@ouraihub/aether-core 0.1.0 → 0.1.2

package/src/images/index.ts

@@ -1,19 +1,38 @@
-import type { ImagePart, KitErrorCode, Details } from '@ouraihub/aether-contracts'
+import type { ImagePart, KitErrorCode, Details, TokenUsage } from '@ouraihub/aether-contracts'
 import { badRequest, KitFailure } from '../error.js'
 import type { OutboundHttp } from '../ports.js'
 import type { Connection } from '../types.js'
+import { emptyUsage } from '../pricing.js'
+import { validateImageBytes } from './validation.js'
+export { validateImageBytes } from './validation.js'
 
 export const MAX_IMAGE_BYTES = 4 * 1024 * 1024
 export const MAX_EDIT_IMAGES = 4
 export const IMAGE_MIMES = ['image/png', 'image/jpeg', 'image/webp', 'image/gif'] as const
 export const IMAGE_SIZES = ['1024x1024', '1024x1536', '1536x1024'] as const
 export const IMAGE_TIMEOUT_MS = 120_000
-const RESPONSE_BYTES = Math.ceil(MAX_IMAGE_BYTES / 3) * 4 + 64 * 1024
+export const MAX_GENERATED_IMAGE_BYTES = 10 * 1024 * 1024
+export const MAX_IMAGE_INPUT_BYTES = 20 * 1024 * 1024
+export type ImageProfile = 'generic' | 'gpt-image' | 'siliconflow'
+export type ImageQuality = 'low' | 'medium' | 'high'
+export interface ImageLimits {
+  readonly maxImageBytes?: number
+  readonly timeoutMs?: number
+  readonly profile?: ImageProfile
+}
+export interface ImageGeneration {
+  readonly image: ImagePart
+  readonly revisedPrompt: string | null
+  readonly usage: TokenUsage
+  readonly totalTokens: number | null
+}
 export type ImageSize = (typeof IMAGE_SIZES)[number]
 export interface ImageRequest {
   readonly prompt: string
   readonly size: ImageSize
   readonly images: readonly ImagePart[]
+  readonly quality?: ImageQuality
+  readonly mask?: ImagePart
 }
 export type ImageConnection = Pick<
   Connection,
@@ -55,7 +74,7 @@ export function checkImages(images: unknown): asserts images is ImagePart[] {
   for (const image of images) parseImage(image)
 }
 
-export function decodeImage(image: ImagePart): Uint8Array<ArrayBuffer> {
+export function decodeImage(image: ImagePart, maxBytes = MAX_IMAGE_BYTES): Uint8Array<ArrayBuffer> {
   if (
     !record(image) ||
     Object.keys(image).some((key) => key !== 'mime' && key !== 'data') ||
@@ -65,8 +84,9 @@ export function decodeImage(image: ImagePart): Uint8Array<ArrayBuffer> {
     throw badRequest('images', 'encoding')
   if (!IMAGE_MIMES.some((mime) => mime === image.mime)) throw badRequest('images', 'mime')
   const data = image.data
-  if (data.length > Math.ceil(MAX_IMAGE_BYTES / 3) * 4) throw badRequest('images', 'size', MAX_IMAGE_BYTES)
-  if (data.length % 4 !== 0 || !/^[A-Za-z0-9+/]*={0,2}$/u.test(data)) throw badRequest('images', 'encoding')
+  if (data.length > Math.ceil(maxBytes / 3) * 4) throw badRequest('images', 'size', maxBytes)
+  if (data.length % 4 !== 0 || !/^[A-Za-z0-9+/]*={0,2}$/u.test(data))
+    throw badRequest('images', 'encoding')
   let binary: string
   try {
     binary = atob(data)
@@ -75,7 +95,7 @@ export function decodeImage(image: ImagePart): Uint8Array<ArrayBuffer> {
   }
   // atob accepts noncanonical padding bits; standard base64 does not.
   if (btoa(binary) !== data) throw badRequest('images', 'encoding')
-  if (binary.length > MAX_IMAGE_BYTES) throw badRequest('images', 'size', MAX_IMAGE_BYTES)
+  if (binary.length > maxBytes) throw badRequest('images', 'size', maxBytes)
   return Uint8Array.from(binary, (character) => character.charCodeAt(0))
 }
 
@@ -86,15 +106,6 @@ export function encodeImage(bytes: Uint8Array): string {
   return btoa(binary)
 }
 
-function imageMime(bytes: Uint8Array): string {
-  if (bytes[0] === 0x89 && bytes[1] === 0x50 && bytes[2] === 0x4e && bytes[3] === 0x47) return 'image/png'
-  if (bytes[0] === 0xff && bytes[1] === 0xd8) return 'image/jpeg'
-  const signature = (start: number, end: number): string => String.fromCharCode(...bytes.subarray(start, end))
-  if (signature(0, 4) === 'RIFF' && signature(8, 12) === 'WEBP') return 'image/webp'
-  if (signature(0, 6) === 'GIF87a' || signature(0, 6) === 'GIF89a') return 'image/gif'
-  throw badRequest('images', 'mime')
-}
-
 function interrupted(signal: AbortSignal): KitFailure {
   return signal.reason instanceof DOMException && signal.reason.name === 'TimeoutError'
     ? new KitFailure('timeout', 'Image request deadline exceeded')
@@ -113,7 +124,11 @@ function abortable<T>(pending: Promise<T>, signal: AbortSignal): Promise<T> {
   return promise
 }
 
-async function bounded(response: Response, limit: number, signal: AbortSignal): Promise<Uint8Array> {
+async function bounded(
+  response: Response,
+  limit: number,
+  signal: AbortSignal,
+): Promise<Uint8Array> {
   const length = response.headers.get('content-length')
   if (length !== null && (!/^\d+$/u.test(length) || Number(length) > limit)) {
     void response.body?.cancel().catch(() => {})
@@ -155,7 +170,13 @@ function endpoint(base: string, edit: boolean): string {
   } catch {
     throw badRequest('url', 'invalid')
   }
-  if (!['https:', 'http:'].includes(url.protocol) || url.username || url.password || url.search || url.hash)
+  if (
+    !['https:', 'http:'].includes(url.protocol) ||
+    url.username ||
+    url.password ||
+    url.search ||
+    url.hash
+  )
     throw badRequest('url', 'invalid')
   return url.href
 }
@@ -172,6 +193,28 @@ function downloadTarget(value: string): string {
   return url.href
 }
 
+/** Only known profiles enable provider-specific options; callers may explicitly select one. */
+export function imageCapabilities(connection: ImageConnection, limits: ImageLimits = {}) {
+  const host = new URL(endpoint(connection.imageBaseUrl ?? connection.baseUrl, false)).hostname
+  const profile =
+    limits.profile ??
+    (['api.siliconflow.cn', 'api.siliconflow.com'].includes(host)
+      ? 'siliconflow'
+      : ['gpt-image-1', 'gpt-image-1-mini', 'gpt-image-1.5', 'gpt-image-2'].includes(
+            connection.modelId,
+          )
+        ? 'gpt-image'
+        : 'generic')
+  if (!['generic', 'gpt-image', 'siliconflow'].includes(profile))
+    throw badRequest('profile', 'invalid')
+  return {
+    profile,
+    edit: connection.canVision && profile !== 'siliconflow',
+    quality: profile === 'gpt-image',
+    mask: profile === 'gpt-image',
+  }
+}
+
 /**
  * One independent generation/edit. OutboundHttp MUST enforce host address policy
  * for BOTH endpoint and returned download URLs, including DNS, and reject redirects.
@@ -182,26 +225,73 @@ export async function generateImage(
   connection: ImageConnection,
   input: ImageRequest,
   signal: AbortSignal,
-): Promise<ImagePart> {
+  limits: ImageLimits = {},
+): Promise<ImageGeneration> {
   let dispatch: ImageDispatch = 'not_dispatched'
   const controller = new AbortController()
   const cancel = (): void => controller.abort(signal.reason)
   signal.addEventListener('abort', cancel, { once: true })
   if (signal.aborted) cancel()
-  const timer = setTimeout(
-    () => controller.abort(new DOMException('Image request deadline exceeded', 'TimeoutError')),
-    IMAGE_TIMEOUT_MS,
-  )
+  const timeoutMs = limits.timeoutMs ?? IMAGE_TIMEOUT_MS
+  const maxImageBytes = limits.maxImageBytes ?? MAX_IMAGE_BYTES
+  const validLimits =
+    Number.isSafeInteger(timeoutMs) &&
+    timeoutMs > 0 &&
+    timeoutMs <= 180_000 &&
+    Number.isSafeInteger(maxImageBytes) &&
+    maxImageBytes > 0 &&
+    maxImageBytes <= MAX_GENERATED_IMAGE_BYTES
+  const timer = validLimits
+    ? setTimeout(
+        () => controller.abort(new DOMException('Image request deadline exceeded', 'TimeoutError')),
+        timeoutMs,
+      )
+    : undefined
   const active = controller.signal
   try {
     if (active.aborted) throw interrupted(active)
+    if (!validLimits) throw badRequest('limits', 'invalid')
     const prompt = input.prompt.trim()
     if (!prompt || [...prompt].length > 4000) throw badRequest('prompt', 'invalid')
     if (!IMAGE_SIZES.some((size) => size === input.size)) throw badRequest('size', 'invalid')
     if (input.images.length > MAX_EDIT_IMAGES) throw badRequest('images', 'count', MAX_EDIT_IMAGES)
     const edit = input.images.length > 0
-    if (edit && !connection.canVision) throw new KitFailure('unsupported', 'Image editing unsupported')
-    const target = endpoint((edit ? connection.imageEditBaseUrl : connection.imageBaseUrl) ?? connection.baseUrl, edit)
+    const capabilities = imageCapabilities(connection, limits)
+    if (edit && !capabilities.edit) throw new KitFailure('unsupported', 'Image editing unsupported')
+    if (input.quality !== undefined) {
+      if (!['low', 'medium', 'high'].includes(input.quality)) throw badRequest('quality', 'invalid')
+      if (!capabilities.quality) throw new KitFailure('unsupported', 'Image quality unsupported')
+    }
+    if (input.mask !== undefined && (!edit || !capabilities.mask))
+      throw new KitFailure('unsupported', 'Image mask unsupported')
+    let inputBytes = 0
+    const decoded = input.images.map((image) => {
+      const bytes = decodeImage(image, maxImageBytes)
+      validateImageBytes(bytes, image.mime, maxImageBytes)
+      inputBytes += bytes.length
+      return bytes
+    })
+    const maskBytes = input.mask === undefined ? undefined : decodeImage(input.mask, maxImageBytes)
+    if (maskBytes && input.mask) {
+      const mask = validateImageBytes(maskBytes, 'image/png', maxImageBytes)
+      const firstBytes = decoded[0]
+      if (firstBytes === undefined) throw badRequest('mask', 'requires_image')
+      const first = validateImageBytes(firstBytes, undefined, maxImageBytes)
+      if (
+        input.mask.mime !== 'image/png' ||
+        !mask.alpha ||
+        mask.width !== first.width ||
+        mask.height !== first.height
+      )
+        throw badRequest('mask', 'invalid')
+      inputBytes += maskBytes.length
+    }
+    if (inputBytes > MAX_IMAGE_INPUT_BYTES)
+      throw badRequest('images', 'size', MAX_IMAGE_INPUT_BYTES)
+    const target = endpoint(
+      (edit ? connection.imageEditBaseUrl : connection.imageBaseUrl) ?? connection.baseUrl,
+      edit,
+    )
     let payload: BodyInit
     if (edit) {
       const form = new FormData()
@@ -209,9 +299,16 @@ export async function generateImage(
       form.set('prompt', prompt)
       form.set('size', input.size)
       form.set('n', '1')
+      if (capabilities.profile === 'gpt-image') {
+        form.set('output_format', 'png')
+        form.set('background', 'opaque')
+      }
+      if (input.quality !== undefined) form.set('quality', input.quality)
+      if (maskBytes) form.set('mask', new Blob([maskBytes], { type: 'image/png' }), 'mask.png')
       for (const [index, raw] of input.images.entries()) {
         const image = raw
-        const bytes = decodeImage(image)
+        const bytes = decoded[index]
+        if (bytes === undefined) throw badRequest('images', 'encoding')
         const extension = image.mime === 'image/jpeg' ? 'jpg' : image.mime.slice(6)
         form.append(
           input.images.length === 1 ? 'image' : 'image[]',
@@ -221,7 +318,20 @@ export async function generateImage(
       }
       payload = form
     } else {
-      payload = JSON.stringify({ model: connection.modelId, prompt, size: input.size, n: 1 })
+      payload = JSON.stringify(
+        capabilities.profile === 'siliconflow'
+          ? { model: connection.modelId, prompt, image_size: input.size }
+          : {
+              model: connection.modelId,
+              prompt,
+              size: input.size,
+              n: 1,
+              ...(capabilities.profile === 'gpt-image'
+                ? { output_format: 'png', background: 'opaque' }
+                : {}),
+              ...(input.quality === undefined ? {} : { quality: input.quality }),
+            },
+      )
     }
     const baseHeaders = new Headers(connection.headers)
     // Never allow a custom JSON header to break the platform multipart boundary.
@@ -235,19 +345,35 @@ export async function generateImage(
       if (key !== undefined) headers.set('authorization', `Bearer ${key}`)
       dispatch = 'unknown'
       const response = await abortable(
-        http.fetch(target, { method: 'POST', headers, body: payload, redirect: 'manual', signal: active }),
+        http.fetch(target, {
+          method: 'POST',
+          headers,
+          body: payload,
+          redirect: 'manual',
+          signal: active,
+        }),
         active,
       )
       if (response.redirected || (response.status >= 300 && response.status < 400)) {
         void response.body?.cancel().catch(() => {})
         throw new KitFailure('upstream', 'Image redirect refused', { status: response.status })
       }
-      if (!response.ok) dispatch = 'rejected'
-      const bytes = await bounded(response, response.ok ? RESPONSE_BYTES : 8192, active)
+      if (response.status >= 400 && response.status < 500) dispatch = 'rejected'
+      const bytes = await bounded(
+        response,
+        response.ok ? Math.ceil(maxImageBytes / 3) * 4 + 64 * 1024 : 8192,
+        active,
+      )
       if (!response.ok) {
         if ([401, 403, 429].includes(response.status) && attempt + 1 < attempts) continue
         // Deliberately never surface provider bodies: they can contain credentials.
-        throw new KitFailure('upstream', 'Image provider rejected request', { status: response.status })
+        const code =
+          response.status === 401 || response.status === 403
+            ? 'unauthorized'
+            : response.status === 429
+              ? 'rate_limited'
+              : 'upstream'
+        throw new KitFailure(code, 'Image provider rejected request', { status: response.status })
       }
       let body: unknown
       try {
@@ -255,14 +381,30 @@ export async function generateImage(
       } catch {
         throw new KitFailure('upstream', 'Invalid image response')
       }
-      const first: unknown = record(body) && Array.isArray(body.data) ? body.data[0] : undefined
-      if (!record(first)) throw new KitFailure('upstream', 'No image in response')
+      const images: unknown = record(body)
+        ? capabilities.profile === 'siliconflow'
+          ? body.images
+          : body.data
+        : undefined
+      if (!Array.isArray(images) || images.length !== 1)
+        throw new KitFailure('upstream', 'Expected exactly one image')
+      const first: unknown = images[0]
+      if (
+        !record(first) ||
+        (typeof first.b64_json === 'string') === (typeof first.url === 'string')
+      )
+        throw new KitFailure('upstream', 'Invalid image response')
       let imageBytes: Uint8Array
+      let expectedMime: string | undefined
       if (typeof first.b64_json === 'string') {
-        imageBytes = decodeImage({ mime: 'image/png', data: first.b64_json })
+        imageBytes = decodeImage({ mime: 'image/png', data: first.b64_json }, maxImageBytes)
       } else if (typeof first.url === 'string') {
         const image = await abortable(
-          http.fetch(downloadTarget(first.url), { method: 'GET', redirect: 'manual', signal: active }),
+          http.fetch(downloadTarget(first.url), {
+            method: 'GET',
+            redirect: 'manual',
+            signal: active,
+          }),
           active,
         )
         if (image.redirected || !image.ok) {
@@ -270,14 +412,45 @@ export async function generateImage(
           throw new KitFailure('upstream', 'Image download failed', { status: image.status })
         }
         const mime = image.headers.get('content-type')?.split(';')[0]?.trim().toLowerCase()
-        if (mime !== undefined && !IMAGE_MIMES.some((allowed) => allowed === mime)) {
+        if (
+          mime &&
+          mime !== 'application/octet-stream' &&
+          !IMAGE_MIMES.some((allowed) => allowed === mime)
+        ) {
           void image.body?.cancel().catch(() => {})
           throw badRequest('images', 'mime')
         }
-        imageBytes = await bounded(image, MAX_IMAGE_BYTES, active)
-        if (mime !== undefined && imageMime(imageBytes) !== mime) throw badRequest('images', 'mime')
+        imageBytes = await bounded(image, maxImageBytes, active)
+        expectedMime = mime && mime !== 'application/octet-stream' ? mime : undefined
       } else throw new KitFailure('upstream', 'No image in response')
-      return { mime: imageMime(imageBytes), data: encodeImage(imageBytes) }
+      const checked = validateImageBytes(imageBytes, expectedMime, maxImageBytes)
+      const usage = emptyUsage()
+      let totalTokens: number | null = null
+      if (record(body) && record(body.usage)) {
+        const count = (value: unknown): number | null =>
+          typeof value === 'number' && Number.isSafeInteger(value) && value >= 0 ? value : null
+        totalTokens = count(body.usage.total_tokens)
+        usage.inputTokens = count(body.usage.input_tokens ?? body.usage.prompt_tokens)
+        usage.outputTokens = count(body.usage.output_tokens ?? body.usage.completion_tokens)
+        const inputDetails = body.usage.input_tokens_details ?? body.usage.prompt_tokens_details
+        const outputDetails =
+          body.usage.output_tokens_details ?? body.usage.completion_tokens_details
+        if (record(inputDetails)) {
+          usage.cacheReadTokens = count(inputDetails.cached_tokens)
+          usage.cacheWriteTokens = count(
+            inputDetails.cache_creation_tokens ?? body.usage.cache_creation_input_tokens,
+          )
+        }
+        if (!record(inputDetails))
+          usage.cacheWriteTokens = count(body.usage.cache_creation_input_tokens)
+        if (record(outputDetails)) usage.reasoningTokens = count(outputDetails.reasoning_tokens)
+      }
+      return {
+        image: { mime: checked.mime, data: encodeImage(imageBytes) },
+        revisedPrompt: typeof first.revised_prompt === 'string' ? first.revised_prompt : null,
+        usage,
+        totalTokens,
+      }
     }
     throw new KitFailure('internal', 'Image request has no attempts')
   } catch (error: unknown) {
@@ -288,7 +461,7 @@ export async function generateImage(
         : new KitFailure('network', 'Image provider unreachable')
     throw new ImageFailure(failure.code, failure.message, dispatch, failure.details)
   } finally {
-    clearTimeout(timer)
+    clearTimeout(timer ?? 0)
     signal.removeEventListener('abort', cancel)
   }
 }

package/src/images/validation.ts

@@ -0,0 +1,276 @@
+import { badRequest } from '../error.js'
+
+const invalid = (): never => {
+  throw badRequest('images', 'encoding')
+}
+
+/** Structural image validation shared by independent generation and host storage adapters. */
+export function validateImageBytes(
+  bytes: Uint8Array,
+  expectedMime?: string,
+  maxBytes = 4 * 1024 * 1024,
+): { mime: string; width: number; height: number; alpha: boolean } {
+  if (!bytes.length) return invalid()
+  if (bytes.length > maxBytes) throw badRequest('images', 'size', maxBytes)
+  const signature = (start: number, end: number): string =>
+    String.fromCharCode(...bytes.subarray(start, end))
+  const mime =
+    bytes[0] === 137 && signature(1, 4) === 'PNG'
+      ? 'image/png'
+      : bytes[0] === 255 && bytes[1] === 216
+        ? 'image/jpeg'
+        : signature(0, 4) === 'RIFF' && signature(8, 12) === 'WEBP'
+          ? 'image/webp'
+          : ['GIF87a', 'GIF89a'].includes(signature(0, 6))
+            ? 'image/gif'
+            : undefined
+  if (!mime || (expectedMime !== undefined && expectedMime !== mime))
+    throw badRequest('images', 'mime')
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength)
+  const tag = (offset: number, text: string): boolean => {
+    for (let index = 0; index < text.length; index++)
+      if (bytes[offset + index] !== text.charCodeAt(index)) return false
+    return true
+  }
+  let width = 0,
+    height = 0,
+    alpha = false
+  if (mime === 'image/png') {
+    if (bytes.length < 57 || ![137, 80, 78, 71, 13, 10, 26, 10].every((v, i) => bytes[i] === v))
+      return invalid()
+    let offset = 8,
+      first = true,
+      data = false,
+      end = false
+    while (offset + 12 <= bytes.length) {
+      const size = view.getUint32(offset)
+      if (size > bytes.length - offset - 12) return invalid()
+      const kind = offset + 4
+      if (first) {
+        if (!tag(kind, 'IHDR') || size !== 13) return invalid()
+        width = view.getUint32(offset + 8)
+        height = view.getUint32(offset + 12)
+        const depth = bytes[offset + 16],
+          color = bytes[offset + 17]
+        if (
+          depth === undefined ||
+          color === undefined ||
+          ![0, 2, 3, 4, 6].includes(color) ||
+          !(color === 0 ? [1, 2, 4, 8, 16] : color === 3 ? [1, 2, 4, 8] : [8, 16]).includes(
+            depth,
+          ) ||
+          bytes[offset + 18] !== 0 ||
+          bytes[offset + 19] !== 0 ||
+          ![0, 1].includes(bytes[offset + 20] ?? -1)
+        )
+          return invalid()
+        alpha = color === 4 || color === 6
+        first = false
+      } else if (tag(kind, 'IHDR')) return invalid()
+      if (tag(kind, 'tRNS')) alpha = true
+      if (tag(kind, 'IDAT') && size > 0) data = true
+      offset += size + 12
+      if (tag(kind, 'IEND')) {
+        if (size !== 0 || offset !== bytes.length) return invalid()
+        end = true
+        break
+      }
+    }
+    if (!data || !end) return invalid()
+  } else if (mime === 'image/jpeg') {
+    if (bytes.length < 12 || bytes[0] !== 255 || bytes[1] !== 216) return invalid()
+    let offset = 2,
+      scan = false,
+      end = false
+    while (offset < bytes.length) {
+      if (bytes[offset++] !== 255) return invalid()
+      while (bytes[offset] === 255) offset++
+      const marker = bytes[offset++]
+      if (marker === 217) {
+        end = offset === bytes.length
+        break
+      }
+      if (marker === undefined || marker === 0 || marker === 216 || offset + 2 > bytes.length)
+        return invalid()
+      if (marker >= 208 && marker <= 215) continue
+      const size = view.getUint16(offset)
+      if (size < 2 || offset + size > bytes.length) return invalid()
+      if ([192, 193, 194, 195, 197, 198, 199, 201, 202, 203, 205, 206, 207].includes(marker)) {
+        if (size < 8 || width !== 0) return invalid()
+        height = view.getUint16(offset + 3)
+        width = view.getUint16(offset + 5)
+      }
+      offset += size
+      if (marker === 218) {
+        scan = true
+        while (offset < bytes.length) {
+          if (bytes[offset] !== 255) {
+            offset++
+            continue
+          }
+          if (
+            bytes[offset + 1] === 0 ||
+            ((bytes[offset + 1] ?? 0) >= 208 && (bytes[offset + 1] ?? 0) <= 215)
+          ) {
+            offset += 2
+            continue
+          }
+          break
+        }
+      }
+    }
+    if (!scan || !end) return invalid()
+  } else if (mime === 'image/webp') {
+    if (
+      bytes.length < 26 ||
+      !tag(0, 'RIFF') ||
+      !tag(8, 'WEBP') ||
+      view.getUint32(4, true) + 8 !== bytes.length
+    )
+      return invalid()
+    let offset = 12,
+      image = false,
+      extended = false,
+      animated = false,
+      animationHeader = false
+    while (offset + 8 <= bytes.length) {
+      const size = view.getUint32(offset + 4, true),
+        body = offset + 8
+      if (size > bytes.length - body) return invalid()
+      if (tag(offset, 'VP8X')) {
+        if (offset !== 12 || size !== 10) return invalid()
+        extended = true
+        alpha = ((bytes[body] ?? 0) & 16) !== 0
+        animated = ((bytes[body] ?? 0) & 2) !== 0
+        width =
+          1 +
+          (bytes[body + 4] ?? 0) +
+          ((bytes[body + 5] ?? 0) << 8) +
+          ((bytes[body + 6] ?? 0) << 16)
+        height =
+          1 +
+          (bytes[body + 7] ?? 0) +
+          ((bytes[body + 8] ?? 0) << 8) +
+          ((bytes[body + 9] ?? 0) << 16)
+      } else if (tag(offset, 'ANIM')) {
+        if (!animated || size !== 6 || animationHeader) return invalid()
+        animationHeader = true
+      } else if (tag(offset, 'ANMF')) {
+        if (!animated || !animationHeader || size < 24) return invalid()
+        const u24 = (at: number): number =>
+          (bytes[at] ?? 0) + ((bytes[at + 1] ?? 0) << 8) + ((bytes[at + 2] ?? 0) << 16)
+        const x = u24(body) * 2,
+          y = u24(body + 3) * 2,
+          w = u24(body + 6) + 1,
+          h = u24(body + 9) + 1
+        if (x + w > width || y + h > height || ((bytes[body + 15] ?? 0) & 252) !== 0)
+          return invalid()
+        let frame = body + 16,
+          pixels = false
+        while (frame + 8 <= body + size) {
+          const length = view.getUint32(frame + 4, true),
+            data = frame + 8
+          if (data + length > body + size) return invalid()
+          if (tag(frame, 'VP8 ')) {
+            if (
+              pixels ||
+              length < 10 ||
+              ((bytes[data] ?? 1) & 1) !== 0 ||
+              !tag(data + 3, '\u009d\u0001\u002a') ||
+              (view.getUint16(data + 6, true) & 16383) !== w ||
+              (view.getUint16(data + 8, true) & 16383) !== h
+            )
+              return invalid()
+            pixels = true
+          } else if (tag(frame, 'VP8L')) {
+            if (pixels || length < 5 || bytes[data] !== 47) return invalid()
+            const bits = view.getUint32(data + 1, true)
+            if (bits >>> 29 !== 0 || (bits & 16383) + 1 !== w || ((bits >>> 14) & 16383) + 1 !== h)
+              return invalid()
+            alpha ||= ((bits >>> 28) & 1) !== 0
+            pixels = true
+          } else if (!tag(frame, 'ALPH')) return invalid()
+          frame = data + length + (length & 1)
+        }
+        if (!pixels || frame !== body + size) return invalid()
+        image = true
+      } else if (tag(offset, 'VP8 ') || tag(offset, 'VP8L')) {
+        if (animated) return invalid()
+        if (image) return invalid()
+        image = true
+        let w: number, h: number
+        if (tag(offset, 'VP8 ')) {
+          if (size < 10 || ((bytes[body] ?? 1) & 1) !== 0 || !tag(body + 3, '\u009d\u0001\u002a'))
+            return invalid()
+          w = view.getUint16(body + 6, true) & 16383
+          h = view.getUint16(body + 8, true) & 16383
+        } else {
+          if (size < 5 || bytes[body] !== 47) return invalid()
+          const bits = view.getUint32(body + 1, true)
+          if (bits >>> 29 !== 0) return invalid()
+          w = (bits & 16383) + 1
+          h = ((bits >>> 14) & 16383) + 1
+          alpha ||= ((bits >>> 28) & 1) !== 0
+        }
+        if (extended && (w !== width || h !== height)) return invalid()
+        width = w
+        height = h
+      }
+      offset = body + size + (size & 1)
+    }
+    if (!image || offset !== bytes.length) return invalid()
+  } else if (mime === 'image/gif') {
+    if (bytes.length < 14 || (!tag(0, 'GIF87a') && !tag(0, 'GIF89a'))) return invalid()
+    width = view.getUint16(6, true)
+    height = view.getUint16(8, true)
+    let offset = 13
+    const packed = bytes[10] ?? 0
+    if (packed & 128) offset += 3 * (1 << ((packed & 7) + 1))
+    const blocks = (): void => {
+      while (true) {
+        if (offset >= bytes.length) return invalid()
+        const size = bytes[offset++] ?? 0
+        if (!size) return
+        if (size > bytes.length - offset) return invalid()
+        offset += size
+      }
+    }
+    let frames = 0,
+      end = false
+    while (offset < bytes.length) {
+      const marker = bytes[offset++]
+      if (marker === 59) {
+        end = offset === bytes.length
+        break
+      }
+      if (marker === 33) {
+        if (offset >= bytes.length) return invalid()
+        const label = bytes[offset++]
+        if (label === 249) {
+          if (bytes[offset] !== 4 || offset + 6 > bytes.length) return invalid()
+          alpha ||= ((bytes[offset + 1] ?? 0) & 1) !== 0
+        }
+        blocks()
+      } else if (marker === 44) {
+        if (offset + 9 > bytes.length) return invalid()
+        const x = view.getUint16(offset, true),
+          y = view.getUint16(offset + 2, true)
+        const w = view.getUint16(offset + 4, true),
+          h = view.getUint16(offset + 6, true)
+        if (!w || !h || x + w > width || y + h > height) return invalid()
+        const flags = bytes[offset + 8] ?? 0
+        offset += 9
+        if (flags & 128) offset += 3 * (1 << ((flags & 7) + 1))
+        const codeSize = bytes[offset++]
+        if (codeSize === undefined || codeSize < 2 || codeSize > 8 || !bytes[offset])
+          return invalid()
+        blocks()
+        frames++
+      } else return invalid()
+    }
+    if (!frames || !end) return invalid()
+  } else return invalid()
+  if (width < 1 || height < 1 || width * height > 40_000_000)
+    throw badRequest('images', 'dimensions')
+  return { mime, width, height, alpha }
+}