@juspay/neurolink 10.12.4 → 10.12.5

package/dist/processors/document/OpenDocumentProcessor.js

@@ -7,7 +7,9 @@
  * @module processors/document/OpenDocumentProcessor
  */
 import { createRequire } from "node:module";
+import * as zlib from "node:zlib";
 import { BaseFileProcessor } from "../base/BaseFileProcessor.js";
+import { readZipEntryWithinLimit } from "../archive/zipEntryReader.js";
 import { SIZE_LIMITS } from "../config/index.js";
 const require = createRequire(import.meta.url);
 // Re-import for local use within this file
@@ -64,7 +66,17 @@ export class OpenDocumentProcessor extends BaseFileProcessor {
             // Try to get content.xml
             const contentEntry = zip.getEntry("content.xml");
             if (contentEntry) {
-                const xmlContent = contentEntry.getData().toString("utf-8");
+                // Bounded rather than `getData()`: an ODF file is a ZIP, so its
+                // content.xml can declare any uncompressed size it likes, and
+                // `maxSizeMB` only ever saw the compressed archive on the way in.
+                const read = readZipEntryWithinLimit(contentEntry, SIZE_LIMITS.DOCUMENT_MAX_MB * 1024 * 1024, zlib);
+                if (read.status === "too-large") {
+                    throw new Error(`content.xml exceeds the ${SIZE_LIMITS.DOCUMENT_MAX_MB}MB limit for OpenDocument content`);
+                }
+                if (read.status !== "ok") {
+                    throw new Error("content.xml could not be read from the archive");
+                }
+                const xmlContent = read.buffer.toString("utf-8");
                 const extracted = this.extractTextFromXml(xmlContent);
                 textContent = extracted.text;
                 paragraphCount = extracted.paragraphCount;

package/dist/processors/document/PptxProcessor.js

@@ -27,6 +27,47 @@
  * ```
  */
 import AdmZip from "adm-zip";
+import * as zlib from "node:zlib";
+import { readZipEntryWithinLimit } from "../archive/zipEntryReader.js";
+import { SIZE_LIMITS } from "../config/index.js";
+/**
+ * Total budget for everything read out of one presentation.
+ *
+ * This class is a static utility with no `BaseFileProcessor` behind it, so
+ * there is no `maxSizeMB` to inherit and nothing else was bounding these
+ * reads at all — not even a late check. A .pptx is a ZIP, so any entry in it
+ * can declare whatever uncompressed size its author likes.
+ */
+const PPTX_MAX_TOTAL_BYTES = SIZE_LIMITS.DOCUMENT_MAX_MB * 1024 * 1024;
+/**
+ * Read entries out of one presentation, refusing once the total passes budget.
+ *
+ * The budget spans the call rather than each entry: a deck of two hundred
+ * slides that each sit just under a per-entry limit is the obvious way around
+ * one. Returns null for an absent or unreadable entry, which every call site
+ * already treats as "no content here".
+ */
+function createBoundedEntryReader() {
+    let spent = 0;
+    return (entry) => {
+        if (!entry) {
+            return null;
+        }
+        const remaining = PPTX_MAX_TOTAL_BYTES - spent;
+        if (remaining <= 0) {
+            throw new Error(`PPTX content exceeds the ${SIZE_LIMITS.DOCUMENT_MAX_MB}MB limit`);
+        }
+        const read = readZipEntryWithinLimit(entry, remaining, zlib);
+        if (read.status === "too-large") {
+            throw new Error(`PPTX content exceeds the ${SIZE_LIMITS.DOCUMENT_MAX_MB}MB limit`);
+        }
+        if (read.status !== "ok") {
+            return null;
+        }
+        spent += read.buffer.length;
+        return read.buffer.toString("utf-8");
+    };
+}
 /**
  * Regex to match text content within PowerPoint XML `<a:t>` elements.
  * These elements contain the actual visible text on slides.
@@ -63,14 +104,17 @@ export class PptxProcessor {
     static async extractText(content) {
         const zip = new AdmZip(content);
         const entries = zip.getEntries();
+        const readEntry = createBoundedEntryReader();
         // Collect slide entries with their slide numbers for sorting
         const slides = [];
         for (const entry of entries) {
             const match = entry.entryName.match(SLIDE_ENTRY_REGEX);
             if (match) {
                 const slideNumber = parseInt(match[1], 10);
-                const xmlContent = entry.getData().toString("utf-8");
-                slides.push({ slideNumber, xml: xmlContent });
+                const xmlContent = readEntry(entry);
+                if (xmlContent !== null) {
+                    slides.push({ slideNumber, xml: xmlContent });
+                }
             }
         }
         // Sort slides by number (slide1, slide2, ...)
@@ -82,7 +126,7 @@ export class PptxProcessor {
         parts.push(`Presentation: ${slides.length} slide(s)\n`);
         for (const slide of slides) {
             const texts = PptxProcessor.extractTextFromXml(slide.xml);
-            const notes = PptxProcessor.extractNotesForSlide(zip, slide.slideNumber);
+            const notes = PptxProcessor.extractNotesForSlide(zip, slide.slideNumber, readEntry);
             // Emit a slide section when it has either body text or speaker notes.
             if (texts.length > 0 || notes) {
                 parts.push(`### Slide ${slide.slideNumber}`);
@@ -111,12 +155,11 @@ export class PptxProcessor {
      * @param slideNumber - 1-indexed slide number
      * @returns The notes text (runs joined by a space), or null when absent
      */
-    static extractNotesForSlide(zip, slideNumber) {
-        const relsEntry = zip.getEntry(SLIDE_RELS_NAME(slideNumber));
-        if (!relsEntry) {
+    static extractNotesForSlide(zip, slideNumber, readEntry) {
+        const relsXml = readEntry(zip.getEntry(SLIDE_RELS_NAME(slideNumber)));
+        if (relsXml === null) {
             return null;
         }
-        const relsXml = relsEntry.getData().toString("utf-8");
         let notesTarget = null;
         RELATIONSHIP_TAG_REGEX.lastIndex = 0;
         for (let match = RELATIONSHIP_TAG_REGEX.exec(relsXml); match !== null; match = RELATIONSHIP_TAG_REGEX.exec(relsXml)) {
@@ -134,11 +177,11 @@ export class PptxProcessor {
         const normalized = notesTarget
             .replace(/^\.\.\//, "ppt/")
             .replace(/^\/+/, "");
-        const notesEntry = zip.getEntry(normalized);
-        if (!notesEntry) {
+        const notesXml = readEntry(zip.getEntry(normalized));
+        if (notesXml === null) {
             return null;
         }
-        const notes = PptxProcessor.extractTextFromXml(notesEntry.getData().toString("utf-8")).join(" ");
+        const notes = PptxProcessor.extractTextFromXml(notesXml).join(" ");
         return notes.trim() || null;
     }
     /**
@@ -175,6 +218,7 @@ export class PptxProcessor {
     static async extractSlides(content, slideNumbers) {
         const zip = new AdmZip(content);
         const entries = zip.getEntries();
+        const readEntry = createBoundedEntryReader();
         // Collect all slides
         const slides = [];
         for (const entry of entries) {
@@ -182,8 +226,10 @@ export class PptxProcessor {
             if (match) {
                 const slideNumber = parseInt(match[1], 10);
                 if (slideNumbers.includes(slideNumber)) {
-                    const xmlContent = entry.getData().toString("utf-8");
-                    slides.push({ slideNumber, xml: xmlContent });
+                    const xmlContent = readEntry(entry);
+                    if (xmlContent !== null) {
+                        slides.push({ slideNumber, xml: xmlContent });
+                    }
                 }
             }
         }

package/dist/types/processor.d.ts

@@ -774,6 +774,21 @@ export type ArchiveDecompressionResult = {
  * perfectly well-formed, and telling the user it is damaged would send them to
  * re-create a file that was never broken.
  */
+/**
+ * The slice of an adm-zip entry the bounded reader depends on.
+ *
+ * Structural rather than adm-zip's own `IZipEntry` so the reader states what it
+ * actually needs — the compressed bytes and the header fields it refuses to
+ * trust — instead of importing a library type it would then have to satisfy in
+ * full when building a test double.
+ */
+export type BoundedZipEntry = {
+    getCompressedData: () => Buffer;
+    header: {
+        method: number;
+        crc: number;
+    };
+};
 export type ArchiveEntryReadResult = {
     readonly status: "ok";
     readonly buffer: Buffer;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@juspay/neurolink",
-  "version": "10.12.4",
+  "version": "10.12.5",
   "packageManager": "pnpm@10.15.1",
   "description": "TypeScript AI SDK with 24+ LLM providers behind one consistent API. MCP-native (connect any MCP server), voice TTS/STT/realtime, RAG, agents, memory, context compaction. OpenAI · Anthropic · Gemini · Bedrock · Azure · Ollama · DeepSeek · NVIDIA NIM and more.",
   "author": {
@@ -163,7 +163,7 @@
     "test:system-messages": "npx tsx test/continuous-test-suite-system-messages.ts",
     "test:test-stubs": "npx tsx test/continuous-test-suite-test-stubs.ts",
     "test:tool-routing-semantic": "npx tsx test/continuous-test-suite-tool-routing-semantic.ts",
-    "test:unit": "pnpm run test:envguard && pnpm run test:bugfixes && pnpm run test:file-detector-extension && pnpm run test:file-detector-magic-bytes && pnpm run test:mcp:infra && pnpm run test:mcp:bash && pnpm run test:mcp:limits && pnpm run test:mcp:spans && pnpm run test:autoresearch:redis && pnpm run test:tool-routing && pnpm run test:tool-routing-cli && pnpm run test:tool-dedup && pnpm run test:model-pool && pnpm run test:litellm-context && pnpm run test:dedup-execute-map && pnpm run test:step-budget-guard && pnpm run test:agent-plumbing && pnpm run test:tool-execution-recorder && pnpm run test:proxy-terminal-errors && pnpm run test:proxy-usage-refresh && pnpm run test:system-messages && pnpm run test:tool-routing-semantic && pnpm run test:anthropic-tools-policy && pnpm run test:anthropic-structured && pnpm run test:sagemaker-tools && pnpm run test:anthropic-multimodal && pnpm run test:excel-interop && pnpm run test:model-capabilities && pnpm run test:agent-runtime:vitest && pnpm run test:agent-delegation && pnpm run test:retry-after:vitest && pnpm run test:sampling-params && pnpm run test:structured-recovery && pnpm run test:prompt-redaction && pnpm run test:mcp-result-cache && pnpm run test:test-stubs && pnpm run test:model-not-found-retryable && pnpm run test:websearch-grounding && pnpm run test:archive:security",
+    "test:unit": "pnpm run test:envguard && pnpm run test:bugfixes && pnpm run test:file-detector-extension && pnpm run test:file-detector-magic-bytes && pnpm run test:mcp:infra && pnpm run test:mcp:bash && pnpm run test:mcp:limits && pnpm run test:mcp:spans && pnpm run test:autoresearch:redis && pnpm run test:tool-routing && pnpm run test:tool-routing-cli && pnpm run test:tool-dedup && pnpm run test:model-pool && pnpm run test:litellm-context && pnpm run test:dedup-execute-map && pnpm run test:step-budget-guard && pnpm run test:agent-plumbing && pnpm run test:tool-execution-recorder && pnpm run test:proxy-terminal-errors && pnpm run test:proxy-usage-refresh && pnpm run test:system-messages && pnpm run test:tool-routing-semantic && pnpm run test:anthropic-tools-policy && pnpm run test:anthropic-structured && pnpm run test:sagemaker-tools && pnpm run test:anthropic-multimodal && pnpm run test:excel-interop && pnpm run test:model-capabilities && pnpm run test:agent-runtime:vitest && pnpm run test:agent-delegation && pnpm run test:retry-after:vitest && pnpm run test:sampling-params && pnpm run test:structured-recovery && pnpm run test:prompt-redaction && pnpm run test:mcp-result-cache && pnpm run test:test-stubs && pnpm run test:model-not-found-retryable && pnpm run test:websearch-grounding && pnpm run test:archive:security && pnpm run test:office:security",
     "// CI tier — live providers, runs only when API keys are present (test:credentials and test:dynamic make real provider calls when keys are set, so they live here, not in test:unit)": "",
     "test:live": "pnpm run test:providers && pnpm run test:mcp:http && pnpm run test:mcp:sdk && pnpm run test:mcp:cli && pnpm run test:observability && pnpm run test:context && pnpm run test:memory && pnpm run test:tool-reliability && pnpm run test:evaluation && pnpm run test:autoresearch && pnpm run test:credentials && pnpm run test:dynamic",
     "// CI tier — product output (image/video/TTS/PPT) — costs $$ per run": "",
@@ -246,7 +246,8 @@
     "test:structured-recovery": "npx tsx test/continuous-test-suite-structured-recovery.ts",
     "test:prompt-redaction": "npx tsx test/continuous-test-suite-prompt-redaction.ts",
     "test:mcp-result-cache": "npx tsx test/continuous-test-suite-mcp-result-cache.ts",
-    "test:archive:security": "npx tsx test/continuous-test-suite-archive-security.ts"
+    "test:archive:security": "npx tsx test/continuous-test-suite-archive-security.ts",
+    "test:office:security": "npx tsx test/continuous-test-suite-office-security.ts"
   },
   "files": [
     "dist",