@juspay/neurolink 9.30.0 → 9.31.0

package/dist/proxy/requestLogger.js

@@ -0,0 +1,207 @@
+/**
+ * Proxy Request Logger
+ * Logs proxy request/response metadata to a rotating log file.
+ * Useful for debugging and auditing proxy traffic.
+ */
+import { join } from "path";
+import { homedir } from "os";
+import { logger } from "../utils/logger.js";
+import { chmodSync, existsSync, mkdirSync, readdirSync, statSync, unlinkSync, } from "fs";
+import { appendFile } from "fs/promises";
+let logDir = null;
+let logEnabled = false;
+/** Maximum body size to log (bytes). Larger bodies are truncated. */
+const MAX_BODY_LOG_SIZE = 32_768; // 32 KB
+/** Headers whose values must always be redacted. */
+const SENSITIVE_HEADER_NAMES = new Set([
+    "authorization",
+    "proxy-authorization",
+    "x-api-key",
+    "cookie",
+    "set-cookie",
+]);
+/** Pattern that matches header names likely to contain secrets. */
+const SENSITIVE_HEADER_PATTERN = /token|secret|key|password|credential/i;
+/** JSON keys whose values should be redacted in request/response bodies. */
+const SENSITIVE_BODY_KEYS = /("(?:password|access_token|refresh_token|api_key|apiKey|secret|authorization|token|credential|x-api-key)"\s*:\s*)"(?:[^"\\]|\\.)*"/gi;
+export function initRequestLogger(enabled = true) {
+    logEnabled = enabled;
+    if (!enabled) {
+        return;
+    }
+    try {
+        logDir = join(homedir(), ".neurolink", "logs");
+        if (!existsSync(logDir)) {
+            mkdirSync(logDir, { recursive: true, mode: 0o700 });
+        }
+        chmodSync(logDir, 0o700);
+    }
+    catch (err) {
+        logEnabled = false;
+        logDir = null;
+        logger.warn(`[proxy] Request logging disabled — failed to create log directory: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+export async function logRequest(entry) {
+    if (!logEnabled || !logDir) {
+        return;
+    }
+    const logFile = join(logDir, `proxy-${new Date().toISOString().split("T")[0]}.jsonl`);
+    const line = JSON.stringify(entry) + "\n";
+    try {
+        await appendFile(logFile, line, { mode: 0o600 });
+    }
+    catch {
+        // Non-fatal — don't crash proxy for logging failures
+    }
+}
+export function getLogDir() {
+    return logDir;
+}
+/**
+ * Redact sensitive header values in-place.
+ */
+function redactHeaders(headers) {
+    if (!headers) {
+        return headers;
+    }
+    const redacted = {};
+    for (const [key, value] of Object.entries(headers)) {
+        const lower = key.toLowerCase();
+        if (SENSITIVE_HEADER_NAMES.has(lower) ||
+            SENSITIVE_HEADER_PATTERN.test(lower)) {
+            redacted[key] = "[REDACTED]";
+        }
+        else {
+            redacted[key] = value;
+        }
+    }
+    return redacted;
+}
+/**
+ * Redact sensitive keys from a JSON body string and truncate if too large.
+ */
+function redactBody(body) {
+    if (body === undefined || body === null) {
+        return body;
+    }
+    let str = typeof body === "string" ? body : JSON.stringify(body);
+    // Redact known sensitive JSON keys BEFORE truncating so that a mid-string
+    // slice cannot leave a partially exposed secret (the regex needs closing
+    // quotes to match).
+    str = str.replace(SENSITIVE_BODY_KEYS, '$1"[REDACTED]"');
+    if (str.length > MAX_BODY_LOG_SIZE) {
+        str =
+            str.slice(0, MAX_BODY_LOG_SIZE) +
+                `... [TRUNCATED from ${str.length} bytes]`;
+    }
+    return str;
+}
+/**
+ * Log the FULL raw request and response for debugging.
+ * Writes to a separate file: proxy-debug-YYYY-MM-DD.jsonl
+ * Each entry has the complete request body and response body.
+ *
+ * Sensitive headers and body fields are redacted before writing.
+ */
+export async function logFullRequestResponse(entry) {
+    if (!logEnabled || !logDir) {
+        return;
+    }
+    const sanitizedEntry = {
+        ...entry,
+        requestHeaders: redactHeaders(entry.requestHeaders),
+        requestBody: redactBody(entry.requestBody),
+        responseHeaders: redactHeaders(entry.responseHeaders),
+        responseBody: redactBody(entry.responseBody),
+    };
+    const logFile = join(logDir, `proxy-debug-${new Date().toISOString().split("T")[0]}.jsonl`);
+    const line = JSON.stringify(sanitizedEntry) + "\n";
+    try {
+        await appendFile(logFile, line, { mode: 0o600 });
+    }
+    catch {
+        // Non-fatal
+    }
+}
+/**
+ * Log a mid-stream error that occurs after the initial 200 was sent.
+ * These are invisible in normal request logs since the 200 was already recorded.
+ */
+export async function logStreamError(entry) {
+    if (!logEnabled || !logDir) {
+        return;
+    }
+    const logFile = join(logDir, `proxy-${new Date().toISOString().split("T")[0]}.jsonl`);
+    const logEntry = {
+        ...entry,
+        responseStatus: 200,
+        errorType: "stream_error",
+        note: "mid-stream failure after initial 200",
+    };
+    try {
+        await appendFile(logFile, JSON.stringify(logEntry) + "\n", {
+            mode: 0o600,
+        });
+    }
+    catch {
+        // Non-fatal — don't crash proxy for logging failures
+    }
+}
+/**
+ * Clean up old log files by age and total size.
+ * - Deletes files older than maxAgeDays
+ * - If remaining files exceed maxSizeMb, deletes oldest until under limit
+ * Non-fatal — proxy keeps working even if cleanup fails.
+ */
+export function cleanupLogs(maxAgeDays = 7, maxSizeMb = 500) {
+    if (!logDir || !existsSync(logDir)) {
+        return;
+    }
+    try {
+        const files = readdirSync(logDir)
+            .filter((f) => f.startsWith("proxy-") && f.endsWith(".jsonl"))
+            .map((f) => {
+            const filePath = join(logDir, f);
+            const stat = statSync(filePath);
+            return {
+                name: f,
+                path: filePath,
+                mtime: stat.mtimeMs,
+                size: stat.size,
+            };
+        })
+            .sort((a, b) => a.mtime - b.mtime); // oldest first
+        const cutoff = Date.now() - maxAgeDays * 24 * 60 * 60 * 1000;
+        let deletedCount = 0;
+        let freedBytes = 0;
+        // Pass 1: delete files older than maxAgeDays
+        const remaining = [];
+        for (const file of files) {
+            if (file.mtime < cutoff) {
+                unlinkSync(file.path);
+                deletedCount++;
+                freedBytes += file.size;
+            }
+            else {
+                remaining.push(file);
+            }
+        }
+        // Pass 2: if total size exceeds maxSizeMb, delete oldest until under limit
+        const maxBytes = maxSizeMb * 1024 * 1024;
+        let totalSize = remaining.reduce((sum, f) => sum + f.size, 0);
+        while (totalSize > maxBytes && remaining.length > 0) {
+            const oldest = remaining.shift();
+            unlinkSync(oldest.path);
+            totalSize -= oldest.size;
+            deletedCount++;
+            freedBytes += oldest.size;
+        }
+        if (deletedCount > 0) {
+            logger.info(`[proxy] log cleanup: deleted ${deletedCount} file(s), freed ${(freedBytes / 1024 / 1024).toFixed(1)} MB`);
+        }
+    }
+    catch {
+        // Non-fatal
+    }
+}

package/dist/proxy/tokenRefresh.d.ts

@@ -0,0 +1,4 @@
+import type { RefreshableAccount, RefreshResult, TokenPersistTarget } from "../types/index.js";
+export declare function needsRefresh(account: RefreshableAccount): boolean;
+export declare function refreshToken(account: RefreshableAccount): Promise<RefreshResult>;
+export declare function persistTokens(target: TokenPersistTarget, account: RefreshableAccount): Promise<void>;

package/dist/proxy/tokenRefresh.js

@@ -0,0 +1,124 @@
+import { logger } from "../utils/logger.js";
+import { tokenStore } from "../auth/tokenStore.js";
+const REFRESH_URL = "https://api.anthropic.com/v1/oauth/token";
+const REFRESH_URL_FALLBACK = "https://console.anthropic.com/v1/oauth/token";
+const CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
+const BUFFER_MS = 60 * 60 * 1000;
+const USER_AGENT = "claude-cli/2.1.80 (external, cli)";
+export function needsRefresh(account) {
+    return !!(account.expiresAt &&
+        account.expiresAt <= Date.now() + BUFFER_MS &&
+        account.refreshToken);
+}
+export async function refreshToken(account) {
+    if (!account.refreshToken) {
+        return { success: false, error: "No refresh token available" };
+    }
+    const formBody = new URLSearchParams({
+        grant_type: "refresh_token",
+        refresh_token: account.refreshToken,
+        client_id: CLIENT_ID,
+    }).toString();
+    const headers = {
+        "Content-Type": "application/x-www-form-urlencoded",
+        "User-Agent": USER_AGENT,
+    };
+    const urls = [REFRESH_URL, REFRESH_URL_FALLBACK];
+    for (const url of urls) {
+        try {
+            const resp = await fetch(url, {
+                method: "POST",
+                headers,
+                body: formBody,
+                signal: AbortSignal.timeout(10_000),
+            });
+            if (!resp.ok) {
+                const errorBody = await resp.text();
+                logger.warn(`[token-refresh] failed for ${account.label} at ${url}`, {
+                    status: resp.status,
+                    error: errorBody.slice(0, 500),
+                });
+                // If primary URL returned a non-ok status, try fallback
+                if (url === REFRESH_URL) {
+                    continue;
+                }
+                return { success: false, error: errorBody, status: resp.status };
+            }
+            const data = (await resp.json());
+            const previousExpiresAt = account.expiresAt;
+            account.token = data.access_token;
+            account.expiresAt =
+                data.expires_in !== undefined
+                    ? Date.now() + data.expires_in * 1000
+                    : previousExpiresAt && previousExpiresAt > Date.now()
+                        ? previousExpiresAt
+                        : Date.now() + 55 * 60 * 1000;
+            if (data.refresh_token) {
+                account.refreshToken = data.refresh_token;
+            }
+            logger.debug(`[token-refresh] refreshed for ${account.label}`);
+            return { success: true };
+        }
+        catch (e) {
+            logger.warn(`[token-refresh] exception for ${account.label} at ${url}`, {
+                error: String(e),
+            });
+            // If primary URL threw, try fallback
+            if (url === REFRESH_URL) {
+                continue;
+            }
+            return { success: false, error: String(e) };
+        }
+    }
+    // Should not reach here, but guard against empty urls array
+    return { success: false, error: "No refresh URLs available" };
+}
+export async function persistTokens(target, account) {
+    if (typeof target !== "string" && "providerKey" in target) {
+        await persistTokenStoreAccount(target.providerKey, account);
+        return;
+    }
+    const credPath = typeof target === "string" ? target : target.credPath;
+    await persistLegacyCredentials(credPath, account);
+}
+async function persistLegacyCredentials(credPath, account) {
+    try {
+        const fs = await import("fs/promises");
+        const existing = JSON.parse(await fs.readFile(credPath, "utf8"));
+        existing.oauth = {
+            ...existing.oauth,
+            accessToken: account.token,
+            expiresAt: account.expiresAt,
+            refreshToken: account.refreshToken,
+        };
+        existing.updatedAt = Date.now();
+        const tmpPath = credPath + ".tmp";
+        await fs.writeFile(tmpPath, JSON.stringify(existing, null, 2), {
+            mode: 0o600,
+        });
+        await fs.rename(tmpPath, credPath);
+    }
+    catch (err) {
+        logger.warn("[token-refresh] Failed to persist legacy credentials", {
+            error: err instanceof Error ? err.message : String(err),
+        });
+    }
+}
+async function persistTokenStoreAccount(providerKey, account) {
+    try {
+        const existing = await tokenStore.loadTokens(providerKey);
+        const merged = {
+            accessToken: account.token,
+            refreshToken: account.refreshToken ?? existing?.refreshToken,
+            expiresAt: account.expiresAt ?? existing?.expiresAt ?? Date.now() + 55 * 60 * 1000,
+            tokenType: existing?.tokenType ?? "Bearer",
+            ...(existing?.scope ? { scope: existing.scope } : {}),
+        };
+        await tokenStore.saveTokens(providerKey, merged);
+    }
+    catch (err) {
+        logger.warn("[token-refresh] Failed to persist TokenStore credentials", {
+            error: err instanceof Error ? err.message : String(err),
+        });
+    }
+}

package/dist/proxy/usageStats.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Proxy Usage Statistics
+ * Tracks per-account request counts, token usage, and error rates.
+ * In-memory only — resets on proxy restart.
+ */
+import type { AccountStats, ProxyStats } from "../types/index.js";
+export declare function recordRequest(accountLabel: string, accountType: string): void;
+export declare function recordSuccess(accountLabel: string, accountType: string): void;
+export declare function recordError(accountLabel: string, accountType: string, status: number): void;
+export declare function recordCooldown(accountLabel: string, accountType: string, cooldownUntil: number, backoffLevel: number): void;
+export declare function getStats(): ProxyStats;
+export declare function getAccountStats(label: string): AccountStats | undefined;
+export declare function resetStats(): void;

package/dist/proxy/usageStats.js

@@ -0,0 +1,74 @@
+/**
+ * Proxy Usage Statistics
+ * Tracks per-account request counts, token usage, and error rates.
+ * In-memory only — resets on proxy restart.
+ */
+const stats = {
+    startedAt: Date.now(),
+    totalRequests: 0,
+    totalSuccess: 0,
+    totalErrors: 0,
+    totalRateLimits: 0,
+    accounts: {},
+};
+export function recordRequest(accountLabel, accountType) {
+    ensureAccount(accountLabel, accountType).requestCount++;
+    ensureAccount(accountLabel, accountType).lastRequestAt = Date.now();
+}
+export function recordSuccess(accountLabel, accountType) {
+    stats.totalRequests++;
+    stats.totalSuccess++;
+    const acct = ensureAccount(accountLabel, accountType);
+    acct.successCount++;
+    acct.currentBackoffLevel = 0;
+}
+export function recordError(accountLabel, accountType, status) {
+    stats.totalRequests++;
+    stats.totalErrors++;
+    const acct = ensureAccount(accountLabel, accountType);
+    acct.errorCount++;
+    acct.lastErrorAt = Date.now();
+    if (status === 429) {
+        stats.totalRateLimits++;
+        acct.rateLimitCount++;
+    }
+}
+export function recordCooldown(accountLabel, accountType, cooldownUntil, backoffLevel) {
+    const acct = ensureAccount(accountLabel, accountType);
+    acct.coolingUntil = cooldownUntil;
+    acct.currentBackoffLevel = backoffLevel;
+}
+export function getStats() {
+    const accounts = {};
+    for (const [label, account] of Object.entries(stats.accounts)) {
+        accounts[label] = { ...account };
+    }
+    return { ...stats, accounts };
+}
+export function getAccountStats(label) {
+    const account = stats.accounts[label];
+    return account ? { ...account } : undefined;
+}
+export function resetStats() {
+    stats.startedAt = Date.now();
+    stats.totalRequests = 0;
+    stats.totalSuccess = 0;
+    stats.totalErrors = 0;
+    stats.totalRateLimits = 0;
+    stats.accounts = {};
+}
+function ensureAccount(label, type) {
+    if (!stats.accounts[label]) {
+        stats.accounts[label] = {
+            label,
+            type,
+            requestCount: 0,
+            successCount: 0,
+            errorCount: 0,
+            rateLimitCount: 0,
+            lastRequestAt: 0,
+            currentBackoffLevel: 0,
+        };
+    }
+    return stats.accounts[label];
+}

package/dist/rag/document/loaders.js

@@ -97,7 +97,7 @@ export class JSONLoader extends TextLoader {
             JSON.parse(content);
         }
         catch (error) {
-            throw new Error(`Invalid JSON: ${error instanceof Error ? error.message : String(error)}`);
+            throw new Error(`Invalid JSON: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
         }
         return MDocument.fromJSONContent(content, {
             source: this.getSourceName(source),

package/dist/rag/pipeline/contextAssembly.d.ts

@@ -12,13 +12,10 @@
  * - Context summarization
  */
 import type { Chunk, VectorQueryResult } from "../types.js";
-import type { ContextAssemblyOptions, ContextWindow } from "../../types/ragTypes.js";
-/**
- * Citation format options
- */
-export type CitationFormat = "inline" | "footnote" | "numbered" | "none";
-export type { ContextAssemblyOptions } from "../../types/ragTypes.js";
-export type { ContextWindow } from "../../types/ragTypes.js";
+import type { ContextAssemblyOptions, ContextWindow } from "../../types/index.js";
+export type { CitationFormat } from "../../types/index.js";
+export type { ContextAssemblyOptions } from "../../types/index.js";
+export type { ContextWindow } from "../../types/index.js";
 /**
  * Assemble context from retrieved results
  *

package/dist/rag/ragIntegration.d.ts

@@ -6,8 +6,8 @@
  * embedding generation, vector storage, and tool creation internally
  * so developers only need to pass `rag: { files: [...] }`.
  */
-import type { Tool } from "ai";
 import type { RAGConfig, VectorQueryResult } from "./types.js";
+import type { RAGPreparedTool } from "../types/index.js";
 /**
  * Generate deterministic embeddings for chunks.
  * Combines character-frequency (40%) with word-level hash features (60%)
@@ -21,19 +21,7 @@ declare function generateSimpleEmbedding(text: string, dimension: number): numbe
  * preventing any single file from dominating retrieval.
  */
 declare function diversifyResults(results: VectorQueryResult[], topK: number): VectorQueryResult[];
-/**
- * Result of preparing RAG for a generate/stream call
- */
-export type RAGPreparedTool = {
-    /** The tool to inject into the tools Record */
-    tool: Tool;
-    /** Tool name (key for the tools Record) */
-    toolName: string;
-    /** Number of chunks indexed */
-    chunksIndexed: number;
-    /** Number of files loaded */
-    filesLoaded: number;
-};
+export type { RAGPreparedTool } from "../types/index.js";
 /**
  * Prepare RAG tools from the provided configuration.
  *

package/dist/rag/ragIntegration.js

@@ -266,7 +266,7 @@ async function _prepareRAGToolInner(ragConfig, fallbackProvider) {
     // Convert to Vercel AI SDK Tool format
     const aiTool = {
         description: queryTool.description,
-        parameters: z.object({
+        inputSchema: z.object({
             query: z
                 .string()
                 .describe("The search query to find relevant information"),

package/dist/rag/resilience/CircuitBreaker.d.ts

@@ -6,50 +6,11 @@
  * Provides fault tolerance and prevents cascading failures.
  */
 import { TypedEventEmitter } from "../../core/infrastructure/index.js";
-/**
- * Circuit breaker states
- */
-export type CircuitState = "closed" | "open" | "half-open";
-import type { RAGCircuitBreakerConfig, RAGCircuitBreakerStats } from "../../types/ragTypes.js";
-export type { RAGCircuitBreakerConfig } from "../../types/ragTypes.js";
-export type { RAGCircuitBreakerStats } from "../../types/ragTypes.js";
-/**
- * Circuit breaker events
- */
-export type RAGCircuitBreakerEvents = {
-    stateChange: [
-        {
-            oldState: CircuitState;
-            newState: CircuitState;
-            reason: string;
-            timestamp: Date;
-        }
-    ];
-    callSuccess: [{
-        duration: number;
-        timestamp: Date;
-        operationType?: string;
-    }];
-    callFailure: [
-        {
-            error: string;
-            duration: number;
-            timestamp: Date;
-            operationType?: string;
-        }
-    ];
-    circuitOpen: [{
-        failureRate: number;
-        totalCalls: number;
-        timestamp: Date;
-    }];
-    circuitHalfOpen: [{
-        timestamp: Date;
-    }];
-    circuitClosed: [{
-        timestamp: Date;
-    }];
-};
+import type { CircuitState, RAGCircuitBreakerConfig, RAGCircuitBreakerEvents, RAGCircuitBreakerStats } from "../../types/index.js";
+export type { CircuitState } from "../../types/index.js";
+export type { RAGCircuitBreakerConfig } from "../../types/index.js";
+export type { RAGCircuitBreakerStats } from "../../types/index.js";
+export type { RAGCircuitBreakerEvents } from "../../types/index.js";
 /**
  * RAG Circuit Breaker
  *

package/dist/rag/resilience/RetryHandler.js

@@ -5,7 +5,7 @@
  * specifically designed for RAG operations including embeddings,
  * vector queries, and LLM-based extraction.
  */
-import { withRetry, } from "../../core/infrastructure/index.js";
+import { withRetry } from "../../core/infrastructure/index.js";
 import { isAbortError } from "../../utils/errorHandling.js";
 import { logger } from "../../utils/logger.js";
 import { EmbeddingError, isRetryableRAGError, MetadataExtractionError, RAGError, RAGErrorCodes, VectorQueryError, } from "../errors/RAGError.js";

package/dist/rag/retrieval/vectorQueryTool.d.ts

@@ -23,15 +23,7 @@ export declare function createVectorQueryTool(config: VectorQueryToolConfig, vec
         topK: z.ZodOptional<z.ZodNumber>;
         filter?: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>> | undefined;
         query: z.ZodString;
-    }, "strip", z.ZodTypeAny, {
-        query: string;
-        filter?: unknown;
-        topK?: number | undefined;
-    }, {
-        query: string;
-        filter?: unknown;
-        topK?: number | undefined;
-    }>;
+    }, z.core.$strip>;
     /**
      * Execute the vector query
      * @param params - Query parameters

package/dist/rag/retrieval/vectorQueryTool.js

@@ -29,7 +29,7 @@ export function createVectorQueryTool(config, vectorStore) {
             ...(enableFilter
                 ? {
                     filter: z
-                        .record(z.unknown())
+                        .record(z.string(), z.unknown())
                         .optional()
                         .describe("Metadata filters to narrow down results"),
                 }

package/dist/sdk/toolRegistration.js

@@ -169,7 +169,18 @@ function provideToolSuggestions(name, tool) {
  * Helper to create a tool with typed parameters
  */
 export function createTypedTool(config) {
-    return config;
+    // Wrap the typed execute to match SimpleTool's signature.
+    // The Zod schema validates params at runtime, so the cast within the wrapper is safe.
+    const wrappedExecute = async (params, context) => {
+        const result = await config.execute(params, context);
+        return result;
+    };
+    return {
+        description: config.description,
+        parameters: config.parameters,
+        execute: wrappedExecute,
+        ...(config.metadata && { metadata: config.metadata }),
+    };
 }
 /**
  * Enhanced tool name validation using centralized utilities

package/dist/server/abstract/baseServerAdapter.js

@@ -294,8 +294,8 @@ export class BaseServerAdapter extends EventEmitter {
                 handler: async (ctx) => {
                     const toolRegistry = ctx.toolRegistry;
                     const readinessTimeout = this.config.timeout || 5000;
-                    let tools = [];
-                    let toolsAvailable = false;
+                    let tools;
+                    let toolsAvailable;
                     try {
                         tools = await withTimeout(toolRegistry.listTools(), readinessTimeout, new Error(`toolRegistry.listTools timed out after ${readinessTimeout}ms`));
                         toolsAvailable = tools.length > 0;

package/dist/server/adapters/honoAdapter.d.ts

@@ -37,6 +37,12 @@ export declare class HonoServerAdapter extends BaseServerAdapter {
      * Handle streaming response using SSE
      */
     private handleStreamingResponse;
+    /**
+     * Transform a raw provider chunk into a StreamEvent
+     * Provider chunks are typically { content: string } objects;
+     * the client SDK expects { type: "text", content: string, timestamp: number }
+     */
+    private toStreamEvent;
     /**
      * Register middleware with Hono
      */