@juspay/neurolink 12.46.0 → 12.47.0

package/dist/cli/commands/decide.js

@@ -191,7 +191,7 @@ export const decideCommand = {
         type: "string",
         array: true,
         nargs: 1,
-        describe: "Image for the model to read: a file path or a data: URL. Repeat for several (XOR and Perplexity take up to 8)",
+        describe: "Image for the model to read: a file path or a data: URL. Repeat for several (XOR and Perplexity take up to 8, Cloudflare Clef up to 4)",
     })
         .option("video", {
         type: "string",
@@ -217,7 +217,7 @@ export const decideCommand = {
     })
         .example('$0 decide "Refund request for a damaged item" --questions \'{"urgent":{"type":"boolean","instructions":"Is this urgent?"}}\'', "Ask a single yes/no question")
         .example("$0 decide --state-file ticket.json --questions-file questions.json --format json", "Read state and questions from files, emit raw JSON")
-        .example('$0 decide "What color is this?" --provider xor --image ./photo.png --questions \'{"color":{"type":"choice","instructions":"What color is the image?","criteria":{"red":"red","blue":"blue"}}}\'', "Ask about an image (XOR and Perplexity read images)"),
+        .example('$0 decide "What color is this?" --provider xor --image ./photo.png --questions \'{"color":{"type":"choice","instructions":"What color is the image?","criteria":{"red":"red","blue":"blue"}}}\'', "Ask about an image (XOR, Perplexity and Cloudflare Clef read images)"),
     handler: async (argv) => {
         const outputFormat = argv.format ?? "text";
         // --- Validate before any provider work ---------------------------------

package/dist/cli/commands/setup.js

@@ -20,7 +20,7 @@ import { handleGCPSetup } from "./setup-gcp.js";
 import { handleHuggingFaceSetup } from "./setup-huggingface.js";
 import { handleMistralSetup } from "./setup-mistral.js";
 import { PROVIDER_DESCRIPTORS_BY_NAME } from "../../factories/providerDescriptors.js";
-import { createCohereConfig, createDeepSeekConfig, createIdeogramConfig, createJinaConfig, createNvidiaNimConfig, createOpenAICompatibleConfig, createRecraftConfig, createReplicateConfig, createStabilityConfig, createVoyageConfig, createTypeSafeConfig, createLayaConfig, createXorConfig, createPerplexityDeciderConfig, satisfiesFallbacks, } from "../../utils/providerConfig.js";
+import { createCohereConfig, createDeepSeekConfig, createIdeogramConfig, createJinaConfig, createNvidiaNimConfig, createOpenAICompatibleConfig, createRecraftConfig, createReplicateConfig, createStabilityConfig, createVoyageConfig, createTypeSafeConfig, createLayaConfig, createXorConfig, createPerplexityDeciderConfig, createCloudflareClefConfig, satisfiesFallbacks, } from "../../utils/providerConfig.js";
 import { getCatalogJsonEntries, buildCatalogConfigOptions, } from "../../providers/catalog/loader.js";
 // Provider information database
 const PROVIDERS = [
@@ -172,6 +172,7 @@ export const EXTRA_PROVIDER_CONFIGS = {
     laya: createLayaConfig(),
     xor: createXorConfig(),
     "perplexity-decider": createPerplexityDeciderConfig(),
+    "cloudflare-clef": createCloudflareClefConfig(),
     ...Object.fromEntries(getCatalogJsonEntries()
         .filter((e) => e.id !== "mistral")
         .map((e) => [e.id, buildCatalogConfigOptions(e)])),

package/dist/cli/factories/commandFactory.js

@@ -616,7 +616,7 @@ export class CLICommandFactory {
         },
         classifierStrategy: {
             type: "string",
-            description: "Classifier strategy: 'auto' (default — 'jev' when a decision provider is configured, such as TYPESAFE_API_KEY, LAYA_API_KEY with LAYA_BASE_URL, XOR_API_KEY with XOR_BASE_URL, or PERPLEXITY_API_KEY, else 'heuristic'), 'heuristic' (no LLM), 'llm' (a cheap model picks per prompt), or 'jev' (a System One decision model — TypeSafe Jev, Laya, XOR or Perplexity — with calibrated confidence).",
+            description: "Classifier strategy: 'auto' (default — 'jev' when a decision provider is configured, such as TYPESAFE_API_KEY, LAYA_API_KEY with LAYA_BASE_URL, XOR_API_KEY with XOR_BASE_URL, PERPLEXITY_API_KEY, or CLOUDFLARE_API_KEY with CLOUDFLARE_ACCOUNT_ID, else 'heuristic'), 'heuristic' (no LLM), 'llm' (a cheap model picks per prompt), or 'jev' (a System One decision model — TypeSafe Jev, Laya, XOR, Perplexity or Cloudflare Clef — with calibrated confidence).",
             choices: ["auto", "heuristic", "llm", "jev"],
             alias: "classifier-strategy",
         },

package/dist/constants/enums.d.ts

@@ -115,6 +115,12 @@ export declare enum AIProviderName {
      * inference type only. Distinct from `PERPLEXITY`, the Sonar text provider.
      */
     PERPLEXITY_DECIDER = "perplexity-decider",
+    /**
+     * Cloudflare Clef (`@cf/cloudflare/clef`, `@cf/cloudflare/clef-flash`) on
+     * Workers AI — serves the `decide` inference type only. Distinct from
+     * `CLOUDFLARE`, the Workers AI text provider.
+     */
+    CLOUDFLARE_CLEF = "cloudflare-clef",
     AUTO = "auto"
 }
 /**
@@ -1781,3 +1787,13 @@ export declare enum XorModels {
 export declare enum PerplexityDeciderModels {
     PPLX_DECIDER_V1_27B = "pplx-decider-v1-27b"
 }
+/**
+ * Cloudflare Clef decision models, named as the Workers AI API names them in
+ * the request body (the path adds the `@cf/cloudflare/` prefix). Hand-written:
+ * Clef is a Tier-3 provider, so it is not in the provider catalog and codegen
+ * never touches this. `CLEF` is the 27B model, `CLEF_FLASH` the 9B one.
+ */
+export declare enum CloudflareClefModels {
+    CLEF = "clef",
+    CLEF_FLASH = "clef-flash"
+}

package/dist/constants/enums.js

@@ -121,6 +121,12 @@ export var AIProviderName;
      * inference type only. Distinct from `PERPLEXITY`, the Sonar text provider.
      */
     AIProviderName["PERPLEXITY_DECIDER"] = "perplexity-decider";
+    /**
+     * Cloudflare Clef (`@cf/cloudflare/clef`, `@cf/cloudflare/clef-flash`) on
+     * Workers AI — serves the `decide` inference type only. Distinct from
+     * `CLOUDFLARE`, the Workers AI text provider.
+     */
+    AIProviderName["CLOUDFLARE_CLEF"] = "cloudflare-clef";
     AIProviderName["AUTO"] = "auto";
 })(AIProviderName || (AIProviderName = {}));
 /**
@@ -2103,3 +2109,14 @@ export var PerplexityDeciderModels;
 (function (PerplexityDeciderModels) {
     PerplexityDeciderModels["PPLX_DECIDER_V1_27B"] = "pplx-decider-v1-27b";
 })(PerplexityDeciderModels || (PerplexityDeciderModels = {}));
+/**
+ * Cloudflare Clef decision models, named as the Workers AI API names them in
+ * the request body (the path adds the `@cf/cloudflare/` prefix). Hand-written:
+ * Clef is a Tier-3 provider, so it is not in the provider catalog and codegen
+ * never touches this. `CLEF` is the 27B model, `CLEF_FLASH` the 9B one.
+ */
+export var CloudflareClefModels;
+(function (CloudflareClefModels) {
+    CloudflareClefModels["CLEF"] = "clef";
+    CloudflareClefModels["CLEF_FLASH"] = "clef-flash";
+})(CloudflareClefModels || (CloudflareClefModels = {}));

package/dist/factories/providerDescriptors.js

@@ -1,5 +1,5 @@
 import { AIProviderName } from "../constants/enums.js";
-import { GoogleAIModels, OpenAIModels, AnthropicModels, VertexModels, OllamaModels, LiteLLMModels, NvidiaNimModels, OpenRouterModels, CohereModels, VoyageModels, TypeSafeModels, LayaModels, XorModels, PerplexityDeciderModels, JinaModels, StabilityModels, IdeogramModels, RecraftModels, ReplicateModels, } from "../constants/enums.js";
+import { GoogleAIModels, OpenAIModels, AnthropicModels, VertexModels, OllamaModels, LiteLLMModels, NvidiaNimModels, OpenRouterModels, CohereModels, VoyageModels, TypeSafeModels, LayaModels, XorModels, PerplexityDeciderModels, CloudflareClefModels, JinaModels, StabilityModels, IdeogramModels, RecraftModels, ReplicateModels, } from "../constants/enums.js";
 import { API_KEY_FORMATS } from "../utils/providerConfig.js";
 import { getCatalogJsonEntries, catalogCredentialsKey, catalogEnvVar, } from "../providers/catalog/loader.js";
 import { DEFAULT_INFERENCE_KINDS } from "../types/index.js";
@@ -451,7 +451,8 @@ const HAND_DESCRIPTORS = [
         timeouts: { decideMs: 5000 },
         setupUrl: "https://console.typesafe.ai/keys",
     },
-    // Laya MUST stay after TypeSafe, XOR after Laya, and Perplexity after XOR.
+    // Laya MUST stay after TypeSafe, XOR after Laya, Perplexity after XOR, and
+    // Cloudflare Clef after Perplexity.
     // resolveDefaultDecisionProvider() returns the first configured
     // DECISION_PROVIDERS entry, in this order, so a host configured for several
     // keeps Jev for every built-in consumer and reaches the others only by
@@ -606,6 +607,79 @@ const HAND_DESCRIPTORS = [
         },
         setupUrl: "https://console.perplexity.ai",
     },
+    {
+        name: AIProviderName.CLOUDFLARE_CLEF,
+        aliases: [],
+        credentialsKey: "cloudflareClef",
+        envVars: {
+            // The same token and account id the `cloudflare` text provider reads, so
+            // ambient Workers AI settings configure this provider too. It sits last
+            // in this list, which is what keeps that from displacing any other
+            // decision provider a host has configured.
+            apiKey: "CLOUDFLARE_API_KEY",
+            // Cloudflare's own API is the endpoint, so a base URL is optional; but
+            // the path carries the account id, so a token alone is useless. Both are
+            // required for it to count as configured, from the environment or from
+            // credentials.cloudflareClef.
+            extraRequired: ["CLOUDFLARE_ACCOUNT_ID"],
+            extraRequiredCredentialFields: { CLOUDFLARE_ACCOUNT_ID: "accountId" },
+            baseURL: "CLOUDFLARE_CLEF_BASE_URL",
+            model: "CLOUDFLARE_CLEF_MODEL",
+        },
+        defaultModel: CloudflareClefModels.CLEF,
+        // Serves only `decide`, like the other decision providers — the one
+        // declaration that keeps it out of every generation code path, and out of
+        // the way of the `cloudflare` text provider.
+        inferenceKinds: ["decide"],
+        toolSupport: "none",
+        localRuntime: false,
+        healthCheck: "env-only",
+        // Deliberately NO autoSelectPriority / autoSelectPreference /
+        // defaultHealthSweepPriority, for the same reason as TypeSafe above.
+        //
+        // Measured 2026-10-03: 0.3 to 1.0 s for a small request, 1.1 s for 64 questions on
+        // clef-flash and 1.3 s on clef, and 2.2 s at most for any of 60 requests
+        // sent at once. On 2026-10-04, 64 questions took 1.5 s (flash) / 2.3 s (clef).
+        // 5s covers those observations and keeps a fail-open consumer
+        // from waiting on a stuck call.
+        timeouts: { decideMs: 5_000 },
+        // The Workers AI endpoint ignores state text past about 2,048 tokens
+        // (hosted service or model: unknown), despite the documented 64K. The local
+        // 1,500-token estimate refuses before every measured cut. On 2026-10-04,
+        // both models read facts at the original clef-flash lower bounds for logs,
+        // number lists, digit arrays and compact JSON, but not about 2.5% further on;
+        // English prose and random CJK already matched on both. Digits cost 1,
+        // ASCII symbols 0.75, BMP non-ASCII 1.5 and astral characters 3 tokens.
+        // Natural Chinese, Japanese, Korean and Hindi prose and emoji-rich English
+        // were also safe under those rates on clef. A many-key object cut between
+        // 128 and 134 preceding keys on both models: its lower bound was 4,883
+        // compact-JSON characters, estimated at 2,299 tokens. The probe used an
+        // explicit field-name question and zero-padded keys together after the
+        // control failed three times. It then passed; necessity was not established.
+        // Other object shapes and Unicode sequences may differ.
+        decisionLimits: {
+            maxStateTokens: 1_500,
+            maxQuestions: 64,
+            nonAsciiTokensPerChar: 1.5,
+            digitTokensPerChar: 1,
+            symbolTokensPerChar: 0.75,
+            astralTokensPerChar: 3,
+            // Images only. Exactly four tiny images succeeded and five were refused
+            // on both models. image/jpg also succeeded and is normalized to JPEG.
+            // Retain the conservative 256,000-byte encoded-body cap: on 2026-10-04
+            // both models accepted 520,000 text characters and refused 525,000 with
+            // 413/code 5021. On 2026-10-03, clef-flash accepted 262,000 and refused
+            // 270,000. Estimates match encoded body characters / 4, rounded up. The
+            // threshold moved from 65,527 accepted / 67,527 refused to 130,026 /
+            // 131,276 (clef) and 130,027 / 131,277 (flash); errors still print 65,536.
+            // Inference: the new interval contains 131,072 (twice the printed
+            // figure); reason unknown.
+            // The new image-byte ceiling was not measured; the old 195/202 KB PNG boundary
+            // is historical. See the guide for exact model and date coverage.
+            media: { maxImages: 4, video: false, maxRequestBytes: 256_000 },
+        },
+        setupUrl: "https://dash.cloudflare.com/profile/api-tokens",
+    },
 ];
 /**
  * Builds a ProviderDescriptor for every JSON-catalog provider. Every field
@@ -724,9 +798,14 @@ function isDecisionProviderConfigured(descriptor, credentials) {
     const hasKey = [descriptor.envVars.apiKey, ...(descriptor.envVars.fallbacks ?? [])].some(inEnv) ||
         isSet(slice?.apiKey) ||
         isSet(slice?.gatewayApiKey);
-    // A required base URL can also come from credentials.<key>.baseURL.
-    const hasRequired = (descriptor.envVars.extraRequired ?? []).every((name) => inEnv(name) ||
-        (name === descriptor.envVars.baseURL && isSet(slice?.baseURL)));
+    // A required base URL can also come from credentials.<key>.baseURL, and any
+    // other required value the descriptor maps to a field of that slice.
+    const hasRequired = (descriptor.envVars.extraRequired ?? []).every((name) => {
+        const field = descriptor.envVars.extraRequiredCredentialFields?.[name];
+        return (inEnv(name) ||
+            (name === descriptor.envVars.baseURL && isSet(slice?.baseURL)) ||
+            (field !== undefined && isSet(slice?.[field])));
+    });
     return hasKey && hasRequired;
 }
 /**

package/dist/factories/providerRegistry.js

@@ -1,6 +1,6 @@
 import { ProviderFactory } from "./providerFactory.js";
 import { logger } from "../utils/logger.js";
-import { AIProviderName, GoogleAIModels, OpenAIModels, AnthropicModels, VertexModels, OllamaModels, LiteLLMModels, NvidiaNimModels, OpenRouterModels, CohereModels, VoyageModels, JinaModels, StabilityModels, IdeogramModels, RecraftModels, TypeSafeModels, LayaModels, XorModels, PerplexityDeciderModels, ReplicateModels, } from "../constants/enums.js";
+import { AIProviderName, GoogleAIModels, OpenAIModels, AnthropicModels, VertexModels, OllamaModels, LiteLLMModels, NvidiaNimModels, OpenRouterModels, CohereModels, VoyageModels, JinaModels, StabilityModels, IdeogramModels, RecraftModels, TypeSafeModels, LayaModels, XorModels, PerplexityDeciderModels, CloudflareClefModels, ReplicateModels, } from "../constants/enums.js";
 import { PROVIDER_DESCRIPTORS_BY_NAME } from "./providerDescriptors.js";
 import { OPENAI_COMPAT_CATALOG } from "../providers/openaiCompatCatalog.js";
 import { providerChoicesFor } from "./mediaHandlerCatalog.js";
@@ -260,6 +260,15 @@ export class ProviderRegistry {
                 return new PerplexityDeciderProvider(modelName, sdk, undefined, perplexityDeciderCreds);
             }, process.env.PERPLEXITY_DECIDER_MODEL ||
                 PerplexityDeciderModels.PPLX_DECIDER_V1_27B, [], PROVIDER_DESCRIPTORS_BY_NAME.get(AIProviderName.PERPLEXITY_DECIDER));
+            // Register Cloudflare Clef — a `decide` provider reached through the
+            // Workers AI REST API. Its descriptor declares inferenceKinds:
+            // ["decide"], so nothing in the generation fallback chain can reach it,
+            // and it is registered apart from the `cloudflare` text provider.
+            ProviderFactory.registerProvider(AIProviderName.CLOUDFLARE_CLEF, async (modelName, _providerName, sdk, _region, credentials) => {
+                const cloudflareClefCreds = credentials;
+                const { CloudflareClefProvider } = await import("../providers/cloudflareClef.js");
+                return new CloudflareClefProvider(modelName, sdk, undefined, cloudflareClefCreds);
+            }, process.env.CLOUDFLARE_CLEF_MODEL || CloudflareClefModels.CLEF, [], PROVIDER_DESCRIPTORS_BY_NAME.get(AIProviderName.CLOUDFLARE_CLEF));
             logger.debug("All AI providers registered successfully");
             // ===== MEDIA HANDLER REGISTRATION =====
             // Single registration path (Task 11): each ecosystem barrel (voice,

package/dist/models/manifestRegistry.js

@@ -23,6 +23,7 @@ import { typesafeManifest } from "./manifests/typesafe.js";
 import { layaManifest } from "./manifests/laya.js";
 import { xorManifest } from "./manifests/xor.js";
 import { perplexityDeciderManifest } from "./manifests/perplexityDecider.js";
+import { cloudflareClefManifest } from "./manifests/cloudflareClef.js";
 import { cohereManifest } from "./manifests/cohere.js";
 import { togetherAiManifest } from "./manifests/together-ai.js";
 import { fireworksManifest } from "./manifests/fireworks.js";
@@ -124,6 +125,7 @@ export const MANIFEST_REGISTRY = {
     laya: layaManifest,
     xor: xorManifest,
     "perplexity-decider": perplexityDeciderManifest,
+    "cloudflare-clef": cloudflareClefManifest,
     cerebras: catalogManifest("cerebras"),
     sambanova: catalogManifest("sambanova"),
     cohere: cohereManifest,

package/dist/models/manifests/cloudflareClef.d.ts

@@ -0,0 +1,16 @@
+import type { ProviderModelManifest } from "../../types/index.js";
+/**
+ * Cloudflare Clef on Workers AI — the `decide` inference type, not text
+ * generation, and not the Workers AI text models of the `cloudflare` provider.
+ *
+ * `contextWindow` is the figure Cloudflare documents (65,536 tokens). The
+ * Workers AI endpoint ignores state text past about 2,048 tokens without an
+ * error (hosted service or model: unknown), so NeuroLink enforces the limit on
+ * the descriptor's `decisionLimits`, not this. `vision` describes `generate()`
+ * input, which this provider does not serve; its image input is
+ * `DecisionRequest.images`.
+ *
+ * `maxOutputTokens` is required by the manifest type but has no honest value
+ * for a model that emits no text, so a small non-zero figure is used.
+ */
+export declare const cloudflareClefManifest: ProviderModelManifest;

package/dist/models/manifests/cloudflareClef.js

@@ -0,0 +1,42 @@
+/**
+ * Cloudflare Clef on Workers AI — the `decide` inference type, not text
+ * generation, and not the Workers AI text models of the `cloudflare` provider.
+ *
+ * `contextWindow` is the figure Cloudflare documents (65,536 tokens). The
+ * Workers AI endpoint ignores state text past about 2,048 tokens without an
+ * error (hosted service or model: unknown), so NeuroLink enforces the limit on
+ * the descriptor's `decisionLimits`, not this. `vision` describes `generate()`
+ * input, which this provider does not serve; its image input is
+ * `DecisionRequest.images`.
+ *
+ * `maxOutputTokens` is required by the manifest type but has no honest value
+ * for a model that emits no text, so a small non-zero figure is used.
+ */
+export const cloudflareClefManifest = {
+    defaultContextWindow: 65_536,
+    models: {
+        _default: {
+            aliases: [],
+            contextWindow: 65_536,
+            maxOutputTokens: 256,
+            vision: false,
+            functionCalling: false,
+        },
+        clef: {
+            aliases: ["@cf/cloudflare/clef"],
+            displayName: "Cloudflare Clef (27B)",
+            contextWindow: 65_536,
+            maxOutputTokens: 256,
+            vision: false,
+            functionCalling: false,
+        },
+        "clef-flash": {
+            aliases: ["@cf/cloudflare/clef-flash"],
+            displayName: "Cloudflare Clef-flash (9B)",
+            contextWindow: 65_536,
+            maxOutputTokens: 256,
+            vision: false,
+            functionCalling: false,
+        },
+    },
+};

package/dist/providers/anthropic/client.js

@@ -1432,7 +1432,12 @@ export class AnthropicProvider extends BaseProvider {
                 message: (ctx) => `Connection error: ${ctx.message}`,
             },
             {
-                match: (ctx) => /500|502|503|504|server error/i.test(ctx.message),
+                // Match the shared 5xx predicate: HTTP status or a bounded phrase,
+                // rather than digits embedded in an unrelated value.
+                match: (ctx) => (ctx.statusCode !== undefined &&
+                    ctx.statusCode >= 500 &&
+                    ctx.statusCode <= 599) ||
+                    /server error|bad gateway|service unavailable|gateway timeout|\berror\b\D{0,12}\b5\d\d\b|\b5\d\d\b\D{0,12}\berror\b|\bstatus(?:\s*code)?\b\D{0,12}\b5\d\d\b/i.test(ctx.message),
                 errorClass: ProviderError,
                 message: (ctx) => `Server error: ${ctx.message}`,
             },

package/dist/providers/catalog/huggingface.json

@@ -373,7 +373,8 @@
             "message": "HuggingFace model '{model}' not found.\n\nSuggestions:\n1. Check model name spelling\n2. Ensure an Inference Provider serves the model (https://huggingface.co/inference/models)\n3. For tool calling, use: meta-llama/Llama-3.3-70B-Instruct, zai-org/GLM-5 or Qwen/Qwen3.5-397B-A17B"
         },
         {
-            "pattern": "function|tool",
+            "pattern": "\\b(?:(?:tool|function)s?(?:\\s*/\\s*(?:tool|function)s?)?[ _-]?call(?:s|ing)?|tool_choice|tools? (?:is|are) not supported|(?:does|do) not support tools?)\\b",
+            "patternStatuses": [400, 422],
             "class": "provider",
             "message": "HuggingFace tool calling error: {message}\n\nNotes:\n1. Ensure you're using a tool-capable model, e.g. meta-llama/Llama-3.3-70B-Instruct, zai-org/GLM-5 or Qwen/Qwen3.5-397B-A17B\n2. Check that your model supports function calling\n3. Verify tool schema format is correct"
         }

package/dist/providers/catalog/loader.js

@@ -66,7 +66,11 @@ function buildErrorRules(entry) {
         const needsContext = rule.message.includes("{model}") || rule.message.includes("{message}");
         return {
             match: (ctx) => (rule.status !== undefined && ctx.statusCode === rule.status) ||
-                (regex !== undefined && regex.test(ctx.message)),
+                (regex !== undefined &&
+                    (rule.patternStatuses === undefined ||
+                        (ctx.statusCode !== undefined &&
+                            rule.patternStatuses.includes(ctx.statusCode))) &&
+                    regex.test(ctx.message)),
             errorClass: ERROR_CLASS_MAP[rule.class],
             message: needsContext
                 ? (ctx) => interpolate(rule.message, entry, ctx.modelName, ctx.message)

package/dist/providers/catalog/schema.d.ts

@@ -71,6 +71,7 @@ export declare const providerCatalogJsonSchema: z.ZodObject<{
     errorRules: z.ZodArray<z.ZodObject<{
         status: z.ZodOptional<z.ZodNumber>;
         pattern: z.ZodOptional<z.ZodString>;
+        patternStatuses: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
         class: z.ZodEnum<{
             network: "network";
             provider: "provider";

package/dist/providers/catalog/schema.js

@@ -111,6 +111,7 @@ const catalogErrorRuleJsonSchema = z
     .strictObject({
     status: z.number().optional(),
     pattern: z.string().optional(),
+    patternStatuses: z.array(z.number().int()).min(1).optional(),
     class: catalogErrorRuleClassSchema,
     message: z.string(),
 })
@@ -122,6 +123,13 @@ const catalogErrorRuleJsonSchema = z
             message: "errorRules entry requires status or pattern",
         });
     }
+    if (rule.patternStatuses !== undefined && rule.pattern === undefined) {
+        ctx.addIssue({
+            code: "custom",
+            path: ["patternStatuses"],
+            message: "errorRules patternStatuses requires pattern",
+        });
+    }
     if (rule.pattern !== undefined) {
         try {
             new RegExp(rule.pattern, "i");

package/dist/providers/cloudflareClef.d.ts

@@ -0,0 +1,52 @@
+import type { DecisionError, DecisionPreparedMedia, DecisionState, NeurolinkCredentials } from "../types/index.js";
+import { SystemOneDecisionProvider } from "./systemOneDecision.js";
+/**
+ * Cloudflare Clef — the `decide` inference type only.
+ *
+ * `@cf/cloudflare/clef` (27B) and `@cf/cloudflare/clef-flash` (9B) answer the
+ * same typed `noul` / `choice` / `score` questions as the other decision
+ * providers, follow the System One wire, and read images. They are reached
+ * through the Workers AI REST API, which wraps every answer in Cloudflare's own
+ * `{ result, success, errors }` envelope and puts the model in the URL path.
+ *
+ * The token and account id are the ones the Cloudflare Workers AI text provider
+ * reads (`CLOUDFLARE_API_KEY`, `CLOUDFLARE_ACCOUNT_ID`), so a host that has
+ * configured that provider has also configured this one.
+ *
+ * The Workers AI endpoint ignores text past about 2,048 tokens, far below
+ * the documented 64K (hosted service or model: unknown). See `decisionLimits`
+ * on the descriptor for the measured figures.
+ *
+ * @see https://developers.cloudflare.com/workers-ai/models/clef/
+ */
+export declare class CloudflareClefProvider extends SystemOneDecisionProvider {
+    private readonly apiKey;
+    private readonly accountId;
+    private readonly baseURL;
+    constructor(modelName?: string, sdk?: unknown, _region?: string, credentials?: NeurolinkCredentials["cloudflareClef"]);
+    protected getDefaultModel(): string;
+    protected vendorLabel(): string;
+    protected vendorDisplayName(): string;
+    protected decisionApiKey(): string;
+    protected missingKeyMessage(): string;
+    protected missingConfigMessage(): string | undefined;
+    /** The model is part of the path, so the endpoint depends on the model asked for. */
+    protected decisionEndpoint(model: string): string;
+    protected decisionHeaders(): Record<string, string>;
+    /**
+     * Images travel in their own `images` array, as `data:` URLs, placed before
+     * the state by the server. `model` is sent although the path already names
+     * it: the API documents it as required, and refuses a body whose `model`
+     * differs from the path.
+     */
+    protected buildDecisionBody(state: DecisionState, questions: Record<string, Record<string, unknown>>, model: string, media?: DecisionPreparedMedia): Record<string, unknown>;
+    /** A success is `{ result: { model, answers, usage }, success: true }`. */
+    protected readDecisionPayload(payload: unknown): unknown;
+    protected parseDecisionError(status: number, payload: unknown, requestId: string | undefined): DecisionError;
+    /**
+     * `cf-ai-req-id` is on every answer that reached the model, success or
+     * refusal. A 401 and a wrong-path 400 never reach it, so they carry only the
+     * edge's `cf-ray`.
+     */
+    protected readRequestId(headers: Headers): string | undefined;
+}