@gmickel/gno 1.32.0 → 1.33.0

package/src/publish/attachment-raster.ts

@@ -0,0 +1,852 @@
+/**
+ * Bounded raster signature + dimension validation for publish attachments.
+ * Extension/MIME are untrusted; only sniffed bytes decide media type.
+ *
+ * Structural validation is synchronous and closed-parser safe.
+ * Full image decodability is a separate async producer/file-ingress check.
+ *
+ * @module src/publish/attachment-raster
+ */
+
+// node:zlib is required because Bun.inflateSync has no bounded-output option.
+import { inflateSync } from "node:zlib";
+
+import {
+  MAX_PUBLISH_UPLOAD_BYTES,
+  MAX_RASTER_DIMENSION_PX,
+  MIN_RASTER_DIMENSION_PX,
+  type PublishAssetDiagnosticCode,
+  type SupportedRasterMediaType,
+} from "./artifact-asset-contract";
+import { sniffRasterMediaType } from "./artifact-asset-sniff";
+
+/** Header probe size: enough for signatures + early boxes/markers. */
+export const RASTER_HEADER_PROBE_BYTES = 65_536;
+
+export interface RasterValidationOk {
+  ok: true;
+  height: number;
+  mediaType: SupportedRasterMediaType;
+  width: number;
+}
+
+export interface RasterValidationFail {
+  ok: false;
+  code: PublishAssetDiagnosticCode;
+  message: string;
+}
+
+export type RasterValidationResult = RasterValidationOk | RasterValidationFail;
+
+const fail = (
+  code: PublishAssetDiagnosticCode,
+  message: string
+): RasterValidationFail => ({ ok: false, code, message });
+
+const asciiSlice = (bytes: Uint8Array, start: number, end: number): string =>
+  String.fromCharCode(...bytes.subarray(start, end));
+
+const readU16BE = (bytes: Uint8Array, offset: number): number =>
+  ((bytes[offset] ?? 0) << 8) | (bytes[offset + 1] ?? 0);
+
+const readU16LE = (bytes: Uint8Array, offset: number): number =>
+  (bytes[offset] ?? 0) | ((bytes[offset + 1] ?? 0) << 8);
+
+const readU24LE = (bytes: Uint8Array, offset: number): number =>
+  (bytes[offset] ?? 0) |
+  ((bytes[offset + 1] ?? 0) << 8) |
+  ((bytes[offset + 2] ?? 0) << 16);
+
+const readU32BE = (bytes: Uint8Array, offset: number): number =>
+  (((bytes[offset] ?? 0) << 24) |
+    ((bytes[offset + 1] ?? 0) << 16) |
+    ((bytes[offset + 2] ?? 0) << 8) |
+    (bytes[offset + 3] ?? 0)) >>>
+  0;
+
+const readU32LE = (bytes: Uint8Array, offset: number): number =>
+  (((bytes[offset + 3] ?? 0) << 24) |
+    ((bytes[offset + 2] ?? 0) << 16) |
+    ((bytes[offset + 1] ?? 0) << 8) |
+    (bytes[offset] ?? 0)) >>>
+  0;
+
+const CRC32_TABLE = Uint32Array.from({ length: 256 }, (_, value) => {
+  let crc = value;
+  for (let bit = 0; bit < 8; bit += 1) {
+    crc = (crc >>> 1) ^ (crc & 1 ? 0xedb88320 : 0);
+  }
+  return crc >>> 0;
+});
+
+const crc32 = (bytes: Uint8Array, start: number, end: number): number => {
+  let crc = 0xffffffff;
+  for (let index = start; index < end; index += 1) {
+    const tableIndex = (crc ^ (bytes[index] ?? 0)) & 0xff;
+    crc = (crc >>> 8) ^ (CRC32_TABLE[tableIndex] ?? 0);
+  }
+  return (crc ^ 0xffffffff) >>> 0;
+};
+
+const validateDimensions = (
+  width: number,
+  height: number
+): RasterValidationFail | null => {
+  if (
+    !Number.isSafeInteger(width) ||
+    !Number.isSafeInteger(height) ||
+    width < MIN_RASTER_DIMENSION_PX ||
+    height < MIN_RASTER_DIMENSION_PX
+  ) {
+    return fail(
+      "ASSET_DIMENSION_INVALID",
+      `Raster dimensions ${width}x${height} are zero or non-integer`
+    );
+  }
+  if (width > MAX_RASTER_DIMENSION_PX || height > MAX_RASTER_DIMENSION_PX) {
+    return fail(
+      "ASSET_DIMENSION_INVALID",
+      `Raster dimensions ${width}x${height} exceed ${MAX_RASTER_DIMENSION_PX}px limit`
+    );
+  }
+  return null;
+};
+
+const parsePngDimensions = (
+  bytes: Uint8Array
+): { width: number; height: number } | null => {
+  if (bytes.length < 24) return null;
+  if (asciiSlice(bytes, 12, 16) !== "IHDR") return null;
+  return {
+    width: readU32BE(bytes, 16),
+    height: readU32BE(bytes, 20),
+  };
+};
+
+const parseGifDimensions = (
+  bytes: Uint8Array
+): { width: number; height: number } | null => {
+  if (bytes.length < 10) return null;
+  return {
+    width: readU16LE(bytes, 6),
+    height: readU16LE(bytes, 8),
+  };
+};
+
+const parseJpegDimensions = (
+  bytes: Uint8Array
+): { width: number; height: number } | null => {
+  let offset = 2;
+  const limit = bytes.length;
+  while (offset + 9 < limit) {
+    if (bytes[offset] !== 0xff) return null;
+    while (offset < limit && bytes[offset] === 0xff) offset += 1;
+    if (offset >= limit) return null;
+    const marker = bytes[offset] ?? 0;
+    offset += 1;
+    if (marker === 0xd8 || marker === 0xd9) continue;
+    if (offset + 2 > limit) return null;
+    const segmentLength = readU16BE(bytes, offset);
+    if (segmentLength < 2) return null;
+    const sof =
+      (marker >= 0xc0 && marker <= 0xc3) ||
+      (marker >= 0xc5 && marker <= 0xc7) ||
+      (marker >= 0xc9 && marker <= 0xcb) ||
+      (marker >= 0xcd && marker <= 0xcf);
+    if (sof) {
+      if (offset + 7 >= limit) return null;
+      return {
+        height: readU16BE(bytes, offset + 3),
+        width: readU16BE(bytes, offset + 5),
+      };
+    }
+    offset += segmentLength;
+  }
+  return null;
+};
+
+const parseWebpDimensions = (
+  bytes: Uint8Array
+): { width: number; height: number } | null => {
+  if (bytes.length < 30) return null;
+  const chunk = asciiSlice(bytes, 12, 16);
+  if (chunk === "VP8X" && bytes.length >= 30) {
+    return {
+      width: readU24LE(bytes, 24) + 1,
+      height: readU24LE(bytes, 27) + 1,
+    };
+  }
+  if (chunk === "VP8 " && bytes.length >= 30) {
+    // Lossy bitstream start code 0x9d012a at payload+3
+    if (
+      bytes[23] === 0x9d &&
+      bytes[24] === 0x01 &&
+      bytes[25] === 0x2a &&
+      bytes.length >= 30
+    ) {
+      return {
+        width: readU16LE(bytes, 26) & 0x3fff,
+        height: readU16LE(bytes, 28) & 0x3fff,
+      };
+    }
+    return null;
+  }
+  if (chunk === "VP8L" && bytes.length >= 25) {
+    if (bytes[20] !== 0x2f) return null;
+    const b0 = bytes[21] ?? 0;
+    const b1 = bytes[22] ?? 0;
+    const b2 = bytes[23] ?? 0;
+    const b3 = bytes[24] ?? 0;
+    const bits = b0 | (b1 << 8) | (b2 << 16) | (b3 << 24);
+    return {
+      width: (bits & 0x3fff) + 1,
+      height: ((bits >> 14) & 0x3fff) + 1,
+    };
+  }
+  return null;
+};
+
+/** ISO BMFF containers that may hold `ispe` (directly or nested). */
+const BMFF_NEST_BOXES = new Set(["meta", "iprp", "ipco", "moov"]);
+/** FullBox containers: 4-byte version+flags after the box header. */
+const BMFF_FULLBOX_CONTAINERS = new Set(["meta"]);
+const BMFF_MAX_DEPTH = 12;
+const BMFF_MAX_BOXES = 512;
+
+/**
+ * Bounded recursive BMFF scan for HEIF/AVIF `ispe` (Image Spatial Extents).
+ * Handles nested containers, `meta` FullBox payload, and 64-bit size fields.
+ * The input is already bounded by the attachment byte limit, so scan it all;
+ * valid files may place arbitrarily large metadata boxes before `meta`.
+ */
+const parseAvifDimensions = (
+  bytes: Uint8Array
+): { width: number; height: number } | null => {
+  const limit = bytes.length;
+
+  const scanRange = (
+    start: number,
+    end: number,
+    depth: number,
+    boxBudget: { remaining: number }
+  ): { width: number; height: number } | null => {
+    if (depth > BMFF_MAX_DEPTH) return null;
+    let offset = start;
+    while (offset + 8 <= end && boxBudget.remaining > 0) {
+      boxBudget.remaining -= 1;
+      let size = readU32BE(bytes, offset);
+      const type = asciiSlice(bytes, offset + 4, offset + 8);
+      let headerSize = 8;
+      if (size === 1) {
+        if (offset + 16 > end) return null;
+        const high = readU32BE(bytes, offset + 8);
+        const low = readU32BE(bytes, offset + 12);
+        if (high !== 0) return null;
+        size = low;
+        headerSize = 16;
+      } else if (size === 0) {
+        size = end - offset;
+      }
+      if (size < headerSize) return null;
+      if (offset + headerSize > end) return null;
+
+      // Clamp to the validated input boundary so malformed boxes cannot escape it.
+      const boxEnd = Math.min(offset + size, end);
+
+      if (type === "ispe") {
+        // ispe is a FullBox: version(1)+flags(3) then width/height u32be.
+        const payload = offset + headerSize;
+        if (payload + 12 > boxEnd) return null;
+        const width = readU32BE(bytes, payload + 4);
+        const height = readU32BE(bytes, payload + 8);
+        return { width, height };
+      }
+
+      if (BMFF_NEST_BOXES.has(type)) {
+        let payloadStart = offset + headerSize;
+        if (BMFF_FULLBOX_CONTAINERS.has(type)) {
+          if (payloadStart + 4 > boxEnd) return null;
+          payloadStart += 4;
+        }
+        const nested = scanRange(payloadStart, boxEnd, depth + 1, boxBudget);
+        if (nested) return nested;
+      }
+
+      if (offset + size > end) {
+        // Truncated declared size — stop rather than walk past the range.
+        break;
+      }
+      offset += size;
+    }
+    return null;
+  };
+
+  return scanRange(0, limit, 0, { remaining: BMFF_MAX_BOXES });
+};
+
+const parseDimensions = (
+  mediaType: SupportedRasterMediaType,
+  bytes: Uint8Array
+): { width: number; height: number } | null => {
+  switch (mediaType) {
+    case "image/png":
+      return parsePngDimensions(bytes);
+    case "image/jpeg":
+      return parseJpegDimensions(bytes);
+    case "image/gif":
+      return parseGifDimensions(bytes);
+    case "image/webp":
+      return parseWebpDimensions(bytes);
+    case "image/avif":
+      return parseAvifDimensions(bytes);
+    default:
+      return null;
+  }
+};
+
+/**
+ * Validate the complete PNG chunk stream. This prevents a signature + fabricated
+ * IHDR prefix from crossing the boundary as an image. CRCs, image data, the
+ * terminal IEND chunk, and no trailing bytes are required.
+ */
+const pngPasses = [
+  [0, 0, 8, 8],
+  [4, 0, 8, 8],
+  [0, 4, 4, 8],
+  [2, 0, 4, 4],
+  [0, 2, 2, 4],
+  [1, 0, 2, 2],
+  [0, 1, 1, 2],
+] as const;
+
+const validatePngPixels = (
+  bytes: Uint8Array,
+  idatChunks: readonly Uint8Array[]
+): boolean => {
+  const width = readU32BE(bytes, 16);
+  const height = readU32BE(bytes, 20);
+  const bitDepth = bytes[24] ?? 0;
+  const colorType = bytes[25] ?? 0;
+  const interlace = bytes[28] ?? 0;
+  const channels = new Map([
+    [0, 1],
+    [2, 3],
+    [3, 1],
+    [4, 2],
+    [6, 4],
+  ]).get(colorType);
+  const validDepths = new Map<number, readonly number[]>([
+    [0, [1, 2, 4, 8, 16]],
+    [2, [8, 16]],
+    [3, [1, 2, 4, 8]],
+    [4, [8, 16]],
+    [6, [8, 16]],
+  ]).get(colorType);
+  if (
+    channels === undefined ||
+    !validDepths?.includes(bitDepth) ||
+    bytes[26] !== 0 ||
+    bytes[27] !== 0 ||
+    (interlace !== 0 && interlace !== 1)
+  ) {
+    return false;
+  }
+  const passes = interlace === 0 ? ([[0, 0, 1, 1]] as const) : pngPasses;
+  const rowLengths: number[] = [];
+  let expectedLength = 0;
+  for (const [startX, startY, stepX, stepY] of passes) {
+    const passWidth = width <= startX ? 0 : Math.ceil((width - startX) / stepX);
+    const passHeight =
+      height <= startY ? 0 : Math.ceil((height - startY) / stepY);
+    if (passWidth === 0 || passHeight === 0) continue;
+    const rowBytes = Math.ceil((passWidth * channels * bitDepth) / 8);
+    expectedLength += (rowBytes + 1) * passHeight;
+    if (expectedLength > MAX_PUBLISH_UPLOAD_BYTES) return false;
+    for (let row = 0; row < passHeight; row += 1) rowLengths.push(rowBytes);
+  }
+  const compressedLength = idatChunks.reduce(
+    (total, chunk) => total + chunk.length,
+    0
+  );
+  const compressed = new Uint8Array(compressedLength);
+  let compressedOffset = 0;
+  for (const chunk of idatChunks) {
+    compressed.set(chunk, compressedOffset);
+    compressedOffset += chunk.length;
+  }
+  let inflated: Uint8Array;
+  try {
+    inflated = inflateSync(compressed, {
+      maxOutputLength: expectedLength,
+      windowBits: 15,
+    });
+  } catch {
+    return false;
+  }
+  if (inflated.length !== expectedLength) return false;
+  let rowOffset = 0;
+  for (const rowLength of rowLengths) {
+    if ((inflated[rowOffset] ?? 5) > 4) return false;
+    rowOffset += rowLength + 1;
+  }
+  return rowOffset === inflated.length;
+};
+
+const isCompletePng = (bytes: Uint8Array): boolean => {
+  let offset = 8;
+  let chunkIndex = 0;
+  let sawIdat = false;
+  const idatChunks: Uint8Array[] = [];
+  while (offset + 12 <= bytes.length) {
+    const dataLength = readU32BE(bytes, offset);
+    const typeStart = offset + 4;
+    const dataStart = offset + 8;
+    const dataEnd = dataStart + dataLength;
+    const chunkEnd = dataEnd + 4;
+    if (dataEnd < dataStart || chunkEnd > bytes.length) return false;
+    const type = asciiSlice(bytes, typeStart, dataStart);
+    if (crc32(bytes, typeStart, dataEnd) !== readU32BE(bytes, dataEnd)) {
+      return false;
+    }
+    if (chunkIndex === 0 && (type !== "IHDR" || dataLength !== 13)) {
+      return false;
+    }
+    if (type === "IDAT") {
+      sawIdat = true;
+      idatChunks.push(bytes.subarray(dataStart, dataEnd));
+    }
+    if (type === "IEND") {
+      return (
+        dataLength === 0 &&
+        sawIdat &&
+        chunkEnd === bytes.length &&
+        validatePngPixels(bytes, idatChunks)
+      );
+    }
+    offset = chunkEnd;
+    chunkIndex += 1;
+  }
+  return false;
+};
+
+/** Complete marker walk: a JPEG needs frame metadata, a scan, and terminal EOI. */
+const isCompleteJpeg = (bytes: Uint8Array): boolean => {
+  if (bytes.length < 6 || bytes[0] !== 0xff || bytes[1] !== 0xd8) return false;
+  let offset = 2;
+  let sawFrame = false;
+  let sawScan = false;
+  let sawEntropyData = false;
+  while (offset < bytes.length) {
+    if (bytes[offset] !== 0xff) return false;
+    while (offset < bytes.length && bytes[offset] === 0xff) offset += 1;
+    if (offset >= bytes.length) return false;
+    const marker = bytes[offset] ?? 0;
+    offset += 1;
+    if (marker === 0xd9) {
+      return sawFrame && sawScan && sawEntropyData && offset === bytes.length;
+    }
+    if (
+      marker === 0xd8 ||
+      (marker >= 0xd0 && marker <= 0xd7) ||
+      marker === 0x01
+    ) {
+      continue;
+    }
+    if (offset + 2 > bytes.length) return false;
+    const segmentLength = readU16BE(bytes, offset);
+    if (segmentLength < 2 || offset + segmentLength > bytes.length)
+      return false;
+    const isFrame =
+      (marker >= 0xc0 && marker <= 0xc3) ||
+      (marker >= 0xc5 && marker <= 0xc7) ||
+      (marker >= 0xc9 && marker <= 0xcb) ||
+      (marker >= 0xcd && marker <= 0xcf);
+    if (isFrame) sawFrame = true;
+    if (marker !== 0xda) {
+      offset += segmentLength;
+      continue;
+    }
+    sawScan = true;
+    offset += segmentLength;
+    while (offset < bytes.length) {
+      if (bytes[offset] !== 0xff) {
+        sawEntropyData = true;
+        offset += 1;
+        continue;
+      }
+      const next = bytes[offset + 1];
+      if (next === undefined) return false;
+      if (next === 0x00 || (next >= 0xd0 && next <= 0xd7)) {
+        offset += 2;
+        continue;
+      }
+      break;
+    }
+  }
+  return false;
+};
+
+const skipGifSubBlocks = (bytes: Uint8Array, start: number): number | null => {
+  let offset = start;
+  while (offset < bytes.length) {
+    const size = bytes[offset] ?? 0;
+    offset += 1;
+    if (size === 0) return offset;
+    if (offset + size > bytes.length) return null;
+    offset += size;
+  }
+  return null;
+};
+
+const validateGifLzwSubBlocks = (
+  bytes: Uint8Array,
+  start: number,
+  minimumCodeSize: number,
+  expectedPixels: number
+): number | null => {
+  const compressed: number[] = [];
+  let offset = start;
+  let sawTerminator = false;
+  while (offset < bytes.length) {
+    const size = bytes[offset] ?? 0;
+    offset += 1;
+    if (size === 0) {
+      sawTerminator = true;
+      break;
+    }
+    if (offset + size > bytes.length) return null;
+    for (const value of bytes.subarray(offset, offset + size)) {
+      compressed.push(value);
+    }
+    offset += size;
+  }
+  if (!sawTerminator || compressed.length === 0) return null;
+
+  const clearCode = 1 << minimumCodeSize;
+  const endCode = clearCode + 1;
+  let codeSize = minimumCodeSize + 1;
+  let nextCode = endCode + 1;
+  let bitOffset = 0;
+  let previousCode: number | null = null;
+  let previousLength = 0;
+  let decodedPixels = 0;
+  let sawClear = false;
+  const dictionaryLengths = new Uint16Array(4096);
+  for (let code = 0; code < clearCode; code += 1) {
+    dictionaryLengths[code] = 1;
+  }
+  while (bitOffset + codeSize <= compressed.length * 8) {
+    let code = 0;
+    for (let bit = 0; bit < codeSize; bit += 1) {
+      const position = bitOffset + bit;
+      const value = compressed[position >> 3] ?? 0;
+      code |= ((value >> (position & 7)) & 1) << bit;
+    }
+    bitOffset += codeSize;
+    if (code === clearCode) {
+      sawClear = true;
+      codeSize = minimumCodeSize + 1;
+      nextCode = endCode + 1;
+      previousCode = null;
+      previousLength = 0;
+      continue;
+    }
+    if (!sawClear) return null;
+    if (code === endCode) {
+      return decodedPixels === expectedPixels ? offset : null;
+    }
+    if (previousCode === null) {
+      if (code >= clearCode) return null;
+      previousCode = code;
+      previousLength = 1;
+      decodedPixels += 1;
+      continue;
+    }
+    if (code > nextCode) return null;
+    const decodedLength =
+      code === nextCode ? previousLength + 1 : (dictionaryLengths[code] ?? 0);
+    if (decodedLength === 0 || decodedPixels + decodedLength > expectedPixels) {
+      return null;
+    }
+    decodedPixels += decodedLength;
+    if (nextCode < 4096) {
+      dictionaryLengths[nextCode] = previousLength + 1;
+      nextCode += 1;
+      if (nextCode === 1 << codeSize && codeSize < 12) codeSize += 1;
+    }
+    previousCode = code;
+    previousLength = decodedLength;
+  }
+  return null;
+};
+
+/** Complete GIF block walk with at least one image and a terminal trailer. */
+const isCompleteGif = (bytes: Uint8Array): boolean => {
+  if (bytes.length < 14) return false;
+  let offset = 13;
+  const globalTable = (bytes[10] ?? 0) & 0x80;
+  if (globalTable) offset += 3 * 2 ** (((bytes[10] ?? 0) & 0x07) + 1);
+  if (offset > bytes.length) return false;
+  let sawImage = false;
+  while (offset < bytes.length) {
+    const introducer = bytes[offset] ?? 0;
+    offset += 1;
+    if (introducer === 0x3b) return sawImage && offset === bytes.length;
+    if (introducer === 0x21) {
+      if (offset >= bytes.length) return false;
+      offset += 1;
+      const next = skipGifSubBlocks(bytes, offset);
+      if (next === null) return false;
+      offset = next;
+      continue;
+    }
+    if (introducer !== 0x2c || offset + 9 > bytes.length) return false;
+    const frameWidth = readU16LE(bytes, offset + 4);
+    const frameHeight = readU16LE(bytes, offset + 6);
+    if (frameWidth === 0 || frameHeight === 0) return false;
+    const packed = bytes[offset + 8] ?? 0;
+    offset += 9;
+    if (packed & 0x80) offset += 3 * 2 ** ((packed & 0x07) + 1);
+    if (offset >= bytes.length) return false;
+    const minimumCodeSize = bytes[offset] ?? 0;
+    if (minimumCodeSize < 2 || minimumCodeSize > 8) return false;
+    offset += 1;
+    if ((bytes[offset] ?? 0) === 0) return false;
+    const next = validateGifLzwSubBlocks(
+      bytes,
+      offset,
+      minimumCodeSize,
+      frameWidth * frameHeight
+    );
+    if (next === null) return false;
+    offset = next;
+    sawImage = true;
+  }
+  return false;
+};
+
+const isWebpImageChunk = (
+  bytes: Uint8Array,
+  type: string,
+  dataStart: number,
+  size: number
+): boolean => {
+  if (type === "VP8 ") {
+    if (
+      size <= 10 ||
+      bytes[dataStart + 3] !== 0x9d ||
+      bytes[dataStart + 4] !== 0x01 ||
+      bytes[dataStart + 5] !== 0x2a
+    ) {
+      return false;
+    }
+    const frameTag =
+      (bytes[dataStart] ?? 0) |
+      ((bytes[dataStart + 1] ?? 0) << 8) |
+      ((bytes[dataStart + 2] ?? 0) << 16);
+    const firstPartitionLength = frameTag >>> 5;
+    return firstPartitionLength > 0 && 10 + firstPartitionLength < size;
+  }
+  // VP8L's five-byte signature/dimension header must be followed by image data.
+  return type === "VP8L" && size > 5 && bytes[dataStart] === 0x2f;
+};
+
+const animationFrameHasImageData = (
+  bytes: Uint8Array,
+  dataStart: number,
+  size: number
+): boolean => {
+  if (size < 16) return false;
+  const frameEnd = dataStart + size;
+  let offset = dataStart + 16;
+  let sawImageData = false;
+  while (offset + 8 <= frameEnd) {
+    const type = asciiSlice(bytes, offset, offset + 4);
+    const chunkSize = readU32LE(bytes, offset + 4);
+    const chunkDataStart = offset + 8;
+    const paddedEnd = chunkDataStart + chunkSize + (chunkSize % 2);
+    if (paddedEnd < chunkDataStart || paddedEnd > frameEnd) return false;
+    if (isWebpImageChunk(bytes, type, chunkDataStart, chunkSize)) {
+      sawImageData = true;
+    }
+    offset = paddedEnd;
+  }
+  return sawImageData && offset === frameEnd;
+};
+
+/** RIFF size/chunk walk; metadata and empty animation frames are not image data. */
+const isCompleteWebp = (bytes: Uint8Array): boolean => {
+  if (bytes.length < 20 || readU32LE(bytes, 4) + 8 !== bytes.length) {
+    return false;
+  }
+  let offset = 12;
+  let sawImageData = false;
+  while (offset + 8 <= bytes.length) {
+    const type = asciiSlice(bytes, offset, offset + 4);
+    const size = readU32LE(bytes, offset + 4);
+    const dataStart = offset + 8;
+    const paddedEnd = dataStart + size + (size % 2);
+    if (paddedEnd < dataStart || paddedEnd > bytes.length) return false;
+    const isAnimationFrame =
+      type === "ANMF" && animationFrameHasImageData(bytes, dataStart, size);
+    if (isWebpImageChunk(bytes, type, dataStart, size) || isAnimationFrame) {
+      sawImageData = true;
+    }
+    offset = paddedEnd;
+  }
+  return sawImageData && offset === bytes.length;
+};
+
+/** Exact top-level BMFF walk; AVIF needs metadata and a non-empty media payload. */
+const isCompleteAvif = (bytes: Uint8Array): boolean => {
+  let offset = 0;
+  let sawFtyp = false;
+  let sawMeta = false;
+  let sawMediaData = false;
+  while (offset + 8 <= bytes.length) {
+    let size = readU32BE(bytes, offset);
+    const type = asciiSlice(bytes, offset + 4, offset + 8);
+    let headerSize = 8;
+    if (size === 1) {
+      if (offset + 16 > bytes.length || readU32BE(bytes, offset + 8) !== 0) {
+        return false;
+      }
+      size = readU32BE(bytes, offset + 12);
+      headerSize = 16;
+    } else if (size === 0) {
+      size = bytes.length - offset;
+    }
+    if (size < headerSize || offset + size > bytes.length) return false;
+    if (type === "ftyp" && size >= headerSize + 8) sawFtyp = true;
+    if (type === "meta") sawMeta = true;
+    if (type === "mdat" && size > headerSize) sawMediaData = true;
+    offset += size;
+  }
+  return sawFtyp && sawMeta && sawMediaData && offset === bytes.length;
+};
+
+const isCompleteRaster = (
+  mediaType: SupportedRasterMediaType,
+  bytes: Uint8Array
+): boolean => {
+  switch (mediaType) {
+    case "image/png":
+      return isCompletePng(bytes);
+    case "image/jpeg":
+      return isCompleteJpeg(bytes);
+    case "image/gif":
+      return isCompleteGif(bytes);
+    case "image/webp":
+      return isCompleteWebp(bytes);
+    case "image/avif":
+      return isCompleteAvif(bytes);
+    default:
+      return false;
+  }
+};
+
+/**
+ * Synchronous structural raster validation: signature sniff, bounded
+ * dimensions, and container completeness. Does **not** prove AV1
+ * decodability for AVIF — producers must also await
+ * `validateRasterDecodable` before bundling.
+ */
+export const validateRasterBytesStructural = (
+  bytes: Uint8Array
+): RasterValidationResult => {
+  if (bytes.byteLength === 0) {
+    return fail("ASSET_CORRUPT", "Image payload is empty");
+  }
+  if (bytes.byteLength > MAX_PUBLISH_UPLOAD_BYTES) {
+    return fail(
+      "ASSET_OVERSIZE",
+      `Image payload is ${bytes.byteLength} bytes; max is ${MAX_PUBLISH_UPLOAD_BYTES}`
+    );
+  }
+
+  const mediaType = sniffRasterMediaType(bytes);
+  if (!mediaType) {
+    if (
+      bytes.length >= 5 &&
+      (asciiSlice(bytes, 0, 5) === "<?xml" ||
+        asciiSlice(bytes, 0, 4).toLowerCase() === "<svg")
+    ) {
+      return fail(
+        "ASSET_UNSUPPORTED_FORMAT",
+        "SVG is unsupported for bundled publish assets"
+      );
+    }
+    return fail(
+      "ASSET_UNSUPPORTED_FORMAT",
+      "Payload does not match a supported raster signature"
+    );
+  }
+
+  const dims = parseDimensions(mediaType, bytes);
+  if (!dims) {
+    return fail(
+      "ASSET_CORRUPT",
+      `Unable to parse ${mediaType} dimensions from bounded header`
+    );
+  }
+  const dimError = validateDimensions(dims.width, dims.height);
+  if (dimError) return dimError;
+  if (!isCompleteRaster(mediaType, bytes)) {
+    return fail(
+      "ASSET_CORRUPT",
+      `${mediaType} payload is not a complete, structurally renderable image`
+    );
+  }
+
+  return {
+    ok: true,
+    height: dims.height,
+    mediaType,
+    width: dims.width,
+  };
+};
+
+const MAX_RASTER_DECODE_INPUT_PIXELS =
+  MAX_RASTER_DIMENSION_PX * MAX_RASTER_DIMENSION_PX;
+
+/**
+ * Prove payloads contain a decodable image via a bounded 1x1 decode.
+ * Bun has no native image decoder; sharp provides the cross-platform path.
+ * Call only after structural dimension/bomb checks. Avoids retaining decoded
+ * pixel buffers beyond the 1x1 probe.
+ */
+const assertRasterDecodable = async (
+  bytes: Uint8Array,
+  structural: RasterValidationOk
+): Promise<RasterValidationResult> => {
+  try {
+    // sharp — Bun has no native AV1/image decoder; pin exact version in package.json.
+    const sharp = (await import("sharp")).default;
+    await sharp(bytes, {
+      failOn: "error",
+      limitInputPixels: MAX_RASTER_DECODE_INPUT_PIXELS,
+    })
+      .resize(1, 1, { fit: "fill" })
+      .raw()
+      .toBuffer();
+    return structural;
+  } catch {
+    return fail(
+      "ASSET_CORRUPT",
+      `${structural.mediaType} payload is not image-decodable`
+    );
+  }
+};
+
+/**
+ * Producer/file-ingress validation: structural checks, then full image
+ * decodability for every supported raster type. Closed artifact parsers use
+ * `validateRasterBytesStructural` only (sync).
+ */
+export const validateRasterDecodable = async (
+  bytes: Uint8Array
+): Promise<RasterValidationResult> => {
+  const structural = validateRasterBytesStructural(bytes);
+  if (!structural.ok) return structural;
+  return assertRasterDecodable(bytes, structural);
+};