@juspay/neurolink 10.12.3 → 10.12.5

package/dist/lib/processors/archive/ArchiveProcessor.js

@@ -37,12 +37,10 @@
  */
 import * as path from "path";
 import { BaseFileProcessor } from "../base/BaseFileProcessor.js";
+import { isDecompressionBoundExceeded, readZipEntryWithinLimit, } from "./zipEntryReader.js";
 import { SIZE_LIMITS_MB } from "../config/index.js";
 import { FileErrorCode } from "../errors/index.js";
 // =============================================================================
-// TYPES
-// =============================================================================
-// =============================================================================
 // SECURITY CONFIGURATION
 // =============================================================================
 /**
@@ -162,17 +160,6 @@ const SINGLE_STREAM_TOOLS = {
     xz: "xz",
     zst: "zstd",
 };
-/**
- * Whether a zlib rejection is the output bound firing rather than bad input.
- *
- * `maxOutputLength` aborts an inflate the moment its output would pass the cap,
- * which is the whole point — but it surfaces as a plain `RangeError`, and a
- * bomb reported as "failed to decompress" reads as a corrupt upload and invites
- * the user to send it again. It will fail identically every time.
- *
- * Keyed on `code`, not the message: the message embeds a byte count.
- */
-const isDecompressionBoundExceeded = (error) => error?.code === "ERR_BUFFER_TOO_LARGE";
 /** File extensions recognized as archive formats */
 const SUPPORTED_ARCHIVE_EXTENSIONS = [".zip", ".tar", ".gz", ".tgz", ".bz2", ".tbz2", ".jar", ".xz", ".txz", ".zst", ".tzst"];
 // =============================================================================
@@ -1368,6 +1355,7 @@ export class ArchiveProcessor extends BaseFileProcessor {
                 .sort((a, b) => a.uncompressedSize - b.uncompressedSize);
             let totalExtracted = 0;
             let extractCount = 0;
+            const zlibModule = await import("zlib");
             for (const entry of candidates) {
                 if (extractCount >= ARCHIVE_CONFIG.MAX_EXTRACT_ENTRIES) {
                     break;
@@ -1380,8 +1368,17 @@ export class ArchiveProcessor extends BaseFileProcessor {
                     if (!zipEntry) {
                         continue;
                     }
-                    const data = zipEntry.getData();
-                    if (!data || data.length === 0) {
+                    // This path was already bounded, but only by coincidence: entries
+                    // declaring 0 are dropped above, oversized declarations are dropped
+                    // above, and adm-zip caps everything else at the size it declares.
+                    // That leaves the ceiling resting on library internals we do not
+                    // trust anywhere else in this file, so it is spelled out here.
+                    const read = readZipEntryWithinLimit(zipEntry, Math.min(ARCHIVE_CONFIG.MAX_EXTRACT_ENTRY_SIZE, ARCHIVE_CONFIG.MAX_TOTAL_EXTRACT_SIZE - totalExtracted), zlibModule);
+                    if (read.status !== "ok") {
+                        continue;
+                    }
+                    const data = read.buffer;
+                    if (data.length === 0) {
                         continue;
                     }
                     // Simple binary detection: check for null bytes in first 512 bytes
@@ -1552,12 +1549,29 @@ export class ArchiveProcessor extends BaseFileProcessor {
             if (targetEntry.isDirectory) {
                 return `"${entryPath}" is a directory, not a file.`;
             }
-            // Security: size check
+            // Security: size check.
+            //
+            // The declared size is a hint, not the bound — it is chosen by whoever
+            // built the archive, and an entry claiming 0 passes this comparison while
+            // switching off adm-zip's own cap (see readZipEntryWithinLimit). It is
+            // still worth checking, because an honestly-declared oversized entry is
+            // refused here without decompressing anything at all.
             const maxSize = 5 * 1024 * 1024; // 5 MB
             if (targetEntry.header.size > maxSize) {
                 return `Entry "${entryPath}" is too large (${this.formatHumanReadableSize(targetEntry.header.size)}). Maximum extraction size is 5 MB.`;
             }
-            const data = targetEntry.getData();
+            const zlibModule = await import("zlib");
+            const read = readZipEntryWithinLimit(targetEntry, maxSize, zlibModule);
+            if (read.status === "too-large") {
+                return `Entry "${entryPath}" is too large. Maximum extraction size is 5 MB.`;
+            }
+            if (read.status === "unsupported-method") {
+                return `Entry "${entryPath}" uses an unsupported compression method.`;
+            }
+            if (read.status === "corrupt") {
+                return `Entry "${entryPath}" could not be read — the archive entry is corrupt.`;
+            }
+            const data = read.buffer;
             // Check if it looks like text
             const sampleSize = Math.min(data.length, 512);
             let printable = 0;

package/dist/lib/processors/archive/zipEntryReader.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Bounded ZIP entry reading, shared by every processor that opens a ZIP.
+ *
+ * Extracted from ArchiveProcessor because the Office formats are ZIPs too:
+ * .pptx and .odt read their entries directly and so can be handed the same
+ * bomb, and need the same refusal. One implementation rather than three means
+ * a correction to the guard lands everywhere at once.
+ *
+ * .docx and .xlsx deliberately do NOT use this. mammoth and exceljs unzip for
+ * themselves and were measured refusing a 400MB bomb at 46MB and 53MB peak,
+ * so wrapping them in a pre-scan bought no safety and roughly tripled the cost
+ * of every ordinary document.
+ *
+ * @module processors/archive/zipEntryReader
+ */
+import type { ArchiveEntryReadResult, BoundedZipEntry } from "../../types/index.js";
+/** ZIP compression methods this reader handles (APPNOTE 4.4.5). */
+export declare const ZIP_METHOD_STORED = 0;
+export declare const ZIP_METHOD_DEFLATED = 8;
+/**
+ * Whether a zlib rejection is the output bound firing rather than bad input.
+ *
+ * `maxOutputLength` aborts an inflate the moment its output would pass the cap,
+ * which is the whole point — but it surfaces as a plain `RangeError`, and a
+ * bomb reported as "failed to decompress" reads as a corrupt upload and invites
+ * the user to send it again. It will fail identically every time.
+ *
+ * Keyed on `code`, not the message: the message embeds a byte count.
+ */
+export declare const isDecompressionBoundExceeded: (error: unknown) => boolean;
+/**
+ * Read one ZIP entry's bytes without trusting the size it declares.
+ *
+ * `entry.getData()` cannot be used for this. It sizes its output buffer from
+ * the central-directory `size` field, which the archive author chooses, and
+ * adm-zip only arms its own guard when that field is positive:
+ *
+ *   const option = version >= 15 && expectedLength > 0
+ *     ? { maxOutputLength: expectedLength } : {};
+ *
+ * So an entry declaring 0 disables the bound and the caller's `size > maxSize`
+ * check in one move — `0 > 5MB` is false, and the inflate then runs uncapped.
+ * The declared size is the attack, so nothing here may depend on it: the cap
+ * comes from our own limit and is handed to the decoder.
+ *
+ * CRC is verified on both paths rather than dropped, so bypassing `getData()`
+ * does not also quietly lose its corruption check — a STORED entry is copied
+ * out rather than decoded, but it can be damaged just the same. It detects
+ * damage, not malice — the CRC field is attacker-controlled too.
+ */
+export declare function readZipEntryWithinLimit(entry: BoundedZipEntry, maxBytes: number, zlibModule: typeof import("zlib")): ArchiveEntryReadResult;

package/dist/lib/processors/archive/zipEntryReader.js

@@ -0,0 +1,81 @@
+/**
+ * Bounded ZIP entry reading, shared by every processor that opens a ZIP.
+ *
+ * Extracted from ArchiveProcessor because the Office formats are ZIPs too:
+ * .pptx and .odt read their entries directly and so can be handed the same
+ * bomb, and need the same refusal. One implementation rather than three means
+ * a correction to the guard lands everywhere at once.
+ *
+ * .docx and .xlsx deliberately do NOT use this. mammoth and exceljs unzip for
+ * themselves and were measured refusing a 400MB bomb at 46MB and 53MB peak,
+ * so wrapping them in a pre-scan bought no safety and roughly tripled the cost
+ * of every ordinary document.
+ *
+ * @module processors/archive/zipEntryReader
+ */
+/** ZIP compression methods this reader handles (APPNOTE 4.4.5). */
+export const ZIP_METHOD_STORED = 0;
+export const ZIP_METHOD_DEFLATED = 8;
+/**
+ * Whether a zlib rejection is the output bound firing rather than bad input.
+ *
+ * `maxOutputLength` aborts an inflate the moment its output would pass the cap,
+ * which is the whole point — but it surfaces as a plain `RangeError`, and a
+ * bomb reported as "failed to decompress" reads as a corrupt upload and invites
+ * the user to send it again. It will fail identically every time.
+ *
+ * Keyed on `code`, not the message: the message embeds a byte count.
+ */
+export const isDecompressionBoundExceeded = (error) => error?.code === "ERR_BUFFER_TOO_LARGE";
+/**
+ * Read one ZIP entry's bytes without trusting the size it declares.
+ *
+ * `entry.getData()` cannot be used for this. It sizes its output buffer from
+ * the central-directory `size` field, which the archive author chooses, and
+ * adm-zip only arms its own guard when that field is positive:
+ *
+ *   const option = version >= 15 && expectedLength > 0
+ *     ? { maxOutputLength: expectedLength } : {};
+ *
+ * So an entry declaring 0 disables the bound and the caller's `size > maxSize`
+ * check in one move — `0 > 5MB` is false, and the inflate then runs uncapped.
+ * The declared size is the attack, so nothing here may depend on it: the cap
+ * comes from our own limit and is handed to the decoder.
+ *
+ * CRC is verified on both paths rather than dropped, so bypassing `getData()`
+ * does not also quietly lose its corruption check — a STORED entry is copied
+ * out rather than decoded, but it can be damaged just the same. It detects
+ * damage, not malice — the CRC field is attacker-controlled too.
+ */
+export function readZipEntryWithinLimit(entry, maxBytes, zlibModule) {
+    const compressed = entry.getCompressedData();
+    const matchesCrc = (data) => (zlibModule.crc32(data) >>> 0) === (entry.header.crc >>> 0);
+    // STORED: the bytes are already the payload, so its own length is the bound.
+    if (entry.header.method === ZIP_METHOD_STORED) {
+        if (compressed.length > maxBytes) {
+            return { status: "too-large" };
+        }
+        return matchesCrc(compressed)
+            ? { status: "ok", buffer: compressed }
+            : { status: "corrupt" };
+    }
+    if (entry.header.method !== ZIP_METHOD_DEFLATED) {
+        return { status: "unsupported-method" };
+    }
+    let inflated;
+    try {
+        inflated = zlibModule.inflateRawSync(compressed, {
+            maxOutputLength: maxBytes,
+        });
+    }
+    catch (error) {
+        if (isDecompressionBoundExceeded(error)) {
+            return { status: "too-large" };
+        }
+        return { status: "corrupt" };
+    }
+    return matchesCrc(inflated)
+        ? { status: "ok", buffer: inflated }
+        : { status: "corrupt" };
+}
+//# sourceMappingURL=zipEntryReader.js.map

package/dist/lib/processors/base/BaseFileProcessor.d.ts

@@ -181,6 +181,25 @@ export declare abstract class BaseFileProcessor<T extends ProcessedFileBase> {
      * @throws Error if download fails
      */
     protected downloadFile(url: string, authHeaders?: Record<string, string>, timeout?: number): Promise<Buffer>;
+    /**
+     * Read a response body, refusing it the moment it passes `maxBytes`.
+     *
+     * `response.arrayBuffer()` buffers whatever the server sends before anyone
+     * can object, so the size check further up only ever ran against a body that
+     * had already been paid for in full. Metering the stream makes the ceiling
+     * the configured limit instead of the server's choice, and cancelling the
+     * reader stops the transfer rather than merely stopping our interest in it.
+     *
+     * Content-Length is deliberately not trusted as the bound — it is a hint that
+     * can be absent or a lie — but it is worth honouring when present, because it
+     * refuses the honest oversized case without reading a byte.
+     *
+     * @param response - Fetch response whose body should be read
+     * @param maxBytes - Ceiling for the body, in bytes
+     * @returns The body as a Buffer
+     * @throws When the body exceeds `maxBytes`
+     */
+    private readBodyWithinLimit;
     /**
      * Download file with retry logic for transient failures.
      *

package/dist/lib/processors/base/BaseFileProcessor.js

@@ -52,6 +52,30 @@ import { tracers } from "../../telemetry/tracers.js";
 import { createFileError, extractHttpStatus, FileErrorCode, isRetryableError, } from "../errors/index.js";
 import { DEFAULT_RETRY_CONFIG } from "../../types/index.js";
 const gunzipAsync = promisify(gunzip);
+/**
+ * Marker on the error raised when a download is refused for exceeding the
+ * processor's size limit.
+ *
+ * A code rather than a message match, for two reasons. `classifyDownloadError`
+ * can then report FILE_TOO_LARGE — the same verdict the post-download check
+ * gave, so refusing earlier does not quietly downgrade the error a caller
+ * sees to DOWNLOAD_FAILED. And `isRetryableError` decides from text; a bound
+ * that fires is not a transient fault, and re-fetching a file that will be
+ * exactly as oversized next time is the one thing worth not doing three times.
+ */
+const DOWNLOAD_TOO_LARGE_CODE = "DOWNLOAD_TOO_LARGE";
+function downloadTooLargeError(maxSizeMB, typeName) {
+    const error = new Error(`Download exceeds the maximum size of ${maxSizeMB} MB for ${typeName}`);
+    error.code = DOWNLOAD_TOO_LARGE_CODE;
+    return error;
+}
+function isDownloadTooLarge(error) {
+    return (error?.code === DOWNLOAD_TOO_LARGE_CODE);
+}
+/** Node's signal that a zlib output bound was reached. */
+function isBufferTooLargeError(error) {
+    return (error?.code === "ERR_BUFFER_TOO_LARGE");
+}
 /**
  * Abstract base class for file processors.
  * Provides common download, validation, and error handling functionality.
@@ -389,8 +413,8 @@ export class BaseFileProcessor {
             if (contentType && contentType.includes("text/html")) {
                 throw new Error(`Received HTML response instead of file content (Content-Type: ${contentType}). This usually means the download URL returned an error page.`);
             }
-            const arrayBuffer = await response.arrayBuffer();
-            let buffer = Buffer.from(arrayBuffer);
+            const maxBytes = this.config.maxSizeMB * 1024 * 1024;
+            let buffer = await this.readBodyWithinLimit(response, maxBytes);
             // Check for gzip encoding and decompress if needed
             // Only decompress if the data actually starts with gzip magic bytes (0x1f 0x8b)
             const contentEncoding = response.headers.get("Content-Encoding");
@@ -398,9 +422,16 @@ export class BaseFileProcessor {
             if (contentEncoding?.toLowerCase().includes("gzip") &&
                 isActuallyGzipped) {
                 try {
-                    buffer = Buffer.from(await gunzipAsync(buffer));
+                    // Bounded at the decoder. The size check that runs after the download
+                    // only ever sees what already fits in memory, so a few KB of gzip
+                    // declaring gigabytes was inflated in full before anything objected —
+                    // the response passed the "is it small" test on its way in.
+                    buffer = Buffer.from(await gunzipAsync(buffer, { maxOutputLength: maxBytes }));
                 }
                 catch (gzipError) {
+                    if (isBufferTooLargeError(gzipError)) {
+                        throw downloadTooLargeError(this.config.maxSizeMB, this.config.fileTypeName);
+                    }
                     throw new Error(`Failed to decompress gzip response: ${gzipError instanceof Error ? gzipError.message : String(gzipError)}`, { cause: gzipError });
                 }
             }
@@ -408,7 +439,68 @@ export class BaseFileProcessor {
         }
         finally {
             clearTimeout(timeoutId);
+            // Release the connection on every early exit. Rejecting a response for
+            // its status or its Content-Type leaves the body unread, which keeps the
+            // socket out of the pool until the response is garbage-collected. After
+            // a successful read there is nothing left in flight, so this is a no-op.
+            controller.abort();
+        }
+    }
+    /**
+     * Read a response body, refusing it the moment it passes `maxBytes`.
+     *
+     * `response.arrayBuffer()` buffers whatever the server sends before anyone
+     * can object, so the size check further up only ever ran against a body that
+     * had already been paid for in full. Metering the stream makes the ceiling
+     * the configured limit instead of the server's choice, and cancelling the
+     * reader stops the transfer rather than merely stopping our interest in it.
+     *
+     * Content-Length is deliberately not trusted as the bound — it is a hint that
+     * can be absent or a lie — but it is worth honouring when present, because it
+     * refuses the honest oversized case without reading a byte.
+     *
+     * @param response - Fetch response whose body should be read
+     * @param maxBytes - Ceiling for the body, in bytes
+     * @returns The body as a Buffer
+     * @throws When the body exceeds `maxBytes`
+     */
+    async readBodyWithinLimit(response, maxBytes) {
+        const declared = Number(response.headers.get("Content-Length"));
+        if (Number.isFinite(declared) && declared > maxBytes) {
+            // Release the socket. An unread body keeps the connection out of the
+            // pool until the response is collected, so a run of oversized downloads
+            // would hold one socket open each.
+            await response.body?.cancel();
+            throw downloadTooLargeError(this.config.maxSizeMB, this.config.fileTypeName);
+        }
+        // Some responses carry no readable stream (mocked fetch, polyfills). The
+        // buffered read is the fallback, still checked — just after the fact.
+        if (!response.body) {
+            const buffered = Buffer.from(await response.arrayBuffer());
+            if (buffered.length > maxBytes) {
+                throw downloadTooLargeError(this.config.maxSizeMB, this.config.fileTypeName);
+            }
+            return buffered;
+        }
+        const reader = response.body.getReader();
+        const chunks = [];
+        let total = 0;
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done) {
+                break;
+            }
+            if (!value) {
+                continue;
+            }
+            total += value.byteLength;
+            if (total > maxBytes) {
+                await reader.cancel();
+                throw downloadTooLargeError(this.config.maxSizeMB, this.config.fileTypeName);
+            }
+            chunks.push(Buffer.from(value));
         }
+        return Buffer.concat(chunks, total);
     }
     /**
      * Download file with retry logic for transient failures.
@@ -559,6 +651,15 @@ export class BaseFileProcessor {
      * @returns Structured file processing error
      */
     classifyDownloadError(error) {
+        // Refusing an oversized body mid-stream is the same verdict the old
+        // post-download check gave, so it must carry the same code — otherwise
+        // bounding the read earlier would silently reclassify a familiar error.
+        if (isDownloadTooLarge(error)) {
+            return this.createError(FileErrorCode.FILE_TOO_LARGE, {
+                maxMB: this.config.maxSizeMB,
+                type: this.config.fileTypeName,
+            }, error);
+        }
         if (isAbortError(error)) {
             return this.createError(FileErrorCode.DOWNLOAD_TIMEOUT, { timeoutMs: this.config.timeoutMs }, error);
         }

package/dist/lib/processors/document/OpenDocumentProcessor.js

@@ -7,7 +7,9 @@
  * @module processors/document/OpenDocumentProcessor
  */
 import { createRequire } from "node:module";
+import * as zlib from "node:zlib";
 import { BaseFileProcessor } from "../base/BaseFileProcessor.js";
+import { readZipEntryWithinLimit } from "../archive/zipEntryReader.js";
 import { SIZE_LIMITS } from "../config/index.js";
 const require = createRequire(import.meta.url);
 // Re-import for local use within this file
@@ -64,7 +66,17 @@ export class OpenDocumentProcessor extends BaseFileProcessor {
             // Try to get content.xml
             const contentEntry = zip.getEntry("content.xml");
             if (contentEntry) {
-                const xmlContent = contentEntry.getData().toString("utf-8");
+                // Bounded rather than `getData()`: an ODF file is a ZIP, so its
+                // content.xml can declare any uncompressed size it likes, and
+                // `maxSizeMB` only ever saw the compressed archive on the way in.
+                const read = readZipEntryWithinLimit(contentEntry, SIZE_LIMITS.DOCUMENT_MAX_MB * 1024 * 1024, zlib);
+                if (read.status === "too-large") {
+                    throw new Error(`content.xml exceeds the ${SIZE_LIMITS.DOCUMENT_MAX_MB}MB limit for OpenDocument content`);
+                }
+                if (read.status !== "ok") {
+                    throw new Error("content.xml could not be read from the archive");
+                }
+                const xmlContent = read.buffer.toString("utf-8");
                 const extracted = this.extractTextFromXml(xmlContent);
                 textContent = extracted.text;
                 paragraphCount = extracted.paragraphCount;

package/dist/lib/processors/document/PptxProcessor.js

@@ -27,6 +27,47 @@
  * ```
  */
 import AdmZip from "adm-zip";
+import * as zlib from "node:zlib";
+import { readZipEntryWithinLimit } from "../archive/zipEntryReader.js";
+import { SIZE_LIMITS } from "../config/index.js";
+/**
+ * Total budget for everything read out of one presentation.
+ *
+ * This class is a static utility with no `BaseFileProcessor` behind it, so
+ * there is no `maxSizeMB` to inherit and nothing else was bounding these
+ * reads at all — not even a late check. A .pptx is a ZIP, so any entry in it
+ * can declare whatever uncompressed size its author likes.
+ */
+const PPTX_MAX_TOTAL_BYTES = SIZE_LIMITS.DOCUMENT_MAX_MB * 1024 * 1024;
+/**
+ * Read entries out of one presentation, refusing once the total passes budget.
+ *
+ * The budget spans the call rather than each entry: a deck of two hundred
+ * slides that each sit just under a per-entry limit is the obvious way around
+ * one. Returns null for an absent or unreadable entry, which every call site
+ * already treats as "no content here".
+ */
+function createBoundedEntryReader() {
+    let spent = 0;
+    return (entry) => {
+        if (!entry) {
+            return null;
+        }
+        const remaining = PPTX_MAX_TOTAL_BYTES - spent;
+        if (remaining <= 0) {
+            throw new Error(`PPTX content exceeds the ${SIZE_LIMITS.DOCUMENT_MAX_MB}MB limit`);
+        }
+        const read = readZipEntryWithinLimit(entry, remaining, zlib);
+        if (read.status === "too-large") {
+            throw new Error(`PPTX content exceeds the ${SIZE_LIMITS.DOCUMENT_MAX_MB}MB limit`);
+        }
+        if (read.status !== "ok") {
+            return null;
+        }
+        spent += read.buffer.length;
+        return read.buffer.toString("utf-8");
+    };
+}
 /**
  * Regex to match text content within PowerPoint XML `<a:t>` elements.
  * These elements contain the actual visible text on slides.
@@ -63,14 +104,17 @@ export class PptxProcessor {
     static async extractText(content) {
         const zip = new AdmZip(content);
         const entries = zip.getEntries();
+        const readEntry = createBoundedEntryReader();
         // Collect slide entries with their slide numbers for sorting
         const slides = [];
         for (const entry of entries) {
             const match = entry.entryName.match(SLIDE_ENTRY_REGEX);
             if (match) {
                 const slideNumber = parseInt(match[1], 10);
-                const xmlContent = entry.getData().toString("utf-8");
-                slides.push({ slideNumber, xml: xmlContent });
+                const xmlContent = readEntry(entry);
+                if (xmlContent !== null) {
+                    slides.push({ slideNumber, xml: xmlContent });
+                }
             }
         }
         // Sort slides by number (slide1, slide2, ...)
@@ -82,7 +126,7 @@ export class PptxProcessor {
         parts.push(`Presentation: ${slides.length} slide(s)\n`);
         for (const slide of slides) {
             const texts = PptxProcessor.extractTextFromXml(slide.xml);
-            const notes = PptxProcessor.extractNotesForSlide(zip, slide.slideNumber);
+            const notes = PptxProcessor.extractNotesForSlide(zip, slide.slideNumber, readEntry);
             // Emit a slide section when it has either body text or speaker notes.
             if (texts.length > 0 || notes) {
                 parts.push(`### Slide ${slide.slideNumber}`);
@@ -111,12 +155,11 @@ export class PptxProcessor {
      * @param slideNumber - 1-indexed slide number
      * @returns The notes text (runs joined by a space), or null when absent
      */
-    static extractNotesForSlide(zip, slideNumber) {
-        const relsEntry = zip.getEntry(SLIDE_RELS_NAME(slideNumber));
-        if (!relsEntry) {
+    static extractNotesForSlide(zip, slideNumber, readEntry) {
+        const relsXml = readEntry(zip.getEntry(SLIDE_RELS_NAME(slideNumber)));
+        if (relsXml === null) {
             return null;
         }
-        const relsXml = relsEntry.getData().toString("utf-8");
         let notesTarget = null;
         RELATIONSHIP_TAG_REGEX.lastIndex = 0;
         for (let match = RELATIONSHIP_TAG_REGEX.exec(relsXml); match !== null; match = RELATIONSHIP_TAG_REGEX.exec(relsXml)) {
@@ -134,11 +177,11 @@ export class PptxProcessor {
         const normalized = notesTarget
             .replace(/^\.\.\//, "ppt/")
             .replace(/^\/+/, "");
-        const notesEntry = zip.getEntry(normalized);
-        if (!notesEntry) {
+        const notesXml = readEntry(zip.getEntry(normalized));
+        if (notesXml === null) {
             return null;
         }
-        const notes = PptxProcessor.extractTextFromXml(notesEntry.getData().toString("utf-8")).join(" ");
+        const notes = PptxProcessor.extractTextFromXml(notesXml).join(" ");
         return notes.trim() || null;
     }
     /**
@@ -175,6 +218,7 @@ export class PptxProcessor {
     static async extractSlides(content, slideNumbers) {
         const zip = new AdmZip(content);
         const entries = zip.getEntries();
+        const readEntry = createBoundedEntryReader();
         // Collect all slides
         const slides = [];
         for (const entry of entries) {
@@ -182,8 +226,10 @@ export class PptxProcessor {
             if (match) {
                 const slideNumber = parseInt(match[1], 10);
                 if (slideNumbers.includes(slideNumber)) {
-                    const xmlContent = entry.getData().toString("utf-8");
-                    slides.push({ slideNumber, xml: xmlContent });
+                    const xmlContent = readEntry(entry);
+                    if (xmlContent !== null) {
+                        slides.push({ slideNumber, xml: xmlContent });
+                    }
                 }
             }
         }

package/dist/lib/types/processor.d.ts

@@ -761,6 +761,44 @@ export type ArchiveDecompressionResult = {
 } | {
     readonly status: "failed";
 };
+/**
+ * Outcome of reading one ZIP entry under an explicit output bound.
+ *
+ * Separate from {@link ArchiveDecompressionResult} because the failures differ:
+ * a single-stream archive can fail for want of an external tool, while a ZIP
+ * entry can instead use a compression method this reader does not implement.
+ * Collapsing them would force one caller to handle a state it can never see.
+ *
+ * `too-large` is a distinct outcome rather than a corrupt-file error because it
+ * is a verdict about our limit, not about the archive: the entry may be
+ * perfectly well-formed, and telling the user it is damaged would send them to
+ * re-create a file that was never broken.
+ */
+/**
+ * The slice of an adm-zip entry the bounded reader depends on.
+ *
+ * Structural rather than adm-zip's own `IZipEntry` so the reader states what it
+ * actually needs — the compressed bytes and the header fields it refuses to
+ * trust — instead of importing a library type it would then have to satisfy in
+ * full when building a test double.
+ */
+export type BoundedZipEntry = {
+    getCompressedData: () => Buffer;
+    header: {
+        method: number;
+        crc: number;
+    };
+};
+export type ArchiveEntryReadResult = {
+    readonly status: "ok";
+    readonly buffer: Buffer;
+} | {
+    readonly status: "too-large";
+} | {
+    readonly status: "unsupported-method";
+} | {
+    readonly status: "corrupt";
+};
 /**
  * Metadata about an individual entry within an archive.
  */