@juspay/neurolink 10.4.4 → 10.5.1

package/dist/lib/processors/config/mimeConstants.js

@@ -283,6 +283,8 @@ export const EXTENSION_MIME_MAP = {
     ".webp": IMAGE_MIME_TYPES.WEBP,
     ".bmp": IMAGE_MIME_TYPES.BMP,
     ".ico": IMAGE_MIME_TYPES.ICO,
+    ".heic": IMAGE_MIME_TYPES.HEIC,
+    ".heif": IMAGE_MIME_TYPES.HEIF,
     // Source code
     ".js": TEXT_MIME_TYPES.JAVASCRIPT,
     ".mjs": TEXT_MIME_TYPES.JAVASCRIPT,

package/dist/lib/server/routes/claudeProxyRoutes.d.ts

@@ -249,6 +249,17 @@ export declare function parseClaudeErrorBody(errBody: string): ParsedClaudeError
  * Detect malformed request errors that should not trigger account/provider failover.
  */
 export declare function isInvalidRequestError(status: number, errBody: string): boolean;
+/**
+ * A subscription-specific beta rejection. Anthropic returns
+ * `400 invalid_request_error` with a message like
+ * "The long context beta is not yet available for this subscription." when an
+ * account's plan tier does not grant an optional beta the proxy injected (see
+ * CLAUDE_CODE_OAUTH_BETAS in anthropicOAuth.ts). Unlike a genuinely malformed
+ * request, the SAME request can succeed on a different account whose tier
+ * grants the beta — so this must be treated as retryable on the next account
+ * rather than a terminal client-facing 400.
+ */
+export declare function isSubscriptionBetaRejection(status: number, errBody: string): boolean;
 /**
  * Backward-compatible alias — delegates to the shared translation engine.
  */

package/dist/lib/server/routes/claudeProxyRoutes.js

@@ -3131,6 +3131,38 @@ async function handleAnthropicNonOkResponse(args) {
         durationMs: Date.now() - fetchStartMs,
     });
     if (isInvalidRequestError(response.status, errBody)) {
+        if (isSubscriptionBetaRejection(response.status, errBody)) {
+            // Subscription-specific beta rejection (an account whose plan tier lacks
+            // an optional beta the proxy injected). The SAME request can succeed on
+            // another account whose tier grants the beta — or on a fallback provider —
+            // so advance to the next account instead of failing the client here.
+            //
+            // Deliberately do NOT store this in `currentInvalidRequestFailure`: that
+            // field is a deterministic "malformed request" signal that both
+            // suppresses provider fallback (shouldAttemptClaudeFallback) and outranks
+            // transient/rate-limit failures in the final response. A beta rejection is
+            // neither terminal nor higher-priority — a later account's real 429/5xx
+            // must still take precedence, and fallback must stay eligible. The reason
+            // is carried in `lastError`, so if every account rejects the beta the
+            // exhaustion response still explains why.
+            logger.always(`[proxy] ← ${response.status} account=${account.label} beta unavailable for subscription; advancing to next account`);
+            logAttempt(response.status, "invalid_request_error", summarizeErrorMessage(errBody));
+            tracer?.setError("invalid_request_error", summarizeErrorMessage(errBody));
+            tracer?.recordRetry(account.label, "beta_unavailable");
+            // A tier's lack of a beta is stable, not transient — advance the
+            // fill-first primary pointer (like the auth/rate-limit rotation paths) so
+            // this account stops being retried first on every future request.
+            advancePrimaryIfCurrent(account.key, enabledAccounts.length, orderedAccounts[0]?.key);
+            currentLastError = summarizeErrorMessage(errBody);
+            return {
+                continueLoop: true,
+                lastError: currentLastError,
+                authFailureMessage: currentAuthFailureMessage,
+                sawTransientFailure: currentSawTransientFailure,
+                invalidRequestFailure: currentInvalidRequestFailure,
+                upstreamSpan: undefined,
+            };
+        }
         logger.always(`[proxy] ← ${response.status} upstream invalid_request_error`);
         logAttempt(response.status, "invalid_request_error", summarizeErrorMessage(errBody));
         tracer?.setError("invalid_request_error", summarizeErrorMessage(errBody));
@@ -4613,6 +4645,29 @@ export function isInvalidRequestError(status, errBody) {
     return (parsed.errorType === "invalid_request_error" ||
         errBody.includes("invalid_request_error"));
 }
+/**
+ * A subscription-specific beta rejection. Anthropic returns
+ * `400 invalid_request_error` with a message like
+ * "The long context beta is not yet available for this subscription." when an
+ * account's plan tier does not grant an optional beta the proxy injected (see
+ * CLAUDE_CODE_OAUTH_BETAS in anthropicOAuth.ts). Unlike a genuinely malformed
+ * request, the SAME request can succeed on a different account whose tier
+ * grants the beta — so this must be treated as retryable on the next account
+ * rather than a terminal client-facing 400.
+ */
+export function isSubscriptionBetaRejection(status, errBody) {
+    if (status !== 400) {
+        return false;
+    }
+    const parsed = parseClaudeErrorBody(errBody);
+    if (parsed.errorType !== "invalid_request_error") {
+        return false;
+    }
+    const message = (parsed.message ?? "").toLowerCase();
+    return (message.includes("beta") &&
+        message.includes("subscription") &&
+        message.includes("available"));
+}
 function normalizeClaudeRequestForAnthropic(body) {
     return {
         ...body,

package/dist/lib/utils/fileDetector.js

@@ -23,6 +23,7 @@ async function getArchiveProcessor() {
 import { tracers, ATTR, withSpan } from "../telemetry/index.js";
 import { CSVProcessor } from "./csvProcessor.js";
 import { ImageProcessor } from "./imageProcessor.js";
+import { detectIsoBmffImageMimeType, hasFtypBoxSignature } from "./isoBmff.js";
 import { logger } from "./logger.js";
 import { withTimeout } from "./errorHandling.js";
 import { normalizeUrlForCache, redactUrlForError, sanitizeErrorCause, } from "./logSanitize.js";
@@ -1659,17 +1660,35 @@ class MagicBytesStrategy {
         if (this.isWebP(input)) {
             return this.result("image", "image/webp", 95);
         }
+        if (input.length >= 2 && input[0] === 0x42 && input[1] === 0x4d) {
+            return this.result("image", "image/bmp", 95);
+        }
+        if (input.length >= 4 &&
+            ((input[0] === 0x49 &&
+                input[1] === 0x49 &&
+                input[2] === 0x2a &&
+                input[3] === 0x00) ||
+                (input[0] === 0x4d &&
+                    input[1] === 0x4d &&
+                    input[2] === 0x00 &&
+                    input[3] === 0x2a))) {
+            return this.result("image", "image/tiff", 95);
+        }
+        if (input.length >= 4 &&
+            input[0] === 0x00 &&
+            input[1] === 0x00 &&
+            input[2] === 0x01 &&
+            input[3] === 0x00 &&
+            !hasFtypBoxSignature(input)) {
+            return this.result("image", "image/x-icon", 95);
+        }
         if (this.isPDF(input)) {
             return this.result("pdf", "application/pdf", 95);
         }
         // ISO-BMFF ("ftyp" at offset 4): MP4 video, QuickTime MOV, or M4A/M4B/M4P
         // audio all share this box — disambiguate by the major brand at offset 8-11,
         // otherwise an .m4a audio file is misrouted to the video pipeline.
-        if (input.length >= 8 &&
-            input[4] === 0x66 &&
-            input[5] === 0x74 &&
-            input[6] === 0x79 &&
-            input[7] === 0x70) {
+        if (hasFtypBoxSignature(input)) {
             const brand = input.length >= 12 ? input.toString("latin1", 8, 12) : "";
             // AVIF images share the ISO-BMFF ftyp box with MP4/MOV; the major brand
             // ('avif' still, 'avis' sequence, 'avio' intra-only AV1 image/sequence
@@ -1677,8 +1696,9 @@ class MagicBytesStrategy {
             // major_brand by real encoders) distinguishes them. Detect before the
             // audio/video branches so an AVIF buffer isn't misrouted to the video
             // pipeline (#286).
-            if (/^(avif|avis|avio)/.test(brand)) {
-                return this.result("image", "image/avif", 95);
+            const imageMimeType = detectIsoBmffImageMimeType(input);
+            if (imageMimeType) {
+                return this.result("image", imageMimeType, 95);
             }
             if (/^(M4A|M4B|M4P|F4A|F4B)/.test(brand)) {
                 return this.result("audio", "audio/mp4", 95);
@@ -1775,6 +1795,16 @@ class MagicBytesStrategy {
         if (input.length >= 2 && input[0] === 0x1f && input[1] === 0x8b) {
             return this.result("archive", "application/gzip", 90);
         }
+        // 7z: 37 7A BC AF 27 1C
+        if (input.length >= 6 &&
+            input[0] === 0x37 &&
+            input[1] === 0x7a &&
+            input[2] === 0xbc &&
+            input[3] === 0xaf &&
+            input[4] === 0x27 &&
+            input[5] === 0x1c) {
+            return this.result("archive", "application/x-7z-compressed", 95);
+        }
         // RAR: "Rar!"
         if (input.length >= 4 &&
             input[0] === 0x52 &&
@@ -2006,6 +2036,8 @@ class ExtensionStrategy {
             // AI providers don't support SVG format, so we process it as sanitized text
             svg: "svg",
             avif: "image",
+            heic: "image",
+            heif: "image",
             pdf: "pdf",
             // Video formats
             mp4: "video",
@@ -2179,6 +2211,8 @@ class ExtensionStrategy {
             tif: "image/tiff",
             svg: "image/svg+xml",
             avif: "image/avif",
+            heic: "image/heic",
+            heif: "image/heif",
             pdf: "application/pdf",
             // Video MIME types
             mp4: "video/mp4",

package/dist/lib/utils/imageProcessor.js

@@ -11,6 +11,7 @@ import { SYSTEM_LIMITS } from "../core/constants.js";
 import { SIZE_LIMITS_BYTES } from "../processors/config/sizeLimits.js";
 import { getImageCache } from "./imageCache.js";
 import { ErrorFactory, NeuroLinkError } from "./errorHandling.js";
+import { detectIsoBmffImageMimeType, hasFtypBoxSignature } from "./isoBmff.js";
 /**
  * Minimum bytes required just to detect an image format from magic bytes (#293).
  */
@@ -104,7 +105,7 @@ function isRetryableDownloadError(error) {
 }
 /**
  * Reject `detectImageType()`'s `application/octet-stream` sentinel — the
- * honest "no known image signature (PNG/JPEG/GIF/WebP/BMP/TIFF/SVG/AVIF)
+ * honest "no known image signature (PNG/JPEG/GIF/WebP/BMP/TIFF/ICO/SVG/AVIF/HEIC/HEIF)
  * matched" fallback (#261/#286). Packaging that sentinel into a data URI
  * hands vision providers (OpenAI/Anthropic/Google) a MIME type they reject
  * outright with an HTTP 400, so every public conversion path that turns
@@ -118,7 +119,7 @@ function assertKnownImageType(mediaType) {
     if (mediaType === "application/octet-stream") {
         logger.error("Unable to detect a supported image format from file content");
         throw new Error("Unsupported or corrupted image: no known image signature " +
-            "(PNG/JPEG/GIF/WebP/BMP/TIFF/SVG/AVIF) was found in the file content.");
+            "(PNG/JPEG/GIF/WebP/BMP/TIFF/ICO/SVG/AVIF/HEIC/HEIF) was found in the file content.");
     }
 }
 /**
@@ -457,24 +458,22 @@ export class ImageProcessor {
                         return "image/svg+xml";
                     }
                 }
-                // AVIF (ISOBMFF): "ftyp" box at offset 4, major brand at offset 8.
-                // Accept the AVIF-spec brand variants — 'avif' (still image), 'avis'
-                // (image sequence), and 'avio' (intra-only AV1 image/sequence — the
-                // spec lists it under compatible_brands rather than major_brand, but
-                // real-world encoders emit it as major_brand too, so it's accepted
-                // here) — and compare bytes directly rather than via Buffer.toString()
-                // (which would utf-8-decode non-ASCII bytes) so the check is exact
-                // (#286).
-                if (input.length >= 12) {
-                    const isFtyp = input[4] === 0x66 && // 'f'
-                        input[5] === 0x74 && // 't'
-                        input[6] === 0x79 && // 'y'
-                        input[7] === 0x70; // 'p'
-                    const brand = String.fromCharCode(input[8], input[9], input[10], input[11]);
-                    if (isFtyp &&
-                        (brand === "avif" || brand === "avis" || brand === "avio")) {
-                        return "image/avif";
-                    }
+                // ISO-BMFF images: "ftyp" box at offset 4, major brand at offset 8.
+                // AVIF has codec-specific major brands. HEIC uses HEVC image/sequence
+                // brands, while generic HEIF structural brands (mif1/msf1) need a
+                // compatible codec brand to avoid mistaking AVIF or generic MP4 data
+                // for HEIF.
+                const isoBmffMimeType = detectIsoBmffImageMimeType(input);
+                if (isoBmffMimeType) {
+                    return isoBmffMimeType;
+                }
+                // ICO: 00 00 01 00 (icon type=1)
+                if (input[0] === 0x00 &&
+                    input[1] === 0x00 &&
+                    input[2] === 0x01 &&
+                    input[3] === 0x00 &&
+                    !hasFtypBoxSignature(input)) {
+                    return "image/x-icon";
                 }
                 // BMP: "BM" magic (0x42 0x4D)
                 if (input[0] === 0x42 && input[1] === 0x4d) {

package/dist/lib/utils/isoBmff.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Shared ISO-BMFF (`ftyp`) image-brand detection.
+ *
+ * FileDetector and ImageProcessor must use the same brand tables and declared
+ * box boundary when classifying AVIF, HEIC, and structural HEIF brands. Keeping
+ * the scan here prevents the two consumers from drifting as new brands are
+ * added.
+ */
+export declare const AVIF_FTYP_BRANDS: Set<string>;
+export declare const HEIC_FTYP_BRANDS: Set<string>;
+export declare const HEIF_STRUCTURAL_FTYP_BRANDS: Set<string>;
+/**
+ * Whether the buffer starts with an ISO-BMFF `ftyp` box signature.
+ */
+export declare function hasFtypBoxSignature(input: Buffer): boolean;
+/**
+ * Read compatible brands without scanning past the declared `ftyp` box.
+ */
+export declare function getCompatibleFtypBrands(input: Buffer): Set<string>;
+/**
+ * Return the image MIME type encoded by an ISO-BMFF `ftyp` box, or null when
+ * the box belongs to a non-image ISO-BMFF flavor.
+ */
+export declare function detectIsoBmffImageMimeType(input: Buffer): string | null;

package/dist/lib/utils/isoBmff.js

@@ -0,0 +1,83 @@
+/**
+ * Shared ISO-BMFF (`ftyp`) image-brand detection.
+ *
+ * FileDetector and ImageProcessor must use the same brand tables and declared
+ * box boundary when classifying AVIF, HEIC, and structural HEIF brands. Keeping
+ * the scan here prevents the two consumers from drifting as new brands are
+ * added.
+ */
+export const AVIF_FTYP_BRANDS = new Set(["avif", "avis", "avio"]);
+export const HEIC_FTYP_BRANDS = new Set([
+    "heic",
+    "heix",
+    "hevc",
+    "hevx",
+    "heim",
+    "heis",
+    "hevm",
+    "hevs",
+]);
+export const HEIF_STRUCTURAL_FTYP_BRANDS = new Set(["mif1", "msf1"]);
+/**
+ * Whether the buffer starts with an ISO-BMFF `ftyp` box signature.
+ */
+export function hasFtypBoxSignature(input) {
+    return (input.length >= 8 &&
+        input[4] === 0x66 &&
+        input[5] === 0x74 &&
+        input[6] === 0x79 &&
+        input[7] === 0x70);
+}
+/**
+ * Read compatible brands without scanning past the declared `ftyp` box.
+ */
+export function getCompatibleFtypBrands(input) {
+    const compatibleBrands = new Set();
+    if (input.length < 20) {
+        return compatibleBrands;
+    }
+    const declaredBoxSize = input.readUInt32BE(0);
+    const boxEnd = declaredBoxSize === 0
+        ? input.length
+        : Math.min(input.length, declaredBoxSize);
+    for (let offset = 16; offset + 4 <= boxEnd; offset += 4) {
+        compatibleBrands.add(input.toString("latin1", offset, offset + 4));
+    }
+    return compatibleBrands;
+}
+function hasFtypBrand(compatibleBrands, candidates) {
+    for (const brand of compatibleBrands) {
+        if (candidates.has(brand)) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Return the image MIME type encoded by an ISO-BMFF `ftyp` box, or null when
+ * the box belongs to a non-image ISO-BMFF flavor.
+ */
+export function detectIsoBmffImageMimeType(input) {
+    if (input.length < 12 || !hasFtypBoxSignature(input)) {
+        return null;
+    }
+    const brand = input.toString("latin1", 8, 12);
+    if (AVIF_FTYP_BRANDS.has(brand)) {
+        return "image/avif";
+    }
+    if (HEIC_FTYP_BRANDS.has(brand)) {
+        return "image/heic";
+    }
+    if (!HEIF_STRUCTURAL_FTYP_BRANDS.has(brand)) {
+        return null;
+    }
+    const compatibleBrands = getCompatibleFtypBrands(input);
+    if (hasFtypBrand(compatibleBrands, HEIC_FTYP_BRANDS)) {
+        return "image/heif";
+    }
+    if (hasFtypBrand(compatibleBrands, AVIF_FTYP_BRANDS)) {
+        return "image/avif";
+    }
+    return null;
+}
+//# sourceMappingURL=isoBmff.js.map

package/dist/processors/config/mimeConstants.js

@@ -283,6 +283,8 @@ export const EXTENSION_MIME_MAP = {
     ".webp": IMAGE_MIME_TYPES.WEBP,
     ".bmp": IMAGE_MIME_TYPES.BMP,
     ".ico": IMAGE_MIME_TYPES.ICO,
+    ".heic": IMAGE_MIME_TYPES.HEIC,
+    ".heif": IMAGE_MIME_TYPES.HEIF,
     // Source code
     ".js": TEXT_MIME_TYPES.JAVASCRIPT,
     ".mjs": TEXT_MIME_TYPES.JAVASCRIPT,

package/dist/server/routes/claudeProxyRoutes.d.ts

@@ -249,6 +249,17 @@ export declare function parseClaudeErrorBody(errBody: string): ParsedClaudeError
  * Detect malformed request errors that should not trigger account/provider failover.
  */
 export declare function isInvalidRequestError(status: number, errBody: string): boolean;
+/**
+ * A subscription-specific beta rejection. Anthropic returns
+ * `400 invalid_request_error` with a message like
+ * "The long context beta is not yet available for this subscription." when an
+ * account's plan tier does not grant an optional beta the proxy injected (see
+ * CLAUDE_CODE_OAUTH_BETAS in anthropicOAuth.ts). Unlike a genuinely malformed
+ * request, the SAME request can succeed on a different account whose tier
+ * grants the beta — so this must be treated as retryable on the next account
+ * rather than a terminal client-facing 400.
+ */
+export declare function isSubscriptionBetaRejection(status: number, errBody: string): boolean;
 /**
  * Backward-compatible alias — delegates to the shared translation engine.
  */

package/dist/server/routes/claudeProxyRoutes.js

@@ -3131,6 +3131,38 @@ async function handleAnthropicNonOkResponse(args) {
         durationMs: Date.now() - fetchStartMs,
     });
     if (isInvalidRequestError(response.status, errBody)) {
+        if (isSubscriptionBetaRejection(response.status, errBody)) {
+            // Subscription-specific beta rejection (an account whose plan tier lacks
+            // an optional beta the proxy injected). The SAME request can succeed on
+            // another account whose tier grants the beta — or on a fallback provider —
+            // so advance to the next account instead of failing the client here.
+            //
+            // Deliberately do NOT store this in `currentInvalidRequestFailure`: that
+            // field is a deterministic "malformed request" signal that both
+            // suppresses provider fallback (shouldAttemptClaudeFallback) and outranks
+            // transient/rate-limit failures in the final response. A beta rejection is
+            // neither terminal nor higher-priority — a later account's real 429/5xx
+            // must still take precedence, and fallback must stay eligible. The reason
+            // is carried in `lastError`, so if every account rejects the beta the
+            // exhaustion response still explains why.
+            logger.always(`[proxy] ← ${response.status} account=${account.label} beta unavailable for subscription; advancing to next account`);
+            logAttempt(response.status, "invalid_request_error", summarizeErrorMessage(errBody));
+            tracer?.setError("invalid_request_error", summarizeErrorMessage(errBody));
+            tracer?.recordRetry(account.label, "beta_unavailable");
+            // A tier's lack of a beta is stable, not transient — advance the
+            // fill-first primary pointer (like the auth/rate-limit rotation paths) so
+            // this account stops being retried first on every future request.
+            advancePrimaryIfCurrent(account.key, enabledAccounts.length, orderedAccounts[0]?.key);
+            currentLastError = summarizeErrorMessage(errBody);
+            return {
+                continueLoop: true,
+                lastError: currentLastError,
+                authFailureMessage: currentAuthFailureMessage,
+                sawTransientFailure: currentSawTransientFailure,
+                invalidRequestFailure: currentInvalidRequestFailure,
+                upstreamSpan: undefined,
+            };
+        }
         logger.always(`[proxy] ← ${response.status} upstream invalid_request_error`);
         logAttempt(response.status, "invalid_request_error", summarizeErrorMessage(errBody));
         tracer?.setError("invalid_request_error", summarizeErrorMessage(errBody));
@@ -4613,6 +4645,29 @@ export function isInvalidRequestError(status, errBody) {
     return (parsed.errorType === "invalid_request_error" ||
         errBody.includes("invalid_request_error"));
 }
+/**
+ * A subscription-specific beta rejection. Anthropic returns
+ * `400 invalid_request_error` with a message like
+ * "The long context beta is not yet available for this subscription." when an
+ * account's plan tier does not grant an optional beta the proxy injected (see
+ * CLAUDE_CODE_OAUTH_BETAS in anthropicOAuth.ts). Unlike a genuinely malformed
+ * request, the SAME request can succeed on a different account whose tier
+ * grants the beta — so this must be treated as retryable on the next account
+ * rather than a terminal client-facing 400.
+ */
+export function isSubscriptionBetaRejection(status, errBody) {
+    if (status !== 400) {
+        return false;
+    }
+    const parsed = parseClaudeErrorBody(errBody);
+    if (parsed.errorType !== "invalid_request_error") {
+        return false;
+    }
+    const message = (parsed.message ?? "").toLowerCase();
+    return (message.includes("beta") &&
+        message.includes("subscription") &&
+        message.includes("available"));
+}
 function normalizeClaudeRequestForAnthropic(body) {
     return {
         ...body,

package/dist/utils/fileDetector.js

@@ -23,6 +23,7 @@ async function getArchiveProcessor() {
 import { tracers, ATTR, withSpan } from "../telemetry/index.js";
 import { CSVProcessor } from "./csvProcessor.js";
 import { ImageProcessor } from "./imageProcessor.js";
+import { detectIsoBmffImageMimeType, hasFtypBoxSignature } from "./isoBmff.js";
 import { logger } from "./logger.js";
 import { withTimeout } from "./errorHandling.js";
 import { normalizeUrlForCache, redactUrlForError, sanitizeErrorCause, } from "./logSanitize.js";
@@ -1659,17 +1660,35 @@ class MagicBytesStrategy {
         if (this.isWebP(input)) {
             return this.result("image", "image/webp", 95);
         }
+        if (input.length >= 2 && input[0] === 0x42 && input[1] === 0x4d) {
+            return this.result("image", "image/bmp", 95);
+        }
+        if (input.length >= 4 &&
+            ((input[0] === 0x49 &&
+                input[1] === 0x49 &&
+                input[2] === 0x2a &&
+                input[3] === 0x00) ||
+                (input[0] === 0x4d &&
+                    input[1] === 0x4d &&
+                    input[2] === 0x00 &&
+                    input[3] === 0x2a))) {
+            return this.result("image", "image/tiff", 95);
+        }
+        if (input.length >= 4 &&
+            input[0] === 0x00 &&
+            input[1] === 0x00 &&
+            input[2] === 0x01 &&
+            input[3] === 0x00 &&
+            !hasFtypBoxSignature(input)) {
+            return this.result("image", "image/x-icon", 95);
+        }
         if (this.isPDF(input)) {
             return this.result("pdf", "application/pdf", 95);
         }
         // ISO-BMFF ("ftyp" at offset 4): MP4 video, QuickTime MOV, or M4A/M4B/M4P
         // audio all share this box — disambiguate by the major brand at offset 8-11,
         // otherwise an .m4a audio file is misrouted to the video pipeline.
-        if (input.length >= 8 &&
-            input[4] === 0x66 &&
-            input[5] === 0x74 &&
-            input[6] === 0x79 &&
-            input[7] === 0x70) {
+        if (hasFtypBoxSignature(input)) {
             const brand = input.length >= 12 ? input.toString("latin1", 8, 12) : "";
             // AVIF images share the ISO-BMFF ftyp box with MP4/MOV; the major brand
             // ('avif' still, 'avis' sequence, 'avio' intra-only AV1 image/sequence
@@ -1677,8 +1696,9 @@ class MagicBytesStrategy {
             // major_brand by real encoders) distinguishes them. Detect before the
             // audio/video branches so an AVIF buffer isn't misrouted to the video
             // pipeline (#286).
-            if (/^(avif|avis|avio)/.test(brand)) {
-                return this.result("image", "image/avif", 95);
+            const imageMimeType = detectIsoBmffImageMimeType(input);
+            if (imageMimeType) {
+                return this.result("image", imageMimeType, 95);
             }
             if (/^(M4A|M4B|M4P|F4A|F4B)/.test(brand)) {
                 return this.result("audio", "audio/mp4", 95);
@@ -1775,6 +1795,16 @@ class MagicBytesStrategy {
         if (input.length >= 2 && input[0] === 0x1f && input[1] === 0x8b) {
             return this.result("archive", "application/gzip", 90);
         }
+        // 7z: 37 7A BC AF 27 1C
+        if (input.length >= 6 &&
+            input[0] === 0x37 &&
+            input[1] === 0x7a &&
+            input[2] === 0xbc &&
+            input[3] === 0xaf &&
+            input[4] === 0x27 &&
+            input[5] === 0x1c) {
+            return this.result("archive", "application/x-7z-compressed", 95);
+        }
         // RAR: "Rar!"
         if (input.length >= 4 &&
             input[0] === 0x52 &&
@@ -2006,6 +2036,8 @@ class ExtensionStrategy {
             // AI providers don't support SVG format, so we process it as sanitized text
             svg: "svg",
             avif: "image",
+            heic: "image",
+            heif: "image",
             pdf: "pdf",
             // Video formats
             mp4: "video",
@@ -2179,6 +2211,8 @@ class ExtensionStrategy {
             tif: "image/tiff",
             svg: "image/svg+xml",
             avif: "image/avif",
+            heic: "image/heic",
+            heif: "image/heif",
             pdf: "application/pdf",
             // Video MIME types
             mp4: "video/mp4",

package/dist/utils/imageProcessor.js

@@ -11,6 +11,7 @@ import { SYSTEM_LIMITS } from "../core/constants.js";
 import { SIZE_LIMITS_BYTES } from "../processors/config/sizeLimits.js";
 import { getImageCache } from "./imageCache.js";
 import { ErrorFactory, NeuroLinkError } from "./errorHandling.js";
+import { detectIsoBmffImageMimeType, hasFtypBoxSignature } from "./isoBmff.js";
 /**
  * Minimum bytes required just to detect an image format from magic bytes (#293).
  */
@@ -104,7 +105,7 @@ function isRetryableDownloadError(error) {
 }
 /**
  * Reject `detectImageType()`'s `application/octet-stream` sentinel — the
- * honest "no known image signature (PNG/JPEG/GIF/WebP/BMP/TIFF/SVG/AVIF)
+ * honest "no known image signature (PNG/JPEG/GIF/WebP/BMP/TIFF/ICO/SVG/AVIF/HEIC/HEIF)
  * matched" fallback (#261/#286). Packaging that sentinel into a data URI
  * hands vision providers (OpenAI/Anthropic/Google) a MIME type they reject
  * outright with an HTTP 400, so every public conversion path that turns
@@ -118,7 +119,7 @@ function assertKnownImageType(mediaType) {
     if (mediaType === "application/octet-stream") {
         logger.error("Unable to detect a supported image format from file content");
         throw new Error("Unsupported or corrupted image: no known image signature " +
-            "(PNG/JPEG/GIF/WebP/BMP/TIFF/SVG/AVIF) was found in the file content.");
+            "(PNG/JPEG/GIF/WebP/BMP/TIFF/ICO/SVG/AVIF/HEIC/HEIF) was found in the file content.");
     }
 }
 /**
@@ -457,24 +458,22 @@ export class ImageProcessor {
                         return "image/svg+xml";
                     }
                 }
-                // AVIF (ISOBMFF): "ftyp" box at offset 4, major brand at offset 8.
-                // Accept the AVIF-spec brand variants — 'avif' (still image), 'avis'
-                // (image sequence), and 'avio' (intra-only AV1 image/sequence — the
-                // spec lists it under compatible_brands rather than major_brand, but
-                // real-world encoders emit it as major_brand too, so it's accepted
-                // here) — and compare bytes directly rather than via Buffer.toString()
-                // (which would utf-8-decode non-ASCII bytes) so the check is exact
-                // (#286).
-                if (input.length >= 12) {
-                    const isFtyp = input[4] === 0x66 && // 'f'
-                        input[5] === 0x74 && // 't'
-                        input[6] === 0x79 && // 'y'
-                        input[7] === 0x70; // 'p'
-                    const brand = String.fromCharCode(input[8], input[9], input[10], input[11]);
-                    if (isFtyp &&
-                        (brand === "avif" || brand === "avis" || brand === "avio")) {
-                        return "image/avif";
-                    }
+                // ISO-BMFF images: "ftyp" box at offset 4, major brand at offset 8.
+                // AVIF has codec-specific major brands. HEIC uses HEVC image/sequence
+                // brands, while generic HEIF structural brands (mif1/msf1) need a
+                // compatible codec brand to avoid mistaking AVIF or generic MP4 data
+                // for HEIF.
+                const isoBmffMimeType = detectIsoBmffImageMimeType(input);
+                if (isoBmffMimeType) {
+                    return isoBmffMimeType;
+                }
+                // ICO: 00 00 01 00 (icon type=1)
+                if (input[0] === 0x00 &&
+                    input[1] === 0x00 &&
+                    input[2] === 0x01 &&
+                    input[3] === 0x00 &&
+                    !hasFtypBoxSignature(input)) {
+                    return "image/x-icon";
                 }
                 // BMP: "BM" magic (0x42 0x4D)
                 if (input[0] === 0x42 && input[1] === 0x4d) {