|refresh[_-]?token)['\"]?\\s*[:=]\\s*['\"]?[^\\s,;'\"&]+", "gi");
 /** Header names that should always be redacted regardless of value shape. */
 const SENSITIVE_HEADER_NAMES = [
     "authorization",