@juspay/neurolink 12.26.1 → 12.26.2

package/dist/server/routes/claudeProxyRoutes.js

@@ -531,6 +531,46 @@ function claimTransientRateLimitRetry(accountKey, coolingUntil, now = Date.now()
     budget.retriesClaimed += 1;
     return budget.retriesClaimed;
 }
+/**
+ * Claims one same-account retry after a transient rate limit and returns its
+ * delay, or undefined once this request's retries or the account's shared
+ * budget are spent. Both the HTTP 429 and the in-stream rate-limit paths use
+ * it, so a burst is paced the same way however it arrives.
+ */
+function claimTransientRateLimitRetryDelay(accountKey, coolingUntil, retryAfterMs, retriesThisRequest) {
+    const slot = claimTransientRateLimitRetry(accountKey, coolingUntil);
+    if (retryAfterMs === undefined ||
+        retriesThisRequest >= MAX_RATE_LIMIT_SAME_ACCOUNT_RETRIES ||
+        slot === undefined) {
+        return undefined;
+    }
+    const base = Math.min(retryAfterMs || 1_000, MAX_RATE_LIMIT_RETRY_DELAY_MS);
+    // Stagger the two shared slots, then cap after jitter so the final sleep
+    // never exceeds the configured maximum.
+    return {
+        slot,
+        delayMs: Math.min(MAX_RATE_LIMIT_RETRY_DELAY_MS, jitteredDelay(base * slot)),
+    };
+}
+/**
+ * A same-account retry that was served shows the burst is over. Without this
+ * the burst cooldown outlives it, the session's next request goes to another
+ * account and loses its prompt cache — the A→B→A bounce this retry exists to
+ * prevent. Only a transient cooldown is lifted: an exhaustion cooldown that a
+ * concurrent request recorded meanwhile stays.
+ */
+function liftTransientCooldownAfterServedRetry(account, state) {
+    transientRateLimitRetryBudgets.delete(account.key);
+    if (state.coolingReason !== "transient" || !state.coolingUntil) {
+        return;
+    }
+    const previousCoolingUntil = state.coolingUntil;
+    state.coolingUntil = undefined;
+    state.coolingReason = undefined;
+    clearAccountCooldown(account.key, previousCoolingUntil).catch(() => {
+        // Best-effort: routing already reads the cleared in-memory state.
+    });
+}
 function claimTransientCooldownAdmission(accountKey, coolingUntil, now = Date.now()) {
     if (coolingUntil <= now) {
         return 0;
@@ -4978,8 +5018,10 @@ async function handleAnthropicStreamingSuccessResponse(args) {
         const logicalStatus = isRateLimit ? 429 : 502;
         const quota = parseQuotaHeaders(responseHeaders, { model: body.model });
         const now = Date.now();
+        let sameAccountRetry;
         if (isRateLimit) {
-            const cooldownPlan = planCooldownFor429(quota, parseRetryAfterMs(responseHeaders["retry-after"] ?? null), now, getUnifiedRateLimitStatus(responseHeaders), overagePolicy, typeof body.model === "string" ? body.model : undefined);
+            const retryAfterMs = parseRetryAfterMs(responseHeaders["retry-after"] ?? null);
+            const cooldownPlan = planCooldownFor429(quota, retryAfterMs, now, getUnifiedRateLimitStatus(responseHeaders), overagePolicy, typeof body.model === "string" ? body.model : undefined);
             accountState.quota = quota
                 ? mergeQuotaSnapshot(accountState.quota, quota)
                 : accountState.quota;
@@ -4999,6 +5041,12 @@ async function handleAnthropicStreamingSuccessResponse(args) {
                 rateLimitKind,
                 cooldownReason: cooldownPlan.reason,
             });
+            if (!cooldownPlan.rotateImmediately) {
+                sameAccountRetry = {
+                    coolingUntil: cooldownPlan.coolingUntil,
+                    retryAfterMs,
+                };
+            }
         }
         else {
             recordAttemptError(account.label, account.type, logicalStatus);
@@ -5006,7 +5054,7 @@ async function handleAnthropicStreamingSuccessResponse(args) {
                 retryable: true,
             });
         }
-        logger.always(`[proxy] immediate SSE ${preflight.errorType} account=${account.label}: ${preflight.message}; rotating before client commit`);
+        logger.always(`[proxy] immediate SSE ${preflight.errorType} account=${account.label}: ${preflight.message}; ${sameAccountRetry ? "transient, same account may retry" : "rotating"} before client commit`);
         tracer?.recordRetry(account.label, isRateLimit
             ? "stream_rate_limit_before_commit"
             : "stream_error_before_commit");
@@ -5035,6 +5083,7 @@ async function handleAnthropicStreamingSuccessResponse(args) {
                 ...(preflight.errorType === "overloaded_error"
                     ? { retryDelayMs: getOverloadRotationDelayMs(attemptNumber) }
                     : {}),
+                ...(sameAccountRetry ? { sameAccountRetry } : {}),
             },
         };
     }
@@ -7371,21 +7420,13 @@ async function handleAnthropicRoutedClaudeRequest(args) {
                             // Transient retries are budgeted across all concurrent requests for
                             // this account/window. Exhaustion plans rotate immediately and never
                             // claim this budget.
-                            const sharedRetrySlot = fetchResult.retrySameAccount
-                                ? claimTransientRateLimitRetry(account.key, plan.coolingUntil)
+                            const retry = fetchResult.retrySameAccount
+                                ? claimTransientRateLimitRetryDelay(account.key, plan.coolingUntil, fetchResult.retryAfterMs, rateLimitSameAccountRetries)
                                 : undefined;
-                            if (fetchResult.retrySameAccount &&
-                                fetchResult.retryAfterMs !== undefined &&
-                                rateLimitSameAccountRetries <
-                                    MAX_RATE_LIMIT_SAME_ACCOUNT_RETRIES &&
-                                sharedRetrySlot !== undefined) {
+                            if (retry) {
                                 rateLimitSameAccountRetries += 1;
-                                const base = Math.min(fetchResult.retryAfterMs || 1_000, MAX_RATE_LIMIT_RETRY_DELAY_MS);
-                                // Stagger the two shared slots, then cap after jitter so the final
-                                // sleep never exceeds the configured maximum.
-                                const delayMs = Math.min(MAX_RATE_LIMIT_RETRY_DELAY_MS, jitteredDelay(base * sharedRetrySlot));
-                                logger.always(`[proxy] retrying same account=${account.label} after transient 429 (shared slot ${sharedRetrySlot}/${MAX_RATE_LIMIT_SAME_ACCOUNT_RETRIES}) in ${delayMs}ms`);
-                                await sleep(delayMs);
+                                logger.always(`[proxy] retrying same account=${account.label} after transient 429 (shared slot ${retry.slot}/${MAX_RATE_LIMIT_SAME_ACCOUNT_RETRIES}) in ${retry.delayMs}ms`);
+                                await sleep(retry.delayMs);
                                 continue;
                             }
                             // Exhaustion, or the shared transient retry budget being used up:
@@ -7560,6 +7601,16 @@ async function handleAnthropicRoutedClaudeRequest(args) {
                             loopState.sawRateLimit ||= successResult.failure.rateLimit;
                             loopState.sawTransientFailure ||=
                                 !successResult.failure.rateLimit;
+                            const { sameAccountRetry } = successResult.failure;
+                            const retry = sameAccountRetry
+                                ? claimTransientRateLimitRetryDelay(account.key, sameAccountRetry.coolingUntil, sameAccountRetry.retryAfterMs, rateLimitSameAccountRetries)
+                                : undefined;
+                            if (retry) {
+                                rateLimitSameAccountRetries += 1;
+                                logger.always(`[proxy] retrying same account=${account.label} after transient in-stream rate limit (shared slot ${retry.slot}/${MAX_RATE_LIMIT_SAME_ACCOUNT_RETRIES}) in ${retry.delayMs}ms`);
+                                await sleep(retry.delayMs);
+                                continue;
+                            }
                             if (hasNextAccount && successResult.failure.retryDelayMs) {
                                 logger.always(`[proxy] pacing cross-account SSE overload rotation for ${successResult.failure.retryDelayMs}ms`);
                                 await sleep(successResult.failure.retryDelayMs);
@@ -7569,6 +7620,9 @@ async function handleAnthropicRoutedClaudeRequest(args) {
                     }
                     admissionTransferredToStream =
                         successResult.holdsAccountAdmission === true;
+                    if (successResult.served && rateLimitSameAccountRetries > 0) {
+                        liftTransientCooldownAfterServedRetry(account, accountState);
+                    }
                     if (bindServedSession && successResult.served) {
                         bindServedSession(account.key);
                     }

package/dist/types/proxy.d.ts

@@ -1128,6 +1128,15 @@ export type AnthropicSuccessResult = {
         message: string;
         rateLimit: boolean;
         retryDelayMs?: number;
+        /**
+         * Set only for a transient (burst) rate limit: the attempt loop may
+         * retry the same account within the shared budget before rotating,
+         * exactly as it does for an HTTP 429.
+         */
+        sameAccountRetry?: {
+            coolingUntil: number;
+            retryAfterMs: number;
+        };
     };
 } | {
     response: Response | unknown;

package/docs-site/static/search-index.json

@@ -2884,7 +2884,7 @@
 {"objectID":"d3e03ca160a62086a328b7f6782dd27a4cc252801bd4ebbf6c6b15961a0dd314","title":"Account 3: API key for fallback","url":"/docs/features/claude-proxy#account-3-api-key-for-fallback","content":"neurolink auth login anthropic --method api-key --add --label api\n`","hierarchy":{"lvl0":"Features","lvl1":"Claude Proxy","lvl2":"Account 3: API key for fallback","lvl3":""}},
 {"objectID":"2167cdac36707378e3d95b4ae7f07988af5ef02cf9d09b8809b897263316efcc","title":"How accounts are selected","url":"/docs/features/claude-proxy#how-accounts-are-selected","content":"The proxy discovers accounts in this order:\nCompound keys from TokenStore (e.g., , )\nLegacy credentials file (if no compound keys exist)\nenvironment variable (if no other accounts exist)\n\nWhen  is configured, this discovery happens only within the allowed set. A disabled or unavailable TokenStore account does not cause the proxy to activate a legacy file or environment key while TokenStore entries still exist.\n\nWithin the account pool, the proxy uses fill-first routing: it always tries the first non-cooling account and only switches on failure. This avoids unnecessary identity switches that could confuse Claude Code's session state.","hierarchy":{"lvl0":"Features","lvl1":"Claude Proxy","lvl2":"How accounts are selected","lvl3":""}},
 {"objectID":"8c3a17a43510fb3eeca918e6c91dd4f38f37f0392e1440e021488aefa1e56b80","title":"Model-scoped weekly limits","url":"/docs/features/claude-proxy#model-scoped-weekly-limits","content":"Some plans cap a specific model separately from the overall weekly window — a\nFable-only weekly allowance, for instance. Anthropic reports that cap as its own\nheader family (), sent only on responses\nfor the model it applies to, so the proxy learns about it from live traffic\nrather than needing a refresh.\n\nRouting treats a spent model-scoped cap as per-model, never per-account:\nAn account whose cap for the requested model is spent is skipped for that\n  model only. It stays fully available for every other model, and no cooldown\n  is set — cooling is account-wide and would wrongly withhold a healthy account.\nAmong accounts that do have headroom, the one closest to spending its\n  allowance is preferred, so the pool finishes an allowance rather than spreading\n  across all of them. This rung only applies when both candidates report a window\n  for the model.\nIf every account has spent the cap, the request is not attempted. The\n  client gets a  naming the model, the real reset time, and that other\n  models remain available — switch model, or add an account with headroom.\nA scoped window older than the quota freshness budget is ignored, so stale or\n  mis-parsed data can never take the pool down. Routing falls back to attempting\n  the request.\n\n shows any scoped window under its account, and\n returns the full  array.","hierarchy":{"lvl0":"Features","lvl1":"Claude Proxy","lvl2":"Model-scoped weekly limits","lvl3":""}},
-{"objectID":"971d8917e081ed8fe1f30633edee82462617b534a0645dd9f370c37c0769494f","title":"Cooldown and backoff","url":"/docs/features/claude-proxy#cooldown-and-backoff","content":"When an account encounters an error, it enters a cooldown period based on the error type:\n\n| Failure                                                | Cooldown                                           | Behavior                                         |\n| ------------------------------------------------------ | -------------------------------------------------- | ------------------------------------------------ |\n| Authoritative unified, 5-hour, or 7-day rejection      | Upstream reset or , capped per reason | Persist cooldown and rotate immediately          |\n| Transient burst 429                                    | Upstream delay, capped at 15 minutes               | At most 2 same-account retries, then rotate      |\n| Refresh credential rejection (///) | Disabled until explicit login                      | Rotate without retrying an invalid refresh token |\n| Refresh network, , or                        | 30 seconds to 5 minutes                            | Persist auth cooldown and rotate                 |\n| Upstream  or network error                        | Bounded same-account retries                       | Rotate after retry budget                        |\n\nCooldown updates are extend-only: a late concurrent response cannot shorten a longer known reset window.\n\nEach cooldown is also capped by what its reason can mean — a  cooldown\ndescribes a 5-hour window, so it can never run for days no matter what reset the\nupstream reports. The cap is applied when the cooldown is written and again when\nit is read back from disk, so an entry written by an older build heals itself on\nload and logs that it did:\n\nUse  to see what is currently parked, and\n to release one.","hierarchy":{"lvl0":"Features","lvl1":"Claude Proxy","lvl2":"Cooldown and backoff","lvl3":""}},
+{"objectID":"971d8917e081ed8fe1f30633edee82462617b534a0645dd9f370c37c0769494f","title":"Cooldown and backoff","url":"/docs/features/claude-proxy#cooldown-and-backoff","content":"When an account encounters an error, it enters a cooldown period based on the error type:\n\n| Failure                                                         | Cooldown                                           | Behavior                                         |\n| --------------------------------------------------------------- | -------------------------------------------------- | ------------------------------------------------ |\n| Authoritative unified, 5-hour, or 7-day rejection               | Upstream reset or , capped per reason | Persist cooldown and rotate immediately          |\n| Transient burst 429, as a status or as the stream's first event | Upstream delay, capped at 15 minutes               | At most 2 same-account retries, then rotate      |\n| Refresh credential rejection (///)          | Disabled until explicit login                      | Rotate without retrying an invalid refresh token |\n| Refresh network, , or                                 | 30 seconds to 5 minutes                            | Persist auth cooldown and rotate                 |\n| Upstream  or network error                                 | Bounded same-account retries                       | Rotate after retry budget                        |\n\nCooldown updates are extend-only: a late concurrent response cannot shorten a longer known reset window.\n\nThe one exception is a transient burst. When a same-account retry is served, the\nburst is over, so its cooldown is lifted and the session's next request stays on\nthat account instead of moving away and losing its prompt cache. An exhaustion\ncooldown recorded in the meantime is left in place.\n\nEach cooldown is also capped by what its reason can mean — a  cooldown\ndescribes a 5-hour window, so it can never run for days no matter what reset the\nupstream reports. The cap is applied when the cooldown is written and again when\nit is read back from disk, so an entry written by an older build heals itself on\nload and logs that it did:\n\nUse  to se","hierarchy":{"lvl0":"Features","lvl1":"Claude Proxy","lvl2":"Cooldown and backoff","lvl3":""}},
 {"objectID":"c95cca165ca71f8c198ba1ad405ec47ab1666e20d2d9ad4120139306226f26f0","title":"Error Handling","url":"/docs/features/claude-proxy#error-handling","content":"The proxy classifies upstream errors and applies different strategies:","hierarchy":{"lvl0":"Features","lvl1":"Claude Proxy","lvl2":"Error Handling","lvl3":""}},
 {"objectID":"7a743b6bb13366c925cd238d4853826a08f0b161659bcb0575d5b2e83709a2e5","title":"429 Rate Limit","url":"/docs/features/claude-proxy#429-rate-limit","content":"Treat top-level  as authoritative, even if sub-windows still say .\nPrefer the rejected 5-hour or 7-day reset and otherwise use .\nPersist the cooldown and rotate immediately for authoritative exhaustion.\nReturn the earliest recovery timestamp without another upstream request when all accounts are cooling.","hierarchy":{"lvl0":"Features","lvl1":"Claude Proxy","lvl2":"429 Rate Limit","lvl3":""}},
 {"objectID":"1522c22c8467bae6a5a51e9e4c4dca5792a7b45c457b0628ef5536d068d642b3","title":"401/402/403 Authentication Errors","url":"/docs/features/claude-proxy#401402403-authentication-errors","content":"OAuth accounts with refresh token: Serialize refresh, persist the new rotating token, and retry. A rejected refresh credential disables the account until re-authentication; transient refresh infrastructure errors cool and rotate.\nOAuth accounts without refresh token: Disable until re-authentication and rotate.\nAPI key accounts: Rotate after authentication failure.","hierarchy":{"lvl0":"Features","lvl1":"Claude Proxy","lvl2":"401/402/403 Authentication Errors","lvl3":""}},

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@juspay/neurolink",
-  "version": "12.26.1",
+  "version": "12.26.2",
   "packageManager": "pnpm@10.15.1",
   "description": "The pipe layer of an AI nervous system: one interface connecting provider neurons to your application, across three inference types — generate, stream and decide. `decide` returns typed, calibrated judgements from a non-generative model (~400ms, ~$0.00002/call) for routing, tool selection and context budgeting. MCP-native (4 transports), voice TTS/STT/realtime, RAG, agents, memory, compaction, 9 observability exporters. OpenAI · Anthropic · Gemini · Bedrock · Azure · Ollama · TypeSafe Jev and more.",
   "author": {