@juspay/neurolink 12.19.2 → 12.20.1

package/dist/utils/imageProcessor.js

@@ -65,6 +65,153 @@ const RETRYABLE_ERROR_CODES = new Set([
     "ETIMEDOUT",
     "ERR_NETWORK",
 ]);
+/**
+ * Bytes of prologue {@link hasSvgRoot} decodes and scans.
+ *
+ * A real SVG reaches its root within a few hundred bytes, so 4KB is generous.
+ * The cap exists because scanning the whole buffer made every unrecognized
+ * binary — and every BMP/TIFF/ICO/AVIF, whose checks run after this one — pay
+ * a full UTF-8 decode, and let a crafted unterminated doctype walk every byte
+ * (measured: 322ms on 32MB, 69ms to reject a 16MB BMP).
+ */
+const SVG_PROLOGUE_SCAN_BYTES = 4096;
+/**
+ * Find an SVG root after XML's permitted leading constructs.
+ *
+ * Deliberately a discriminator, not an XML parser. Raster magic is checked
+ * first; this only distinguishes text reaching an SVG root after a UTF-8 BOM,
+ * XML whitespace, processing instructions, comments, or a doctype. The doctype
+ * scanner tracks quotes, comments/PIs, and the internal subset so a `>` or
+ * `]` inside any of them cannot expose a later `<svg` early. The root itself
+ * may carry an XML namespace prefix (`<s:svg xmlns:s="...">`), which is
+ * accepted alongside the bare `<svg` form.
+ *
+ * Scanning a bounded window makes "unterminated" ambiguous, and the two cases
+ * must resolve OPPOSITE ways:
+ *
+ *  - the WINDOW ran out — the rest of the document is unreadable from here, so
+ *    fail CLOSED and answer SVG. This function gates a rejection, so answering
+ *    raster on an unterminated prologue would hand back the exact bypass it
+ *    exists to close: prepend filler past the window and sail through as
+ *    raster. A raster file never opens `<!--` or `<!doctype`, so the
+ *    false-positive cost is a skipped image; the other direction is the
+ *    vulnerability.
+ *  - the BUFFER ran out — the whole document was read and is malformed, so it
+ *    is genuinely not an SVG.
+ */
+function hasSvgRoot(input) {
+    const windowed = input.length > SVG_PROLOGUE_SCAN_BYTES;
+    const text = input
+        .subarray(0, Math.min(input.length, SVG_PROLOGUE_SCAN_BYTES))
+        .toString("utf8");
+    let position = text.charCodeAt(0) === 0xfeff ? 1 : 0;
+    const skipWhitespace = () => {
+        while (/\s/.test(text[position] ?? "")) {
+            position++;
+        }
+    };
+    const skipDoctype = () => {
+        let quote;
+        let subsetDepth = 0;
+        let index = position + 9;
+        while (index < text.length) {
+            const char = text[index];
+            if (quote) {
+                if (char === quote) {
+                    quote = undefined;
+                }
+                index++;
+                continue;
+            }
+            // Comments and processing instructions are valid markup inside the
+            // internal subset (and, leniently, anywhere else in the declaration)
+            // and may themselves contain `]` or `>` — e.g. `<!-- ] > -->`. Skip
+            // them as opaque spans, the same way the outer scan does, so their
+            // contents can never be misread as the subset-close or doctype-end
+            // delimiter.
+            if (text.startsWith("<!--", index)) {
+                const end = text.indexOf("-->", index + 4);
+                if (end < 0) {
+                    return false;
+                }
+                index = end + 3;
+                continue;
+            }
+            if (text.startsWith("<?", index)) {
+                const end = text.indexOf("?>", index + 2);
+                if (end < 0) {
+                    return false;
+                }
+                index = end + 2;
+                continue;
+            }
+            if (char === '"' || char === "'") {
+                quote = char;
+            }
+            else if (char === "[") {
+                subsetDepth++;
+            }
+            else if (char === "]" && subsetDepth > 0) {
+                subsetDepth--;
+            }
+            else if (char === ">" && subsetDepth === 0) {
+                position = index + 1;
+                return true;
+            }
+            index++;
+        }
+        return false;
+    };
+    skipWhitespace();
+    while (position < text.length) {
+        if (text.startsWith("<?", position)) {
+            const end = text.indexOf("?>", position + 2);
+            if (end < 0) {
+                return windowed;
+            }
+            position = end + 2;
+        }
+        else if (text.startsWith("<!--", position)) {
+            const end = text.indexOf("-->", position + 4);
+            if (end < 0) {
+                return windowed;
+            }
+            position = end + 3;
+        }
+        else if (text.slice(position, position + 9).toLowerCase() === "<!doctype") {
+            if (!skipDoctype()) {
+                return windowed;
+            }
+        }
+        else {
+            break;
+        }
+        skipWhitespace();
+    }
+    const rest = text.slice(position);
+    // Accepts an optional XML namespace prefix ahead of the tag name — an
+    // NCName (letters/digits/`.`/`-`/`_`, not starting with a digit) followed
+    // by `:` — so `<s:svg xmlns:s="...">` matches the same way bare `<svg`
+    // does.
+    if (/^<(?:[A-Za-z_][\w.-]*:)?svg(?:[\s/>])/i.test(rest)) {
+        return true;
+    }
+    // A fixed "`<svg` plus its delimiter is 5 characters" cutoff only worked
+    // when the tag name was the literal `svg`. With a namespace prefix now
+    // accepted, the prefix is unbounded (any NCName), so no fixed length can
+    // bound "may still be mid-token" — `<s:svg` (6 chars) is just as
+    // truncatable as `<svg` (4) was. Instead, check whether `rest` could still
+    // be the START of a string this function would accept: an optional NCName
+    // prefix, optionally followed by `:` and however much of the literal
+    // `svg` has been seen so far, with nothing left over. Anything left over
+    // (a character that cannot continue the prefix, isn't `:`, or doesn't
+    // continue "svg") proves `rest` can never complete into a match, so it is
+    // safe to answer false even though the window is cut. An empty `rest` is
+    // the same ambiguity in the degenerate case (no root text observed yet).
+    const isUnresolvedPrefix = rest.length === 0 ||
+        /^<(?:[A-Za-z_][\w.-]*)?(?::(?:s(?:v(?:g)?)?)?)?$/i.test(rest);
+    return windowed && isUnresolvedPrefix;
+}
 /**
  * Determines if an HTTP error is retryable based on status code
  * Only network errors and certain HTTP status codes should be retried
@@ -452,12 +599,10 @@ export class ImageProcessor {
                         return "image/webp";
                     }
                 }
-                // SVG: check for "<svg" or "<?xml" at start (text-based)
-                if (input.length >= 4) {
-                    const start = input.subarray(0, 4).toString();
-                    if (start === "<svg" || start === "<?xm") {
-                        return "image/svg+xml";
-                    }
+                // SVG is text-based and may legally put a BOM, whitespace, an XML
+                // declaration, comments, or a doctype before its root element.
+                if (hasSvgRoot(input)) {
+                    return "image/svg+xml";
                 }
                 // ISO-BMFF images: "ftyp" box at offset 4, major brand at offset 8.
                 // AVIF has codec-specific major brands. HEIC uses HEVC image/sequence

package/dist/utils/messageBuilder.d.ts

@@ -1,4 +1,4 @@
-import type { GenerateOptions, MultimodalChatMessage, StreamOptions, TextGenerationOptions } from "../types/index.js";
+import type { GenerateOptions, MultimodalChatMessage, StreamOptions, TextGenerationOptions, VisionImageOutputFormat } from "../types/index.js";
 import type { ModelMessage } from "../types/index.js";
 /**
  * Type-safe conversion from MultimodalChatMessage[] to ModelMessage[]
@@ -56,4 +56,4 @@ export declare function buildMultimodalMessagesArray(options: GenerateOptions, p
  * Entries that are `http(s)` URLs are left alone — they have no bytes yet, and
  * `processImageToBase64` converts them once they are downloaded.
  */
-export declare function normalizeVisionImageFormats(input: GenerateOptions["input"]): Promise<void>;
+export declare function normalizeVisionImageFormats(input: GenerateOptions["input"], outputFormat?: VisionImageOutputFormat): Promise<void>;

package/dist/utils/messageBuilder.js

@@ -1352,7 +1352,7 @@ export async function buildMultimodalMessagesArray(options, provider, model) {
     await processUnifiedFilesArray(options, maxSize, provider);
     // Detection can append images (PDF page renders, video keyframes, a HEIC
     // photo), so compatibility conversion has to run after it, not before.
-    await normalizeVisionImageFormats(inp);
+    await normalizeVisionImageFormats(inp, options.imageOptions?.outputFormat);
     // Process explicit CSV files array
     await processExplicitCsvFiles(options);
     // Post-processing budget enforcement and token usage logging
@@ -1486,7 +1486,7 @@ export async function buildMultimodalMessagesArray(options, provider, model) {
             // the multimodal converter below, so the bytes were dropped and only the
             // metadata summary folded into `text` survived. Exactly the failure this
             // change exists to remove, reintroduced through the other door.
-            userContent = await convertContentToProviderFormat(inp.content, provider, model, options.pdfOptions, inp.nativeAudioFiles ?? []);
+            userContent = await convertContentToProviderFormat(inp.content, provider, model, options.pdfOptions, inp.nativeAudioFiles ?? [], options.imageOptions?.outputFormat);
         }
         else if ((inp.images && inp.images.length > 0) ||
             pdfFiles.length > 0 ||
@@ -1495,7 +1495,10 @@ export async function buildMultimodalMessagesArray(options, provider, model) {
             // recording was dropped and only its metadata summary — already folded
             // into `text` — ever reached the model.
             (inp.nativeAudioFiles?.length ?? 0) > 0) {
-            userContent = await convertMultimodalToProviderFormat(inp.text ?? "", inp.images || [], pdfFiles, provider, model, inp.nativeAudioFiles ?? []);
+            userContent = await convertMultimodalToProviderFormat(inp.text ?? "", inp.images || [], pdfFiles, provider, model, {
+                audioFiles: inp.nativeAudioFiles ?? [],
+                outputFormat: options.imageOptions?.outputFormat,
+            });
         }
         else {
             userContent = inp.text;
@@ -1571,7 +1574,7 @@ async function appendCsvContentToText(csvItems, baseText) {
 /**
  * Convert advanced content format to provider-specific format
  */
-async function convertContentToProviderFormat(content, provider, _model, pdfOptions, audioFiles = []) {
+async function convertContentToProviderFormat(content, provider, _model, pdfOptions, audioFiles = [], outputFormat) {
     const textContent = content.find((c) => c.type === "text");
     const imageContent = content.filter((c) => c.type === "image");
     const pdfContent = content.filter((c) => c.type === "pdf");
@@ -1624,7 +1627,10 @@ async function convertContentToProviderFormat(content, provider, _model, pdfOpti
     await enforceAggregatePdfLimits(pdfFiles, provider, {
         trustSuppliedPageCounts: false,
     });
-    return await convertMultimodalToProviderFormat(text, images, pdfFiles, provider, _model, audioFiles);
+    return await convertMultimodalToProviderFormat(text, images, pdfFiles, provider, _model, {
+        audioFiles,
+        outputFormat,
+    });
 }
 /**
  * Check if a string is an internet URL
@@ -1868,7 +1874,7 @@ async function convertFilePathToBase64(filePath) {
  * Passing raw base64 avoids this because `new URL(base64string)` throws and
  * the SDK treats the string as inline base64 data instead.
  */
-async function processImageToBase64(image, index) {
+async function processImageToBase64(image, index, outputFormat) {
     let imageData;
     let mimeType = "image/jpeg"; // Default mime type
     if (typeof image === "string") {
@@ -1947,7 +1953,7 @@ async function processImageToBase64(image, index) {
         const context = `image input at index ${index}`;
         ImageProcessor.validateSize(base64DecodedByteLength(imageData), context);
         const rawImage = Buffer.from(imageData, "base64");
-        const compatible = await toVisionCompatibleImage(rawImage, mimeType);
+        const compatible = await toVisionCompatibleImage(rawImage, mimeType, outputFormat);
         if (compatible.converted) {
             imageData = compatible.buffer.toString("base64");
             mimeType = compatible.mimeType;
@@ -1968,7 +1974,7 @@ async function processImageToBase64(image, index) {
  * Entries that are `http(s)` URLs are left alone — they have no bytes yet, and
  * `processImageToBase64` converts them once they are downloaded.
  */
-export async function normalizeVisionImageFormats(input) {
+export async function normalizeVisionImageFormats(input, outputFormat) {
     const images = input?.images;
     if (!images || images.length === 0) {
         return;
@@ -1985,7 +1991,7 @@ export async function normalizeVisionImageFormats(input) {
         if (!source || !needsVisionTranscode(source.mimeType)) {
             continue;
         }
-        const compatible = await toVisionCompatibleImage(source.buffer, source.mimeType);
+        const compatible = await toVisionCompatibleImage(source.buffer, source.mimeType, outputFormat);
         if (!compatible.converted) {
             continue;
         }
@@ -2115,7 +2121,7 @@ async function readImageSourceForConversion(payload) {
  * - Buffers/Data URIs: Processed normally
  * - Supports alt text for accessibility (included as context in text parts)
  */
-async function convertSimpleImagesToProviderFormat(text, images, provider, _model) {
+async function convertSimpleImagesToProviderFormat(text, images, provider, _model, outputFormat) {
     // Validate image count against provider-specific limits before processing
     ProviderImageAdapter.validateImageCount(images.length, provider, _model);
     // For Vercel AI SDK, we need to return the content in the standard format
@@ -2172,7 +2178,7 @@ async function convertSimpleImagesToProviderFormat(text, images, provider, _mode
     for (const [index, { data: image }] of actualImages.entries()) {
         try {
             // Use helper function to process image and reduce nesting depth
-            const { imageData, mimeType } = await processImageToBase64(image, index);
+            const { imageData, mimeType } = await processImageToBase64(image, index, outputFormat);
             content.push({
                 type: "image",
                 image: imageData,
@@ -2195,13 +2201,17 @@ async function convertSimpleImagesToProviderFormat(text, images, provider, _mode
 async function convertMultimodalToProviderFormat(text, images, 
 // The canonical entry shape (#309) rather than a fourth copy of it inline —
 // which is what let the render knobs stop short of this function.
-pdfFiles, provider, model, audioFiles = []) {
+pdfFiles, provider, model, 
+// Bundled rather than two more positional params: a 7th would trip the
+// repo's `max-params` ceiling of 6.
+mediaOptions = {}) {
+    const { audioFiles = [], outputFormat } = mediaOptions;
     const content = [
         { type: "text", text },
     ];
     // Add images if present
     if (images.length > 0) {
-        const imageContent = await convertSimpleImagesToProviderFormat("", images, provider, model);
+        const imageContent = await convertSimpleImagesToProviderFormat("", images, provider, model, outputFormat);
         if (Array.isArray(imageContent)) {
             imageContent.forEach((item) => {
                 if (item.type !== "text") {

package/dist/utils/multimodalOptionsBuilder.d.ts

@@ -61,6 +61,9 @@ export declare function buildMultimodalOptions(options: StreamOptions, providerN
         scale?: number;
         maxPages?: number;
     } | undefined;
+    imageOptions: {
+        outputFormat?: import("../index.js").VisionImageOutputFormat;
+    } | undefined;
     systemPrompt: string | undefined;
     conversationHistory: import("../index.js").ChatMessage[] | undefined;
     provider: string;

package/dist/utils/multimodalOptionsBuilder.js

@@ -59,6 +59,7 @@ export function buildMultimodalOptions(options, providerName, modelName) {
         },
         csvOptions: options.csvOptions,
         pdfOptions: options.pdfOptions,
+        imageOptions: options.imageOptions,
         systemPrompt: options.systemPrompt,
         conversationHistory: options.conversationMessages,
         provider: providerName,