@juspay/neurolink 12.9.6 → 12.10.0

package/dist/types/config.d.ts

@@ -6,6 +6,7 @@ import type { MCPToolRegistry } from "../mcp/toolRegistry.js";
 import type { TaskManagerConfig } from "./task.js";
 import type { HITLConfig } from "../types/hitl.js";
 import type { ConversationMemoryConfig } from "./conversation.js";
+import type { ArtifactStorageConfig } from "./artifact.js";
 import type { ObservabilityConfig } from "./observability.js";
 import type { AuthProvider, AuthProviderType, AuthProviderConfig, Auth0Config, ClerkConfig, FirebaseConfig, SupabaseConfig, WorkOSConfig, BetterAuthConfig, JWTConfig, OAuth2Config, CognitoConfig, KeycloakConfig, AuthenticatedContext } from "./auth.js";
 import type { NeurolinkCredentials } from "./providers.js";
@@ -61,6 +62,12 @@ export type NeurolinkConstructorConfig = {
     modelAliasConfig?: ModelAliasConfig;
     /** MCP enhancement modules configuration (cache, router, batcher, annotations, middleware) */
     mcp?: MCPEnhancementsConfig;
+    /**
+     * Artifact storage: where externalized MCP tool outputs and banked payloads
+     * live. The backend follows `STORAGE_TYPE` exactly like conversation memory
+     * unless chosen here. See {@link ArtifactStorageConfig}.
+     */
+    artifacts?: ArtifactStorageConfig;
     /** Authentication provider configuration */
     auth?: NeuroLinkAuthConfig;
     /** TaskManager configuration (scheduled and self-running tasks) */

package/dist/utils/redis.d.ts

@@ -3,6 +3,21 @@
  * Helper functions for Redis storage operations
  */
 import type { ChatMessage, RedisClient, RedisConversationObject, RedisStorageConfig } from "../types/index.js";
+/**
+ * Redact the userinfo of every `scheme://user:pass@host` in `text`.
+ *
+ * Deliberately not a regex. `/:\/\/[^@]+@/` and its relatives backtrack
+ * quadratically on input with many `://` and no `@` (CodeQL
+ * js/polynomial-redos), and the URL here can come straight from a caller —
+ * `RedisStorageConfig.url` reaches this through `RedisArtifactStore` and the
+ * conversation memory manager. One forward pass, every character visited a
+ * bounded number of times.
+ *
+ * Redacts everything before the LAST `@` of the authority, so a password
+ * containing `@` is still hidden. A URL with only a user name is redacted
+ * too; the old regexes let that through.
+ */
+export declare function redactUrlCredentials(text: string): string;
 /**
  * Get a pooled Redis connection. Multiple callers with the same host:port:db
  * share a single connection, reducing connection count.

package/dist/utils/redis.js

@@ -6,17 +6,75 @@ import { randomUUID } from "crypto";
 import { createClient } from "redis";
 import { logger } from "./logger.js";
 const SESSION_ONLY_PREFIX = "session-only:";
+/** Characters that end the authority (`user:pass@host:port`) of a URL in text. */
+const AUTHORITY_TERMINATORS = new Set(["/", "?", "#", " ", "\t", "\n", "\r"]);
+/**
+ * Redact the userinfo of every `scheme://user:pass@host` in `text`.
+ *
+ * Deliberately not a regex. `/:\/\/[^@]+@/` and its relatives backtrack
+ * quadratically on input with many `://` and no `@` (CodeQL
+ * js/polynomial-redos), and the URL here can come straight from a caller —
+ * `RedisStorageConfig.url` reaches this through `RedisArtifactStore` and the
+ * conversation memory manager. One forward pass, every character visited a
+ * bounded number of times.
+ *
+ * Redacts everything before the LAST `@` of the authority, so a password
+ * containing `@` is still hidden. A URL with only a user name is redacted
+ * too; the old regexes let that through.
+ */
+export function redactUrlCredentials(text) {
+    let out = "";
+    let cursor = 0;
+    for (;;) {
+        const schemeEnd = text.indexOf("://", cursor);
+        if (schemeEnd === -1) {
+            return out + text.slice(cursor);
+        }
+        const authorityStart = schemeEnd + 3;
+        let authorityEnd = authorityStart;
+        let lastAt = -1;
+        while (authorityEnd < text.length) {
+            const ch = text[authorityEnd];
+            if (AUTHORITY_TERMINATORS.has(ch)) {
+                break;
+            }
+            if (ch === "@") {
+                lastAt = authorityEnd;
+            }
+            authorityEnd += 1;
+        }
+        if (lastAt === -1) {
+            out += text.slice(cursor, authorityEnd);
+            cursor = authorityEnd;
+        }
+        else {
+            out += `${text.slice(cursor, authorityStart)}[redacted]@`;
+            cursor = lastAt + 1;
+        }
+    }
+}
 // Connection pool - keyed by host:port:db
 const connectionPool = new Map();
 const pendingConnections = new Map();
+/**
+ * One pool key per distinct connection. Shared by acquire AND release: they
+ * used to compute it separately, and the release side never knew about the
+ * `url:` form, so a URL-configured client was acquired under one key and
+ * "released" under another that did not exist — its reference count never
+ * dropped and the connection outlived every owner. Credentials never appear
+ * in the key; it is logged.
+ */
+function poolKeyFor(config) {
+    return config.url
+        ? `url:${redactUrlCredentials(config.url)}`
+        : `${config.host}:${config.port}:${config.db}:${config.password ? "auth" : "noauth"}`;
+}
 /**
  * Get a pooled Redis connection. Multiple callers with the same host:port:db
  * share a single connection, reducing connection count.
  */
 export async function getPooledRedisClient(config) {
-    const key = config.url
-        ? `url:${config.url.replace(/:\/\/[^:]+:[^@]+@/, "://[redacted]@")}`
-        : `${config.host}:${config.port}:${config.db}:${config.password ? "auth" : "noauth"}`;
+    const key = poolKeyFor(config);
     const existing = connectionPool.get(key);
     if (existing && existing.client.isOpen) {
         existing.refCount++;
@@ -77,7 +135,7 @@ export async function getPooledRedisClient(config) {
  * Release a pooled Redis connection. Only closes when refCount reaches 0.
  */
 export async function releasePooledRedisClient(config) {
-    const key = `${config.host}:${config.port}:${config.db}:${config.password ? "auth" : "noauth"}`;
+    const key = poolKeyFor(config);
     const entry = connectionPool.get(key);
     if (!entry) {
         return;
@@ -140,7 +198,7 @@ export async function createRedisClient(config) {
     // Create client with secured options
     const client = createClient(clientOptions);
     client.on("error", (err) => {
-        const sanitizedMessage = err.message.replace(/redis:\/\/.*?@/g, "redis://[redacted]@");
+        const sanitizedMessage = redactUrlCredentials(err.message);
         logger.error("Redis client error", { error: sanitizedMessage });
     });
     client.on("connect", () => {
@@ -420,7 +478,7 @@ export function getNormalizedConfig(config) {
                 : 0;
         }
         catch (e) {
-            const sanitizedUrl = url.replace(/:\/\/[^@]+@/, "://[redacted]@");
+            const sanitizedUrl = redactUrlCredentials(url);
             logger.warn("[redisUtils] Failed to parse Redis URL, falling back to component-based connection", {
                 url: sanitizedUrl,
                 error: e instanceof Error ? e.message : String(e),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@juspay/neurolink",
-  "version": "12.9.6",
+  "version": "12.10.0",
   "packageManager": "pnpm@10.15.1",
   "description": "TypeScript AI SDK with 24+ LLM providers behind one consistent API. MCP-native (connect any MCP server), voice TTS/STT/realtime, RAG, agents, memory, context compaction. OpenAI · Anthropic · Gemini · Bedrock · Azure · Ollama · DeepSeek · NVIDIA NIM and more.",
   "author": {
@@ -456,7 +456,7 @@
     "exceljs": "^4.4.0",
     "express": "^5.1.0",
     "express-rate-limit": "^8.2.1",
-    "fastify": "^5.8.5",
+    "fastify": "^5.12.1",
     "ffmpeg-static": "^5.3.0",
     "fluent-ffmpeg": "^2.1.3",
     "koa": "^3.1.1",
@@ -605,7 +605,7 @@
       "@opentelemetry/sdk-trace-node": "^2.6.0",
       "jws@<4.0.1": ">=4.0.1",
       "tar@<7.5.8": ">=7.5.8",
-      "qs@<6.15.2": ">=6.15.2",
+      "qs@<6.16.0": ">=6.16.0",
       "minimatch@>=10.0.0 <10.2.3": ">=10.2.3",
       "minimatch@>=9.0.0 <9.0.7": ">=9.0.7",
       "typedoc>minimatch": ">=10.2.3",
@@ -622,7 +622,7 @@
       "ajv@>=8.0.0 <8.18.0": ">=8.18.0",
       "@grpc/grpc-js@<1.14.4": ">=1.14.4",
       "@protobufjs/utf8@<1.1.1": ">=1.1.1",
-      "fast-uri@<3.1.5": ">=3.1.5 <4",
+      "fast-uri@<3.1.6": ">=3.1.6 <4",
       "ip-address@<10.1.1": ">=10.1.1",
       "basic-ftp@<5.2.2": ">=5.2.2",
       "fast-xml-builder@<1.1.7": ">=1.1.7",
@@ -632,7 +632,7 @@
       "undici@>=8.0.0": ">=7.24.0 <8.0.0",
       "pdfjs-dist": "5.4.624",
       "markdown-it@<14.2.0": ">=14.2.0",
-      "@xmldom/xmldom@<0.9.11": ">=0.9.11",
+      "@xmldom/xmldom@<0.9.12": ">=0.9.12",
       "protobufjs@<7.6.5": ">=7.6.5",
       "brace-expansion@>=5.0.0 <5.0.9": ">=5.0.9",
       "@opentelemetry/core@>=2.0.0 <2.8.0": ">=2.8.0"