@juspay/neurolink 10.10.12 → 10.11.0

package/dist/lib/utils/imageProcessor.js

@@ -3,6 +3,7 @@
  * Handles format conversion for different AI providers
  */
 import { basename } from "path";
+import { SUPPORTED_INPUT_IMAGE_MIME_TYPES } from "../adapters/imageFormatSupport.js";
 import { logger } from "./logger.js";
 import { redactPathFromMessage, redactUrlForError, redactUrlsInText, sanitizeErrorCause, } from "./logSanitize.js";
 import { urlDownloadRateLimiter } from "./rateLimiter.js";
@@ -565,23 +566,19 @@ export class ImageProcessor {
      * Validate image format
      */
     static validateImageFormat(mediaType) {
-        const supportedFormats = [
-            "image/jpeg",
-            "image/png",
-            "image/gif",
-            "image/webp",
-            "image/bmp",
-            "image/tiff",
-            "image/svg+xml",
-            "image/avif",
-            // Deliberately excludes "application/octet-stream": that's
-            // detectImageType()'s honest sentinel for bytes matching no known
-            // image signature (#261), not a real image format. Vision providers
-            // (OpenAI/Anthropic/Google) reject it outright with an HTTP 400, so
-            // process() must fail loud instead of packaging it as a valid image
-            // (see the octet-stream guard in process() below).
-        ];
-        return supportedFormats.includes(mediaType.toLowerCase());
+        // Derived from the canonical input set rather than hand-listed. The old
+        // literal omitted HEIC, HEIF, ICO and JPEG 2000, so an iPhone photo
+        // attached by path was rejected here — "Invalid MIME type: image/heic is
+        // not in allowed list" — before the transcode that exists to accept it
+        // could run. Intake has to allow every format we can convert, not just the
+        // ones providers take unchanged.
+        //
+        // Still excludes "application/octet-stream": that is detectImageType()'s
+        // honest sentinel for bytes matching no known image signature (#261), not
+        // a real format. Vision providers reject it with an HTTP 400, so process()
+        // must fail loud rather than package it as a valid image (see the
+        // octet-stream guard in process() below).
+        return SUPPORTED_INPUT_IMAGE_MIME_TYPES.has(mediaType.toLowerCase());
     }
     /**
      * Get image dimensions from Buffer (basic implementation)

package/dist/lib/utils/markupSniff.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Content sniffing for text-shaped image formats.
+ *
+ * SVG is markup, so it has no byte signature — but it does have an unambiguous
+ * root element, and identifying it matters twice over: the detector routes SVG
+ * to the sanitizer rather than to a vision API, and the image path must not let
+ * SVG bytes travel under some other format's MIME type.
+ *
+ * ## Why this is a scan and not a regular expression
+ *
+ * The obvious implementation strips the prolog with a pattern like
+ * `(?:<!--[\s\S]*?-->\s*)*<svg`. That is two nested quantifiers, and CodeQL
+ * rightly flags it as `js/redos`: input beginning `<!--` and repeating
+ * `--><!--` drives exponential backtracking, so a hostile (or merely odd)
+ * upload can burn CPU inside what is supposed to be a cheap type check.
+ *
+ * The `.replace()`-chain alternative is unsound for a different reason —
+ * removing a multi-character construct can join the surrounding text into a
+ * fresh instance of that same construct, so one pass does not converge
+ * (`<!--<!-- -->-->` leaves a comment behind). CodeQL flags that shape too, as
+ * `js/incomplete-multi-character-sanitization`.
+ *
+ * A single forward scan has neither problem: the cursor only ever advances, so
+ * the work is linear in the input and no construct can re-form behind it.
+ *
+ * @module utils/markupSniff
+ */
+/**
+ * Whether the leading bytes are an SVG document.
+ *
+ * Requires `<svg` to be the *root element* rather than merely present, so an
+ * HTML page embedding an inline `<svg>` icon is not mistaken for a standalone
+ * image. A BOM, XML declaration, DOCTYPE and comments may precede it.
+ *
+ * @param input - Buffer or string to inspect; only the head is read.
+ */
+export declare function looksLikeSvgMarkup(input: Buffer | string): boolean;

package/dist/lib/utils/markupSniff.js

@@ -0,0 +1,125 @@
+/**
+ * Content sniffing for text-shaped image formats.
+ *
+ * SVG is markup, so it has no byte signature — but it does have an unambiguous
+ * root element, and identifying it matters twice over: the detector routes SVG
+ * to the sanitizer rather than to a vision API, and the image path must not let
+ * SVG bytes travel under some other format's MIME type.
+ *
+ * ## Why this is a scan and not a regular expression
+ *
+ * The obvious implementation strips the prolog with a pattern like
+ * `(?:<!--[\s\S]*?-->\s*)*<svg`. That is two nested quantifiers, and CodeQL
+ * rightly flags it as `js/redos`: input beginning `<!--` and repeating
+ * `--><!--` drives exponential backtracking, so a hostile (or merely odd)
+ * upload can burn CPU inside what is supposed to be a cheap type check.
+ *
+ * The `.replace()`-chain alternative is unsound for a different reason —
+ * removing a multi-character construct can join the surrounding text into a
+ * fresh instance of that same construct, so one pass does not converge
+ * (`<!--<!-- -->-->` leaves a comment behind). CodeQL flags that shape too, as
+ * `js/incomplete-multi-character-sanitization`.
+ *
+ * A single forward scan has neither problem: the cursor only ever advances, so
+ * the work is linear in the input and no construct can re-form behind it.
+ *
+ * @module utils/markupSniff
+ */
+/** Bytes inspected when sniffing for a markup root element. */
+const MARKUP_SNIFF_LIMIT = 1024;
+/**
+ * Whether the leading bytes are an SVG document.
+ *
+ * Requires `<svg` to be the *root element* rather than merely present, so an
+ * HTML page embedding an inline `<svg>` icon is not mistaken for a standalone
+ * image. A BOM, XML declaration, DOCTYPE and comments may precede it.
+ *
+ * @param input - Buffer or string to inspect; only the head is read.
+ */
+export function looksLikeSvgMarkup(input) {
+    const head = typeof input === "string"
+        ? input.slice(0, MARKUP_SNIFF_LIMIT)
+        : input.toString("utf8", 0, Math.min(input.length, MARKUP_SNIFF_LIMIT));
+    if (!head.includes("<svg")) {
+        return false;
+    }
+    let cursor = head.charCodeAt(0) === 0xfeff ? 1 : 0;
+    while (cursor < head.length) {
+        while (cursor < head.length && /\s/.test(head[cursor])) {
+            cursor++;
+        }
+        if (head[cursor] !== "<") {
+            // Text before any element — not a well-formed XML document.
+            return false;
+        }
+        // Each prolog construct ends at a known delimiter; an unterminated one
+        // means the document is truncated or malformed, so stop rather than guess.
+        let end;
+        if (head.startsWith("<?", cursor)) {
+            end = head.indexOf("?>", cursor + 2);
+            cursor = end === -1 ? head.length : end + 2;
+        }
+        else if (head.startsWith("<!--", cursor)) {
+            end = head.indexOf("-->", cursor + 4);
+            cursor = end === -1 ? head.length : end + 3;
+        }
+        else if (head.startsWith("<!", cursor)) {
+            // DOCTYPE. Stopping at the first '>' is wrong for two legal forms: a
+            // quoted public/system identifier may contain '>', and an internal
+            // subset (`<!DOCTYPE svg [ <!ENTITY x "y"> ]>`) certainly does. Either
+            // one left the cursor mid-declaration and made a valid SVG classify as
+            // not-SVG. Track quotes and subset depth to find the real terminator.
+            cursor = skipDoctype(head, cursor);
+        }
+        else {
+            // First real element decides.
+            return /^<svg[\s>/]/i.test(head.slice(cursor));
+        }
+    }
+    return false;
+}
+/**
+ * Return the index just past a DOCTYPE declaration beginning at `start`.
+ *
+ * Handles quoted identifiers and a bracketed internal subset. Returns
+ * `head.length` when the declaration is unterminated within the sniffed
+ * window, which stops the caller rather than letting it guess.
+ */
+function skipDoctype(head, start) {
+    let quote = null;
+    let subsetDepth = 0;
+    for (let i = start + 2; i < head.length; i++) {
+        const ch = head[i];
+        if (quote) {
+            if (ch === quote) {
+                quote = null;
+            }
+            continue;
+        }
+        // A comment inside the internal subset may itself contain ']' and '>'.
+        // Treating those as structural closed the subset early and terminated the
+        // DOCTYPE on the comment's own '-->', so valid SVG classified as not-SVG.
+        if (head.startsWith("<!--", i)) {
+            const commentEnd = head.indexOf("-->", i + 4);
+            if (commentEnd === -1) {
+                return head.length;
+            }
+            i = commentEnd + 2; // loop increment steps past the final '>'
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            quote = ch;
+        }
+        else if (ch === "[") {
+            subsetDepth++;
+        }
+        else if (ch === "]") {
+            subsetDepth = Math.max(0, subsetDepth - 1);
+        }
+        else if (ch === ">" && subsetDepth === 0) {
+            return i + 1;
+        }
+    }
+    return head.length;
+}
+//# sourceMappingURL=markupSniff.js.map

package/dist/lib/utils/messageBuilder.d.ts

@@ -52,3 +52,17 @@ export declare function processUnifiedFilesArray(options: GenerateOptions, maxSi
  * Detects when images are present and routes through provider adapter
  */
 export declare function buildMultimodalMessagesArray(options: GenerateOptions, provider: string, model: string): Promise<MultimodalChatMessage[]>;
+/**
+ * Transcode any image in `input.images` that no vision provider accepts,
+ * rewriting the entry in place as a PNG data URI.
+ *
+ * Mutates in place and is idempotent, matching `processUnifiedFilesArray` and
+ * `foldMediaAliasesIntoFiles`: the shared multimodal builder and the providers
+ * that bypass it (Google AI Studio's and Vertex's native SDK paths, Bedrock's
+ * Converse path) can all call it on the same options object without converting
+ * anything twice.
+ *
+ * Entries that are `http(s)` URLs are left alone — they have no bytes yet, and
+ * `processImageToBase64` converts them once they are downloaded.
+ */
+export declare function normalizeVisionImageFormats(input: GenerateOptions["input"]): Promise<void>;

package/dist/lib/utils/messageBuilder.js

@@ -8,11 +8,16 @@ import { PDF_LIMITS } from "../core/constants.js";
 import { enforceAggregateFileBudget, FILE_READ_BUDGET_PERCENT, } from "../context/fileTokenBudget.js";
 import { isCSVContent, SIZE_TIER_THRESHOLDS } from "../types/index.js";
 import { tracers, ATTR, withSpan } from "../telemetry/index.js";
+import { needsVisionTranscode, toVisionCompatibleImage, } from "../adapters/imageFormatSupport.js";
+import { FILE_TYPE_REGISTRY, lookupByExtension, } from "../processors/config/fileTypeRegistry.js";
 import { ErrorFactory, NeuroLinkError, withTimeout } from "./errorHandling.js";
 import { FileDetector } from "./fileDetector.js";
+import { detectIsoBmffImageMimeType } from "./isoBmff.js";
 import { getImageCache } from "./imageCache.js";
 import { ImageProcessor, imageUtils } from "./imageProcessor.js";
 import { logger } from "./logger.js";
+import { looksLikeSvgMarkup } from "./markupSniff.js";
+import { redactUrlForError } from "./logSanitize.js";
 import { PDFImageConverter, PDFProcessor } from "./pdfProcessor.js";
 import { urlDownloadRateLimiter } from "./rateLimiter.js";
 import { estimateTokens } from "./tokenEstimation.js";
@@ -22,82 +27,16 @@ import { estimateTokens } from "./tokenEstimation.js";
 // classify files into broad categories (video, audio, image, etc.) so
 // estimatePostProcessingTokens() can use type-aware estimates.
 // ---------------------------------------------------------------------------
-/** Extension → file type mapping for budget estimation */
-const EXTENSION_TYPE_MAP = {
-    // Video
-    mp4: "video",
-    mkv: "video",
-    mov: "video",
-    avi: "video",
-    webm: "video",
-    wmv: "video",
-    flv: "video",
-    m4v: "video",
-    // Audio
-    mp3: "audio",
-    wav: "audio",
-    ogg: "audio",
-    flac: "audio",
-    m4a: "audio",
-    aac: "audio",
-    wma: "audio",
-    opus: "audio",
-    // Image
-    jpg: "image",
-    jpeg: "image",
-    jpe: "image",
-    jfif: "image",
-    png: "image",
-    apng: "image",
-    gif: "image",
-    webp: "image",
-    bmp: "image",
-    tiff: "image",
-    tif: "image",
-    avif: "image",
-    // Below this line the entries exist because this map now decides whether an
-    // image is processed eagerly (see isEagerMultimodalFile), not merely how its
-    // tokens are estimated. An extension missing here classifies as `undefined`
-    // and takes the lazy path, which drops the pixels — so a gap is a dropped
-    // photo, not a slightly-off estimate. HEIC is the one that matters most:
-    // it is what an iPhone writes by default.
-    heic: "image",
-    heif: "image",
-    ico: "image",
-    jp2: "image",
-    jpx: "image",
-    // NB: `svg` is deliberately absent here — it is mapped to its own "svg"
-    // routing type further down, and listing it twice is a duplicate key whose
-    // second entry silently wins. `isEagerMultimodalFile` accepts both types
-    // instead, so SVG takes the eager path without this map having to lie about
-    // which processor handles it.
-    // Archive
-    zip: "archive",
-    tar: "archive",
-    gz: "archive",
-    tgz: "archive",
-    rar: "archive",
-    "7z": "archive",
-    jar: "archive",
-    // Documents
-    xlsx: "xlsx",
-    xls: "xlsx",
-    ods: "xlsx",
-    docx: "docx",
-    doc: "docx",
-    odt: "docx",
-    rtf: "docx",
-    pptx: "pptx",
-    ppt: "pptx",
-    odp: "pptx",
-    // PDF
-    pdf: "pdf",
-    // SVG
-    svg: "svg",
-    // CSV
-    csv: "csv",
-    tsv: "csv",
-};
+/**
+ * Extension → file type for budget estimation.
+ *
+ * Derived from the canonical registry rather than hand-listed: this was a
+ * fourth copy of the same knowledge, and it disagreed with the detector it is
+ * supposed to predict — it had no entry for .mpg/.mpeg/.3gp/.aiff and so on, so
+ * estimatePostProcessingTokens() silently fell back to a generic estimate for
+ * exactly the large media files whose estimate matters most.
+ */
+const EXTENSION_TYPE_MAP = Object.fromEntries(FILE_TYPE_REGISTRY.flatMap((entry) => entry.extensions.map((ext) => [ext.slice(1), entry.fileType])));
 /**
  * Infer file type from extension in a file path or URL.
  * Returns undefined if no extension or unrecognized.
@@ -1265,6 +1204,9 @@ export async function buildMultimodalMessagesArray(options, provider, model) {
     enforceFileBudget(options, provider, model);
     // Process unified files array (auto-detect)
     await processUnifiedFilesArray(options, maxSize, provider);
+    // Detection can append images (PDF page renders, video keyframes, a HEIC
+    // photo), so compatibility conversion has to run after it, not before.
+    await normalizeVisionImageFormats(inp);
     // Process explicit CSV files array
     await processExplicitCsvFiles(options);
     // Post-processing budget enforcement and token usage logging
@@ -1576,25 +1518,24 @@ async function downloadImageFromUrl(url) {
     }
 }
 /**
- * Get MIME type from file extension
+ * Get MIME type from an image file extension.
+ *
+ * Delegates to the canonical registry instead of the six-case switch this used
+ * to be. That switch covered png/gif/webp/bmp/tiff and defaulted *everything
+ * else* to image/jpeg, so a .heic, .avif, .ico or .jp2 path was labelled JPEG
+ * — which meant `needsVisionTranscode()` never fired for it and the raw bytes
+ * went to the provider under a MIME type that was simply untrue. Exactly the
+ * kind of hand-maintained table this registry exists to delete.
+ *
+ * The image/jpeg fallback is kept only for genuinely unknown extensions, since
+ * callers here have already established they are handling an image.
  */
 function getMimeTypeFromExtension(filePath) {
-    const ext = filePath.toLowerCase().split(".").pop();
-    switch (ext) {
-        case "png":
-            return "image/png";
-        case "gif":
-            return "image/gif";
-        case "webp":
-            return "image/webp";
-        case "bmp":
-            return "image/bmp";
-        case "tiff":
-        case "tif":
-            return "image/tiff";
-        default:
-            return "image/jpeg";
+    const entry = lookupByExtension(filePath);
+    if (entry?.modality === "image") {
+        return entry.mimeTypes[0];
     }
+    return "image/jpeg";
 }
 /**
  * Detect MIME type from buffer magic bytes
@@ -1658,6 +1599,45 @@ function detectMimeTypeFromBuffer(buffer) {
                 buffer[3] === 0x2a))) {
         return "image/tiff";
     }
+    // The formats above are the ones a provider accepts (or that sharp handles
+    // trivially). Everything below is a format NO vision provider accepts, and
+    // recognising it here is what lets `needsVisionTranscode()` fire — a Buffer
+    // whose format was unrecognised fell through to the image/jpeg default and
+    // was shipped to the provider unconverted under a MIME type that was false.
+    // Raw Buffers are the most direct way a backend attaches an image, so this
+    // was the single biggest hole in the vision-compatibility path.
+    // HEIC / HEIF / AVIF: ISO-BMFF `ftyp` box, distinguished by major brand.
+    // Shared with the FileDetector so the two cannot drift on brand tables.
+    const isoBmffImage = detectIsoBmffImageMimeType(buffer);
+    if (isoBmffImage) {
+        return isoBmffImage;
+    }
+    // ICO: 00 00 01 00. Checked after the ftyp probe because an ISO-BMFF file
+    // also starts with a zero byte.
+    if (buffer.length >= 4 &&
+        buffer[0] === 0x00 &&
+        buffer[1] === 0x00 &&
+        buffer[2] === 0x01 &&
+        buffer[3] === 0x00) {
+        return "image/x-icon";
+    }
+    // SVG is markup, so it has no byte signature — and without this probe a raw
+    // SVG buffer matched nothing, kept processImageToBase64's "image/jpeg"
+    // default, and was shipped to the provider as XML labelled as a JPEG.
+    // Shared forward scan rather than a local regex: the regex form of this
+    // check is a CodeQL js/redos finding (see markupSniff).
+    if (looksLikeSvgMarkup(buffer)) {
+        return "image/svg+xml";
+    }
+    // JPEG 2000: 12-byte signature box "....jP  ".
+    if (buffer.length >= 8 &&
+        buffer[0] === 0x00 &&
+        buffer[1] === 0x00 &&
+        buffer[2] === 0x00 &&
+        buffer[3] === 0x0c &&
+        buffer.toString("latin1", 4, 8) === "jP  ") {
+        return "image/jp2";
+    }
     return undefined;
 }
 /**
@@ -1764,8 +1744,108 @@ async function processImageToBase64(image, index) {
         ImageProcessor.validateBufferSize(image, `image input at index ${index}`);
         imageData = image.toString("base64");
     }
+    // Last line of defence for vision-format compatibility. `normalizeVisionImageFormats`
+    // handles `input.images` eagerly so the providers that read that array
+    // directly (Google AI Studio, Bedrock) see converted bytes, but images that
+    // arrive as URLs are downloaded further downstream and only become bytes
+    // here. A no-op for the universal formats, so the common path is unaffected.
+    if (needsVisionTranscode(mimeType)) {
+        const compatible = await toVisionCompatibleImage(Buffer.from(imageData, "base64"), mimeType);
+        if (compatible.converted) {
+            imageData = compatible.buffer.toString("base64");
+            mimeType = compatible.mimeType;
+        }
+    }
     return { imageData, mimeType };
 }
+/**
+ * Transcode any image in `input.images` that no vision provider accepts,
+ * rewriting the entry in place as a PNG data URI.
+ *
+ * Mutates in place and is idempotent, matching `processUnifiedFilesArray` and
+ * `foldMediaAliasesIntoFiles`: the shared multimodal builder and the providers
+ * that bypass it (Google AI Studio's and Vertex's native SDK paths, Bedrock's
+ * Converse path) can all call it on the same options object without converting
+ * anything twice.
+ *
+ * Entries that are `http(s)` URLs are left alone — they have no bytes yet, and
+ * `processImageToBase64` converts them once they are downloaded.
+ */
+export async function normalizeVisionImageFormats(input) {
+    const images = input?.images;
+    if (!images || images.length === 0) {
+        return;
+    }
+    for (let index = 0; index < images.length; index++) {
+        const entry = images[index];
+        // ImageWithAltText wraps the payload in `.data`; convert that and keep the
+        // alt text attached rather than dropping the wrapper.
+        const isWrapped = typeof entry === "object" && entry !== null && !Buffer.isBuffer(entry);
+        const payload = isWrapped
+            ? entry.data
+            : entry;
+        const source = await readImageSourceForConversion(payload);
+        if (!source || !needsVisionTranscode(source.mimeType)) {
+            continue;
+        }
+        const compatible = await toVisionCompatibleImage(source.buffer, source.mimeType);
+        if (!compatible.converted) {
+            continue;
+        }
+        const dataUri = `data:${compatible.mimeType};base64,${compatible.buffer.toString("base64")}`;
+        images[index] = isWrapped
+            ? { ...entry, data: dataUri }
+            : dataUri;
+    }
+}
+/**
+ * Resolve one `input.images` entry to bytes plus a MIME type, or undefined when
+ * it cannot be resolved without a network call.
+ *
+ * File paths are only read when their extension says the format would need
+ * conversion. Reading every attached .png off disk just to confirm it is
+ * already compatible would double the I/O of the common case for no benefit.
+ */
+async function readImageSourceForConversion(payload) {
+    if (Buffer.isBuffer(payload)) {
+        const mimeType = detectMimeTypeFromBuffer(payload);
+        return mimeType ? { buffer: payload, mimeType } : undefined;
+    }
+    if (typeof payload !== "string") {
+        return undefined;
+    }
+    if (payload.startsWith("data:")) {
+        const match = payload.match(/^data:([^;]+);base64,(.+)$/);
+        return match
+            ? { buffer: Buffer.from(match[2], "base64"), mimeType: match[1] }
+            : undefined;
+    }
+    if (isInternetUrl(payload)) {
+        return undefined;
+    }
+    const mimeType = getMimeTypeFromExtension(payload);
+    if (!needsVisionTranscode(mimeType)) {
+        return undefined;
+    }
+    try {
+        // Preflight the size before reading. Conversion replaces the entry with a
+        // data URI, which bypasses processImageToBase64's buffer-size guard — so
+        // without this a large local HEIC/TIFF/BMP was read fully into memory and
+        // then re-encoded, with no limit applied at either step.
+        const { size } = await statAsync(payload);
+        ImageProcessor.validateSize(size, `image at ${safeBasename(payload)}`);
+        const buffer = await readFileAsync(payload);
+        ImageProcessor.validateBufferSize(buffer, `image at ${safeBasename(payload)}`);
+        return { buffer, mimeType };
+    }
+    catch (error) {
+        // The path may be a signed URL or carry credentials in query params, so it
+        // is redacted rather than interpolated verbatim (see logSanitize).
+        logger.warn(`[messageBuilder] Could not read ${redactUrlForError(payload)} for image ` +
+            `format conversion: ${error instanceof Error ? error.message : String(error)}`);
+        return undefined;
+    }
+}
 /**
  * Convert simple images format to Vercel AI SDK format with smart auto-detection
  * - URLs: Downloaded and converted to base64 for Vercel AI SDK compatibility

package/dist/processors/config/fileExtensions.d.ts

@@ -2,20 +2,34 @@
  * File Extension Constants
  * Centralized file extension definitions organized by category for file processing
  *
+ * The media/document/data/archive categories are derived from
+ * {@link FILE_TYPE_REGISTRY} rather than typed out here — they used to be a
+ * second hand-maintained list that drifted from both the registry-equivalent
+ * MIME map and the detector, so formats appeared "supported" in one place and
+ * were invisible in another. Source-code and text categories, which carry no
+ * modality, are still enumerated below.
+ *
  * @module processors/config/fileTypes
  */
 /**
- * Image file extensions supported by the platform
+ * Image file extensions supported by the platform.
+ * Includes `.svg`, which is processed as sanitized markup rather than raster.
  */
-export declare const IMAGE_EXTENSIONS: readonly [".jpg", ".jpeg", ".png", ".gif", ".webp", ".svg", ".bmp", ".tiff", ".tif", ".avif", ".heic", ".heif", ".ico"];
+export declare const IMAGE_EXTENSIONS: readonly string[];
 /**
- * AI vision-supported image extensions (subset that works with AI models)
+ * Image extensions every vision-capable provider accepts as-is.
+ *
+ * Deliberately NOT derived from the registry: this is the intersection of what
+ * OpenAI, Anthropic, Google and Bedrock all accept, not the set NeuroLink can
+ * identify. Anything else the registry knows about (BMP, TIFF, AVIF, ICO,
+ * HEIC/HEIF) is transcoded to PNG before dispatch — see
+ * `adapters/imageFormatSupport.ts`.
  */
 export declare const AI_VISION_EXTENSIONS: readonly [".jpg", ".jpeg", ".png", ".gif", ".webp"];
 /**
  * Document file extensions for office documents and PDFs
  */
-export declare const DOCUMENT_EXTENSIONS: readonly [".pdf", ".docx", ".doc", ".xlsx", ".xls", ".pptx", ".ppt", ".odt", ".ods", ".odp", ".rtf"];
+export declare const DOCUMENT_EXTENSIONS: readonly string[];
 /**
  * PDF document extensions
  */
@@ -57,9 +71,12 @@ export declare const CSV_EXTENSIONS: readonly [".csv"];
  */
 export declare const YAML_EXTENSIONS: readonly [".yaml", ".yml"];
 /**
- * All data format extensions combined
+ * All data format extensions combined.
+ *
+ * The tabular formats (.csv/.tsv) come from the registry; .json/.xml/.yaml are
+ * text formats with no modality of their own and stay listed here.
  */
-export declare const DATA_EXTENSIONS: readonly [".json", ".xml", ".csv", ".yaml", ".yml"];
+export declare const DATA_EXTENSIONS: readonly string[];
 /**
  * Plain text file extensions
  */
@@ -173,15 +190,15 @@ export declare const CONFIG_EXTENSIONS: readonly [".env", ".ini", ".toml", ".cfg
 /**
  * Archive and compressed file extensions
  */
-export declare const ARCHIVE_EXTENSIONS: readonly [".zip", ".tar", ".gz", ".tgz", ".tar.gz", ".tar.bz2", ".bz2", ".rar", ".7z", ".xz"];
+export declare const ARCHIVE_EXTENSIONS: readonly string[];
 /**
  * Video file extensions
  */
-export declare const VIDEO_EXTENSIONS: readonly [".mp4", ".avi", ".mov", ".mkv", ".webm", ".flv", ".wmv", ".m4v", ".mpg", ".mpeg"];
+export declare const VIDEO_EXTENSIONS: readonly string[];
 /**
  * Audio file extensions
  */
-export declare const AUDIO_EXTENSIONS: readonly [".mp3", ".wav", ".aac", ".flac", ".ogg", ".m4a", ".wma", ".opus"];
+export declare const AUDIO_EXTENSIONS: readonly string[];
 /**
  * Design and graphics file extensions
  */
@@ -198,16 +215,16 @@ export declare const EXECUTABLE_EXTENSIONS: readonly [".exe", ".dll", ".so", ".d
  * File extensions grouped by category for easy access
  */
 export declare const FILE_EXTENSIONS: {
-    readonly IMAGES: readonly [".jpg", ".jpeg", ".png", ".gif", ".webp", ".svg", ".bmp", ".tiff", ".tif", ".avif", ".heic", ".heif", ".ico"];
+    readonly IMAGES: readonly string[];
     readonly AI_VISION: readonly [".jpg", ".jpeg", ".png", ".gif", ".webp"];
-    readonly DOCUMENTS: readonly [".pdf", ".docx", ".doc", ".xlsx", ".xls", ".pptx", ".ppt", ".odt", ".ods", ".odp", ".rtf"];
+    readonly DOCUMENTS: readonly string[];
     readonly PDF: readonly [".pdf"];
     readonly WORD: readonly [".docx", ".doc"];
     readonly EXCEL: readonly [".xlsx", ".xls"];
     readonly POWERPOINT: readonly [".pptx", ".ppt"];
     readonly OPENDOCUMENT: readonly [".odt", ".ods", ".odp"];
     readonly RTF: readonly [".rtf"];
-    readonly DATA: readonly [".json", ".xml", ".csv", ".yaml", ".yml"];
+    readonly DATA: readonly string[];
     readonly JSON: readonly [".json"];
     readonly XML: readonly [".xml"];
     readonly CSV: readonly [".csv"];
@@ -254,9 +271,9 @@ export declare const FILE_EXTENSIONS: {
     };
     readonly ALL_CODE: readonly [".js", ".jsx", ".mjs", ".cjs", ".ts", ".tsx", ".py", ".pyw", ".pyi", ".java", ".kt", ".kts", ".go", ".rs", ".c", ".h", ".cpp", ".hpp", ".cc", ".cxx", ".hxx", ".cs", ".rb", ".rake", ".php", ".phtml", ".php3", ".php4", ".php5", ".phps", ".sh", ".bash", ".zsh", ".fish", ".ksh", ".pl", ".pm", ".pod", ".t", ".lua", ".sql", ".swift", ".dart", ".m", ".mm", ".scala", ".sc", ".hs", ".lhs", ".ex", ".exs", ".erl", ".hrl", ".clj", ".cljs", ".cljc", ".edn", ".fs", ".fsx", ".fsi", ".ml", ".mli", ".lisp", ".lsp", ".cl", ".scm", ".ss", ".groovy", ".gvy", ".gy", ".gsh", ".ps1", ".psm1", ".psd1", ".r", ".rmd", ".jl", ".nim", ".nims", ".zig", ".v", ".cr", ".d", ".asm", ".s", ".f", ".f90", ".f95", ".f03", ".for", ".cob", ".cbl", ".cobol", ".pas", ".pp", ".p", ".ada", ".adb", ".ads", ".vue", ".svelte", ".hbs", ".handlebars", ".ejs", ".pug", ".jade", ".css", ".scss", ".sass", ".less", ".styl", ".stylus", ".dockerfile", ".mk"];
     readonly CONFIG: readonly [".env", ".ini", ".toml", ".cfg", ".conf", ".config", ".properties", ".editorconfig", ".gitignore", ".gitattributes", ".npmrc", ".yarnrc", ".prettierrc", ".eslintrc", ".babelrc"];
-    readonly ARCHIVES: readonly [".zip", ".tar", ".gz", ".tgz", ".tar.gz", ".tar.bz2", ".bz2", ".rar", ".7z", ".xz"];
-    readonly VIDEO: readonly [".mp4", ".avi", ".mov", ".mkv", ".webm", ".flv", ".wmv", ".m4v", ".mpg", ".mpeg"];
-    readonly AUDIO: readonly [".mp3", ".wav", ".aac", ".flac", ".ogg", ".m4a", ".wma", ".opus"];
+    readonly ARCHIVES: readonly string[];
+    readonly VIDEO: readonly string[];
+    readonly AUDIO: readonly string[];
     readonly DESIGN: readonly [".psd", ".psb", ".ai", ".sketch", ".fig", ".xd"];
     readonly DATABASE: readonly [".db", ".sqlite", ".sqlite3", ".mdb", ".accdb"];
     readonly EXECUTABLE: readonly [".exe", ".dll", ".so", ".dylib", ".app", ".bat", ".cmd", ".vbs", ".ps1", ".msi", ".dmg", ".bin"];