@juspay/neurolink 12.37.5 → 12.38.1

package/dist/cli/commands/decide.d.ts

@@ -8,8 +8,8 @@
  * for the full vocabulary.
  *
  * Credentials are env-only here, exactly as every other CLI command: the
- * decision provider reads its own settings (TYPESAFE_API_KEY, or LAYA_API_KEY
- * and LAYA_BASE_URL) itself.
+ * decision provider reads its own settings (TYPESAFE_API_KEY, LAYA_API_KEY and
+ * LAYA_BASE_URL, or XOR_API_KEY and XOR_BASE_URL) itself.
  */
 import type { CommandModule } from "yargs";
 import type { CliDecideArgs } from "../../types/index.js";

package/dist/cli/commands/decide.js

@@ -8,8 +8,8 @@
  * for the full vocabulary.
  *
  * Credentials are env-only here, exactly as every other CLI command: the
- * decision provider reads its own settings (TYPESAFE_API_KEY, or LAYA_API_KEY
- * and LAYA_BASE_URL) itself.
+ * decision provider reads its own settings (TYPESAFE_API_KEY, LAYA_API_KEY and
+ * LAYA_BASE_URL, or XOR_API_KEY and XOR_BASE_URL) itself.
  */
 import chalk from "chalk";
 import ora from "ora";
@@ -186,6 +186,17 @@ export const decideCommand = {
         .option("model", {
         type: "string",
         describe: "Overrides the provider's configured model for this call",
+    })
+        .option("image", {
+        type: "string",
+        array: true,
+        nargs: 1,
+        describe: "Image for the model to read: a file path or a data: URL. Repeat for several (XOR takes up to 8)",
+    })
+        .option("video", {
+        type: "string",
+        nargs: 1,
+        describe: "One video for the model to read: a file path or a data: URL",
     })
         .option("timeout", {
         type: "number",
@@ -205,7 +216,8 @@ export const decideCommand = {
         describe: "Enable debug logging (written to stderr when --format json is used)",
     })
         .example('$0 decide "Refund request for a damaged item" --questions \'{"urgent":{"type":"boolean","instructions":"Is this urgent?"}}\'', "Ask a single yes/no question")
-        .example("$0 decide --state-file ticket.json --questions-file questions.json --format json", "Read state and questions from files, emit raw JSON"),
+        .example("$0 decide --state-file ticket.json --questions-file questions.json --format json", "Read state and questions from files, emit raw JSON")
+        .example('$0 decide "What color is this?" --provider xor --image ./photo.png --questions \'{"color":{"type":"choice","instructions":"What color is the image?","criteria":{"red":"red","blue":"blue"}}}\'', "Ask about an image (XOR only)"),
     handler: async (argv) => {
         const outputFormat = argv.format ?? "text";
         // --- Validate before any provider work ---------------------------------
@@ -235,6 +247,11 @@ export const decideCommand = {
             logger.error(chalk.red("Error: --timeout must be a positive number of milliseconds."));
             process.exit(1);
         }
+        const videos = [].concat(argv.video ?? []);
+        if (videos.length > 1) {
+            logger.error(chalk.red("Error: pass at most one --video."));
+            process.exit(1);
+        }
         if (!isDecisionQuestionMap(parsedQuestions)) {
             logger.error(chalk.red('Error: questions must be a non-empty object of { type: "boolean" | "choice" | "score", ... }.'));
             process.exit(1);
@@ -261,6 +278,8 @@ export const decideCommand = {
                 provider: argv.provider,
                 model: argv.model,
                 timeoutMs: argv.timeout,
+                ...(argv.image && argv.image.length > 0 ? { images: argv.image } : {}),
+                ...(videos.length === 1 ? { video: videos[0] } : {}),
             });
             spinner?.succeed("Decision complete");
             if (outputFormat === "json") {

package/dist/cli/commands/setup.js

@@ -20,7 +20,7 @@ import { handleGCPSetup } from "./setup-gcp.js";
 import { handleHuggingFaceSetup } from "./setup-huggingface.js";
 import { handleMistralSetup } from "./setup-mistral.js";
 import { PROVIDER_DESCRIPTORS_BY_NAME } from "../../factories/providerDescriptors.js";
-import { createCohereConfig, createDeepSeekConfig, createIdeogramConfig, createJinaConfig, createNvidiaNimConfig, createOpenAICompatibleConfig, createRecraftConfig, createReplicateConfig, createStabilityConfig, createVoyageConfig, createTypeSafeConfig, createLayaConfig, satisfiesFallbacks, } from "../../utils/providerConfig.js";
+import { createCohereConfig, createDeepSeekConfig, createIdeogramConfig, createJinaConfig, createNvidiaNimConfig, createOpenAICompatibleConfig, createRecraftConfig, createReplicateConfig, createStabilityConfig, createVoyageConfig, createTypeSafeConfig, createLayaConfig, createXorConfig, satisfiesFallbacks, } from "../../utils/providerConfig.js";
 import { getCatalogJsonEntries, buildCatalogConfigOptions, } from "../../providers/catalog/loader.js";
 // Provider information database
 const PROVIDERS = [
@@ -170,6 +170,7 @@ export const EXTRA_PROVIDER_CONFIGS = {
     recraft: createRecraftConfig(),
     typesafe: createTypeSafeConfig(),
     laya: createLayaConfig(),
+    xor: createXorConfig(),
     ...Object.fromEntries(getCatalogJsonEntries()
         .filter((e) => e.id !== "mistral")
         .map((e) => [e.id, buildCatalogConfigOptions(e)])),

package/dist/cli/factories/commandFactory.js

@@ -616,7 +616,7 @@ export class CLICommandFactory {
         },
         classifierStrategy: {
             type: "string",
-            description: "Classifier strategy: 'auto' (default — 'jev' when a decision provider is configured, such as TYPESAFE_API_KEY, or LAYA_API_KEY with LAYA_BASE_URL, else 'heuristic'), 'heuristic' (no LLM), 'llm' (a cheap model picks per prompt), or 'jev' (a System One decision model — TypeSafe Jev, or Laya — with calibrated confidence).",
+            description: "Classifier strategy: 'auto' (default — 'jev' when a decision provider is configured, such as TYPESAFE_API_KEY, LAYA_API_KEY with LAYA_BASE_URL, or XOR_API_KEY with XOR_BASE_URL, else 'heuristic'), 'heuristic' (no LLM), 'llm' (a cheap model picks per prompt), or 'jev' (a System One decision model — TypeSafe Jev, Laya or XOR — with calibrated confidence).",
             choices: ["auto", "heuristic", "llm", "jev"],
             alias: "classifier-strategy",
         },

package/dist/constants/enums.d.ts

@@ -48,6 +48,8 @@ export declare enum AIProviderName {
     TYPESAFE = "typesafe",
     /** Laya (Convai, open weights) — serves the `decide` inference type only. */
     LAYA = "laya",
+    /** XOR (Juspay, open weights) — serves the `decide` inference type only. */
+    XOR = "xor",
     AUTO = "auto"
 }
 /**
@@ -1097,3 +1099,10 @@ export declare enum LayaModels {
     MULTILINGUAL = "multilingual",
     AUTO = "auto"
 }
+/**
+ * XOR decision models. Hand-written: XOR is a Tier-3 provider, so it is not in
+ * the provider catalog and codegen never touches this.
+ */
+export declare enum XorModels {
+    XOR_1_1 = "xor-1.1"
+}

package/dist/constants/enums.js

@@ -54,6 +54,8 @@ export var AIProviderName;
     AIProviderName["TYPESAFE"] = "typesafe";
     /** Laya (Convai, open weights) — serves the `decide` inference type only. */
     AIProviderName["LAYA"] = "laya";
+    /** XOR (Juspay, open weights) — serves the `decide` inference type only. */
+    AIProviderName["XOR"] = "xor";
     AIProviderName["AUTO"] = "auto";
 })(AIProviderName || (AIProviderName = {}));
 /**
@@ -1357,3 +1359,11 @@ export var LayaModels;
     LayaModels["MULTILINGUAL"] = "multilingual";
     LayaModels["AUTO"] = "auto";
 })(LayaModels || (LayaModels = {}));
+/**
+ * XOR decision models. Hand-written: XOR is a Tier-3 provider, so it is not in
+ * the provider catalog and codegen never touches this.
+ */
+export var XorModels;
+(function (XorModels) {
+    XorModels["XOR_1_1"] = "xor-1.1";
+})(XorModels || (XorModels = {}));

package/dist/core/modelConfiguration.js

@@ -322,6 +322,7 @@ export class ModelConfigurationManager {
                 ]),
                 toolCapableModels: this.getConfigArray("OLLAMA_TOOL_CAPABLE_MODELS", [
                     "llama3.1",
+                    "llama3.2",
                     "mistral",
                     "hermes3",
                     "qwen2.5",

package/dist/factories/providerDescriptors.d.ts

@@ -30,6 +30,8 @@ export declare const DECISION_PROVIDERS: readonly ProviderDescriptor[];
  * internal consumer treats as "carry on exactly as before".
  */
 export declare function resolveDefaultDecisionProvider(credentials?: NeurolinkCredentials): string | undefined;
+/** Names of the decision providers that accept images or video. */
+export declare function listMediaDecisionProviders(): string[];
 /**
  * The variables that would configure each decision provider, one clause per
  * provider in precedence order, e.g. "TYPESAFE_API_KEY or AI_GATEWAY_API_KEY

package/dist/factories/providerDescriptors.js

@@ -1,5 +1,5 @@
 import { AIProviderName } from "../constants/enums.js";
-import { GoogleAIModels, OpenAIModels, AnthropicModels, VertexModels, OllamaModels, LiteLLMModels, NvidiaNimModels, OpenRouterModels, CohereModels, VoyageModels, TypeSafeModels, LayaModels, JinaModels, StabilityModels, IdeogramModels, RecraftModels, ReplicateModels, } from "../constants/enums.js";
+import { GoogleAIModels, OpenAIModels, AnthropicModels, VertexModels, OllamaModels, LiteLLMModels, NvidiaNimModels, OpenRouterModels, CohereModels, VoyageModels, TypeSafeModels, LayaModels, XorModels, JinaModels, StabilityModels, IdeogramModels, RecraftModels, ReplicateModels, } from "../constants/enums.js";
 import { API_KEY_FORMATS } from "../utils/providerConfig.js";
 import { getCatalogJsonEntries, catalogCredentialsKey, catalogEnvVar, } from "../providers/catalog/loader.js";
 import { DEFAULT_INFERENCE_KINDS } from "../types/index.js";
@@ -451,11 +451,12 @@ const HAND_DESCRIPTORS = [
         timeouts: { decideMs: 5000 },
         setupUrl: "https://console.typesafe.ai/keys",
     },
-    // Laya MUST stay after TypeSafe. resolveDefaultDecisionProvider() returns
-    // the first configured DECISION_PROVIDERS entry, in this order, so a host
-    // configured for both keeps Jev for every built-in consumer and reaches
-    // Laya only by naming it. Reordering these two silently changes which model
-    // routes, compacts and plans for every such host.
+    // Laya MUST stay after TypeSafe, and XOR after Laya.
+    // resolveDefaultDecisionProvider() returns the first configured
+    // DECISION_PROVIDERS entry, in this order, so a host configured for several
+    // keeps Jev for every built-in consumer and reaches the others only by
+    // naming them. Reordering these silently changes which model routes,
+    // compacts and plans for every such host.
     {
         name: AIProviderName.LAYA,
         aliases: [],
@@ -501,6 +502,47 @@ const HAND_DESCRIPTORS = [
         },
         setupUrl: "https://github.com/NandhaKishorM/laya",
     },
+    {
+        name: AIProviderName.XOR,
+        aliases: [],
+        credentialsKey: "xor",
+        envVars: {
+            apiKey: "XOR_API_KEY",
+            baseURL: "XOR_BASE_URL",
+            // XOR has no built-in endpoint (it is reached at a deployment or behind a
+            // proxy), so a key is useless without a base URL. Both are required for
+            // it to count as configured, from the environment or credentials.xor.
+            extraRequired: ["XOR_BASE_URL"],
+            model: "XOR_MODEL",
+        },
+        defaultModel: XorModels.XOR_1_1,
+        // Serves only `decide`, like TypeSafe and Laya — the one declaration that
+        // keeps it out of every generation code path.
+        inferenceKinds: ["decide"],
+        toolSupport: "none",
+        localRuntime: false,
+        healthCheck: "env-only",
+        // Deliberately NO autoSelectPriority / autoSelectPreference /
+        // defaultHealthSweepPriority, for the same reason as TypeSafe above.
+        timeouts: { decideMs: 5000 },
+        // The deployment's prefill is 250,000 tokens, shared by the state, the
+        // questions and any media. 200,000 leaves 20% for those, and a state
+        // between this and the server's 4 MB would otherwise pass validation and
+        // fail inside the engine as a 500, which the base class would retry. There
+        // is no question cap (the server only limits a choice to 2..255 options).
+        // Non-ASCII text is charged per character because the four-characters-
+        // per-token estimate is several times too generous for CJK on this
+        // tokenizer. One token per character is a deliberate upper bound, to be
+        // replaced by a live measurement.
+        decisionLimits: {
+            maxStateTokens: 200_000,
+            nonAsciiTokensPerChar: 1,
+            // The server takes 1..8 images and one video, and refuses a body over
+            // 8 MB.
+            media: { maxImages: 8, video: true, maxRequestBytes: 8 * 1024 * 1024 },
+        },
+        setupUrl: "https://huggingface.co/juspay/xor",
+    },
 ];
 /**
  * Builds a ProviderDescriptor for every JSON-catalog provider. Every field
@@ -636,6 +678,10 @@ function isDecisionProviderConfigured(descriptor, credentials) {
 export function resolveDefaultDecisionProvider(credentials) {
     return DECISION_PROVIDERS.find((descriptor) => isDecisionProviderConfigured(descriptor, credentials))?.name;
 }
+/** Names of the decision providers that accept images or video. */
+export function listMediaDecisionProviders() {
+    return DECISION_PROVIDERS.filter((descriptor) => descriptor.decisionLimits?.media !== undefined).map((descriptor) => descriptor.name);
+}
 /**
  * The variables that would configure each decision provider, one clause per
  * provider in precedence order, e.g. "TYPESAFE_API_KEY or AI_GATEWAY_API_KEY

package/dist/factories/providerRegistry.js

@@ -1,6 +1,6 @@
 import { ProviderFactory } from "./providerFactory.js";
 import { logger } from "../utils/logger.js";
-import { AIProviderName, GoogleAIModels, OpenAIModels, AnthropicModels, VertexModels, OllamaModels, LiteLLMModels, NvidiaNimModels, OpenRouterModels, CohereModels, VoyageModels, JinaModels, StabilityModels, IdeogramModels, RecraftModels, TypeSafeModels, LayaModels, ReplicateModels, } from "../constants/enums.js";
+import { AIProviderName, GoogleAIModels, OpenAIModels, AnthropicModels, VertexModels, OllamaModels, LiteLLMModels, NvidiaNimModels, OpenRouterModels, CohereModels, VoyageModels, JinaModels, StabilityModels, IdeogramModels, RecraftModels, TypeSafeModels, LayaModels, XorModels, ReplicateModels, } from "../constants/enums.js";
 import { PROVIDER_DESCRIPTORS_BY_NAME } from "./providerDescriptors.js";
 import { OPENAI_COMPAT_CATALOG } from "../providers/openaiCompatCatalog.js";
 import { providerChoicesFor } from "./mediaHandlerCatalog.js";
@@ -242,6 +242,14 @@ export class ProviderRegistry {
                 const { LayaProvider } = await import("../providers/laya.js");
                 return new LayaProvider(modelName, sdk, undefined, layaCreds);
             }, process.env.LAYA_MODEL || LayaModels.TYPED_DECISIONS, [], PROVIDER_DESCRIPTORS_BY_NAME.get(AIProviderName.LAYA));
+            // Register XOR — the third `decide` provider, reached at whatever base
+            // URL its config names. Its descriptor declares inferenceKinds:
+            // ["decide"], so nothing in the generation fallback chain can reach it.
+            ProviderFactory.registerProvider(AIProviderName.XOR, async (modelName, _providerName, sdk, _region, credentials) => {
+                const xorCreds = credentials;
+                const { XorProvider } = await import("../providers/xor.js");
+                return new XorProvider(modelName, sdk, undefined, xorCreds);
+            }, process.env.XOR_MODEL || XorModels.XOR_1_1, [], PROVIDER_DESCRIPTORS_BY_NAME.get(AIProviderName.XOR));
             logger.debug("All AI providers registered successfully");
             // ===== MEDIA HANDLER REGISTRATION =====
             // Single registration path (Task 11): each ecosystem barrel (voice,

package/dist/models/manifestRegistry.js

@@ -21,6 +21,7 @@ import { xaiManifest } from "./manifests/xai.js";
 import { groqManifest } from "./manifests/groq.js";
 import { typesafeManifest } from "./manifests/typesafe.js";
 import { layaManifest } from "./manifests/laya.js";
+import { xorManifest } from "./manifests/xor.js";
 import { cohereManifest } from "./manifests/cohere.js";
 import { togetherAiManifest } from "./manifests/together-ai.js";
 import { fireworksManifest } from "./manifests/fireworks.js";
@@ -120,6 +121,7 @@ export const MANIFEST_REGISTRY = {
     groq: groqManifest,
     typesafe: typesafeManifest,
     laya: layaManifest,
+    xor: xorManifest,
     cerebras: catalogManifest("cerebras"),
     sambanova: catalogManifest("sambanova"),
     cohere: cohereManifest,

package/dist/models/manifests/xor.d.ts

@@ -0,0 +1,12 @@
+import type { ProviderModelManifest } from "../../types/index.js";
+/**
+ * XOR — the `decide` inference type, not text generation.
+ *
+ * `contextWindow` is the deployment's maximum prefill, shared by the state,
+ * the questions and any images or video. `vision` describes `generate()`
+ * input, which XOR does not serve; its image input is `DecisionRequest.images`.
+ *
+ * `maxOutputTokens` is required by the manifest type but has no honest value
+ * for a model that emits no text, so a small non-zero figure is used.
+ */
+export declare const xorManifest: ProviderModelManifest;

package/dist/models/manifests/xor.js

@@ -0,0 +1,30 @@
+/**
+ * XOR — the `decide` inference type, not text generation.
+ *
+ * `contextWindow` is the deployment's maximum prefill, shared by the state,
+ * the questions and any images or video. `vision` describes `generate()`
+ * input, which XOR does not serve; its image input is `DecisionRequest.images`.
+ *
+ * `maxOutputTokens` is required by the manifest type but has no honest value
+ * for a model that emits no text, so a small non-zero figure is used.
+ */
+export const xorManifest = {
+    defaultContextWindow: 250_000,
+    models: {
+        _default: {
+            aliases: [],
+            contextWindow: 250_000,
+            maxOutputTokens: 256,
+            vision: false,
+            functionCalling: false,
+        },
+        "xor-1.1": {
+            aliases: [],
+            displayName: "XOR 1.1",
+            contextWindow: 250_000,
+            maxOutputTokens: 256,
+            vision: false,
+            functionCalling: false,
+        },
+    },
+};

package/dist/neurolink.js

@@ -12956,6 +12956,7 @@ Current user's request: ${currentInput}`;
                 "gen_ai.operation.name": "decide",
                 "ai.provider": providerName,
                 "decision.question_count": questionCount,
+                "decision.images.count": options.images?.length ?? 0,
             },
         }, async (otelSpan) => {
             const { traceId, parentSpanId } = getActiveTraceContext();
@@ -12964,6 +12965,7 @@ Current user's request: ${currentInput}`;
                 "ai.provider": providerName,
                 "ai.model": options.model ?? "",
                 "decision.question_count": questionCount,
+                "decision.images.count": options.images?.length ?? 0,
             }, parentSpanId, traceId);
             try {
                 // enableMCP: false — a decision model has no tools and never will.
@@ -12974,6 +12976,8 @@ Current user's request: ${currentInput}`;
                 const result = await provider.decide({
                     state: options.state,
                     questions: options.questions,
+                    images: options.images,
+                    video: options.video,
                     model: options.model,
                     signal: options.signal,
                     timeoutMs: options.timeoutMs,
@@ -12988,6 +12992,7 @@ Current user's request: ${currentInput}`;
                 otelSpan.setAttribute("gen_ai.usage.input_tokens", result.usage.inputTokens);
                 otelSpan.setAttribute("gen_ai.usage.output_tokens", result.usage.outputTokens);
                 otelSpan.setAttribute("decision.answer_count", answerCount);
+                otelSpan.setAttribute("decision.media.bytes", result.mediaBytes ?? 0);
                 otelSpan.setAttribute("ai.cost.total", cost);
                 if (result.upstreamMs !== undefined) {
                     otelSpan.setAttribute("decision.upstream_ms", result.upstreamMs);
@@ -13008,6 +13013,7 @@ Current user's request: ${currentInput}`;
                     "ai.cost.output": 0,
                     "ai.cost.total": cost,
                     "decision.answer_count": answerCount,
+                    "decision.media.bytes": result.mediaBytes ?? 0,
                     "decision.latency_ms": result.latencyMs,
                     ...(result.upstreamMs !== undefined
                         ? { "decision.upstream_ms": result.upstreamMs }

package/dist/providers/anthropic/client.js

@@ -2307,7 +2307,14 @@ export class AnthropicProvider extends BaseProvider {
         return {
             stream: transformedStream(),
             provider: this.providerName,
-            model: this.modelName,
+            // Cell-3 identity fix: `this.modelName` is the raw, possibly-unset
+            // constructor arg (undefined whenever a caller relies on the default
+            // model). `modelId` (resolved above as
+            // `this.modelName || getDefaultAnthropicModel()`) is what was actually
+            // put on the wire for this turn — the same value `buildParams` uses to
+            // build the request. Reporting the raw field previously let a
+            // default-model turn's StreamResult claim an undefined/empty model.
+            model: modelId,
             toolCalls: [],
             toolResults: [],
             metadata: turnMetadata,

package/dist/providers/laya.js

@@ -2,25 +2,7 @@ import { LayaModels } from "../constants/enums.js";
 import { logger } from "../utils/logger.js";
 import { redactUrlForError } from "../utils/logSanitize.js";
 import { getProviderModel } from "../utils/providerConfig.js";
-import { describeValidationErrors, isRecord, SystemOneDecisionProvider, } from "./systemOneDecision.js";
-/**
- * LiteLLM echoes credentials back in its error texts, in more than one
- * wording: a masked key plus its hash on a rejected key, the whole key when it
- * does not look like a LiteLLM key, a key hash on a rate limit. None of it
- * belongs in an error message or a log, whatever the wording, so the
- * configured key, anything shaped like a LiteLLM key and any long hex run are
- * all removed.
- */
-function redactCredentials(message, apiKey) {
-    const withoutKey = apiKey
-        ? message.split(apiKey).join("[redacted]")
-        : message;
-    return withoutKey
-        .replace(/\.?\s*Received API Key\s*=[\s\S]*$/, "")
-        .replace(/\bsk-[A-Za-z0-9._-]+/g, "[redacted]")
-        .replace(/\b[0-9a-f]{32,}\b/gi, "[redacted]")
-        .trim();
-}
+import { describeValidationErrors, isRecord, redactCredentials, SystemOneDecisionProvider, } from "./systemOneDecision.js";
 /**
  * Normalise the two envelopes a Laya failure can arrive in.
  *

package/dist/providers/openRouter/client.js

@@ -203,6 +203,7 @@ export class OpenRouterProvider extends OpenAIChatCompletionsProvider {
             "mistralai/devstral",
             "meta-llama/llama-3.3",
             "meta-llama/llama-3.2",
+            "meta-llama/llama-3.1",
             "qwen/qwen3",
             "nvidia/nemotron",
         ];

package/dist/providers/openaiChatCompletionsBase.js

@@ -1648,6 +1648,12 @@ export class OpenAIChatCompletionsProvider extends BaseProvider {
         // middleware short-circuits the request — the case where there is no
         // turn to build on at all.
         let loopConversation;
+        // Cell-3 identity fix: the last model id the SERVER actually echoed on
+        // the wire (via `onModelObserved`, see `runStreamLoop`), distinct from
+        // the pre-call resolved/requested `modelId` below. Stays undefined for
+        // backends that never echo `model` on a chunk, in which case the
+        // `result.model` getter falls back to `modelId` — unchanged behavior.
+        let observedServerModel;
         const providerNameForLoop = this.providerName;
         const streamBaseModel = {
             specificationVersion: "v3",
@@ -1700,6 +1706,9 @@ export class OpenAIChatCompletionsProvider extends BaseProvider {
                     resolveUsage,
                     resolveFinish,
                     responseFormat,
+                    onModelObserved: (model) => {
+                        observedServerModel = model;
+                    },
                 });
                 const completion = loopPromise.then(() => Promise.all([usagePromise, finishPromise]).then(([usage, reason]) => ({
                     type: "finish",
@@ -1930,6 +1939,24 @@ export class OpenAIChatCompletionsProvider extends BaseProvider {
             toolsUsed,
             metadata: streamMetadata,
         };
+        // Cell-3 identity fix: `model` starts as a plain `modelId` data property
+        // above (satisfying StreamResult's type and giving every reader a value
+        // even before the loop starts), then gets redefined as a live getter.
+        // A plain reassignment (`result.model = observedServerModel`) would not
+        // survive `preserveLiveStreamAccessors`' re-wrapping at the
+        // BaseProvider/NeuroLink boundaries — those boundaries spread `result`
+        // into a new object BEFORE the background loop has produced a single
+        // chunk, which freezes a plain field at its construction-time value.
+        // Re-defining as a getter (the same mechanism already used for
+        // `toolExecutions` below) means every boundary's spread re-applies the
+        // getter itself, so a caller reading `.model` after draining `.stream`
+        // sees whatever the server actually echoed, falling back to the
+        // pre-call resolved `modelId` when the backend never echoed one.
+        Object.defineProperty(result, "model", {
+            enumerable: true,
+            configurable: true,
+            get: () => observedServerModel ?? modelId,
+        });
         // Lazy getter: every read transforms the live `toolExecutionSummaries`
         // through the canonical `transformToolExecutions()` so consumers see
         // `{name, input, output, duration}[]` (codebase convention), while still
@@ -1952,7 +1979,7 @@ export class OpenAIChatCompletionsProvider extends BaseProvider {
         return result;
     }
     async runStreamLoop(args) {
-        const { maxSteps, modelId, url, fetchImpl, abortSignal, options, conversation, openAITools, openAIToolChoice, toolsRecord, toolNameFromWire, emitter, toolsUsed, toolExecutionSummaries, pushChunk, closeChannel, resolveUsage, resolveFinish, responseFormat, } = args;
+        const { maxSteps, modelId, url, fetchImpl, abortSignal, options, conversation, openAITools, openAIToolChoice, toolsRecord, toolNameFromWire, emitter, toolsUsed, toolExecutionSummaries, pushChunk, closeChannel, resolveUsage, resolveFinish, responseFormat, onModelObserved, } = args;
         // Hoisted above the try so the catch can resolve the usage accumulated
         // by steps that completed BEFORE the failure — those steps were billed.
         let stepFinish = null;
@@ -2060,6 +2087,15 @@ export class OpenAIChatCompletionsProvider extends BaseProvider {
                 if (stepResult.usage) {
                     stepUsage = mergeUsage(stepUsage, stepResult.usage);
                 }
+                // Cell-3 identity fix: `stepResult.model` is what the SERVER echoed
+                // on the wire (parseSSEStream captures `chunk.model`), which can
+                // differ from the pre-call resolved `modelId` a gateway/router was
+                // asked for. Surfaced via callback rather than the method's return
+                // value so `executeStream` can update the already-returned
+                // `StreamResult` in place (see `onModelObserved` wiring there).
+                if (stepResult.model) {
+                    onModelObserved?.(stepResult.model);
+                }
                 if (stepResult.toolCalls.size === 0) {
                     break;
                 }

package/dist/providers/systemOneDecision.d.ts

@@ -1,7 +1,7 @@
 import type { AIProviderName } from "../constants/enums.js";
 import { BaseProvider } from "../core/baseProvider.js";
 import { ProviderError } from "../types/index.js";
-import type { DecisionError, DecisionQuestion, DecisionRequest, DecisionResult, DecisionState, LanguageModel, StreamOptions, StreamResult, ValidationSchema } from "../types/index.js";
+import type { DecisionError, DecisionQuestion, DecisionRequest, DecisionResult, DecisionPreparedMedia, DecisionState, LanguageModel, StreamOptions, StreamResult, ValidationSchema } from "../types/index.js";
 /**
  * Generous enough for a cold start (measured at 2.0–2.7s after idle on Jev)
  * while still bounded. Every internal caller is fail-open, so this only bites
@@ -16,6 +16,15 @@ export declare const asNumber: (v: unknown) => number | undefined;
  * request back — possibly the whole state — so it is never surfaced.
  */
 export declare function describeValidationErrors(detail: readonly unknown[]): string;
+/**
+ * A LiteLLM proxy echoes credentials back in its error texts, in more than one
+ * wording: a masked key plus its hash on a rejected key, the whole key when it
+ * does not look like a LiteLLM key, a key hash on a rate limit. None of it
+ * belongs in an error message or a log, whatever the wording, so the
+ * configured key, anything shaped like a LiteLLM key, any long hex run and any
+ * embedded `data:` URL are all removed.
+ */
+export declare function redactCredentials(message: string, apiKey: string): string;
 /**
  * The shared half of every "System One" decision provider — a model that takes
  * one `state` plus typed questions and returns one typed answer each, with no
@@ -52,7 +61,7 @@ export declare abstract class SystemOneDecisionProvider extends BaseProvider {
     protected missingConfigMessage(): string | undefined;
     protected abstract decisionEndpoint(): string;
     protected abstract decisionHeaders(): Record<string, string>;
-    protected abstract buildDecisionBody(state: DecisionState, questions: Record<string, Record<string, unknown>>, model: string): Record<string, unknown>;
+    protected abstract buildDecisionBody(state: DecisionState, questions: Record<string, Record<string, unknown>>, model: string, media?: DecisionPreparedMedia): Record<string, unknown>;
     protected abstract parseDecisionError(status: number, payload: unknown, requestId: string | undefined): DecisionError;
     protected abstract readRequestId(headers: Headers): string | undefined;
     /**
@@ -87,6 +96,16 @@ export declare abstract class SystemOneDecisionProvider extends BaseProvider {
      * which returns null instead.
      */
     decide(request: DecisionRequest): Promise<DecisionResult>;
+    /**
+     * Turn the request's images and video into data URLs, or refuse it. Refused
+     * as a non-retryable `invalid_request`: resending the same media cannot help.
+     */
+    private prepareMedia;
+    /**
+     * The encoded body, not just the media, is what the server's size limit
+     * applies to.
+     */
+    private assertWithinRequestBytes;
     /**
      * Refuse a request the model cannot read in full. An encoder cuts the state
      * off past its window without saying so, so without this a decision would