@juspay/neurolink 12.35.4 → 12.36.0

package/dist/proxy/otelLogSink.js

@@ -1,15 +1,52 @@
 /* eslint-disable no-console -- This proxy-only sink replaces console methods with OTLP emission. */
 import { inspect } from "node:util";
 import { randomUUID } from "node:crypto";
+import { createRequire } from "node:module";
 import { getProxyRequestTraceContext, proxyLogContext, } from "./proxyTraceContext.js";
 import { setImmediate as yieldToRequests } from "node:timers/promises";
-import { SeverityNumber } from "@opentelemetry/api-logs";
-import { ExportResultCode } from "@opentelemetry/core";
 import { createProxyOtlpLogTransport, getProxyOtlpRetryAfter, } from "./otlpLogTransport.js";
-import { resourceFromAttributes } from "@opentelemetry/resources";
-import { BatchLogRecordProcessor, LoggerProvider, } from "@opentelemetry/sdk-logs";
 import { sanitizeForLog } from "../utils/logSanitize.js";
 import { splitUtf8StringByBytes } from "./bodyCaptureProcessing.js";
+/**
+ * @opentelemetry/sdk-logs, resources, api-logs and core are loaded
+ * synchronously via require() on first actual use, not via a top-level
+ * import — so merely requiring this module (reachable eagerly from
+ * dist/server/index.js via codexProxyRoutes.ts/claudeProxyRoutes.ts) no
+ * longer pulls in four heavy OTel packages for the overwhelming majority
+ * of callers who never set NEUROLINK_PROXY_LOG_SINK=otel. All four ship
+ * plain CommonJS builds, so require() works on any Node >=22.0.0 — no
+ * experimental flag, unlike require(esm) of a local ES module (which only
+ * works unflagged from Node 22.12). otlpLogTransport.js stays a normal
+ * static import for exactly that reason; it lazily requires its own two
+ * npm dependencies (@opentelemetry/core, otlp-transformer) internally.
+ * Everything here stays fully synchronous — construction is still one
+ * synchronous call, exactly as before — only the *import* is deferred, not
+ * the initialization semantics. Do not convert this to a dynamic
+ * `import()`: that would make initializeProxyOtelLogs() asynchronous and
+ * break every caller (both production code and the tests below) that
+ * relies on the queues/provider existing synchronously the moment it
+ * returns.
+ */
+const require = createRequire(import.meta.url);
+let SeverityNumber;
+let ExportResultCode;
+let resourceFromAttributes;
+let BatchLogRecordProcessor;
+let LoggerProvider;
+let otelDepsLoaded = false;
+function loadOtelDeps() {
+    if (otelDepsLoaded) {
+        return;
+    }
+    ({ SeverityNumber } = require("@opentelemetry/api-logs"));
+    ({ ExportResultCode } = require("@opentelemetry/core"));
+    ({ resourceFromAttributes } = require("@opentelemetry/resources"));
+    ({
+        BatchLogRecordProcessor,
+        LoggerProvider,
+    } = require("@opentelemetry/sdk-logs"));
+    otelDepsLoaded = true;
+}
 let provider;
 let restoreConsole;
 const queues = [];
@@ -569,6 +606,9 @@ export function initializeProxyOtelLogs(role = "worker") {
             throw new Error("Proxy OTLP logs require HTTPS for non-loopback collectors");
         }
     }
+    // Validation above must run — and be able to throw — before this: a
+    // misconfigured endpoint must fail without ever loading the OTel SDK.
+    loadOtelDeps();
     const metadata = createTrackedProcessor(endpoint, 2048, "metadata", 8 * 1024 * 1024);
     const bodies = createTrackedProcessor(bodyEndpoint, 256, "bodies", 40 * 1024 * 1024);
     const diagnostics = createTrackedProcessor(endpoint, 512, "diagnostics", 2 * 1024 * 1024);

package/dist/proxy/otlpLogTransport.js

@@ -10,8 +10,30 @@ import { Agent as HttpsAgent, request as httpsRequest } from "node:https";
 import { setTimeout as delay } from "node:timers/promises";
 import { promisify } from "node:util";
 import { gzip } from "node:zlib";
-import { ExportResultCode, parseKeyPairsIntoRecord } from "@opentelemetry/core";
-import { JsonLogsSerializer } from "@opentelemetry/otlp-transformer";
+import { createRequire } from "node:module";
+/**
+ * @opentelemetry/core and @opentelemetry/otlp-transformer are loaded via
+ * require() on first actual use (this file itself stays a normal static
+ * import, since it is genuinely CommonJS-safe to require() these two —
+ * unlike a local ESM file, which would need Node's newer require(esm)
+ * support and break on Node <22.12). Both packages ship plain CJS builds.
+ */
+const require = createRequire(import.meta.url);
+let ExportResultCode;
+let parseKeyPairsIntoRecord;
+let JsonLogsSerializer;
+let transportDepsLoaded = false;
+function loadTransportDeps() {
+    if (transportDepsLoaded) {
+        return;
+    }
+    ({
+        ExportResultCode,
+        parseKeyPairsIntoRecord,
+    } = require("@opentelemetry/core"));
+    ({ JsonLogsSerializer } = require("@opentelemetry/otlp-transformer"));
+    transportDepsLoaded = true;
+}
 const gzipAsync = promisify(gzip);
 const MAX_RESPONSE_BYTES = 64 * 1024;
 const MAX_EXPORT_ATTEMPTS = 5;
@@ -151,6 +173,7 @@ function validateAcknowledgement(bytes) {
 }
 /** Both proxy queues use this transport; success is not backend persistence. */
 export function createProxyOtlpLogTransport(endpoint, timeoutMillis) {
+    loadTransportDeps();
     let url;
     try {
         url = new URL(endpoint);

package/dist/proxy/requestLogger.js

@@ -20,7 +20,24 @@ import { captureProxyBody, getBodyCaptureWorkerSnapshot, PROXY_BODY_CAPTURE_DEAD
 import { prepareProxyBodyForLogging as prepareRedactedBody, redactProxyHeadersForLogging as redactHeaders, splitUtf8StringByBytes, } from "./bodyCaptureProcessing.js";
 import { isBorrowedRequest } from "./shareContext.js";
 import { OtelBridge } from "../observability/otelBridge.js";
-import { SeverityNumber } from "@opentelemetry/api-logs";
+import { createRequire } from "node:module";
+/**
+ * Loaded via require() on first actual use rather than a top-level import,
+ * so requiring this module (reachable eagerly from dist/server/index.js)
+ * doesn't pull in @opentelemetry/api-logs for callers who never emit an
+ * OTLP log record. Both use sites below only run once resolveLoggerProvider()
+ * has already resolved a real provider, so OTel logging is already active.
+ */
+const otelRequire = createRequire(import.meta.url);
+let SeverityNumber;
+let severityNumberLoaded = false;
+function loadSeverityNumber() {
+    if (severityNumberLoaded) {
+        return;
+    }
+    ({ SeverityNumber } = otelRequire("@opentelemetry/api-logs"));
+    severityNumberLoaded = true;
+}
 import { configureProxyLifecycleLogger } from "./proxyLifecycle.js";
 import { notifyProxyFinalLog, notifyProxyAttemptLog, getProxyRequestAccounting, } from "./proxyActivity.js";
 import { withTimeout } from "../utils/async/withTimeout.js";
@@ -388,6 +405,7 @@ function emitOtlpLogRecord(entry) {
         if (!provider) {
             return;
         }
+        loadSeverityNumber();
         const otelLogger = provider.getLogger("neurolink-proxy", "1.0.0");
         // A streaming response can fail after sending HTTP 200. Indexed fields
         // and severity must agree with the final semantic outcome in the body.
@@ -568,6 +586,7 @@ function emitOtlpBodyLogRecord(entry, stored) {
         if (!provider || stored.redactedBody === undefined) {
             return undefined;
         }
+        loadSeverityNumber();
         const otelLogger = provider.getLogger("neurolink-proxy-bodies", "1.0.0");
         const captureId = entry.captureId ?? randomUUID();
         const emit = (chunk, chunkIndex, totalChunks) => {

package/dist/routing/modelCatalog.d.ts

@@ -9,7 +9,7 @@
  * routing read none of it beyond cost and quality. `maxContextTokens` in
  * particular was never read anywhere.
  *
- * The registry covers 7 of the 40 registered providers, so the catalogue is
+ * The registry covers 7 of the registered providers, so the catalogue is
  * an addition to a declared pool, never a replacement: a host routing over
  * LiteLLM, OpenRouter or a self-hosted model still declares those by hand,
  * and `enrichCandidate` ranks declared and catalogue members on one scale.

package/dist/routing/modelCatalog.js

@@ -9,7 +9,7 @@
  * routing read none of it beyond cost and quality. `maxContextTokens` in
  * particular was never read anywhere.
  *
- * The registry covers 7 of the 40 registered providers, so the catalogue is
+ * The registry covers 7 of the registered providers, so the catalogue is
  * an addition to a declared pool, never a replacement: a host routing over
  * LiteLLM, OpenRouter or a self-hosted model still declares those by hand,
  * and `enrichCandidate` ranks declared and catalogue members on one scale.

package/dist/types/codex.d.ts

@@ -11,7 +11,7 @@
  * stored through the same AccountQuota shape as Anthropic — its primary window
  * maps onto the session fields and its secondary window onto the weekly fields.
  */
-import type { AccountCoolingReason, AccountQuota, InternalResult } from "./proxy.js";
+import type { AccountCoolingReason, AccountQuota, ClaudeContentBlock, InternalResult } from "./proxy.js";
 /** Token block inside `~/.codex/auth.json`. */
 export type CodexAuthFileTokens = {
     id_token?: string;
@@ -194,3 +194,139 @@ export type CodexFallbackStream = {
     frames: AsyncGenerator<string, CodexFallbackResult>;
     cancel: (reason?: unknown) => Promise<void>;
 };
+/** Role a native Codex `input` message item can carry. */
+export type CodexNativeRole = "developer" | "user" | "assistant";
+/** A plain message item in a native Codex request's `input` array. */
+export type CodexNativeMessageInputItem = {
+    type: "message";
+    id?: string;
+    role: CodexNativeRole;
+    content: CodexContentPart[];
+};
+/** A tool declaration backed by a JSON Schema, dispatched as a function call. */
+export type CodexNativeFunctionToolDeclaration = {
+    type: "function";
+    name: string;
+    description?: string;
+    strict: boolean;
+    parameters: Record<string, unknown>;
+};
+/** Grammar constraining a custom tool's argument text. */
+export type CodexNativeCustomToolFormat = {
+    type: "grammar";
+    syntax: "lark" | "regex";
+    definition: string;
+};
+/** A tool declaration whose arguments are grammar-constrained free text. */
+export type CodexNativeCustomToolDeclaration = {
+    type: "custom";
+    name: string;
+    description?: string;
+    format: CodexNativeCustomToolFormat;
+};
+/** A single tool declaration, discriminated by its own `type` field. */
+export type CodexNativeToolDeclaration = CodexNativeFunctionToolDeclaration | CodexNativeCustomToolDeclaration;
+/** A named group of tool declarations inside one `additional_tools` item. */
+export type CodexNativeToolNamespace = {
+    type: "namespace";
+    name: string;
+    description: string;
+    tools: CodexNativeToolDeclaration[];
+};
+/** The `input` item carrying every tool declaration for a native Codex request. */
+export type CodexNativeAdditionalToolsInputItem = {
+    type: "additional_tools";
+    id?: string;
+    role: "developer";
+    tools: CodexNativeToolNamespace[];
+};
+/** A model-emitted tool call replayed in a native Codex request's history. */
+export type CodexNativeFunctionCallInputItem = {
+    type: "function_call";
+    call_id: string;
+    name: string;
+    arguments: string;
+};
+/** A client-supplied tool result replayed in a native Codex request's history. */
+export type CodexNativeFunctionCallOutputInputItem = {
+    type: "function_call_output";
+    call_id: string;
+    output: string;
+};
+/** A call to a grammar-constrained (`type:"custom"`) tool, replayed in history. */
+export type CodexNativeCustomToolCallInputItem = {
+    type: "custom_tool_call";
+    id?: string;
+    call_id: string;
+    name: string;
+    input: string;
+};
+/** A client-supplied result for a `custom_tool_call`, replayed in history. */
+export type CodexNativeCustomToolCallOutputInputItem = {
+    type: "custom_tool_call_output";
+    call_id: string;
+    output: string;
+};
+/**
+ * A reasoning item the client echoes back with `store:false`. Its content is
+ * opaque (`encrypted_content` is readable only by the OpenAI backend), so its
+ * shape is deliberately loose beyond the discriminator.
+ */
+export type CodexNativeReasoningInputItem = {
+    type: "reasoning";
+    id?: string;
+    encrypted_content?: string | null;
+    summary?: unknown[];
+};
+/** A single item in a native Codex request's `input` array. */
+export type CodexNativeInputItem = CodexNativeMessageInputItem | CodexNativeAdditionalToolsInputItem | CodexNativeFunctionCallInputItem | CodexNativeFunctionCallOutputInputItem | CodexNativeCustomToolCallInputItem | CodexNativeCustomToolCallOutputInputItem | CodexNativeReasoningInputItem;
+/** How a native Codex request constrains which tool the model may call. */
+export type CodexNativeToolChoice = "auto" | "required" | "none" | {
+    type: "function";
+    name: string;
+};
+/**
+ * A native Codex Responses request, as sent by the real Codex CLI.
+ *
+ * No top-level `session_id`/`thread_id` — real traffic carries neither at
+ * top level, only inside `client_metadata`, which the existing
+ * `Record<string, unknown>` field already covers.
+ */
+export type CodexNativeRequest = {
+    model: string;
+    input: CodexNativeInputItem[];
+    stream: boolean;
+    store: boolean;
+    tool_choice?: CodexNativeToolChoice;
+    parallel_tool_calls?: boolean;
+    reasoning?: {
+        effort: CodexReasoningEffort;
+        context?: string;
+    };
+    include?: string[];
+    text?: {
+        verbosity?: string;
+    };
+    prompt_cache_key?: string;
+    client_metadata?: Record<string, unknown>;
+};
+/**
+ * A `parseCodexNativeRequest`/`translateCodexRequestToClaude` failure. Never thrown.
+ * `UNTRANSLATABLE_REQUEST` is a request Codex itself accepts but Anthropic would
+ * reject, as opposed to one that is invalid on the Codex wire.
+ */
+export type CodexTranslationError = {
+    code: "MALFORMED_REQUEST";
+    message: string;
+} | {
+    code: "SUSPECTED_PARTIAL_HISTORY";
+    message: string;
+} | {
+    code: "UNTRANSLATABLE_REQUEST";
+    message: string;
+};
+/** One coalesced run of same-role content while flattening a native Codex `input` array. */
+export type CodexOutboundMessageGroup = {
+    role: "user" | "assistant";
+    blocks: ClaudeContentBlock[];
+};

package/dist/utils/modelChoices.d.ts

@@ -7,10 +7,11 @@ import type { CatalogProviderName, ModelChoice } from "../types/index.js";
 /**
  * Default models per provider (first choice/recommended).
  *
- * Covers every provider EXCEPT the 11 JSON-catalog providers — those default
- * models come from `models.default` in the catalog JSON, read directly by
- * `getDefaultModel()` below. (Two of the 11 — cerebras, sambanova — never had
- * a hand entry here at all; `getDefaultModel()` now resolves them too.)
+ * Covers every provider EXCEPT the JSON-catalog providers (see
+ * `CatalogProviderName`) — those default models come from `models.default`
+ * in the catalog JSON, read directly by `getDefaultModel()` below. (cerebras,
+ * sambanova — never had a hand entry here at all; `getDefaultModel()` now
+ * resolves them too.)
  *
  * AUTO is also excluded — it never had an entry here either (matches
  * pre-existing behavior: `getDefaultModel(AUTO)` returns `undefined`).

package/dist/utils/modelChoices.js

@@ -36,9 +36,8 @@ function catalogTopModels(entry) {
  * Top models per provider with descriptions for CLI prompts
  * These are curated lists of the most commonly used/recommended models
  *
- * Covers every provider EXCEPT the 11 JSON-catalog providers (cerebras,
- * cloudflare, deepseek, fireworks, groq, huggingface, mistral, perplexity,
- * sambanova, together-ai, xai) — their entries are derived from
+ * Covers every provider EXCEPT the JSON-catalog providers (see
+ * `CatalogProviderName`) — their entries are derived from
  * `models.catalog[*].description` by `catalogTopModels()` and merged in at
  * the accessor-function level below, never hand-duplicated here.
  */
@@ -393,10 +392,11 @@ const TOP_MODELS_CONFIG = {
 /**
  * Default models per provider (first choice/recommended).
  *
- * Covers every provider EXCEPT the 11 JSON-catalog providers — those default
- * models come from `models.default` in the catalog JSON, read directly by
- * `getDefaultModel()` below. (Two of the 11 — cerebras, sambanova — never had
- * a hand entry here at all; `getDefaultModel()` now resolves them too.)
+ * Covers every provider EXCEPT the JSON-catalog providers (see
+ * `CatalogProviderName`) — those default models come from `models.default`
+ * in the catalog JSON, read directly by `getDefaultModel()` below. (cerebras,
+ * sambanova — never had a hand entry here at all; `getDefaultModel()` now
+ * resolves them too.)
  *
  * AUTO is also excluded — it never had an entry here either (matches
  * pre-existing behavior: `getDefaultModel(AUTO)` returns `undefined`).
@@ -431,9 +431,10 @@ export const DEFAULT_MODELS = {
 /**
  * Model enum mappings for getAllModels.
  *
- * Covers every provider EXCEPT the 11 JSON-catalog providers — those model
- * lists come from `Object.keys(models.catalog)` in the catalog JSON, read
- * directly by `getAllModels()` below.
+ * Covers every provider EXCEPT the JSON-catalog providers (see
+ * `CatalogProviderName`) — those model lists come from
+ * `Object.keys(models.catalog)` in the catalog JSON, read directly by
+ * `getAllModels()` below.
  */
 const MODEL_ENUMS = {
     [AIProviderName.OPENAI]: OpenAIModels,

package/dist/utils/providerHealth.d.ts

@@ -92,7 +92,7 @@ export declare class ProviderHealthChecker {
      * zero-config local proxy. Their real requirement is validated by
      * checkProviderSpecificConfig()'s dedicated per-provider checks instead.
      * Naively deriving [apiKey, ...extraRequired] from the descriptor for
-     * these three (as for the other 27 providers) would make
+     * these three (as for the other providers) would make
      * checkEnvironmentConfiguration() push a false "missing environment
      * variables" issue — and therefore isHealthy=false — for legitimate
      * fallback-based Vertex auth, AWS_PROFILE/IAM-role Bedrock auth, and

package/dist/utils/providerHealth.js

@@ -449,7 +449,7 @@ export class ProviderHealthChecker {
      * zero-config local proxy. Their real requirement is validated by
      * checkProviderSpecificConfig()'s dedicated per-provider checks instead.
      * Naively deriving [apiKey, ...extraRequired] from the descriptor for
-     * these three (as for the other 27 providers) would make
+     * these three (as for the other providers) would make
      * checkEnvironmentConfiguration() push a false "missing environment
      * variables" issue — and therefore isHealthy=false — for legitimate
      * fallback-based Vertex auth, AWS_PROFILE/IAM-role Bedrock auth, and