@juspay/neurolink 11.13.0 → 11.13.2

package/dist/cli/loop/session.js

@@ -1,12 +1,12 @@
 import chalk from "chalk";
 import readline from "readline";
-import { checkContextBudget } from "../../lib/context/budgetChecker.js";
-import { NeuroLink } from "../../lib/neurolink.js";
-import { globalSession } from "../../lib/session/globalSessionState.js";
-import { logger } from "../../lib/utils/logger.js";
-import { displayConversationPreview, displaySessionMessage, getConversationPreview, loadCommandHistory, parseValue, restoreSessionVariables, saveCommandToHistory, verifyConversationContext, } from "../../lib/utils/loopUtils.js";
+import { checkContextBudget } from "../../context/budgetChecker.js";
+import { NeuroLink } from "../../neurolink.js";
+import { globalSession } from "../../session/globalSessionState.js";
+import { logger } from "../../utils/logger.js";
+import { displayConversationPreview, displaySessionMessage, getConversationPreview, loadCommandHistory, parseValue, restoreSessionVariables, saveCommandToHistory, verifyConversationContext, } from "../../utils/loopUtils.js";
 import { SpanStatusCode } from "@opentelemetry/api";
-import { tracers } from "../../lib/telemetry/tracers.js";
+import { tracers } from "../../telemetry/tracers.js";
 import { handleError } from "../errorHandler.js";
 import { ConversationSelector } from "./conversationSelector.js";
 import { textGenerationOptionsSchema } from "./optionsSchema.js";

package/dist/cli/parser.js

@@ -1,9 +1,17 @@
 import chalk from "chalk";
+// `@types/yargs` is pinned to the v17 line while the runtime `yargs` dependency
+// is v18 — a real, currently unfixable skew. DefinitelyTyped has no v18 types
+// package, and yargs 18's package.json `exports` map gives the main entry no
+// `types` condition, so there is no way to get types straight from the
+// runtime package either. `@types/yargs` therefore stays load-bearing here
+// until DefinitelyTyped (or yargs itself) ships v18-compatible types. This
+// file is the canonical place for that note, not the only import site —
+// yargs is imported across roughly two dozen files in this codebase.
 import yargs from "yargs";
 import { hideBin } from "yargs/helpers";
 import packageJson from "../../package.json" with { type: "json" };
-import { globalSession } from "../lib/session/globalSessionState.js";
-import { logger } from "../lib/utils/logger.js";
+import { globalSession } from "../session/globalSessionState.js";
+import { logger } from "../utils/logger.js";
 import { handleError } from "./errorHandler.js";
 import { CLICommandFactory } from "./factories/commandFactory.js";
 import { SetupCommandFactory } from "./factories/setupCommandFactory.js";

package/dist/cli/proxy-clients/claudeCode.d.ts

@@ -5,7 +5,7 @@
  * new. This was the only writer that created its config file for a CLI that
  * may never have been installed.
  */
-import type { CliProxyClientConfigurator } from "../../lib/types/index.js";
+import type { CliProxyClientConfigurator } from "../../types/index.js";
 /**
  * Resolved per call rather than at module load so `detect()` and `apply()`
  * agree when HOME changes — under test, and on the `--dev` isolation path.

package/dist/cli/proxy-clients/claudeCode.js

@@ -7,7 +7,7 @@
  */
 import { homedir } from "os";
 import { join } from "path";
-import { logger } from "../../lib/utils/logger.js";
+import { logger } from "../../utils/logger.js";
 import { isProxyOwnedValue, shouldCaptureSnapshot } from "./snapshot.js";
 /**
  * Resolved per call rather than at module load so `detect()` and `apply()`

package/dist/cli/proxy-clients/codex.d.ts

@@ -4,7 +4,7 @@
  * Moved verbatim out of `proxy.ts`. Codex is the writer the other two should
  * have copied: it probes for an installed CLI and reports whether it wrote.
  */
-import type { CliProxyClientConfigurator } from "../../lib/types/index.js";
+import type { CliProxyClientConfigurator } from "../../types/index.js";
 /**
  * Resolved per call rather than at module load so `detect()` and `apply()`
  * agree when HOME changes — under test, and on the `--dev` isolation path.

package/dist/cli/proxy-clients/codex.js

@@ -6,7 +6,7 @@
  */
 import { homedir } from "os";
 import { join } from "path";
-import { logger } from "../../lib/utils/logger.js";
+import { logger } from "../../utils/logger.js";
 //
 // Points the Codex CLI at the proxy by managing `~/.codex/config.toml`:
 //   - appends a marker-delimited `[model_providers.neurolink]` table

package/dist/cli/proxy-clients/copilot.d.ts

@@ -21,7 +21,7 @@
  * `COPILOT_ENABLE_ALT_PROVIDERS=true` is set; the `COPILOT_PROVIDER_*` path has
  * no such gate, so that is the one used here.
  */
-import type { CliProxyClientConfigurator } from "../../lib/types/index.js";
+import type { CliProxyClientConfigurator } from "../../types/index.js";
 /**
  * Resolved per call rather than at module load so `detect()` and `apply()`
  * agree when HOME changes — under test, and on the `--dev` isolation path.

package/dist/cli/proxy-clients/copilot.js

@@ -23,7 +23,7 @@
  */
 import { homedir } from "os";
 import { join } from "path";
-import { logger } from "../../lib/utils/logger.js";
+import { logger } from "../../utils/logger.js";
 /**
  * Resolved per call rather than at module load so `detect()` and `apply()`
  * agree when HOME changes — under test, and on the `--dev` isolation path.

package/dist/cli/proxy-clients/openCode.d.ts

@@ -4,7 +4,7 @@
  * Moved verbatim out of `proxy.ts` so that adding a CLI means adding a file
  * here rather than editing a 5,000-line command module in seven places.
  */
-import type { CliProxyClientConfigurator } from "../../lib/types/index.js";
+import type { CliProxyClientConfigurator } from "../../types/index.js";
 declare function getOpenCodeConfigDir(): string;
 declare function getOpenCodeConfigPath(): string;
 export declare function setOpenCodeProxySettings(baseUrl: string, proxyKey?: string): Promise<boolean>;

package/dist/cli/proxy-clients/openCode.js

@@ -6,7 +6,7 @@
  */
 import { homedir } from "os";
 import { join } from "path";
-import { logger } from "../../lib/utils/logger.js";
+import { logger } from "../../utils/logger.js";
 import { cloneForSnapshot, isProxyOwnedValue, shouldCaptureSnapshot, } from "./snapshot.js";
 function getOpenCodeConfigDir() {
     // OpenCode resolves this with the unmodified `xdg-basedir` package —

package/dist/cli/proxy-clients/qwenCode.d.ts

@@ -17,7 +17,7 @@
  *     "$version": 2
  *   }
  */
-import type { CliProxyClientConfigurator } from "../../lib/types/index.js";
+import type { CliProxyClientConfigurator } from "../../types/index.js";
 /**
  * Resolved per call rather than at module load so `detect()` and `apply()`
  * agree when HOME changes — under test, and on the `--dev` isolation path.

package/dist/cli/proxy-clients/qwenCode.js

@@ -19,7 +19,7 @@
  */
 import { homedir } from "os";
 import { join } from "path";
-import { logger } from "../../lib/utils/logger.js";
+import { logger } from "../../utils/logger.js";
 import { cloneForSnapshot, isProxyOwnedValue, shouldCaptureSnapshot, } from "./snapshot.js";
 /**
  * Resolved per call rather than at module load so `detect()` and `apply()`

package/dist/cli/proxy-clients/registry.d.ts

@@ -1,4 +1,4 @@
-import type { CliProxyClientApplyResult, CliProxyClientConfigurator, CliProxyClientRestoreResult } from "../../lib/types/index.js";
+import type { CliProxyClientApplyResult, CliProxyClientConfigurator, CliProxyClientRestoreResult } from "../../types/index.js";
 /**
  * Every CLI the proxy auto-configures, in apply order.
  *

package/dist/cli/proxy-clients/registry.js

@@ -1,4 +1,4 @@
-import { logger } from "../../lib/utils/logger.js";
+import { logger } from "../../utils/logger.js";
 import { claudeCodeConfigurator } from "./claudeCode.js";
 import { openCodeConfigurator } from "./openCode.js";
 import { codexConfigurator } from "./codex.js";

package/dist/cli/utils/audioFileUtils.d.ts

@@ -6,7 +6,7 @@
  *
  * @module cli/utils/audioFileUtils
  */
-import type { TTSResult, AudioSaveResult, TTSAudioFormat } from "../../lib/types/index.js";
+import type { TTSResult, AudioSaveResult, TTSAudioFormat } from "../../types/index.js";
 /**
  * Format file size in human-readable format
  *

package/dist/cli/utils/audioPlayer.d.ts

@@ -6,7 +6,7 @@
  *
  * @module cli/utils/audioPlayer
  */
-import type { TTSAudioFormat, CliAudioPlayerCommand } from "../../lib/types/index.js";
+import type { TTSAudioFormat, CliAudioPlayerCommand } from "../../types/index.js";
 /**
  * Get the file extension for an audio format
  *

package/dist/cli/utils/classifierRouterFlags.d.ts

@@ -4,7 +4,7 @@
  * Side-effect-free so it can be unit-tested without a running NeuroLink
  * instance. Mirrors the `--tool-routing-*` flag parser.
  */
-import type { CliClassifierRouterFlags, ClassifierRouterConfig } from "../../lib/types/index.js";
+import type { CliClassifierRouterFlags, ClassifierRouterConfig } from "../../types/index.js";
 /**
  * Build a {@link ClassifierRouterConfig} from the parsed CLI flags.
  *

package/dist/cli/utils/classifierRouterFlags.js

@@ -5,7 +5,7 @@
  * instance. Mirrors the `--tool-routing-*` flag parser.
  */
 import fs from "node:fs";
-import { logger } from "../../lib/utils/logger.js";
+import { logger } from "../../utils/logger.js";
 // Trust model: --classifier-pool is a local, user-supplied CLI flag. The
 // invoking user already holds the process's OS permissions, so absolute and
 // home-dir config paths are fully supported — there is no cross-trust boundary

package/dist/cli/utils/completeSetup.d.ts

@@ -4,7 +4,7 @@
  * Orchestrates the entire setup process: interactive wizard, environment management,
  * provider testing, and summary display.
  */
-import type { SetupResult } from "../../lib/types/index.js";
+import type { SetupResult } from "../../types/index.js";
 /**
  * Run the complete interactive setup process
  */

package/dist/cli/utils/completeSetup.js

@@ -7,7 +7,7 @@
 import { runInteractiveSetup, testProviderConnectivity, displaySetupSummary, } from "./interactiveSetup.js";
 import { updateEnvFile, displayEnvUpdateSummary } from "./envManager.js";
 import chalk from "chalk";
-import { logger } from "../../lib/utils/logger.js";
+import { logger } from "../../utils/logger.js";
 /**
  * Run the complete interactive setup process
  */

package/dist/cli/utils/envManager.d.ts

@@ -3,7 +3,7 @@
  *
  * Handles .env file operations including backup, update, and validation.
  */
-import type { EnvBackupResult, EnvUpdateResult } from "../../lib/types/index.js";
+import type { EnvBackupResult, EnvUpdateResult } from "../../types/index.js";
 /**
  * Create a timestamped backup of the existing .env file
  */

package/dist/cli/utils/envManager.js

@@ -5,7 +5,7 @@
  */
 import fs from "fs";
 import chalk from "chalk";
-import { logger } from "../../lib/utils/logger.js";
+import { logger } from "../../utils/logger.js";
 /**
  * Create a timestamped backup of the existing .env file
  */

package/dist/cli/utils/inputValidation.js

@@ -12,8 +12,8 @@
 import fs from "node:fs";
 import { fileURLToPath } from "node:url";
 import chalk from "chalk";
-import { logger } from "../../lib/utils/logger.js";
-import { redactUrlForError } from "../../lib/utils/logSanitize.js";
+import { logger } from "../../utils/logger.js";
+import { redactUrlForError } from "../../utils/logSanitize.js";
 import { resolveFilePath } from "./pathResolver.js";
 /**
  * Soft (warn-only) size thresholds for CLI multimodal flags. Intentionally

package/dist/cli/utils/interactiveSetup.d.ts

@@ -4,8 +4,8 @@
  * Provides interactive configuration wizard with provider selection,
  * credential collection, testing, and environment file management.
  */
-import { AIProviderName } from "../../lib/constants/enums.js";
-import type { InteractiveProviderConfig, SetupResult } from "../../lib/types/index.js";
+import { AIProviderName } from "../../constants/enums.js";
+import type { InteractiveProviderConfig, SetupResult } from "../../types/index.js";
 export declare const PROVIDER_CONFIGS: InteractiveProviderConfig[];
 /**
  * Run the interactive setup wizard

package/dist/cli/utils/interactiveSetup.js

@@ -4,11 +4,11 @@
  * Provides interactive configuration wizard with provider selection,
  * credential collection, testing, and environment file management.
  */
-import { AIProviderName } from "../../lib/constants/enums.js";
-import { NeuroLink } from "../../lib/neurolink.js";
+import { AIProviderName } from "../../constants/enums.js";
+import { NeuroLink } from "../../neurolink.js";
 import chalk from "chalk";
 import ora from "ora";
-import { logger } from "../../lib/utils/logger.js";
+import { logger } from "../../utils/logger.js";
 export const PROVIDER_CONFIGS = [
     {
         id: AIProviderName.OPENAI,

package/dist/cli/utils/ollamaUtils.d.ts

@@ -1,5 +1,5 @@
 import { type SpawnSyncReturns, type SpawnSyncOptions } from "child_process";
-import type { AllowedCommand } from "../../lib/types/index.js";
+import type { AllowedCommand } from "../../types/index.js";
 /**
  * Shared Ollama utilities for CLI commands
  */

package/dist/cli/utils/ollamaUtils.js

@@ -1,7 +1,7 @@
 import { spawnSync, spawn, } from "child_process";
 import chalk from "chalk";
 import ora from "ora";
-import { logger } from "../../lib/utils/logger.js";
+import { logger } from "../../utils/logger.js";
 /**
  * Shared Ollama utilities for CLI commands
  */

package/dist/cli/utils/skillsFlags.d.ts

@@ -6,5 +6,5 @@
  * filesystem store for generate / stream / batch / loop runs. Returns null
  * when neither is provided so the SDK stays skills-free by default.
  */
-import type { SkillsConfig } from "../../lib/types/index.js";
+import type { SkillsConfig } from "../../types/index.js";
 export declare function buildSkillsConfigFromCli(options: Record<string, unknown>): SkillsConfig | null;

package/dist/cli/utils/toolRoutingFlags.d.ts

@@ -4,7 +4,7 @@
  * This module is intentionally side-effect-free so it can be unit-tested
  * without a running NeuroLink instance.
  */
-import type { CliToolRoutingFlags, ToolRoutingConfig } from "../../lib/types/index.js";
+import type { CliToolRoutingFlags, ToolRoutingConfig } from "../../types/index.js";
 /**
  * Build a {@link ToolRoutingConfig} from the parsed CLI flags.
  *

package/dist/cli/utils/toolRoutingFlags.js

@@ -5,7 +5,7 @@
  * without a running NeuroLink instance.
  */
 import fs from "node:fs";
-import { logger } from "../../lib/utils/logger.js";
+import { logger } from "../../utils/logger.js";
 /**
  * Build a {@link ToolRoutingConfig} from the parsed CLI flags.
  *

package/dist/cli/utils/videoFileUtils.d.ts

@@ -7,7 +7,7 @@
  *
  * @module cli/utils/videoFileUtils
  */
-import type { VideoGenerationResult, VideoSaveResult } from "../../lib/types/index.js";
+import type { VideoGenerationResult, VideoSaveResult } from "../../types/index.js";
 /**
  * Format file size in human-readable format
  *

package/dist/processors/data/XmlProcessor.d.ts

@@ -15,6 +15,20 @@
  * 2. **Mitigation**: We reject XML files containing DOCTYPE or ENTITY declarations
  *    and disable entity processing in the parser.
  *
+ * ⚠️ **Reachability**: this guard is not currently wired into the
+ * `generate()`/`stream()` attachment pipeline for a standalone `.xml` file.
+ * `src/lib/processors/config/fileTypeRegistry.ts` has no `"xml"` entry,
+ * `src/lib/utils/mimeTypeHints.ts` maps `application/xml`/`text/xml` to the
+ * generic `"text"` file type, and `messageBuilder.ts`'s `allowedTypes`
+ * whitelist has no `"xml"` entry either — so a `.xml` attachment is always
+ * routed to inert generic-text handling, and `checkXxeVectors()` /
+ * `parseXmlSecurely()` below are never invoked from that path. The
+ * `ProcessorRegistry` subsystem that does own this file has no importer
+ * outside `src/lib/processors/` itself. The guard is correct; it is simply
+ * orphaned. See `test/continuous-test-suite-office-security.ts`'s header for
+ * the test-coverage consequence — no e2e test exercises this file today,
+ * because there is no public surface that reaches it (CLAUDE.md rule 15).
+ *
  * References:
  * - https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing
  * - https://cwe.mitre.org/data/definitions/611.html (XXE)

package/dist/processors/data/XmlProcessor.js

@@ -15,6 +15,20 @@
  * 2. **Mitigation**: We reject XML files containing DOCTYPE or ENTITY declarations
  *    and disable entity processing in the parser.
  *
+ * ⚠️ **Reachability**: this guard is not currently wired into the
+ * `generate()`/`stream()` attachment pipeline for a standalone `.xml` file.
+ * `src/lib/processors/config/fileTypeRegistry.ts` has no `"xml"` entry,
+ * `src/lib/utils/mimeTypeHints.ts` maps `application/xml`/`text/xml` to the
+ * generic `"text"` file type, and `messageBuilder.ts`'s `allowedTypes`
+ * whitelist has no `"xml"` entry either — so a `.xml` attachment is always
+ * routed to inert generic-text handling, and `checkXxeVectors()` /
+ * `parseXmlSecurely()` below are never invoked from that path. The
+ * `ProcessorRegistry` subsystem that does own this file has no importer
+ * outside `src/lib/processors/` itself. The guard is correct; it is simply
+ * orphaned. See `test/continuous-test-suite-office-security.ts`'s header for
+ * the test-coverage consequence — no e2e test exercises this file today,
+ * because there is no public surface that reaches it (CLAUDE.md rule 15).
+ *
  * References:
  * - https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing
  * - https://cwe.mitre.org/data/definitions/611.html (XXE)

package/dist/processors/document/PptxProcessor.d.ts

@@ -14,6 +14,15 @@
  *
  * Uses `adm-zip` (already a project dependency) for ZIP extraction.
  *
+ * **XML-entity attacks are not applicable here.** Unlike `WordProcessor`
+ * (mammoth/@xmldom/xmldom) and `ExcelProcessor` (exceljs/saxes), this
+ * processor never hands slide XML to a DOM or SAX parser at all — extraction
+ * is a single regex (`TEXT_ELEMENT_REGEX`, below) run over the raw decoded
+ * bytes. There is no DOCTYPE/ENTITY resolution path for a payload to reach,
+ * so there is nothing for a `.pptx`-specific XXE or billion-laughs test to
+ * falsify; one is deliberately not written (see
+ * `test/continuous-test-suite-office-security.ts`'s header).
+ *
  * @module processors/document/PptxProcessor
  *
  * @example

package/dist/processors/document/PptxProcessor.js

@@ -14,6 +14,15 @@
  *
  * Uses `adm-zip` (already a project dependency) for ZIP extraction.
  *
+ * **XML-entity attacks are not applicable here.** Unlike `WordProcessor`
+ * (mammoth/@xmldom/xmldom) and `ExcelProcessor` (exceljs/saxes), this
+ * processor never hands slide XML to a DOM or SAX parser at all — extraction
+ * is a single regex (`TEXT_ELEMENT_REGEX`, below) run over the raw decoded
+ * bytes. There is no DOCTYPE/ENTITY resolution path for a payload to reach,
+ * so there is nothing for a `.pptx`-specific XXE or billion-laughs test to
+ * falsify; one is deliberately not written (see
+ * `test/continuous-test-suite-office-security.ts`'s header).
+ *
  * @module processors/document/PptxProcessor
  *
  * @example

package/dist/processors/media/VideoProcessor.js

@@ -99,6 +99,34 @@ async function loadMediaBunny() {
     _mediabunny = await tryImport("mediabunny", "Video processing");
     return _mediabunny;
 }
+// Keyframe resize (both extraction paths) previously swallowed a missing
+// `sharp` with a fully silent per-frame catch — every frame failed the same
+// way and nothing ever said why. Route the import through this loader so the
+// cause is logged once (not once per frame) the first time it fails; the
+// per-frame catch sites still skip individually, matching prior behavior.
+let sharpLoadWarned = false;
+async function loadSharp() {
+    try {
+        // `typeof import("sharp")` is the MODULE namespace, and sharp 0.35 puts
+        // the callable factory on its `default` export. Typing the import as
+        // `{ default: typeof import("sharp") }` wrapped that namespace a second
+        // time, so `mod.default` came back as a namespace rather than a factory
+        // and every call site failed with "no call signatures".
+        //
+        // imageFormatSupport.ts already reads `sharpModule.default(...)` for the
+        // same reason; this loader is now the one place that normalizes it, so
+        // callers keep calling the returned value directly.
+        const mod = await tryImport("sharp", "Video keyframe resizing");
+        return mod.default;
+    }
+    catch (error) {
+        if (!sharpLoadWarned) {
+            sharpLoadWarned = true;
+            logger.warn("[VideoProcessor] sharp is required to resize extracted keyframes but failed to load; keyframe extraction will return no frames", { error: error instanceof Error ? error.message : String(error) });
+        }
+        throw error;
+    }
+}
 // =============================================================================
 // FFMPEG PATH INITIALIZATION
 // =============================================================================
@@ -707,7 +735,7 @@ export class VideoProcessor extends BaseFileProcessor {
                 await fs.access(framePath);
                 const rawFrame = await fs.readFile(framePath);
                 // Resize to fit within max dimension while preserving aspect ratio
-                const sharp = (await import("sharp")).default;
+                const sharp = await loadSharp();
                 const pipeline = sharp(rawFrame).resize(VIDEO_CONFIG.FRAME_MAX_DIMENSION, VIDEO_CONFIG.FRAME_MAX_DIMENSION, {
                     fit: "inside",
                     withoutEnlargement: true,
@@ -1042,7 +1070,7 @@ export class VideoProcessor extends BaseFileProcessor {
                 try {
                     await fs.access(framePath);
                     const rawFrame = await fs.readFile(framePath);
-                    const sharp = (await import("sharp")).default;
+                    const sharp = await loadSharp();
                     const resized = await sharp(rawFrame)
                         .resize(VIDEO_CONFIG.FRAME_MAX_DIMENSION, VIDEO_CONFIG.FRAME_MAX_DIMENSION, {
                         fit: "inside",

package/dist/providers/amazonBedrock/client.js

@@ -1,4 +1,4 @@
-import { BedrockRuntimeClient, ImageFormat, } from "@aws-sdk/client-bedrock-runtime";
+import { BedrockRuntimeClient, ImageFormat, InvokeModelCommand, } from "@aws-sdk/client-bedrock-runtime";
 import path from "path";
 import { createAnalytics } from "../../core/analytics.js";
 import { BaseProvider } from "../../core/baseProvider.js";
@@ -1109,7 +1109,6 @@ export class AmazonBedrockProvider extends BaseProvider {
             textLength: text.length,
         });
         try {
-            const { InvokeModelCommand } = await import("@aws-sdk/client-bedrock-runtime");
             // Titan Embed models expect a specific input format
             const requestBody = JSON.stringify({
                 inputText: text,

package/dist/providers/googleVertex/index.d.ts

@@ -1,3 +1,2 @@
 export * from "./client.js";
 export * from "./constants.js";
-export * from "./utils.js";

package/dist/providers/googleVertex/index.js

@@ -1,3 +1,2 @@
 export * from "./client.js";
 export * from "./constants.js";
-export * from "./utils.js";

package/dist/rag/document/loaders.js

@@ -227,55 +227,83 @@ export class PDFLoader {
             source,
             pageRange: options?.pageRange,
         });
+        let PDFParse;
         try {
-            // Try to use pdf-parse if available
-            const pdfParse = await this.loadPdfParser();
-            const buffer = await readFile(source);
-            const data = await pdfParse(buffer);
+            PDFParse = await this.loadPdfParser();
+        }
+        catch (error) {
+            // pdf-parse genuinely isn't installed / doesn't expose a usable
+            // export — degrade gracefully rather than throwing.
+            logger.warn("[PDFLoader] pdf-parse not available, using fallback", {
+                error: error instanceof Error ? error.message : String(error),
+            });
+            return new MDocument(`[PDF Document: ${basename(source)}]\n\nNote: PDF parsing requires the 'pdf-parse' package. Install it with:\n  npm install pdf-parse`, {
+                type: "pdf",
+                metadata: {
+                    source: basename(source),
+                    parseError: "pdf-parse not available",
+                    ...options?.metadata,
+                },
+            });
+        }
+        const buffer = await readFile(source);
+        const parser = new PDFParse({ data: buffer });
+        try {
+            const data = await parser.getText();
             const text = data.text;
             // Handle page range if specified
             if (options?.pageRange) {
-                const _pages = this.parsePageRange(options.pageRange, data.numpages);
+                const _pages = this.parsePageRange(options.pageRange, data.total);
                 // Note: pdf-parse doesn't support page selection directly
                 // This is a placeholder for more sophisticated page handling
                 logger.debug("[PDFLoader] Page range requested but not fully supported", {
                     pageRange: options.pageRange,
-                    totalPages: data.numpages,
+                    totalPages: data.total,
                 });
             }
             return new MDocument(text, {
                 type: "pdf",
                 metadata: {
                     source: basename(source),
-                    pageCount: data.numpages,
-                    info: data.info,
+                    pageCount: data.total,
                     ...options?.metadata,
                 },
             });
         }
         catch (error) {
-            // Fallback: Return placeholder document
-            logger.warn("[PDFLoader] pdf-parse not available, using fallback", {
-                error: error instanceof Error ? error.message : String(error),
+            // pdf-parse IS installed and loaded fine, but failed on this
+            // specific file (corrupt PDF, password-protected, unsupported
+            // structure, etc.). Keep this distinct from the "not installed"
+            // fallback above — both surface as a placeholder document, but the
+            // message, parseError value, and log level differ so a genuine
+            // parse failure is never mistaken for a missing dependency.
+            const message = error instanceof Error ? error.message : String(error);
+            logger.error("[PDFLoader] pdf-parse failed to parse PDF", {
+                source,
+                error: message,
             });
-            return new MDocument(`[PDF Document: ${basename(source)}]\n\nNote: PDF parsing requires the 'pdf-parse' package. Install it with:\n  npm install pdf-parse`, {
+            return new MDocument(`[PDF Document: ${basename(source)}]\n\nNote: PDF parsing failed for this file: ${message}`, {
                 type: "pdf",
                 metadata: {
                     source: basename(source),
-                    parseError: "pdf-parse not available",
+                    parseError: `pdf-parse failed: ${message}`,
                     ...options?.metadata,
                 },
             });
         }
+        finally {
+            await parser.destroy();
+        }
     }
     canHandle(source) {
         const ext = extname(source).toLowerCase();
         return ext === ".pdf";
     }
     async loadPdfParser() {
-        // pdf-parse is an optional dependency — resolve it dynamically and
-        // validate at runtime that it exposes a callable parser (either the
-        // module itself or its default export) instead of blindly asserting.
+        // pdf-parse v2 exports a `PDFParse` class (`new PDFParse({ data }).getText()`)
+        // instead of v1's bare callable — resolve it dynamically and validate at
+        // runtime that the export shape is actually present instead of blindly
+        // asserting.
         let pdfParseModule;
         try {
             pdfParseModule = await import("pdf-parse");
@@ -283,15 +311,15 @@ export class PDFLoader {
         catch {
             throw new Error("pdf-parse module not available");
         }
-        const candidate = (typeof pdfParseModule === "object" &&
+        const candidate = typeof pdfParseModule === "object" &&
             pdfParseModule !== null &&
-            "default" in pdfParseModule
-            ? pdfParseModule.default
-            : undefined) || pdfParseModule;
+            "PDFParse" in pdfParseModule
+            ? pdfParseModule.PDFParse
+            : undefined;
         if (typeof candidate !== "function") {
             // Outside the try/catch so this message isn't swallowed by the
             // module-not-available rethrow.
-            throw new Error("pdf-parse module does not export a parse function");
+            throw new Error("pdf-parse module does not export a PDFParse class");
         }
         return candidate;
     }