@juspay/neurolink 13.8.17 → 13.8.19

package/dist/providers/openaiChatCompletionsClient.js

@@ -725,6 +725,8 @@ export const parseSSEStream = async (body, onTextDelta, onReasoningDelta) => {
     };
     const decoder = new TextDecoder();
     let parseErr;
+    // Key of the tool call the previous delta wrote to (for unindexed deltas).
+    let lastToolCallKey;
     const handleEvent = (msg) => {
         const data = msg.data;
         if (!data || data === "[DONE]") {
@@ -768,14 +770,21 @@ export const parseSSEStream = async (body, onTextDelta, onReasoningDelta) => {
         }
         if (delta?.tool_calls) {
             for (const tc of delta.tool_calls) {
-                let state = result.toolCalls.get(tc.index);
+                // Gemini's OpenAI-compatible endpoint omits `index`: an unindexed
+                // delta with an id or name starts a call, otherwise it continues one.
+                const index = tc.index ??
+                    (tc.id || tc.function?.name || lastToolCallKey === undefined
+                        ? Math.max(-1, ...result.toolCalls.keys()) + 1
+                        : lastToolCallKey);
+                lastToolCallKey = index;
+                let state = result.toolCalls.get(index);
                 if (!state) {
                     state = {
-                        id: tc.id ?? `call_${tc.index}_${Date.now()}`,
+                        id: tc.id ?? `call_${index}_${Date.now()}`,
                         name: tc.function?.name ?? "",
                         argsBuffered: "",
                     };
-                    result.toolCalls.set(tc.index, state);
+                    result.toolCalls.set(index, state);
                 }
                 else if (tc.id) {
                     state.id = tc.id;

package/dist/proxy/accountLedger.js

@@ -28,6 +28,7 @@
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { calculateCost, hasPricing } from "../utils/pricing.js";
+import { proxyTokenUsage } from "./proxyTokenUsage.js";
 /** Same pattern proxyAnalysis.ts uses, deliberately duplicated as a constant. */
 const REQUEST_FILE_PATTERN = /^proxy-\d{4}-\d{2}-\d{2}\.jsonl$/;
 /**
@@ -163,6 +164,7 @@ async function advanceCursor(fileName, cursor) {
             model: typeof record.model === "string" ? record.model : "",
             provider: typeof record.provider === "string" ? record.provider : undefined,
             inputTokens: finiteNumber(record.inputTokens),
+            inputIncludesCachedTokens: record.inputIncludesCachedTokens === true,
             outputTokens: finiteNumber(record.outputTokens),
             cacheReadTokens: finiteNumber(record.cacheReadTokens),
             cacheCreationTokens: finiteNumber(record.cacheCreationTokens),
@@ -196,6 +198,9 @@ async function advanceCursor(fileName, cursor) {
                 ...previous,
                 ...next,
                 inputTokens: Math.max(previous.inputTokens, next.inputTokens),
+                inputIncludesCachedTokens: next.inputTokens > previous.inputTokens
+                    ? next.inputIncludesCachedTokens
+                    : previous.inputIncludesCachedTokens,
                 outputTokens: Math.max(previous.outputTokens, next.outputTokens),
                 cacheReadTokens: Math.max(previous.cacheReadTokens, next.cacheReadTokens),
                 cacheCreationTokens: Math.max(previous.cacheCreationTokens, next.cacheCreationTokens),
@@ -335,14 +340,7 @@ export async function readAccountUsage(date = currentUsageDate()) {
         const provider = resolveProvider(entry);
         if (entry.model && entry.model !== "-") {
             if (hasPricing(provider, entry.model)) {
-                const cost = calculateCost(provider, entry.model, {
-                    input: entry.inputTokens,
-                    output: entry.outputTokens,
-                    total: entry.inputTokens + entry.outputTokens,
-                    cacheReadTokens: entry.cacheReadTokens,
-                    cacheCreationTokens: entry.cacheCreationTokens,
-                    cacheCreation1hTokens: entry.cacheCreation1hTokens,
-                });
+                const cost = calculateCost(provider, entry.model, proxyTokenUsage(entry));
                 row.costUsd += cost;
                 client.costUsd += cost;
             }

package/dist/proxy/geminiFormat.d.ts

@@ -18,7 +18,7 @@
  * its own usage line, so getting them wrong is visible to the user rather than
  * merely wrong in a log.
  */
-import type { ParsedGeminiRequest, StreamSerializerAdapter } from "../types/index.js";
+import type { ParsedGeminiRequest, StreamSerializerAdapter, TokenUsage } from "../types/index.js";
 /**
  * Parse a `generateContent` body into the shape the translation engine takes.
  *
@@ -46,11 +46,7 @@ export declare function parseGeminiRequest(model: string, body: Record<string, u
  * cannot drift.
  */
 export declare function renderGeminiToolUse(name: string, input: unknown): string;
-export declare function buildGeminiResponse(text: string, finishReason: string, usage: {
-    input: number;
-    output: number;
-    total: number;
-}, modelVersion: string, toolCalls?: ReadonlyArray<{
+export declare function buildGeminiResponse(text: string, finishReason: string, usage: TokenUsage, modelVersion: string, toolCalls?: ReadonlyArray<{
     toolName: string;
     args: Record<string, unknown>;
 }>): Record<string, unknown>;
@@ -81,11 +77,7 @@ export declare class GeminiStreamSerializer {
      * that is never coming; rendering it as text keeps the turn terminating.
      */
     pushToolUse(_id: string, name: string, input: unknown): string[];
-    finish(finishReason: string, usage: {
-        input: number;
-        output: number;
-        total: number;
-    }): string[];
+    finish(finishReason: string, usage: TokenUsage): string[];
     /**
      * Errors ride the stream as a Google error object.
      *

package/dist/proxy/geminiFormat.js

@@ -206,10 +206,19 @@ function toGeminiFinishReason(reason) {
     }
 }
 function usageMetadata(usage) {
+    const promptTokens = usage.input +
+        (usage.cacheReadTokens ?? 0) +
+        (usage.cacheCreationTokens ?? 0);
     return {
-        promptTokenCount: usage.input,
+        promptTokenCount: promptTokens,
         candidatesTokenCount: usage.output,
-        totalTokenCount: usage.total || usage.input + usage.output,
+        totalTokenCount: usage.total || promptTokens + usage.output,
+        ...(usage.cacheReadTokens !== undefined && {
+            cachedContentTokenCount: usage.cacheReadTokens,
+        }),
+        ...(usage.reasoning !== undefined && {
+            thoughtsTokenCount: usage.reasoning,
+        }),
     };
 }
 /** Build a complete `generateContent` response body. */

package/dist/proxy/inboundAuth.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Inbound trust for the proxy listeners and the SDK-mounted proxy routes.
+ *
+ * Both pool engines spend the operator's subscriptions on behalf of whoever
+ * reaches the port. On loopback that is the operator; anywhere else it is
+ * anyone. This module holds the three decisions that keep that honest:
+ *
+ * - **Bind policy.** A listener may bind off-loopback only when something
+ *   authenticates callers: the share gate, an inbound token, or the operator's
+ *   explicit `--allow-unauthenticated`.
+ * - **Inbound token.** `NEUROLINK_PROXY_INBOUND_TOKEN` (or `--inbound-token`)
+ *   is a bearer every caller must present, compared in constant time. A share
+ *   token is an alternative credential, judged by the share gate.
+ * - **Operator-only surfaces.** `/accounts`, `/limits` and `/status` name the
+ *   pool's accounts; they are refused to borrowers and, when a token is
+ *   configured, to anyone without it.
+ *
+ * @module proxy/inboundAuth
+ */
+import type { ProxyBindPolicyDecision, ProxyBindPolicyInput, ProxyInboundAuthOptions, ProxyShareRefusalResponse } from "../types/index.js";
+/** Dedicated header, so the inbound token never collides with a client credential. */
+export declare const INBOUND_TOKEN_HEADER = "x-neurolink-inbound-token";
+/** Set on every refusal so a client can tell "token required" from "bad request". */
+export declare const INBOUND_AUTH_HEADER = "x-neurolink-inbound-auth";
+export declare const INBOUND_TOKEN_ENV = "NEUROLINK_PROXY_INBOUND_TOKEN";
+export declare const ALLOW_UNAUTHENTICATED_ENV = "NEUROLINK_PROXY_ALLOW_UNAUTHENTICATED";
+/**
+ * Compare two secrets without leaking where they diverge. Hand-rolled rather
+ * than `crypto.timingSafeEqual` so the proxy routes stay loadable from a build
+ * whose `node:crypto` stub does not carry it.
+ */
+export declare function secretsMatch(expected: string, presented: string): boolean;
+/** The inbound token in force: an explicit value wins over the environment. */
+export declare function resolveInboundToken(explicit?: string): string | undefined;
+/** `NEUROLINK_PROXY_ALLOW_UNAUTHENTICATED` as a boolean. */
+export declare function isUnauthenticatedBindAllowedByEnv(): boolean;
+/** Loopback addresses in every spelling a bind flag accepts. */
+export declare function isLoopbackHost(host: string): boolean;
+/**
+ * May the proxy bind to `host`?
+ *
+ * Loopback always may. Anything else needs the share gate, an inbound token,
+ * or the operator's explicit acknowledgement — and the acknowledgement still
+ * earns a warning, because the subscriptions are then one port scan away.
+ */
+export declare function evaluateProxyBindPolicy(input: ProxyBindPolicyInput): ProxyBindPolicyDecision;
+/** True when the request presents the configured inbound token. */
+export declare function hasValidInboundToken(headers: Record<string, string | undefined>, token: string | undefined): boolean;
+/** The 401 an unauthenticated caller receives, in the Anthropic error shape. */
+export declare function buildInboundAuthRefusal(): ProxyShareRefusalResponse;
+/**
+ * Decide an inbound request against the configured token.
+ *
+ * A request carrying a share token is handed to the share gate instead: a
+ * borrower holds a grant, not the operator's token, and the gate is what
+ * judges a grant. Everything else must present the token.
+ */
+export declare function authorizeInboundRequest(headers: Record<string, string | undefined>, token: string | undefined): {
+    ok: true;
+} | {
+    ok: false;
+    response: ProxyShareRefusalResponse;
+};
+/** `Response` form of the refusal, for route factories whose adapters pass one through. */
+export declare function inboundAuthRefusalResponse(): Response;
+/**
+ * Say, loudly and once per engine, that a proxy route group was mounted with
+ * nothing authenticating its callers. `logger.always` on purpose: the ordinary
+ * warn level is invisible outside debug runs, and an open proxy is exactly the
+ * thing an operator must not be able to miss. Suppressed when the caller
+ * recorded the decision (`allowUnauthenticated`), which the CLI does after its
+ * own bind check.
+ */
+export declare function warnIfProxyRoutesUnauthenticated(engine: string, options: ProxyInboundAuthOptions | undefined, token: string | undefined): void;
+/** Test isolation only. */
+export declare function resetInboundAuthWarningsForTests(): void;
+/** Paths that stay open on an authenticated listener: liveness and self-authenticating peers. */
+export declare function isInboundAuthExemptPath(path: string): boolean;
+/**
+ * How many pooled accounts one inbound request may be tried against.
+ *
+ * Without a cap a single request fans out to every account in the pool — N
+ * upstream posts, N× quota — on any rotation trigger. Default 3;
+ * `NEUROLINK_PROXY_MAX_ACCOUNTS_PER_REQUEST=0` restores the unbounded
+ * behaviour.
+ */
+export declare const MAX_ACCOUNTS_PER_REQUEST_ENV = "NEUROLINK_PROXY_MAX_ACCOUNTS_PER_REQUEST";
+export declare const DEFAULT_MAX_ACCOUNTS_PER_REQUEST = 3;
+export declare function resolveMaxAccountsPerRequest(): number;

package/dist/proxy/inboundAuth.js

@@ -0,0 +1,219 @@
+/**
+ * Inbound trust for the proxy listeners and the SDK-mounted proxy routes.
+ *
+ * Both pool engines spend the operator's subscriptions on behalf of whoever
+ * reaches the port. On loopback that is the operator; anywhere else it is
+ * anyone. This module holds the three decisions that keep that honest:
+ *
+ * - **Bind policy.** A listener may bind off-loopback only when something
+ *   authenticates callers: the share gate, an inbound token, or the operator's
+ *   explicit `--allow-unauthenticated`.
+ * - **Inbound token.** `NEUROLINK_PROXY_INBOUND_TOKEN` (or `--inbound-token`)
+ *   is a bearer every caller must present, compared in constant time. A share
+ *   token is an alternative credential, judged by the share gate.
+ * - **Operator-only surfaces.** `/accounts`, `/limits` and `/status` name the
+ *   pool's accounts; they are refused to borrowers and, when a token is
+ *   configured, to anyone without it.
+ *
+ * @module proxy/inboundAuth
+ */
+import { logger } from "../utils/logger.js";
+import { extractShareToken } from "./shareGate.js";
+/** Dedicated header, so the inbound token never collides with a client credential. */
+export const INBOUND_TOKEN_HEADER = "x-neurolink-inbound-token";
+/** Set on every refusal so a client can tell "token required" from "bad request". */
+export const INBOUND_AUTH_HEADER = "x-neurolink-inbound-auth";
+export const INBOUND_TOKEN_ENV = "NEUROLINK_PROXY_INBOUND_TOKEN";
+export const ALLOW_UNAUTHENTICATED_ENV = "NEUROLINK_PROXY_ALLOW_UNAUTHENTICATED";
+/**
+ * Compare two secrets without leaking where they diverge. Hand-rolled rather
+ * than `crypto.timingSafeEqual` so the proxy routes stay loadable from a build
+ * whose `node:crypto` stub does not carry it.
+ */
+export function secretsMatch(expected, presented) {
+    if (expected.length !== presented.length || expected.length === 0) {
+        return false;
+    }
+    let difference = 0;
+    for (let index = 0; index < expected.length; index += 1) {
+        difference |= expected.charCodeAt(index) ^ presented.charCodeAt(index);
+    }
+    return difference === 0;
+}
+function envFlagIsOn(name) {
+    const raw = (process.env[name] ?? "").trim().toLowerCase();
+    return raw === "1" || raw === "true" || raw === "on" || raw === "yes";
+}
+/** The inbound token in force: an explicit value wins over the environment. */
+export function resolveInboundToken(explicit) {
+    const candidate = explicit?.trim() || process.env[INBOUND_TOKEN_ENV]?.trim();
+    return candidate ? candidate : undefined;
+}
+/** `NEUROLINK_PROXY_ALLOW_UNAUTHENTICATED` as a boolean. */
+export function isUnauthenticatedBindAllowedByEnv() {
+    return envFlagIsOn(ALLOW_UNAUTHENTICATED_ENV);
+}
+/** Loopback addresses in every spelling a bind flag accepts. */
+export function isLoopbackHost(host) {
+    const trimmed = host
+        .trim()
+        .toLowerCase()
+        .replace(/^\[|\]$/g, "");
+    if (trimmed === "localhost" || trimmed === "::1") {
+        return true;
+    }
+    if (/^0{1,4}(:0{1,4}){6}:0{0,3}1$/.test(trimmed)) {
+        return true;
+    }
+    if (trimmed.startsWith("::ffff:")) {
+        return isLoopbackHost(trimmed.slice("::ffff:".length));
+    }
+    const octets = trimmed.split(".");
+    return (octets.length === 4 &&
+        octets[0] === "127" &&
+        octets.every((octet) => /^\d{1,3}$/.test(octet) && Number(octet) <= 255));
+}
+/**
+ * May the proxy bind to `host`?
+ *
+ * Loopback always may. Anything else needs the share gate, an inbound token,
+ * or the operator's explicit acknowledgement — and the acknowledgement still
+ * earns a warning, because the subscriptions are then one port scan away.
+ */
+export function evaluateProxyBindPolicy(input) {
+    if (isLoopbackHost(input.host)) {
+        return { allowed: true };
+    }
+    if (input.inboundToken || input.requireGrant) {
+        return { allowed: true };
+    }
+    if (input.allowUnauthenticated) {
+        return {
+            allowed: true,
+            warning: `Binding ${input.host} with no inbound authentication: anyone who reaches ` +
+                `this port can spend every pooled subscription. --allow-unauthenticated ` +
+                `acknowledges that; put an authenticating reverse proxy in front.`,
+        };
+    }
+    return {
+        allowed: false,
+        reason: `Refusing to bind ${input.host}: it is not a loopback address and nothing ` +
+            `would authenticate inbound callers. Set ${INBOUND_TOKEN_ENV} (or pass ` +
+            `--inbound-token <secret>), gate the port with NEUROLINK_PROXY_REQUIRE_GRANT=1, ` +
+            `or pass --allow-unauthenticated to accept an open proxy.`,
+    };
+}
+function presentedInboundToken(headers) {
+    const dedicated = headers[INBOUND_TOKEN_HEADER];
+    if (dedicated?.trim()) {
+        return dedicated.trim();
+    }
+    const authorization = headers.authorization ?? headers.Authorization;
+    if (!authorization) {
+        return undefined;
+    }
+    const trimmed = authorization.trim();
+    return trimmed.toLowerCase().startsWith("bearer ")
+        ? trimmed.slice("bearer ".length).trim()
+        : undefined;
+}
+/** True when the request presents the configured inbound token. */
+export function hasValidInboundToken(headers, token) {
+    if (!token) {
+        return false;
+    }
+    const presented = presentedInboundToken(headers);
+    return presented !== undefined && secretsMatch(token, presented);
+}
+/** The 401 an unauthenticated caller receives, in the Anthropic error shape. */
+export function buildInboundAuthRefusal() {
+    return {
+        status: 401,
+        headers: { [INBOUND_AUTH_HEADER]: "required" },
+        body: {
+            type: "error",
+            error: {
+                type: "authentication_error",
+                message: "This proxy requires an inbound token. Send it as " +
+                    `${INBOUND_TOKEN_HEADER} or as Authorization: Bearer <token>.`,
+            },
+        },
+    };
+}
+/**
+ * Decide an inbound request against the configured token.
+ *
+ * A request carrying a share token is handed to the share gate instead: a
+ * borrower holds a grant, not the operator's token, and the gate is what
+ * judges a grant. Everything else must present the token.
+ */
+export function authorizeInboundRequest(headers, token) {
+    if (!token) {
+        return { ok: true };
+    }
+    if (hasValidInboundToken(headers, token)) {
+        return { ok: true };
+    }
+    if (extractShareToken(headers) !== undefined) {
+        return { ok: true };
+    }
+    return { ok: false, response: buildInboundAuthRefusal() };
+}
+/** `Response` form of the refusal, for route factories whose adapters pass one through. */
+export function inboundAuthRefusalResponse() {
+    const refusal = buildInboundAuthRefusal();
+    return new Response(JSON.stringify(refusal.body), {
+        status: refusal.status,
+        headers: { "content-type": "application/json", ...refusal.headers },
+    });
+}
+const warnedEngines = new Set();
+/**
+ * Say, loudly and once per engine, that a proxy route group was mounted with
+ * nothing authenticating its callers. `logger.always` on purpose: the ordinary
+ * warn level is invisible outside debug runs, and an open proxy is exactly the
+ * thing an operator must not be able to miss. Suppressed when the caller
+ * recorded the decision (`allowUnauthenticated`), which the CLI does after its
+ * own bind check.
+ */
+export function warnIfProxyRoutesUnauthenticated(engine, options, token) {
+    if (token || options?.allowUnauthenticated || warnedEngines.has(engine)) {
+        return;
+    }
+    warnedEngines.add(engine);
+    logger.always(`[proxy] SECURITY: the ${engine} proxy routes were mounted with no inbound ` +
+        `authentication. Anyone who can reach them spends the pooled subscriptions. ` +
+        `Set ${INBOUND_TOKEN_ENV}, pass inboundAuth.token, or bind loopback only ` +
+        `and set inboundAuth.allowUnauthenticated to acknowledge this.`);
+}
+/** Test isolation only. */
+export function resetInboundAuthWarningsForTests() {
+    warnedEngines.clear();
+}
+/** Paths that stay open on an authenticated listener: liveness and self-authenticating peers. */
+export function isInboundAuthExemptPath(path) {
+    return (path === "/health" ||
+        path === "/internal/update-control" ||
+        path.startsWith("/peer/"));
+}
+/**
+ * How many pooled accounts one inbound request may be tried against.
+ *
+ * Without a cap a single request fans out to every account in the pool — N
+ * upstream posts, N× quota — on any rotation trigger. Default 3;
+ * `NEUROLINK_PROXY_MAX_ACCOUNTS_PER_REQUEST=0` restores the unbounded
+ * behaviour.
+ */
+export const MAX_ACCOUNTS_PER_REQUEST_ENV = "NEUROLINK_PROXY_MAX_ACCOUNTS_PER_REQUEST";
+export const DEFAULT_MAX_ACCOUNTS_PER_REQUEST = 3;
+export function resolveMaxAccountsPerRequest() {
+    const raw = process.env[MAX_ACCOUNTS_PER_REQUEST_ENV]?.trim();
+    if (raw === undefined || raw === "") {
+        return DEFAULT_MAX_ACCOUNTS_PER_REQUEST;
+    }
+    const parsed = Number(raw);
+    if (!Number.isFinite(parsed) || parsed < 0) {
+        return DEFAULT_MAX_ACCOUNTS_PER_REQUEST;
+    }
+    return parsed === 0 ? Number.POSITIVE_INFINITY : Math.floor(parsed);
+}

package/dist/proxy/openaiFormat.d.ts

@@ -8,7 +8,7 @@
  *
  * Reference: https://platform.openai.com/docs/api-reference/chat/create
  */
-import type { ClaudeRequest, ClaudeResponse, InternalResult, OpenAICompletionRequest, OpenAICompletionResponse, OpenAIErrorResponse, ParsedOpenAIRequest, StreamLifecycleState } from "../types/index.js";
+import type { ClaudeRequest, ClaudeResponse, InternalResult, OpenAICompletionRequest, OpenAICompletionResponse, OpenAIErrorResponse, ParsedOpenAIRequest, StreamLifecycleState, TokenUsage } from "../types/index.js";
 /** Generate a unique chat completion ID in the OpenAI format. */
 export declare function generateChatCompletionId(): string;
 /** Generate an OpenAI-format tool call ID (`call_` + random chars). */
@@ -25,9 +25,7 @@ export declare function generateOpenAIToolCallId(): string;
  * - top_p, temperature, max_tokens pass-through
  */
 export declare function parseOpenAIRequest(body: OpenAICompletionRequest): ParsedOpenAIRequest;
-/**
- * Serialize a NeuroLink GenerateResult into an OpenAI Chat Completions response.
- */
+/** Serialize a NeuroLink GenerateResult into an OpenAI Chat Completions response. */
 export declare function serializeOpenAIResponse(result: InternalResult, requestModel: string): OpenAICompletionResponse;
 /**
  * Build an OpenAI-compatible error envelope.
@@ -97,11 +95,7 @@ export declare class OpenAIStreamSerializer {
     /**
      * Finalize the stream: emit finish_reason chunk, then `data: [DONE]`.
      */
-    finish(finishReason?: string, usage?: {
-        input: number;
-        output: number;
-        total: number;
-    }): Generator<string>;
+    finish(finishReason?: string, usage?: TokenUsage): Generator<string>;
     /**
      * Emit an error event.  Transitions to terminal ERROR state.
      */

package/dist/proxy/openaiFormat.js

@@ -205,9 +205,25 @@ function mapFinishReason(finishReason) {
             return finishReason ? "stop" : null;
     }
 }
-/**
- * Serialize a NeuroLink GenerateResult into an OpenAI Chat Completions response.
- */
+/** Add cache to the prompt total; reasoning is already part of completion. */
+function toOpenAIUsage(usage) {
+    const promptTokens = (usage?.input ?? 0) +
+        (usage?.cacheReadTokens ?? 0) +
+        (usage?.cacheCreationTokens ?? 0);
+    const completionTokens = usage?.output ?? 0;
+    return {
+        prompt_tokens: promptTokens,
+        completion_tokens: completionTokens,
+        total_tokens: usage?.total ?? promptTokens + completionTokens,
+        ...(usage?.cacheReadTokens !== undefined && {
+            prompt_tokens_details: { cached_tokens: usage.cacheReadTokens },
+        }),
+        ...(usage?.reasoning !== undefined && {
+            completion_tokens_details: { reasoning_tokens: usage.reasoning },
+        }),
+    };
+}
+/** Serialize a NeuroLink GenerateResult into an OpenAI Chat Completions response. */
 export function serializeOpenAIResponse(result, requestModel) {
     const inferredFinishReason = result.toolCalls &&
         result.toolCalls.length > 0 &&
@@ -244,11 +260,7 @@ export function serializeOpenAIResponse(result, requestModel) {
                 finish_reason: mapFinishReason(inferredFinishReason),
             },
         ],
-        usage: {
-            prompt_tokens: result.usage?.input ?? 0,
-            completion_tokens: result.usage?.output ?? 0,
-            total_tokens: result.usage?.total ?? 0,
-        },
+        usage: toOpenAIUsage(result.usage),
     };
 }
 // ---------------------------------------------------------------------------
@@ -450,13 +462,7 @@ export class OpenAIStreamSerializer {
             return;
         }
         const mappedReason = mapFinishReason(finishReason) ?? "stop";
-        const usagePayload = usage
-            ? {
-                prompt_tokens: usage.input,
-                completion_tokens: usage.output,
-                total_tokens: usage.total,
-            }
-            : undefined;
+        const usagePayload = usage ? toOpenAIUsage(usage) : undefined;
         yield formatOpenAISSE(this.makeChunk({}, mappedReason, usagePayload));
         yield "data: [DONE]\n\n";
         this.state = "done";

package/dist/proxy/proxyTranslationEngine.d.ts

@@ -12,7 +12,7 @@
  * JSON handlers that accept a format discriminator.
  */
 import type { ProxyTracer } from "./proxyTracer.js";
-import type { ParsedClaudeRequest, ParsedGeminiRequest, ParsedOpenAIRequest, ProxyFormat, ProxyTranslationAttempt, ServerContext } from "../types/index.js";
+import type { ParsedClaudeRequest, ParsedGeminiRequest, ParsedOpenAIRequest, ProxyFormat, ProxyTranslationAttempt, ServerContext, TokenUsage } from "../types/index.js";
 /**
  * Extract text content from a stream chunk (handles various chunk formats).
  */
@@ -29,11 +29,7 @@ export declare function hasTranslatedOutput(collectedText: string, toolCalls: un
  * - AI SDK v4: promptTokens / completionTokens
  * - NeuroLink internal: input / output
  */
-export declare function extractUsageFromStreamResult(usage: unknown): {
-    input: number;
-    output: number;
-    total: number;
-};
+export declare function extractUsageFromStreamResult(usage: unknown): TokenUsage;
 /**
  * Detect which proxy format a request is using based on path and headers.
  */

package/dist/proxy/proxyTranslationEngine.js

@@ -77,17 +77,25 @@ export function hasTranslatedOutput(collectedText, toolCalls) {
  * - NeuroLink internal: input / output
  */
 export function extractUsageFromStreamResult(usage) {
-    if (!usage || typeof usage !== "object") {
-        return { input: 0, output: 0, total: 0 };
-    }
-    const u = usage;
-    const input = (typeof u.inputTokens === "number" ? u.inputTokens : 0) ||
-        (typeof u.promptTokens === "number" ? u.promptTokens : 0) ||
-        (typeof u.input === "number" ? u.input : 0);
-    const output = (typeof u.outputTokens === "number" ? u.outputTokens : 0) ||
-        (typeof u.completionTokens === "number" ? u.completionTokens : 0) ||
-        (typeof u.output === "number" ? u.output : 0);
-    return { input, output, total: input + output };
+    const observed = readTranslationUsage(usage);
+    const cacheReadTokens = observed.cacheReadTokens ?? 0;
+    const cacheCreationTokens = observed.cacheCreationTokens ?? 0;
+    const input = observed.inputIncludesCachedTokens
+        ? Math.max(0, (observed.inputTokens ?? 0) - cacheReadTokens - cacheCreationTokens)
+        : (observed.inputTokens ?? 0);
+    const output = observed.outputTokens ?? 0;
+    return {
+        input,
+        output,
+        total: input + cacheReadTokens + cacheCreationTokens + output,
+        ...(observed.cacheReadTokens !== undefined ? { cacheReadTokens } : {}),
+        ...(observed.cacheCreationTokens !== undefined
+            ? { cacheCreationTokens }
+            : {}),
+        ...(observed.reasoningTokens !== undefined
+            ? { reasoning: observed.reasoningTokens }
+            : {}),
+    };
 }
 // ---------------------------------------------------------------------------
 // Format detection
@@ -250,11 +258,11 @@ function defaultFinishReason(format) {
     return format === "claude" ? "end_turn" : "stop";
 }
 /** Preserve unknown usage as absent; zero is only reported when observed. */
-function translationUsage(result) {
-    const raw = result?.usage;
-    if (!raw) {
+function readTranslationUsage(usage) {
+    if (!usage || typeof usage !== "object") {
         return {};
     }
+    const raw = usage;
     const number = (...values) => values.find((value) => typeof value === "number" && Number.isFinite(value) && value >= 0);
     const details = raw.outputTokenDetails;
     const inputs = raw.inputTokenDetails;
@@ -275,6 +283,9 @@ function translationUsage(result) {
         reasoningTokens: number(raw.reasoningTokens, raw.reasoning, details?.reasoningTokens),
     };
 }
+function translationUsage(result) {
+    return readTranslationUsage(result?.usage);
+}
 /** Shared request owner, independent of a consumer asking for another chunk. */
 function createTranslationRequest(args) {
     const { ctx, requestModel, parsed, tracer, requestStartTime, stream } = args;

package/dist/proxy/routingPolicy.d.ts

@@ -14,6 +14,8 @@ export declare function buildProxyTranslationPlan(primary: {
 }, fallbackChain: FallbackEntry[], requestedModel: string, _parsed?: ParsedClaudeRequest, allowAutoFallback?: boolean): ProxyTranslationPlan;
 /**
  * Parse the retry-after header from an upstream 429 response.
- * Returns milliseconds to wait, or 0 if no valid header present.
+ *
+ * @param retryAfterHeader - The raw Retry-After header string or null
+ * @returns Milliseconds to wait (minimum 1000ms if valid), or 0 if no valid header present
  */
 export declare function parseRetryAfterMs(retryAfterHeader: string | null): number;

package/dist/proxy/routingPolicy.js

@@ -1,3 +1,4 @@
+import { parseRetryAfterHeaderValue } from "../utils/retryAfter.js";
 export function inferClaudeProxyModelTier(modelName) {
     const normalized = modelName.toLowerCase();
     if (normalized.includes("opus")) {
@@ -59,19 +60,17 @@ export function buildProxyTranslationPlan(primary, fallbackChain, requestedModel
 // ---------------------------------------------------------------------------
 /**
  * Parse the retry-after header from an upstream 429 response.
- * Returns milliseconds to wait, or 0 if no valid header present.
+ *
+ * @param retryAfterHeader - The raw Retry-After header string or null
+ * @returns Milliseconds to wait (minimum 1000ms if valid), or 0 if no valid header present
  */
 export function parseRetryAfterMs(retryAfterHeader) {
     if (!retryAfterHeader) {
         return 0;
     }
-    const seconds = parseInt(retryAfterHeader, 10);
-    if (!Number.isNaN(seconds)) {
-        return Math.max(1, seconds) * 1000;
-    }
-    const date = new Date(retryAfterHeader);
-    if (!Number.isNaN(date.getTime())) {
-        return Math.max(1000, date.getTime() - Date.now());
+    const delay = parseRetryAfterHeaderValue(retryAfterHeader);
+    if (delay !== undefined) {
+        return Math.max(1000, delay);
     }
     return 0;
 }