@juspay/neurolink 12.9.1 → 12.9.3

package/dist/server/routes/claudeProxyRoutes.js

@@ -18,6 +18,8 @@ import { clearAccountCooldown, loadAccountCooldowns, saveAccountCooldown, } from
 import { anthropicAccountKeysEqual, ENV_ANTHROPIC_ACCOUNT_KEY, isAccountAllowed, LEGACY_ANTHROPIC_ACCOUNT_KEY, normalizeAnthropicAccountKey, shouldLoadFallbackCredential, } from "../../proxy/accountSelection.js";
 import { getUnifiedRateLimitStatus, isQuotaOverageAvailable, loadAccountQuotas, mergeQuotaSnapshot, modelFamilyToken, parseQuotaHeaders, saveAccountQuota, } from "../../proxy/accountQuota.js";
 import { fetchAccountUsage, listAnthropicAccountsForUsage, usageToQuota, } from "../../proxy/accountUsage.js";
+import { tokenStore } from "../../auth/tokenStore.js";
+import { fetchCodexAccountUsage, listCodexAccountsForUsage, resolveProxyStatusAccountIdentity, } from "../../proxy/codexAccountUsage.js";
 import { AccountQuotaRefreshCoordinator } from "../../proxy/accountQuotaRefreshCoordinator.js";
 import { ProviderTransportCoordinator } from "../../proxy/providerTransportCoordinator.js";
 import { MAX_COOLDOWN_MS_BY_REASON } from "../../proxy/routingEvidence.js";
@@ -780,6 +782,45 @@ async function refreshAccountQuotaInBackground(account, trigger) {
     }
     await applyAccountUsageResult(account, refresh.result, refresh.startedAt);
 }
+/**
+ * The logins the account-exposing routes enumerate, per engine, plus every
+ * key the token store holds at all (disabled ones included). Overridable by
+ * the suite because the token store is a singleton bound to the real home at
+ * import — a case cannot point it elsewhere, and reading the operator's own
+ * logins inside a fixture test is exactly how a phantom would hide.
+ */
+let accountDirectoryOverride = null;
+async function listRoutableAccountsByEngine(allowlist) {
+    if (accountDirectoryOverride) {
+        return {
+            anthropic: accountDirectoryOverride.anthropic,
+            codex: accountDirectoryOverride.codex,
+        };
+    }
+    // The allowlist is an Anthropic routing concept, keyed by anthropic:
+    // prefixes; applying it to Codex keys would exclude every Codex login.
+    const [anthropic, codex] = await Promise.all([
+        listAnthropicAccountsForUsage(allowlist),
+        listCodexAccountsForUsage(),
+    ]);
+    return { anthropic, codex };
+}
+/**
+ * Every login the token store knows, routable or not. This is what separates
+ * a DISABLED login (still here, shown as unrouted) from a REMOVED one (gone,
+ * and not shown): usage counters and quota snapshots outlive a logout, and
+ * without this check a deleted login renders as an unrouted account forever.
+ */
+async function listKnownAccountKeys() {
+    if (accountDirectoryOverride) {
+        return accountDirectoryOverride.knownKeys;
+    }
+    const [anthropic, codex] = await Promise.all([
+        tokenStore.listByPrefix("anthropic:"),
+        tokenStore.listByPrefix("codex:"),
+    ]);
+    return new Set([...anthropic.map(normalizeAnthropicAccountKey), ...codex]);
+}
 /**
  * Fetch fresh limits from Anthropic's usage endpoint for every eligible OAuth
  * account and write them through the exact same chain the passive header
@@ -789,24 +830,38 @@ async function refreshAccountQuotaInBackground(account, trigger) {
  */
 async function refreshAccountLimits(options = {}) {
     const fetchedAt = Date.now();
-    const allAccounts = await listAnthropicAccountsForUsage(options.accountAllowlist);
+    const directory = await listRoutableAccountsByEngine(options.accountAllowlist);
+    const allAccounts = [
+        ...directory.anthropic.map((account) => ({
+            account,
+            provider: "anthropic",
+        })),
+        ...directory.codex.map((account) => ({
+            account,
+            provider: "codex",
+        })),
+    ];
     const accounts = options.accountFilter
-        ? allAccounts.filter((account) => account.label === options.accountFilter ||
+        ? allAccounts.filter(({ account }) => account.label === options.accountFilter ||
             account.key === options.accountFilter)
         : allAccounts;
     const persisted = await loadAccountQuotas().catch(() => ({}));
-    const buildResult = (account, status, quota, error) => {
+    const buildResult = (account, provider, status, quota, error) => {
         const state = accountRuntimeState.get(account.key);
+        // The quota store keys Anthropic snapshots by bare label for historical
+        // reasons (see CLAUDE.md) and Codex snapshots by full key. A Codex login
+        // must never fall back to the bare label: with one email on both engines
+        // that label holds the ANTHROPIC account's windows.
+        const persistedQuota = provider === "anthropic"
+            ? (persisted[account.key] ?? persisted[account.label] ?? null)
+            : (persisted[account.key] ?? null);
         const result = {
             account: account.label,
             key: account.key,
+            provider,
             type: account.type,
             status,
-            quota: quota ??
-                state?.quota ??
-                persisted[account.key] ??
-                persisted[account.label] ??
-                null,
+            quota: quota ?? state?.quota ?? persistedQuota,
         };
         if (error !== undefined) {
             result.error = error;
@@ -823,7 +878,7 @@ async function refreshAccountLimits(options = {}) {
         return {
             fetchedAt,
             snapshot: true,
-            results: accounts.map((account) => buildResult(account, "snapshot", null)),
+            results: accounts.map(({ account, provider }) => buildResult(account, provider, "snapshot", null)),
             refreshMetrics: accountQuotaRefreshCoordinator.getMetrics(),
         };
     }
@@ -835,23 +890,41 @@ async function refreshAccountLimits(options = {}) {
             if (index >= accounts.length) {
                 return;
             }
-            const account = accounts[index];
+            const { account, provider } = accounts[index];
             if (account.type !== "oauth") {
-                results[index] = buildResult(account, "skipped_api_key", null);
+                results[index] = buildResult(account, provider, "skipped_api_key", null);
                 continue;
             }
             const lastFetch = lastUsageFetchAt.get(account.key) ?? 0;
             if (Date.now() - lastFetch < MIN_USAGE_REFETCH_INTERVAL_MS) {
-                results[index] = buildResult(account, "throttled", null);
+                results[index] = buildResult(account, provider, "throttled", null);
                 continue;
             }
             lastUsageFetchAt.set(account.key, Date.now());
+            if (provider === "codex") {
+                // Codex has its own usage endpoint and no overage/cooldown
+                // reconciliation to run; the snapshot is written under the full key,
+                // which is the only key the Codex engine ever reads it back by.
+                try {
+                    const fetched = await fetchCodexAccountUsage(account);
+                    if (fetched.ok === false) {
+                        results[index] = buildResult(account, provider, "error", null, `codex usage fetch failed: ${fetched.reason}`);
+                        continue;
+                    }
+                    await saveAccountQuota(account.key, fetched.quota);
+                    results[index] = buildResult(account, provider, "refreshed", fetched.quota);
+                }
+                catch (err) {
+                    results[index] = buildResult(account, provider, "error", null, err instanceof Error ? err.message : String(err));
+                }
+                continue;
+            }
             // Isolate failures per account: an unexpected rejection must not abort
             // the Promise.all sweep and turn the whole /limits response into a 502.
             try {
                 const refresh = await accountQuotaRefreshCoordinator.run(account, `manual:${account.key}`, fetchValidatedAccountUsage, { force: true });
                 if (refresh.kind !== "completed") {
-                    results[index] = buildResult(account, "throttled", null);
+                    results[index] = buildResult(account, provider, "throttled", null);
                     continue;
                 }
                 const fetchResult = refresh.result;
@@ -859,18 +932,18 @@ async function refreshAccountLimits(options = {}) {
                 // file without strictNullChecks, where negated boolean-discriminant
                 // narrowing does not apply.
                 if (fetchResult.ok === false) {
-                    results[index] = buildResult(account, "error", null, fetchResult.error);
+                    results[index] = buildResult(account, provider, "error", null, fetchResult.error);
                     continue;
                 }
                 const quota = await applyAccountUsageResult(account, fetchResult, refresh.startedAt, persisted[account.key] ?? persisted[account.label] ?? null);
                 if (!quota) {
-                    results[index] = buildResult(account, "error", null, "usage payload had no recognizable limit windows");
+                    results[index] = buildResult(account, provider, "error", null, "usage payload had no recognizable limit windows");
                     continue;
                 }
-                results[index] = buildResult(account, "refreshed", quota);
+                results[index] = buildResult(account, provider, "refreshed", quota);
             }
             catch (err) {
-                results[index] = buildResult(account, "error", null, err instanceof Error ? err.message : String(err));
+                results[index] = buildResult(account, provider, "error", null, err instanceof Error ? err.message : String(err));
             }
         }
     };
@@ -6769,11 +6842,6 @@ function buildEarlyClaudeRequestError(args) {
  * millisecond fields tens of thousands of years into the future, so only the
  * seconds fields are converted, and 0 becomes null rather than epoch zero.
  */
-/**
- * Account types that represent a real credential rather than proxy plumbing.
- * Mirrors the Anthropic pool's own account types.
- */
-const REAL_ACCOUNT_TYPES = new Set(["oauth", "api_key"]);
 function toMillis(value) {
     return typeof value === "number" && Number.isFinite(value) && value > 0
         ? Math.round(value * 1000)
@@ -7498,9 +7566,31 @@ export function createClaudeProxyRoutes(modelRouter, basePath = "", accountStrat
                         // Usage is the optional half; quota and status must still render.
                         usageError = error instanceof Error ? error.message : String(error);
                     }
-                    const statsByLabel = new Map();
-                    for (const entry of Object.values(statsAccounts)) {
-                        statsByLabel.set(entry.label, entry);
+                    // Joined by provider-qualified KEY, never by label. One email can
+                    // be logged in to both engines; joined by label, the Codex login was
+                    // swallowed by the Anthropic row (and its counters could land on
+                    // that row, last write winning). Legacy stats entries that predate
+                    // the key carry only a label and a type, which is enough to derive
+                    // it; a keyed entry for the same login wins over a legacy one.
+                    const statsByKey = new Map();
+                    for (const [mapKey, entry] of Object.entries(statsAccounts)) {
+                        const identity = resolveProxyStatusAccountIdentity(entry.label, entry.type, entry.key ?? mapKey);
+                        const identityKey = identity.key ?? mapKey;
+                        const existing = statsByKey.get(identityKey);
+                        if (!existing || (entry.key && !existing.key)) {
+                            statsByKey.set(identityKey, { ...entry, identityKey });
+                        }
+                    }
+                    // Which logins exist at all, disabled ones included. A stats entry
+                    // with no login behind it is a REMOVED account, not an unrouted one.
+                    // If the store cannot be read, err towards showing rows: hiding a
+                    // real login is the worse mistake, and the old behaviour.
+                    let knownKeys;
+                    try {
+                        knownKeys = await listKnownAccountKeys();
+                    }
+                    catch {
+                        knownKeys = null;
                     }
                     const rows = [];
                     const claimed = new Set();
@@ -7509,13 +7599,14 @@ export function createClaudeProxyRoutes(modelRouter, basePath = "", accountStrat
                     // today, which is exactly when an operator most wants to see it.
                     for (const result of limits.results) {
                         const label = result.account;
-                        claimed.add(label);
-                        const stat = statsByLabel.get(label);
+                        claimed.add(result.key);
+                        const stat = statsByKey.get(result.key);
                         const quota = normalizeQuotaForAccounts(result.quota);
                         const cooling = isCooling(result.key ?? null);
                         rows.push({
                             label,
                             key: result.key ?? null,
+                            provider: result.provider,
                             kind: "account",
                             type: result.type ?? stat?.type ?? "oauth",
                             // result.status describes how the quota was obtained
@@ -7549,39 +7640,53 @@ export function createClaudeProxyRoutes(modelRouter, basePath = "", accountStrat
                                     weeklyHealth: quotaHealth(quota.weeklyStatus),
                                 }
                                 : null,
-                            usage: usageByAccount.get(label) ?? null,
+                            usage: usageByAccount.get(result.key) ?? null,
                         });
                     }
                     // Plumbing rows are still reported, but tagged, so a consumer can
                     // show or hide them rather than rendering them as credentials.
                     //
-                    // A real login can land here too: listAnthropicAccountsForUsage
-                    // skips accounts the token store has disabled or the allowlist
-                    // excludes, so an account with real usage history but no current
-                    // route is absent from limits.results. Tagging that as plumbing hid
-                    // the one account an operator is looking for when they ask why
-                    // traffic stopped — the docs tell consumers to filter internal rows
-                    // out. It stays kind "account", with a status saying why it has no
-                    // quota block.
-                    for (const entry of Object.values(statsAccounts)) {
-                        if (claimed.has(entry.label)) {
+                    // A real login can land here too: the listers skip accounts the
+                    // token store has disabled or the allowlist excludes, so a login
+                    // with real usage history but no current route is absent from
+                    // limits.results. Tagging that as plumbing hid the one account an
+                    // operator is looking for when they ask why traffic stopped. It
+                    // stays kind "account", with a status saying why it has no quota
+                    // block — but only while the login still EXISTS. A stats entry whose
+                    // login has been removed from the store is history, not a
+                    // credential, and rendering it as "unrouted" put a phantom account
+                    // on every dashboard for as long as the counters file lived.
+                    for (const entry of statsByKey.values()) {
+                        const identity = resolveProxyStatusAccountIdentity(entry.label, entry.type, entry.identityKey);
+                        if (identity.key !== null && claimed.has(identity.key)) {
+                            continue;
+                        }
+                        const isLogin = identity.provider !== "other";
+                        if (isLogin &&
+                            identity.key !== null &&
+                            knownKeys !== null &&
+                            !knownKeys.has(identity.key)) {
                             continue;
                         }
-                        const isRealAccount = REAL_ACCOUNT_TYPES.has(entry.type);
                         rows.push({
                             label: entry.label,
-                            key: null,
-                            kind: isRealAccount
+                            key: isLogin ? identity.key : null,
+                            ...(isLogin ? { provider: identity.provider } : {}),
+                            kind: isLogin
                                 ? "account"
                                 : entry.type === "translation"
                                     ? "translation"
                                     : "internal",
-                            type: entry.type,
-                            status: isRealAccount ? "unrouted" : null,
+                            // The row's type is the credential kind; the engine is
+                            // `provider`. Stats record Codex logins as "codex-oauth", which
+                            // consumers that only know the credential kinds read as
+                            // plumbing, so it is reported as the OAuth login it is.
+                            type: identity.provider === "codex" ? "oauth" : entry.type,
+                            status: isLogin ? "unrouted" : null,
                             cooling: false,
                             allowed: null,
                             expired: null,
-                            isPrimary: isPrimaryAccount(entry.label),
+                            isPrimary: isLogin ? isPrimaryAccount(identity.key) : false,
                             requests: entry.successCount + entry.errorCount,
                             errors: entry.errorCount,
                             rateLimits: entry.rateLimitCount,
@@ -7593,7 +7698,9 @@ export function createClaudeProxyRoutes(modelRouter, basePath = "", accountStrat
                             // and cost in the ledger — hardcoding null here discarded
                             // exactly the usage an operator is looking for when they ask
                             // why traffic stopped.
-                            usage: usageByAccount.get(entry.label) ?? null,
+                            usage: identity.key !== null
+                                ? (usageByAccount.get(identity.key) ?? null)
+                                : null,
                         });
                     }
                     const response = {
@@ -8001,6 +8108,9 @@ export const __testHooks = {
         limitsRefreshInFlight = null;
         accountQuotaRefreshCoordinator.clear();
     },
+    setAccountDirectoryForTests: (override) => {
+        accountDirectoryOverride = override;
+    },
     isRetryableNetworkError,
     isPermanentRefreshFailure,
     getStreamFailureDetails,

package/dist/types/providerCatalog.d.ts

@@ -44,6 +44,12 @@ export type CatalogErrorRuleJson = {
 };
 export type CatalogQuirks = {
     timeoutErrorClass?: "provider";
+    /** Vendor speaks OpenAI for chat but restricts how message content is
+     *  encoded. "string": `messages[].content` must be a plain string —
+     *  the content-parts array and the `null` OpenAI uses on an assistant
+     *  message with tool_calls are both rejected with HTTP 400. Normalized by
+     *  ConfiguredOpenAICompatProvider so tool round-trips work. */
+    messageContentFormat?: "string";
     registryDefaultIgnoresModelEnvVar?: boolean;
 };
 export type CatalogBillingPolicy = "free-tier" | "free-with-card" | "no-free-tier";

package/dist/types/providers.d.ts

@@ -693,6 +693,9 @@ export type OpenAICompatCatalogEntry = {
      * the classifier's default (six of the seven catalog entries).
      */
     timeoutErrorClass?: new (message: string, provider?: string) => ProviderError;
+    /** See CatalogQuirks.messageContentFormat — a vendor that accepts
+     *  `messages[].content` only as a plain string. */
+    messageContentFormat?: "string";
 };
 /** The subset of OpenAICompatCatalogEntry that resolveOpenAICompatConfig()
  *  needs — lets call sites pass a minimal object without the full catalog

package/dist/types/proxy.d.ts

@@ -1209,8 +1209,14 @@ export type ProxyQuotaRefreshRunResult = {
 export type ProxyLimitsAccountResult = {
     /** Account label (quota-store key). */
     account: string;
-    /** Token-store key ("anthropic:<label>"). */
+    /** Token-store key ("anthropic:<label>" or "codex:<label>"). */
     key: string;
+    /**
+     * Which pool engine owns this login. Two logins can share a label — an
+     * operator may use one email for both — so the key, not the label, is the
+     * identity, and this names the engine without parsing the key's prefix.
+     */
+    provider: ProxyAccountProvider;
     type: ProxyAccountType;
     status: "refreshed" | "throttled" | "skipped_api_key" | "snapshot" | "error";
     /** Fresh quota on "refreshed"; last known snapshot otherwise (may be null). */
@@ -1219,6 +1225,20 @@ export type ProxyLimitsAccountResult = {
     coolingUntil?: number;
     coolingReason?: AccountCoolingReason;
 };
+/** The pool engine a login belongs to, as named on limits and accounts rows. */
+export type ProxyAccountProvider = "anthropic" | "codex";
+/**
+ * Test-only replacement for the token store behind the account-exposing
+ * routes. The token store is a module singleton bound to the real home at
+ * import, so a suite cannot redirect it; this lets a case state which logins
+ * exist (`knownKeys`, including disabled ones) and which are routable per
+ * engine, exactly as the real listers would answer.
+ */
+export type ProxyAccountDirectoryOverride = {
+    knownKeys: Set<string>;
+    anthropic: ProxyPassthroughAccount[];
+    codex: ProxyPassthroughAccount[];
+};
 /** Response body of the proxy's GET /limits endpoint. */
 export type ProxyLimitsRefreshResponse = {
     fetchedAt: number;

package/dist/types/proxyClient.d.ts

@@ -141,10 +141,21 @@ export type CliClientUsageTotals = {
 };
 /** One row of GET /accounts. */
 export type CliAccountsRow = {
-    /** Bare label, e.g. "someone@example.com". The join key across all sources. */
+    /**
+     * Bare label, e.g. "someone@example.com". Display only: two rows can share
+     * it when one email is logged in to both engines. `key` is the identity.
+     */
     label: string;
-    /** Full pool key, e.g. "anthropic:someone@example.com". */
+    /**
+     * Full pool key, e.g. "anthropic:someone@example.com" or
+     * "codex:someone@example.com". Null only for plumbing rows.
+     */
     key: string | null;
+    /**
+     * Which pool engine owns this login. Absent on plumbing rows. Consumers
+     * that key a list by row must key by `key`, not `label` — see above.
+     */
+    provider?: "anthropic" | "codex";
     /**
      * What this row actually is. Only "account" rows are real logins; the proxy
      * also tracks internal and translation pseudo-accounts, which have no quota
@@ -183,6 +194,13 @@ export type CliAccountsResponse = {
 /** One request as recorded in the proxy request log, reduced to what costing needs. */
 export type ProxyLedgerEntry = {
     account: string;
+    /**
+     * Provider-qualified identity, "anthropic:<label>" or "codex:<label>".
+     * Read from the log row when present; derived from `accountType` for rows
+     * written before the pool logged it. This, not `account`, is the join key:
+     * one email can be logged in to both engines.
+     */
+    accountKey: string;
     /** Derived calling CLI; see CliAccountUsageTotals.byClient. */
     clientApp: string;
     accountType: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@juspay/neurolink",
-  "version": "12.9.1",
+  "version": "12.9.3",
   "packageManager": "pnpm@10.15.1",
   "description": "TypeScript AI SDK with 24+ LLM providers behind one consistent API. MCP-native (connect any MCP server), voice TTS/STT/realtime, RAG, agents, memory, context compaction. OpenAI · Anthropic · Gemini · Bedrock · Azure · Ollama · DeepSeek · NVIDIA NIM and more.",
   "author": {
@@ -41,6 +41,7 @@
     "prepack": "svelte-kit sync && svelte-package && pnpm run build:react-hooks && pnpm run build:cli && pnpm run build:browser && publint",
     "build:react-hooks": "pnpm exec tsc --jsx react-jsx --module nodenext --moduleResolution nodenext --target esnext --esModuleInterop --skipLibCheck --outDir dist --declaration false src/lib/client/reactHooks.tsx",
     "check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json && tsc --noEmit --strict",
+    "check:models": "tsx tools/check-model-liveness.ts",
     "check:ci-scripts": "svelte-kit sync && tsc -p tsconfig.ci-scripts.json",
     "check:test-parse": "node scripts/parse-check-tests.mjs",
     "check:tools-tests": "svelte-kit sync && tsc -p tsconfig.tools-tests.json",