@juspay/neurolink 12.22.1 → 12.23.0

package/dist/providers/catalog/friendli.json

@@ -0,0 +1,130 @@
+{
+    "$schema": "./provider-catalog.schema.json",
+    "id": "friendli",
+    "displayName": "FriendliAI",
+    "aliases": [],
+    "tier": 2,
+    "wire": {
+        "baseURL": "https://api.friendli.ai/serverless/v1"
+    },
+    "models": {
+        "default": "zai-org/GLM-5.3",
+        "fallbacks": [
+            "zai-org/GLM-5.3",
+            "zai-org/GLM-5.3-Flash",
+            "zai-org/GLM-5.2",
+            "zai-org/GLM-5.1",
+            "google/gemma-4-31B-it",
+            "deepseek-ai/DeepSeek-V3.2",
+            "MiniMaxAI/MiniMax-M2.5"
+        ],
+        "defaultContextWindow": 1048576,
+        "defaultMaxOutputTokens": 131072,
+        "catalog": {
+            "zai-org/GLM-5.3": {
+                "contextWindow": 1048576,
+                "maxOutputTokens": 131072,
+                "pricingPerMTok": {
+                    "input": 1.4,
+                    "output": 4.4,
+                    "cachedInput": 0.26
+                },
+                "vision": false,
+                "status": "production",
+                "description": "Recommended - Zhipu's flagship GLM-5.3, the only model in this roster that was live capability-probed end to end: a real structured tool call (finish_reason=tool_calls, 9 tool_calls deltas under streaming), SSE streaming (62 events, terminal [DONE]), and json_object structured output. A heavy internal reasoner exposed via reasoning/reasoning_content — at a small max_tokens budget the whole completion is spent on unfinished reasoning before any visible content, so give it a generous max_tokens. Rejects image/video input and rejects tools+response_format together, both HTTP 422 (see capabilities.structuredOutputWithTools). maxOutputTokens is the documented per-request output ceiling from https://friendli.ai/docs/examples/models/zai-glm-5-3/overview.md (retrieved 2026-09-09) — 131,072 tokens, distinct from the 1,048,576-token context window; the authenticated roster's max_completion_tokens field reports 1048576 (equal to context) but that is not treated as the output cap. Pricing per the same page: $1.40 / $4.40 per MTok input/output, $0.26 per MTok cached input."
+            },
+            "zai-org/GLM-5.3-Flash": {
+                "vision": false,
+                "status": "production",
+                "description": "Zhipu GLM-5.3 Flash — lighter/faster sibling of the default; present on the live roster (GET /serverless/v1/models, 200) but not itself capability-probed under the tight rate limit; fallback."
+            },
+            "zai-org/GLM-5.2": {
+                "vision": false,
+                "status": "production",
+                "description": "Zhipu GLM-5.2 — prior GLM generation; roster-listed only, not capability-probed; fallback."
+            },
+            "zai-org/GLM-5.1": {
+                "vision": false,
+                "status": "production",
+                "description": "Zhipu GLM-5.1 — prior GLM generation; roster-listed only, not capability-probed; fallback."
+            },
+            "google/gemma-4-31B-it": {
+                "vision": false,
+                "status": "production",
+                "description": "Google Gemma 4 31B instruct-tuned; roster-listed only, not capability-probed; fallback."
+            },
+            "deepseek-ai/DeepSeek-V3.2": {
+                "vision": false,
+                "status": "production",
+                "description": "DeepSeek V3.2; roster-listed only, not capability-probed; fallback."
+            },
+            "MiniMaxAI/MiniMax-M2.5": {
+                "vision": false,
+                "status": "production",
+                "description": "MiniMax M2.5; roster-listed only, not capability-probed; fallback."
+            }
+        },
+        "topModels": [
+            "zai-org/GLM-5.3",
+            "zai-org/GLM-5.3-Flash",
+            "zai-org/GLM-5.2",
+            "zai-org/GLM-5.1",
+            "google/gemma-4-31B-it",
+            "deepseek-ai/DeepSeek-V3.2",
+            "MiniMaxAI/MiniMax-M2.5"
+        ]
+    },
+    "capabilities": {
+        "text": true,
+        "streaming": true,
+        "tools": true,
+        "toolsWithStreaming": true,
+        "structuredOutput": true,
+        "structuredOutputWithTools": false,
+        "embeddings": false,
+        "thinking": false
+    },
+    "errorRules": [
+        {
+            "status": 401,
+            "pattern": "Unauthorized|valid credential",
+            "class": "authentication",
+            "message": "Invalid Friendli API key. Check {apiKeyEnvVar}. Get one at {setupUrl}"
+        },
+        {
+            "status": 404,
+            "pattern": "\\bModel\\s+['\"][^'\"\\r\\n]+['\"]\\s+not\\s+found\\b",
+            "class": "invalid-model",
+            "message": "Friendli model '{model}' not found. Pick a current model from the authenticated /serverless/v1/models roster or {setupUrl}"
+        }
+    ],
+    "setup": {
+        "url": "https://suite.friendli.ai/",
+        "apiKeyFormat": null,
+        "billingPolicy": "free-tier",
+        "instructions": [
+            "1. Visit: https://suite.friendli.ai/ and sign in",
+            "2. Create a Personal Access Token for the serverless endpoints",
+            "3. New accounts start with trial credit; confirm current billing terms in the console before heavy use",
+            "4. Set {apiKeyEnvVar} in your .env file"
+        ],
+        "description": "OpenAI-compatible endpoint at https://api.friendli.ai/serverless/v1, serving a small zai-org GLM-family roster plus a few third-party models. Rate limits are tight — pace requests at least 20 seconds apart."
+    },
+    "evidence": {
+        "rosterVerified": {
+            "date": "2026-09-06",
+            "method": "authenticated GET /serverless/v1/models",
+            "status": 200
+        },
+        "authProbe": {
+            "date": "2026-09-06",
+            "method": "POST /chat/completions with an invalid API key",
+            "status": 401
+        },
+        "liveMatrix": {
+            "date": "2026-09-06",
+            "result": "Probed against the default model, zai-org/GLM-5.3, via https://api.friendli.ai/serverless/v1. The first probe run used a 2s cadence, tripped Friendli's rate limit (12/16 cases 429) and is discarded entirely; this result is from a slower-paced re-run plus targeted single-call re-probes, each still hitting 429 occasionally even at ~25s spacing — Friendli's rate limits are tight, so any future live check needs generous pacing (20s+) and retry. Roster: GET /serverless/v1/models returns 200 with exactly 7 ids, all zai-org GLM family plus google/gemma-4-31B-it, deepseek-ai/DeepSeek-V3.2 and MiniMaxAI/MiniMax-M2.5 — models.fallbacks lists all 7. Wire mechanics on GLM-5.3: chat, system role, array content parts (message content IS accepted as a parts array, so no messageContentFormat quirk is declared), sampling params and max_completion_tokens all 200. Streaming: SSE, 200, 62 events, terminal [DONE] present — contentDeltas were 0 only because GLM-5.3 is a heavy reasoner that spent the small test budget entirely on reasoning/reasoning_content fields, not because streaming is broken. Tool calling: a real structured tool_call (get_time, tz argument parsed, finish_reason=tool_calls) on the first turn, a null-content assistant tool_calls turn accepted on replay, and 9 tool_calls deltas surfacing mid-SSE-stream — tools and toolsWithStreaming true; tool_choice is tolerated even with no tools declared. response_format json_object returns 200 cleanly — structuredOutput true. response_format json_schema also returns 200, but at the tested token budget the content is unfinished reasoning text rather than schema-conformant JSON — same reasoning-budget effect as above; NeuroLink's coerceJsonToSchema repair layer is the intended safety net. Sending tools and a JSON schema together in the same request is a genuine, hard rejection: HTTP 422 'The 'response_format' field cannot be set when tools are specified' — the same class of vendor exclusivity NeuroLink already handles generically for Groq via isToolsSchemaConflictError (pattern-matches the response_format+tool wording in the thrown error and retries the call without response_format), so no provider-specific quirk was added — structuredOutputWithTools is declared false. Vision: a real image part returns HTTP 422 'This model does not support image/video inputs.' — genuinely unsupported, not a rate limit; no model in this roster is marked vision:true and models.visionModel is left unset. Error shapes: bad key -> 401 {\"detail\":\"Unauthorized. Please provide a valid credential.\"}; bad model -> 404 {\"detail\":\"Model '<id>' not found.\"}. Only zai-org/GLM-5.3 (the declared default) was capability-probed end to end under the account's tight rate limit; the other 6 roster ids are roster-verified by id only, matching the account's usable request budget for this pass."
+        },
+        "addedInPR": "https://github.com/juspay/neurolink/pull/1657"
+    }
+}

package/dist/providers/catalog/index.generated.d.ts

@@ -1,3 +1,3 @@
 import type { ProviderCatalogJson } from "../../types/index.js";
 export declare const CATALOG_JSON_ENTRIES: ProviderCatalogJson[];
-export declare const CATALOG_PROVIDER_IDS: readonly ["api-route", "baseten", "cerebras", "cloudflare", "fireworks", "gmicloud", "groq", "inception-labs", "io-intelligence", "mancer", "mistral", "perplexity", "sambanova", "together-ai", "upstage", "xai"];
+export declare const CATALOG_PROVIDER_IDS: readonly ["api-route", "baseten", "cerebras", "cloudflare", "fireworks", "friendli", "gmicloud", "groq", "inception-labs", "io-intelligence", "mancer", "mistral", "perplexity", "sambanova", "together-ai", "upstage", "xai"];

package/dist/providers/catalog/index.generated.js

@@ -5,6 +5,7 @@ import basetenJson from "./baseten.json" with { type: "json" };
 import cerebrasJson from "./cerebras.json" with { type: "json" };
 import cloudflareJson from "./cloudflare.json" with { type: "json" };
 import fireworksJson from "./fireworks.json" with { type: "json" };
+import friendliJson from "./friendli.json" with { type: "json" };
 import gmicloudJson from "./gmicloud.json" with { type: "json" };
 import groqJson from "./groq.json" with { type: "json" };
 import inceptionLabsJson from "./inception-labs.json" with { type: "json" };
@@ -22,6 +23,7 @@ export const CATALOG_JSON_ENTRIES = [
     cerebrasJson,
     cloudflareJson,
     fireworksJson,
+    friendliJson,
     gmicloudJson,
     groqJson,
     inceptionLabsJson,
@@ -40,6 +42,7 @@ export const CATALOG_PROVIDER_IDS = [
     "cerebras",
     "cloudflare",
     "fireworks",
+    "friendli",
     "gmicloud",
     "groq",
     "inception-labs",

package/dist/providers/catalog/mistral.json

@@ -9,9 +9,8 @@
     },
     "models": {
         "default": "mistral-small-2506",
-        "fallbackModelName": "mistral-small-2506",
         "registryDefaultModel": "mistral-large-latest",
-        "fallbacks": ["mistral-small-2506", "mistral-large-latest"],
+        "fallbacks": ["mistral-small-2506", "mistral-medium-latest"],
         "defaultContextWindow": 128000,
         "defaultMaxOutputTokens": 4096,
         "catalog": {

package/dist/providers/catalog/schema.js

@@ -230,6 +230,40 @@ const catalogModelsSchema = z
             message: "models.fallbackModelName must be a key of models.catalog",
         });
     }
+    // A fallback that resolves to the default model cannot fall back.
+    //
+    // `loader.ts` derives it positionally as
+    // `fallbackModelName ?? fallbacks[1] ?? fallbacks[0]`, and nothing checked
+    // the result. A provider with one model has no choice and is left alone;
+    // a provider with alternatives that still lands on its own default has
+    // silently disabled its retry path — the primary fails, the SDK retries
+    // the same model, and it fails again for the same reason.
+    //
+    // This is not hypothetical. `mistral.json` ships 32 models and explicitly
+    // sets `fallbackModelName` to its own default, overriding a perfectly good
+    // `fallbacks[1]`. Two single-model catalogs also resolve this way and are
+    // correctly exempt.
+    const derivedFallback = models.fallbackModelName ?? models.fallbacks[1] ?? models.fallbacks[0];
+    // Count only entries that could actually serve as a fallback. The whole
+    // `catalog` map also carries retired ids, so its size both over-reports in
+    // the message below and could fire this rule on a catalog whose only other
+    // entries are unusable — the mirror of the single-model exemption.
+    const selectableModels = Object.values(models.catalog).filter((spec) => spec.status !== "retired").length;
+    if (derivedFallback !== undefined &&
+        derivedFallback === models.default &&
+        selectableModels > 1) {
+        ctx.addIssue({
+            code: "custom",
+            path: models.fallbackModelName !== undefined
+                ? ["fallbackModelName"]
+                : ["fallbacks"],
+            message: `the fallback model resolves to "${derivedFallback}", which is also models.default — ` +
+                `a fallback identical to the primary cannot fall back. This catalog declares ` +
+                `${selectableModels} selectable models, so name a different one (or drop ` +
+                `fallbackModelName to ` +
+                `let fallbacks[1] apply). Single-model catalogs are exempt.`,
+        });
+    }
     if (models.registryDefaultModel !== undefined &&
         !catalogKeys.has(models.registryDefaultModel)) {
         ctx.addIssue({

package/dist/providers/googleAiStudio/client.js

@@ -380,7 +380,13 @@ export class GoogleAIStudioProvider extends BaseProvider {
                             if ("inlineData" in part && part.inlineData?.data) {
                                 const foundImageData = part.inlineData.data;
                                 imageData = foundImageData;
-                                const mimeType = part.inlineData.mimeType || "image/png";
+                                // Keep the DECLARED value separate from the display default.
+                                // ImageGenService trusts a string `mimeType` on imageOutput and
+                                // skips sniffing, so forwarding a hardcoded "image/png" for a
+                                // vendor that declared nothing would defeat the byte detection
+                                // — WebP bytes would ship labelled PNG, with a .png extension.
+                                const declaredMimeType = part.inlineData.mimeType;
+                                const mimeType = declaredMimeType || "image/png";
                                 logger.info("Image generation successful", {
                                     model: imageModelName,
                                     mimeType,
@@ -390,7 +396,12 @@ export class GoogleAIStudioProvider extends BaseProvider {
                                 const result = {
                                     content: `Generated image using ${imageModelName} (${mimeType})`,
                                     imageOutput: {
+                                        // The vendor declares the format on the inline part; that
+                                        // beats sniffing it back out of the bytes. When it declares
+                                        // nothing, omit the field entirely so the service sniffs
+                                        // rather than trusting a default we invented.
                                         base64: foundImageData,
+                                        ...(declaredMimeType ? { mimeType: declaredMimeType } : {}),
                                     },
                                     provider: this.providerName,
                                     model: imageModelName,
@@ -434,7 +445,10 @@ export class GoogleAIStudioProvider extends BaseProvider {
                         if ("inlineData" in part && part.inlineData?.data) {
                             const foundImageData = part.inlineData.data;
                             imageData = foundImageData;
-                            const mimeType = part.inlineData.mimeType || "image/png";
+                            // See the streaming site above: only a mime type the vendor
+                            // actually declared may be forwarded, or the sniffer is bypassed.
+                            const declaredMimeType = part.inlineData.mimeType;
+                            const mimeType = declaredMimeType || "image/png";
                             logger.info("Image generation successful (non-streaming)", {
                                 model: imageModelName,
                                 mimeType,
@@ -444,7 +458,9 @@ export class GoogleAIStudioProvider extends BaseProvider {
                             const result = {
                                 content: `Generated image using ${imageModelName} (${mimeType})`,
                                 imageOutput: {
+                                    // As above: forward only a declared value, never a default.
                                     base64: foundImageData,
+                                    ...(declaredMimeType ? { mimeType: declaredMimeType } : {}),
                                 },
                                 provider: this.providerName,
                                 model: imageModelName,

package/dist/providers/googleVertex/client.js

@@ -5229,7 +5229,12 @@ export class GoogleVertexProvider extends BaseProvider {
                     if (imageOutput) {
                         yield {
                             type: "image",
-                            imageOutput: { base64: imageOutput.base64 || "" },
+                            imageOutput: {
+                                base64: imageOutput.base64 || "",
+                                ...(imageOutput.mimeType
+                                    ? { mimeType: imageOutput.mimeType }
+                                    : {}),
+                            },
                         };
                     }
                     yield { content: textContent };
@@ -6370,9 +6375,12 @@ export class GoogleVertexProvider extends BaseProvider {
             }
             // Extract image data (handle both formats)
             const imageData = imagePart.inlineData?.data || imagePart.inline_data?.data;
-            const mimeType = imagePart.inlineData?.mimeType ||
-                imagePart.inline_data?.mime_type ||
-                "image/png";
+            // The declared label and the display default are deliberately separate.
+            // `ImageGenService` trusts a string `mimeType` and skips sniffing, so
+            // stamping the `image/png` default onto `imageOutput` would relabel an
+            // unlabelled WebP as PNG — the exact defect this change fixes elsewhere.
+            const declaredMimeType = imagePart.inlineData?.mimeType || imagePart.inline_data?.mime_type;
+            const mimeType = declaredMimeType || "image/png";
             if (!imageData) {
                 throw new ProviderError("Image part found but no data available", this.providerName);
             }
@@ -6387,6 +6395,7 @@ export class GoogleVertexProvider extends BaseProvider {
                 content: `Generated image using ${imageModelName} (${mimeType})`,
                 imageOutput: {
                     base64: imageData,
+                    ...(declaredMimeType ? { mimeType: declaredMimeType } : {}),
                 },
                 provider: this.providerName,
                 model: imageModelName,

package/dist/providers/recraft.js

@@ -7,6 +7,7 @@ import { logger } from "../utils/logger.js";
 import { createRecraftConfig, getProviderModel, validateApiKey, } from "../utils/providerConfig.js";
 import { MAX_IMAGE_BYTES, readBoundedBuffer } from "../utils/sizeGuard.js";
 import { assertSafeUrl } from "../utils/ssrfGuard.js";
+import { detectImageMimeType } from "../utils/imageDetection.js";
 const RECRAFT_DEFAULT_BASE_URL = "https://external.api.recraft.ai/v1";
 const REQUEST_TIMEOUT_MS = 120_000;
 const getRecraftApiKey = () => validateApiKey(createRecraftConfig());
@@ -178,7 +179,13 @@ export class RecraftProvider extends BaseProvider {
             model: this.modelName,
             // output: 1000 = sentinel for per-image pricing (see pricing.ts)
             usage: { input: 0, output: 1000, total: 1000 },
-            imageOutput: { base64 },
+            // Recraft answers b64_json with WebP bytes for V3 raster models; label
+            // the real format from the leading bytes instead of leaving callers to
+            // assume PNG.
+            imageOutput: {
+                base64,
+                mimeType: detectImageMimeType(Buffer.from(base64.slice(0, 64), "base64")),
+            },
         };
     }
     async validateConfiguration() {

package/dist/types/cli.d.ts

@@ -405,6 +405,8 @@ export type CliGenerateResult = CommandResult & {
     imageOutput?: {
         base64: string;
         savedPath?: string;
+        /** Encoded format, when the provider identified it (e.g. Recraft returns WebP). */
+        mimeType?: string;
     } | null;
 };
 /**

package/dist/types/externalMcp.d.ts

@@ -10,7 +10,7 @@ import type { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
 /**
  * Supported MCP transport protocols - imported from mcpTypes.js (canonical definition)
  */
-import type { MCPTransportType, MCPServerInfo } from "./mcp.js";
+import type { MCPTransportType, MCPServerInfo, MCPServerReadiness } from "./mcp.js";
 export type { MCPTransportType } from "./mcp.js";
 /**
  * External MCP server configuration for process spawning
@@ -182,10 +182,28 @@ export type ExternalMCPOperationResult<T = unknown> = {
     serverId?: string;
     /** Operation duration in milliseconds */
     duration?: number;
-    /** Additional metadata */
+    /**
+     * Additional metadata.
+     *
+     * The two typed optional fields are intersected with the pre-existing
+     * `JsonValue` index signature rather than declared inside it: declaring an
+     * optional property next to a `JsonValue` index signature does not compile
+     * (its type includes `undefined`), and widening the index signature to
+     * `JsonValue | undefined` would change the read type of every other key
+     * for every existing consumer — a backward-incompatible public change.
+     */
     metadata?: {
         timestamp: number;
         operation: string;
+        /**
+         * Set on `addServer` results: whether the registration discovered
+         * enough tools to be considered ready (see `MCPServerInfo.minTools`).
+         * Absent on operations the minTools gate does not apply to.
+         */
+        readiness?: MCPServerReadiness;
+        /** Set alongside `readiness` on `addServer` results — tools discovered, post block-list. */
+        toolsDiscovered?: number;
+    } & {
         [key: string]: JsonValue;
     };
 };

package/dist/types/generate.d.ts

@@ -954,9 +954,14 @@ export type MediaGenerationOutputs = {
      * ```
      */
     ppt?: PPTGenerationResult;
-    /** Standard format for image generation */
+    /**
+     * Standard format for image generation. `mimeType` is set when the provider
+     * can identify the encoded format (sniffed from the image bytes, e.g.
+     * Recraft returns WebP), so callers do not have to assume PNG.
+     */
     imageOutput?: {
         base64: string;
+        mimeType?: string;
     } | null;
     /** STT transcription result (present when stt.enabled is true and audio input was provided) */
     transcription?: STTResult;

package/dist/types/mcp.d.ts

@@ -17,6 +17,13 @@ export type MCPTransportType = "stdio" | "sse" | "websocket" | "http" | "ws" | "
  * MCP Server Connection Status - Individual server status
  */
 export type MCPServerConnectionStatus = "initializing" | "connecting" | "connected" | "disconnected" | "failed" | "restarting" | "stopping" | "stopped";
+/**
+ * Readiness of an external MCP server registration, distinct from raw
+ * connection status: a server can be "connected" at the transport level yet
+ * still be gated as not ready when it discovers fewer tools than its
+ * configured `minTools` floor.
+ */
+export type MCPServerReadiness = "ready" | "insufficient_tools" | "failed";
 /**
  * MCP Server Category Types - Deployment and server type classification
  */
@@ -56,6 +63,16 @@ export type MCPServerInfo = {
     cwd?: string;
     autoRestart?: boolean;
     healthCheckInterval?: number;
+    /**
+     * Minimum number of tools that must be discovered for this server's
+     * registration to be considered ready (default: 0 — no minimum, so a
+     * resource/prompt-only server that legitimately exposes zero tools still
+     * registers successfully). When discovery finds fewer tools than this
+     * floor, `ExternalServerManager.addServer` returns `success: false` with
+     * `metadata.readiness: "insufficient_tools"` instead of marking the
+     * server connected/healthy, and tears the connection back down.
+     */
+    minTools?: number;
     /** Retry configuration for HTTP transport */
     retryConfig?: {
         maxAttempts?: number;

package/dist/types/providerCatalog.generated.d.ts

@@ -1,2 +1,2 @@
-export type CatalogProviderName = "api-route" | "baseten" | "cerebras" | "cloudflare" | "fireworks" | "gmicloud" | "groq" | "inception-labs" | "io-intelligence" | "mancer" | "mistral" | "perplexity" | "sambanova" | "together-ai" | "upstage" | "xai";
-export type CatalogCredentialKey = "apiRoute" | "baseten" | "cerebras" | "cloudflare" | "fireworks" | "gmicloud" | "groq" | "inceptionLabs" | "ioIntelligence" | "mancer" | "mistral" | "perplexity" | "sambanova" | "together" | "upstage" | "xai";
+export type CatalogProviderName = "api-route" | "baseten" | "cerebras" | "cloudflare" | "fireworks" | "friendli" | "gmicloud" | "groq" | "inception-labs" | "io-intelligence" | "mancer" | "mistral" | "perplexity" | "sambanova" | "together-ai" | "upstage" | "xai";
+export type CatalogCredentialKey = "apiRoute" | "baseten" | "cerebras" | "cloudflare" | "fireworks" | "friendli" | "gmicloud" | "groq" | "inceptionLabs" | "ioIntelligence" | "mancer" | "mistral" | "perplexity" | "sambanova" | "together" | "upstage" | "xai";

package/dist/types/providers.d.ts

@@ -200,6 +200,10 @@ export type NeurolinkCredentials = {
         apiKey?: string;
         baseURL?: string;
     };
+    friendli?: {
+        apiKey?: string;
+        baseURL?: string;
+    };
     gmicloud?: {
         apiKey?: string;
         baseURL?: string;

package/dist/utils/imageDetection.d.ts

@@ -7,6 +7,16 @@
  * otherwise a wrong default (historically `image/jpeg`) makes Anthropic reject
  * PNG/GIF/WebP with a media-type mismatch 400.
  */
+/**
+ * Detect an image's MIME type from its magic bytes, or `null` when the bytes
+ * match no known signature.
+ *
+ * Use this when the answer "not an image" has to be distinguishable from a
+ * default. `detectImageMimeType` collapses that distinction on purpose, which
+ * is right for a caller that already knows it holds an image and wrong for one
+ * deciding whether it does.
+ */
+export declare function sniffImageMimeType(buffer: Buffer): string | null;
 /**
  * Detect an image's MIME type from its magic bytes. Returns `image/png` for
  * buffers that match no known signature (the safest neutral default for the

package/dist/utils/imageDetection.js

@@ -8,17 +8,27 @@
  * PNG/GIF/WebP with a media-type mismatch 400.
  */
 /**
- * Detect an image's MIME type from its magic bytes. Returns `image/png` for
- * buffers that match no known signature (the safest neutral default for the
- * Vertex image path).
+ * Detect an image's MIME type from its magic bytes, or `null` when the bytes
+ * match no known signature.
+ *
+ * Use this when the answer "not an image" has to be distinguishable from a
+ * default. `detectImageMimeType` collapses that distinction on purpose, which
+ * is right for a caller that already knows it holds an image and wrong for one
+ * deciding whether it does.
  */
-export function detectImageMimeType(buffer) {
-    // PNG: 89 50 4E 47
+export function sniffImageMimeType(buffer) {
+    // PNG: the full 8-byte signature 89 50 4E 47 0D 0A 1A 0A. The trailing four
+    // bytes matter — a truncated `iVBORw==` carries only the first four and is
+    // not a decodable image.
     if (buffer.length >= 8 &&
         buffer[0] === 0x89 &&
         buffer[1] === 0x50 &&
         buffer[2] === 0x4e &&
-        buffer[3] === 0x47) {
+        buffer[3] === 0x47 &&
+        buffer[4] === 0x0d &&
+        buffer[5] === 0x0a &&
+        buffer[6] === 0x1a &&
+        buffer[7] === 0x0a) {
         return "image/png";
     }
     // JPEG: FF D8 FF
@@ -40,13 +50,29 @@ export function detectImageMimeType(buffer) {
         buffer[11] === 0x50) {
         return "image/webp";
     }
-    // GIF: "GIF"
+    // GIF: the full 6-byte header "GIF87a" or "GIF89a". The version stamp is
+    // what separates a header from three coincidental letters — the old check
+    // compared only "GIF" while guarding on `length >= 6`, so any six bytes
+    // beginning with those letters (base64 `R0lGAAAA` decodes to 47 49 46 00
+    // 00 00) were labelled image/gif. This gate is what decides whether bytes
+    // are an image at all, so it is only as strict as its weakest signature.
     if (buffer.length >= 6 &&
-        buffer[0] === 0x47 &&
-        buffer[1] === 0x49 &&
-        buffer[2] === 0x46) {
+        buffer[0] === 0x47 && // G
+        buffer[1] === 0x49 && // I
+        buffer[2] === 0x46 && // F
+        buffer[3] === 0x38 && // 8
+        (buffer[4] === 0x37 || buffer[4] === 0x39) && // 7 | 9
+        buffer[5] === 0x61 // a
+    ) {
         return "image/gif";
     }
-    // Unknown — neutral default.
-    return "image/png";
+    return null;
+}
+/**
+ * Detect an image's MIME type from its magic bytes. Returns `image/png` for
+ * buffers that match no known signature (the safest neutral default for the
+ * Vertex image path).
+ */
+export function detectImageMimeType(buffer) {
+    return sniffImageMimeType(buffer) ?? "image/png";
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@juspay/neurolink",
-  "version": "12.22.1",
+  "version": "12.23.0",
   "packageManager": "pnpm@10.15.1",
   "description": "The pipe layer of an AI nervous system: one interface connecting provider neurons to your application, across three inference types — generate, stream and decide. `decide` returns typed, calibrated judgements from a non-generative model (~400ms, ~$0.00002/call) for routing, tool selection and context budgeting. MCP-native (4 transports), voice TTS/STT/realtime, RAG, agents, memory, compaction, 9 observability exporters. OpenAI · Anthropic · Gemini · Bedrock · Azure · Ollama · TypeSafe Jev and more.",
   "author": {
@@ -89,7 +89,8 @@
     "test:mcp:cli": "pnpm exec tsx test/continuous-test-suite-mcp-cli.ts",
     "test:mcp:stdio-lifecycle": "pnpm exec tsx test/continuous-test-suite-mcp-stdio-lifecycle.ts",
     "test:mcp-direct-name-repair": "pnpm exec tsx test/continuous-test-suite-mcp-direct-name-repair.ts",
-    "test:mcp:full": "pnpm run test:mcp:infra && pnpm run test:mcp:spans && pnpm run test:mcp:stdio-lifecycle && pnpm run test:mcp:sdk && pnpm run test:mcp:cli && pnpm run test:mcp:http",
+    "test:mcp:min-tools-readiness": "pnpm exec tsx test/continuous-test-suite-mcp-min-tools-readiness.ts",
+    "test:mcp:full": "pnpm run test:mcp:infra && pnpm run test:mcp:spans && pnpm run test:mcp:stdio-lifecycle && pnpm run test:mcp:min-tools-readiness && pnpm run test:mcp:sdk && pnpm run test:mcp:cli && pnpm run test:mcp:http",
     "test:media": "pnpm exec tsx test/continuous-test-suite-media-gen.ts",
     "test:media-registry-collisions": "pnpm exec tsx test/continuous-test-suite-media-registry-collisions.ts",
     "test:memory": "pnpm exec tsx test/continuous-test-suite-memory.ts",