@juspay/neurolink 13.8.17 → 13.8.18

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@juspay/neurolink",
-  "version": "13.8.17",
-  "packageManager": "pnpm@10.28.2",
+  "version": "13.8.18",
+  "packageManager": "pnpm@10.34.7+sha512.upirxYVTmTM3W1lx9LxtbHOhtLftxKh559EC/lQj0eAjCdZ8YKEfBJVQk6luUhrZw7E4zdZUylvlY/N4s65IvQ==",
   "description": "The pipe layer of an AI nervous system: one interface connecting provider neurons to your application, across three inference types — generate, stream and decide. `decide` returns typed, calibrated judgements from a non-generative model (~400ms, ~$0.00002/call) for routing, tool selection and context budgeting. MCP-native (4 transports), voice TTS/STT/realtime, RAG, agents, memory, compaction, 9 observability exporters. OpenAI · Anthropic · Gemini · Bedrock · Azure · Ollama · TypeSafe Jev and more.",
   "author": {
     "name": "Juspay Technologies",
@@ -22,8 +22,8 @@
     "url": "https://github.com/sponsors/juspay"
   },
   "engines": {
-    "node": ">=22.0.0",
-    "pnpm": ">=10.0.0"
+    "node": ">=22.23.4 <23 || >=24.22.1 <25 || >=26.12.1",
+    "pnpm": ">=10.34.7"
   },
   "scripts": {
     "dev": "vite dev",
@@ -372,7 +372,14 @@
     "test:cli-json-output": "pnpm exec tsx test/continuous-test-suite-cli-json-output.ts",
     "test:logging-guidelines": "pnpm exec tsx test/continuous-test-suite-logging-guidelines.ts",
     "test:proxy-polyfills": "pnpm exec tsx test/continuous-test-suite-proxy-polyfills.ts",
-    "test:mcp:startup-readiness": "pnpm exec tsx test/continuous-test-suite-mcp-startup-readiness.ts"
+    "test:mcp:startup-readiness": "pnpm exec tsx test/continuous-test-suite-mcp-startup-readiness.ts",
+    "test:security:cwd-trust": "tsx test/continuous-test-suite-security-cwd-trust.ts",
+    "test:security:server": "tsx test/continuous-test-suite-security-server.ts",
+    "test:security:proxy": "tsx test/continuous-test-suite-security-proxy.ts",
+    "test:security:tools": "tsx test/continuous-test-suite-security-tools.ts",
+    "test:security:ingestion": "tsx test/continuous-test-suite-security-ingestion.ts",
+    "test:security:supply-chain": "tsx test/continuous-test-suite-security-supply-chain.ts",
+    "test:security": "pnpm run test:security:cwd-trust && pnpm run test:security:server && pnpm run test:security:proxy && pnpm run test:security:tools && pnpm run test:security:ingestion && pnpm run test:security:supply-chain"
   },
   "files": [
     "dist",
@@ -515,58 +522,57 @@
     }
   },
   "dependencies": {
-    "@anthropic-ai/sdk": "^0.102.0",
-    "@anthropic-ai/vertex-sdk": "^0.16.0",
-    "@aws-sdk/types": "^3.862.0",
-    "@cfworker/json-schema": "^4.1.1",
-    "@google/genai": "^2.23.0",
-    "@langfuse/core": "^5.13.1",
-    "@langfuse/tracing": "^5.13.1",
-    "@modelcontextprotocol/sdk": "^1.31.0",
-    "@opentelemetry/api-logs": "^0.214.0",
-    "@opentelemetry/context-async-hooks": "^2.6.1",
-    "@opentelemetry/core": "^2.8.0",
-    "@opentelemetry/exporter-logs-otlp-http": "^0.214.0",
-    "@opentelemetry/exporter-metrics-otlp-http": "^0.214.0",
-    "@opentelemetry/exporter-trace-otlp-http": "^0.214.0",
-    "@opentelemetry/otlp-transformer": "^0.214.0",
-    "@opentelemetry/resources": "^2.6.0",
-    "@opentelemetry/sdk-logs": "^0.214.0",
-    "@opentelemetry/sdk-metrics": "^2.6.1",
-    "@opentelemetry/sdk-trace-base": "^2.6.0",
-    "@opentelemetry/sdk-trace-node": "^2.6.0",
-    "@opentelemetry/semantic-conventions": "^1.40.0",
-    "@types/json-schema": "^7.0.15",
-    "@types/ws": "^8.18.1",
-    "adm-zip": "^0.6.0",
-    "chalk": "^5.6.2",
+    "@anthropic-ai/sdk": "0.102.0",
+    "@anthropic-ai/vertex-sdk": "0.16.0",
+    "@aws-sdk/types": "3.973.7",
+    "@cfworker/json-schema": "4.1.1",
+    "@google/genai": "2.31.0",
+    "@langfuse/core": "5.13.1",
+    "@langfuse/tracing": "5.13.1",
+    "@modelcontextprotocol/sdk": "1.32.1",
+    "@opentelemetry/api-logs": "0.214.0",
+    "@opentelemetry/context-async-hooks": "2.6.1",
+    "@opentelemetry/core": "2.8.0",
+    "@opentelemetry/exporter-logs-otlp-http": "0.214.0",
+    "@opentelemetry/exporter-metrics-otlp-http": "0.214.0",
+    "@opentelemetry/exporter-trace-otlp-http": "0.214.0",
+    "@opentelemetry/otlp-transformer": "0.214.0",
+    "@opentelemetry/resources": "2.6.1",
+    "@opentelemetry/sdk-logs": "0.214.0",
+    "@opentelemetry/sdk-metrics": "2.6.1",
+    "@opentelemetry/sdk-trace-base": "2.6.1",
+    "@opentelemetry/sdk-trace-node": "2.6.1",
+    "@opentelemetry/semantic-conventions": "1.40.0",
+    "@types/json-schema": "7.0.15",
+    "@types/ws": "8.18.1",
+    "adm-zip": "0.6.1",
+    "chalk": "5.6.2",
     "chardet": "2.1.1",
-    "croner": "^9.1.0",
-    "csv-parser": "^3.2.0",
-    "diff": "^9.0.0",
-    "dotenv": "^17.3.1",
-    "eventsource-parser": "^3.0.8",
-    "fast-xml-parser": "^5.7.0",
-    "google-auth-library": "^10.6.1",
+    "croner": "9.1.0",
+    "csv-parser": "3.2.0",
+    "diff": "9.0.0",
+    "dotenv": "17.3.1",
+    "eventsource-parser": "3.0.8",
+    "fast-xml-parser": "5.7.3",
+    "google-auth-library": "10.6.2",
     "hono": "4.13.13",
     "iconv-lite": "0.7.2",
-    "inquirer": "^13.3.0",
-    "jose": "^6.1.3",
-    "js-yaml": "^4.3.2",
-    "json-schema-to-zod": "^2.7.0",
-    "jsonrepair": "^3.14.0",
-    "minisearch": "^7.2.0",
-    "nanoid": "^5.1.16",
-    "ora": "^9.3.0",
-    "p-limit": "^7.3.0",
-    "redis": "^5.11.0",
-    "tar-stream": "^3.1.8",
-    "type-decoder": "^2.3.1",
-    "undici": ">=7.30.1 <8.0.0",
-    "ws": "^8.20.1",
-    "yargs": "^18.0.0",
-    "zod": "^4.6.7",
-    "zod-to-json-schema": "^3.25.1"
+    "inquirer": "13.3.2",
+    "jose": "6.2.2",
+    "js-yaml": "4.3.2",
+    "jsonrepair": "3.14.0",
+    "minisearch": "7.2.0",
+    "nanoid": "5.1.16",
+    "ora": "9.3.0",
+    "p-limit": "7.3.0",
+    "redis": "5.11.0",
+    "tar-stream": "3.1.8",
+    "type-decoder": "2.3.1",
+    "undici": "7.30.1",
+    "ws": "8.21.0",
+    "yargs": "18.0.0",
+    "zod": "4.6.7",
+    "zod-to-json-schema": "3.25.2"
   },
   "peerDependencies": {
     "@juspay/hippocampus": ">=0.2.1",
@@ -586,104 +592,104 @@
     }
   },
   "optionalDependencies": {
-    "@aws-sdk/client-bedrock": "^3.1000.0",
-    "@aws-sdk/client-bedrock-runtime": "^3.1000.0",
-    "@aws-sdk/client-sagemaker": "^3.1000.0",
-    "@aws-sdk/client-sagemaker-runtime": "^3.1000.0",
-    "@aws-sdk/credential-provider-node": "^3.886.0",
-    "@fastify/cors": "^11.2.0",
-    "@fastify/rate-limit": "^10.3.0",
-    "@google-cloud/text-to-speech": "^6.4.0",
-    "@hono/node-server": "^1.19.15",
-    "@koa/cors": "^5.0.0",
-    "@koa/router": "^15.3.1",
-    "@livekit/agents": "^1.4.6",
-    "@livekit/agents-plugin-cartesia": "^1.4.6",
-    "@livekit/agents-plugin-deepgram": "^1.4.6",
-    "@livekit/agents-plugin-elevenlabs": "^1.4.6",
-    "@livekit/agents-plugin-google": "^1.4.6",
-    "@livekit/agents-plugin-livekit": "^1.4.6",
-    "@livekit/agents-plugin-openai": "^1.4.6",
-    "@livekit/agents-plugin-silero": "^1.4.6",
-    "@livekit/agents-plugin-soniox": "^1.4.6",
-    "@livekit/agents-plugin-xai": "^1.4.6",
-    "@livekit/rtc-node": "^0.13.29",
-    "@picovoice/cobra-node": "^3.0.2",
-    "bullmq": "^5.52.2",
-    "cors": "^2.8.5",
-    "exceljs": "^4.4.0",
-    "express": "^5.1.0",
-    "express-rate-limit": "^8.2.1",
-    "fastify": "^5.12.5",
-    "ffmpeg-static": "^5.3.0",
-    "fluent-ffmpeg": "^2.1.3",
-    "koa": "^3.1.1",
-    "koa-bodyparser": "^4.4.1",
-    "livekit-server-sdk": "^2.15.4",
+    "@aws-sdk/client-bedrock": "3.1019.0",
+    "@aws-sdk/client-bedrock-runtime": "3.1019.0",
+    "@aws-sdk/client-sagemaker": "3.1019.0",
+    "@aws-sdk/client-sagemaker-runtime": "3.1019.0",
+    "@aws-sdk/credential-provider-node": "3.972.30",
+    "@fastify/cors": "11.3.1",
+    "@fastify/rate-limit": "10.3.0",
+    "@google-cloud/text-to-speech": "6.4.0",
+    "@hono/node-server": "1.19.17",
+    "@koa/cors": "5.0.0",
+    "@koa/router": "15.4.0",
+    "@livekit/agents": "1.9.3",
+    "@livekit/agents-plugin-cartesia": "1.9.3",
+    "@livekit/agents-plugin-deepgram": "1.9.3",
+    "@livekit/agents-plugin-elevenlabs": "1.9.3",
+    "@livekit/agents-plugin-google": "1.9.3",
+    "@livekit/agents-plugin-livekit": "1.9.3",
+    "@livekit/agents-plugin-openai": "1.9.3",
+    "@livekit/agents-plugin-silero": "1.9.3",
+    "@livekit/agents-plugin-soniox": "1.9.3",
+    "@livekit/agents-plugin-xai": "1.9.3",
+    "@livekit/rtc-node": "0.13.35",
+    "@picovoice/cobra-node": "3.0.2",
+    "bullmq": "5.81.5",
+    "cors": "2.8.6",
+    "exceljs": "4.4.0",
+    "express": "5.2.1",
+    "express-rate-limit": "8.7.1",
+    "fastify": "5.12.7",
+    "ffmpeg-static": "5.3.0",
+    "fluent-ffmpeg": "2.1.3",
+    "koa": "3.2.0",
+    "koa-bodyparser": "4.4.1",
+    "livekit-server-sdk": "2.19.2",
     "mammoth": "1.12.0",
-    "mediabunny": "^1.40.1",
-    "music-metadata": "^11.16.1",
-    "onnxruntime-node": "^1.24.3",
-    "pdf-parse": "^2.4.5",
-    "pptxgenjs": "^4.0.1",
-    "sharp": "^0.35.3"
+    "mediabunny": "1.40.1",
+    "music-metadata": "11.16.1",
+    "onnxruntime-node": "1.30.0",
+    "pdf-parse": "2.4.5",
+    "pptxgenjs": "4.0.1",
+    "sharp": "0.35.5"
   },
   "devDependencies": {
-    "@actions/core": "^3.0.0",
-    "@actions/exec": "^3.0.0",
-    "@actions/github": "^9.0.0",
-    "@changesets/changelog-github": "^0.6.0",
-    "@changesets/cli": "^2.29.8",
-    "@electric-sql/pglite": "^0.4.6",
-    "@eslint/js": "^10.0.1",
-    "@langfuse/otel": "^5.13.1",
-    "@opentelemetry/api": "^1.9.0",
-    "@semantic-release/changelog": "^6.0.3",
-    "@semantic-release/commit-analyzer": "^13.0.1",
-    "@semantic-release/github": "^12.0.6",
-    "@semantic-release/npm": "^13.1.4",
-    "@semantic-release/release-notes-generator": "^14.1.0",
-    "@smithy/types": "^4.13.0",
-    "@sveltejs/adapter-auto": "^7.0.1",
-    "@sveltejs/kit": "^2.70.3",
-    "@sveltejs/package": "^2.5.7",
-    "@sveltejs/vite-plugin-svelte": "^7.0.0",
-    "@types/cors": "^2.8.19",
-    "@types/diff": "^8.0.0",
-    "@types/emscripten": "^1.41.6",
-    "@types/express": "^5.0.6",
-    "@types/fluent-ffmpeg": "^2.1.28",
-    "@types/js-yaml": "^4.0.9",
-    "@types/koa": "^3.0.1",
-    "@types/koa-bodyparser": "^4.3.13",
-    "@types/koa__cors": "^5.0.1",
-    "@types/node": "^22.20.0",
-    "@types/react": "^19.2.10",
-    "@types/tar-stream": "^3.1.4",
-    "@types/yargs": "^17.0.35",
-    "@typescript-eslint/eslint-plugin": "^8.57.2",
-    "@typescript-eslint/parser": "^8.57.2",
-    "@vercel/ncc": "^0.38.4",
-    "concurrently": "^9.2.1",
-    "conventional-changelog-conventionalcommits": "^9.1.0",
-    "esbuild": "^0.28.1",
-    "eslint": "^10.0.2",
-    "glob": "^13.0.6",
-    "husky": "^9.1.7",
-    "playwright": "^1.58.2",
-    "prettier": "^3.8.1",
-    "publint": "^0.3.17",
-    "react": "^19.2.4",
-    "react-dom": "^19.2.4",
-    "semantic-release": "^25.0.3",
-    "svelte": "^5.55.7",
-    "svelte-check": "^4.4.4",
-    "tsx": "^4.21.0",
-    "typedoc": "^0.28.17",
-    "typedoc-plugin-markdown": "^4.10.0",
-    "typescript": "^5.9.3",
-    "vite": "^8.2.2",
-    "vitest": "^4.1.0"
+    "@actions/core": "3.0.0",
+    "@actions/exec": "3.0.0",
+    "@actions/github": "9.0.0",
+    "@changesets/changelog-github": "0.6.0",
+    "@changesets/cli": "2.30.0",
+    "@electric-sql/pglite": "0.4.6",
+    "@eslint/js": "10.0.1",
+    "@langfuse/otel": "5.13.1",
+    "@opentelemetry/api": "1.9.1",
+    "@semantic-release/changelog": "6.0.3",
+    "@semantic-release/commit-analyzer": "13.0.1",
+    "@semantic-release/github": "12.0.6",
+    "@semantic-release/npm": "13.1.5",
+    "@semantic-release/release-notes-generator": "14.1.0",
+    "@smithy/types": "4.13.1",
+    "@sveltejs/adapter-auto": "7.0.1",
+    "@sveltejs/kit": "2.70.3",
+    "@sveltejs/package": "2.5.7",
+    "@sveltejs/vite-plugin-svelte": "7.0.0",
+    "@types/cors": "2.8.19",
+    "@types/diff": "8.0.0",
+    "@types/emscripten": "1.41.6",
+    "@types/express": "5.0.6",
+    "@types/fluent-ffmpeg": "2.1.28",
+    "@types/js-yaml": "4.0.9",
+    "@types/koa": "3.0.2",
+    "@types/koa-bodyparser": "4.3.13",
+    "@types/koa__cors": "5.0.1",
+    "@types/node": "22.20.1",
+    "@types/react": "19.2.14",
+    "@types/tar-stream": "3.1.4",
+    "@types/yargs": "17.0.35",
+    "@typescript-eslint/eslint-plugin": "8.57.2",
+    "@typescript-eslint/parser": "8.57.2",
+    "@vercel/ncc": "0.38.4",
+    "concurrently": "9.2.1",
+    "conventional-changelog-conventionalcommits": "9.3.0",
+    "esbuild": "0.28.1",
+    "eslint": "10.1.0",
+    "glob": "13.0.6",
+    "husky": "9.1.7",
+    "playwright": "1.58.2",
+    "prettier": "3.8.1",
+    "publint": "0.3.18",
+    "react": "19.2.4",
+    "react-dom": "19.2.4",
+    "semantic-release": "25.0.3",
+    "svelte": "5.55.7",
+    "svelte-check": "4.4.5",
+    "tsx": "4.21.0",
+    "typedoc": "0.28.18",
+    "typedoc-plugin-markdown": "4.11.0",
+    "typescript": "5.9.3",
+    "vite": "8.3.5",
+    "vitest": "4.1.12"
   },
   "keywords": [
     "ai",
@@ -805,23 +811,32 @@
       "body-parser@<1.20.9": ">=1.20.9 <2",
       "body-parser@>=2.0.0 <2.4.0": ">=2.4.0 <3",
       "fast-uri@<3.1.9": ">=3.1.9 <4",
-      "ip-address@<10.1.1": ">=10.1.1",
       "basic-ftp@<5.2.2": ">=5.2.2",
       "fast-xml-builder@<1.1.7": ">=1.1.7",
       "esbuild@>=0.17.0 <0.28.1": ">=0.28.1",
       "rollup@>=4.0.0 <4.59.0": ">=4.59.0",
       "shell-quote@<1.11.0": ">=1.11.0",
       "@modelcontextprotocol/sdk@<1.31.0": ">=1.31.0",
-      "undici@>=8.0.0": ">=7.30.1 <8.0.0",
-      "markdown-it@<14.2.0": ">=14.2.0",
       "@xmldom/xmldom@<0.9.12": ">=0.9.12",
       "protobufjs@<7.6.5": ">=7.6.5",
       "brace-expansion@>=5.0.0 <5.0.12": ">=5.0.12",
       "@opentelemetry/core@>=2.0.0 <2.8.0": ">=2.8.0",
-      "qs": "6.16.0",
-      "fastify": "5.12.5",
-      "fast-uri": "3.1.9",
-      "@xmldom/xmldom": "0.9.12"
+      "adm-zip@<0.6.1": ">=0.6.1",
+      "ip-address@<10.7.4": ">=10.7.4",
+      "image-size@<2.0.3": ">=2.0.3",
+      "sharp@<0.35.5": ">=0.35.5",
+      "form-data@>=4.0.0 <4.0.6": ">=4.0.6",
+      "find-my-way@<9.7.0": ">=9.7.0",
+      "uuid@<11.1.1": ">=11.1.1 <12",
+      "fastify@<5.12.7": ">=5.12.7",
+      "qs@<6.16.1": ">=6.16.1",
+      "devalue@<5.9.3": ">=5.9.3 <6",
+      "source-map-js@<1.2.2": ">=1.2.2",
+      "@humanfs/node@<0.16.8": ">=0.16.8 <0.17.0",
+      "vite@>=8.2.0 <8.2.4": ">=8.2.4",
+      "@vitest/mocker@<4.1.12": ">=4.1.12",
+      "vitest@>=2.1.0 <4.1.12": ">=4.1.12 <5",
+      "markdown-it@<15.0.3": ">=15.0.3 <16"
     },
     "patchedDependencies": {
       "hono@4.13.13": "patches/hono@4.13.13.patch",

package/scripts/observability/import-openobserve-dashboard.mjs

@@ -32,9 +32,12 @@ function parseArgs(argv) {
     dashboard: defaultDashboardPath,
     openobserveUrl: process.env.NEUROLINK_OPENOBSERVE_URL ?? "http://localhost:5080",
     org: process.env.NEUROLINK_OPENOBSERVE_ORG ?? "default",
-    user: process.env.NEUROLINK_OPENOBSERVE_USER ?? "root@example.com",
-    password:
-      process.env.NEUROLINK_OPENOBSERVE_PASSWORD ?? "Complexpass#123",
+    user: process.env.NEUROLINK_OPENOBSERVE_USER,
+    // No default. The previous fallback was OpenObserve's documented dev
+    // credential, shipped in the npm package (scripts/observability is in
+    // `files`); a script that logs into a dashboard host must be given its
+    // password, never assume one.
+    password: process.env.NEUROLINK_OPENOBSERVE_PASSWORD,
     replaceByTitle: false,
     dryRun: false,
   };
@@ -78,6 +81,11 @@ function parseArgs(argv) {
     }
   }
 
+  if (!options.user || !options.password) {
+    throw new Error(
+      "OpenObserve credentials are required: pass --user/--password or set NEUROLINK_OPENOBSERVE_USER and NEUROLINK_OPENOBSERVE_PASSWORD (there is no default).",
+    );
+  }
   return options;
 }