@juspay/neurolink 10.11.2 → 10.12.0

package/dist/lib/utils/fileDetector.js

@@ -290,6 +290,13 @@ export class FileDetector {
     // These default ensure consistent timeout behavior across all file-detection logic.
     static DEFAULT_NETWORK_TIMEOUT = 30000; // 30 seconds
     static DEFAULT_HEAD_TIMEOUT = 5000; // 5 seconds
+    /**
+     * Ceiling on an in-process document parse (unzip + XML walk). Generous
+     * relative to the work, because the cost of firing early on a large but
+     * legitimate file is a lost extraction, while the cost of never firing is a
+     * held request.
+     */
+    static DEFAULT_DOCUMENT_TIMEOUT = 30000; // 30 seconds
     /**
      * Auto-detect file type and process in one call
      *
@@ -404,7 +411,14 @@ export class FileDetector {
         if (Buffer.isBuffer(input)) {
             return "buffer";
         }
-        return "unknown-input";
+        // Everything left is a `FileWithMetadata`, which states its own name, and
+        // `withResolvedExtension` reads this to recover an extension when a
+        // content-based strategy reported none. Falling straight through to
+        // "unknown-input" threw that name away, so an `.odp`, `.rtf` or `.tar`
+        // supplied as bytes-plus-name lost the extension its processor routes on.
+        // Still defensive about the value: the type says required, callers are
+        // untyped JavaScript often enough.
+        return input?.filename || "unknown-input";
     }
     /**
      * Derive byte size from FileInput for tracing.
@@ -661,7 +675,7 @@ export class FileDetector {
                     source: FileDetector.deriveInputSource(input),
                     metadata: {
                         confidence: 95,
-                        filename: FileDetector.deriveInputFilename(input),
+                        filename: options?.filenameHint || FileDetector.deriveInputFilename(input),
                         size: FileDetector.deriveInputSize(input),
                     },
                 };
@@ -684,13 +698,68 @@ export class FileDetector {
             }
             if (result.metadata.confidence >= confidenceThreshold) {
                 logger.info(`[FileDetector] Type: ${result.type} (${result.metadata.confidence}%)`);
-                return result;
+                return FileDetector.withResolvedExtension(result, input, options);
             }
         }
         // Below-threshold detection is the common case for any file under the
         // ContentHeuristic ceiling — a debug detail, not a warning-worthy anomaly.
         logger.debug(`[FileDetector] Best-effort type below threshold: ${best?.type ?? "unknown"} (${best?.metadata.confidence ?? 0}%, threshold ${confidenceThreshold}%)`);
-        return best;
+        return FileDetector.withResolvedExtension(best, input, options);
+    }
+    /**
+     * Fill in `extension` from the input's name when detection did not set it.
+     *
+     * Content-based strategies identify a type from magic bytes and legitimately
+     * have no extension to report, so they return null. That is fine for the type
+     * itself but not for routing: several processors are chosen by extension
+     * *after* detection has settled the type, because one routing type covers
+     * several formats — `docx` covers .docx, .odt and .rtf.
+     *
+     * With a null extension those branches were unreachable. An .rtf scored high
+     * on its `{\\rtf1` signature, arrived as type "docx" with no extension, and
+     * fell through to the Word processor, which cannot read RTF — so a file whose
+     * dedicated processor extracts it perfectly reported "Could not extract
+     * content". The extension was known the whole time; it was simply dropped on
+     * the way through.
+     *
+     * Only fills a gap — a strategy that did determine an extension keeps it, so
+     * content still wins over a lying filename.
+     */
+    static withResolvedExtension(result, input, options) {
+        if (!result) {
+            return result;
+        }
+        // The caller's hint outranks a name derived from the input, because on the
+        // unified path the input has already been unwrapped to a bare Buffer and
+        // derives to the literal "buffer" — carrying no extension at all.
+        const filename = options?.filenameHint ||
+            result.metadata?.filename ||
+            FileDetector.deriveInputFilename(input);
+        if (!filename) {
+            return result;
+        }
+        // Split on both separators so a Windows-style path on a POSIX host still
+        // yields its basename, then take the final suffix.
+        const base = filename.split(/[\\/]/).pop() ?? filename;
+        const dot = base.lastIndexOf(".");
+        const extension = result.extension ??
+            (dot > 0 && dot < base.length - 1
+                ? base.slice(dot + 1).toLowerCase()
+                : null);
+        // The name is carried alongside the extension for the same reason. A
+        // content strategy reports no filename, so every processor keyed on one
+        // received the literal fallback "archive" — and archive format detection
+        // reads the name, because TAR has no magic bytes at offset 0 (its "ustar"
+        // marker sits at byte 257). A .tar therefore arrived as an unidentifiable
+        // archive and reported "Could not extract content", while the same bytes
+        // handed to the processor WITH their name extract perfectly.
+        const metadata = result.metadata && !result.metadata.filename
+            ? { ...result.metadata, filename: base }
+            : result.metadata;
+        if (extension === result.extension && metadata === result.metadata) {
+            return result;
+        }
+        return { ...result, extension, metadata };
     }
     /**
      * Load file content from various sources
@@ -1343,6 +1412,40 @@ export class FileDetector {
     static async processPptxFile(content, detection) {
         const pptxFilename = detection.metadata.filename || "presentation";
         try {
+            // ODP is an OpenDocument package, not OOXML — the PPTX reader finds no
+            // ppt/slides parts in it and returns nothing. It reaches this branch at
+            // all because one routing type ("pptx") covers every presentation
+            // format, the same way "docx" covers .odt.
+            if (detection.extension?.toLowerCase() === "odp") {
+                const { openDocumentProcessor } = await import("../processors/document/OpenDocumentProcessor.js");
+                // Bounded per the project's async-timeout guideline: this unzips and
+                // parses attacker-supplied bytes, and a stalled parse would otherwise
+                // hold the request open with no ceiling. On timeout the throw lands in
+                // this block's existing catch, which degrades to the placeholder.
+                const odpResult = await withTimeout(openDocumentProcessor.processFile({
+                    id: pptxFilename,
+                    name: pptxFilename,
+                    mimetype: detection.mimeType ||
+                        "application/vnd.oasis.opendocument.presentation",
+                    size: content.length,
+                    buffer: content,
+                }), FileDetector.DEFAULT_DOCUMENT_TIMEOUT);
+                // Gated on success rather than on text, because a presentation of
+                // nothing but images is a legitimate ODP that extracts to an empty
+                // string. Requiring text sent that file on to the PPTX reader, which
+                // cannot read OpenDocument at all — so a successful extraction was
+                // discarded in favour of a guaranteed failure. Matches how the ODT and
+                // ODS branches degrade.
+                if (odpResult.success && odpResult.data) {
+                    return {
+                        type: "pptx",
+                        content: odpResult.data.textContent ||
+                            FileDetector.formatInformativePlaceholder("Presentation", pptxFilename, content, detection),
+                        mimeType: detection.mimeType,
+                        metadata: detection.metadata,
+                    };
+                }
+            }
             const { PptxProcessor } = await import("../processors/document/PptxProcessor.js");
             const pptxResult = await PptxProcessor.extractText(content);
             if (pptxResult) {
@@ -2003,13 +2106,33 @@ class MagicBytesStrategy {
         if (input.length >= 6 && input.toString("latin1", 0, 5) === "#!AMR") {
             return this.result("audio", "audio/amr", 95);
         }
-        // JPEG 2000: 12-byte signature box.
-        if (input.length >= 8 &&
+        // JPEG 2000: the full 12-byte signature box, trailing 0D 0A 87 0A
+        // included. Those four bytes are a deliberate line-ending probe — CR LF, a
+        // high byte, LF — that any transfer which mangles newlines or strips the
+        // eighth bit will visibly corrupt, so checking only the length and brand
+        // accepts exactly the damaged files the signature exists to reject.
+        if (input.length >= 12 &&
             input[0] === 0x00 &&
             input[1] === 0x00 &&
             input[2] === 0x00 &&
             input[3] === 0x0c &&
-            input.toString("latin1", 4, 8) === "jP  ") {
+            input.toString("latin1", 4, 8) === "jP  " &&
+            input[8] === 0x0d &&
+            input[9] === 0x0a &&
+            input[10] === 0x87 &&
+            input[11] === 0x0a) {
+            return this.result("image", "image/jp2", 95);
+        }
+        // The other shape JPEG 2000 ships in: a bare codestream (.j2k/.j2c) opening
+        // with the SOC + SIZ markers. `ImageProcessor.detectImageType` learned both
+        // shapes; this strategy knew only the container, so a codestream uploaded
+        // as bytes-plus-filename was typed "unknown" and delivered as a binary
+        // blob — the codestream branch over there was unreachable from this path.
+        if (input.length >= 4 &&
+            input[0] === 0xff &&
+            input[1] === 0x4f &&
+            input[2] === 0xff &&
+            input[3] === 0x51) {
             return this.result("image", "image/jp2", 95);
         }
         // MP3: ID3 tag

package/dist/lib/utils/imageProcessor.js

@@ -468,6 +468,37 @@ export class ImageProcessor {
                 if (isoBmffMimeType) {
                     return isoBmffMimeType;
                 }
+                // JPEG 2000, in both shapes it ships in. The JP2 container opens with
+                // the 12-byte signature box `00 00 00 0C 6A 50 20 20 0D 0A 87 0A`; a
+                // bare codestream (.j2k/.j2c) opens with the SOC+SIZ markers FF 4F FF
+                // 51. Checked BEFORE ICO because the container's first three bytes are
+                // 00 00 00, which is one byte away from ICO's 00 00 01 00 and shares
+                // its leading zeros — an ordering mistake here would classify every
+                // JPEG 2000 as an icon rather than merely failing to recognise it.
+                // All twelve bytes are checked, not just the length and brand: the
+                // trailing 0D 0A 87 0A is the signature's whole point. It is a
+                // line-ending probe — CR LF, a high byte, LF — that a transfer which
+                // mangles newlines or strips the eighth bit will visibly corrupt, so
+                // skipping it accepts exactly the damaged files it exists to reject.
+                if (input.length >= 12 &&
+                    input[0] === 0x00 &&
+                    input[1] === 0x00 &&
+                    input[2] === 0x00 &&
+                    input[3] === 0x0c &&
+                    input.subarray(4, 8).toString("latin1") === "jP  " &&
+                    input[8] === 0x0d &&
+                    input[9] === 0x0a &&
+                    input[10] === 0x87 &&
+                    input[11] === 0x0a) {
+                    return "image/jp2";
+                }
+                if (input.length >= 4 &&
+                    input[0] === 0xff &&
+                    input[1] === 0x4f &&
+                    input[2] === 0xff &&
+                    input[3] === 0x51) {
+                    return "image/jp2";
+                }
                 // ICO: 00 00 01 00 (icon type=1)
                 if (input[0] === 0x00 &&
                     input[1] === 0x00 &&

package/dist/lib/utils/messageBuilder.d.ts

@@ -37,15 +37,6 @@ export declare function mergeMediaFileAliases<TFile>(input: {
     audioFiles?: Array<Buffer | string>;
     videoFiles?: Array<Buffer | string>;
 }): void;
-/**
- * Process the unified files array with auto-detection.
- * Handles lazy file registration, full processing, and preview injection.
- *
- * Exported so providers that bypass BaseProvider.generate() (e.g.
- * GoogleVertex's native @google/genai path) can still preprocess
- * `input.files` — without this, mimetype-hint and text-file inputs
- * would silently never reach the model on those paths.
- */
 export declare function processUnifiedFilesArray(options: GenerateOptions, maxSize: number, provider: string): Promise<void>;
 /**
  * Build multimodal message array with image support