@juspay/neurolink 9.51.4 → 9.52.0

package/dist/neurolink.js

@@ -259,6 +259,60 @@ export class NeuroLink {
     authProvider;
     pendingAuthConfig;
     authInitPromise;
+    // Per-provider credential overrides (instance-level default)
+    credentials;
+    /**
+     * Merge instance-level credentials with per-call credentials.
+     *
+     * Semantics: **deep merge at the provider level.** For each provider key
+     * present in both `this.credentials` and `callCredentials`, the per-call
+     * fields are merged ON TOP of the instance-level fields, so fields not
+     * mentioned in the per-call slice are preserved.
+     *
+     * Example:
+     * ```
+     * instance:  { openai: { apiKey: "key1", baseURL: "url1" } }
+     * per-call:  { openai: { apiKey: "key2" } }
+     * merged:    { openai: { apiKey: "key2", baseURL: "url1" } }   // baseURL preserved
+     * ```
+     *
+     * Providers present only in one source are carried through unchanged.
+     * Unrelated providers (not overridden in callCredentials) are carried through
+     * from instance credentials unchanged.
+     */
+    resolveCredentials(callCredentials) {
+        if (!this.credentials && !callCredentials) {
+            return undefined;
+        }
+        if (!this.credentials) {
+            return callCredentials;
+        }
+        if (!callCredentials) {
+            return this.credentials;
+        }
+        // Per-provider deep merge: for each provider key in the per-call
+        // override, merge its fields on top of the instance-level slice so
+        // individual fields (e.g. baseURL) are preserved when only apiKey
+        // is overridden per-call.
+        const merged = { ...this.credentials };
+        for (const key of Object.keys(callCredentials)) {
+            const instanceSlice = this.credentials[key];
+            const callSlice = callCredentials[key];
+            if (instanceSlice &&
+                callSlice &&
+                typeof instanceSlice === "object" &&
+                typeof callSlice === "object") {
+                merged[key] = {
+                    ...instanceSlice,
+                    ...callSlice,
+                };
+            }
+            else {
+                merged[key] = callSlice ?? instanceSlice;
+            }
+        }
+        return merged;
+    }
     // HITL (Human-in-the-Loop) support
     hitlManager;
     // Accumulated cost in USD across all generate() calls on this instance
@@ -599,6 +653,10 @@ export class NeuroLink {
         if (config?.auth) {
             this.pendingAuthConfig = config.auth;
         }
+        // Store per-provider credential overrides
+        if (config?.credentials) {
+            this.credentials = config.credentials;
+        }
         // Store task config for lazy initialization
         this._taskManagerConfig = config?.tasks;
         // Eagerly create TaskManager and register tools if config is provided
@@ -2122,6 +2180,7 @@ Current user's request: ${currentInput}`;
                 }
             }
             logger.debug("[NeuroLink] Graceful shutdown completed");
+            this.credentials = undefined;
         }
         catch (error) {
             logger.error("[NeuroLink] Shutdown failed:", error);
@@ -2650,6 +2709,7 @@ Current user's request: ${currentInput}`;
             skipToolPromptInjection: options.skipToolPromptInjection,
             middleware: options.middleware,
             conversationMessages: options.conversationMessages,
+            credentials: options.credentials,
         };
         const extraContext = options;
         if (extraContext.sessionId || extraContext.userId) {
@@ -2784,7 +2844,7 @@ Current user's request: ${currentInput}`;
         const { extractPPTContext, getEffectivePPTProvider } = await import("./features/ppt/utils.js");
         // Get provider instance for content planning
         const requestedProvider = (options.provider || "vertex");
-        const provider = await AIProviderFactory.createProvider(requestedProvider, options.model, true, this);
+        const provider = await AIProviderFactory.createProvider(requestedProvider, options.model, true, this, undefined, this.resolveCredentials(options.credentials));
         // Resolve effective PPT provider (may auto-select if current is not PPT-compatible)
         const effectiveProvider = await getEffectivePPTProvider(provider, requestedProvider, options.model || "default", this);
         // Extract PPT context from options
@@ -3818,7 +3878,7 @@ Current user's request: ${currentInput}`;
     }
     async generateWithMCPProvider(context) {
         const { options, requestId, functionTag, tryMCPStartTime, providerName, availableTools, enhancedSystemPrompt, conversationMessages, } = context;
-        const provider = await AIProviderFactory.createProvider(providerName, options.model, !options.disableTools, this, options.region);
+        const provider = await AIProviderFactory.createProvider(providerName, options.model, !options.disableTools, this, options.region, this.resolveCredentials(options.credentials));
         provider.setTraceContext(this._metricsTraceContext);
         this.emitter.emit("connected");
         this.emitter.emit("message", `${providerName} provider initialized successfully`);
@@ -4014,7 +4074,8 @@ Current user's request: ${currentInput}`;
                 }
                 const provider = await AIProviderFactory.createProvider(providerName, options.model, !options.disableTools, // Pass disableTools as inverse of enableMCP
                 this, // Pass SDK instance
-                options.region);
+                options.region, // Pass region parameter
+                this.resolveCredentials(options.credentials));
                 // Propagate trace context for parent-child span hierarchy
                 provider.setTraceContext(this._metricsTraceContext);
                 // ADD: Emit connection events for successful provider creation (Bedrock-compatible)
@@ -4762,7 +4823,7 @@ Current user's request: ${currentInput}`;
             reason: errorMsg,
         });
         try {
-            const fallbackProvider = await AIProviderFactory.createProvider(fallbackRoute.provider, fallbackRoute.model);
+            const fallbackProvider = await AIProviderFactory.createProvider(fallbackRoute.provider, fallbackRoute.model, true, undefined, undefined, this.resolveCredentials(enhancedOptions.credentials));
             // Ensure fallback provider can execute tools
             fallbackProvider.setupToolExecutor({
                 customTools: this.getCustomTools(),
@@ -4925,7 +4986,8 @@ Current user's request: ${currentInput}`;
         const providerName = await getBestProvider(options.provider);
         const provider = await AIProviderFactory.createProvider(providerName, options.model, !options.disableTools, // Pass disableTools as inverse of enableMCP
         this, // Pass SDK instance
-        options.region);
+        options.region, // Pass region parameter
+        this.resolveCredentials(options.credentials));
         // Propagate trace context for parent-child span hierarchy
         provider.setTraceContext(this._metricsTraceContext);
         // Enable tool execution for the provider using BaseProvider method
@@ -5140,7 +5202,7 @@ Current user's request: ${currentInput}`;
         const originalPrompt = options.input.text;
         const responseTime = Date.now() - startTime;
         const providerName = await getBestProvider(options.provider);
-        const provider = await AIProviderFactory.createProvider(providerName, options.model);
+        const provider = await AIProviderFactory.createProvider(providerName, options.model, true, undefined, undefined, this.resolveCredentials(options.credentials));
         const fallbackStreamResult = await provider.stream({
             input: { text: options.input.text },
             model: options.model,
@@ -8502,6 +8564,7 @@ Current user's request: ${currentInput}`;
                 this.mcpInitialized = false;
                 this.mcpInitPromise = null;
                 this.conversationMemoryNeedsInit = false;
+                this.credentials = undefined;
                 logger.debug("[NeuroLink] Initialization state reset successfully");
             }
             catch (error) {

package/dist/providers/amazonBedrock.d.ts

@@ -8,7 +8,12 @@ export declare class AmazonBedrockProvider extends BaseProvider {
     private bedrockClient;
     private conversationHistory;
     private region;
-    constructor(modelName?: string, neurolink?: NeuroLink, region?: string);
+    constructor(modelName?: string, neurolink?: NeuroLink, region?: string, credentials?: {
+        accessKeyId?: string;
+        secretAccessKey?: string;
+        sessionToken?: string;
+        region?: string;
+    });
     /**
      * Perform initial health check to catch credential/connectivity issues early
      * This prevents the health check failure we saw in production logs

package/dist/providers/amazonBedrock.js

@@ -18,9 +18,10 @@ export class AmazonBedrockProvider extends BaseProvider {
     bedrockClient;
     conversationHistory = [];
     region;
-    constructor(modelName, neurolink, region) {
+    constructor(modelName, neurolink, region, credentials) {
         super(modelName, "bedrock", neurolink);
-        this.region = region || process.env.AWS_REGION || "us-east-1";
+        this.region =
+            credentials?.region || region || process.env.AWS_REGION || "us-east-1";
         logger.debug("[AmazonBedrockProvider] Starting constructor with extensive logging for debugging");
         // Log environment variables for debugging
         logger.debug(`[AmazonBedrockProvider] Environment check: AWS_REGION=${process.env.AWS_REGION || "undefined"}, AWS_ACCESS_KEY_ID=${process.env.AWS_ACCESS_KEY_ID ? "SET" : "undefined"}, AWS_SECRET_ACCESS_KEY=${process.env.AWS_SECRET_ACCESS_KEY ? "SET" : "undefined"}`);
@@ -35,6 +36,17 @@ export class AmazonBedrockProvider extends BaseProvider {
                 // 2. Environment variables
                 // 3. AWS config files
                 // 4. Instance metadata
+                ...(credentials?.accessKeyId && credentials?.secretAccessKey
+                    ? {
+                        credentials: {
+                            accessKeyId: credentials.accessKeyId,
+                            secretAccessKey: credentials.secretAccessKey,
+                            ...(credentials.sessionToken
+                                ? { sessionToken: credentials.sessionToken }
+                                : {}),
+                        },
+                    }
+                    : {}),
             });
             logger.debug(`[AmazonBedrockProvider] Successfully created BedrockRuntimeClient with model: ${this.modelName}, region: ${this.region}`);
         }

package/dist/providers/amazonSagemaker.d.ts

@@ -17,7 +17,13 @@ export declare class AmazonSageMakerProvider extends BaseProvider {
     private sagemakerModel;
     private sagemakerConfig;
     private modelConfig;
-    constructor(modelName?: string, endpointName?: string, region?: string, neurolink?: NeuroLink);
+    constructor(modelName?: string, endpointName?: string, region?: string, neurolink?: NeuroLink, credentials?: {
+        accessKeyId?: string;
+        secretAccessKey?: string;
+        sessionToken?: string;
+        region?: string;
+        endpoint?: string;
+    });
     protected getProviderName(): AIProviderName;
     protected getDefaultModel(): string;
     protected getAISDKModel(): LanguageModel;

package/dist/providers/amazonSagemaker.js

@@ -17,11 +17,29 @@ export class AmazonSageMakerProvider extends BaseProvider {
     sagemakerModel;
     sagemakerConfig;
     modelConfig;
-    constructor(modelName, endpointName, region, neurolink) {
+    constructor(modelName, endpointName, region, neurolink, credentials) {
         super(modelName, "sagemaker", neurolink);
         try {
-            // Load and validate configuration
-            this.sagemakerConfig = getSageMakerConfig(region);
+            // Load and validate configuration, then overlay per-request credentials
+            const baseConfig = getSageMakerConfig(credentials?.region ?? region);
+            this.sagemakerConfig = {
+                ...baseConfig,
+                ...(credentials?.region !== undefined && {
+                    region: credentials.region,
+                }),
+                ...(credentials?.accessKeyId !== undefined && {
+                    accessKeyId: credentials.accessKeyId,
+                }),
+                ...(credentials?.secretAccessKey !== undefined && {
+                    secretAccessKey: credentials.secretAccessKey,
+                }),
+                ...(credentials?.sessionToken !== undefined && {
+                    sessionToken: credentials.sessionToken,
+                }),
+                ...(credentials?.endpoint !== undefined && {
+                    endpoint: credentials.endpoint,
+                }),
+            };
             this.modelConfig = getSageMakerModelConfig(endpointName || getDefaultSageMakerEndpoint());
             // Create the SageMaker LanguageModel implementation.
             // SageMakerLanguageModel implements SageMakerAsLanguageModel which is

package/dist/providers/anthropic.d.ts

@@ -41,7 +41,10 @@ export declare class AnthropicProvider extends BaseProvider {
      * @param sdk - Optional NeuroLink SDK instance
      * @param config - Optional configuration options for auth, subscription tier, and beta features
      */
-    constructor(modelName?: string, sdk?: unknown, config?: AnthropicProviderConfig);
+    constructor(modelName?: string, sdk?: unknown, config?: AnthropicProviderConfig, credentials?: {
+        apiKey?: string;
+        oauthToken?: string;
+    });
     /**
      * Get authentication headers based on current auth method and configuration.
      *

package/dist/providers/anthropic.js

@@ -219,14 +219,27 @@ export class AnthropicProvider extends BaseProvider {
      * @param sdk - Optional NeuroLink SDK instance
      * @param config - Optional configuration options for auth, subscription tier, and beta features
      */
-    constructor(modelName, sdk, config) {
-        // Pre-compute effective model with tier validation before calling super
-        const oauthToken = config?.oauthToken ?? getOAuthToken();
+    constructor(modelName, sdk, config, credentials) {
+        // Pre-compute effective model with tier validation before calling super.
+        //
+        // When per-request credentials supply an apiKey (without oauthToken),
+        // force api_key auth — skip OAuth detection entirely so the caller's
+        // key is used rather than a stale OAuth token from ~/.neurolink/.
+        const forceApiKey = !!(credentials?.apiKey && !credentials?.oauthToken);
+        const oauthToken = forceApiKey
+            ? null
+            : ((credentials?.oauthToken
+                ? { accessToken: credentials.oauthToken }
+                : null) ??
+                config?.oauthToken ??
+                getOAuthToken());
         // Resolve auth method FIRST so that tier detection uses the chosen method.
         // If ANTHROPIC_AUTH_METHOD=api_key wins over an existing OAuth token, the
         // tier must reflect api_key mode (full model access) rather than the OAuth
         // token's subscription level.
-        const authMethod = config?.authMethod ?? detectAuthMethod(oauthToken);
+        const authMethod = forceApiKey
+            ? "api_key"
+            : (config?.authMethod ?? detectAuthMethod(oauthToken));
         const subscriptionTier = config?.subscriptionTier ??
             (authMethod === "oauth" ? detectSubscriptionTier(oauthToken) : "api");
         const targetModel = modelName || getDefaultAnthropicModel();
@@ -306,7 +319,7 @@ export class AnthropicProvider extends BaseProvider {
         }
         else {
             // Traditional API key authentication
-            const apiKeyToUse = config?.apiKey ?? getAnthropicApiKey();
+            const apiKeyToUse = credentials?.apiKey ?? config?.apiKey ?? getAnthropicApiKey();
             anthropic = createAnthropic({
                 apiKey: apiKeyToUse,
                 headers,

package/dist/providers/azureOpenai.d.ts

@@ -2,13 +2,14 @@ import { type LanguageModel } from "ai";
 import { type AIProviderName } from "../constants/enums.js";
 import { BaseProvider } from "../core/baseProvider.js";
 import type { StreamOptions, StreamResult } from "../types/streamTypes.js";
+import type { NeurolinkCredentials } from "../types/providers.js";
 export declare class AzureOpenAIProvider extends BaseProvider {
     private apiKey;
     private resourceName;
     private deployment;
     private apiVersion;
     private azureProvider;
-    constructor(modelName?: string, sdk?: unknown);
+    constructor(modelName?: string, sdk?: unknown, _region?: string, credentials?: NeurolinkCredentials["azure"]);
     getProviderName(): AIProviderName;
     getDefaultModel(): string;
     /**

package/dist/providers/azureOpenai.js

@@ -14,22 +14,27 @@ export class AzureOpenAIProvider extends BaseProvider {
     deployment;
     apiVersion;
     azureProvider;
-    constructor(modelName, sdk) {
+    constructor(modelName, sdk, _region, credentials) {
         super(modelName, "azure", sdk);
-        this.apiKey = process.env.AZURE_OPENAI_API_KEY || "";
+        this.apiKey = credentials?.apiKey || process.env.AZURE_OPENAI_API_KEY || "";
         const endpoint = process.env.AZURE_OPENAI_ENDPOINT || "";
-        this.resourceName = endpoint
+        const envResourceName = endpoint
             .replace("https://", "")
             .replace(/\/+$/, "") // Remove trailing slashes
             .replace(".openai.azure.com", "")
             .replace(".cognitiveservices.azure.com", "");
+        this.resourceName = credentials?.resourceName || envResourceName;
         this.deployment =
-            modelName ||
+            credentials?.deploymentName ||
+                modelName ||
                 process.env.AZURE_OPENAI_MODEL ||
                 process.env.AZURE_OPENAI_DEPLOYMENT ||
                 process.env.AZURE_OPENAI_DEPLOYMENT_ID ||
                 "gpt-4o";
-        this.apiVersion = process.env.AZURE_API_VERSION || APIVersions.AZURE_LATEST;
+        this.apiVersion =
+            credentials?.apiVersion ||
+                process.env.AZURE_API_VERSION ||
+                APIVersions.AZURE_LATEST;
         // Configuration validation - now using consolidated utility
         if (!this.apiKey) {
             validateApiKey(createAzureAPIKeyConfig());

package/dist/providers/googleAiStudio.d.ts

@@ -36,7 +36,10 @@ import type { ZodUnknownSchema } from "../types/typeAliases.js";
  *       Solution: Simplify schema or use disableTools: true
  */
 export declare class GoogleAIStudioProvider extends BaseProvider {
-    constructor(modelName?: string, sdk?: unknown);
+    private credentials?;
+    constructor(modelName?: string, sdk?: unknown, credentials?: {
+        apiKey?: string;
+    });
     getProviderName(): AIProviderName;
     getDefaultModel(): string;
     /**

package/dist/providers/googleAiStudio.js

@@ -65,8 +65,10 @@ async function createGoogleGenAIClient(apiKey) {
  *       Solution: Simplify schema or use disableTools: true
  */
 export class GoogleAIStudioProvider extends BaseProvider {
-    constructor(modelName, sdk) {
+    credentials;
+    constructor(modelName, sdk, credentials) {
         super(modelName, "google-ai", sdk);
+        this.credentials = credentials;
         logger.debug("GoogleAIStudioProvider initialized", {
             model: this.modelName,
             provider: this.providerName,
@@ -432,11 +434,6 @@ export class GoogleAIStudioProvider extends BaseProvider {
         }
         this.validateStreamOptions(options);
         const startTime = Date.now();
-        const apiKey = this.getApiKey();
-        // Ensure environment variable is set for @ai-sdk/google
-        if (!process.env.GOOGLE_GENERATIVE_AI_API_KEY) {
-            process.env.GOOGLE_GENERATIVE_AI_API_KEY = apiKey;
-        }
         const model = await this.getAISDKModelWithMiddleware(options);
         const timeout = this.getTimeout(options);
         const timeoutController = createTimeoutController(timeout, this.providerName, "stream");
@@ -1214,7 +1211,9 @@ export class GoogleAIStudioProvider extends BaseProvider {
         }
     }
     getApiKey() {
-        const apiKey = process.env.GOOGLE_AI_API_KEY || process.env.GOOGLE_GENERATIVE_AI_API_KEY;
+        const apiKey = this.credentials?.apiKey ||
+            process.env.GOOGLE_AI_API_KEY ||
+            process.env.GOOGLE_GENERATIVE_AI_API_KEY;
         if (!apiKey) {
             throw new AuthenticationError("GOOGLE_AI_API_KEY or GOOGLE_GENERATIVE_AI_API_KEY environment variable is not set", this.providerName);
         }

package/dist/providers/googleVertex.d.ts

@@ -3,6 +3,7 @@ import type { ZodType } from "zod";
 import { type AIProviderName } from "../constants/enums.js";
 import { BaseProvider } from "../core/baseProvider.js";
 import type { EnhancedGenerateResult, TextGenerationOptions } from "../types/generateTypes.js";
+import type { NeurolinkCredentials } from "../types/providers.js";
 import type { StreamOptions, StreamResult } from "../types/streamTypes.js";
 /**
  * Vertex Model Aliases
@@ -70,13 +71,14 @@ export declare class GoogleVertexProvider extends BaseProvider {
     private location;
     private registeredTools;
     private toolContext;
+    private credentials;
     private static modelConfigCache;
     private static modelConfigCacheTime;
     private static readonly CACHE_DURATION;
     private static readonly MAX_CACHE_SIZE;
     private static maxTokensCache;
     private static maxTokensCacheTime;
-    constructor(modelName?: string, _providerName?: string, sdk?: unknown, region?: string);
+    constructor(modelName?: string, _providerName?: string, sdk?: unknown, region?: string, credentials?: NeurolinkCredentials["vertex"]);
     protected getProviderName(): AIProviderName;
     protected getDefaultModel(): string;
     /**

package/dist/providers/googleVertex.js

@@ -96,9 +96,9 @@ const hasGoogleCredentials = () => {
 // Module-level cache for runtime-created credentials file to avoid per-request writes
 let cachedCredentialsPath = null;
 // Enhanced Vertex settings creation with authentication fallback and proxy support
-const createVertexSettings = async (region) => {
-    const location = region || getVertexLocation();
-    const project = getVertexProjectId();
+const createVertexSettings = async (region, credentials) => {
+    const location = credentials?.location || region || getVertexLocation();
+    const project = credentials?.projectId || getVertexProjectId();
     const baseSettings = {
         project,
         location,
@@ -115,6 +115,35 @@ const createVertexSettings = async (region) => {
             project,
         });
     }
+    // ── Per-request credentials (highest priority, never touches module-level cache) ──
+    if (credentials) {
+        // Express Mode: API key auth (Vertex Express)
+        if (credentials.apiKey) {
+            return { ...baseSettings, apiKey: credentials.apiKey };
+        }
+        // Resolve client_email / private_key from inline fields or serviceAccountKey JSON
+        const resolvedClientEmail = credentials.clientEmail ||
+            (credentials.serviceAccountKey
+                ? JSON.parse(credentials.serviceAccountKey)
+                    .client_email
+                : undefined);
+        const resolvedPrivateKey = credentials.privateKey ||
+            (credentials.serviceAccountKey
+                ? JSON.parse(credentials.serviceAccountKey)
+                    .private_key
+                : undefined);
+        if (resolvedClientEmail && resolvedPrivateKey) {
+            return {
+                ...baseSettings,
+                googleAuthOptions: {
+                    credentials: {
+                        client_email: resolvedClientEmail,
+                        private_key: resolvedPrivateKey.replace(/\\n/g, "\n"),
+                    },
+                },
+            };
+        }
+    }
     // 🎯 OPTION 2: Create credentials file from environment variables at runtime
     // This solves the problem where GOOGLE_APPLICATION_CREDENTIALS exists in ZSHRC locally
     // but the file doesn't exist on production servers
@@ -290,20 +319,21 @@ const createVertexSettings = async (region) => {
     return baseSettings;
 };
 // Create Anthropic-specific Vertex settings with the same authentication and proxy support
-const createVertexAnthropicSettings = async (region) => {
+const createVertexAnthropicSettings = async (region, credentials) => {
     // The @ai-sdk/google-vertex SDK constructs Anthropic URLs as:
     //   https://{location}-aiplatform.googleapis.com/...
     // When location is "global", this creates "https://global-aiplatform.googleapis.com"
     // which is invalid. The correct global endpoint omits the region prefix entirely.
     // Since the SDK doesn't handle this, redirect "global" to "us-east5" for Anthropic.
     const anthropicRegion = !region || region === "global" ? "us-east5" : region;
-    const baseVertexSettings = await createVertexSettings(anthropicRegion);
+    const baseVertexSettings = await createVertexSettings(anthropicRegion, credentials);
     // GoogleVertexAnthropicProviderSettings extends GoogleVertexProviderSettings
     // so we can use the same settings with proper typing
     return {
         project: baseVertexSettings.project,
         location: baseVertexSettings.location,
         fetch: baseVertexSettings.fetch,
+        ...(baseVertexSettings.apiKey && { apiKey: baseVertexSettings.apiKey }),
         ...(baseVertexSettings.googleAuthOptions && {
             googleAuthOptions: baseVertexSettings.googleAuthOptions,
         }),
@@ -397,6 +427,7 @@ export class GoogleVertexProvider extends BaseProvider {
     location;
     registeredTools = new Map();
     toolContext = {};
+    credentials;
     // Memory-managed cache for model configuration lookups to avoid repeated calls
     // Uses WeakMap for automatic cleanup and bounded LRU for recently used models
     static modelConfigCache = new Map();
@@ -406,15 +437,17 @@ export class GoogleVertexProvider extends BaseProvider {
     // Memory-managed cache for maxTokens handling decisions to optimize streaming performance
     static maxTokensCache = new Map();
     static maxTokensCacheTime = 0;
-    constructor(modelName, _providerName, sdk, region) {
+    constructor(modelName, _providerName, sdk, region, credentials) {
         super(modelName, "vertex", sdk);
+        this.credentials = credentials;
         // Validate Google Cloud credentials - now using consolidated utility
-        if (!hasGoogleCredentials()) {
+        // Skip env-var validation when per-request credentials are provided
+        if (!credentials && !hasGoogleCredentials()) {
             validateApiKey(createGoogleAuthConfig());
         }
         // Initialize Google Cloud configuration
-        this.projectId = getVertexProjectId();
-        this.location = region || getVertexLocation();
+        this.projectId = credentials?.projectId || getVertexProjectId();
+        this.location = credentials?.location || region || getVertexLocation();
         logger.debug("[GoogleVertexProvider] Constructor initialized", {
             regionParam: region,
             resolvedLocation: this.location,
@@ -549,7 +582,7 @@ export class GoogleVertexProvider extends BaseProvider {
             message: "Starting Vertex settings creation with network configuration analysis",
         });
         try {
-            const vertexSettings = await createVertexSettings(this.location);
+            const vertexSettings = await createVertexSettings(this.location, this.credentials);
             const vertexSettingsEndTime = process.hrtime.bigint();
             const vertexSettingsDurationNs = vertexSettingsEndTime - vertexSettingsStartTime;
             logger.debug(`[GoogleVertexProvider] ✅ LOG_POINT_V009_VERTEX_SETTINGS_SUCCESS`, {
@@ -1084,8 +1117,11 @@ export class GoogleVertexProvider extends BaseProvider {
      * Create @google/genai client configured for Vertex AI
      */
     async createVertexGenAIClient(regionOverride) {
-        const project = getVertexProjectId();
-        const location = regionOverride || this.location || getVertexLocation();
+        const project = this.credentials?.projectId || getVertexProjectId();
+        const location = this.credentials?.location ||
+            regionOverride ||
+            this.location ||
+            getVertexLocation();
         const mod = await import("@google/genai");
         const ctor = mod.GoogleGenAI;
         if (!ctor) {
@@ -1099,7 +1135,42 @@ export class GoogleVertexProvider extends BaseProvider {
             });
         }
         const Ctor = ctor;
-        // Use vertexai mode with project and location
+        // Per-request credentials: Express Mode (API key)
+        if (this.credentials?.apiKey) {
+            // Cast via unknown because GoogleGenAIClass union doesn't include apiKey+vertexai
+            return new Ctor({
+                vertexai: true,
+                project,
+                location,
+                apiKey: this.credentials.apiKey,
+            });
+        }
+        // Per-request credentials: inline service account
+        if (this.credentials?.clientEmail || this.credentials?.serviceAccountKey) {
+            const clientEmail = this.credentials.clientEmail ||
+                (this.credentials.serviceAccountKey
+                    ? JSON.parse(this.credentials.serviceAccountKey).client_email
+                    : undefined);
+            const privateKey = this.credentials.privateKey ||
+                (this.credentials.serviceAccountKey
+                    ? JSON.parse(this.credentials.serviceAccountKey).private_key
+                    : undefined);
+            if (clientEmail && privateKey) {
+                // Cast via unknown because GoogleGenAIClass union doesn't include googleAuthOptions
+                return new Ctor({
+                    vertexai: true,
+                    project,
+                    location,
+                    googleAuthOptions: {
+                        credentials: {
+                            client_email: clientEmail,
+                            private_key: privateKey.replace(/\\n/g, "\n"),
+                        },
+                    },
+                });
+            }
+        }
+        // Fallback: env-var / ADC auth
         return new Ctor({
             vertexai: true,
             project,
@@ -1849,7 +1920,15 @@ export class GoogleVertexProvider extends BaseProvider {
             return null;
         }
         // 2. Authentication Validation
-        const authValidation = await this.validateVertexAuthentication();
+        // Per-request credentials bypass env-var auth checks entirely
+        const hasPerRequestAuth = this.credentials &&
+            (this.credentials.apiKey ||
+                this.credentials.clientEmail ||
+                this.credentials.privateKey ||
+                this.credentials.serviceAccountKey);
+        const authValidation = hasPerRequestAuth
+            ? { isValid: true, method: "per_request_credentials", issues: [] }
+            : await this.validateVertexAuthentication();
         if (!authValidation.isValid) {
             logger.error("[GoogleVertexProvider] ❌ Authentication validation failed", {
                 validationId,
@@ -1927,7 +2006,7 @@ export class GoogleVertexProvider extends BaseProvider {
                 projectId: projectValidation.projectId,
                 region: projectValidation.region,
             });
-            const vertexAnthropicSettings = await createVertexAnthropicSettings(this.location);
+            const vertexAnthropicSettings = await createVertexAnthropicSettings(this.location, this.credentials);
             // 7. Settings Validation
             if (!vertexAnthropicSettings.project ||
                 !vertexAnthropicSettings.location) {
@@ -2844,7 +2923,7 @@ export class GoogleVertexProvider extends BaseProvider {
         });
         try {
             // Create the Vertex provider with current settings
-            const vertexSettings = await createVertexSettings(this.location);
+            const vertexSettings = await createVertexSettings(this.location, this.credentials);
             const vertex = createVertex(vertexSettings);
             // Get the text embedding model
             const embeddingModel = vertex.textEmbeddingModel(embeddingModelName);
@@ -2883,7 +2962,7 @@ export class GoogleVertexProvider extends BaseProvider {
             count: texts.length,
         });
         try {
-            const vertexSettings = await createVertexSettings(this.location);
+            const vertexSettings = await createVertexSettings(this.location, this.credentials);
             const vertex = createVertex(vertexSettings);
             const embeddingModel = vertex.textEmbeddingModel(embeddingModelName);
             const result = await embedMany({

package/dist/providers/huggingFace.d.ts

@@ -2,6 +2,7 @@ import { type LanguageModel, type Schema } from "ai";
 import type { ZodType } from "zod";
 import type { AIProviderName } from "../constants/enums.js";
 import { BaseProvider } from "../core/baseProvider.js";
+import type { NeurolinkCredentials } from "../types/providers.js";
 import type { StreamOptions, StreamResult } from "../types/streamTypes.js";
 /**
  * HuggingFace Provider - BaseProvider Implementation
@@ -9,7 +10,7 @@ import type { StreamOptions, StreamResult } from "../types/streamTypes.js";
  */
 export declare class HuggingFaceProvider extends BaseProvider {
     private model;
-    constructor(modelName?: string);
+    constructor(modelName?: string, _sdk?: unknown, credentials?: NeurolinkCredentials["huggingFace"]);
     /**
      * HuggingFace Tool Calling Support (Enhanced 2025)
      *