@juspay/neurolink 13.1.1 → 13.3.0

package/dist/neurolink.js

@@ -94,6 +94,7 @@ import { hasLifecycleErrorFired, markLifecycleErrorFired, markLifecycleStreamCal
 import { interleaveTTSStream } from "./utils/ttsStream.js";
 import { resolveLifecycleTimeoutMs } from "./utils/lifecycleTimeout.js";
 import { cloneOptionsForCallIsolation } from "./utils/cloneOptions.js";
+import { getGlobalMiddleware, readEnvMiddlewarePreset, resolveMiddlewareOptions, snapshotMiddlewareOptions, } from "./middleware/defaults.js";
 import { preserveLiveStreamAccessors } from "./utils/streamResultAccessors.js";
 import { coerceJsonToSchema, recoverScalarRoot, schemaAccepts, } from "./utils/json/coerce.js";
 // Factory processing imports
@@ -655,6 +656,12 @@ export class NeuroLink {
     discoveryPins = new Map();
     // Add orchestration property
     enableOrchestration;
+    // Language-model middleware defaults, lowest precedence first: the layer
+    // read from NEUROLINK_MIDDLEWARE_PRESET, then the constructor's `middleware`
+    // option. The module-level global registry sits between them and is read on
+    // each call, so it can change after construction. See middleware/defaults.ts.
+    envMiddleware;
+    constructorMiddleware;
     // Authentication provider for secure access control
     authProvider;
     pendingAuthConfig;
@@ -900,6 +907,18 @@ export class NeuroLink {
             ...tokenDerivedFields,
         };
     }
+    /**
+     * Fold the instance, global and environment middleware defaults beneath the
+     * call's own `middleware`. Runs before the lifecycle helpers so they layer
+     * onFinish/onError on top of the resolved config rather than replacing it.
+     * With no default set the options are left untouched.
+     */
+    applyMiddlewareDefaults(options) {
+        const resolved = resolveMiddlewareOptions([this.envMiddleware, getGlobalMiddleware(), this.constructorMiddleware], options.middleware);
+        if (resolved !== options.middleware) {
+            options.middleware = resolved;
+        }
+    }
     applyGenerateLifecycleMiddleware(options) {
         if (!options.onFinish && !options.onError) {
             return;
@@ -1207,6 +1226,13 @@ export class NeuroLink {
         return metricsTraceContextStorage.getStore() ?? null;
     }
     constructor(config) {
+        // Validated first: an invalid default must throw before the constructor
+        // starts telemetry or any other process-wide state.
+        this.envMiddleware = readEnvMiddlewarePreset();
+        this.constructorMiddleware =
+            config?.middleware === undefined
+                ? undefined
+                : snapshotMiddlewareOptions(config.middleware, "NeuroLink constructor");
         if (config?.toolRegistry) {
             // A supplied registry (a host's, shared with a worker) keeps its owner's
             // roots; per-call executeTool() binds this instance's policy anyway.
@@ -4157,6 +4183,7 @@ Current user's request: ${currentInput}`;
             options.input.text = piiResult.text;
         }
         this.enforceSessionBudget(options.maxBudgetUsd);
+        this.applyMiddlewareDefaults(options);
         this.applyGenerateLifecycleMiddleware(options);
         await this.applyAuthenticatedRequestContext(options);
         return { options, originalPrompt };
@@ -5470,6 +5497,9 @@ Current user's request: ${currentInput}`;
         // NL-004: Resolve model aliases/deprecations before processing
         isolated.model = resolveModel(isolated.model, this.modelAliasConfig);
         bindFileToolRoots(isolated, this.resolveFileToolRoots(isolated.toolRoots));
+        // generateText() reaches the same providers as generate() without passing
+        // through its prelude, so the middleware defaults are folded in here too.
+        this.applyMiddlewareDefaults(isolated);
         // Use internal generation method directly
         return await this.generateTextInternal(isolated);
     }
@@ -8291,6 +8321,7 @@ Current user's request: ${currentInput}`;
         this.enforceSessionBudget(options.maxBudgetUsd);
         await this.applyAuthenticatedRequestContext(options);
         this.emitStreamStartEvents(options, startTime);
+        this.applyMiddlewareDefaults(options);
         this.applyStreamLifecycleMiddleware(options);
     }
     async maybeHandleWorkflowStreamRequest(params) {
@@ -14298,7 +14329,13 @@ Current user's request: ${currentInput}`;
                     timeoutMs: options.timeoutMs,
                 });
                 const answerCount = Object.keys(result.answers).length;
-                const cost = calculateCost(providerName, result.model, {
+                // `providerName` is what the caller passed, so it can be an alias
+                // (`jev`, `scaledown-classify`). The pricing table is keyed by the
+                // canonical id and does not read the decide catalog, so an alias
+                // priced the decision at 0.
+                const pricedProvider = PROVIDER_ALIAS_INDEX.get(providerName.toLowerCase()) ??
+                    providerName;
+                const cost = calculateCost(pricedProvider, result.model, {
                     input: result.usage.inputTokens,
                     output: result.usage.outputTokens,
                     total: result.usage.inputTokens + result.usage.outputTokens,

package/dist/providers/catalog/charm-hyper.json

@@ -89,11 +89,10 @@
                 },
                 "vision": true,
                 "status": "production",
-                "description": "Moonshot Kimi K3 — vision-capable per the live roster; reasoning effort levels low/high/xhigh (default high). Context window, max output tokens, vision and pricing per GET https://hyper.charm.land/v1/models (unauthenticated, 2026-09-28)."
+                "description": "Moonshot Kimi K3 — vision-capable per the live roster; reasoning effort levels low/high/xhigh (default high). Context window, max output tokens, vision and pricing per GET https://hyper.charm.land/v1/models (unauthenticated, 2026-09-28). The 16000 max output tokens is Hyper's own cap for this model: Hyper's List Models docs (https://hyper.charm.land/docs/api/list-models.html) define `max_output_tokens` as the model's max output tokens, and the roster still reported 16000 on 2026-10-18. Moonshot's own API allows more (`max_completion_tokens` defaults to 131072 and can be set up to 1048576, per https://platform.kimi.ai/docs/guide/kimi-k3-quickstart), so the cap belongs to this gateway, not to the model."
             },
             "kimi-k2-thinking": {
                 "contextWindow": 262144,
-                "maxOutputTokens": 26214,
                 "pricingPerMTok": {
                     "input": 0.6,
                     "output": 2.5,
@@ -101,7 +100,7 @@
                 },
                 "vision": false,
                 "status": "production",
-                "description": "Moonshot Kimi K2 Thinking — reasoning-first Kimi variant; reasoning effort levels low/high/xhigh (default high). Context window, max output tokens, vision and pricing per GET https://hyper.charm.land/v1/models (unauthenticated, 2026-09-28)."
+                "description": "Moonshot Kimi K2 Thinking — reasoning-first Kimi variant; reasoning effort levels low/high/xhigh (default high). Context window, max output tokens, vision and pricing per GET https://hyper.charm.land/v1/models (unauthenticated, 2026-09-28). No maxOutputTokens is recorded: the roster reports 26214, which is a fixed fraction of the 262144-token context window and reads like a gateway default rather than a model limit."
             },
             "kimi-k2.7-code": {
                 "contextWindow": 256000,
@@ -113,7 +112,7 @@
                 },
                 "vision": true,
                 "status": "production",
-                "description": "Moonshot Kimi K2.7 Code — code-focused Kimi variant, vision-capable per the live roster; reasoning effort levels low/high/xhigh (default high). Context window, max output tokens, vision and pricing per GET https://hyper.charm.land/v1/models (unauthenticated, 2026-09-28)."
+                "description": "Moonshot Kimi K2.7 Code — code-focused Kimi variant, vision-capable per the live roster; reasoning effort levels low/high/xhigh (default high). Context window, max output tokens, vision and pricing per GET https://hyper.charm.land/v1/models (unauthenticated, 2026-09-28). The 16000 max output tokens is Hyper's own cap for this model: Hyper's List Models docs (https://hyper.charm.land/docs/api/list-models.html) define `max_output_tokens` as the model's max output tokens, and the roster still reported 16000 on 2026-10-18. Moonshot's own API defaults `max_tokens` to 32768 (https://platform.kimi.ai/docs/guide/kimi-k2-7-code-quickstart), so the cap belongs to this gateway, not to the model."
             },
             "glm-5.3": {
                 "contextWindow": 1000000,
@@ -165,7 +164,6 @@
             },
             "minimax-m2.7": {
                 "contextWindow": 262100,
-                "maxOutputTokens": 6553,
                 "pricingPerMTok": {
                     "input": 0.484,
                     "output": 1.852,
@@ -173,7 +171,7 @@
                 },
                 "vision": false,
                 "status": "production",
-                "description": "MiniMax M2.7 — prior MiniMax generation. Context window, max output tokens, vision and pricing per GET https://hyper.charm.land/v1/models (unauthenticated, 2026-09-28)."
+                "description": "MiniMax M2.7 — prior MiniMax generation. Context window, max output tokens, vision and pricing per GET https://hyper.charm.land/v1/models (unauthenticated, 2026-09-28). No maxOutputTokens is recorded: the roster reports 6553, which is a fixed fraction of the 262100-token context window and reads like a gateway default rather than a model limit."
             },
             "inkling": {
                 "contextWindow": 1048576,
@@ -273,7 +271,6 @@
             },
             "gpt-oss-120b": {
                 "contextWindow": 131072,
-                "maxOutputTokens": 13107,
                 "pricingPerMTok": {
                     "input": 0.178,
                     "output": 0.68,
@@ -281,11 +278,10 @@
                 },
                 "vision": false,
                 "status": "production",
-                "description": "OpenAI's open-weight gpt-oss-120b. Context window, max output tokens, vision and pricing per GET https://hyper.charm.land/v1/models (unauthenticated, 2026-09-28)."
+                "description": "OpenAI's open-weight gpt-oss-120b. Context window, max output tokens, vision and pricing per GET https://hyper.charm.land/v1/models (unauthenticated, 2026-09-28). No maxOutputTokens is recorded: the roster reports 13107, which is a fixed fraction of the 131072-token context window and reads like a gateway default rather than a model limit."
             },
             "gemma-4-26b-a4b-it": {
                 "contextWindow": 256000,
-                "maxOutputTokens": 25600,
                 "pricingPerMTok": {
                     "input": 0.098,
                     "output": 0.334,
@@ -293,7 +289,7 @@
                 },
                 "vision": false,
                 "status": "production",
-                "description": "Google Gemma 4 26B A4B, instruction-tuned. Context window, max output tokens, vision and pricing per GET https://hyper.charm.land/v1/models (unauthenticated, 2026-09-28)."
+                "description": "Google Gemma 4 26B A4B, instruction-tuned. Context window, max output tokens, vision and pricing per GET https://hyper.charm.land/v1/models (unauthenticated, 2026-09-28). No maxOutputTokens is recorded: the roster reports 25600, which is a fixed fraction of the 256000-token context window and reads like a gateway default rather than a model limit."
             }
         },
         "topModels": [

package/dist/providers/catalog/index.generated.d.ts

@@ -2,4 +2,4 @@ import type { DecideCatalogJson, ProviderCatalogJson } from "../../types/index.j
 export declare const CATALOG_JSON_ENTRIES: ProviderCatalogJson[];
 export declare const CATALOG_PROVIDER_IDS: readonly ["a2agent", "abliteration", "above-dev", "ai21", "aiand", "aihubmix", "aionlabs", "ambient", "api-route", "arcee", "atlas-cloud", "avian-io", "baidu-qianfan", "baseten", "bee-heossi", "byteplus-modelark", "bytez", "cerebras", "charm-hyper", "chutes", "cloudflare", "crusoe", "dashscope", "deepinfra", "deepseek", "empiriolabs", "featherless-ai", "fireworks", "friendli", "gmicloud", "gradientai", "groq", "hetzner-inference", "huggingface", "inception-labs", "inceptron", "inco", "inference-net", "io-intelligence", "koscompute", "lemonfox-ai", "lilac", "llmtech", "longcat", "mancer", "meta-model-api", "minimax", "mistral", "moark", "modelscope", "moonshot-ai", "morph", "naver-clova-studio", "nebius", "neuralwatt", "novita", "ovhcloud", "parasail", "pareto-inference", "perplexity", "poolside", "prime-intellect", "reka", "runinfra", "sakana-ai", "sambanova", "sarvam", "scaleway", "siliconflow", "stackit", "stepfun", "subconscious", "synthetic", "telnyx", "thinking-machines", "tinfoil", "together-ai", "umans-ai", "upstage", "venice-ai", "vispark", "vultr-inference", "wafer", "wandb-inference", "xai", "xiaomi-mimo", "z-ai"];
 export declare const DECIDE_CATALOG_JSON_ENTRIES: DecideCatalogJson[];
-export declare const DECIDE_CATALOG_PROVIDER_IDS: readonly ["laya", "openai-decisions", "subq", "xor"];
+export declare const DECIDE_CATALOG_PROVIDER_IDS: readonly ["laya", "openai-decisions", "scaledown", "subq", "xor"];

package/dist/providers/catalog/index.generated.js

@@ -69,6 +69,7 @@ import runinfraJson from "./runinfra.json" with { type: "json" };
 import sakanaAiJson from "./sakana-ai.json" with { type: "json" };
 import sambanovaJson from "./sambanova.json" with { type: "json" };
 import sarvamJson from "./sarvam.json" with { type: "json" };
+import scaledownJson from "./scaledown.json" with { type: "json" };
 import scalewayJson from "./scaleway.json" with { type: "json" };
 import siliconflowJson from "./siliconflow.json" with { type: "json" };
 import stackitJson from "./stackit.json" with { type: "json" };
@@ -280,12 +281,14 @@ export const CATALOG_PROVIDER_IDS = [
 export const DECIDE_CATALOG_JSON_ENTRIES = [
     layaJson,
     openaiDecisionsJson,
+    scaledownJson,
     subqJson,
     xorJson,
 ].map(asDecideEntry);
 export const DECIDE_CATALOG_PROVIDER_IDS = [
     "laya",
     "openai-decisions",
+    "scaledown",
     "subq",
     "xor",
 ];

package/dist/providers/catalog/openai-decisions.json

@@ -60,7 +60,7 @@
         "instructions": [
             "1. Create an API key at https://platform.openai.com/api-keys",
             "2. Set {apiKeyEnvVar}; it is shared with the openai chat provider",
-            "3. With no other decision provider configured, {apiKeyEnvVar} alone makes openai-decisions the default decision provider (the last resort, after every other one, as PERPLEXITY_API_KEY does for perplexity-decider), unless OPENAI_BASE_URL, OPENAI_API_BASE or credentials.openai.baseURL names a host other than https://api.openai.com: the key is then taken to be a gateway's and is not used by default. To use it while another provider is configured, name it in a call (provider: \"openai-decisions\" or --provider openai-decisions), but only if the key is OpenAI's, because a named call sends the environment key to api.openai.com. Behind a gateway, route it on purpose with OPENAI_DECISIONS_BASE_URL or credentials.openaiDecisions, or do not use it",
+            "3. With no other decision provider configured, {apiKeyEnvVar} alone makes openai-decisions the default decision provider (a last resort, after every other one except ScaleDown, as PERPLEXITY_API_KEY does for perplexity-decider), unless OPENAI_BASE_URL, OPENAI_API_BASE or credentials.openai.baseURL names a host other than https://api.openai.com: the key is then taken to be a gateway's and is not used by default. To use it while another provider is configured, name it in a call (provider: \"openai-decisions\" or --provider openai-decisions), but only if the key is OpenAI's, because a named call sends the environment key to api.openai.com. Behind a gateway, route it on purpose with OPENAI_DECISIONS_BASE_URL or credentials.openaiDecisions, or do not use it",
             "4. Optional: OPENAI_DECISIONS_BASE_URL (an origin) and OPENAI_DECISIONS_MODEL (default gpt-6-luna)"
         ]
     },

package/dist/providers/catalog/provider-catalog.schema.json

@@ -142,6 +142,14 @@
             }
           }
         },
+        "authHeader": {
+          "enum": ["bearer", "x-api-key"],
+          "description": "How the API key is sent. bearer, the default when omitted, sends Authorization: Bearer <key>. x-api-key sends x-api-key: <key> and no Authorization header at all. This is the decide request's own setting; quirks.authHeaderStyle belongs to the chat path and is not read here."
+        },
+        "stateEncoding": {
+          "enum": ["text"],
+          "description": "text makes the state that goes out always a string: a string is sent unchanged (not trimmed), any other value is sent as its JSON text, and a state that is blank after trimming is refused before any request, as an invalid_request. Omitted means the state goes out as given."
+        },
         "media": {
           "type": "object",
           "additionalProperties": false,

package/dist/providers/catalog/scaledown.json

@@ -0,0 +1,68 @@
+{
+    "$schema": "./provider-catalog.schema.json",
+    "id": "scaledown",
+    "displayName": "ScaleDown",
+    "enumTypeName": "ScaleDownModels",
+    "aliases": ["scaledown-classify"],
+    "inferenceKinds": ["decide"],
+    "wire": { "baseURL": "https://api.scaledown.xyz" },
+    "models": {
+        "default": "classify-1",
+        "topModels": ["classify-1", "classify"],
+        "catalog": {
+            "classify-1": {
+                "contextWindow": 128000,
+                "maxOutputTokens": 1,
+                "vision": false,
+                "status": "preview",
+                "description": "Recommended - ScaleDown Classify 1, decision model for boolean, choice and score questions; context window and output limit not established"
+            },
+            "classify": {
+                "vision": false,
+                "status": "preview",
+                "description": "ScaleDown's name for its latest Classify model; whether it moves to a newer model is not established"
+            }
+        }
+    },
+    "decide": {
+        "dialect": "system-one",
+        "order": 8,
+        "baseURLNormalize": ["strip-trailing-slash"],
+        "endpoint": "{baseURL}/v1/scaledown",
+        "model": { "placement": "body" },
+        "authHeader": "x-api-key",
+        "stateEncoding": "text",
+        "errors": {
+            "rules": [
+                { "status": 401, "kind": "authentication" },
+                { "status": [402, 422], "kind": "invalid_request" },
+                { "status": 429, "kind": "rate_limit" },
+                { "status": 502, "kind": "server" },
+                { "status": 504, "kind": "timeout" },
+                { "statusMin": 500, "kind": "server" }
+            ],
+            "default": "invalid_request",
+            "bodyShapes": [{ "path": "detail.message" }, { "path": "detail" }]
+        }
+    },
+    "setup": {
+        "url": "https://docs.scaledown.ai",
+        "apiKeyFormat": null,
+        "billingPolicy": "promotional-credit",
+        "description": "API key from ScaleDown (see its documentation). Sign-up gives a free allowance; whether it expires is not established",
+        "instructions": [
+            "1. Create an account and an API key, following https://docs.scaledown.ai",
+            "2. Set {apiKeyEnvVar} in your .env file",
+            "3. ScaleDown's documentation says the key goes in an x-api-key header rather than Authorization: Bearer, and NeuroLink sends it that way",
+            "4. ScaleDown's documentation says a request made with no credit left returns HTTP 402"
+        ]
+    },
+    "evidence": {
+        "rosterVerified": {
+            "date": "2026-10-15",
+            "method": "Checked by the marketing session, not in this change: ScaleDown's docs at docs.scaledown.ai were read and probes were made against api.scaledown.xyz. No request was made to ScaleDown in this change"
+        },
+        "liveMatrix": null,
+        "addedInPR": "https://github.com/juspay/neurolink/pull/2005"
+    }
+}

package/dist/providers/catalog/schema.js

@@ -600,6 +600,8 @@ const decideBlockSchema = z.strictObject({
         placement: z.enum(["body", "body-unless-alias"]),
         alias: z.string().min(1).optional(),
     }),
+    authHeader: z.enum(["bearer", "x-api-key"]).optional(),
+    stateEncoding: z.enum(["text"]).optional(),
     media: decideMediaSchema.optional(),
     ambientKeyGuard: ambientKeyGuardSchema.optional(),
     requestIdHeaders: z.array(decideHeaderNameSchema).optional(),

package/dist/providers/configuredDecision.d.ts

@@ -15,6 +15,11 @@ export declare class ConfiguredDecisionProvider extends SystemOneDecisionProvide
     protected missingConfigMessage(): string | undefined;
     protected decisionEndpoint(): string;
     protected decisionHeaders(): Record<string, string>;
+    /**
+     * The state the dialect is given. Only an entry that sets `stateEncoding`
+     * changes it, so every other entry sends exactly what the caller passed.
+     */
+    private encodeState;
     protected buildDecisionBody(state: DecisionState, questions: Record<string, Record<string, unknown>>, model: string, media?: DecisionPreparedMedia): Record<string, unknown>;
     protected parseDecisionError(status: number, payload: unknown, requestId: string | undefined): DecisionError;
     protected readRequestId(headers: Headers): string | undefined;

package/dist/providers/configuredDecision.js

@@ -10,6 +10,9 @@ import { readPath } from "./decide/paths.js";
 import { fillEndpointTemplate } from "./decide/template.js";
 import { SystemOneDecisionProvider } from "./systemOneDecision.js";
 const readText = (value) => typeof value === "string" ? value.trim() : "";
+// JSON.stringify answers undefined for a value JSON cannot hold, such as a
+// state a JavaScript caller left out, although its own return type says string.
+const stateText = (state) => typeof state === "string" ? state : JSON.stringify(state);
 /** A `decide` provider described entirely by its catalog entry. */
 export class ConfiguredDecisionProvider extends SystemOneDecisionProvider {
     entry;
@@ -68,15 +71,34 @@ export class ConfiguredDecisionProvider extends SystemOneDecisionProvider {
         return this.endpoint;
     }
     decisionHeaders() {
-        return {
-            Authorization: `Bearer ${this.apiKey}`,
-            "Content-Type": "application/json",
-        };
+        const credential = this.entry.decide.authHeader === "x-api-key"
+            ? { "x-api-key": this.apiKey }
+            : { Authorization: `Bearer ${this.apiKey}` };
+        return { ...credential, "Content-Type": "application/json" };
+    }
+    /**
+     * The state the dialect is given. Only an entry that sets `stateEncoding`
+     * changes it, so every other entry sends exactly what the caller passed.
+     */
+    encodeState(state) {
+        if (this.entry.decide.stateEncoding !== "text") {
+            return state;
+        }
+        const text = stateText(state);
+        if (text === undefined || text.trim() === "") {
+            throw this.decisionError({
+                kind: "invalid_request",
+                // Never the state itself, which can hold anything the caller was sent.
+                message: `${this.vendorLabel()} needs non-blank state text; the state was empty or only whitespace.`,
+                retryable: false,
+            });
+        }
+        return text;
     }
     buildDecisionBody(state, questions, model, media) {
         const { placement, alias } = this.entry.decide.model;
         return this.dialect().buildBody({
-            state,
+            state: this.encodeState(state),
             questions,
             model: placement === "body-unless-alias" && model === alias
                 ? undefined

package/dist/types/classifierRouter.d.ts

@@ -24,16 +24,16 @@ export type ClassifierDifficulty = "trivial" | "simple" | "moderate" | "hard" |
  * - `heuristic` — keyword/length scoring. Deterministic, zero latency.
  * - `llm` — a cheap classifier model via the injected `generate`.
  * - `jev` — a decision model, whichever decision provider is configured
- *   (TypeSafe's Jev, Laya, XOR, SubQ, Perplexity, Cloudflare Clef or OpenAI
- *   Decisions); one round trip that returns the confidence the provider
+ *   (TypeSafe's Jev, Laya, XOR, SubQ, Perplexity, Cloudflare Clef, OpenAI
+ *   Decisions or ScaleDown); one round trip that returns the confidence the provider
  *   reports (*calibrated* on TypeSafe's Jev, ~400ms there) rather than a
  *   self-reported one.
  * - `auto` — `jev` when a decision provider is configured, in the environment
  *   or in SDK credentials (`TYPESAFE_API_KEY`, `LAYA_API_KEY` with
  *   `LAYA_BASE_URL`, `XOR_API_KEY` with `XOR_BASE_URL`, `SUBQ_API_KEY`, `PERPLEXITY_API_KEY`,
- *   `CLOUDFLARE_API_KEY` with `CLOUDFLARE_ACCOUNT_ID`, or `OPENAI_API_KEY`,
+ *   `CLOUDFLARE_API_KEY` with `CLOUDFLARE_ACCOUNT_ID`, `OPENAI_API_KEY`,
  *   which does not count while `OPENAI_BASE_URL`, `OPENAI_API_BASE` or `credentials.openai.baseURL` names a
- *   host other than `https://api.openai.com`), otherwise `heuristic`.
+ *   host other than `https://api.openai.com`, or `SCALEDOWN_API_KEY`), otherwise `heuristic`.
  */
 export type ClassifierStrategyKind = "heuristic" | "llm" | "jev" | "auto";
 /**
@@ -195,15 +195,16 @@ export type ClassifierRouterConfig = {
      * decision provider is configured, in the environment or in SDK credentials
      * (`TYPESAFE_API_KEY`, `LAYA_API_KEY` with `LAYA_BASE_URL`,
      * `XOR_API_KEY` with `XOR_BASE_URL`, `SUBQ_API_KEY`, `PERPLEXITY_API_KEY`,
-     * `CLOUDFLARE_API_KEY` with `CLOUDFLARE_ACCOUNT_ID`, or `OPENAI_API_KEY`) and
-     * "heuristic" otherwise, so configuring one upgrades routing without any code
+     * `CLOUDFLARE_API_KEY` with `CLOUDFLARE_ACCOUNT_ID`, `OPENAI_API_KEY` or
+     * `SCALEDOWN_API_KEY`) and "heuristic" otherwise, so configuring one upgrades routing without any code
      * change. Behaviour for a caller with none of these is unchanged. Three of them
      * are shared with a text provider and count here too: `PERPLEXITY_API_KEY`
      * (Perplexity's), the Cloudflare pair (Workers AI's) and `OPENAI_API_KEY` (the
      * OpenAI chat provider's). A caller whose only key is `OPENAI_API_KEY` now
-     * resolves to "jev", answered by OpenAI Decisions as the last-resort decision
-     * provider; each classification is then a paid call that still falls back to
-     * the heuristic on any failure. The exception is a key that sits beside an
+     * resolves to "jev", answered by OpenAI Decisions (the default decision
+     * provider whenever none ahead of it in the order is configured); each
+     * classification is then a paid call that still falls back to the heuristic
+     * on any failure. The exception is a key that sits beside an
      * `OPENAI_BASE_URL`, `OPENAI_API_BASE` or `credentials.openai.baseURL` naming a host other than
      * `https://api.openai.com`: that key is a gateway's and does not count.
      */

package/dist/types/cli.d.ts

@@ -1770,9 +1770,9 @@ export type CliClassifierRouterFlags = {
      * (--classifier-strategy). "auto" resolves to "jev" when a decision
      * provider is configured (TYPESAFE_API_KEY, LAYA_API_KEY with
      * LAYA_BASE_URL, XOR_API_KEY with XOR_BASE_URL, SUBQ_API_KEY, PERPLEXITY_API_KEY,
-     * CLOUDFLARE_API_KEY with CLOUDFLARE_ACCOUNT_ID, or OPENAI_API_KEY, which does
+     * CLOUDFLARE_API_KEY with CLOUDFLARE_ACCOUNT_ID, OPENAI_API_KEY, which does
      * not count beside an OPENAI_BASE_URL, OPENAI_API_BASE or credentials.openai.baseURL naming a host other
-     * than https://api.openai.com) and "heuristic" otherwise.
+     * than https://api.openai.com, or SCALEDOWN_API_KEY) and "heuristic" otherwise.
      */
     classifierStrategy?: string;
     /**

package/dist/types/config.d.ts

@@ -17,6 +17,7 @@ import type { ContextRelevanceOptions } from "./context.js";
 import type { DecisionHooks } from "./decision.js";
 import type { SkillsConfig } from "./skills.js";
 import type { KnowledgeGroundingConfig } from "./knowledge.js";
+import type { MiddlewareFactoryOptions } from "./middleware.js";
 /**
  * Main NeuroLink configuration type
  */
@@ -184,6 +185,27 @@ export type NeurolinkConstructorConfig = {
      * {@link KnowledgeGroundingConfig}.
      */
     knowledgeGrounding?: KnowledgeGroundingConfig;
+    /**
+     * Language-model middleware applied to every generate()/stream() on this
+     * instance (guardrails, analytics, custom middleware). Spares each call from
+     * repeating the same `middleware` option.
+     *
+     * Precedence, lowest to highest: `NEUROLINK_MIDDLEWARE_PRESET`,
+     * `configureGlobalMiddleware()`, this option, then the call's own
+     * `middleware`. `middlewareConfig` merges per middleware id, and a key set
+     * by a higher layer replaces the lower layer's value; arrays are replaced,
+     * never concatenated. A call can switch off an inherited middleware with
+     * `disabledMiddleware` or `middlewareConfig.<id>.enabled: false`.
+     *
+     * Throws a TypeError at construction when this is not an object or its
+     * `preset` is not a built-in preset (`default`, `all` or `security`).
+     *
+     * Unset by default, in which case calls behave exactly as before. Note that
+     * `preset: "security"` only turns guardrails on: nothing is redacted until
+     * `middlewareConfig.guardrails.config` supplies `badWords` or `modelFilter`.
+     * See {@link MiddlewareFactoryOptions}.
+     */
+    middleware?: MiddlewareFactoryOptions;
 };
 /**
  * Configuration for MCP enhancement modules wired into generate()/stream() paths.

package/dist/types/providerCatalog.d.ts

@@ -25,6 +25,14 @@ export type CatalogTimeouts = {
 };
 export type CatalogModelSpec = {
     contextWindow?: number;
+    /**
+     * The model's own output-token limit. Enforced at runtime: for a provider
+     * with no PROVIDER_MAX_TOKENS row, getSafeMaxTokens clamps a larger
+     * requested maxTokens to this value. Record only a number the vendor states
+     * as a hard limit; omit it when the source is a roster field that looks
+     * derived from the context window, because an omitted value leaves the
+     * model uncapped while a wrong one silently truncates callers.
+     */
     maxOutputTokens?: number;
     pricingPerMTok?: CatalogPricingPerMTok;
     vision: boolean;
@@ -314,6 +322,20 @@ export type DecideBlock = {
     /** Request URL; `{baseURL}` is the only placeholder. */
     endpoint: string;
     model: DecideModel;
+    /**
+     * How the API key is sent. `bearer`, the default when omitted, sends
+     * `Authorization: Bearer <key>`. `x-api-key` sends `x-api-key: <key>` and no
+     * `Authorization` header at all. This is the decide request's own setting;
+     * `quirks.authHeaderStyle` belongs to the chat path and is not read here.
+     */
+    authHeader?: "bearer" | "x-api-key";
+    /**
+     * `text` makes the state that goes out always a string: a string is sent
+     * unchanged (not trimmed), any other value is sent as its JSON text, and a
+     * state that is blank after trimming is refused before any request, as an
+     * `invalid_request`. Omitted means the state goes out as given.
+     */
+    stateEncoding?: "text";
     /** Body keys for images and video, after `model`, `state` and `questions`. Omitted means the body never carries media. */
     media?: DecideMedia;
     /**

package/dist/types/providerCatalog.generated.d.ts

@@ -1,2 +1,2 @@
-export type CatalogProviderName = "a2agent" | "abliteration" | "above-dev" | "ai21" | "aiand" | "aihubmix" | "aionlabs" | "ambient" | "api-route" | "arcee" | "atlas-cloud" | "avian-io" | "baidu-qianfan" | "baseten" | "bee-heossi" | "byteplus-modelark" | "bytez" | "cerebras" | "charm-hyper" | "chutes" | "cloudflare" | "crusoe" | "dashscope" | "deepinfra" | "deepseek" | "empiriolabs" | "featherless-ai" | "fireworks" | "friendli" | "gmicloud" | "gradientai" | "groq" | "hetzner-inference" | "huggingface" | "inception-labs" | "inceptron" | "inco" | "inference-net" | "io-intelligence" | "koscompute" | "laya" | "lemonfox-ai" | "lilac" | "llmtech" | "longcat" | "mancer" | "meta-model-api" | "minimax" | "mistral" | "moark" | "modelscope" | "moonshot-ai" | "morph" | "naver-clova-studio" | "nebius" | "neuralwatt" | "novita" | "openai-decisions" | "ovhcloud" | "parasail" | "pareto-inference" | "perplexity" | "poolside" | "prime-intellect" | "reka" | "runinfra" | "sakana-ai" | "sambanova" | "sarvam" | "scaleway" | "siliconflow" | "stackit" | "stepfun" | "subconscious" | "subq" | "synthetic" | "telnyx" | "thinking-machines" | "tinfoil" | "together-ai" | "umans-ai" | "upstage" | "venice-ai" | "vispark" | "vultr-inference" | "wafer" | "wandb-inference" | "xai" | "xiaomi-mimo" | "xor" | "z-ai";
-export type CatalogCredentialKey = "a2agent" | "abliteration" | "aboveDev" | "ai21" | "aiand" | "aihubmix" | "aionlabs" | "ambient" | "apiRoute" | "arcee" | "atlasCloud" | "avianIo" | "baiduQianfan" | "baseten" | "beeHeossi" | "byteplusModelark" | "bytez" | "cerebras" | "charmHyper" | "chutes" | "cloudflare" | "crusoe" | "dashscope" | "deepinfra" | "deepseek" | "empiriolabs" | "featherlessAi" | "fireworks" | "friendli" | "gmicloud" | "gradientai" | "groq" | "hetznerInference" | "huggingFace" | "inceptionLabs" | "inceptron" | "inco" | "inferenceNet" | "ioIntelligence" | "koscompute" | "laya" | "lemonfoxAi" | "lilac" | "llmtech" | "longcat" | "mancer" | "metaModelApi" | "minimax" | "mistral" | "moark" | "modelscope" | "moonshotAi" | "morph" | "naverClovaStudio" | "nebius" | "neuralwatt" | "novita" | "openaiDecisions" | "ovhcloud" | "parasail" | "paretoInference" | "perplexity" | "poolside" | "primeIntellect" | "reka" | "runinfra" | "sakanaAi" | "sambanova" | "sarvam" | "scaleway" | "siliconflow" | "stackit" | "stepfun" | "subconscious" | "subq" | "synthetic" | "telnyx" | "thinkingMachines" | "tinfoil" | "together" | "umansAi" | "upstage" | "veniceAi" | "vispark" | "vultrInference" | "wafer" | "wandbInference" | "xai" | "xiaomiMimo" | "xor" | "zAi";
+export type CatalogProviderName = "a2agent" | "abliteration" | "above-dev" | "ai21" | "aiand" | "aihubmix" | "aionlabs" | "ambient" | "api-route" | "arcee" | "atlas-cloud" | "avian-io" | "baidu-qianfan" | "baseten" | "bee-heossi" | "byteplus-modelark" | "bytez" | "cerebras" | "charm-hyper" | "chutes" | "cloudflare" | "crusoe" | "dashscope" | "deepinfra" | "deepseek" | "empiriolabs" | "featherless-ai" | "fireworks" | "friendli" | "gmicloud" | "gradientai" | "groq" | "hetzner-inference" | "huggingface" | "inception-labs" | "inceptron" | "inco" | "inference-net" | "io-intelligence" | "koscompute" | "laya" | "lemonfox-ai" | "lilac" | "llmtech" | "longcat" | "mancer" | "meta-model-api" | "minimax" | "mistral" | "moark" | "modelscope" | "moonshot-ai" | "morph" | "naver-clova-studio" | "nebius" | "neuralwatt" | "novita" | "openai-decisions" | "ovhcloud" | "parasail" | "pareto-inference" | "perplexity" | "poolside" | "prime-intellect" | "reka" | "runinfra" | "sakana-ai" | "sambanova" | "sarvam" | "scaledown" | "scaleway" | "siliconflow" | "stackit" | "stepfun" | "subconscious" | "subq" | "synthetic" | "telnyx" | "thinking-machines" | "tinfoil" | "together-ai" | "umans-ai" | "upstage" | "venice-ai" | "vispark" | "vultr-inference" | "wafer" | "wandb-inference" | "xai" | "xiaomi-mimo" | "xor" | "z-ai";
+export type CatalogCredentialKey = "a2agent" | "abliteration" | "aboveDev" | "ai21" | "aiand" | "aihubmix" | "aionlabs" | "ambient" | "apiRoute" | "arcee" | "atlasCloud" | "avianIo" | "baiduQianfan" | "baseten" | "beeHeossi" | "byteplusModelark" | "bytez" | "cerebras" | "charmHyper" | "chutes" | "cloudflare" | "crusoe" | "dashscope" | "deepinfra" | "deepseek" | "empiriolabs" | "featherlessAi" | "fireworks" | "friendli" | "gmicloud" | "gradientai" | "groq" | "hetznerInference" | "huggingFace" | "inceptionLabs" | "inceptron" | "inco" | "inferenceNet" | "ioIntelligence" | "koscompute" | "laya" | "lemonfoxAi" | "lilac" | "llmtech" | "longcat" | "mancer" | "metaModelApi" | "minimax" | "mistral" | "moark" | "modelscope" | "moonshotAi" | "morph" | "naverClovaStudio" | "nebius" | "neuralwatt" | "novita" | "openaiDecisions" | "ovhcloud" | "parasail" | "paretoInference" | "perplexity" | "poolside" | "primeIntellect" | "reka" | "runinfra" | "sakanaAi" | "sambanova" | "sarvam" | "scaledown" | "scaleway" | "siliconflow" | "stackit" | "stepfun" | "subconscious" | "subq" | "synthetic" | "telnyx" | "thinkingMachines" | "tinfoil" | "together" | "umansAi" | "upstage" | "veniceAi" | "vispark" | "vultrInference" | "wafer" | "wandbInference" | "xai" | "xiaomiMimo" | "xor" | "zAi";

package/dist/types/providers.d.ts

@@ -469,6 +469,10 @@ export type NeurolinkCredentials = {
         apiKey?: string;
         baseURL?: string;
     };
+    scaledown?: {
+        apiKey?: string;
+        baseURL?: string;
+    };
     scaleway?: {
         apiKey?: string;
         baseURL?: string;

package/dist/utils/pricing.js

@@ -812,6 +812,18 @@ const PRICING = {
         // name, so a `"gpt-6-luna"` key would price that chat model at this rate.
         _default: { input: 0.1 / 1_000_000, output: 0 },
     },
+    scaledown: {
+        // $0.05 per million input tokens, output free: `output: 0` is a price, not
+        // a token count, so do not "correct" it from `usage.output_tokens`. A list
+        // price from ScaleDown's launch post and from `usage.cost` in a response,
+        // both as reported to this project on 2026-10-15; this project has not
+        // priced a call itself. Per ScaleDown's docs each choice option is a
+        // separate internal call, so input tokens grow with options times state
+        // length (not measured here). Only `_default`: LiteLLM, OpenRouter and
+        // openai-compatible search every table by model name, so a `"classify"` key
+        // would price an unrelated model at this rate.
+        _default: { input: 0.05 / 1_000_000, output: 0 },
+    },
     "cloudflare-clef": {
         // Workers AI bills Clef per million INPUT tokens ($0.24 for clef, $0.09 for
         // clef-flash); no output price is listed. `output: 0` is a price, not a token

package/dist/utils/tokenLimits.js

@@ -2,7 +2,7 @@
  * Provider-specific token limit utilities
  * Provides safe maxTokens values based on provider and model capabilities
  */
-import { getRuntimeOutputCeiling } from "../constants/contextWindows.js";
+import { getCatalogOutputCeiling, getRuntimeOutputCeiling, } from "../constants/contextWindows.js";
 import { bedrockModelIdForLookup, stripBedrockGeoPrefix, } from "../constants/bedrockIdentifiers.js";
 import { PROVIDER_MAX_TOKENS } from "../core/constants.js";
 import { logger } from "./logger.js";
@@ -68,6 +68,25 @@ export function getSafeMaxTokens(provider, model, requestedMaxTokens) {
     // Get provider-specific limits
     const providerLimits = PROVIDER_MAX_TOKENS[canonicalProvider];
     if (!providerLimits) {
+        // A JSON-catalog provider has no PROVIDER_MAX_TOKENS row, but its catalog
+        // entry can declare the model's own output ceiling. Only that per-model
+        // value counts: the provider-wide default is a 4096 placeholder for many
+        // providers. An over-large request is clamped. Unlike the runtime ceiling
+        // above, this ceiling is not injected as a default: an unset request stays
+        // unset, because a ceiling-sized default would shrink usable input on
+        // total-context backends.
+        const catalogCeiling = getCatalogOutputCeiling(provider, model);
+        if (catalogCeiling !== undefined) {
+            if (requestedMaxTokens === undefined || requestedMaxTokens === null) {
+                return undefined;
+            }
+            if (requestedMaxTokens > catalogCeiling) {
+                logger.warn(`Requested maxTokens ${requestedMaxTokens} exceeds the catalog output ceiling ` +
+                    `of ${catalogCeiling} for ${provider}/${model}. Using ${catalogCeiling} instead.`);
+                return catalogCeiling;
+            }
+            return requestedMaxTokens;
+        }
         logger.warn(`Unknown provider ${provider}, no token limits enforced`);
         // Explicit undefined/null check so a caller-supplied 0 is preserved
         // (truthy guard would silently drop 0 here as it does in the restricted branch).