@juspay/neurolink 9.86.3 → 9.86.5

package/dist/core/modules/GenerationHandler.js

@@ -566,6 +566,14 @@ export class GenerationHandler {
             }
             try {
                 const scalar = JSON.parse(strippedText);
+                if (scalar === "") {
+                    // A JSON-encoded empty string is an EMPTY completion, not a
+                    // recovered scalar — normalize to a true empty ('' content, no
+                    // structuredData) so callers' empty-response handling fires
+                    // instead of a literal '""' reaching the user.
+                    logger.warn("[GenerationHandler] schema requested but the model returned an empty JSON string; normalizing to empty content", { provider: this.providerName, model: this.modelName });
+                    return "";
+                }
                 if (scalar !== null && scalar !== undefined) {
                     structuredData = scalar;
                     return strippedText;
@@ -580,7 +588,17 @@ export class GenerationHandler {
         if (useStructuredOutput) {
             try {
                 const experimentalOutput = generateResult.experimental_output;
-                if (experimentalOutput !== undefined) {
+                // ai@6 generateText resolves `output ?? text()` internally, so a
+                // result produced WITHOUT an output spec — the structured-output
+                // fallback retry, or the tools↔schema exclusion path — no longer
+                // throws here: `experimental_output` echoes the RAW MODEL TEXT.
+                // Treating that echo as parsed schema output double-encodes the
+                // content (JSON.stringify of a string) and, for an empty
+                // completion, turns '' into the literal '""'. Detect the echo
+                // (a string identical to the step text) and coerce it instead.
+                const rawTextEcho = typeof experimentalOutput === "string" &&
+                    experimentalOutput === (generateResult.text ?? "");
+                if (experimentalOutput !== undefined && !rawTextEcho) {
                     // AI-SDK already parsed + schema-validated the object. Expose it
                     // directly and serialise canonically — no hand-parsing needed.
                     structuredData = experimentalOutput;

package/dist/lib/auth/tokenStore.d.ts

@@ -171,6 +171,10 @@ export declare class TokenStore {
      * round-trips. The state survives proxy restarts because it is stored
      * alongside the tokens in the JSON file.
      *
+     * This operation and saveTokens() share the instance mutex. A concurrent
+     * save cannot erase a disable: a later disable wins, while a later save
+     * preserves the existing disabled metadata.
+     *
      * @param provider - The provider key (e.g., "anthropic:user@example.com")
      * @param reason - Optional human-readable reason (e.g., "refresh_failed")
      */
@@ -194,6 +198,8 @@ export declare class TokenStore {
      * @returns true if the provider entry exists and is disabled
      */
     isDisabled(provider: string): Promise<boolean>;
+    /** Return the persisted disable reason, if the provider is disabled. */
+    getDisabledReason(provider: string): Promise<string | undefined>;
     /**
      * Lists all provider keys that are currently disabled.
      *

package/dist/lib/auth/tokenStore.js

@@ -146,13 +146,23 @@ export class TokenStore {
                 throw error;
             }
         }
-        // Update provider tokens
+        const existingProvider = storageData.providers[provider];
+        const now = Date.now();
+        // Token rotation must not silently clear an operator-disabled account.
+        // Explicit login calls markEnabled() after saving fresh credentials.
         storageData.providers[provider] = {
             tokens,
-            createdAt: Date.now(),
-            lastAccessed: Date.now(),
+            createdAt: existingProvider?.createdAt ?? now,
+            lastAccessed: now,
+            ...(existingProvider?.disabled === true
+                ? {
+                    disabled: true,
+                    disabledAt: existingProvider.disabledAt,
+                    disabledReason: existingProvider.disabledReason,
+                }
+                : {}),
         };
-        storageData.lastModified = Date.now();
+        storageData.lastModified = now;
         try {
             const content = this.encryptionEnabled
                 ? this.obfuscate(JSON.stringify(storageData))
@@ -489,6 +499,10 @@ export class TokenStore {
      * round-trips. The state survives proxy restarts because it is stored
      * alongside the tokens in the JSON file.
      *
+     * This operation and saveTokens() share the instance mutex. A concurrent
+     * save cannot erase a disable: a later disable wins, while a later save
+     * preserves the existing disabled metadata.
+     *
      * @param provider - The provider key (e.g., "anthropic:user@example.com")
      * @param reason - Optional human-readable reason (e.g., "refresh_failed")
      */
@@ -587,6 +601,24 @@ export class TokenStore {
             }
         });
     }
+    /** Return the persisted disable reason, if the provider is disabled. */
+    async getDisabledReason(provider) {
+        return this._mutex.runExclusive(async () => {
+            try {
+                const storageData = await this.loadStorageData();
+                const providerData = storageData.providers[provider];
+                return providerData?.disabled === true
+                    ? providerData.disabledReason
+                    : undefined;
+            }
+            catch (error) {
+                if (error instanceof TokenStoreError && error.code === "NOT_FOUND") {
+                    return undefined;
+                }
+                throw error;
+            }
+        });
+    }
     /**
      * Lists all provider keys that are currently disabled.
      *

package/dist/lib/core/modules/GenerationHandler.js

@@ -566,6 +566,14 @@ export class GenerationHandler {
             }
             try {
                 const scalar = JSON.parse(strippedText);
+                if (scalar === "") {
+                    // A JSON-encoded empty string is an EMPTY completion, not a
+                    // recovered scalar — normalize to a true empty ('' content, no
+                    // structuredData) so callers' empty-response handling fires
+                    // instead of a literal '""' reaching the user.
+                    logger.warn("[GenerationHandler] schema requested but the model returned an empty JSON string; normalizing to empty content", { provider: this.providerName, model: this.modelName });
+                    return "";
+                }
                 if (scalar !== null && scalar !== undefined) {
                     structuredData = scalar;
                     return strippedText;
@@ -580,7 +588,17 @@ export class GenerationHandler {
         if (useStructuredOutput) {
             try {
                 const experimentalOutput = generateResult.experimental_output;
-                if (experimentalOutput !== undefined) {
+                // ai@6 generateText resolves `output ?? text()` internally, so a
+                // result produced WITHOUT an output spec — the structured-output
+                // fallback retry, or the tools↔schema exclusion path — no longer
+                // throws here: `experimental_output` echoes the RAW MODEL TEXT.
+                // Treating that echo as parsed schema output double-encodes the
+                // content (JSON.stringify of a string) and, for an empty
+                // completion, turns '' into the literal '""'. Detect the echo
+                // (a string identical to the step text) and coerce it instead.
+                const rawTextEcho = typeof experimentalOutput === "string" &&
+                    experimentalOutput === (generateResult.text ?? "");
+                if (experimentalOutput !== undefined && !rawTextEcho) {
                     // AI-SDK already parsed + schema-validated the object. Expose it
                     // directly and serialise canonically — no hand-parsing needed.
                     structuredData = experimentalOutput;

package/dist/lib/neurolink.js

@@ -3858,7 +3858,15 @@ Current user's request: ${currentInput}`;
             else {
                 try {
                     const scalar = JSON.parse(textResult.content);
-                    if (scalar !== null && scalar !== undefined) {
+                    if (scalar === "") {
+                        // A JSON-encoded empty string is an EMPTY completion, not a
+                        // recovered scalar — normalize to a true empty so callers'
+                        // empty-response handling fires instead of a literal '""'
+                        // reaching the user. `structuredData` stays undefined.
+                        textResult.content = "";
+                        logger.warn("[NeuroLink] schema requested but the model returned an empty JSON string; normalizing to empty content", { provider: textResult.provider, model: textResult.model });
+                    }
+                    else if (scalar !== null && scalar !== undefined) {
                         textResult.structuredData = scalar;
                     }
                 }

package/dist/lib/proxy/accountCooldown.d.ts

@@ -0,0 +1,5 @@
+import type { AccountCoolingReason, PersistedAccountCooldown } from "../types/index.js";
+export declare function initAccountCooldown(cooldownFilePath: string): void;
+export declare function loadAccountCooldowns(): Promise<Record<string, PersistedAccountCooldown>>;
+export declare function saveAccountCooldown(accountKey: string, coolingUntil: number, reason: AccountCoolingReason): Promise<void>;
+export declare function clearAccountCooldown(accountKey: string, expectedCoolingUntil?: number): Promise<void>;

package/dist/lib/proxy/accountCooldown.js

@@ -0,0 +1,93 @@
+import { readFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { AsyncMutex } from "../utils/asyncMutex.js";
+import { writeJsonSnapshotAtomically } from "./snapshotPersistence.js";
+const COOLDOWN_FILE = "account-cooldowns.json";
+const VALID_REASONS = new Set([
+    "weekly",
+    "session",
+    "unified",
+    "transient",
+    "auth",
+]);
+let customCooldownFilePath = null;
+let cacheLoaded = false;
+let cacheLoadPromise = null;
+let memoryCache = {};
+const mutationMutex = new AsyncMutex();
+export function initAccountCooldown(cooldownFilePath) {
+    customCooldownFilePath = cooldownFilePath;
+    cacheLoaded = false;
+    cacheLoadPromise = null;
+    memoryCache = {};
+}
+function getCooldownFilePath() {
+    return customCooldownFilePath ?? join(homedir(), ".neurolink", COOLDOWN_FILE);
+}
+function isPersistedCooldown(value) {
+    if (!value || typeof value !== "object") {
+        return false;
+    }
+    const candidate = value;
+    return (typeof candidate.coolingUntil === "number" &&
+        Number.isFinite(candidate.coolingUntil) &&
+        typeof candidate.updatedAt === "number" &&
+        Number.isFinite(candidate.updatedAt) &&
+        typeof candidate.reason === "string" &&
+        VALID_REASONS.has(candidate.reason));
+}
+async function ensureAccountCooldownsLoaded() {
+    if (!cacheLoaded) {
+        if (!cacheLoadPromise) {
+            cacheLoadPromise = (async () => {
+                try {
+                    const parsed = JSON.parse(await readFile(getCooldownFilePath(), "utf8"));
+                    memoryCache = Object.fromEntries(Object.entries(parsed).filter((entry) => isPersistedCooldown(entry[1])));
+                }
+                catch {
+                    memoryCache = {};
+                }
+                cacheLoaded = true;
+            })().finally(() => {
+                cacheLoadPromise = null;
+            });
+        }
+        await cacheLoadPromise;
+    }
+}
+export async function loadAccountCooldowns() {
+    await ensureAccountCooldownsLoaded();
+    return mutationMutex.runExclusive(async () => ({ ...memoryCache }));
+}
+export async function saveAccountCooldown(accountKey, coolingUntil, reason) {
+    await mutationMutex.runExclusive(async () => {
+        await ensureAccountCooldownsLoaded();
+        const current = memoryCache[accountKey];
+        if (current && current.coolingUntil > coolingUntil) {
+            return;
+        }
+        memoryCache[accountKey] = {
+            coolingUntil,
+            reason,
+            updatedAt: Date.now(),
+        };
+        await writeJsonSnapshotAtomically(getCooldownFilePath(), memoryCache);
+    });
+}
+export async function clearAccountCooldown(accountKey, expectedCoolingUntil) {
+    await mutationMutex.runExclusive(async () => {
+        await ensureAccountCooldownsLoaded();
+        const current = memoryCache[accountKey];
+        if (!current) {
+            return;
+        }
+        if (expectedCoolingUntil !== undefined &&
+            current.coolingUntil !== expectedCoolingUntil) {
+            return;
+        }
+        delete memoryCache[accountKey];
+        await writeJsonSnapshotAtomically(getCooldownFilePath(), memoryCache);
+    });
+}
+//# sourceMappingURL=accountCooldown.js.map

package/dist/lib/proxy/accountQuota.d.ts

@@ -10,6 +10,8 @@
  * path is never blocked by file I/O.
  */
 import type { AccountQuota } from "../types/index.js";
+/** Read and normalize Anthropic's authoritative top-level unified status. */
+export declare function getUnifiedRateLimitStatus(headers: Headers | Record<string, string>): string | undefined;
 /**
  * Parse Anthropic rate-limit / quota headers into an `AccountQuota`.
  * Returns `null` when key headers are absent.
@@ -22,10 +24,6 @@ export declare function parseQuotaHeaders(headers: Headers | Record<string, stri
  * ~/.neurolink/account-quotas.json. Call before the first load/save.
  */
 export declare function initAccountQuota(quotaFilePath: string): void;
-/**
- * Load all persisted account quotas.
- * First call reads from disk; subsequent calls return the in-memory cache.
- */
 export declare function loadAccountQuotas(): Promise<Record<string, AccountQuota>>;
 /**
  * Load quota for a single account.
@@ -42,3 +40,4 @@ export declare function loadAccountQuota(accountKey: string): Promise<AccountQuo
  * other accounts' snapshots and blinded quota-aware routing to them).
  */
 export declare function saveAccountQuota(accountKey: string, quota: AccountQuota): Promise<void>;
+export declare function flushAccountQuotaStateForTests(): Promise<void>;

package/dist/lib/proxy/accountQuota.js

@@ -9,9 +9,11 @@
  * updates an in-memory cache and debounces disk writes so the request/response
  * path is never blocked by file I/O.
  */
-import { dirname, join } from "path";
+import { join } from "path";
 import { homedir } from "os";
 import { promises as fs } from "fs";
+import { AsyncMutex } from "../utils/asyncMutex.js";
+import { writeJsonSnapshotAtomically } from "./snapshotPersistence.js";
 // ---------------------------------------------------------------------------
 // Header parsing (pure CPU — no I/O, safe for hot path)
 // ---------------------------------------------------------------------------
@@ -31,6 +33,12 @@ function getHeader(headers, name) {
     }
     return undefined;
 }
+/** Read and normalize Anthropic's authoritative top-level unified status. */
+export function getUnifiedRateLimitStatus(headers) {
+    const value = getHeader(headers, "anthropic-ratelimit-unified-status");
+    const normalized = value?.trim().toLowerCase();
+    return normalized || undefined;
+}
 /**
  * Parse Anthropic rate-limit / quota headers into an `AccountQuota`.
  * Returns `null` when key headers are absent.
@@ -53,6 +61,7 @@ export function parseQuotaHeaders(headers) {
     const weeklyResetRaw = getHeader(headers, `${P}unified-7d-reset`);
     const fallbackRaw = getHeader(headers, `${P}unified-fallback-percentage`);
     return {
+        unifiedStatus: getUnifiedRateLimitStatus(headers),
         sessionUsed,
         sessionStatus: getHeader(headers, `${P}unified-5h-status`) ?? "unknown",
         sessionResetAt: sessionResetRaw ? parseInt(sessionResetRaw, 10) || 0 : 0,
@@ -71,8 +80,12 @@ const QUOTA_FILE = "account-quotas.json";
 const FLUSH_INTERVAL_MS = 5_000; // write to disk at most every 5 seconds
 let memoryCache = {};
 let cacheLoaded = false;
+let cacheLoadPromise = null;
 let dirty = false;
+let cacheVersion = 0;
 let flushTimer = null;
+const stateMutex = new AsyncMutex();
+const flushMutex = new AsyncMutex();
 /** Custom quota file path set via initAccountQuota(). */
 let customQuotaFilePath = null;
 /**
@@ -91,41 +104,42 @@ export function initAccountQuota(quotaFilePath) {
     // Reset cache so the new path is picked up on next load
     memoryCache = {};
     cacheLoaded = false;
+    cacheLoadPromise = null;
     dirty = false;
+    cacheVersion = 0;
 }
 function getQuotaFilePath() {
     return customQuotaFilePath ?? join(homedir(), ".neurolink", QUOTA_FILE);
 }
-async function ensureDir() {
-    const filePath = getQuotaFilePath();
-    const dir = dirname(filePath);
-    await fs.mkdir(dir, { recursive: true, mode: 0o700 }).catch(() => {
-        // Non-fatal: directory may already exist
-    });
-}
 /** Flush the in-memory cache to disk (async, non-blocking). */
 async function flushToDisk() {
-    if (!dirty) {
-        return;
-    }
-    try {
-        // Snapshot before async I/O so we only clear dirty if nothing changed
-        const snapshot = JSON.stringify(memoryCache, null, 2);
-        await ensureDir();
-        const filePath = getQuotaFilePath();
-        const tmpPath = `${filePath}.tmp`;
-        await fs.writeFile(tmpPath, snapshot, {
-            mode: 0o600,
+    await flushMutex.runExclusive(async () => {
+        let snapshot;
+        let snapshotVersion = 0;
+        let filePath = "";
+        await stateMutex.runExclusive(async () => {
+            if (!dirty) {
+                return;
+            }
+            snapshot = Object.fromEntries(Object.entries(memoryCache).map(([key, quota]) => [key, { ...quota }]));
+            snapshotVersion = cacheVersion;
+            filePath = getQuotaFilePath();
         });
-        await fs.rename(tmpPath, filePath);
-        // Only clear dirty if the cache hasn't changed during the write
-        if (JSON.stringify(memoryCache, null, 2) === snapshot) {
-            dirty = false;
+        if (!snapshot) {
+            return;
         }
-    }
-    catch {
-        // Non-fatal — quota is best-effort telemetry
-    }
+        try {
+            await writeJsonSnapshotAtomically(filePath, snapshot, 0o600);
+            await stateMutex.runExclusive(async () => {
+                if (cacheVersion === snapshotVersion) {
+                    dirty = false;
+                }
+            });
+        }
+        catch {
+            // Non-fatal — quota is best-effort telemetry
+        }
+    });
 }
 function scheduleFlush() {
     if (flushTimer) {
@@ -149,19 +163,28 @@ function scheduleFlush() {
  * Load all persisted account quotas.
  * First call reads from disk; subsequent calls return the in-memory cache.
  */
-export async function loadAccountQuotas() {
-    if (cacheLoaded) {
-        return { ...memoryCache };
-    }
-    try {
-        const raw = await fs.readFile(getQuotaFilePath(), "utf-8");
-        memoryCache = JSON.parse(raw);
-    }
-    catch {
-        memoryCache = {};
+async function ensureAccountQuotasLoaded() {
+    if (!cacheLoaded) {
+        if (!cacheLoadPromise) {
+            cacheLoadPromise = (async () => {
+                try {
+                    const raw = await fs.readFile(getQuotaFilePath(), "utf-8");
+                    memoryCache = JSON.parse(raw);
+                }
+                catch {
+                    memoryCache = {};
+                }
+                cacheLoaded = true;
+            })().finally(() => {
+                cacheLoadPromise = null;
+            });
+        }
+        await cacheLoadPromise;
     }
-    cacheLoaded = true;
-    return { ...memoryCache };
+}
+export async function loadAccountQuotas() {
+    await ensureAccountQuotasLoaded();
+    return stateMutex.runExclusive(async () => ({ ...memoryCache }));
 }
 /**
  * Load quota for a single account.
@@ -181,11 +204,19 @@ export async function loadAccountQuota(accountKey) {
  * other accounts' snapshots and blinded quota-aware routing to them).
  */
 export async function saveAccountQuota(accountKey, quota) {
-    if (!cacheLoaded) {
-        await loadAccountQuotas();
-    }
-    memoryCache[accountKey] = quota;
-    dirty = true;
+    await stateMutex.runExclusive(async () => {
+        await ensureAccountQuotasLoaded();
+        memoryCache[accountKey] = { ...quota };
+        dirty = true;
+        cacheVersion += 1;
+    });
     scheduleFlush();
 }
+export async function flushAccountQuotaStateForTests() {
+    if (flushTimer) {
+        clearTimeout(flushTimer);
+        flushTimer = null;
+    }
+    await flushToDisk();
+}
 //# sourceMappingURL=accountQuota.js.map

package/dist/lib/proxy/accountSelection.d.ts

@@ -0,0 +1,8 @@
+import type { AccountAllowlist } from "../types/index.js";
+export declare const LEGACY_ANTHROPIC_ACCOUNT_KEY = "anthropic:legacy-default";
+export declare const ENV_ANTHROPIC_ACCOUNT_KEY = "anthropic:env";
+export declare function normalizeAnthropicAccountKey(value: string): string;
+export declare function anthropicAccountKeysEqual(left: string, right: string): boolean;
+export declare function createAccountAllowlist(values?: readonly string[]): AccountAllowlist | undefined;
+export declare function isAccountAllowed(accountKey: string, allowlist?: AccountAllowlist): boolean;
+export declare function shouldLoadFallbackCredential(storedAnthropicAccountCount: number, fallbackAccountKey: string, allowlist?: AccountAllowlist): boolean;

package/dist/lib/proxy/accountSelection.js

@@ -0,0 +1,26 @@
+export const LEGACY_ANTHROPIC_ACCOUNT_KEY = "anthropic:legacy-default";
+export const ENV_ANTHROPIC_ACCOUNT_KEY = "anthropic:env";
+export function normalizeAnthropicAccountKey(value) {
+    const trimmed = value.trim().toLowerCase();
+    return trimmed.startsWith("anthropic:") ? trimmed : `anthropic:${trimmed}`;
+}
+export function anthropicAccountKeysEqual(left, right) {
+    return (normalizeAnthropicAccountKey(left) === normalizeAnthropicAccountKey(right));
+}
+export function createAccountAllowlist(values) {
+    if (values === undefined) {
+        return undefined;
+    }
+    return new Set(values
+        .map(normalizeAnthropicAccountKey)
+        .filter((value) => value !== "anthropic:"));
+}
+export function isAccountAllowed(accountKey, allowlist) {
+    return (allowlist === undefined ||
+        allowlist.has(normalizeAnthropicAccountKey(accountKey)));
+}
+export function shouldLoadFallbackCredential(storedAnthropicAccountCount, fallbackAccountKey, allowlist) {
+    return (storedAnthropicAccountCount === 0 &&
+        isAccountAllowed(fallbackAccountKey, allowlist));
+}
+//# sourceMappingURL=accountSelection.js.map

package/dist/lib/proxy/proxyConfig.js

@@ -212,6 +212,22 @@ export function validateProxyConfig(config) {
         errors.push('"routing" must be an object');
         return errors;
     }
+    if (hasRouting) {
+        const routing = cfg.routing;
+        const rawAccountAllowlist = routing["account-allowlist"] ?? routing.accountAllowlist;
+        if (rawAccountAllowlist !== undefined) {
+            if (!Array.isArray(rawAccountAllowlist)) {
+                errors.push("routing.account-allowlist must be an array of non-empty strings");
+            }
+            else {
+                rawAccountAllowlist.forEach((entry, index) => {
+                    if (typeof entry !== "string" || entry.trim() === "") {
+                        errors.push(`routing.account-allowlist[${index}] must be a non-empty string`);
+                    }
+                });
+            }
+        }
+    }
     if (!hasAccounts && !hasRouting) {
         errors.push('Config must contain at least one of "accounts" or "routing"');
         return errors;
@@ -280,6 +296,7 @@ function warnPlaintextApiKeys(accounts) {
  * - `model-mappings` / `modelMappings` — array of {from, to, provider}
  * - `fallback-chain` / `fallbackChain` — array of {provider, model}
  * - `passthroughModels` / `passthrough-models` — array of model IDs
+ * - `account-allowlist` / `accountAllowlist` — allowed Anthropic account IDs
  *
  * Accepts both camelCase and kebab-case keys for YAML-friendliness.
  */
@@ -350,6 +367,13 @@ function parseRoutingConfig(raw) {
                 `string, got ${typeof rawPrimary}`);
         }
     }
+    const rawAccountAllowlist = (raw["account-allowlist"] ??
+        raw.accountAllowlist);
+    if (Array.isArray(rawAccountAllowlist)) {
+        result.accountAllowlist = [
+            ...new Set(rawAccountAllowlist.map((entry) => String(entry).trim())),
+        ];
+    }
     return result;
 }
 // ---------------------------------------------------------------------------

package/dist/lib/proxy/proxyPaths.js

@@ -21,6 +21,7 @@ export function resolveProxyPaths(dev) {
             stateDir: base,
             logsDir: join(base, "logs"),
             quotaFile: join(base, "account-quotas.json"),
+            cooldownFile: join(base, "account-cooldowns.json"),
             isDev: true,
         };
     }
@@ -29,6 +30,7 @@ export function resolveProxyPaths(dev) {
         stateDir: base,
         logsDir: join(base, "logs"),
         quotaFile: join(base, "account-quotas.json"),
+        cooldownFile: join(base, "account-cooldowns.json"),
         isDev: false,
     };
 }

package/dist/lib/proxy/requestLogger.js

@@ -594,6 +594,8 @@ export async function logStreamError(entry) {
     const logEntry = {
         ...entry,
         responseStatus: 200,
+        terminalStatus: 502,
+        terminalOutcome: "stream_error",
         errorType: "stream_error",
         note: "mid-stream failure after initial 200",
     };

package/dist/lib/proxy/snapshotPersistence.js

@@ -5,7 +5,7 @@ const writeLocks = new Map();
 async function writeSnapshotFile(targetPath, payload, mode) {
     const dir = dirname(targetPath);
     const baseName = basename(targetPath);
-    await mkdir(dir, { recursive: true });
+    await mkdir(dir, { recursive: true, mode: 0o700 });
     const tempPath = join(dir, `.${baseName}.${process.pid}.${randomUUID()}.tmp`);
     try {
         await writeFile(tempPath, payload, { mode });

package/dist/lib/proxy/sseInterceptor.js

@@ -185,6 +185,9 @@ function finalize(acc) {
         streamDurationMs: Date.now() - acc.startTime,
         totalBytesReceived: acc.totalBytesReceived,
         events: acc.events,
+        ...(acc.streamErrorMessage
+            ? { streamErrorMessage: acc.streamErrorMessage }
+            : {}),
         ...(acc.rawTextChunks ? { rawText: acc.rawTextChunks.join("") } : {}),
     };
 }
@@ -323,6 +326,19 @@ function processEvent(acc, event) {
         // Malformed JSON — skip silently, bytes already forwarded to client
         return;
     }
+    if (event.event === "error") {
+        const payload = parsed && typeof parsed === "object"
+            ? parsed
+            : {};
+        const nestedError = payload.error && typeof payload.error === "object"
+            ? payload.error
+            : undefined;
+        const message = nestedError?.message ?? payload.message;
+        acc.streamErrorMessage =
+            typeof message === "string" && message.trim()
+                ? message.trim()
+                : truncateString(event.data, MAX_EVENT_DATA_BYTES);
+    }
     switch (event.event) {
         case "message_start":
             processMessageStart(acc, parsed);

package/dist/lib/proxy/streamOutcome.d.ts

@@ -0,0 +1,3 @@
+import type { StreamTerminalOutcome, StreamTerminalOutcomeTracker } from "../types/index.js";
+export declare function createStreamTerminalOutcomeTracker(): StreamTerminalOutcomeTracker;
+export declare function mergeStreamTerminalOutcome(outcome: StreamTerminalOutcome, sseErrorMessage?: string): StreamTerminalOutcome;

package/dist/lib/proxy/streamOutcome.js

@@ -0,0 +1,27 @@
+export function createStreamTerminalOutcomeTracker() {
+    let settled = false;
+    let resolveOutcome;
+    const outcome = new Promise((resolve) => {
+        resolveOutcome = resolve;
+    });
+    const settle = (value) => {
+        if (settled) {
+            return;
+        }
+        settled = true;
+        resolveOutcome(value);
+    };
+    return {
+        outcome,
+        complete: () => settle({ kind: "completed" }),
+        fail: (message) => settle({ kind: "upstream_error", message }),
+        cancel: () => settle({ kind: "client_cancelled" }),
+    };
+}
+export function mergeStreamTerminalOutcome(outcome, sseErrorMessage) {
+    if (outcome.kind === "completed" && sseErrorMessage) {
+        return { kind: "upstream_error", message: sseErrorMessage };
+    }
+    return outcome;
+}
+//# sourceMappingURL=streamOutcome.js.map