claricle 0.1.0 → 0.2.0

data/lib/claricle/models/conversion.rb

@@ -0,0 +1,167 @@
+# frozen_string_literal: true
+
+require "lutaml/model"
+
+require_relative "base"
+# Only the vocabulary, not the classifier: `../lossiness` pulls in the whole
+# `Lossiness` scanner and, through `detector.rb`, REXML -- measured, a caller
+# that only wants this result model to round-trip JSON was paying for that.
+# `lossiness/levels` requires nothing else.
+require_relative "../lossiness/levels"
+
+# Nested `module Claricle` / `module Models`, never the compact
+# `module Claricle::Models`. Measured: the compact form leaves `Claricle` out of
+# Module.nesting, so the unqualified `Lossiness` below raises
+# `NameError: uninitialized constant Claricle::Models::Conversion::Lossiness`.
+# Reproduce with:
+#   ruby -e 'module A; module B; end; end; module A::B; p Module.nesting; end'
+module Claricle
+  module Models
+    # Holds bytes lutaml must not try to render.
+    #
+    # `Models::Base#own_string` runs `JSON.generate` over every String
+    # attribute at seal time (base.rb:466-475, reached from freeze_attributes
+    # at base.rb:448-458), so a `:string` attribute REFUSES binary content --
+    # measured, `ValidationError: content expects a String JSON can render, got
+    # "\xFF" from ASCII-8BIT to UTF-8`. Excluding the attribute from the
+    # key_value mapping does not help: the check is on the stored String, not
+    # on what gets rendered. So the value is stored wrapped, where
+    # freeze_attributes does not reach it.
+    class BinaryContent < Lutaml::Model::Type::Value
+      def self.cast(value, _options = {})
+        return value if Lutaml::Model::Utils.uninitialized?(value)
+        return nil if value.nil?
+        return value if value.instance_of?(self)
+
+        refuse(value) unless value.instance_of?(::String)
+
+        wrap(::String.new(value).freeze)
+      end
+
+      # `allocate`, not `new`: `Type::Value#initialize` calls `self.class.cast`
+      # (lutaml-model-0.8.22/lib/lutaml/model/type/value.rb:52), so building
+      # the wrapper through the constructor recurses to SystemStackError --
+      # measured. Reproduce with:
+      #   ruby -e 'c = Class.new(Lutaml::Model::Type::Value) do
+      #              def self.cast(v, _o = {}) = new(v)
+      #            end; c.cast("x")'
+      # The String is copied before freezing, so this does not take the
+      # caller's own String away from them -- the reason base.rb:445 dups.
+      def self.wrap(frozen_bytes)
+        allocate.tap do |wrapper|
+          wrapper.instance_variable_set(:@value, frozen_bytes)
+          wrapper.freeze
+        end
+      end
+      private_class_method :wrap
+
+      def self.serialize(value)
+        value.nil? ? nil : cast(value)
+      end
+
+      def self.refuse(value)
+        raise Lutaml::Model::ValidationError,
+              [TypeError.new("content expects a String, got #{value.class}")]
+      end
+      private_class_method :refuse
+    end
+
+    # One conversion's result. `lossiness` is decided per conversion from what
+    # the source contains (D23), never from a table of edges.
+    class Conversion < Base
+      LOSSINESS_LEVELS = Lossiness::LEVELS
+
+      attribute :source_path, :string
+      attribute :source_format, :string, required: true
+      attribute :target_format, :string, required: true
+      attribute :lossiness, :string, values: LOSSINESS_LEVELS, required: true
+      attribute :output_path, :string
+      attribute :content, BinaryContent
+
+      key_value do
+        map "source_path", to: :source_path
+        map "source_format", to: :source_format
+        map "target_format", to: :target_format
+        map "lossiness", to: :lossiness
+        map "output_path", to: :output_path
+        # `content` is deliberately unmapped: the bytes are an in-memory
+        # payload, not part of the document. Measured -- an attribute absent
+        # from an explicit key_value block is excluded from to_json, to_yaml
+        # and to_hash alike, and a "content" key in an incoming document is
+        # ignored rather than resurrected.
+        #
+        # It is also OPTIONAL rather than required, and that is forced: a
+        # required attribute excluded from the mapping cannot reload its own
+        # output -- measured, `from_json(to_json)` raises
+        # `ValidationError: Missing required attribute: content`.
+      end
+
+      # Unwraps the stored BinaryContent. The `*args` form, because lutaml
+      # defines this attribute's reader with `define_method` on this class and
+      # the generated reader doubles as the builder-block setter, so overriding
+      # it with a zero-arity reader would break `content "..."` in a builder
+      # block.
+      #
+      # NOT because every attribute here takes that form. `lossiness`, declared
+      # four lines above, is a zero-arity reader -- lutaml's enum path defines
+      # it elsewhere. Measured: `instance_method(:lossiness).arity` is 0 against
+      # -1 for `content`, and `conversion.lossiness("lossy")` raises
+      # ArgumentError. Same shape as Inspection#meta (inspection.rb:160).
+      def content(*args)
+        unless args.empty?
+          self.content = args.first
+          return args.first
+        end
+
+        @content&.value
+      end
+
+      # A handler's own `Conversion` never knows its `output_path` -- it is
+      # built before the write happens, and `Models::Base` seals (freezes)
+      # every instance at construction, so the field cannot be set on this
+      # object afterward. The caller (`Claricle.convert_one`) uses this once
+      # the real destination is known, rather than re-listing every other
+      # field by hand.
+      def with_output_path(path)
+        self.class.new(source_path: source_path, source_format: source_format,
+                       target_format: target_format, lossiness: lossiness,
+                       output_path: path, content: content)
+      end
+
+      private
+
+      # Runs BEFORE lutaml's own `validate!`, which is the whole point:
+      # `validate!` reaches every attribute through `public_send`, so it calls
+      # the `content` reader, and on a bad shape the reader is what dies.
+      # `validate_types` is too late -- base.rb:288-292 orders `validate!`
+      # ahead of it.
+      #
+      # Every non-String content refuses through `BinaryContent.cast`, EXCEPT
+      # an Array: lutaml's collection path never calls `cast` on the Array
+      # itself, so it is stored raw. Measured, `content: ["a"]` reached
+      # `NoMethodError: undefined method 'value' for an instance of Array`
+      # instead of refusing. `[1, 2]` DID refuse, but only because an Integer
+      # ELEMENT tripped `cast` -- a guard that holds for the wrong reason, and
+      # an Array of Strings walks straight past it.
+      #
+      # Reads the raw ivar, never the reader, for the same reason.
+      def normalize
+        raw = instance_variable_get(:@content)
+        return if raw.nil? || raw.is_a?(BinaryContent)
+        return if Lutaml::Model::Utils.uninitialized?(raw)
+
+        refuse(:content, "a String", raw.class)
+      end
+
+      # `source_format`/`target_format`/`lossiness` are `required: true` on
+      # the attribute itself, so lutaml's own `validate!` (runs before this,
+      # per the comment on `normalize` above) already refuses a missing one,
+      # wrapped in `Lutaml::Model::ValidationError` and naming the attribute.
+      # Do not re-add a hand-rolled nil check here: see the gate record for
+      # why `required: true` replaced one (the introspectable schema used to
+      # disagree with the runtime refusal).
+    end
+
+    private_constant :BinaryContent
+  end
+end

data/lib/claricle/models/format_capability.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Claricle
+  module Models
+    # One row of `claricle formats --json`.
+    class FormatCapability < Base
+      # Lutaml's Boolean accepts lexical aliases such as "false" and 0.
+      # Capability rows are structured data, so only JSON booleans belong.
+      class StrictBoolean < Lutaml::Model::Type::Boolean
+        def self.cast(value, _options = {})
+          return value if value.equal?(true) || value.equal?(false)
+          return value if value.nil? || Lutaml::Model::Utils.uninitialized?(value)
+
+          raise Lutaml::Model::ValidationError,
+                [TypeError.new("boolean expects true or false")]
+        end
+      end
+
+      attribute :format, :string, required: true
+      # Not :inspect, which would replace Object#inspect with a boolean.
+      attribute :inspectable, StrictBoolean, required: true
+      attribute :conform, StrictBoolean, required: true
+      attribute :convert, StrictBoolean, required: true
+      attribute :convert_to, :string, collection: true
+
+      key_value do
+        map "format", to: :format
+        map "inspect", to: :inspectable
+        map "conform", to: :conform
+        map "convert", to: :convert
+        # Without render_empty an empty list is dropped from the row.
+        map "convert_to", to: :convert_to, render_empty: true
+      end
+
+      private_constant :StrictBoolean
+    end
+  end
+end

data/lib/claricle/models/free_form_hash.rb

@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+require "lutaml/model"
+
+module Claricle
+  module Models
+    # A Hash attribute for a plain JSON data graph.
+    #
+    # lutaml-model's own `:hash` type is shaped for XML, and it treats
+    # two key names as structure rather than data. Measured on 0.8.19:
+    #
+    #   {"node" => {"text" => "hi", "lang" => "en"}}  ->  {"node" => {"lang" => "en"}}
+    #   {"elements" => {"width" => 1}}                ->  {"width" => 1}
+    #   {"text" => "hi"}                              ->  raises NoMethodError
+    #
+    # The first silently discards a value, the second unwraps a level,
+    # and the third is not representable at all. That is correct for
+    # markup, where those names carry meaning, and wrong for `meta`,
+    # which is whatever a handler read out of a file -- an SVG root
+    # legitimately carries `elements` or `text` as an attribute name, and
+    # inspecting one crashed the CLI.
+    #
+    # So this type does no key-name normalisation in either direction.
+    # It accepts only an exact core Hash at the outer boundary and copies
+    # that container without invoking virtual traversal. `Inspection`
+    # owns and validates the complete graph before sealing it.
+    class FreeFormHash < Lutaml::Model::Type::Hash
+      CORE_INSTANCE = ::Object.instance_method(:instance_of?)
+      CLASS_OF = ::Object.instance_method(:class)
+      DUPLICATE = ::Object.instance_method(:dup)
+      private_constant :CORE_INSTANCE, :CLASS_OF, :DUPLICATE
+
+      # lutaml's `hash_type?` compares the class EXACTLY, so a subclass
+      # is not recognised as a hash and the value arrives wrapped in an
+      # instance of this type rather than as a bare Hash.
+      def self.cast(value)
+        return super if Lutaml::Model::Utils.uninitialized?(value)
+        return nil if value.nil?
+
+        value = value.value if CORE_INSTANCE.bind_call(value, self)
+        refuse(value) unless CORE_INSTANCE.bind_call(value, ::Hash)
+
+        copy(value)
+      end
+
+      # Measured on 0.8.19: the key_value pipeline never reaches this --
+      # `cast` runs in both directions and does the whole job. It stays
+      # because it is the other half of the Type contract, and what it
+      # would otherwise inherit is the XML-shaped `serialize` this class
+      # exists to keep away from `meta`.
+      def self.serialize(value)
+        return nil if value.nil?
+
+        cast(value)
+      end
+
+      def self.copy(value)
+        DUPLICATE.bind_call(value)
+      end
+      private_class_method :copy
+
+      def self.refuse(value)
+        got = CLASS_OF.bind_call(value)
+        raise Lutaml::Model::ValidationError,
+              [TypeError.new("meta expects core JSON values under String keys, got #{got}")]
+      end
+      private_class_method :refuse
+    end
+
+    # A workaround for one measured lutaml-model behaviour, not a type a
+    # caller ever names: `meta` is declared with it here, and what comes
+    # back out of a model is a plain Hash either way. Private where it is
+    # defined, so the guarantee survives this file being required on its
+    # own.
+    private_constant :FreeFormHash
+  end
+end

data/lib/claricle/models/inspection.rb

@@ -0,0 +1,188 @@
+# frozen_string_literal: true
+
+require "json"
+
+require_relative "base"
+require_relative "free_form_hash"
+require_relative "issue"
+
+module Claricle
+  module Models
+    # Owns Inspection's free-form metadata boundary. Keeping the grammar
+    # and canonical copy together makes the graph accepted during
+    # validation exactly the frozen graph stored by the model.
+    module Metadata
+      DUPLICATE = ::Object.instance_method(:dup)
+      HASH_BY_IDENTITY = ::Hash.instance_method(:compare_by_identity?)
+      HASH_EMPTY = ::Hash.instance_method(:empty?)
+      HASH_SHIFT = ::Hash.instance_method(:shift)
+      HASH_SIZE = ::Hash.instance_method(:size)
+      STRING_ENCODE = ::String.instance_method(:encode)
+      META_MAX_DEPTH = ::JSON::State.new.max_nesting - 1
+      META_SCALARS = [::Integer, ::Float, ::TrueClass, ::FalseClass, ::NilClass].freeze
+      private_constant :DUPLICATE, :HASH_BY_IDENTITY, :HASH_EMPTY,
+                       :HASH_SHIFT, :HASH_SIZE, :STRING_ENCODE,
+                       :META_MAX_DEPTH, :META_SCALARS
+
+      private
+
+      def unwrap_meta(value)
+        core_instance?(value, FreeFormHash) ? value.value : value
+      end
+
+      # Copies iteratively so cycles terminate and over-deep graphs stop
+      # at JSON's own nesting boundary. The canonical copy is also the
+      # graph later stored, so validation and storage cannot observe
+      # different virtual views.
+      def canonical_meta(value)
+        return if value.nil?
+
+        copy = copy_meta_graph(value)
+        JSON.generate({ "meta" => copy })
+        copy
+      rescue JSON::JSONError => e
+        refuse("meta", "values JSON can render", e.message)
+      end
+
+      def copy_meta_graph(root)
+        refuse_meta(root) unless core_instance?(root, ::Hash)
+
+        copies = {}.compare_by_identity
+        copy = new_container(root)
+        copies[root] = copy
+        pending = [[root, copy, 1]]
+        populate_meta_copy(pending, copies) until pending.empty?
+        copies.each_value(&:freeze)
+        copy
+      end
+
+      def populate_meta_copy(pending, copies)
+        source, target, depth = pending.pop
+        return populate_hash(source, target, pending, copies, depth) if core_instance?(source, ::Hash)
+
+        each_array(source) do |item|
+          target << copy_meta_value(item, pending, copies, depth + 1)
+        end
+      end
+
+      def populate_hash(source, target, pending, copies, depth)
+        work = DUPLICATE.bind_call(source)
+        until HASH_EMPTY.bind_call(work)
+          key, item = HASH_SHIFT.bind_call(work)
+          refuse_meta(key) unless core_instance?(key, ::String)
+
+          target[canonical_meta_key(key)] = copy_meta_value(item, pending, copies, depth + 1)
+        end
+        refuse_meta(source) unless HASH_SIZE.bind_call(source) == HASH_SIZE.bind_call(target)
+      end
+
+      def canonical_meta_key(key)
+        STRING_ENCODE.bind_call(key, Encoding::UTF_8).freeze
+      rescue EncodingError => e
+        refuse("meta", "UTF-8 String keys", e.message)
+      end
+
+      def copy_meta_value(value, pending, copies, depth)
+        return ::String.new(value).freeze if core_instance?(value, ::String)
+        return value if META_SCALARS.include?(class_of(value))
+        return refuse_meta(value) unless core_instance?(value, ::Hash) || core_instance?(value, ::Array)
+
+        refuse_meta_depth if depth > META_MAX_DEPTH
+        return copies[value] if copies.key?(value)
+
+        new_container(value).tap do |copy|
+          copies[value] = copy
+          pending << [value, copy, depth]
+        end
+      end
+
+      def new_container(source)
+        return [] if core_instance?(source, ::Array)
+
+        refuse_meta(source) if HASH_BY_IDENTITY.bind_call(source)
+        {}
+      end
+
+      def refuse_meta(value)
+        got = class_of(value)
+        refuse("meta", "core JSON values under String keys", got)
+      end
+
+      def refuse_meta_depth
+        refuse("meta", "values JSON can render", "nesting exceeds #{META_MAX_DEPTH}")
+      end
+    end
+
+    # Inspection reports whether metadata parsed, and makes no validity
+    # claim -- that belongs to conform alone (D17).
+    class Inspection < Base
+      include Metadata
+
+      PARSE_STATUSES = %w[ok failed].freeze
+
+      attribute :format, :string
+      attribute :width, :float
+      attribute :height, :float
+      attribute :dpi, :float
+      attribute :color_space, :string
+      attribute :meta, FreeFormHash
+      attribute :parse_status, :string, values: PARSE_STATUSES, required: true
+      attribute :issues, Issue, collection: true
+
+      key_value do
+        map "format", to: :format
+        map "width", to: :width
+        map "height", to: :height
+        map "dpi", to: :dpi
+        map "color_space", to: :color_space
+        # render_empty, so a handler that deliberately reported an empty
+        # `meta` gets `{}` back rather than nil. Without it the key is
+        # omitted from JSON and reloads as nil, turning "I looked and
+        # there was nothing" into "I did not look".
+        map "meta", to: :meta, render_empty: true
+        map "parse_status", to: :parse_status
+        map "issues", to: :issues, render_empty: true
+      end
+
+      # Deserialization wraps the value in the type instance rather than
+      # casting it back: lutaml wraps any Hash whose attribute type is
+      # not EXACTLY `Type::Hash`, and `FreeFormHash` is a subclass. A
+      # caller asked for a Hash and gets one whichever way the model was
+      # built.
+      #
+      # The ivar directly, not `super`: 0.8.19 defines attribute readers
+      # with `define_method` on this very class, so writing one here
+      # replaces it and there is no superclass method to reach.
+      #
+      # `*args` because the generated reader doubles as the builder-form
+      # setter -- `Inspection.new { |i| i.meta("a" => 1) }`. A zero-arity
+      # reader made `meta` the one attribute that form could not set.
+      def meta(*args)
+        unless args.empty?
+          self.meta = args.first
+          return args.first
+        end
+
+        unwrap_meta(@meta)
+      end
+
+      private
+
+      def normalize
+        self.issues = [] if issues.nil?
+      end
+
+      def validate_types
+        super
+        canonical = canonical_meta(meta)
+        @meta = canonical unless object_frozen?(self)
+      end
+
+      def nested_models
+        issues
+      end
+    end
+
+    private_constant :Metadata
+  end
+end

data/lib/claricle/models/issue.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+require_relative "base"
+require_relative "location"
+
+module Claricle
+  module Models
+    class Issue < Base
+      SEVERITIES = %w[error warning info].freeze
+
+      attribute :severity, :string, values: SEVERITIES, required: true
+      attribute :code, :string
+      attribute :message, :string, required: true
+      attribute :location, Location
+
+      private
+
+      def nested_models
+        [location].compact
+      end
+    end
+  end
+end

data/lib/claricle/models/location.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+require "lutaml/model"
+
+require_relative "base"
+require_relative "uncoerced_integer"
+
+module Claricle
+  module Models
+    # Where an issue sits in its source. Every field is nullable, because
+    # what a delegate can report varies by format. `byte_offset` and
+    # `byte_length` are a zero-based half-open range -- issue #1 asks for a
+    # byte range, which a bare offset cannot express.
+    class Location < Base
+      # Every position this model carries, and none of them can be
+      # negative: an offset into the source, the length that runs from
+      # it, and a line and a column, which are counts into a document.
+      POSITIONS = %i[byte_offset byte_length line column].freeze
+      # Only `validate_types` below reads it, and that is private. The two
+      # enums on `Inspection` and `Issue` are vocabulary a caller builds a
+      # model from; this is the loop counter for a check they never run.
+      private_constant :POSITIONS
+
+      attribute :byte_offset, UncoercedInteger
+      attribute :byte_length, UncoercedInteger
+      attribute :line, UncoercedInteger
+      attribute :column, UncoercedInteger
+      attribute :chunk, :string
+      attribute :node_path, :string
+
+      private
+
+      # Absent is fine -- every field is nullable. Anything present has
+      # to BE a non-negative Integer, not merely convert to one: the
+      # declared type keeps the caller's value intact precisely so this
+      # can tell `-0.5` from the `0` lutaml would have made of it.
+      #
+      # `inspect`, so `"3"` and `3` do not read as the same rejected
+      # value in the message.
+      def validate_types
+        super
+        POSITIONS.each do |name|
+          value = public_send(name)
+          next if value.nil? || (value.is_a?(::Integer) && !value.negative?)
+
+          refuse(name, "a non-negative integer", value.inspect)
+        end
+      end
+    end
+  end
+end

data/lib/claricle/models/report.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+require_relative "base"
+require_relative "issue"
+
+module Claricle
+  module Models
+    class Report < Base
+      attribute :source_path, :string
+      attribute :format, :string
+      attribute :issues, Issue, collection: true
+      attribute :profile, :string
+      attribute :validator_version, :string
+
+      key_value do
+        map "source_path", to: :source_path
+        map "format", to: :format
+        # Without render_empty an empty collection is dropped from the
+        # document entirely, and a consumer sees no issues key at all.
+        map "issues", to: :issues, render_empty: true
+        map "profile", to: :profile
+        map "validator_version", to: :validator_version
+        map "valid", with: { to: :valid_to_doc, from: :valid_from_doc }
+      end
+
+      # Derived on read, never stored, so it cannot go stale -- reloading
+      # recomputes it, and the collection is frozen against appends anyway.
+      # D8 order: info never downgrades.
+      def valid
+        return :no if issues.any? { |issue| issue.severity == "error" }
+        return :suspicious if issues.any? { |issue| issue.severity == "warning" }
+
+        :yes
+      end
+
+      def valid_to_doc(model, doc)
+        doc["valid"] = model.valid.to_s
+      end
+
+      # Whatever arrived is discarded; `valid` is recomputed from issues.
+      def valid_from_doc(_model, _value); end
+
+      private
+
+      def normalize
+        self.issues = [] if issues.nil?
+      end
+
+      def nested_models
+        issues
+      end
+    end
+  end
+end

data/lib/claricle/models/uncoerced_integer.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+require "lutaml/model"
+
+module Claricle
+  module Models
+    # An integer attribute that hands validation the value it was given,
+    # rather than a coercion of it.
+    #
+    # lutaml's own `:integer` casts before anything can look at the
+    # value, and the cast destroys the evidence a check would need --
+    # measured on 0.8.19, at construction and through `from_json` alike:
+    # `-0.5` becomes `0`, `1.5` becomes `1`, `true` becomes `1`, `false`
+    # becomes `0` and `"3"` becomes `3`. A non-negative check running
+    # after that sees only the result, so `{"byte_offset":-0.5}`
+    # deserialized, sealed, and rendered `0` for a position the document
+    # never carried.
+    #
+    # So the cast is the identity, and the declaring model's
+    # `validate_types` decides. One rule, in one place, with the value the
+    # caller actually supplied still in hand to name in the message.
+    # Everything a model stores is an Integer or nil by the time the
+    # lifecycle seals it, so `Type::Integer.serialize` -- which renders
+    # through this same cast -- has nothing left to convert.
+    #
+    # Its own file rather than Location's, because BatchItem's `exit_code`
+    # needs it for the same reason and this codebase requires what it names
+    # rather than leaning on a transitive require.
+    class UncoercedInteger < Lutaml::Model::Type::Integer
+      def self.cast(value, _options = {})
+        value
+      end
+    end
+
+    # A coercion workaround, not a type a caller ever names.
+    private_constant :UncoercedInteger
+  end
+end

data/lib/claricle/postscript_fidelity/verdict.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+require "rexml/document"
+require_relative "../lossiness"
+
+module Claricle
+  module PostscriptFidelity
+    # The lossiness of an svg -> ps/eps conversion: `:lossless` only holds
+    # when `repair` could read the SVG it was meant to fix.
+    module Verdict
+      module_function
+
+      def classify(source_format, target, svg)
+        lossiness = Lossiness.classify(source_format: source_format, target_format: target, source: svg)
+        return lossiness unless lossiness == "lossless" && POSTSCRIPT_TARGETS.include?(target)
+
+        repairable?(svg) && renderable?(svg) ? lossiness : "unknown"
+      end
+
+      # A viewBox with no area disables rendering, so nothing it draws is right.
+      def renderable?(svg)
+        text = Detector.read_root(svg)&.last&.fetch("viewBox", nil)
+        box = ViewBox.parse(text)
+        text.nil? || box.nil? || box.last(2).all?(&:positive?)
+      end
+
+      def repairable?(svg)
+        return true unless svg.match?(HINT)
+
+        doc = REXML::Document.new(svg)
+        !doc.root.nil? && doc.encoding == "UTF-8"
+      rescue REXML::ParseException, RuntimeError, EncodingError, ArgumentError
+        false
+      end
+    end
+  end
+end