@juspay/neurolink 12.22.1 → 12.23.1

package/dist/providers/catalog/friendli.json

@@ -0,0 +1,130 @@
+{
+    "$schema": "./provider-catalog.schema.json",
+    "id": "friendli",
+    "displayName": "FriendliAI",
+    "aliases": [],
+    "tier": 2,
+    "wire": {
+        "baseURL": "https://api.friendli.ai/serverless/v1"
+    },
+    "models": {
+        "default": "zai-org/GLM-5.3",
+        "fallbacks": [
+            "zai-org/GLM-5.3",
+            "zai-org/GLM-5.3-Flash",
+            "zai-org/GLM-5.2",
+            "zai-org/GLM-5.1",
+            "google/gemma-4-31B-it",
+            "deepseek-ai/DeepSeek-V3.2",
+            "MiniMaxAI/MiniMax-M2.5"
+        ],
+        "defaultContextWindow": 1048576,
+        "defaultMaxOutputTokens": 131072,
+        "catalog": {
+            "zai-org/GLM-5.3": {
+                "contextWindow": 1048576,
+                "maxOutputTokens": 131072,
+                "pricingPerMTok": {
+                    "input": 1.4,
+                    "output": 4.4,
+                    "cachedInput": 0.26
+                },
+                "vision": false,
+                "status": "production",
+                "description": "Recommended - Zhipu's flagship GLM-5.3, the only model in this roster that was live capability-probed end to end: a real structured tool call (finish_reason=tool_calls, 9 tool_calls deltas under streaming), SSE streaming (62 events, terminal [DONE]), and json_object structured output. A heavy internal reasoner exposed via reasoning/reasoning_content — at a small max_tokens budget the whole completion is spent on unfinished reasoning before any visible content, so give it a generous max_tokens. Rejects image/video input and rejects tools+response_format together, both HTTP 422 (see capabilities.structuredOutputWithTools). maxOutputTokens is the documented per-request output ceiling from https://friendli.ai/docs/examples/models/zai-glm-5-3/overview.md (retrieved 2026-09-09) — 131,072 tokens, distinct from the 1,048,576-token context window; the authenticated roster's max_completion_tokens field reports 1048576 (equal to context) but that is not treated as the output cap. Pricing per the same page: $1.40 / $4.40 per MTok input/output, $0.26 per MTok cached input."
+            },
+            "zai-org/GLM-5.3-Flash": {
+                "vision": false,
+                "status": "production",
+                "description": "Zhipu GLM-5.3 Flash — lighter/faster sibling of the default; present on the live roster (GET /serverless/v1/models, 200) but not itself capability-probed under the tight rate limit; fallback."
+            },
+            "zai-org/GLM-5.2": {
+                "vision": false,
+                "status": "production",
+                "description": "Zhipu GLM-5.2 — prior GLM generation; roster-listed only, not capability-probed; fallback."
+            },
+            "zai-org/GLM-5.1": {
+                "vision": false,
+                "status": "production",
+                "description": "Zhipu GLM-5.1 — prior GLM generation; roster-listed only, not capability-probed; fallback."
+            },
+            "google/gemma-4-31B-it": {
+                "vision": false,
+                "status": "production",
+                "description": "Google Gemma 4 31B instruct-tuned; roster-listed only, not capability-probed; fallback."
+            },
+            "deepseek-ai/DeepSeek-V3.2": {
+                "vision": false,
+                "status": "production",
+                "description": "DeepSeek V3.2; roster-listed only, not capability-probed; fallback."
+            },
+            "MiniMaxAI/MiniMax-M2.5": {
+                "vision": false,
+                "status": "production",
+                "description": "MiniMax M2.5; roster-listed only, not capability-probed; fallback."
+            }
+        },
+        "topModels": [
+            "zai-org/GLM-5.3",
+            "zai-org/GLM-5.3-Flash",
+            "zai-org/GLM-5.2",
+            "zai-org/GLM-5.1",
+            "google/gemma-4-31B-it",
+            "deepseek-ai/DeepSeek-V3.2",
+            "MiniMaxAI/MiniMax-M2.5"
+        ]
+    },
+    "capabilities": {
+        "text": true,
+        "streaming": true,
+        "tools": true,
+        "toolsWithStreaming": true,
+        "structuredOutput": true,
+        "structuredOutputWithTools": false,
+        "embeddings": false,
+        "thinking": false
+    },
+    "errorRules": [
+        {
+            "status": 401,
+            "pattern": "Unauthorized|valid credential",
+            "class": "authentication",
+            "message": "Invalid Friendli API key. Check {apiKeyEnvVar}. Get one at {setupUrl}"
+        },
+        {
+            "status": 404,
+            "pattern": "\\bModel\\s+['\"][^'\"\\r\\n]+['\"]\\s+not\\s+found\\b",
+            "class": "invalid-model",
+            "message": "Friendli model '{model}' not found. Pick a current model from the authenticated /serverless/v1/models roster or {setupUrl}"
+        }
+    ],
+    "setup": {
+        "url": "https://suite.friendli.ai/",
+        "apiKeyFormat": null,
+        "billingPolicy": "free-tier",
+        "instructions": [
+            "1. Visit: https://suite.friendli.ai/ and sign in",
+            "2. Create a Personal Access Token for the serverless endpoints",
+            "3. New accounts start with trial credit; confirm current billing terms in the console before heavy use",
+            "4. Set {apiKeyEnvVar} in your .env file"
+        ],
+        "description": "OpenAI-compatible endpoint at https://api.friendli.ai/serverless/v1, serving a small zai-org GLM-family roster plus a few third-party models. Rate limits are tight — pace requests at least 20 seconds apart."
+    },
+    "evidence": {
+        "rosterVerified": {
+            "date": "2026-09-06",
+            "method": "authenticated GET /serverless/v1/models",
+            "status": 200
+        },
+        "authProbe": {
+            "date": "2026-09-06",
+            "method": "POST /chat/completions with an invalid API key",
+            "status": 401
+        },
+        "liveMatrix": {
+            "date": "2026-09-06",
+            "result": "Probed against the default model, zai-org/GLM-5.3, via https://api.friendli.ai/serverless/v1. The first probe run used a 2s cadence, tripped Friendli's rate limit (12/16 cases 429) and is discarded entirely; this result is from a slower-paced re-run plus targeted single-call re-probes, each still hitting 429 occasionally even at ~25s spacing — Friendli's rate limits are tight, so any future live check needs generous pacing (20s+) and retry. Roster: GET /serverless/v1/models returns 200 with exactly 7 ids, all zai-org GLM family plus google/gemma-4-31B-it, deepseek-ai/DeepSeek-V3.2 and MiniMaxAI/MiniMax-M2.5 — models.fallbacks lists all 7. Wire mechanics on GLM-5.3: chat, system role, array content parts (message content IS accepted as a parts array, so no messageContentFormat quirk is declared), sampling params and max_completion_tokens all 200. Streaming: SSE, 200, 62 events, terminal [DONE] present — contentDeltas were 0 only because GLM-5.3 is a heavy reasoner that spent the small test budget entirely on reasoning/reasoning_content fields, not because streaming is broken. Tool calling: a real structured tool_call (get_time, tz argument parsed, finish_reason=tool_calls) on the first turn, a null-content assistant tool_calls turn accepted on replay, and 9 tool_calls deltas surfacing mid-SSE-stream — tools and toolsWithStreaming true; tool_choice is tolerated even with no tools declared. response_format json_object returns 200 cleanly — structuredOutput true. response_format json_schema also returns 200, but at the tested token budget the content is unfinished reasoning text rather than schema-conformant JSON — same reasoning-budget effect as above; NeuroLink's coerceJsonToSchema repair layer is the intended safety net. Sending tools and a JSON schema together in the same request is a genuine, hard rejection: HTTP 422 'The 'response_format' field cannot be set when tools are specified' — the same class of vendor exclusivity NeuroLink already handles generically for Groq via isToolsSchemaConflictError (pattern-matches the response_format+tool wording in the thrown error and retries the call without response_format), so no provider-specific quirk was added — structuredOutputWithTools is declared false. Vision: a real image part returns HTTP 422 'This model does not support image/video inputs.' — genuinely unsupported, not a rate limit; no model in this roster is marked vision:true and models.visionModel is left unset. Error shapes: bad key -> 401 {\"detail\":\"Unauthorized. Please provide a valid credential.\"}; bad model -> 404 {\"detail\":\"Model '<id>' not found.\"}. Only zai-org/GLM-5.3 (the declared default) was capability-probed end to end under the account's tight rate limit; the other 6 roster ids are roster-verified by id only, matching the account's usable request budget for this pass."
+        },
+        "addedInPR": "https://github.com/juspay/neurolink/pull/1657"
+    }
+}

package/dist/providers/catalog/index.generated.d.ts

@@ -1,3 +1,3 @@
 import type { ProviderCatalogJson } from "../../types/index.js";
 export declare const CATALOG_JSON_ENTRIES: ProviderCatalogJson[];
-export declare const CATALOG_PROVIDER_IDS: readonly ["api-route", "baseten", "cerebras", "cloudflare", "fireworks", "gmicloud", "groq", "inception-labs", "io-intelligence", "mancer", "mistral", "perplexity", "sambanova", "together-ai", "upstage", "xai"];
+export declare const CATALOG_PROVIDER_IDS: readonly ["api-route", "baseten", "cerebras", "cloudflare", "fireworks", "friendli", "gmicloud", "groq", "inception-labs", "io-intelligence", "mancer", "mistral", "perplexity", "sambanova", "together-ai", "upstage", "xai"];

package/dist/providers/catalog/index.generated.js

@@ -5,6 +5,7 @@ import basetenJson from "./baseten.json" with { type: "json" };
 import cerebrasJson from "./cerebras.json" with { type: "json" };
 import cloudflareJson from "./cloudflare.json" with { type: "json" };
 import fireworksJson from "./fireworks.json" with { type: "json" };
+import friendliJson from "./friendli.json" with { type: "json" };
 import gmicloudJson from "./gmicloud.json" with { type: "json" };
 import groqJson from "./groq.json" with { type: "json" };
 import inceptionLabsJson from "./inception-labs.json" with { type: "json" };
@@ -22,6 +23,7 @@ export const CATALOG_JSON_ENTRIES = [
     cerebrasJson,
     cloudflareJson,
     fireworksJson,
+    friendliJson,
     gmicloudJson,
     groqJson,
     inceptionLabsJson,
@@ -40,6 +42,7 @@ export const CATALOG_PROVIDER_IDS = [
     "cerebras",
     "cloudflare",
     "fireworks",
+    "friendli",
     "gmicloud",
     "groq",
     "inception-labs",

package/dist/providers/catalog/mistral.json

@@ -9,9 +9,8 @@
     },
     "models": {
         "default": "mistral-small-2506",
-        "fallbackModelName": "mistral-small-2506",
         "registryDefaultModel": "mistral-large-latest",
-        "fallbacks": ["mistral-small-2506", "mistral-large-latest"],
+        "fallbacks": ["mistral-small-2506", "mistral-medium-latest"],
         "defaultContextWindow": 128000,
         "defaultMaxOutputTokens": 4096,
         "catalog": {

package/dist/providers/catalog/schema.js

@@ -230,6 +230,40 @@ const catalogModelsSchema = z
             message: "models.fallbackModelName must be a key of models.catalog",
         });
     }
+    // A fallback that resolves to the default model cannot fall back.
+    //
+    // `loader.ts` derives it positionally as
+    // `fallbackModelName ?? fallbacks[1] ?? fallbacks[0]`, and nothing checked
+    // the result. A provider with one model has no choice and is left alone;
+    // a provider with alternatives that still lands on its own default has
+    // silently disabled its retry path — the primary fails, the SDK retries
+    // the same model, and it fails again for the same reason.
+    //
+    // This is not hypothetical. `mistral.json` ships 32 models and explicitly
+    // sets `fallbackModelName` to its own default, overriding a perfectly good
+    // `fallbacks[1]`. Two single-model catalogs also resolve this way and are
+    // correctly exempt.
+    const derivedFallback = models.fallbackModelName ?? models.fallbacks[1] ?? models.fallbacks[0];
+    // Count only entries that could actually serve as a fallback. The whole
+    // `catalog` map also carries retired ids, so its size both over-reports in
+    // the message below and could fire this rule on a catalog whose only other
+    // entries are unusable — the mirror of the single-model exemption.
+    const selectableModels = Object.values(models.catalog).filter((spec) => spec.status !== "retired").length;
+    if (derivedFallback !== undefined &&
+        derivedFallback === models.default &&
+        selectableModels > 1) {
+        ctx.addIssue({
+            code: "custom",
+            path: models.fallbackModelName !== undefined
+                ? ["fallbackModelName"]
+                : ["fallbacks"],
+            message: `the fallback model resolves to "${derivedFallback}", which is also models.default — ` +
+                `a fallback identical to the primary cannot fall back. This catalog declares ` +
+                `${selectableModels} selectable models, so name a different one (or drop ` +
+                `fallbackModelName to ` +
+                `let fallbacks[1] apply). Single-model catalogs are exempt.`,
+        });
+    }
     if (models.registryDefaultModel !== undefined &&
         !catalogKeys.has(models.registryDefaultModel)) {
         ctx.addIssue({

package/dist/providers/googleAiStudio/client.js

@@ -380,7 +380,13 @@ export class GoogleAIStudioProvider extends BaseProvider {
                             if ("inlineData" in part && part.inlineData?.data) {
                                 const foundImageData = part.inlineData.data;
                                 imageData = foundImageData;
-                                const mimeType = part.inlineData.mimeType || "image/png";
+                                // Keep the DECLARED value separate from the display default.
+                                // ImageGenService trusts a string `mimeType` on imageOutput and
+                                // skips sniffing, so forwarding a hardcoded "image/png" for a
+                                // vendor that declared nothing would defeat the byte detection
+                                // — WebP bytes would ship labelled PNG, with a .png extension.
+                                const declaredMimeType = part.inlineData.mimeType;
+                                const mimeType = declaredMimeType || "image/png";
                                 logger.info("Image generation successful", {
                                     model: imageModelName,
                                     mimeType,
@@ -390,7 +396,12 @@ export class GoogleAIStudioProvider extends BaseProvider {
                                 const result = {
                                     content: `Generated image using ${imageModelName} (${mimeType})`,
                                     imageOutput: {
+                                        // The vendor declares the format on the inline part; that
+                                        // beats sniffing it back out of the bytes. When it declares
+                                        // nothing, omit the field entirely so the service sniffs
+                                        // rather than trusting a default we invented.
                                         base64: foundImageData,
+                                        ...(declaredMimeType ? { mimeType: declaredMimeType } : {}),
                                     },
                                     provider: this.providerName,
                                     model: imageModelName,
@@ -434,7 +445,10 @@ export class GoogleAIStudioProvider extends BaseProvider {
                         if ("inlineData" in part && part.inlineData?.data) {
                             const foundImageData = part.inlineData.data;
                             imageData = foundImageData;
-                            const mimeType = part.inlineData.mimeType || "image/png";
+                            // See the streaming site above: only a mime type the vendor
+                            // actually declared may be forwarded, or the sniffer is bypassed.
+                            const declaredMimeType = part.inlineData.mimeType;
+                            const mimeType = declaredMimeType || "image/png";
                             logger.info("Image generation successful (non-streaming)", {
                                 model: imageModelName,
                                 mimeType,
@@ -444,7 +458,9 @@ export class GoogleAIStudioProvider extends BaseProvider {
                             const result = {
                                 content: `Generated image using ${imageModelName} (${mimeType})`,
                                 imageOutput: {
+                                    // As above: forward only a declared value, never a default.
                                     base64: foundImageData,
+                                    ...(declaredMimeType ? { mimeType: declaredMimeType } : {}),
                                 },
                                 provider: this.providerName,
                                 model: imageModelName,

package/dist/providers/googleVertex/client.js

@@ -5229,7 +5229,12 @@ export class GoogleVertexProvider extends BaseProvider {
                     if (imageOutput) {
                         yield {
                             type: "image",
-                            imageOutput: { base64: imageOutput.base64 || "" },
+                            imageOutput: {
+                                base64: imageOutput.base64 || "",
+                                ...(imageOutput.mimeType
+                                    ? { mimeType: imageOutput.mimeType }
+                                    : {}),
+                            },
                         };
                     }
                     yield { content: textContent };
@@ -6370,9 +6375,12 @@ export class GoogleVertexProvider extends BaseProvider {
             }
             // Extract image data (handle both formats)
             const imageData = imagePart.inlineData?.data || imagePart.inline_data?.data;
-            const mimeType = imagePart.inlineData?.mimeType ||
-                imagePart.inline_data?.mime_type ||
-                "image/png";
+            // The declared label and the display default are deliberately separate.
+            // `ImageGenService` trusts a string `mimeType` and skips sniffing, so
+            // stamping the `image/png` default onto `imageOutput` would relabel an
+            // unlabelled WebP as PNG — the exact defect this change fixes elsewhere.
+            const declaredMimeType = imagePart.inlineData?.mimeType || imagePart.inline_data?.mime_type;
+            const mimeType = declaredMimeType || "image/png";
             if (!imageData) {
                 throw new ProviderError("Image part found but no data available", this.providerName);
             }
@@ -6387,6 +6395,7 @@ export class GoogleVertexProvider extends BaseProvider {
                 content: `Generated image using ${imageModelName} (${mimeType})`,
                 imageOutput: {
                     base64: imageData,
+                    ...(declaredMimeType ? { mimeType: declaredMimeType } : {}),
                 },
                 provider: this.providerName,
                 model: imageModelName,

package/dist/providers/recraft.js

@@ -7,6 +7,7 @@ import { logger } from "../utils/logger.js";
 import { createRecraftConfig, getProviderModel, validateApiKey, } from "../utils/providerConfig.js";
 import { MAX_IMAGE_BYTES, readBoundedBuffer } from "../utils/sizeGuard.js";
 import { assertSafeUrl } from "../utils/ssrfGuard.js";
+import { detectImageMimeType } from "../utils/imageDetection.js";
 const RECRAFT_DEFAULT_BASE_URL = "https://external.api.recraft.ai/v1";
 const REQUEST_TIMEOUT_MS = 120_000;
 const getRecraftApiKey = () => validateApiKey(createRecraftConfig());
@@ -178,7 +179,13 @@ export class RecraftProvider extends BaseProvider {
             model: this.modelName,
             // output: 1000 = sentinel for per-image pricing (see pricing.ts)
             usage: { input: 0, output: 1000, total: 1000 },
-            imageOutput: { base64 },
+            // Recraft answers b64_json with WebP bytes for V3 raster models; label
+            // the real format from the leading bytes instead of leaving callers to
+            // assume PNG.
+            imageOutput: {
+                base64,
+                mimeType: detectImageMimeType(Buffer.from(base64.slice(0, 64), "base64")),
+            },
         };
     }
     async validateConfiguration() {

package/dist/proxy/accountRanking.d.ts

@@ -0,0 +1,22 @@
+import type { ProxyAccountRoutingReason, ProxyAccountSortMetrics, ProxyPassthroughAccount } from "../types/index.js";
+/**
+ * The pre-existing "spend the soonest-expiring weekly allowance first" order.
+ * Moved verbatim from claudeProxyRoutes.ts — availability → quota-evidence
+ * quality → session saturation → model-scoped saturation → soonest weekly
+ * reset → soonest session-reset bucket → model-scoped utilization → highest
+ * weekly utilization → configured primary → insertion order.
+ */
+export declare function compareExpiryFirst(a: ProxyPassthroughAccount, b: ProxyPassthroughAccount, metricsByKey: ReadonlyMap<string, ProxyAccountSortMetrics>, primaryKey: string | undefined): [number, ProxyAccountRoutingReason];
+/**
+ * Orders accounts by the configured ranking and reports the reason that
+ * placed rank 0. PR1 ships only `expiry-first`; PR2 (Task 11) adds
+ * `headroom-first` plus the affinity/prefer-primary precedence layer.
+ */
+export declare function rankAccounts(args: {
+    accounts: ProxyPassthroughAccount[];
+    metricsByKey: ReadonlyMap<string, ProxyAccountSortMetrics>;
+    primaryKey: string | undefined;
+}): {
+    orderedAccounts: ProxyPassthroughAccount[];
+    reason: ProxyAccountRoutingReason;
+};

package/dist/proxy/accountRanking.js

@@ -0,0 +1,86 @@
+/**
+ * The pre-existing "spend the soonest-expiring weekly allowance first" order.
+ * Moved verbatim from claudeProxyRoutes.ts — availability → quota-evidence
+ * quality → session saturation → model-scoped saturation → soonest weekly
+ * reset → soonest session-reset bucket → model-scoped utilization → highest
+ * weekly utilization → configured primary → insertion order.
+ */
+export function compareExpiryFirst(a, b, metricsByKey, primaryKey) {
+    const ma = metricsByKey.get(a.key);
+    const mb = metricsByKey.get(b.key);
+    if (!ma || !mb) {
+        return [0, "insertion_order"];
+    }
+    if (ma.usable !== mb.usable) {
+        return [ma.usable ? -1 : 1, "availability"];
+    }
+    if (!ma.usable && !mb.usable) {
+        const au = ma.coolingUntil || Number.POSITIVE_INFINITY;
+        const bu = mb.coolingUntil || Number.POSITIVE_INFINITY;
+        return [
+            au === bu ? 0 : au - bu,
+            au === bu ? "insertion_order" : "cooldown_recovery",
+        ];
+    }
+    if (ma.quotaEvidenceRank !== mb.quotaEvidenceRank) {
+        return [ma.quotaEvidenceRank - mb.quotaEvidenceRank, "quota_evidence"];
+    }
+    if (ma.saturated !== mb.saturated) {
+        return [ma.saturated ? 1 : -1, "session_headroom"];
+    }
+    // Per-model headroom, after overall session capacity: an account whose cap
+    // for THIS model is nearly spent is demoted even when its 5h/7d are healthy.
+    // No-op when neither account reports a scoped window for the model.
+    if (ma.scopedSaturated !== mb.scopedSaturated) {
+        return [ma.scopedSaturated ? 1 : -1, "scoped_headroom"];
+    }
+    if (ma.saturated && mb.saturated) {
+        if (ma.sessionResetBucket !== mb.sessionResetBucket) {
+            return [ma.sessionResetBucket - mb.sessionResetBucket, "session_reset"];
+        }
+        if (ma.weeklyReset !== mb.weeklyReset) {
+            return [ma.weeklyReset - mb.weeklyReset, "weekly_reset"];
+        }
+    }
+    else {
+        if (ma.weeklyReset !== mb.weeklyReset) {
+            return [ma.weeklyReset - mb.weeklyReset, "weekly_reset"];
+        }
+        if (ma.sessionResetBucket !== mb.sessionResetBucket) {
+            return [ma.sessionResetBucket - mb.sessionResetBucket, "session_reset"];
+        }
+    }
+    // Fill-first within the per-model allowance: finish off the account closest
+    // to spending its cap for this model before opening a fresher one. Ranked
+    // above overall weekly utilization because it is the tighter constraint.
+    // Both sides must actually report a scoped window. Comparing a real
+    // utilization against the "absent" sentinel would rank the account that has a
+    // window above one that does not — and since only the account serving a model
+    // gets that model's window, it would funnel all of a model's traffic onto
+    // whichever account happened to serve it first.
+    if (ma.scopedUsed !== null &&
+        mb.scopedUsed !== null &&
+        ma.scopedUsedForSort !== mb.scopedUsedForSort) {
+        return [mb.scopedUsedForSort - ma.scopedUsedForSort, "scoped_utilization"];
+    }
+    if (ma.weeklyUsedForSort !== mb.weeklyUsedForSort) {
+        return [mb.weeklyUsedForSort - ma.weeklyUsedForSort, "weekly_utilization"];
+    }
+    if (primaryKey && (a.key === primaryKey) !== (b.key === primaryKey)) {
+        return [a.key === primaryKey ? -1 : 1, "configured_primary"];
+    }
+    return [0, "insertion_order"];
+}
+/**
+ * Orders accounts by the configured ranking and reports the reason that
+ * placed rank 0. PR1 ships only `expiry-first`; PR2 (Task 11) adds
+ * `headroom-first` plus the affinity/prefer-primary precedence layer.
+ */
+export function rankAccounts(args) {
+    const { accounts, metricsByKey, primaryKey } = args;
+    const orderedAccounts = [...accounts].sort((a, b) => compareExpiryFirst(a, b, metricsByKey, primaryKey)[0]);
+    const reason = orderedAccounts.length < 2
+        ? "single_account"
+        : compareExpiryFirst(orderedAccounts[0], orderedAccounts[1], metricsByKey, primaryKey)[1];
+    return { orderedAccounts, reason };
+}