@juspay/neurolink 12.47.4 → 12.47.5

package/dist/localUsage/copilotCliReader.js

@@ -125,7 +125,7 @@ export async function createCopilotCliReader() {
                 errors.push({
                     cliId: CLI_ID,
                     filePath: dbPath,
-                    message: `node:sqlite unavailable on this runtime: ${error instanceof Error ? error.message : String(error)}`,
+                    message: `node:sqlite unavailable on this runtime: ${error instanceof Error ? error.message : String(error)} (needs Node >=22.13.0; on 22.5-22.12 pass --experimental-sqlite)`,
                 });
                 return { cliId: CLI_ID, totals, filesScanned: 0, errors };
             }

package/dist/localUsage/cursorReader.js

@@ -375,7 +375,7 @@ export async function createCursorReader() {
                 errors.push({
                     cliId: CLI_ID,
                     filePath: chatsRoot(),
-                    message: `node:sqlite unavailable on this runtime: ${error instanceof Error ? error.message : String(error)}`,
+                    message: `node:sqlite unavailable on this runtime: ${error instanceof Error ? error.message : String(error)} (needs Node >=22.13.0; on 22.5-22.12 pass --experimental-sqlite)`,
                 });
                 return { cliId: CLI_ID, totals, filesScanned: 0, errors };
             }

package/dist/localUsage/hermesReader.js

@@ -318,7 +318,7 @@ export async function createHermesReader() {
                 errors.push({
                     cliId: CLI_ID,
                     filePath: hermesHome(),
-                    message: `node:sqlite unavailable on this runtime: ${error instanceof Error ? error.message : String(error)}`,
+                    message: `node:sqlite unavailable on this runtime: ${error instanceof Error ? error.message : String(error)} (needs Node >=22.13.0; on 22.5-22.12 pass --experimental-sqlite)`,
                 });
                 return { cliId: CLI_ID, totals, filesScanned: 0, errors };
             }

package/dist/localUsage/openCodeReader.js

@@ -80,10 +80,11 @@ export async function createOpenCodeReader() {
             const errors = [];
             const models = new Set();
             const dbPath = databasePath();
-            // `node:sqlite` is built in from Node 22 but still flagged experimental,
-            // so it can be absent or change shape. Imported lazily and behind a
-            // try/catch: a runtime without it must degrade to a reported failure for
-            // this one reader, not take down a scan of all the others.
+            // `node:sqlite` arrived in Node 22.5.0 behind `--experimental-sqlite`, was
+            // unflagged in 22.13.0 and is still marked experimental, so it can be
+            // absent or change shape. Imported lazily and behind a try/catch: a
+            // runtime without it must degrade to a reported failure for this one
+            // reader, not take down a scan of all the others.
             let DatabaseSync;
             try {
                 const sqlite = await import("node:sqlite");
@@ -102,7 +103,7 @@ export async function createOpenCodeReader() {
                 errors.push({
                     cliId: CLI_ID,
                     filePath: dbPath,
-                    message: `node:sqlite unavailable on this runtime: ${error instanceof Error ? error.message : String(error)}`,
+                    message: `node:sqlite unavailable on this runtime: ${error instanceof Error ? error.message : String(error)} (needs Node >=22.13.0; on 22.5-22.12 pass --experimental-sqlite)`,
                 });
                 return { cliId: CLI_ID, totals, filesScanned: 0, errors };
             }

package/dist/neurolink.d.ts

@@ -129,7 +129,7 @@ export declare class NeuroLink {
      * request dedup — BZ-664's actual goal — is untouched: the first
      * occurrence in a request may still be served from cache. Request-scoped
      * like _disableToolCacheForCurrentRequest above (assigned a fresh Set at
-     * request start so the router's save/restore-by-reference pattern works).
+     * request start so `preservingTurnState`'s save/restore-by-reference works).
      */
     private _toolCacheKeysServedThisRequest;
     /** True only while a generate()/stream() turn is executing — the
@@ -1094,6 +1094,18 @@ export declare class NeuroLink {
      */
     private streamWithIterationFallback;
     private executeStreamRequest;
+    /**
+     * Runs an internal call that re-enters the public generate() (the tool-routing
+     * router, the classifier router) without ending the outer turn's tool-cache
+     * state. generate()'s own `finally` resets these fields, so the outer turn
+     * would otherwise lose its repeat-call cache bypass for every later tool
+     * call. Restored by reference: the nested call assigns a new Set rather than
+     * mutating the outer one.
+     *
+     * Covers one turn re-entering itself. Two concurrent turns on one instance
+     * still share these fields.
+     */
+    private preservingTurnState;
     /**
      * Pre-call tool routing for both stream() and generate() turns: runs the
      * router LLM once per turn and appends the unpicked servers' registered tool

package/dist/neurolink.js

@@ -433,7 +433,7 @@ export class NeuroLink {
      * request dedup — BZ-664's actual goal — is untouched: the first
      * occurrence in a request may still be served from cache. Request-scoped
      * like _disableToolCacheForCurrentRequest above (assigned a fresh Set at
-     * request start so the router's save/restore-by-reference pattern works).
+     * request start so `preservingTurnState`'s save/restore-by-reference works).
      */
     _toolCacheKeysServedThisRequest = new Set();
     /** True only while a generate()/stream() turn is executing — the
@@ -994,9 +994,9 @@ export class NeuroLink {
         // generate() (marked so it never recursively re-routes). Fails open.
         this.classifierRouter = config?.classifierRouter?.enabled
             ? new ClassifierRouter(config.classifierRouter, {
-                generate: (genOptions) => this.generate({
+                generate: (genOptions) => this.preservingTurnState(() => this.generate({
                     ...genOptions,
-                }),
+                })),
                 // Fail-open by construction: tryDecide returns null rather than
                 // throwing, so an absent or broken decision provider leaves routing
                 // exactly as it was.
@@ -7265,6 +7265,30 @@ Current user's request: ${currentInput}`;
             throw error;
         }
     }
+    /**
+     * Runs an internal call that re-enters the public generate() (the tool-routing
+     * router, the classifier router) without ending the outer turn's tool-cache
+     * state. generate()'s own `finally` resets these fields, so the outer turn
+     * would otherwise lose its repeat-call cache bypass for every later tool
+     * call. Restored by reference: the nested call assigns a new Set rather than
+     * mutating the outer one.
+     *
+     * Covers one turn re-entering itself. Two concurrent turns on one instance
+     * still share these fields.
+     */
+    async preservingTurnState(run) {
+        const disableToolCache = this._disableToolCacheForCurrentRequest;
+        const keysServed = this._toolCacheKeysServedThisRequest;
+        const turnActive = this._generationTurnActive;
+        try {
+            return await run();
+        }
+        finally {
+            this._disableToolCacheForCurrentRequest = disableToolCache;
+            this._toolCacheKeysServedThisRequest = keysServed;
+            this._generationTurnActive = turnActive;
+        }
+    }
     /**
      * Pre-call tool routing for both stream() and generate() turns: runs the
      * router LLM once per turn and appends the unpicked servers' registered tool
@@ -7420,104 +7444,92 @@ Current user's request: ${currentInput}`;
                     return;
                 }
             }
-            // The router call below re-enters the public generate(), whose finally
-            // block resets _disableToolCacheForCurrentRequest to false. That flag is
-            // turn-scoped (set at the top of this turn) and read by the main tool
-            // execution path that runs after routing, so save it before the router
-            // call and restore it afterward to keep the turn's cache setting intact.
-            const cacheDisabledForCurrentRequest = this._disableToolCacheForCurrentRequest;
             let routedExcludeTools;
             let resolvedDecision;
-            try {
-                // Intercept the decision so we can store it in the cache.
-                const captureDecision = (decision) => {
-                    resolvedDecision = decision;
-                    emitDecision(decision);
-                };
-                // --- ITEM B: build the embedFn for the L2 embedding fast-path ---
-                // The vector cache is persisted at the NeuroLink instance level so
-                // tool embedding vectors are computed once and reused across turns
-                // (Finding 1 fix). It is cleared by setToolRoutingServers() when the
-                // catalog changes so stale vectors are never used after an update.
-                let routingEmbedFn;
-                const embeddingCfg = routingConfig.embedding;
-                if (embeddingCfg?.enabled === true) {
-                    try {
-                        // Resolve the embedding provider: use the explicitly configured one
-                        // if present, otherwise fall back to the stream/generate call's
-                        // provider. The factory call is wrapped in try/catch so a provider
-                        // that doesn't support embedMany (it throws at call time, not
-                        // construction time) fails open when routingEmbedFn is invoked.
-                        const embProviderName = embeddingCfg.provider ??
-                            (options.provider && options.provider !== "auto"
-                                ? options.provider
-                                : undefined) ??
-                            routingConfig.routerModel?.provider;
-                        if (embProviderName) {
-                            const embProvider = await AIProviderFactory.createProvider(embProviderName, embeddingCfg.model, true, this, undefined, this.resolveCredentials(options.credentials));
-                            // Bind embedMany with the configured model (may be undefined —
-                            // the provider uses its default embedding model in that case).
-                            routingEmbedFn = (texts) => withTimeout(embProvider.embedMany(texts, embeddingCfg.model), embeddingCfg.timeoutMs ?? 10000);
-                            // Lazy-init the persistent vector cache for this instance.
-                            // Subsequent turns reuse the same Map so text→vector lookups
-                            // already populated from earlier turns are served from memory.
-                            if (!this.toolRoutingVectorCache) {
-                                this.toolRoutingVectorCache = new Map();
-                            }
+            // Intercept the decision so we can store it in the cache.
+            const captureDecision = (decision) => {
+                resolvedDecision = decision;
+                emitDecision(decision);
+            };
+            // --- ITEM B: build the embedFn for the L2 embedding fast-path ---
+            // The vector cache is persisted at the NeuroLink instance level so
+            // tool embedding vectors are computed once and reused across turns
+            // (Finding 1 fix). It is cleared by setToolRoutingServers() when the
+            // catalog changes so stale vectors are never used after an update.
+            let routingEmbedFn;
+            const embeddingCfg = routingConfig.embedding;
+            if (embeddingCfg?.enabled === true) {
+                try {
+                    // Resolve the embedding provider: use the explicitly configured one
+                    // if present, otherwise fall back to the stream/generate call's
+                    // provider. The factory call is wrapped in try/catch so a provider
+                    // that doesn't support embedMany (it throws at call time, not
+                    // construction time) fails open when routingEmbedFn is invoked.
+                    const embProviderName = embeddingCfg.provider ??
+                        (options.provider && options.provider !== "auto"
+                            ? options.provider
+                            : undefined) ??
+                        routingConfig.routerModel?.provider;
+                    if (embProviderName) {
+                        const embProvider = await AIProviderFactory.createProvider(embProviderName, embeddingCfg.model, true, this, undefined, this.resolveCredentials(options.credentials));
+                        // Bind embedMany with the configured model (may be undefined —
+                        // the provider uses its default embedding model in that case).
+                        routingEmbedFn = (texts) => withTimeout(embProvider.embedMany(texts, embeddingCfg.model), embeddingCfg.timeoutMs ?? 10000);
+                        // Lazy-init the persistent vector cache for this instance.
+                        // Subsequent turns reuse the same Map so text→vector lookups
+                        // already populated from earlier turns are served from memory.
+                        if (!this.toolRoutingVectorCache) {
+                            this.toolRoutingVectorCache = new Map();
                         }
                     }
-                    catch (embSetupError) {
-                        logger.debug("[ToolRouting] Embedding provider setup failed, L2 path disabled for this turn", {
-                            error: embSetupError instanceof Error
-                                ? embSetupError.message
-                                : String(embSetupError),
-                        });
-                        // routingEmbedFn remains undefined — fast-path is skipped.
-                    }
                 }
-                routedExcludeTools = await resolveToolRoutingExclusions({
-                    catalog,
-                    alwaysIncludeServerIds: routingConfig.alwaysIncludeServerIds ?? [],
-                    userQuery: routingQuery,
-                    routerPromptPrefix: routingConfig.routerPromptPrefix,
-                    routerModel: {
-                        provider: routingConfig.routerModel?.provider ??
-                            options.provider,
-                        model: routingConfig.routerModel?.model ?? options.model,
-                        region: routingConfig.routerModel?.region ?? options.region,
-                        temperature: routingConfig.routerModel?.temperature,
-                    },
-                    timeoutMs: routingConfig.timeoutMs ?? DEFAULT_TOOL_ROUTING_TIMEOUT_MS,
-                    // Forward the abort signal so a cancelled turn aborts the router
-                    // call promptly instead of waiting out the routing timeout.
-                    generateFn: (generateOptions) => this.generate({
-                        ...generateOptions,
-                        abortSignal: options.abortSignal,
-                    }),
-                    // Calibrated per-server routing when a decision provider is
-                    // configured. tryDecide returns null without one, so the resolver
-                    // falls straight through to the generative router as before.
-                    decideFn: (decisionOptions) => this.tryDecide({
-                        ...decisionOptions,
-                        signal: options.abortSignal,
-                    }),
-                    decisionMinDropConfidence: routingConfig.minDropConfidence,
-                    emitDecision: captureDecision,
-                    // L2 / ITEM D — only populated when embedding is configured.
-                    embedFn: routingEmbedFn,
-                    embeddingConfig: embeddingCfg,
-                    granularity: routingConfig.granularity ?? "server",
-                    // Pass the persistent vector cache so tool embeddings are reused
-                    // across turns (Finding 1).
-                    embeddingVectorCache: routingEmbedFn !== undefined
-                        ? this.toolRoutingVectorCache
-                        : undefined,
-                });
-            }
-            finally {
-                this._disableToolCacheForCurrentRequest =
-                    cacheDisabledForCurrentRequest;
-            }
+                catch (embSetupError) {
+                    logger.debug("[ToolRouting] Embedding provider setup failed, L2 path disabled for this turn", {
+                        error: embSetupError instanceof Error
+                            ? embSetupError.message
+                            : String(embSetupError),
+                    });
+                    // routingEmbedFn remains undefined — fast-path is skipped.
+                }
+            }
+            routedExcludeTools = await resolveToolRoutingExclusions({
+                catalog,
+                alwaysIncludeServerIds: routingConfig.alwaysIncludeServerIds ?? [],
+                userQuery: routingQuery,
+                routerPromptPrefix: routingConfig.routerPromptPrefix,
+                routerModel: {
+                    provider: routingConfig.routerModel?.provider ??
+                        options.provider,
+                    model: routingConfig.routerModel?.model ?? options.model,
+                    region: routingConfig.routerModel?.region ?? options.region,
+                    temperature: routingConfig.routerModel?.temperature,
+                },
+                timeoutMs: routingConfig.timeoutMs ?? DEFAULT_TOOL_ROUTING_TIMEOUT_MS,
+                // Forward the abort signal so a cancelled turn aborts the router
+                // call promptly instead of waiting out the routing timeout.
+                generateFn: (generateOptions) => this.preservingTurnState(() => this.generate({
+                    ...generateOptions,
+                    abortSignal: options.abortSignal,
+                })),
+                // Calibrated per-server routing when a decision provider is
+                // configured. tryDecide returns null without one, so the resolver
+                // falls straight through to the generative router as before.
+                decideFn: (decisionOptions) => this.tryDecide({
+                    ...decisionOptions,
+                    signal: options.abortSignal,
+                }),
+                decisionMinDropConfidence: routingConfig.minDropConfidence,
+                emitDecision: captureDecision,
+                // L2 / ITEM D — only populated when embedding is configured.
+                embedFn: routingEmbedFn,
+                embeddingConfig: embeddingCfg,
+                granularity: routingConfig.granularity ?? "server",
+                // Pass the persistent vector cache so tool embeddings are reused
+                // across turns (Finding 1).
+                embeddingVectorCache: routingEmbedFn !== undefined
+                    ? this.toolRoutingVectorCache
+                    : undefined,
+            });
             // Aborted during the router call — skip applying now-stale exclusions;
             // the main generation path enforces the abort itself.
             if (options.abortSignal?.aborted) {
@@ -7986,6 +7998,20 @@ Current user's request: ${currentInput}`;
                         yield* incrementalFallback;
                     }
                     ttsResolver?.(streamedTTSResult);
+                    // `streamState.finishReason` starts as a "stop" placeholder, before a
+                    // single chunk exists. A provider that records how the turn really
+                    // ended in metadata (a token-limit cut, a content filter, a step cap
+                    // that left tool calls pending) has that adopted here, once the drain
+                    // is done. Only the three unified values count: a raw vendor string
+                    // or "stop" leaves the graded reason alone, and a fallback's own
+                    // value is never overwritten.
+                    const drainedFinishReason = mcpStreamOutcome.metadata?.finishReason;
+                    if (!metadata.fallbackAttempted &&
+                        (drainedFinishReason === "length" ||
+                            drainedFinishReason === "tool-calls" ||
+                            drainedFinishReason === "content-filter")) {
+                        streamState.finishReason = drainedFinishReason;
+                    }
                     resolvedUsage = mcpStreamOutcome.usage;
                     if (!resolvedUsage && mcpStreamOutcome.analytics) {
                         try {
@@ -8176,8 +8202,19 @@ Current user's request: ${currentInput}`;
                 }
             })();
             const streamResult = await this.processStreamResult(processedStream, enhancedOptions, factoryResult);
-            streamResult.finishReason =
+            streamState.finishReason =
                 streamState.finishReason || streamResult.finishReason;
+            // Live, like toolCalls/toolResults below: the reason a stream ends with is
+            // only known after it drains, so a plain copy would stay the creation-time
+            // placeholder for every truncated or capped turn.
+            Object.defineProperty(streamResult, "finishReason", {
+                enumerable: true,
+                configurable: true,
+                get: () => streamState.finishReason,
+                set: (value) => {
+                    streamState.finishReason = value;
+                },
+            });
             // #1819 / E1b: a top-level cross-provider fallback (handleStreamFallback,
             // inside `processedStream` above) only reassigns
             // `streamState.toolCalls`/`toolResults` once the caller starts draining
@@ -9207,13 +9244,18 @@ Current user's request: ${currentInput}`;
         if (toolResultsDescriptor) {
             Object.defineProperty(response, "toolResults", toolResultsDescriptor);
         }
+        const finishReasonDescriptor = Object.getOwnPropertyDescriptor(streamResult, "finishReason");
+        if (finishReasonDescriptor) {
+            Object.defineProperty(response, "finishReason", finishReasonDescriptor);
+        }
         if (!source) {
             return response;
         }
         // NeuroLink grades the turn's terminal state itself (a normalized
         // finishReason, stopReason for aborts and time limits), so those fields
-        // stay plain values here. Copying the provider's getter for them would
-        // report the raw vendor reason, e.g. Anthropic's end_turn, instead.
+        // keep NeuroLink's own value here (finishReason through the descriptor
+        // copied above). Copying the provider's getter for them would report the
+        // raw vendor reason, e.g. Anthropic's end_turn, instead.
         //
         // toolCalls/toolResults are excluded for a different reason: `source`
         // (the PRIMARY provider's own result) may itself define them as live

package/dist/providers/openaiChatCompletionsBase.js

@@ -99,6 +99,28 @@ const resolveAgainstSchema = (text, schema) => {
     const scalar = recoverScalarRoot(text, schema);
     return scalar.kind === "accepted" ? scalar.value : undefined;
 };
+/**
+ * The one place a finish reason becomes the unified spelling. Accepts the wire's
+ * `finish_reason` (`tool_calls`, `content_filter`) and the unified spelling a
+ * middleware's own finish part already carries (`tool-calls`, `content-filter`),
+ * since both reach the stream path. Anything else, including `stop`, `error` and
+ * an absent value, reads as `stop`.
+ */
+const toUnifiedFinishReason = (reason) => {
+    switch (reason) {
+        case "length":
+            return "length";
+        case "tool_calls":
+        case "function_call":
+        case "tool-calls":
+            return "tool-calls";
+        case "content_filter":
+        case "content-filter":
+            return "content-filter";
+        default:
+            return "stop";
+    }
+};
 // Pull one native chunk at a time and forward cancellation to its iterator.
 const chunksToV3Stream = (source, completion, cancel) => {
     const iterator = source[Symbol.asyncIterator]();
@@ -774,13 +796,7 @@ export class OpenAIChatCompletionsProvider extends BaseProvider {
                     });
                 }
                 const rawFinish = choice?.finish_reason;
-                const unified = rawFinish === "length"
-                    ? "length"
-                    : rawFinish === "tool_calls" || rawFinish === "function_call"
-                        ? "tool-calls"
-                        : rawFinish === "content_filter"
-                            ? "content-filter"
-                            : "stop";
+                const unified = toUnifiedFinishReason(rawFinish);
                 return {
                     content,
                     finishReason: { unified, raw: rawFinish ?? "stop" },
@@ -1839,7 +1855,8 @@ export class OpenAIChatCompletionsProvider extends BaseProvider {
                 if (!loopPromise) {
                     resolveFinish("stop");
                 }
-                streamMetadata.rawFinishReason = await finishPromise;
+                const rawFinishReason = await finishPromise;
+                streamMetadata.rawFinishReason = rawFinishReason;
                 // Structured output for a `stream({ schema })` turn. Runs HERE —
                 // after the stream is fully drained — so a tool-free re-ask (when the
                 // streamed answer isn't already schema-valid) never reaches
@@ -1884,9 +1901,11 @@ export class OpenAIChatCompletionsProvider extends BaseProvider {
                 // Only reached once the structured-output re-ask above (when there
                 // was one) has resolved without throwing. A caller abort during that
                 // re-ask rejects `resolveStreamStructuredData` and skips this line
-                // entirely, so `metadata.finishReason` never claims "stop" for a
+                // entirely, so `metadata.finishReason` never claims a finish for a
                 // turn that actually failed after the wire stream itself finished.
-                streamMetadata.finishReason = "stop";
+                // The reason is the turn's own (a token-limit cut reads "length"), not
+                // a blanket "stop" for every stream that drained without throwing.
+                streamMetadata.finishReason = toUnifiedFinishReason(rawFinishReason);
                 // No-output path: stream completed normally but yielded zero text.
                 // Build an enriched sentinel + stamp the active OTel span so
                 // Pipeline B (ContextEnricher) surfaces a WARNING-level Langfuse

package/dist/proxy/proxyConfig.js

@@ -241,6 +241,10 @@ function kebabToCamelRoutingKey(kebabKey) {
  * *because* one of the spellings was explicitly `null` — never merely
  * because both were absent — so callers can warn once per null key without
  * warning on ordinary omission.
+ *
+ * `account-allowlist` is the one key whose `null` `validateProxyConfig`
+ * rejects before this runs, so for it the `null` branch is only reachable
+ * through a direct `parseRoutingConfig` call.
  */
 function readLegacyRoutingKey(routing, kebabKey) {
     const camelKey = kebabToCamelRoutingKey(kebabKey);
@@ -313,6 +317,13 @@ export function validateProxyConfig(config) {
                 }
             });
         }
+        // A `null` allowlist must not read as "unset": a reload that loses a
+        // restriction this way would silently open the proxy to every account.
+        // Checked per spelling, before the legacy read coalesces them.
+        if (routing["account-allowlist"] === null ||
+            routing[kebabToCamelRoutingKey("account-allowlist")] === null) {
+            errors.push("routing.account-allowlist must be an array of non-empty strings (null is not allowed; omit the key to remove the restriction)");
+        }
         const rawAccountAllowlist = readLegacyRoutingKey(routing, "account-allowlist").value;
         if (rawAccountAllowlist !== undefined) {
             if (!Array.isArray(rawAccountAllowlist)) {

package/dist/utils/errorClassifier.d.ts

@@ -1,7 +1,10 @@
 /**
- * Shared provider-error classification. Every provider's
- * `formatProviderError(error)` delegates here instead of hand-rolling its
+ * Shared provider-error classification. Migrated providers'
+ * `formatProviderError(error)` delegate here instead of hand-rolling their
  * own TimeoutError-check → .includes()-chain → `new XError(...)` ladder.
+ * Not yet migrated (they do not call it): Google AI Studio, SageMaker, the
+ * media and embedding providers (Ideogram, Recraft, Stability, Replicate,
+ * Jina, Voyage) and the System One decision provider.
  *
  * `classifyProviderError` picks the Error subclass + message; it does NOT
  * stamp statusCode/isRetryable/retryAfterMs onto the result — that

package/dist/utils/errorClassifier.js

@@ -1,7 +1,10 @@
 /**
- * Shared provider-error classification. Every provider's
- * `formatProviderError(error)` delegates here instead of hand-rolling its
+ * Shared provider-error classification. Migrated providers'
+ * `formatProviderError(error)` delegate here instead of hand-rolling their
  * own TimeoutError-check → .includes()-chain → `new XError(...)` ladder.
+ * Not yet migrated (they do not call it): Google AI Studio, SageMaker, the
+ * media and embedding providers (Ideogram, Recraft, Stability, Replicate,
+ * Jina, Voyage) and the System One decision provider.
  *
  * `classifyProviderError` picks the Error subclass + message; it does NOT
  * stamp statusCode/isRetryable/retryAfterMs onto the result — that

package/docs-site/static/search-index.json

@@ -2732,7 +2732,7 @@
 {"objectID":"67869c44bf604306f5e7d4f118c84d1357aba914cd78f1c63e338a61afd446cd","title":"ModelMapping Fields","url":"/docs/features/claude-proxy-config-reference#modelmapping-fields","content":"| Field      | Type     | Default       | Required | Description                                      |\n| ---------- | -------- | ------------- | -------- | ------------------------------------------------ |\n| from     | string | \"\"          | Yes      | Incoming model name (what Claude Code requests). |\n| to       | string | \"\"          | Yes      | Target model name at the destination provider.   |\n| provider | string | \"anthropic\" | No       | Target provider to route to.                     |","hierarchy":{"lvl0":"Features","lvl1":"Claude Proxy Configuration Reference","lvl2":"ModelMapping Fields","lvl3":""}},
 {"objectID":"52dc93bd2fb61c11e711465bcce7ab2445d21dd11f8601a791c1800577cd68bc","title":"FallbackEntry Fields","url":"/docs/features/claude-proxy-config-reference#fallbackentry-fields","content":"| Field      | Type     | Default | Required | Description                                  |\n| ---------- | -------- | ------- | -------- | -------------------------------------------- |\n| provider | string | \"\"    | Yes      | Provider name (e.g., google-ai, openai). |\n| model    | string | \"\"    | Yes      | Model to use at that provider.               |","hierarchy":{"lvl0":"Features","lvl1":"Claude Proxy Configuration Reference","lvl2":"FallbackEntry Fields","lvl3":""}},
 {"objectID":"d9b034b736d0076ac98c315f8227b06382eafb161166a630a350add28c818ee6","title":"Cloaking Fields","url":"/docs/features/claude-proxy-config-reference#cloaking-fields","content":"| Field                            | Type                            | Default                       | Description                                                                                                  |\n| -------------------------------- | ------------------------------- | ----------------------------- | ------------------------------------------------------------------------------------------------------------ |\n| mode                           | \"auto\" \\| \"always\" \\| \"never\" | \"auto\"                      | auto applies cloaking only to OAuth accounts. always applies to all. never disables all plugins.       |\n| plugins.headerScrubber         | boolean                       | false                       | Strip proxy-revealing headers (x-forwarded-for, via, sec-ch-\\*, etc.).                                       |\n| plugins.sessionIdentity        | boolean                       | false                       | Generate consistent userid/sessionid per account with 1-hour TTL.                                          |\n| plugins.systemPromptInjector   | boolean                       | false                       | Inject Claude Code session context (IDE metadata, timestamps) into system prompt. OAuth accounts only.       |\n| plugins.wordObfuscator.enabled | boolean                       | false                       | Insert zero-width characters into sensitive words to defeat string matching.                                 |\n| plugins.wordObfuscator.words   | string[]                      | [\"proxy\", \"neurolink\", ...] | Words to obfuscate. Defaults include: proxy, neurolink, load balancer, round-robin, failover, multi-account. |\n| plugins.tlsFingerprint.enabled | boolean                       | false                       | TLS fingerprint mimicry. Currently a stub/placeholder (no-op).                                               |","hierarchy":{"lvl0":"Features","lvl1":"Claude Proxy Configuration Reference","lvl2":"Cloaking Fields","lvl3":""}},
-{"objectID":"f1d10e310dd6cdd2e1ec76e8fb228e48f343eec841772b564c22357e7ea8f64f","title":"Validation Rules","url":"/docs/features/claude-proxy-config-reference#validation-rules","content":"The config loader validates the following:\naccounts must be present and be a non-array object.\nEach provider key in accounts must map to an array.\nEach account must have a non-empty string apiKey.\nIf version is present, it must be a number.\nrouting.account-allowlist must be an array of non-empty strings when present.\nrouting.quota-routing must be a boolean when present.\nrouting.auto-fallback must be a boolean when present.\nrouting.max-inflight-per-account must be an integer from 1 through 20 when present.\nrouting.session-soft-limit must be a number in (0, 1] when present.\nrouting.session-reset-tolerance-ms must be a positive integer when present.\nrouting.use-overage must be auto, always, or never (case-insensitive)\n  when present.\nrouting.account-ranking must be expiry-first or headroom-first when\n  present.\nrouting.prefer-primary must be a boolean when present.\nrouting.session-affinity must be a boolean when present.\nrouting.session-affinity-idle-ttl-ms must be an integer from 60000 through\n  86400000 when present.\nrouting.spill-inflight must be an integer from 0 through 100 when present.\nFor those five routing policy keys, an explicit null counts as present\n  and is rejected, whichever spelling (kebab-case or camelCase) carries it.\nPlaintext API keys (not using ${ENV_VAR} references) trigger a warning.\n\nAn absent default config is optional. An existing config that cannot be read or\nvalidated fails proxy startup; it is never ignored in favor of unrestricted\nrouting. A value that fails any check above rejects the whole config, never\njust that key: at startup the proxy does not start, and on a hot reload the\nlast-known-good generation stays active.","hierarchy":{"lvl0":"Features","lvl1":"Claude Proxy Configuration Reference","lvl2":"Validation Rules","lvl3":""}},
+{"objectID":"f1d10e310dd6cdd2e1ec76e8fb228e48f343eec841772b564c22357e7ea8f64f","title":"Validation Rules","url":"/docs/features/claude-proxy-config-reference#validation-rules","content":"The config loader validates the following:\naccounts must be present and be a non-array object.\nEach provider key in accounts must map to an array.\nEach account must have a non-empty string apiKey.\nIf version is present, it must be a number.\nrouting.account-allowlist must be an array of non-empty strings when present. An explicit null counts as present and is rejected, whichever spelling carries it, including when the other spelling holds an array.\nrouting.quota-routing must be a boolean when present.\nrouting.auto-fallback must be a boolean when present.\nrouting.max-inflight-per-account must be an integer from 1 through 20 when present.\nrouting.session-soft-limit must be a number in (0, 1] when present.\nrouting.session-reset-tolerance-ms must be a positive integer when present.\nrouting.use-overage must be auto, always, or never (case-insensitive)\n  when present.\nrouting.account-ranking must be expiry-first or headroom-first when\n  present.\nrouting.prefer-primary must be a boolean when present.\nrouting.session-affinity must be a boolean when present.\nrouting.session-affinity-idle-ttl-ms must be an integer from 60000 through\n  86400000 when present.\nrouting.spill-inflight must be an integer from 0 through 100 when present.\nFor those five routing policy keys, an explicit null counts as present\n  and is rejected, whichever spelling (kebab-case or camelCase) carries it.\nPlaintext API keys (not using ${ENV_VAR} references) trigger a warning.\n\nAn absent default config is optional. An existing config that cannot be read or\nvalidated fails proxy startup; it is never ignored in favor of unrestricted\nrouting. A value that fails any check above rejects the whole config, never\njust that key: at startup the proxy does not start, and on a hot reload the\nlast-known-good generation stays active.","hierarchy":{"lvl0":"Features","lvl1":"Claude Proxy Configuration Reference","lvl2":"Validation Rules","lvl3":""}},
 {"objectID":"c8450374b1fc8e0a0f5fb47d3bef0cab242c75e17bfebe6e943ef17b22c10227","title":"Account Routing Policies","url":"/docs/features/claude-proxy-config-reference#account-routing-policies","content":"The five keys above (account-ranking, prefer-primary, session-affinity,\nsession-affinity-idle-ttl-ms, spill-inflight) all default to today's exact\nbehavior — expiry-first ranking, no affinity, no primary preference, no\nspill — and are validated and hot-reloaded through the same runtime config\nsnapshot as every other routing key.\n\nstrategy: round-robin ignores all five keys. They apply only under\nfill-first with more than one enabled account.\n\nNEUROLINK_PROXY_QUOTA_ROUTING=off disables quota-based ranking, but\nsession-affinity, prefer-primary and spill-inflight still apply.\nTurning off quota routing removes the expiry/headroom ordering step, so\naccount-ranking has no effect; it does not disable sticky sessions, the\nprimary preference or spill, which then work on the configured account\norder.\n\nPrecedence. After unusable accounts are removed, the order a request\ntries is:\nthe session's bound account, when session-affinity is on and that\n   account is usable and not session-saturated;\nthe configured primary-account, when prefer-primary is on and it is\n   usable and not session-saturated;\nthe remaining accounts in account-ranking order.\n\nSpill only changes which account is tried first, and only for requests\nwithout an active session-affinity binding — it never re-orders or moves a\nrequest that is already bound to an account. Its target must be usable and\nnot session-saturated, like every step above; when no account under the\nthreshold qualifies, nothing spills.\n\nBinding. A served request binds its session to the Anthropic account\nthat served it. The existing binding is kept only when that request never\ntried the bound account and the bound account is still usable and not\nsession-saturated — a request that overflowed the bound account's\nmax-inflight-per-account cap onto another account keeps the session on its\nwarm prompt cache.","hierarchy":{"lvl0":"Features","lvl1":"Claude Proxy Configuration Reference","lvl2":"Account Routing Policies","lvl3":""}},
 {"objectID":"2b5d2865be217ed908e64f9d07acbe019108e95f210f6c14f031cf8cb99ece6f","title":"3. Environment Variables","url":"/docs/features/claude-proxy-config-reference#3-environment-variables","content":"| Variable                                     | Purpose                                                                                                                                                                                                                                                                                                                | Used By                                          |\n| -------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------ |\n| ANTHROPIC_API_KEY                          | Anthropic API key. Used as a fallback credential when no OAuth accounts are found.                                                                                                                                                                                                                                     | Proxy routes, Anthropic provider                 |\n| ANTHROPIC_OAUTH_TOKEN                      | OAuth access token for Anthropic (alternative to stored tokens).                                                                                                                                                                                                                                                       | Anthropic provider, providerConfig               |\n| CLAUDE_OAUTH_TOKEN                         | Alias for ANTHROPIC_OAUTH_TOKEN. Checked as a fallback.","hierarchy":{"lvl0":"Features","lvl1":"Claude Proxy Configuration Reference","lvl2":"3. Environment Variables","lvl3":""}},
 {"objectID":"3f1a3fc9d7711064037deec5635e85b2dc713d3d9c019df22c659f47215812b8","title":"Proxy Env File Resolution Order","url":"/docs/features/claude-proxy-config-reference#proxy-env-file-resolution-order","content":"When the proxy starts, it loads env vars from a .env file using this priority:\n--env-file <path> CLI flag — explicit path, required to exist.\nNEUROLINK_ENV_FILE=<path> environment variable — explicit path, required to exist.\n~/.neurolink/.env — loaded automatically if the file exists (created by neurolink proxy telemetry setup).\nNothing — proxy starts without extra env vars; telemetry remains disabled unless env vars are already set in the shell, and the proxy emits a startup log explaining how to enable it unless output is suppressed.\n\nThe --env-file flag is baked into the launchd plist by proxy install, so the service always loads from the same file across reboots. The three runtime routing variables above and routing interpolation are reread transactionally; other env settings remain startup-only.\n\nPriority for Anthropic credentials (checked in order by the proxy routes):\nTokenStore compound keys -- anthropic:<label> entries in ~/.neurolink/tokens.json.\nLegacy credentials file -- ~/.neurolink/anthropic-credentials.json (only if no compound keys exist).\nANTHROPIC_API_KEY env var -- Only if no Anthropic TokenStore entries or legacy credential are present.\n\nrouting.account-allowlist filters these sources before loading or refresh. Legacy and environment fallbacks are never activated merely because existing TokenStore accounts are disabled, cooling, or unavailable.","hierarchy":{"lvl0":"Features","lvl1":"Claude Proxy Configuration Reference","lvl2":"Proxy Env File Resolution Order","lvl3":""}},

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@juspay/neurolink",
-  "version": "12.47.4",
+  "version": "12.47.5",
   "packageManager": "pnpm@10.15.1",
   "description": "The pipe layer of an AI nervous system: one interface connecting provider neurons to your application, across three inference types — generate, stream and decide. `decide` returns typed, calibrated judgements from a non-generative model (~400ms, ~$0.00002/call) for routing, tool selection and context budgeting. MCP-native (4 transports), voice TTS/STT/realtime, RAG, agents, memory, compaction, 9 observability exporters. OpenAI · Anthropic · Gemini · Bedrock · Azure · Ollama · TypeSafe Jev and more.",
   "author": {