@kehto/paja 0.16.1 → 0.16.2

package/README.md

@@ -308,7 +308,9 @@ Paja's developer-runtime policy accepts arbitrary `http:` and `https:` resource
 URLs so a normal remote image does not look broken merely because its origin was
 not pre-granted. Paja resolves those URLs with browser `fetch`, omits credentials
 and referrer data, caps responses at 10 MiB, and classifies MIME from returned
-bytes. Browser network and CORS rules still apply: an unreadable response is the
+bytes. Its byte classifier recognizes checksum-valid Game Boy ROM headers as
+`application/vnd.nintendo.gb-rom`; it never trusts a server-supplied media type.
+Browser network and CORS rules still apply: an unreadable response is the
 canonical `network-error`, while any CORS-readable response is returned as NAP
 bytes.
 

package/dist/browser-host.js

@@ -16869,6 +16869,56 @@ var PAJA_RESOURCE_MAX_URLS = 100;
 var PAJA_RESOURCE_MAX_SERVERS = 8;
 var UTF8_DECODER = new TextDecoder("utf-8", { fatal: true });
 var BLOSSOM_RESOURCE_PATTERN = /^blossom:sha256:([0-9a-f]{64})$/i;
+var GAME_BOY_NINTENDO_LOGO = [
+  206,
+  237,
+  102,
+  102,
+  204,
+  13,
+  0,
+  11,
+  3,
+  115,
+  0,
+  131,
+  0,
+  12,
+  0,
+  13,
+  0,
+  8,
+  17,
+  31,
+  136,
+  137,
+  0,
+  14,
+  220,
+  204,
+  110,
+  230,
+  221,
+  221,
+  217,
+  153,
+  187,
+  187,
+  103,
+  99,
+  110,
+  14,
+  236,
+  204,
+  221,
+  220,
+  153,
+  159,
+  187,
+  185,
+  51,
+  62
+];
 function createPajaResourceFetch(options = {}) {
   return async (value, init) => {
     if (init.signal.aborted) throw new DOMException("Resource request cancelled", "AbortError");
@@ -17127,8 +17177,17 @@ function sniffSafeResourceMime(bytes) {
   if (ascii(bytes, 4, 8) === "ftyp") return "video/mp4";
   if (ascii(bytes, 0, 4) === "wOFF") return "font/woff";
   if (ascii(bytes, 0, 4) === "wOF2") return "font/woff2";
+  if (isGameBoyRom(bytes)) return "application/vnd.nintendo.gb-rom";
   return sniffSafeTextMime(bytes);
 }
+function isGameBoyRom(bytes) {
+  if (bytes.byteLength < 336 || !startsWith(bytes, GAME_BOY_NINTENDO_LOGO, 260)) return false;
+  let checksum = 0;
+  for (let index = 308; index <= 332; index += 1) {
+    checksum = checksum - (bytes[index] ?? 0) - 1 & 255;
+  }
+  return checksum === bytes[333];
+}
 function sniffSafeTextMime(bytes) {
   let text;
   try {