@juspay/neurolink 12.7.0 → 12.7.2

package/CHANGELOG.md

@@ -1,12 +1,8 @@
-## [12.7.0](https://github.com/juspay/neurolink/compare/v12.6.1...v12.7.0) (2026-08-29)
-
-### Features
-
-- **(tts):** stream OpenAI audio natively ([dca67fa](https://github.com/juspay/neurolink/commit/dca67fa452ac571d308a3e15da5a100803b27010))
+## [12.7.2](https://github.com/juspay/neurolink/compare/v12.7.1...v12.7.2) (2026-08-29)
 
 ### Bug Fixes
 
-- **(proxy):** correct how the MSIE User-Agent was attributed, and guard the roster ([4e909f9](https://github.com/juspay/neurolink/commit/4e909f912aef943bbddc92150b821aeef9d7a20e))
+- **(localUsage):** pin window monotonicity, and stop two tests lying about failure ([f07f145](https://github.com/juspay/neurolink/commit/f07f1454e457f73c3d9b162faa09f1cd624f9e27))
 
 ## [11.2.3](https://github.com/juspay/neurolink/compare/v11.2.2...v11.2.3) (2026-08-19)
 

package/dist/core/evaluationProviders.d.ts

@@ -33,7 +33,7 @@ export declare function isProviderAvailable(providerName: string): boolean;
  */
 export declare function getBestAvailableProvider(preferCheap?: boolean): ProviderModelConfig | null;
 /**
- Record actual provider performance for optimization
+ * Record actual provider performance for optimization
  */
 export declare function recordProviderPerformanceFromMetrics(providerName: string, metrics: {
     responseTime: number;

package/dist/core/evaluationProviders.js

@@ -111,7 +111,7 @@ export function getBestAvailableProvider(preferCheap = true) {
     return sortedProviders[0];
 }
 /**
- Record actual provider performance for optimization
+ * Record actual provider performance for optimization
  */
 export function recordProviderPerformanceFromMetrics(providerName, metrics) {
     const existing = providerMetrics.get(providerName) || {

package/dist/localUsage/scanWindow.d.ts

@@ -16,14 +16,43 @@
  * Three fixes in three files each closed one door and left the others open.
  * The logic lives here once now, so the next door closes everywhere at once.
  *
- * Contract: `Infinity` is the ONLY value meaning all-history. Anything that is
- * not a usable finite window — NaN, negative, or so large the arithmetic stops
- * being finite — collapses to a zero-length window, which is what a
- * nonsensical request should read as.
+ * Contract, stated as the two directions rather than as one rule, because the
+ * single-sentence version of it was wrong here for weeks:
+ *
+ *   - `0`, negatives, `-Infinity` and `NaN` are NOT windows. They collapse to
+ *     a zero-length one and read nothing. Two of the three historical defects
+ *     above are here (`0` and `NaN`); `-Infinity` and negatives are the same
+ *     class and were fixed with them.
+ *   - `Infinity`, and any finite value whose window is longer than any
+ *     history, mean ALL HISTORY. The THIRD historical defect — `MAX_VALUE` —
+ *     lives in this bucket, not the one above: what was wrong about it was the
+ *     mechanism (a `-Infinity` cutoff), never the outcome. A window of 1e308 days covers every
+ *     transcript that could exist, so "everything" is the right answer to it
+ *     and "nothing" is a wrong one.
+ *
+ * The prose here used to say the opposite of that second point — that a span
+ * too large to stay finite "collapses to a zero-length window". The code never
+ * did that, and the code was right. Anyone reconciling the two by changing the
+ * code re-creates a defect this suite has already seen once: asserting
+ * absurd-means-nothing produces a NON-MONOTONIC CLIFF, where 2.07e300 read
+ * everything, 2.09e300 read nothing, and `Infinity` read everything again.
+ * That was found by running the CLI — `usage local --since 999999999999`
+ * reported 518,576 turns while `--since 1e308` reported 39 — not by reading
+ * either the code or this comment.
+ *
+ * The invariant that actually holds, and the one worth testing, is
+ * MONOTONICITY: a wider window never reads less than a narrower one, across
+ * the whole range including the absurd end.
  */
 export declare const DEFAULT_SINCE_DAYS = 30;
 /**
  * @returns the epoch-ms cutoff a scan must not read past, or `undefined` for an
- * unbounded (all-history) scan — which only `Infinity` produces.
+ * unbounded (all-history) scan.
+ *
+ * `undefined` has TWO sources, not one, and this line used to name only the
+ * first: an explicit `Infinity`, and any finite request whose span overflows
+ * (`Number.MAX_VALUE`). They mean the same thing on purpose — see the contract
+ * above — but a reader who believes only `Infinity` reaches this branch will
+ * mis-handle the second.
  */
 export declare function resolveScanCutoffMs(sinceDays: number | undefined, defaultDays?: number): number | undefined;

package/dist/localUsage/scanWindow.js

@@ -16,16 +16,45 @@
  * Three fixes in three files each closed one door and left the others open.
  * The logic lives here once now, so the next door closes everywhere at once.
  *
- * Contract: `Infinity` is the ONLY value meaning all-history. Anything that is
- * not a usable finite window — NaN, negative, or so large the arithmetic stops
- * being finite — collapses to a zero-length window, which is what a
- * nonsensical request should read as.
+ * Contract, stated as the two directions rather than as one rule, because the
+ * single-sentence version of it was wrong here for weeks:
+ *
+ *   - `0`, negatives, `-Infinity` and `NaN` are NOT windows. They collapse to
+ *     a zero-length one and read nothing. Two of the three historical defects
+ *     above are here (`0` and `NaN`); `-Infinity` and negatives are the same
+ *     class and were fixed with them.
+ *   - `Infinity`, and any finite value whose window is longer than any
+ *     history, mean ALL HISTORY. The THIRD historical defect — `MAX_VALUE` —
+ *     lives in this bucket, not the one above: what was wrong about it was the
+ *     mechanism (a `-Infinity` cutoff), never the outcome. A window of 1e308 days covers every
+ *     transcript that could exist, so "everything" is the right answer to it
+ *     and "nothing" is a wrong one.
+ *
+ * The prose here used to say the opposite of that second point — that a span
+ * too large to stay finite "collapses to a zero-length window". The code never
+ * did that, and the code was right. Anyone reconciling the two by changing the
+ * code re-creates a defect this suite has already seen once: asserting
+ * absurd-means-nothing produces a NON-MONOTONIC CLIFF, where 2.07e300 read
+ * everything, 2.09e300 read nothing, and `Infinity` read everything again.
+ * That was found by running the CLI — `usage local --since 999999999999`
+ * reported 518,576 turns while `--since 1e308` reported 39 — not by reading
+ * either the code or this comment.
+ *
+ * The invariant that actually holds, and the one worth testing, is
+ * MONOTONICITY: a wider window never reads less than a narrower one, across
+ * the whole range including the absurd end.
  */
 export const DEFAULT_SINCE_DAYS = 30;
 const MS_PER_DAY = 86_400_000;
 /**
  * @returns the epoch-ms cutoff a scan must not read past, or `undefined` for an
- * unbounded (all-history) scan — which only `Infinity` produces.
+ * unbounded (all-history) scan.
+ *
+ * `undefined` has TWO sources, not one, and this line used to name only the
+ * first: an explicit `Infinity`, and any finite request whose span overflows
+ * (`Number.MAX_VALUE`). They mean the same thing on purpose — see the contract
+ * above — but a reader who believes only `Infinity` reaches this branch will
+ * mis-handle the second.
  */
 export function resolveScanCutoffMs(sinceDays, defaultDays = DEFAULT_SINCE_DAYS) {
     const requested = sinceDays ?? defaultDays;

package/dist/proxy/clientAttribution.d.ts

@@ -17,34 +17,37 @@
  *   collapsing into one bucket with every other unknown.
  */
 /**
- * Deliberately NOT mapped, with the measurement that ruled each one out.
+ * Deliberately NOT mapped, and why each was ruled out.
  *
- * Copilot CLI is the one client here that cannot be identified from its
- * User-Agent, and both of the strings it sends are actively unsafe to key on:
+ * These two strings are unrelated to each other. They are grouped only because
+ * both were candidates for a Copilot mapping at some point, and neither can
+ * carry one.
  *
- * - `OpenAI/JS 5.20.1` — the stock OpenAI JS SDK UA, sent by every caller of
- *   that SDK. Mapping it to Copilot would file unrelated OpenAI-SDK traffic
- *   under Copilot's name, which is worse than leaving it unattributed.
- - `Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)` — not a
- *   CLI's User-Agent at all. This is what `curl` sends on a machine whose
- *   `~/.curlrc` sets `user-agent`, so every curl-driven caller on such a host
- *   shares it: scripts, agents, health probes. It accounted for the largest
- *   single block of `unknown` rows in the log this table was measured against,
- *   which is exactly what made it tempting.
+ * - `OpenAI/JS 5.20.1` — Copilot CLI's actual User-Agent, and the problem is
+ *   that it is not Copilot's alone: it is the stock OpenAI JS SDK string, sent
+ *   by every caller of that SDK. Mapping it would file unrelated OpenAI-SDK
+ *   traffic under Copilot's name, which is worse than leaving it unattributed.
+ *   Copilot also sends `x-initiator` and `x-interaction-type`, but neither is
+ *   exclusive to it either, so it stays `unknown` and remains traceable
+ *   through the stored raw header.
  *
- *   Recorded because the first pass got this wrong in a way worth naming. The
- *   string was seen arriving at two capture servers during Copilot CLI and
- *   Gemini CLI runs and was written up as "sent by both CLIs". It was neither:
- *   it was the aliveness `curl` fired at each capture server moments before
- *   the CLI, picking up that host's curlrc. The paths gave it away on review —
- *   the Gemini-side hit was a bare `GET /v1beta/models`, which is the probe's
- *   URL and not one the CLI requests. A shared string across two unrelated
- *   clients should have read as "shared dependency or shared tooling", not as
- *   a property of either client.
+ * - `Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)` — not a
+ *   CLI's User-Agent at all, and in particular NOT Copilot's. It is what
+ *   `curl` sends on a machine whose `~/.curlrc` sets `user-agent`, so every
+ *   curl-driven caller on such a host shares it: scripts, agents, health
+ *   probes. It accounted for the largest single block of `unknown` rows in the
+ *   log this table was measured against, which is exactly what made it
+ *   tempting.
  *
- * Copilot does send `x-initiator` and `x-interaction-type`, but neither is
- * exclusive to it either. Attributing it needs a signal nobody has found yet,
- * so it stays `unknown` and remains traceable through the stored raw header.
+ *   Recorded because the first pass got this wrong in a way worth naming. The
+ *   string was seen arriving at two capture servers during a Copilot CLI run
+ *   and a Gemini CLI run, and was written up as "sent by both CLIs". It was
+ *   sent by neither: it was the aliveness `curl` fired at each capture server
+ *   moments before the CLI was pointed at it, picking up that host's curlrc.
+ *   The request paths gave it away on review — the Gemini-side hit was a bare
+ *   `GET /v1beta/models`, which is the probe's URL and not one the CLI
+ *   requests. An identical unusual string arriving from two unrelated clients
+ *   is evidence of shared tooling, never a property of either client.
  */
 /**
  * The client names this table can produce.

package/dist/proxy/clientAttribution.js

@@ -41,34 +41,37 @@ const CLIENT_PREFIXES = [
     ["codex_exec/", "codex"],
 ];
 /**
- * Deliberately NOT mapped, with the measurement that ruled each one out.
+ * Deliberately NOT mapped, and why each was ruled out.
  *
- * Copilot CLI is the one client here that cannot be identified from its
- * User-Agent, and both of the strings it sends are actively unsafe to key on:
+ * These two strings are unrelated to each other. They are grouped only because
+ * both were candidates for a Copilot mapping at some point, and neither can
+ * carry one.
  *
- * - `OpenAI/JS 5.20.1` — the stock OpenAI JS SDK UA, sent by every caller of
- *   that SDK. Mapping it to Copilot would file unrelated OpenAI-SDK traffic
- *   under Copilot's name, which is worse than leaving it unattributed.
- - `Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)` — not a
- *   CLI's User-Agent at all. This is what `curl` sends on a machine whose
- *   `~/.curlrc` sets `user-agent`, so every curl-driven caller on such a host
- *   shares it: scripts, agents, health probes. It accounted for the largest
- *   single block of `unknown` rows in the log this table was measured against,
- *   which is exactly what made it tempting.
+ * - `OpenAI/JS 5.20.1` — Copilot CLI's actual User-Agent, and the problem is
+ *   that it is not Copilot's alone: it is the stock OpenAI JS SDK string, sent
+ *   by every caller of that SDK. Mapping it would file unrelated OpenAI-SDK
+ *   traffic under Copilot's name, which is worse than leaving it unattributed.
+ *   Copilot also sends `x-initiator` and `x-interaction-type`, but neither is
+ *   exclusive to it either, so it stays `unknown` and remains traceable
+ *   through the stored raw header.
  *
- *   Recorded because the first pass got this wrong in a way worth naming. The
- *   string was seen arriving at two capture servers during Copilot CLI and
- *   Gemini CLI runs and was written up as "sent by both CLIs". It was neither:
- *   it was the aliveness `curl` fired at each capture server moments before
- *   the CLI, picking up that host's curlrc. The paths gave it away on review —
- *   the Gemini-side hit was a bare `GET /v1beta/models`, which is the probe's
- *   URL and not one the CLI requests. A shared string across two unrelated
- *   clients should have read as "shared dependency or shared tooling", not as
- *   a property of either client.
+ * - `Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)` — not a
+ *   CLI's User-Agent at all, and in particular NOT Copilot's. It is what
+ *   `curl` sends on a machine whose `~/.curlrc` sets `user-agent`, so every
+ *   curl-driven caller on such a host shares it: scripts, agents, health
+ *   probes. It accounted for the largest single block of `unknown` rows in the
+ *   log this table was measured against, which is exactly what made it
+ *   tempting.
  *
- * Copilot does send `x-initiator` and `x-interaction-type`, but neither is
- * exclusive to it either. Attributing it needs a signal nobody has found yet,
- * so it stays `unknown` and remains traceable through the stored raw header.
+ *   Recorded because the first pass got this wrong in a way worth naming. The
+ *   string was seen arriving at two capture servers during a Copilot CLI run
+ *   and a Gemini CLI run, and was written up as "sent by both CLIs". It was
+ *   sent by neither: it was the aliveness `curl` fired at each capture server
+ *   moments before the CLI was pointed at it, picking up that host's curlrc.
+ *   The request paths gave it away on review — the Gemini-side hit was a bare
+ *   `GET /v1beta/models`, which is the probe's URL and not one the CLI
+ *   requests. An identical unusual string arriving from two unrelated clients
+ *   is evidence of shared tooling, never a property of either client.
  */
 /**
  * The client names this table can produce.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@juspay/neurolink",
-  "version": "12.7.0",
+  "version": "12.7.2",
   "packageManager": "pnpm@10.15.1",
   "description": "TypeScript AI SDK with 24+ LLM providers behind one consistent API. MCP-native (connect any MCP server), voice TTS/STT/realtime, RAG, agents, memory, context compaction. OpenAI · Anthropic · Gemini · Bedrock · Azure · Ollama · DeepSeek · NVIDIA NIM and more.",
   "author": {