@juspay/neurolink 11.12.0 → 11.13.1

package/dist/cli/proxy-clients/qwenCode.d.ts

@@ -17,7 +17,7 @@
  *     "$version": 2
  *   }
  */
-import type { CliProxyClientConfigurator } from "../../lib/types/index.js";
+import type { CliProxyClientConfigurator } from "../../types/index.js";
 /**
  * Resolved per call rather than at module load so `detect()` and `apply()`
  * agree when HOME changes — under test, and on the `--dev` isolation path.

package/dist/cli/proxy-clients/qwenCode.js

@@ -19,7 +19,8 @@
  */
 import { homedir } from "os";
 import { join } from "path";
-import { logger } from "../../lib/utils/logger.js";
+import { logger } from "../../utils/logger.js";
+import { cloneForSnapshot, isProxyOwnedValue, shouldCaptureSnapshot, } from "./snapshot.js";
 /**
  * Resolved per call rather than at module load so `detect()` and `apply()`
  * agree when HOME changes — under test, and on the `--dev` isolation path.
@@ -37,6 +38,12 @@ function getQwenSettingsPath() {
  * the same approach the Claude and OpenCode writers take.
  */
 const QWEN_ORIGINAL_KEY = "__proxy_original_qwen_auth";
+/**
+ * The auth block this writer last wrote. Lets apply() tell its own block from
+ * one the user substituted while the proxy was not running — which for Qwen
+ * carries a real API key.
+ */
+const QWEN_WRITTEN_KEY = "__proxy_written_qwen_auth";
 function readQwenSettings(fs) {
     try {
         const parsed = JSON.parse(fs.readFileSync(getQwenSettingsPath(), "utf8"));
@@ -61,18 +68,25 @@ export async function setQwenProxySettings(baseUrl, proxyKey) {
     const settings = readQwenSettings(fs) ?? {};
     const security = (settings.security ?? {});
     const auth = (security.auth ?? {});
-    // Snapshot only on first touch. A second apply() must not overwrite the
-    // snapshot with our own block, which would lose the user's real config on
-    // the next restore.
-    if (!(QWEN_ORIGINAL_KEY in settings)) {
+    // A repeat apply() must not overwrite the snapshot with our own block, which
+    // would lose the user's real config on the next restore — but a block the
+    // user wrote while the proxy was gone must replace it. See
+    // shouldCaptureSnapshot.
+    const currentAuth = "auth" in security ? security.auth : undefined;
+    if (shouldCaptureSnapshot({
+        hasSnapshot: QWEN_ORIGINAL_KEY in settings,
+        written: settings[QWEN_WRITTEN_KEY],
+        current: currentAuth,
+    })) {
         settings[QWEN_ORIGINAL_KEY] =
-            "auth" in security ? JSON.parse(JSON.stringify(auth)) : null;
+            currentAuth === undefined ? null : cloneForSnapshot(currentAuth);
     }
     auth.selectedType = "openai";
     auth.baseUrl = baseUrl;
     auth.apiKey = proxyKey || "neurolink-proxy";
     security.auth = auth;
     settings.security = security;
+    settings[QWEN_WRITTEN_KEY] = cloneForSnapshot(auth);
     fs.writeFileSync(getQwenSettingsPath(), JSON.stringify(settings, null, 2));
     return true;
 }
@@ -100,14 +114,24 @@ export async function clearQwenProxySettings(expectedBaseUrl) {
         logger.debug("[proxy] Qwen clear: no original-auth snapshot found, leaving security.auth intact");
         return false;
     }
-    const snapshot = settings[QWEN_ORIGINAL_KEY];
-    if (snapshot === null) {
-        delete security.auth;
+    // Only restore what we can prove is ours. The base-URL check above lets
+    // through a block still pointing at the proxy whose key the user rotated
+    // beside it — overwriting that would destroy a live credential. Our
+    // bookkeeping keys go either way, so a stale sentinel cannot outlive us.
+    if (isProxyOwnedValue({ written: settings[QWEN_WRITTEN_KEY], current: auth })) {
+        const snapshot = settings[QWEN_ORIGINAL_KEY];
+        if (snapshot === null) {
+            delete security.auth;
+        }
+        else {
+            security.auth = snapshot;
+        }
     }
     else {
-        security.auth = snapshot;
+        logger.debug("[proxy] Qwen clear: security.auth was edited after the proxy wrote it, leaving it intact");
     }
     delete settings[QWEN_ORIGINAL_KEY];
+    delete settings[QWEN_WRITTEN_KEY];
     settings.security = security;
     fs.writeFileSync(getQwenSettingsPath(), JSON.stringify(settings, null, 2));
     return true;

package/dist/cli/proxy-clients/registry.d.ts

@@ -1,4 +1,4 @@
-import type { CliProxyClientApplyResult, CliProxyClientConfigurator, CliProxyClientRestoreResult } from "../../lib/types/index.js";
+import type { CliProxyClientApplyResult, CliProxyClientConfigurator, CliProxyClientRestoreResult } from "../../types/index.js";
 /**
  * Every CLI the proxy auto-configures, in apply order.
  *

package/dist/cli/proxy-clients/registry.js

@@ -1,3 +1,4 @@
+import { logger } from "../../utils/logger.js";
 import { claudeCodeConfigurator } from "./claudeCode.js";
 import { openCodeConfigurator } from "./openCode.js";
 import { codexConfigurator } from "./codex.js";
@@ -34,11 +35,16 @@ export async function applyAllClients(proxyBaseUrl) {
             results.push({ id: client.id, displayName: client.displayName, applied });
         }
         catch (error) {
+            const wrapped = error instanceof Error ? error : new Error(String(error));
+            // The result already carries the id, but a caller is free to ignore it.
+            // Naming the client here means a path-resolution failure (a HOME that
+            // moved, a directory that vanished mid-run) is never fully silent.
+            logger.debug(`[proxy] ${client.id} apply failed: ${wrapped.message}`);
             results.push({
                 id: client.id,
                 displayName: client.displayName,
                 applied: false,
-                error: error instanceof Error ? error : new Error(String(error)),
+                error: wrapped,
             });
         }
     }
@@ -56,11 +62,13 @@ export async function restoreAllClients(proxyBaseUrl) {
             });
         }
         catch (error) {
+            const wrapped = error instanceof Error ? error : new Error(String(error));
+            logger.debug(`[proxy] ${client.id} restore failed: ${wrapped.message}`);
             results.push({
                 id: client.id,
                 displayName: client.displayName,
                 restored: false,
-                error: error instanceof Error ? error : new Error(String(error)),
+                error: wrapped,
             });
         }
     }

package/dist/cli/proxy-clients/snapshot.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Shared snapshot bookkeeping for the JSON-file configurators.
+ *
+ * Every writer that edits a user's config in place has to answer one question
+ * on each apply(): is the value sitting in the file right now the one *we* put
+ * there, or one the user put there?
+ *
+ * Snapshotting only on first touch is not enough. The sentinel is persisted in
+ * the user's file so a restore survives a crash, which means it also survives
+ * an unclean kill where no restore ever ran. If the user then edits the block
+ * by hand — reasonably, since the proxy is gone — a presence-only guard keeps
+ * the stale snapshot, apply() overwrites their edit, and the next restore
+ * writes the stale value back over it. For Qwen that value is a live API key.
+ *
+ * So each writer also records what it wrote. A current value that still matches
+ * the recorded write is ours and the snapshot stands; anything else is the
+ * user's and must be re-snapshotted before we overwrite it.
+ */
+/**
+ * Whether apply() should record `current` as the user's original value.
+ *
+ * - No snapshot yet: record one. This is the first touch.
+ * - Snapshot present but no record of what we wrote: leave it alone. The file
+ *   was written by a version that predates the write-record, so we cannot tell
+ *   ours from the user's and the safe move is the old behaviour.
+ * - Snapshot present and the current value is exactly what we wrote: leave it
+ *   alone. This is the repeat-apply case the first-touch guard exists for.
+ * - Snapshot present and the current value is *not* what we wrote: re-record.
+ *   The user replaced it while the proxy was not running.
+ */
+export declare function shouldCaptureSnapshot(args: {
+    hasSnapshot: boolean;
+    written: unknown;
+    current: unknown;
+}): boolean;
+/** Deep copy through JSON, so a snapshot cannot alias the object it describes. */
+export declare function cloneForSnapshot<T>(value: T): T;
+/**
+ * Whether the value currently in the file is the one this writer put there.
+ *
+ * Restore uses this as its licence to act. A base-URL check alone catches a
+ * user who repointed the client elsewhere, but not one who kept the proxy URL
+ * and changed something beside it — a rotated key, an added field. Reverting
+ * those to the snapshot destroys a deliberate edit; for Qwen it destroys a
+ * credential. No record of what we wrote (a config from before this existed)
+ * means we cannot prove ownership either way, so the caller keeps its previous
+ * behaviour rather than refusing every restore.
+ */
+export declare function isProxyOwnedValue(args: {
+    written: unknown;
+    current: unknown;
+}): boolean;

package/dist/cli/proxy-clients/snapshot.js

@@ -0,0 +1,98 @@
+/**
+ * Shared snapshot bookkeeping for the JSON-file configurators.
+ *
+ * Every writer that edits a user's config in place has to answer one question
+ * on each apply(): is the value sitting in the file right now the one *we* put
+ * there, or one the user put there?
+ *
+ * Snapshotting only on first touch is not enough. The sentinel is persisted in
+ * the user's file so a restore survives a crash, which means it also survives
+ * an unclean kill where no restore ever ran. If the user then edits the block
+ * by hand — reasonably, since the proxy is gone — a presence-only guard keeps
+ * the stale snapshot, apply() overwrites their edit, and the next restore
+ * writes the stale value back over it. For Qwen that value is a live API key.
+ *
+ * So each writer also records what it wrote. A current value that still matches
+ * the recorded write is ours and the snapshot stands; anything else is the
+ * user's and must be re-snapshotted before we overwrite it.
+ */
+/**
+ * Structural equality, insensitive to object key order.
+ *
+ * Comparing serialised JSON would be simpler but wrong: `JSON.stringify` is not
+ * canonical, so anything that rewrites the user's config — a formatter, an
+ * editor's "sort keys", another tool round-tripping the file — reorders keys and
+ * makes our own block look like the user's. The writer would then snapshot the
+ * proxy block as the "original" and restore it over the real config later.
+ *
+ * `undefined` is only ever equal to itself: absent is not the same as present.
+ */
+function valuesMatch(current, written) {
+    if (current === undefined || written === undefined) {
+        return current === written;
+    }
+    if (current === null || written === null) {
+        return current === written;
+    }
+    if (typeof current !== "object" || typeof written !== "object") {
+        return current === written;
+    }
+    if (Array.isArray(current) || Array.isArray(written)) {
+        if (!Array.isArray(current) || !Array.isArray(written)) {
+            return false;
+        }
+        return (current.length === written.length &&
+            current.every((item, index) => valuesMatch(item, written[index])));
+    }
+    const a = current;
+    const b = written;
+    const aKeys = Object.keys(a);
+    if (aKeys.length !== Object.keys(b).length) {
+        return false;
+    }
+    return aKeys.every((key) => Object.prototype.hasOwnProperty.call(b, key) &&
+        valuesMatch(a[key], b[key]));
+}
+/**
+ * Whether apply() should record `current` as the user's original value.
+ *
+ * - No snapshot yet: record one. This is the first touch.
+ * - Snapshot present but no record of what we wrote: leave it alone. The file
+ *   was written by a version that predates the write-record, so we cannot tell
+ *   ours from the user's and the safe move is the old behaviour.
+ * - Snapshot present and the current value is exactly what we wrote: leave it
+ *   alone. This is the repeat-apply case the first-touch guard exists for.
+ * - Snapshot present and the current value is *not* what we wrote: re-record.
+ *   The user replaced it while the proxy was not running.
+ */
+export function shouldCaptureSnapshot(args) {
+    if (!args.hasSnapshot) {
+        return true;
+    }
+    if (args.written === undefined) {
+        return false;
+    }
+    return !valuesMatch(args.current, args.written);
+}
+/** Deep copy through JSON, so a snapshot cannot alias the object it describes. */
+export function cloneForSnapshot(value) {
+    return JSON.parse(JSON.stringify(value));
+}
+/**
+ * Whether the value currently in the file is the one this writer put there.
+ *
+ * Restore uses this as its licence to act. A base-URL check alone catches a
+ * user who repointed the client elsewhere, but not one who kept the proxy URL
+ * and changed something beside it — a rotated key, an added field. Reverting
+ * those to the snapshot destroys a deliberate edit; for Qwen it destroys a
+ * credential. No record of what we wrote (a config from before this existed)
+ * means we cannot prove ownership either way, so the caller keeps its previous
+ * behaviour rather than refusing every restore.
+ */
+export function isProxyOwnedValue(args) {
+    if (args.written === undefined) {
+        return true;
+    }
+    return valuesMatch(args.current, args.written);
+}
+//# sourceMappingURL=snapshot.js.map

package/dist/cli/utils/audioFileUtils.d.ts

@@ -6,7 +6,7 @@
  *
  * @module cli/utils/audioFileUtils
  */
-import type { TTSResult, AudioSaveResult, TTSAudioFormat } from "../../lib/types/index.js";
+import type { TTSResult, AudioSaveResult, TTSAudioFormat } from "../../types/index.js";
 /**
  * Format file size in human-readable format
  *

package/dist/cli/utils/audioPlayer.d.ts

@@ -6,7 +6,7 @@
  *
  * @module cli/utils/audioPlayer
  */
-import type { TTSAudioFormat, CliAudioPlayerCommand } from "../../lib/types/index.js";
+import type { TTSAudioFormat, CliAudioPlayerCommand } from "../../types/index.js";
 /**
  * Get the file extension for an audio format
  *

package/dist/cli/utils/classifierRouterFlags.d.ts

@@ -4,7 +4,7 @@
  * Side-effect-free so it can be unit-tested without a running NeuroLink
  * instance. Mirrors the `--tool-routing-*` flag parser.
  */
-import type { CliClassifierRouterFlags, ClassifierRouterConfig } from "../../lib/types/index.js";
+import type { CliClassifierRouterFlags, ClassifierRouterConfig } from "../../types/index.js";
 /**
  * Build a {@link ClassifierRouterConfig} from the parsed CLI flags.
  *

package/dist/cli/utils/classifierRouterFlags.js

@@ -5,7 +5,7 @@
  * instance. Mirrors the `--tool-routing-*` flag parser.
  */
 import fs from "node:fs";
-import { logger } from "../../lib/utils/logger.js";
+import { logger } from "../../utils/logger.js";
 // Trust model: --classifier-pool is a local, user-supplied CLI flag. The
 // invoking user already holds the process's OS permissions, so absolute and
 // home-dir config paths are fully supported — there is no cross-trust boundary

package/dist/cli/utils/completeSetup.d.ts

@@ -4,7 +4,7 @@
  * Orchestrates the entire setup process: interactive wizard, environment management,
  * provider testing, and summary display.
  */
-import type { SetupResult } from "../../lib/types/index.js";
+import type { SetupResult } from "../../types/index.js";
 /**
  * Run the complete interactive setup process
  */

package/dist/cli/utils/completeSetup.js

@@ -7,7 +7,7 @@
 import { runInteractiveSetup, testProviderConnectivity, displaySetupSummary, } from "./interactiveSetup.js";
 import { updateEnvFile, displayEnvUpdateSummary } from "./envManager.js";
 import chalk from "chalk";
-import { logger } from "../../lib/utils/logger.js";
+import { logger } from "../../utils/logger.js";
 /**
  * Run the complete interactive setup process
  */

package/dist/cli/utils/envManager.d.ts

@@ -3,7 +3,7 @@
  *
  * Handles .env file operations including backup, update, and validation.
  */
-import type { EnvBackupResult, EnvUpdateResult } from "../../lib/types/index.js";
+import type { EnvBackupResult, EnvUpdateResult } from "../../types/index.js";
 /**
  * Create a timestamped backup of the existing .env file
  */

package/dist/cli/utils/envManager.js

@@ -5,7 +5,7 @@
  */
 import fs from "fs";
 import chalk from "chalk";
-import { logger } from "../../lib/utils/logger.js";
+import { logger } from "../../utils/logger.js";
 /**
  * Create a timestamped backup of the existing .env file
  */

package/dist/cli/utils/inputValidation.js

@@ -12,8 +12,8 @@
 import fs from "node:fs";
 import { fileURLToPath } from "node:url";
 import chalk from "chalk";
-import { logger } from "../../lib/utils/logger.js";
-import { redactUrlForError } from "../../lib/utils/logSanitize.js";
+import { logger } from "../../utils/logger.js";
+import { redactUrlForError } from "../../utils/logSanitize.js";
 import { resolveFilePath } from "./pathResolver.js";
 /**
  * Soft (warn-only) size thresholds for CLI multimodal flags. Intentionally

package/dist/cli/utils/interactiveSetup.d.ts

@@ -4,8 +4,8 @@
  * Provides interactive configuration wizard with provider selection,
  * credential collection, testing, and environment file management.
  */
-import { AIProviderName } from "../../lib/constants/enums.js";
-import type { InteractiveProviderConfig, SetupResult } from "../../lib/types/index.js";
+import { AIProviderName } from "../../constants/enums.js";
+import type { InteractiveProviderConfig, SetupResult } from "../../types/index.js";
 export declare const PROVIDER_CONFIGS: InteractiveProviderConfig[];
 /**
  * Run the interactive setup wizard

package/dist/cli/utils/interactiveSetup.js

@@ -4,11 +4,11 @@
  * Provides interactive configuration wizard with provider selection,
  * credential collection, testing, and environment file management.
  */
-import { AIProviderName } from "../../lib/constants/enums.js";
-import { NeuroLink } from "../../lib/neurolink.js";
+import { AIProviderName } from "../../constants/enums.js";
+import { NeuroLink } from "../../neurolink.js";
 import chalk from "chalk";
 import ora from "ora";
-import { logger } from "../../lib/utils/logger.js";
+import { logger } from "../../utils/logger.js";
 export const PROVIDER_CONFIGS = [
     {
         id: AIProviderName.OPENAI,

package/dist/cli/utils/ollamaUtils.d.ts

@@ -1,5 +1,5 @@
 import { type SpawnSyncReturns, type SpawnSyncOptions } from "child_process";
-import type { AllowedCommand } from "../../lib/types/index.js";
+import type { AllowedCommand } from "../../types/index.js";
 /**
  * Shared Ollama utilities for CLI commands
  */

package/dist/cli/utils/ollamaUtils.js

@@ -1,7 +1,7 @@
 import { spawnSync, spawn, } from "child_process";
 import chalk from "chalk";
 import ora from "ora";
-import { logger } from "../../lib/utils/logger.js";
+import { logger } from "../../utils/logger.js";
 /**
  * Shared Ollama utilities for CLI commands
  */

package/dist/cli/utils/skillsFlags.d.ts

@@ -6,5 +6,5 @@
  * filesystem store for generate / stream / batch / loop runs. Returns null
  * when neither is provided so the SDK stays skills-free by default.
  */
-import type { SkillsConfig } from "../../lib/types/index.js";
+import type { SkillsConfig } from "../../types/index.js";
 export declare function buildSkillsConfigFromCli(options: Record<string, unknown>): SkillsConfig | null;

package/dist/cli/utils/toolRoutingFlags.d.ts

@@ -4,7 +4,7 @@
  * This module is intentionally side-effect-free so it can be unit-tested
  * without a running NeuroLink instance.
  */
-import type { CliToolRoutingFlags, ToolRoutingConfig } from "../../lib/types/index.js";
+import type { CliToolRoutingFlags, ToolRoutingConfig } from "../../types/index.js";
 /**
  * Build a {@link ToolRoutingConfig} from the parsed CLI flags.
  *

package/dist/cli/utils/toolRoutingFlags.js

@@ -5,7 +5,7 @@
  * without a running NeuroLink instance.
  */
 import fs from "node:fs";
-import { logger } from "../../lib/utils/logger.js";
+import { logger } from "../../utils/logger.js";
 /**
  * Build a {@link ToolRoutingConfig} from the parsed CLI flags.
  *

package/dist/cli/utils/videoFileUtils.d.ts

@@ -7,7 +7,7 @@
  *
  * @module cli/utils/videoFileUtils
  */
-import type { VideoGenerationResult, VideoSaveResult } from "../../lib/types/index.js";
+import type { VideoGenerationResult, VideoSaveResult } from "../../types/index.js";
 /**
  * Format file size in human-readable format
  *

package/dist/processors/data/XmlProcessor.d.ts

@@ -15,6 +15,20 @@
  * 2. **Mitigation**: We reject XML files containing DOCTYPE or ENTITY declarations
  *    and disable entity processing in the parser.
  *
+ * ⚠️ **Reachability**: this guard is not currently wired into the
+ * `generate()`/`stream()` attachment pipeline for a standalone `.xml` file.
+ * `src/lib/processors/config/fileTypeRegistry.ts` has no `"xml"` entry,
+ * `src/lib/utils/mimeTypeHints.ts` maps `application/xml`/`text/xml` to the
+ * generic `"text"` file type, and `messageBuilder.ts`'s `allowedTypes`
+ * whitelist has no `"xml"` entry either — so a `.xml` attachment is always
+ * routed to inert generic-text handling, and `checkXxeVectors()` /
+ * `parseXmlSecurely()` below are never invoked from that path. The
+ * `ProcessorRegistry` subsystem that does own this file has no importer
+ * outside `src/lib/processors/` itself. The guard is correct; it is simply
+ * orphaned. See `test/continuous-test-suite-office-security.ts`'s header for
+ * the test-coverage consequence — no e2e test exercises this file today,
+ * because there is no public surface that reaches it (CLAUDE.md rule 15).
+ *
  * References:
  * - https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing
  * - https://cwe.mitre.org/data/definitions/611.html (XXE)

package/dist/processors/data/XmlProcessor.js

@@ -15,6 +15,20 @@
  * 2. **Mitigation**: We reject XML files containing DOCTYPE or ENTITY declarations
  *    and disable entity processing in the parser.
  *
+ * ⚠️ **Reachability**: this guard is not currently wired into the
+ * `generate()`/`stream()` attachment pipeline for a standalone `.xml` file.
+ * `src/lib/processors/config/fileTypeRegistry.ts` has no `"xml"` entry,
+ * `src/lib/utils/mimeTypeHints.ts` maps `application/xml`/`text/xml` to the
+ * generic `"text"` file type, and `messageBuilder.ts`'s `allowedTypes`
+ * whitelist has no `"xml"` entry either — so a `.xml` attachment is always
+ * routed to inert generic-text handling, and `checkXxeVectors()` /
+ * `parseXmlSecurely()` below are never invoked from that path. The
+ * `ProcessorRegistry` subsystem that does own this file has no importer
+ * outside `src/lib/processors/` itself. The guard is correct; it is simply
+ * orphaned. See `test/continuous-test-suite-office-security.ts`'s header for
+ * the test-coverage consequence — no e2e test exercises this file today,
+ * because there is no public surface that reaches it (CLAUDE.md rule 15).
+ *
  * References:
  * - https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing
  * - https://cwe.mitre.org/data/definitions/611.html (XXE)

package/dist/processors/document/PptxProcessor.d.ts

@@ -14,6 +14,15 @@
  *
  * Uses `adm-zip` (already a project dependency) for ZIP extraction.
  *
+ * **XML-entity attacks are not applicable here.** Unlike `WordProcessor`
+ * (mammoth/@xmldom/xmldom) and `ExcelProcessor` (exceljs/saxes), this
+ * processor never hands slide XML to a DOM or SAX parser at all — extraction
+ * is a single regex (`TEXT_ELEMENT_REGEX`, below) run over the raw decoded
+ * bytes. There is no DOCTYPE/ENTITY resolution path for a payload to reach,
+ * so there is nothing for a `.pptx`-specific XXE or billion-laughs test to
+ * falsify; one is deliberately not written (see
+ * `test/continuous-test-suite-office-security.ts`'s header).
+ *
  * @module processors/document/PptxProcessor
  *
  * @example

package/dist/processors/document/PptxProcessor.js

@@ -14,6 +14,15 @@
  *
  * Uses `adm-zip` (already a project dependency) for ZIP extraction.
  *
+ * **XML-entity attacks are not applicable here.** Unlike `WordProcessor`
+ * (mammoth/@xmldom/xmldom) and `ExcelProcessor` (exceljs/saxes), this
+ * processor never hands slide XML to a DOM or SAX parser at all — extraction
+ * is a single regex (`TEXT_ELEMENT_REGEX`, below) run over the raw decoded
+ * bytes. There is no DOCTYPE/ENTITY resolution path for a payload to reach,
+ * so there is nothing for a `.pptx`-specific XXE or billion-laughs test to
+ * falsify; one is deliberately not written (see
+ * `test/continuous-test-suite-office-security.ts`'s header).
+ *
  * @module processors/document/PptxProcessor
  *
  * @example

package/dist/processors/media/VideoProcessor.js

@@ -99,6 +99,34 @@ async function loadMediaBunny() {
     _mediabunny = await tryImport("mediabunny", "Video processing");
     return _mediabunny;
 }
+// Keyframe resize (both extraction paths) previously swallowed a missing
+// `sharp` with a fully silent per-frame catch — every frame failed the same
+// way and nothing ever said why. Route the import through this loader so the
+// cause is logged once (not once per frame) the first time it fails; the
+// per-frame catch sites still skip individually, matching prior behavior.
+let sharpLoadWarned = false;
+async function loadSharp() {
+    try {
+        // `typeof import("sharp")` is the MODULE namespace, and sharp 0.35 puts
+        // the callable factory on its `default` export. Typing the import as
+        // `{ default: typeof import("sharp") }` wrapped that namespace a second
+        // time, so `mod.default` came back as a namespace rather than a factory
+        // and every call site failed with "no call signatures".
+        //
+        // imageFormatSupport.ts already reads `sharpModule.default(...)` for the
+        // same reason; this loader is now the one place that normalizes it, so
+        // callers keep calling the returned value directly.
+        const mod = await tryImport("sharp", "Video keyframe resizing");
+        return mod.default;
+    }
+    catch (error) {
+        if (!sharpLoadWarned) {
+            sharpLoadWarned = true;
+            logger.warn("[VideoProcessor] sharp is required to resize extracted keyframes but failed to load; keyframe extraction will return no frames", { error: error instanceof Error ? error.message : String(error) });
+        }
+        throw error;
+    }
+}
 // =============================================================================
 // FFMPEG PATH INITIALIZATION
 // =============================================================================
@@ -707,7 +735,7 @@ export class VideoProcessor extends BaseFileProcessor {
                 await fs.access(framePath);
                 const rawFrame = await fs.readFile(framePath);
                 // Resize to fit within max dimension while preserving aspect ratio
-                const sharp = (await import("sharp")).default;
+                const sharp = await loadSharp();
                 const pipeline = sharp(rawFrame).resize(VIDEO_CONFIG.FRAME_MAX_DIMENSION, VIDEO_CONFIG.FRAME_MAX_DIMENSION, {
                     fit: "inside",
                     withoutEnlargement: true,
@@ -1042,7 +1070,7 @@ export class VideoProcessor extends BaseFileProcessor {
                 try {
                     await fs.access(framePath);
                     const rawFrame = await fs.readFile(framePath);
-                    const sharp = (await import("sharp")).default;
+                    const sharp = await loadSharp();
                     const resized = await sharp(rawFrame)
                         .resize(VIDEO_CONFIG.FRAME_MAX_DIMENSION, VIDEO_CONFIG.FRAME_MAX_DIMENSION, {
                         fit: "inside",

package/dist/providers/amazonBedrock/client.js

@@ -1,4 +1,4 @@
-import { BedrockRuntimeClient, ImageFormat, } from "@aws-sdk/client-bedrock-runtime";
+import { BedrockRuntimeClient, ImageFormat, InvokeModelCommand, } from "@aws-sdk/client-bedrock-runtime";
 import path from "path";
 import { createAnalytics } from "../../core/analytics.js";
 import { BaseProvider } from "../../core/baseProvider.js";
@@ -1109,7 +1109,6 @@ export class AmazonBedrockProvider extends BaseProvider {
             textLength: text.length,
         });
         try {
-            const { InvokeModelCommand } = await import("@aws-sdk/client-bedrock-runtime");
             // Titan Embed models expect a specific input format
             const requestBody = JSON.stringify({
                 inputText: text,