npm - @jant/core - Versions diffs - 0.6.9 → 0.6.11 - Mend

@jant/core 0.6.9 → 0.6.11

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (69) hide show

package/dist/{app-C-jxWmAV.js → app-CpmficmQ.js} +912 -423
package/dist/app-DqKkZenB.js +6 -0
package/dist/client/.vite/manifest.json +3 -3
package/dist/client/_assets/client-BhHHVvSY.css +2 -0
package/dist/client/_assets/{client-DWy1LEEk.js → client-Dd9U383b.js} +1 -1
package/dist/client/_assets/{client-auth-Blg-a5Ep.js → client-auth-DkpSdIDz.js} +101 -99
package/dist/{export-C2DIB7mm.js → export-Ba7NJImL.js} +93 -93
package/dist/{github-sync-7XQ5ZM6z.js → github-sync-BD4w2m8-.js} +2 -2
package/dist/{github-sync-BEFCfLKK.js → github-sync-Cb4_6_i7.js} +1 -1
package/dist/index.js +3 -3
package/dist/node.js +4 -4
package/package.json +1 -1
package/src/client/components/__tests__/jant-compose-editor-rehost-notice.test.ts +62 -0
package/src/client/components/__tests__/jant-settings-avatar.test.ts +3 -0
package/src/client/components/__tests__/jant-settings-general.test.ts +9 -4
package/src/client/components/compose-types.ts +4 -0
package/src/client/components/jant-compose-editor.ts +111 -0
package/src/client/components/jant-settings-general.ts +18 -3
package/src/client/components/settings-types.ts +2 -0
package/src/client/compose-bridge.ts +25 -8
package/src/client/tiptap/__tests__/inline-image-upload.test.ts +143 -0
package/src/client/tiptap/__tests__/link-toolbar.test.ts +41 -0
package/src/client/tiptap/__tests__/paste-rehost-e2e.test.ts +65 -0
package/src/client/tiptap/__tests__/rehost-images.test.ts +139 -0
package/src/client/tiptap/create-editor.ts +3 -0
package/src/client/tiptap/extensions.ts +4 -0
package/src/client/tiptap/inline-image-upload.ts +174 -50
package/src/client/tiptap/link-toolbar.ts +63 -1
package/src/client/tiptap/rehost-images.ts +104 -0
package/src/i18n/locales/public/en.po +10 -0
package/src/i18n/locales/public/en.ts +1 -1
package/src/i18n/locales/public/zh-Hans.po +10 -0
package/src/i18n/locales/public/zh-Hans.ts +1 -1
package/src/i18n/locales/public/zh-Hant.po +10 -0
package/src/i18n/locales/public/zh-Hant.ts +1 -1
package/src/i18n/locales/settings/en.po +258 -18
package/src/i18n/locales/settings/en.ts +1 -1
package/src/i18n/locales/settings/zh-Hans.po +258 -18
package/src/i18n/locales/settings/zh-Hans.ts +1 -1
package/src/i18n/locales/settings/zh-Hant.po +258 -18
package/src/i18n/locales/settings/zh-Hant.ts +1 -1
package/src/lib/__tests__/feed.test.ts +5 -1
package/src/lib/__tests__/upload-sideload.test.ts +78 -0
package/src/lib/__tests__/url-fetch.test.ts +181 -0
package/src/lib/feed.ts +6 -3
package/src/lib/upload.ts +111 -0
package/src/lib/url-fetch.ts +263 -0
package/src/routes/api/__tests__/uploads.test.ts +63 -1
package/src/routes/api/uploads.ts +52 -0
package/src/routes/dash/settings.tsx +7 -2
package/src/routes/feed/__tests__/feed.test.ts +58 -19
package/src/routes/feed/feed.ts +37 -28
package/src/routes/pages/featured.tsx +17 -0
package/src/routes/pages/latest.tsx +25 -0
package/src/services/__tests__/media.test.ts +168 -1
package/src/services/media.ts +111 -0
package/src/services/post.ts +1 -1
package/src/styles/tokens.css +15 -0
package/src/styles/ui.css +45 -2
package/src/ui/__tests__/color-themes.test.ts +2 -2
package/src/ui/color-themes.ts +32 -0
package/src/ui/compose/ComposeDialog.tsx +16 -0
package/src/ui/dash/appearance/ColorThemeContent.tsx +264 -29
package/src/ui/dash/settings/GeneralContent.tsx +16 -0
package/src/ui/dash/settings/__tests__/GeneralContent.test.tsx +3 -2
package/src/ui/layouts/BaseLayout.tsx +14 -2
package/src/ui/layouts/__tests__/BaseLayout.test.tsx +4 -4
package/dist/app-DqHzOwL5.js +0 -6
package/dist/client/_assets/client-CGf2m3qp.css +0 -2

package/src/lib/__tests__/upload-sideload.test.ts ADDED Viewed

@@ -0,0 +1,78 @@
+import { describe, expect, it } from "vitest";
+import {
+  imageExtensionForMimeType,
+  isAllowedSideloadImageType,
+  sniffImageMimeType,
+} from "../upload.js";
+describe("isAllowedSideloadImageType", () => {
+  it("accepts the full set of displayable image types", () => {
+    for (const type of [
+      "image/jpeg",
+      "image/png",
+      "image/gif",
+      "image/webp",
+      "image/svg+xml",
+      "image/avif",
+      "image/bmp",
+      "image/x-icon",
+    ]) {
+      expect(isAllowedSideloadImageType(type)).toBe(true);
+    }
+  });
+  it("rejects non-image and unknown types", () => {
+    expect(isAllowedSideloadImageType("text/html")).toBe(false);
+    expect(isAllowedSideloadImageType("application/octet-stream")).toBe(false);
+    expect(isAllowedSideloadImageType("image/tiff")).toBe(false);
+  });
+});
+describe("imageExtensionForMimeType", () => {
+  it("maps types to extensions", () => {
+    expect(imageExtensionForMimeType("image/jpeg")).toBe("jpg");
+    expect(imageExtensionForMimeType("image/svg+xml")).toBe("svg");
+    expect(imageExtensionForMimeType("image/x-icon")).toBe("ico");
+  });
+  it("returns null for unsupported types", () => {
+    expect(imageExtensionForMimeType("text/html")).toBeNull();
+  });
+});
+describe("sniffImageMimeType", () => {
+  const cases: Array<[string, number[]]> = [
+    ["image/jpeg", [0xff, 0xd8, 0xff, 0xe0]],
+    ["image/png", [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]],
+    ["image/gif", [...new TextEncoder().encode("GIF89a")]],
+    [
+      "image/webp",
+      [0x52, 0x49, 0x46, 0x46, 0x00, 0x00, 0x00, 0x00, 0x57, 0x45, 0x42, 0x50],
+    ],
+    ["image/bmp", [0x42, 0x4d, 0x00, 0x00]],
+    ["image/x-icon", [0x00, 0x00, 0x01, 0x00]],
+  ];
+  it.each(cases)("detects %s from magic bytes", (expected, bytes) => {
+    expect(sniffImageMimeType(new Uint8Array(bytes))).toBe(expected);
+  });
+  it("detects AVIF via the ftyp brand", () => {
+    const bytes = new Uint8Array(16);
+    bytes.set([...new TextEncoder().encode("ftyp")], 4);
+    bytes.set([...new TextEncoder().encode("avif")], 8);
+    expect(sniffImageMimeType(bytes)).toBe("image/avif");
+  });
+  it("detects SVG from an <svg> root", () => {
+    const svg = new TextEncoder().encode(
+      '<?xml version="1.0"?>\n<svg xmlns="http://www.w3.org/2000/svg"></svg>',
+    );
+    expect(sniffImageMimeType(svg)).toBe("image/svg+xml");
+  });
+  it("returns null for non-image bytes (e.g. HTML)", () => {
+    const html = new TextEncoder().encode("<!doctype html><html></html>");
+    expect(sniffImageMimeType(html)).toBeNull();
+  });
+});

package/src/lib/__tests__/url-fetch.test.ts ADDED Viewed

@@ -0,0 +1,181 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { assertPublicHttpUrl, fetchImageBytes } from "../url-fetch.js";
+import { ValidationError } from "../errors.js";
+describe("assertPublicHttpUrl", () => {
+  it("accepts public http(s) URLs", () => {
+    expect(assertPublicHttpUrl("https://example.com/a.png").href).toBe(
+      "https://example.com/a.png",
+    );
+    expect(assertPublicHttpUrl("http://cdn.example.com/b.jpg").hostname).toBe(
+      "cdn.example.com",
+    );
+  });
+  it.each([
+    ["ftp scheme", "ftp://example.com/a.png"],
+    ["data scheme", "data:image/png;base64,AAAA"],
+    ["embedded credentials", "https://user:pass@example.com/a.png"],
+    ["localhost", "http://localhost/a.png"],
+    ["sub.localhost", "http://api.localhost/a.png"],
+    ["0.0.0.0", "http://0.0.0.0/a.png"],
+    ["loopback v4", "http://127.0.0.1/a.png"],
+    ["private 10/8", "http://10.0.0.5/a.png"],
+    ["private 172.16/12", "http://172.16.5.5/a.png"],
+    ["private 192.168/16", "http://192.168.1.1/a.png"],
+    ["CGNAT 100.64/10", "http://100.64.0.1/a.png"],
+    ["link-local / metadata", "http://169.254.169.254/latest/meta-data"],
+    ["loopback v6", "http://[::1]/a.png"],
+    ["link-local v6", "http://[fe80::1]/a.png"],
+    ["ULA v6", "http://[fd00::1]/a.png"],
+    ["v4-mapped private v6", "http://[::ffff:10.0.0.1]/a.png"],
+  ])("rejects %s", (_label, url) => {
+    expect(() => assertPublicHttpUrl(url)).toThrow(ValidationError);
+  });
+  it("rejects a non-URL string", () => {
+    expect(() => assertPublicHttpUrl("not a url")).toThrow(ValidationError);
+  });
+});
+describe("fetchImageBytes", () => {
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+  function pngBytes(length = 64): Uint8Array {
+    const bytes = new Uint8Array(length);
+    bytes.set([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
+    return bytes;
+  }
+  it("returns the bytes and content-type on success", async () => {
+    const bytes = pngBytes();
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(
+        async () =>
+          new Response(bytes, {
+            headers: { "content-type": "image/png" },
+          }),
+      ),
+    );
+    const result = await fetchImageBytes(new URL("https://example.com/a.png"), {
+      maxBytes: 1024,
+      timeoutMs: 5000,
+    });
+    expect(result.contentType).toBe("image/png");
+    expect(result.bytes.byteLength).toBe(bytes.byteLength);
+  });
+  it("sends a Referer matching the image origin (hotlink protection)", async () => {
+    const fetchMock = vi.fn(
+      async () =>
+        new Response(pngBytes(), { headers: { "content-type": "image/png" } }),
+    );
+    vi.stubGlobal("fetch", fetchMock);
+    await fetchImageBytes(
+      new URL("https://img9.doubanio.com/view/photo/p1.webp"),
+      { maxBytes: 1024, timeoutMs: 5000 },
+    );
+    const headers = fetchMock.mock.calls[0]?.[1]?.headers as
+      | Record<string, string>
+      | undefined;
+    expect(headers?.Referer).toBe("https://img9.doubanio.com/");
+  });
+  it("rejects via the Content-Length precheck", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(
+        async () =>
+          new Response(pngBytes(16), {
+            headers: {
+              "content-type": "image/png",
+              "content-length": "999999",
+            },
+          }),
+      ),
+    );
+    await expect(
+      fetchImageBytes(new URL("https://example.com/a.png"), {
+        maxBytes: 1024,
+        timeoutMs: 5000,
+      }),
+    ).rejects.toThrow(/too large/i);
+  });
+  it("aborts when the streamed body exceeds maxBytes (no Content-Length)", async () => {
+    const stream = new ReadableStream<Uint8Array>({
+      start(controller) {
+        controller.enqueue(new Uint8Array(2048));
+        controller.close();
+      },
+    });
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(
+        async () =>
+          new Response(stream, {
+            headers: { "content-type": "image/png" },
+          }),
+      ),
+    );
+    await expect(
+      fetchImageBytes(new URL("https://example.com/a.png"), {
+        maxBytes: 1024,
+        timeoutMs: 5000,
+      }),
+    ).rejects.toThrow(/too large/i);
+  });
+  it("re-validates redirect targets and rejects a hop to a private address", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(
+        async () =>
+          new Response(null, {
+            status: 302,
+            headers: { location: "http://169.254.169.254/" },
+          }),
+      ),
+    );
+    await expect(
+      fetchImageBytes(new URL("https://example.com/a.png"), {
+        maxBytes: 1024,
+        timeoutMs: 5000,
+      }),
+    ).rejects.toThrow(ValidationError);
+  });
+  it("follows a redirect to a public target", async () => {
+    const bytes = pngBytes();
+    const fetchMock = vi
+      .fn()
+      .mockResolvedValueOnce(
+        new Response(null, {
+          status: 302,
+          headers: { location: "https://cdn.example.com/final.png" },
+        }),
+      )
+      .mockResolvedValueOnce(
+        new Response(bytes, { headers: { "content-type": "image/png" } }),
+      );
+    vi.stubGlobal("fetch", fetchMock);
+    const result = await fetchImageBytes(new URL("https://example.com/a.png"), {
+      maxBytes: 1024,
+      timeoutMs: 5000,
+    });
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+    expect(result.bytes.byteLength).toBe(bytes.byteLength);
+  });
+});

package/src/lib/feed.ts CHANGED Viewed

@@ -187,9 +187,12 @@ function renderMediaItem(item: MediaView, postPermalinkUrl?: string): string {
         : "";
     // Prefix the caption with a ▶ glyph as a video cue. A CSS overlay would
     // be stripped by most feed-reader sanitizers, so a plain-text play
-    // character is the only marker that renders reliably everywhere.
-    const label = `▶ Watch video${meta ? ` · ${meta}` : ""}`;
-    return `<figure><a href="${url}"><img src="${escapeXml(poster)}" alt="${escapeXml(altText || name)}"${dims}/></a><figcaption>${escapeXml(label)}</figcaption></figure>`;
+    // character is the only marker that renders reliably everywhere. Link
+    // only the "Watch video" action label (so it's clickable like the
+    // thumbnail and reads cleanly to screen readers); metadata stays outside
+    // the link in parens, matching the audio/text/document attachment style.
+    const metaSuffix = meta ? ` (${escapeXml(meta)})` : "";
+    return `<figure><a href="${url}"><img src="${escapeXml(poster)}" alt="${escapeXml(altText || name)}"${dims}/></a><figcaption><a href="${url}">▶ Watch video</a>${metaSuffix}</figcaption></figure>`;
   }
   if (category === "audio") {

package/src/lib/upload.ts CHANGED Viewed

@@ -277,6 +277,117 @@ export function isImageMimeType(mimeType: string): boolean {
   return mimeType.startsWith("image/");
 }
+/** Image MIME types accepted by the remote-image sideload path. */
+const SIDELOAD_IMAGE_MIME_TYPES = new Set<string>(IMAGE_MIME_TYPES);
+/** Map of sideload-accepted image MIME types to their file extensions. */
+const IMAGE_MIME_EXTENSIONS: Record<string, string> = {
+  "image/jpeg": "jpg",
+  "image/png": "png",
+  "image/gif": "gif",
+  "image/webp": "webp",
+  "image/svg+xml": "svg",
+  "image/avif": "avif",
+  "image/bmp": "bmp",
+  "image/x-icon": "ico",
+};
+/**
+ * Whether a MIME type may be rehosted via remote-image sideload.
+ *
+ * Unlike {@link getStoredUploadPolicy} (which only allows webp/png/jpeg because
+ * the normal upload path re-encodes everything to WebP client-side), the
+ * sideload path stores the original remote bytes, so it accepts the full set of
+ * image formats Jant can display.
+ *
+ * @param contentType - The MIME type to check
+ * @returns Whether the type is an accepted sideload image
+ * @example
+ * ```ts
+ * isAllowedSideloadImageType("image/gif"); // true
+ * isAllowedSideloadImageType("text/html"); // false
+ * ```
+ */
+export function isAllowedSideloadImageType(contentType: string): boolean {
+  return SIDELOAD_IMAGE_MIME_TYPES.has(contentType);
+}
+/**
+ * Returns the file extension for a sideload-accepted image MIME type.
+ *
+ * @param contentType - The image MIME type
+ * @returns Extension without a dot, or null if the type isn't sideloadable
+ * @example
+ * ```ts
+ * imageExtensionForMimeType("image/jpeg"); // "jpg"
+ * ```
+ */
+export function imageExtensionForMimeType(contentType: string): string | null {
+  return IMAGE_MIME_EXTENSIONS[contentType] ?? null;
+}
+/**
+ * Identify an image format from its leading bytes (magic numbers), so a remote
+ * sideload can trust the actual content rather than the server's content-type
+ * header. Recognizes every {@link isAllowedSideloadImageType} format.
+ *
+ * @param bytes - The leading bytes of the file (≥ ~256 bytes recommended)
+ * @returns The detected image MIME type, or null if unrecognized
+ * @example
+ * ```ts
+ * sniffImageMimeType(pngBytes); // "image/png"
+ * ```
+ */
+export function sniffImageMimeType(bytes: Uint8Array): string | null {
+  if (
+    bytes.length >= 3 &&
+    bytes[0] === 0xff &&
+    bytes[1] === 0xd8 &&
+    bytes[2] === 0xff
+  ) {
+    return "image/jpeg";
+  }
+  if (
+    bytes.length >= 8 &&
+    bytes[0] === 0x89 &&
+    readAscii(bytes, 1, 3) === "PNG"
+  ) {
+    return "image/png";
+  }
+  if (bytes.length >= 6 && /^GIF8[79]a$/.test(readAscii(bytes, 0, 6))) {
+    return "image/gif";
+  }
+  if (
+    bytes.length >= 12 &&
+    readAscii(bytes, 0, 4) === "RIFF" &&
+    readAscii(bytes, 8, 4) === "WEBP"
+  ) {
+    return "image/webp";
+  }
+  if (bytes.length >= 12 && readAscii(bytes, 4, 4) === "ftyp") {
+    const brand = readAscii(bytes, 8, 4);
+    if (brand === "avif" || brand === "avis") return "image/avif";
+  }
+  if (bytes.length >= 2 && bytes[0] === 0x42 && bytes[1] === 0x4d) {
+    return "image/bmp";
+  }
+  if (
+    bytes.length >= 4 &&
+    bytes[0] === 0x00 &&
+    bytes[1] === 0x00 &&
+    bytes[2] === 0x01 &&
+    bytes[3] === 0x00
+  ) {
+    return "image/x-icon";
+  }
+  // SVG is text — look for an <svg> root in the leading bytes.
+  const head = new TextDecoder().decode(bytes.subarray(0, 1024)).toLowerCase();
+  if (head.includes("<svg")) {
+    return "image/svg+xml";
+  }
+  return null;
+}
 export interface ValidateUploadOptions {
   /** When true, only image MIME types are accepted (e.g. for avatar uploads). */
   imagesOnly?: boolean;

package/src/lib/url-fetch.ts ADDED Viewed

@@ -0,0 +1,263 @@
+/**
+ * Safe remote URL fetching for server-side image sideloading.
+ *
+ * When an author pastes an article from another site, its `<img>` tags point at
+ * remote URLs. To rehost those images into the site's own storage the server
+ * must fetch the bytes itself (a browser `fetch` of a third-party image is
+ * blocked by CORS for most hosts). Because the URL comes from pasted HTML it is
+ * attacker-influenced, so every fetch passes through an SSRF guard and a bounded
+ * reader that caps size and time.
+ *
+ * Note: DNS is not resolvable from a Cloudflare Worker, so the IP-literal checks
+ * here are defense-in-depth for self-hosted (Node) deployments and for URLs that
+ * embed a literal address. They are not a substitute for network-level egress
+ * controls.
+ */
+import { ValidationError } from "./errors.js";
+/** A browser-like UA — many CDNs serving article images block unknown bots. */
+const FETCH_USER_AGENT =
+  "Mozilla/5.0 (compatible; Jant image sideloader) AppleWebKit/537.36";
+export interface FetchedImage {
+  bytes: Uint8Array;
+  /** Lowercased content-type with parameters stripped, or null if absent. */
+  contentType: string | null;
+}
+export interface FetchImageBytesOptions {
+  /** Reject (and abort) once the body exceeds this many bytes. */
+  maxBytes: number;
+  /** Abort the whole request after this many milliseconds. */
+  timeoutMs: number;
+  /** Maximum redirect hops to follow (each re-validated). Default 3. */
+  maxRedirects?: number;
+}
+/**
+ * Validate that a string is a public http(s) URL safe to fetch server-side.
+ *
+ * Throws {@link ValidationError} for non-http(s) protocols, embedded
+ * credentials, localhost names, and private/loopback/link-local/ULA/CGNAT IP
+ * literals (including the `169.254.169.254` cloud-metadata address).
+ *
+ * @param raw - The candidate URL string
+ * @returns The parsed {@link URL}
+ * @example
+ * ```ts
+ * const url = assertPublicHttpUrl("https://example.com/photo.jpg");
+ * ```
+ */
+export function assertPublicHttpUrl(raw: string): URL {
+  let url: URL;
+  try {
+    url = new URL(raw);
+  } catch {
+    throw new ValidationError("That doesn't look like a valid image URL.");
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new ValidationError("Only http and https image URLs can be fetched.");
+  }
+  if (url.username || url.password) {
+    throw new ValidationError("Image URLs can't include credentials.");
+  }
+  const host = url.hostname.toLowerCase();
+  if (
+    host === "localhost" ||
+    host.endsWith(".localhost") ||
+    host === "0.0.0.0" ||
+    isPrivateIpv4(host) ||
+    isPrivateIpv6(host)
+  ) {
+    throw new ValidationError("That image URL points to a private address.");
+  }
+  return url;
+}
+/**
+ * Fetch a remote image with an SSRF-checked redirect chain, a size cap, and a
+ * timeout. Reads the body in chunks and aborts the moment it exceeds `maxBytes`
+ * so an untrusted host can't exhaust memory.
+ *
+ * @param startUrl - A URL already validated by {@link assertPublicHttpUrl}
+ * @param options - Size cap, timeout, and redirect budget
+ * @returns The raw bytes and the response content-type
+ * @example
+ * ```ts
+ * const { bytes, contentType } = await fetchImageBytes(url, {
+ *   maxBytes: 25 * 1024 * 1024,
+ *   timeoutMs: 15000,
+ * });
+ * ```
+ */
+export async function fetchImageBytes(
+  startUrl: URL,
+  options: FetchImageBytesOptions,
+): Promise<FetchedImage> {
+  const maxRedirects = options.maxRedirects ?? 3;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), options.timeoutMs);
+  try {
+    let url = startUrl;
+    let response: Response | null = null;
+    for (let hop = 0; hop <= maxRedirects; hop++) {
+      response = await fetch(url.toString(), {
+        method: "GET",
+        redirect: "manual",
+        signal: controller.signal,
+        headers: {
+          Accept: "image/*,*/*;q=0.8",
+          "User-Agent": FETCH_USER_AGENT,
+          // Many CDNs (Douban, WeChat, etc.) reject hotlinked image requests
+          // that lack a Referer. Sending the image's own origin satisfies the
+          // common "referer must be same-site" hotlink check.
+          Referer: `${url.origin}/`,
+        },
+      }).catch((error) => {
+        if (controller.signal.aborted) {
+          throw new ValidationError("Timed out fetching the image.");
+        }
+        throw new ValidationError(
+          error instanceof Error
+            ? `Couldn't fetch the image: ${error.message}`
+            : "Couldn't fetch the image.",
+        );
+      });
+      if (response.status >= 300 && response.status < 400) {
+        const location = response.headers.get("location");
+        if (!location) break; // No target — fall through to the (failing) checks.
+        if (hop === maxRedirects) {
+          throw new ValidationError("Too many redirects fetching the image.");
+        }
+        // Re-validate every hop so a redirect can't escape the SSRF guard.
+        url = assertPublicHttpUrl(new URL(location, url).toString());
+        continue;
+      }
+      break;
+    }
+    if (!response) {
+      throw new ValidationError("Couldn't fetch the image.");
+    }
+    if (!response.ok) {
+      throw new ValidationError(
+        `Couldn't fetch the image (HTTP ${response.status}).`,
+      );
+    }
+    const declared = Number(response.headers.get("content-length"));
+    if (Number.isFinite(declared) && declared > options.maxBytes) {
+      throw new ValidationError("That image is too large.");
+    }
+    const contentType = normalizeContentType(
+      response.headers.get("content-type"),
+    );
+    const bytes = await readBounded(response, options.maxBytes);
+    return { bytes, contentType };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function readBounded(
+  response: Response,
+  maxBytes: number,
+): Promise<Uint8Array> {
+  const body = response.body;
+  if (!body) {
+    const buffer = new Uint8Array(await response.arrayBuffer());
+    if (buffer.byteLength > maxBytes) {
+      throw new ValidationError("That image is too large.");
+    }
+    return buffer;
+  }
+  const reader = body.getReader();
+  const chunks: Uint8Array[] = [];
+  let total = 0;
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    if (!value) continue;
+    total += value.byteLength;
+    if (total > maxBytes) {
+      await reader.cancel().catch(() => {});
+      throw new ValidationError("That image is too large.");
+    }
+    chunks.push(value);
+  }
+  const out = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    out.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return out;
+}
+function normalizeContentType(raw: string | null): string | null {
+  if (!raw) return null;
+  const type = raw.split(";")[0]?.trim().toLowerCase();
+  return type || null;
+}
+/**
+ * True when a canonicalized IPv4 dotted-quad host is in a private, loopback,
+ * link-local, CGNAT, or otherwise non-public range. The WHATWG URL parser
+ * already normalizes decimal/octal/hex IPv4 forms to dotted-quad, so checking
+ * `url.hostname` is sufficient.
+ */
+function isPrivateIpv4(host: string): boolean {
+  const match = host.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+  if (!match) return false;
+  const octets = match.slice(1, 5).map(Number);
+  if (octets.some((part) => part > 255)) return true; // Malformed → unsafe.
+  const a = octets[0] ?? 0;
+  const b = octets[1] ?? 0;
+  if (a === 0) return true; // 0.0.0.0/8 "this" network
+  if (a === 10) return true; // 10/8 private
+  if (a === 127) return true; // 127/8 loopback
+  if (a === 169 && b === 254) return true; // 169.254/16 link-local (metadata)
+  if (a === 172 && b >= 16 && b <= 31) return true; // 172.16/12 private
+  if (a === 192 && b === 168) return true; // 192.168/16 private
+  if (a === 100 && b >= 64 && b <= 127) return true; // 100.64/10 CGNAT
+  if (a === 255 && b === 255) return true; // broadcast
+  return false;
+}
+/** True when an IPv6 host (bracketed or bare) is loopback/link-local/ULA/mapped-private. */
+function isPrivateIpv6(host: string): boolean {
+  let inner = host;
+  if (inner.startsWith("[") && inner.endsWith("]")) {
+    inner = inner.slice(1, -1);
+  }
+  if (!inner.includes(":")) return false;
+  const lower = inner.toLowerCase();
+  if (lower === "::" || lower === "::1") return true; // unspecified / loopback
+  // IPv4-mapped, dotted form (::ffff:1.2.3.4).
+  const dotted = lower.match(/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
+  if (dotted?.[1]) return isPrivateIpv4(dotted[1]);
+  // IPv4-mapped, hex form (::ffff:a00:1) — what the URL parser normalizes to.
+  const hex = lower.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+  if (hex) {
+    const hi = parseInt(hex[1] ?? "0", 16);
+    const lo = parseInt(hex[2] ?? "0", 16);
+    const v4 = `${(hi >> 8) & 0xff}.${hi & 0xff}.${(lo >> 8) & 0xff}.${lo & 0xff}`;
+    return isPrivateIpv4(v4);
+  }
+  if (/^fe[89ab]/.test(lower)) return true; // fe80::/10 link-local
+  if (/^f[cd]/.test(lower)) return true; // fc00::/7 unique local
+  return false;
+}