@juspay/neurolink 12.37.5 → 12.38.0

package/dist/cli/commands/decide.d.ts

@@ -8,8 +8,8 @@
  * for the full vocabulary.
  *
  * Credentials are env-only here, exactly as every other CLI command: the
- * decision provider reads its own settings (TYPESAFE_API_KEY, or LAYA_API_KEY
- * and LAYA_BASE_URL) itself.
+ * decision provider reads its own settings (TYPESAFE_API_KEY, LAYA_API_KEY and
+ * LAYA_BASE_URL, or XOR_API_KEY and XOR_BASE_URL) itself.
  */
 import type { CommandModule } from "yargs";
 import type { CliDecideArgs } from "../../types/index.js";

package/dist/cli/commands/decide.js

@@ -8,8 +8,8 @@
  * for the full vocabulary.
  *
  * Credentials are env-only here, exactly as every other CLI command: the
- * decision provider reads its own settings (TYPESAFE_API_KEY, or LAYA_API_KEY
- * and LAYA_BASE_URL) itself.
+ * decision provider reads its own settings (TYPESAFE_API_KEY, LAYA_API_KEY and
+ * LAYA_BASE_URL, or XOR_API_KEY and XOR_BASE_URL) itself.
  */
 import chalk from "chalk";
 import ora from "ora";
@@ -186,6 +186,17 @@ export const decideCommand = {
         .option("model", {
         type: "string",
         describe: "Overrides the provider's configured model for this call",
+    })
+        .option("image", {
+        type: "string",
+        array: true,
+        nargs: 1,
+        describe: "Image for the model to read: a file path or a data: URL. Repeat for several (XOR takes up to 8)",
+    })
+        .option("video", {
+        type: "string",
+        nargs: 1,
+        describe: "One video for the model to read: a file path or a data: URL",
     })
         .option("timeout", {
         type: "number",
@@ -205,7 +216,8 @@ export const decideCommand = {
         describe: "Enable debug logging (written to stderr when --format json is used)",
     })
         .example('$0 decide "Refund request for a damaged item" --questions \'{"urgent":{"type":"boolean","instructions":"Is this urgent?"}}\'', "Ask a single yes/no question")
-        .example("$0 decide --state-file ticket.json --questions-file questions.json --format json", "Read state and questions from files, emit raw JSON"),
+        .example("$0 decide --state-file ticket.json --questions-file questions.json --format json", "Read state and questions from files, emit raw JSON")
+        .example('$0 decide "What color is this?" --provider xor --image ./photo.png --questions \'{"color":{"type":"choice","instructions":"What color is the image?","criteria":{"red":"red","blue":"blue"}}}\'', "Ask about an image (XOR only)"),
     handler: async (argv) => {
         const outputFormat = argv.format ?? "text";
         // --- Validate before any provider work ---------------------------------
@@ -235,6 +247,11 @@ export const decideCommand = {
             logger.error(chalk.red("Error: --timeout must be a positive number of milliseconds."));
             process.exit(1);
         }
+        const videos = [].concat(argv.video ?? []);
+        if (videos.length > 1) {
+            logger.error(chalk.red("Error: pass at most one --video."));
+            process.exit(1);
+        }
         if (!isDecisionQuestionMap(parsedQuestions)) {
             logger.error(chalk.red('Error: questions must be a non-empty object of { type: "boolean" | "choice" | "score", ... }.'));
             process.exit(1);
@@ -261,6 +278,8 @@ export const decideCommand = {
                 provider: argv.provider,
                 model: argv.model,
                 timeoutMs: argv.timeout,
+                ...(argv.image && argv.image.length > 0 ? { images: argv.image } : {}),
+                ...(videos.length === 1 ? { video: videos[0] } : {}),
             });
             spinner?.succeed("Decision complete");
             if (outputFormat === "json") {

package/dist/cli/commands/setup.js

@@ -20,7 +20,7 @@ import { handleGCPSetup } from "./setup-gcp.js";
 import { handleHuggingFaceSetup } from "./setup-huggingface.js";
 import { handleMistralSetup } from "./setup-mistral.js";
 import { PROVIDER_DESCRIPTORS_BY_NAME } from "../../factories/providerDescriptors.js";
-import { createCohereConfig, createDeepSeekConfig, createIdeogramConfig, createJinaConfig, createNvidiaNimConfig, createOpenAICompatibleConfig, createRecraftConfig, createReplicateConfig, createStabilityConfig, createVoyageConfig, createTypeSafeConfig, createLayaConfig, satisfiesFallbacks, } from "../../utils/providerConfig.js";
+import { createCohereConfig, createDeepSeekConfig, createIdeogramConfig, createJinaConfig, createNvidiaNimConfig, createOpenAICompatibleConfig, createRecraftConfig, createReplicateConfig, createStabilityConfig, createVoyageConfig, createTypeSafeConfig, createLayaConfig, createXorConfig, satisfiesFallbacks, } from "../../utils/providerConfig.js";
 import { getCatalogJsonEntries, buildCatalogConfigOptions, } from "../../providers/catalog/loader.js";
 // Provider information database
 const PROVIDERS = [
@@ -170,6 +170,7 @@ export const EXTRA_PROVIDER_CONFIGS = {
     recraft: createRecraftConfig(),
     typesafe: createTypeSafeConfig(),
     laya: createLayaConfig(),
+    xor: createXorConfig(),
     ...Object.fromEntries(getCatalogJsonEntries()
         .filter((e) => e.id !== "mistral")
         .map((e) => [e.id, buildCatalogConfigOptions(e)])),

package/dist/cli/factories/commandFactory.js

@@ -616,7 +616,7 @@ export class CLICommandFactory {
         },
         classifierStrategy: {
             type: "string",
-            description: "Classifier strategy: 'auto' (default — 'jev' when a decision provider is configured, such as TYPESAFE_API_KEY, or LAYA_API_KEY with LAYA_BASE_URL, else 'heuristic'), 'heuristic' (no LLM), 'llm' (a cheap model picks per prompt), or 'jev' (a System One decision model — TypeSafe Jev, or Laya — with calibrated confidence).",
+            description: "Classifier strategy: 'auto' (default — 'jev' when a decision provider is configured, such as TYPESAFE_API_KEY, LAYA_API_KEY with LAYA_BASE_URL, or XOR_API_KEY with XOR_BASE_URL, else 'heuristic'), 'heuristic' (no LLM), 'llm' (a cheap model picks per prompt), or 'jev' (a System One decision model — TypeSafe Jev, Laya or XOR — with calibrated confidence).",
             choices: ["auto", "heuristic", "llm", "jev"],
             alias: "classifier-strategy",
         },

package/dist/constants/enums.d.ts

@@ -48,6 +48,8 @@ export declare enum AIProviderName {
     TYPESAFE = "typesafe",
     /** Laya (Convai, open weights) — serves the `decide` inference type only. */
     LAYA = "laya",
+    /** XOR (Juspay, open weights) — serves the `decide` inference type only. */
+    XOR = "xor",
     AUTO = "auto"
 }
 /**
@@ -1097,3 +1099,10 @@ export declare enum LayaModels {
     MULTILINGUAL = "multilingual",
     AUTO = "auto"
 }
+/**
+ * XOR decision models. Hand-written: XOR is a Tier-3 provider, so it is not in
+ * the provider catalog and codegen never touches this.
+ */
+export declare enum XorModels {
+    XOR_1_1 = "xor-1.1"
+}

package/dist/constants/enums.js

@@ -54,6 +54,8 @@ export var AIProviderName;
     AIProviderName["TYPESAFE"] = "typesafe";
     /** Laya (Convai, open weights) — serves the `decide` inference type only. */
     AIProviderName["LAYA"] = "laya";
+    /** XOR (Juspay, open weights) — serves the `decide` inference type only. */
+    AIProviderName["XOR"] = "xor";
     AIProviderName["AUTO"] = "auto";
 })(AIProviderName || (AIProviderName = {}));
 /**
@@ -1357,3 +1359,11 @@ export var LayaModels;
     LayaModels["MULTILINGUAL"] = "multilingual";
     LayaModels["AUTO"] = "auto";
 })(LayaModels || (LayaModels = {}));
+/**
+ * XOR decision models. Hand-written: XOR is a Tier-3 provider, so it is not in
+ * the provider catalog and codegen never touches this.
+ */
+export var XorModels;
+(function (XorModels) {
+    XorModels["XOR_1_1"] = "xor-1.1";
+})(XorModels || (XorModels = {}));

package/dist/factories/providerDescriptors.d.ts

@@ -30,6 +30,8 @@ export declare const DECISION_PROVIDERS: readonly ProviderDescriptor[];
  * internal consumer treats as "carry on exactly as before".
  */
 export declare function resolveDefaultDecisionProvider(credentials?: NeurolinkCredentials): string | undefined;
+/** Names of the decision providers that accept images or video. */
+export declare function listMediaDecisionProviders(): string[];
 /**
  * The variables that would configure each decision provider, one clause per
  * provider in precedence order, e.g. "TYPESAFE_API_KEY or AI_GATEWAY_API_KEY

package/dist/factories/providerDescriptors.js

@@ -1,5 +1,5 @@
 import { AIProviderName } from "../constants/enums.js";
-import { GoogleAIModels, OpenAIModels, AnthropicModels, VertexModels, OllamaModels, LiteLLMModels, NvidiaNimModels, OpenRouterModels, CohereModels, VoyageModels, TypeSafeModels, LayaModels, JinaModels, StabilityModels, IdeogramModels, RecraftModels, ReplicateModels, } from "../constants/enums.js";
+import { GoogleAIModels, OpenAIModels, AnthropicModels, VertexModels, OllamaModels, LiteLLMModels, NvidiaNimModels, OpenRouterModels, CohereModels, VoyageModels, TypeSafeModels, LayaModels, XorModels, JinaModels, StabilityModels, IdeogramModels, RecraftModels, ReplicateModels, } from "../constants/enums.js";
 import { API_KEY_FORMATS } from "../utils/providerConfig.js";
 import { getCatalogJsonEntries, catalogCredentialsKey, catalogEnvVar, } from "../providers/catalog/loader.js";
 import { DEFAULT_INFERENCE_KINDS } from "../types/index.js";
@@ -451,11 +451,12 @@ const HAND_DESCRIPTORS = [
         timeouts: { decideMs: 5000 },
         setupUrl: "https://console.typesafe.ai/keys",
     },
-    // Laya MUST stay after TypeSafe. resolveDefaultDecisionProvider() returns
-    // the first configured DECISION_PROVIDERS entry, in this order, so a host
-    // configured for both keeps Jev for every built-in consumer and reaches
-    // Laya only by naming it. Reordering these two silently changes which model
-    // routes, compacts and plans for every such host.
+    // Laya MUST stay after TypeSafe, and XOR after Laya.
+    // resolveDefaultDecisionProvider() returns the first configured
+    // DECISION_PROVIDERS entry, in this order, so a host configured for several
+    // keeps Jev for every built-in consumer and reaches the others only by
+    // naming them. Reordering these silently changes which model routes,
+    // compacts and plans for every such host.
     {
         name: AIProviderName.LAYA,
         aliases: [],
@@ -501,6 +502,47 @@ const HAND_DESCRIPTORS = [
         },
         setupUrl: "https://github.com/NandhaKishorM/laya",
     },
+    {
+        name: AIProviderName.XOR,
+        aliases: [],
+        credentialsKey: "xor",
+        envVars: {
+            apiKey: "XOR_API_KEY",
+            baseURL: "XOR_BASE_URL",
+            // XOR has no built-in endpoint (it is reached at a deployment or behind a
+            // proxy), so a key is useless without a base URL. Both are required for
+            // it to count as configured, from the environment or credentials.xor.
+            extraRequired: ["XOR_BASE_URL"],
+            model: "XOR_MODEL",
+        },
+        defaultModel: XorModels.XOR_1_1,
+        // Serves only `decide`, like TypeSafe and Laya — the one declaration that
+        // keeps it out of every generation code path.
+        inferenceKinds: ["decide"],
+        toolSupport: "none",
+        localRuntime: false,
+        healthCheck: "env-only",
+        // Deliberately NO autoSelectPriority / autoSelectPreference /
+        // defaultHealthSweepPriority, for the same reason as TypeSafe above.
+        timeouts: { decideMs: 5000 },
+        // The deployment's prefill is 250,000 tokens, shared by the state, the
+        // questions and any media. 200,000 leaves 20% for those, and a state
+        // between this and the server's 4 MB would otherwise pass validation and
+        // fail inside the engine as a 500, which the base class would retry. There
+        // is no question cap (the server only limits a choice to 2..255 options).
+        // Non-ASCII text is charged per character because the four-characters-
+        // per-token estimate is several times too generous for CJK on this
+        // tokenizer. One token per character is a deliberate upper bound, to be
+        // replaced by a live measurement.
+        decisionLimits: {
+            maxStateTokens: 200_000,
+            nonAsciiTokensPerChar: 1,
+            // The server takes 1..8 images and one video, and refuses a body over
+            // 8 MB.
+            media: { maxImages: 8, video: true, maxRequestBytes: 8 * 1024 * 1024 },
+        },
+        setupUrl: "https://huggingface.co/juspay/xor",
+    },
 ];
 /**
  * Builds a ProviderDescriptor for every JSON-catalog provider. Every field
@@ -636,6 +678,10 @@ function isDecisionProviderConfigured(descriptor, credentials) {
 export function resolveDefaultDecisionProvider(credentials) {
     return DECISION_PROVIDERS.find((descriptor) => isDecisionProviderConfigured(descriptor, credentials))?.name;
 }
+/** Names of the decision providers that accept images or video. */
+export function listMediaDecisionProviders() {
+    return DECISION_PROVIDERS.filter((descriptor) => descriptor.decisionLimits?.media !== undefined).map((descriptor) => descriptor.name);
+}
 /**
  * The variables that would configure each decision provider, one clause per
  * provider in precedence order, e.g. "TYPESAFE_API_KEY or AI_GATEWAY_API_KEY

package/dist/factories/providerRegistry.js

@@ -1,6 +1,6 @@
 import { ProviderFactory } from "./providerFactory.js";
 import { logger } from "../utils/logger.js";
-import { AIProviderName, GoogleAIModels, OpenAIModels, AnthropicModels, VertexModels, OllamaModels, LiteLLMModels, NvidiaNimModels, OpenRouterModels, CohereModels, VoyageModels, JinaModels, StabilityModels, IdeogramModels, RecraftModels, TypeSafeModels, LayaModels, ReplicateModels, } from "../constants/enums.js";
+import { AIProviderName, GoogleAIModels, OpenAIModels, AnthropicModels, VertexModels, OllamaModels, LiteLLMModels, NvidiaNimModels, OpenRouterModels, CohereModels, VoyageModels, JinaModels, StabilityModels, IdeogramModels, RecraftModels, TypeSafeModels, LayaModels, XorModels, ReplicateModels, } from "../constants/enums.js";
 import { PROVIDER_DESCRIPTORS_BY_NAME } from "./providerDescriptors.js";
 import { OPENAI_COMPAT_CATALOG } from "../providers/openaiCompatCatalog.js";
 import { providerChoicesFor } from "./mediaHandlerCatalog.js";
@@ -242,6 +242,14 @@ export class ProviderRegistry {
                 const { LayaProvider } = await import("../providers/laya.js");
                 return new LayaProvider(modelName, sdk, undefined, layaCreds);
             }, process.env.LAYA_MODEL || LayaModels.TYPED_DECISIONS, [], PROVIDER_DESCRIPTORS_BY_NAME.get(AIProviderName.LAYA));
+            // Register XOR — the third `decide` provider, reached at whatever base
+            // URL its config names. Its descriptor declares inferenceKinds:
+            // ["decide"], so nothing in the generation fallback chain can reach it.
+            ProviderFactory.registerProvider(AIProviderName.XOR, async (modelName, _providerName, sdk, _region, credentials) => {
+                const xorCreds = credentials;
+                const { XorProvider } = await import("../providers/xor.js");
+                return new XorProvider(modelName, sdk, undefined, xorCreds);
+            }, process.env.XOR_MODEL || XorModels.XOR_1_1, [], PROVIDER_DESCRIPTORS_BY_NAME.get(AIProviderName.XOR));
             logger.debug("All AI providers registered successfully");
             // ===== MEDIA HANDLER REGISTRATION =====
             // Single registration path (Task 11): each ecosystem barrel (voice,

package/dist/models/manifestRegistry.js

@@ -21,6 +21,7 @@ import { xaiManifest } from "./manifests/xai.js";
 import { groqManifest } from "./manifests/groq.js";
 import { typesafeManifest } from "./manifests/typesafe.js";
 import { layaManifest } from "./manifests/laya.js";
+import { xorManifest } from "./manifests/xor.js";
 import { cohereManifest } from "./manifests/cohere.js";
 import { togetherAiManifest } from "./manifests/together-ai.js";
 import { fireworksManifest } from "./manifests/fireworks.js";
@@ -120,6 +121,7 @@ export const MANIFEST_REGISTRY = {
     groq: groqManifest,
     typesafe: typesafeManifest,
     laya: layaManifest,
+    xor: xorManifest,
     cerebras: catalogManifest("cerebras"),
     sambanova: catalogManifest("sambanova"),
     cohere: cohereManifest,

package/dist/models/manifests/xor.d.ts

@@ -0,0 +1,12 @@
+import type { ProviderModelManifest } from "../../types/index.js";
+/**
+ * XOR — the `decide` inference type, not text generation.
+ *
+ * `contextWindow` is the deployment's maximum prefill, shared by the state,
+ * the questions and any images or video. `vision` describes `generate()`
+ * input, which XOR does not serve; its image input is `DecisionRequest.images`.
+ *
+ * `maxOutputTokens` is required by the manifest type but has no honest value
+ * for a model that emits no text, so a small non-zero figure is used.
+ */
+export declare const xorManifest: ProviderModelManifest;

package/dist/models/manifests/xor.js

@@ -0,0 +1,30 @@
+/**
+ * XOR — the `decide` inference type, not text generation.
+ *
+ * `contextWindow` is the deployment's maximum prefill, shared by the state,
+ * the questions and any images or video. `vision` describes `generate()`
+ * input, which XOR does not serve; its image input is `DecisionRequest.images`.
+ *
+ * `maxOutputTokens` is required by the manifest type but has no honest value
+ * for a model that emits no text, so a small non-zero figure is used.
+ */
+export const xorManifest = {
+    defaultContextWindow: 250_000,
+    models: {
+        _default: {
+            aliases: [],
+            contextWindow: 250_000,
+            maxOutputTokens: 256,
+            vision: false,
+            functionCalling: false,
+        },
+        "xor-1.1": {
+            aliases: [],
+            displayName: "XOR 1.1",
+            contextWindow: 250_000,
+            maxOutputTokens: 256,
+            vision: false,
+            functionCalling: false,
+        },
+    },
+};

package/dist/neurolink.js

@@ -12956,6 +12956,7 @@ Current user's request: ${currentInput}`;
                 "gen_ai.operation.name": "decide",
                 "ai.provider": providerName,
                 "decision.question_count": questionCount,
+                "decision.images.count": options.images?.length ?? 0,
             },
         }, async (otelSpan) => {
             const { traceId, parentSpanId } = getActiveTraceContext();
@@ -12964,6 +12965,7 @@ Current user's request: ${currentInput}`;
                 "ai.provider": providerName,
                 "ai.model": options.model ?? "",
                 "decision.question_count": questionCount,
+                "decision.images.count": options.images?.length ?? 0,
             }, parentSpanId, traceId);
             try {
                 // enableMCP: false — a decision model has no tools and never will.
@@ -12974,6 +12976,8 @@ Current user's request: ${currentInput}`;
                 const result = await provider.decide({
                     state: options.state,
                     questions: options.questions,
+                    images: options.images,
+                    video: options.video,
                     model: options.model,
                     signal: options.signal,
                     timeoutMs: options.timeoutMs,
@@ -12988,6 +12992,7 @@ Current user's request: ${currentInput}`;
                 otelSpan.setAttribute("gen_ai.usage.input_tokens", result.usage.inputTokens);
                 otelSpan.setAttribute("gen_ai.usage.output_tokens", result.usage.outputTokens);
                 otelSpan.setAttribute("decision.answer_count", answerCount);
+                otelSpan.setAttribute("decision.media.bytes", result.mediaBytes ?? 0);
                 otelSpan.setAttribute("ai.cost.total", cost);
                 if (result.upstreamMs !== undefined) {
                     otelSpan.setAttribute("decision.upstream_ms", result.upstreamMs);
@@ -13008,6 +13013,7 @@ Current user's request: ${currentInput}`;
                     "ai.cost.output": 0,
                     "ai.cost.total": cost,
                     "decision.answer_count": answerCount,
+                    "decision.media.bytes": result.mediaBytes ?? 0,
                     "decision.latency_ms": result.latencyMs,
                     ...(result.upstreamMs !== undefined
                         ? { "decision.upstream_ms": result.upstreamMs }

package/dist/providers/laya.js

@@ -2,25 +2,7 @@ import { LayaModels } from "../constants/enums.js";
 import { logger } from "../utils/logger.js";
 import { redactUrlForError } from "../utils/logSanitize.js";
 import { getProviderModel } from "../utils/providerConfig.js";
-import { describeValidationErrors, isRecord, SystemOneDecisionProvider, } from "./systemOneDecision.js";
-/**
- * LiteLLM echoes credentials back in its error texts, in more than one
- * wording: a masked key plus its hash on a rejected key, the whole key when it
- * does not look like a LiteLLM key, a key hash on a rate limit. None of it
- * belongs in an error message or a log, whatever the wording, so the
- * configured key, anything shaped like a LiteLLM key and any long hex run are
- * all removed.
- */
-function redactCredentials(message, apiKey) {
-    const withoutKey = apiKey
-        ? message.split(apiKey).join("[redacted]")
-        : message;
-    return withoutKey
-        .replace(/\.?\s*Received API Key\s*=[\s\S]*$/, "")
-        .replace(/\bsk-[A-Za-z0-9._-]+/g, "[redacted]")
-        .replace(/\b[0-9a-f]{32,}\b/gi, "[redacted]")
-        .trim();
-}
+import { describeValidationErrors, isRecord, redactCredentials, SystemOneDecisionProvider, } from "./systemOneDecision.js";
 /**
  * Normalise the two envelopes a Laya failure can arrive in.
  *

package/dist/providers/systemOneDecision.d.ts

@@ -1,7 +1,7 @@
 import type { AIProviderName } from "../constants/enums.js";
 import { BaseProvider } from "../core/baseProvider.js";
 import { ProviderError } from "../types/index.js";
-import type { DecisionError, DecisionQuestion, DecisionRequest, DecisionResult, DecisionState, LanguageModel, StreamOptions, StreamResult, ValidationSchema } from "../types/index.js";
+import type { DecisionError, DecisionQuestion, DecisionRequest, DecisionResult, DecisionPreparedMedia, DecisionState, LanguageModel, StreamOptions, StreamResult, ValidationSchema } from "../types/index.js";
 /**
  * Generous enough for a cold start (measured at 2.0–2.7s after idle on Jev)
  * while still bounded. Every internal caller is fail-open, so this only bites
@@ -16,6 +16,15 @@ export declare const asNumber: (v: unknown) => number | undefined;
  * request back — possibly the whole state — so it is never surfaced.
  */
 export declare function describeValidationErrors(detail: readonly unknown[]): string;
+/**
+ * A LiteLLM proxy echoes credentials back in its error texts, in more than one
+ * wording: a masked key plus its hash on a rejected key, the whole key when it
+ * does not look like a LiteLLM key, a key hash on a rate limit. None of it
+ * belongs in an error message or a log, whatever the wording, so the
+ * configured key, anything shaped like a LiteLLM key, any long hex run and any
+ * embedded `data:` URL are all removed.
+ */
+export declare function redactCredentials(message: string, apiKey: string): string;
 /**
  * The shared half of every "System One" decision provider — a model that takes
  * one `state` plus typed questions and returns one typed answer each, with no
@@ -52,7 +61,7 @@ export declare abstract class SystemOneDecisionProvider extends BaseProvider {
     protected missingConfigMessage(): string | undefined;
     protected abstract decisionEndpoint(): string;
     protected abstract decisionHeaders(): Record<string, string>;
-    protected abstract buildDecisionBody(state: DecisionState, questions: Record<string, Record<string, unknown>>, model: string): Record<string, unknown>;
+    protected abstract buildDecisionBody(state: DecisionState, questions: Record<string, Record<string, unknown>>, model: string, media?: DecisionPreparedMedia): Record<string, unknown>;
     protected abstract parseDecisionError(status: number, payload: unknown, requestId: string | undefined): DecisionError;
     protected abstract readRequestId(headers: Headers): string | undefined;
     /**
@@ -87,6 +96,16 @@ export declare abstract class SystemOneDecisionProvider extends BaseProvider {
      * which returns null instead.
      */
     decide(request: DecisionRequest): Promise<DecisionResult>;
+    /**
+     * Turn the request's images and video into data URLs, or refuse it. Refused
+     * as a non-retryable `invalid_request`: resending the same media cannot help.
+     */
+    private prepareMedia;
+    /**
+     * The encoded body, not just the media, is what the server's size limit
+     * applies to.
+     */
+    private assertWithinRequestBytes;
     /**
      * Refuse a request the model cannot read in full. An encoder cuts the state
      * off past its window without saying so, so without this a decision would

package/dist/providers/systemOneDecision.js

@@ -1,9 +1,11 @@
 import { BaseProvider } from "../core/baseProvider.js";
-import { PROVIDER_DESCRIPTORS_BY_NAME } from "../factories/providerDescriptors.js";
+import { listMediaDecisionProviders, PROVIDER_DESCRIPTORS_BY_NAME, } from "../factories/providerDescriptors.js";
 import { isNeuroLink } from "../neurolink.js";
 import { createProxyFetch } from "../proxy/proxyFetch.js";
 import { ProviderError } from "../types/index.js";
+import { prepareDecisionMedia } from "../utils/decisionMedia.js";
 import { logger } from "../utils/logger.js";
+import { redactUrlsInText } from "../utils/logSanitize.js";
 import { estimateTokens, serializeForEstimate, } from "../utils/tokenEstimation.js";
 /**
  * Generous enough for a cold start (measured at 2.0–2.7s after idle on Jev)
@@ -128,6 +130,25 @@ export function describeValidationErrors(detail) {
         .slice(0, 5);
     return fields.join("; ") || "unspecified field";
 }
+/**
+ * A LiteLLM proxy echoes credentials back in its error texts, in more than one
+ * wording: a masked key plus its hash on a rejected key, the whole key when it
+ * does not look like a LiteLLM key, a key hash on a rate limit. None of it
+ * belongs in an error message or a log, whatever the wording, so the
+ * configured key, anything shaped like a LiteLLM key, any long hex run and any
+ * embedded `data:` URL are all removed.
+ */
+export function redactCredentials(message, apiKey) {
+    const withoutKey = apiKey
+        ? message.split(apiKey).join("[redacted]")
+        : message;
+    return withoutKey
+        .replace(/\.?\s*Received API Key\s*=[\s\S]*$/, "")
+        .replace(/\bsk-[A-Za-z0-9._-]+/g, "[redacted]")
+        .replace(/\b[0-9a-f]{32,}\b/gi, "[redacted]")
+        .replace(/data:[a-z]+\/[a-z0-9.+-]+;base64,[A-Za-z0-9+/=]+/gi, "[media]")
+        .trim();
+}
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 /**
  * `estimateTokens` assumes ~4 characters per token. That holds for English
@@ -281,7 +302,9 @@ export class SystemOneDecisionProvider extends BaseProvider {
             id,
             this.encodeQuestion(question),
         ]));
-        const body = JSON.stringify(this.buildDecisionBody(request.state, wireQuestions, resolvedModel));
+        const media = await this.prepareMedia(request);
+        const body = JSON.stringify(this.buildDecisionBody(request.state, wireQuestions, resolvedModel, media));
+        this.assertWithinRequestBytes(body);
         const timeoutMs = request.timeoutMs ??
             this.getDescriptorDecideMs() ??
             this.defaultTimeout ??
@@ -369,6 +392,7 @@ export class SystemOneDecisionProvider extends BaseProvider {
                     requestId,
                     latencyMs,
                     upstreamMs,
+                    ...(media ? { mediaBytes: media.bytes } : {}),
                 };
             }
             catch (error) {
@@ -381,7 +405,7 @@ export class SystemOneDecisionProvider extends BaseProvider {
                 const isTimeout = error instanceof Error && error.name === "TimeoutError";
                 lastError = {
                     kind: aborted ? "network" : isTimeout ? "timeout" : "network",
-                    message: error instanceof Error ? error.message : String(error),
+                    message: redactCredentials(redactUrlsInText(error instanceof Error ? error.message : String(error)), this.decisionApiKey()),
                     retryable: !aborted,
                 };
                 if (aborted || attempt === this.maxRetries) {
@@ -396,6 +420,41 @@ export class SystemOneDecisionProvider extends BaseProvider {
             retryable: false,
         });
     }
+    /**
+     * Turn the request's images and video into data URLs, or refuse it. Refused
+     * as a non-retryable `invalid_request`: resending the same media cannot help.
+     */
+    async prepareMedia(request) {
+        const limits = PROVIDER_DESCRIPTORS_BY_NAME.get(this.providerName)?.decisionLimits;
+        const prepared = await prepareDecisionMedia(request, limits?.media, this.vendorLabel(), listMediaDecisionProviders());
+        if (prepared.status === "refused") {
+            throw this.decisionError({
+                kind: "invalid_request",
+                message: prepared.message,
+                retryable: false,
+            });
+        }
+        return prepared.media;
+    }
+    /**
+     * The encoded body, not just the media, is what the server's size limit
+     * applies to.
+     */
+    assertWithinRequestBytes(body) {
+        const limit = PROVIDER_DESCRIPTORS_BY_NAME.get(this.providerName)
+            ?.decisionLimits?.media?.maxRequestBytes;
+        if (limit === undefined) {
+            return;
+        }
+        const bytes = Buffer.byteLength(body);
+        if (bytes > limit) {
+            throw this.decisionError({
+                kind: "invalid_request",
+                message: `The request is ${bytes} bytes; ${this.vendorLabel()} accepts at most ${limit}. Send fewer or smaller images, or a shorter video.`,
+                retryable: false,
+            });
+        }
+    }
     /**
      * Refuse a request the model cannot read in full. An encoder cuts the state
      * off past its window without saying so, so without this a decision would
@@ -407,7 +466,8 @@ export class SystemOneDecisionProvider extends BaseProvider {
             return;
         }
         const label = this.vendorLabel();
-        if (questionCount > limits.maxQuestions) {
+        if (limits.maxQuestions !== undefined &&
+            questionCount > limits.maxQuestions) {
             throw this.decisionError({
                 kind: "max_tokens_exceeded",
                 message: `${label} accepts at most ${limits.maxQuestions} questions per request; this one has ${questionCount}. Ask fewer, or use a decision provider without this cap.`,

package/dist/providers/xor.d.ts

@@ -0,0 +1,48 @@
+import type { DecisionError, DecisionPreparedMedia, DecisionState, NeurolinkCredentials } from "../types/index.js";
+import { SystemOneDecisionProvider } from "./systemOneDecision.js";
+/**
+ * XOR Provider — the `decide` inference type only.
+ *
+ * XOR is Juspay's open-weights "System One" decision model, post-trained from
+ * Qwen3.6-35B-A3B: the same typed `noul` / `choice` / `score` questions as
+ * TypeSafe's Jev, on the same wire, in one batched pass. Unlike Jev and Laya it
+ * also reads images and one video. The request loop, retries, auth circuit
+ * breaker and answer parsing are shared with every decision provider in
+ * {@link SystemOneDecisionProvider}.
+ *
+ * @see https://huggingface.co/juspay/xor
+ */
+export declare class XorProvider extends SystemOneDecisionProvider {
+    private readonly apiKey;
+    private readonly baseURL;
+    constructor(modelName?: string, sdk?: unknown, _region?: string, credentials?: NeurolinkCredentials["xor"]);
+    protected getDefaultModel(): string;
+    protected vendorLabel(): string;
+    protected vendorDisplayName(): string;
+    protected decisionApiKey(): string;
+    protected missingKeyMessage(): string;
+    protected missingConfigMessage(): string | undefined;
+    protected decisionEndpoint(): string;
+    protected decisionHeaders(): Record<string, string>;
+    /**
+     * `model` is always sent. A LiteLLM proxy checks team access against the
+     * body's `model`, and refuses a request that names none. `images` is
+     * omitted rather than sent empty, which the server rejects.
+     */
+    protected buildDecisionBody(state: DecisionState, questions: Record<string, Record<string, unknown>>, model: string, media?: DecisionPreparedMedia): Record<string, unknown>;
+    /**
+     * A 403 is deliberately NOT `authentication`: on a LiteLLM proxy it means the
+     * team's allow-list lacks the model, which an admin can fix at any time, and
+     * `authentication` would trip the per-instance breaker and keep XOR disabled
+     * until restart even after access is granted. A 402 (a budget) is the same
+     * kind of fixable gap. `DecisionErrorKind` has no billing kind, so both map
+     * to `invalid_request`.
+     */
+    protected parseDecisionError(status: number, payload: unknown, requestId: string | undefined): DecisionError;
+    /**
+     * XOR's server sets `x-request-id` and `x-typesafe-request-id` to one value.
+     * A proxy in front may replace or drop them, so its own call id is the last
+     * resort.
+     */
+    protected readRequestId(headers: Headers): string | undefined;
+}