@juspay/neurolink 9.60.1 → 9.61.0

package/dist/core/constants.js

@@ -17,10 +17,21 @@ export const PDF_IMAGE_GENERATION_MODELS = [
 ];
 // Global Location Models
 // Models that require global location configuration (uses aiplatform.googleapis.com instead of region-specific endpoints)
+// Includes Gemini 3.x text and image models, which are only available via the global endpoint on Vertex AI.
+// IMAGE_GENERATION_MODELS is spread in to keep the two lists from drifting:
+// any new image-gen model added there is automatically routed to global here.
 export const GLOBAL_LOCATION_MODELS = [
-    "gemini-3-pro-image-preview",
-    "gemini-2.5-flash-image",
-    "gemini-3.1-flash-image-preview",
+    // Image generation (sourced from IMAGE_GENERATION_MODELS)
+    ...IMAGE_GENERATION_MODELS,
+    // Gemini 3.1 text models (global-only)
+    "gemini-3.1-pro-preview",
+    "gemini-3.1-flash-lite-preview",
+    "gemini-3.1-pro-preview-customtools",
+    // Gemini 3 text models (global-only)
+    "gemini-3-pro-preview",
+    "gemini-3-pro-preview-11-2025",
+    "gemini-3-pro-latest",
+    "gemini-3-flash-preview",
 ];
 // Core AI Generation Defaults
 export const DEFAULT_MAX_TOKENS = undefined; // Unlimited by default - let providers decide their own limits

package/dist/lib/core/constants.js

@@ -17,10 +17,21 @@ export const PDF_IMAGE_GENERATION_MODELS = [
 ];
 // Global Location Models
 // Models that require global location configuration (uses aiplatform.googleapis.com instead of region-specific endpoints)
+// Includes Gemini 3.x text and image models, which are only available via the global endpoint on Vertex AI.
+// IMAGE_GENERATION_MODELS is spread in to keep the two lists from drifting:
+// any new image-gen model added there is automatically routed to global here.
 export const GLOBAL_LOCATION_MODELS = [
-    "gemini-3-pro-image-preview",
-    "gemini-2.5-flash-image",
-    "gemini-3.1-flash-image-preview",
+    // Image generation (sourced from IMAGE_GENERATION_MODELS)
+    ...IMAGE_GENERATION_MODELS,
+    // Gemini 3.1 text models (global-only)
+    "gemini-3.1-pro-preview",
+    "gemini-3.1-flash-lite-preview",
+    "gemini-3.1-pro-preview-customtools",
+    // Gemini 3 text models (global-only)
+    "gemini-3-pro-preview",
+    "gemini-3-pro-preview-11-2025",
+    "gemini-3-pro-latest",
+    "gemini-3-flash-preview",
 ];
 // Core AI Generation Defaults
 export const DEFAULT_MAX_TOKENS = undefined; // Unlimited by default - let providers decide their own limits

package/dist/lib/mcp/auth/oauthClientProvider.js

@@ -5,6 +5,9 @@
 import { randomBytes, createHash } from "crypto";
 import { InMemoryTokenStorage, isTokenExpired, calculateExpiresAt, } from "./tokenStorage.js";
 import { logger } from "../../utils/logger.js";
+import { withTimeout } from "../../utils/errorHandling.js";
+/** Default timeout for OAuth token operations (30 seconds) */
+const OAUTH_TOKEN_TIMEOUT_MS = 30000;
 /**
  * NeuroLink OAuth Provider for MCP HTTP Transport
  * Handles OAuth 2.1 authentication flow with optional PKCE support
@@ -147,15 +150,15 @@ export class NeuroLinkOAuthProvider {
         if (codeVerifier) {
             body.set("code_verifier", codeVerifier);
         }
-        // Request tokens
-        const response = await fetch(this.config.tokenUrl, {
+        // Request tokens with timeout protection
+        const response = await withTimeout(fetch(this.config.tokenUrl, {
             method: "POST",
             headers: {
                 "Content-Type": "application/x-www-form-urlencoded",
                 Accept: "application/json",
             },
             body: body.toString(),
-        });
+        }), OAUTH_TOKEN_TIMEOUT_MS, new Error(`OAuth token exchange timed out after ${OAUTH_TOKEN_TIMEOUT_MS}ms`));
         if (!response.ok) {
             const errorText = await response.text();
             throw new Error(`Token exchange failed: ${response.status} ${response.statusText} - ${errorText}`);
@@ -186,14 +189,15 @@ export class NeuroLinkOAuthProvider {
         if (this.config.clientSecret) {
             body.set("client_secret", this.config.clientSecret);
         }
-        const response = await fetch(this.config.tokenUrl, {
+        // Refresh tokens with timeout protection
+        const response = await withTimeout(fetch(this.config.tokenUrl, {
             method: "POST",
             headers: {
                 "Content-Type": "application/x-www-form-urlencoded",
                 Accept: "application/json",
             },
             body: body.toString(),
-        });
+        }), OAUTH_TOKEN_TIMEOUT_MS, new Error(`OAuth token refresh timed out after ${OAUTH_TOKEN_TIMEOUT_MS}ms`));
         if (!response.ok) {
             const errorText = await response.text();
             throw new Error(`Token refresh failed: ${response.status} ${response.statusText} - ${errorText}`);
@@ -227,13 +231,14 @@ export class NeuroLinkOAuthProvider {
             body.set("client_secret", this.config.clientSecret);
         }
         try {
-            await fetch(revocationUrl, {
+            // Revoke tokens with timeout protection
+            await withTimeout(fetch(revocationUrl, {
                 method: "POST",
                 headers: {
                     "Content-Type": "application/x-www-form-urlencoded",
                 },
                 body: body.toString(),
-            });
+            }), OAUTH_TOKEN_TIMEOUT_MS, new Error(`OAuth token revocation timed out after ${OAUTH_TOKEN_TIMEOUT_MS}ms`));
         }
         catch (error) {
             logger.warn(`[NeuroLinkOAuthProvider] Token revocation failed: ${error instanceof Error ? error.message : String(error)}`);

package/dist/lib/utils/tokenLimits.js

@@ -2,12 +2,54 @@
  * Provider-specific token limit utilities
  * Provides safe maxTokens values based on provider and model capabilities
  */
-import { PROVIDER_MAX_TOKENS } from "../core/constants.js";
+import { PROVIDER_MAX_TOKENS, IMAGE_GENERATION_MODELS, } from "../core/constants.js";
 import { logger } from "./logger.js";
+// Gemini 3 models and Gemini 2.5 image models have a hard limit of 32768 output tokens
+const GEMINI_RESTRICTED_MAX_OUTPUT_TOKENS = 32768;
+/**
+ * Check if a model has the restricted 32768 output token limit
+ * This applies to:
+ * - All Gemini 3 models (gemini-3-flash, gemini-3-pro, etc.)
+ * - All Gemini 2.5 image generation models (gemini-2.5-flash-image)
+ */
+function hasRestrictedOutputLimit(model) {
+    if (!model) {
+        return false;
+    }
+    // Check for Gemini 3 models
+    if (model.includes("gemini-3")) {
+        return true;
+    }
+    // Check for image generation models (includes gemini-2.5-flash-image)
+    if (IMAGE_GENERATION_MODELS.some((m) => model.includes(m))) {
+        return true;
+    }
+    return false;
+}
 /**
  * Get the safe maximum tokens for a provider and model
  */
 export function getSafeMaxTokens(provider, model, requestedMaxTokens) {
+    // CRITICAL: Gemini 3 models AND image generation models have a hard limit of 32768 output tokens
+    // This check must happen FIRST, before any other logic, because these models
+    // will reject requests with maxOutputTokens > 32768
+    const isRestrictedModel = hasRestrictedOutputLimit(model);
+    if (isRestrictedModel) {
+        // Explicit undefined/null check so a caller-supplied 0 is preserved
+        // (truthy checks would treat 0 as "unset" and silently fall back to the cap).
+        if (requestedMaxTokens !== undefined &&
+            requestedMaxTokens !== null &&
+            requestedMaxTokens > GEMINI_RESTRICTED_MAX_OUTPUT_TOKENS) {
+            logger.warn(`Requested maxTokens ${requestedMaxTokens} exceeds ${model} limit of ${GEMINI_RESTRICTED_MAX_OUTPUT_TOKENS}. Using ${GEMINI_RESTRICTED_MAX_OUTPUT_TOKENS} instead.`);
+            return GEMINI_RESTRICTED_MAX_OUTPUT_TOKENS;
+        }
+        // If no maxTokens specified, use the restricted limit as default
+        if (requestedMaxTokens === undefined || requestedMaxTokens === null) {
+            return GEMINI_RESTRICTED_MAX_OUTPUT_TOKENS;
+        }
+        // Otherwise, use the requested value (it's within limits, including 0)
+        return requestedMaxTokens;
+    }
     // Get provider-specific limits
     const providerLimits = PROVIDER_MAX_TOKENS[provider];
     if (!providerLimits) {

package/dist/mcp/auth/oauthClientProvider.js

@@ -5,6 +5,9 @@
 import { randomBytes, createHash } from "crypto";
 import { InMemoryTokenStorage, isTokenExpired, calculateExpiresAt, } from "./tokenStorage.js";
 import { logger } from "../../utils/logger.js";
+import { withTimeout } from "../../utils/errorHandling.js";
+/** Default timeout for OAuth token operations (30 seconds) */
+const OAUTH_TOKEN_TIMEOUT_MS = 30000;
 /**
  * NeuroLink OAuth Provider for MCP HTTP Transport
  * Handles OAuth 2.1 authentication flow with optional PKCE support
@@ -147,15 +150,15 @@ export class NeuroLinkOAuthProvider {
         if (codeVerifier) {
             body.set("code_verifier", codeVerifier);
         }
-        // Request tokens
-        const response = await fetch(this.config.tokenUrl, {
+        // Request tokens with timeout protection
+        const response = await withTimeout(fetch(this.config.tokenUrl, {
             method: "POST",
             headers: {
                 "Content-Type": "application/x-www-form-urlencoded",
                 Accept: "application/json",
             },
             body: body.toString(),
-        });
+        }), OAUTH_TOKEN_TIMEOUT_MS, new Error(`OAuth token exchange timed out after ${OAUTH_TOKEN_TIMEOUT_MS}ms`));
         if (!response.ok) {
             const errorText = await response.text();
             throw new Error(`Token exchange failed: ${response.status} ${response.statusText} - ${errorText}`);
@@ -186,14 +189,15 @@ export class NeuroLinkOAuthProvider {
         if (this.config.clientSecret) {
             body.set("client_secret", this.config.clientSecret);
         }
-        const response = await fetch(this.config.tokenUrl, {
+        // Refresh tokens with timeout protection
+        const response = await withTimeout(fetch(this.config.tokenUrl, {
             method: "POST",
             headers: {
                 "Content-Type": "application/x-www-form-urlencoded",
                 Accept: "application/json",
             },
             body: body.toString(),
-        });
+        }), OAUTH_TOKEN_TIMEOUT_MS, new Error(`OAuth token refresh timed out after ${OAUTH_TOKEN_TIMEOUT_MS}ms`));
         if (!response.ok) {
             const errorText = await response.text();
             throw new Error(`Token refresh failed: ${response.status} ${response.statusText} - ${errorText}`);
@@ -227,13 +231,14 @@ export class NeuroLinkOAuthProvider {
             body.set("client_secret", this.config.clientSecret);
         }
         try {
-            await fetch(revocationUrl, {
+            // Revoke tokens with timeout protection
+            await withTimeout(fetch(revocationUrl, {
                 method: "POST",
                 headers: {
                     "Content-Type": "application/x-www-form-urlencoded",
                 },
                 body: body.toString(),
-            });
+            }), OAUTH_TOKEN_TIMEOUT_MS, new Error(`OAuth token revocation timed out after ${OAUTH_TOKEN_TIMEOUT_MS}ms`));
         }
         catch (error) {
             logger.warn(`[NeuroLinkOAuthProvider] Token revocation failed: ${error instanceof Error ? error.message : String(error)}`);

package/dist/utils/tokenLimits.js

@@ -2,12 +2,54 @@
  * Provider-specific token limit utilities
  * Provides safe maxTokens values based on provider and model capabilities
  */
-import { PROVIDER_MAX_TOKENS } from "../core/constants.js";
+import { PROVIDER_MAX_TOKENS, IMAGE_GENERATION_MODELS, } from "../core/constants.js";
 import { logger } from "./logger.js";
+// Gemini 3 models and Gemini 2.5 image models have a hard limit of 32768 output tokens
+const GEMINI_RESTRICTED_MAX_OUTPUT_TOKENS = 32768;
+/**
+ * Check if a model has the restricted 32768 output token limit
+ * This applies to:
+ * - All Gemini 3 models (gemini-3-flash, gemini-3-pro, etc.)
+ * - All Gemini 2.5 image generation models (gemini-2.5-flash-image)
+ */
+function hasRestrictedOutputLimit(model) {
+    if (!model) {
+        return false;
+    }
+    // Check for Gemini 3 models
+    if (model.includes("gemini-3")) {
+        return true;
+    }
+    // Check for image generation models (includes gemini-2.5-flash-image)
+    if (IMAGE_GENERATION_MODELS.some((m) => model.includes(m))) {
+        return true;
+    }
+    return false;
+}
 /**
  * Get the safe maximum tokens for a provider and model
  */
 export function getSafeMaxTokens(provider, model, requestedMaxTokens) {
+    // CRITICAL: Gemini 3 models AND image generation models have a hard limit of 32768 output tokens
+    // This check must happen FIRST, before any other logic, because these models
+    // will reject requests with maxOutputTokens > 32768
+    const isRestrictedModel = hasRestrictedOutputLimit(model);
+    if (isRestrictedModel) {
+        // Explicit undefined/null check so a caller-supplied 0 is preserved
+        // (truthy checks would treat 0 as "unset" and silently fall back to the cap).
+        if (requestedMaxTokens !== undefined &&
+            requestedMaxTokens !== null &&
+            requestedMaxTokens > GEMINI_RESTRICTED_MAX_OUTPUT_TOKENS) {
+            logger.warn(`Requested maxTokens ${requestedMaxTokens} exceeds ${model} limit of ${GEMINI_RESTRICTED_MAX_OUTPUT_TOKENS}. Using ${GEMINI_RESTRICTED_MAX_OUTPUT_TOKENS} instead.`);
+            return GEMINI_RESTRICTED_MAX_OUTPUT_TOKENS;
+        }
+        // If no maxTokens specified, use the restricted limit as default
+        if (requestedMaxTokens === undefined || requestedMaxTokens === null) {
+            return GEMINI_RESTRICTED_MAX_OUTPUT_TOKENS;
+        }
+        // Otherwise, use the requested value (it's within limits, including 0)
+        return requestedMaxTokens;
+    }
     // Get provider-specific limits
     const providerLimits = PROVIDER_MAX_TOKENS[provider];
     if (!providerLimits) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@juspay/neurolink",
-  "version": "9.60.1",
+  "version": "9.61.0",
   "packageManager": "pnpm@10.15.1",
   "description": "Universal AI Development Platform with working MCP integration, multi-provider support, and professional CLI. Built-in tools operational, 58+ external MCP servers discoverable. Connect to filesystem, GitHub, database operations, and more. Build, test, and deploy AI applications with 13 providers: OpenAI, Anthropic, Google AI, AWS Bedrock, Azure, Hugging Face, Ollama, and Mistral AI.",
   "author": {