@sigrun/sigrun 0.1.6 → 0.2.1

package/dist/server/images/fetch.js

@@ -0,0 +1,302 @@
+/**
+ * Vetted-address image fetching (UI-blocks U7, spec §11.2 verbatim):
+ * the proxy's DNS-rebinding defense. Every hop is ONE `https.request`
+ * whose `lookup` option answers with the SINGLE vetted address for
+ * that hop — the connection can never re-resolve, so a resolver that
+ * answers a public address first and `127.0.0.1` second cannot cause
+ * a connection to loopback.
+ *
+ * Rules (each enforced per hop, redirects included):
+ * - https only; `http:` URLs and `http:` redirect targets are refused;
+ * - the host is resolved ONCE per hop through `deps.resolve`; every
+ *   returned address is checked against the refused ranges — one bad
+ *   address refuses the host (no happy-eyeballs fallback into it);
+ * - `servername` (SNI) and the `Host` header keep the ORIGINAL host
+ *   name, never the resolved address;
+ * - redirects are followed BY HAND (no library follow option): at most
+ *   3 in total, each target re-resolved and re-checked the same way;
+ * - 10 s total timeout for the whole fetch — ABSOLUTE across the
+ *   resolve, connect, and header phases of every hop plus the body
+ *   read (a socket-inactivity timeout would never fire on a drip);
+ * - no agent reuse across hops (`agent: false`): Node's default
+ *   keep-alive agent could serve a redirect hop from a pooled socket
+ *   whose connection was vetted on the FIRST hop only;
+ * - 10 MiB body cap;
+ * - the body must sniff as PNG/JPEG/GIF/WebP (Content-Type is never
+ *   trusted; SVG and AVIF are refused).
+ */
+import * as https from "node:https";
+import { isRefusedAddress } from "./ranges.js";
+import { isAcceptedImageType, sniffImage } from "./sniff.js";
+/** The whole-fetch budget: 10 s, spec §11.2. */
+export const FETCH_TIMEOUT_MS = 10_000;
+/** The response body cap: 10 MiB, spec §11.2. */
+export const FETCH_MAX_BYTES = 10 * 1024 * 1024;
+/** At most 3 redirects in total, spec §11.2. */
+export const FETCH_MAX_REDIRECTS = 3;
+/** A refusal: the reason plus the message the caller logs. */
+export class FetchRefusal extends Error {
+    reason;
+    constructor(reason, message) {
+        super(message);
+        this.reason = reason;
+        this.name = "FetchRefusal";
+    }
+}
+/** Race `p` against the whole-fetch deadline.
+ *
+ * The deadline must be absolute even in phases a socket-inactivity
+ * timeout can never cut: a resolver that hangs, or a server dripping
+ * header bytes. Rejects with `timeout` when the deadline passes
+ * before `p` settles.
+ */
+function withDeadline(p, deps, deadline, phase) {
+    return new Promise((resolve, reject) => {
+        const remaining = deadline - deps.now();
+        if (remaining <= 0) {
+            // Mark `p`'s (possible later) rejection handled: the
+            // deadline refusal is the one the caller sees.
+            void p.catch(() => { });
+            reject(new FetchRefusal("timeout", `deadline reached before ${phase}`));
+            return;
+        }
+        const timer = setTimeout(() => {
+            reject(new FetchRefusal("timeout", `deadline reached ${phase}`));
+        }, remaining);
+        p.then((value) => {
+            clearTimeout(timer);
+            resolve(value);
+        }, (cause) => {
+            clearTimeout(timer);
+            reject(cause);
+        });
+    });
+}
+/** Resolve and vet one hop's host, or refuse it. */
+async function vettedAddress(host, deps) {
+    let addresses;
+    try {
+        addresses = await deps.resolve(host);
+    }
+    catch (cause) {
+        throw new FetchRefusal("resolve", `resolving ${host}: ${String(cause)}`);
+    }
+    if (addresses.length === 0) {
+        throw new FetchRefusal("resolve", `${host} resolved to no addresses`);
+    }
+    const vet = deps.vet ?? isRefusedAddress;
+    for (const address of addresses) {
+        if (vet(address)) {
+            throw new FetchRefusal("refused-address", `${host} resolves to refused address ${address}`);
+        }
+    }
+    // The FIRST vetted address is the one the connection uses; the
+    // lookup callback never consults the resolver again.
+    return addresses[0];
+}
+/** One `https.request` hop: connect to `address`, keep SNI/Host.
+ *
+ * The connect+header phase is cut by an ABSOLUTE whole-fetch deadline
+ * timer (not `req.setTimeout`, which is socket-inactivity: a
+ * header-drip server resets it forever). The timer is cleared the
+ * moment headers resolve; the body read has its own deadline timer.
+ */
+function hop(options) {
+    const { url, address, deps, deadline } = options;
+    return new Promise((resolve, reject) => {
+        const remaining = deadline - deps.now();
+        if (remaining <= 0) {
+            reject(new FetchRefusal("timeout", "deadline reached before connecting"));
+            return;
+        }
+        const req = https.request({
+            protocol: "https:",
+            host: url.hostname,
+            port: url.port || 443,
+            servername: url.hostname,
+            path: `${url.pathname}${url.search}`,
+            method: "GET",
+            // The rebinding defense: the connection dials the ONE
+            // vetted address, never the hostname (and never a second
+            // resolution). Node calls `lookup` with `all: true`.
+            lookup(_host, opts, callback) {
+                const family = address.includes(":") ? 6 : 4;
+                if (opts && typeof opts === "object" && "all" in opts && opts.all) {
+                    callback(null, [{ address, family }]);
+                }
+                else {
+                    callback(null, address, family);
+                }
+            },
+            // No explicit Host header: Node derives it from the
+            // ORIGINAL hostname (and the port), never the address the
+            // lookup returned.
+            ca: deps.ca,
+            // NO agent reuse across hops: with the default keep-alive
+            // global agent (Node >= 19), a redirect hop to the same
+            // host:port could be served by the pooled FIRST-hop
+            // socket — whose lookup (and vetted address) is the first
+            // hop's, so this hop's vetting would never run.
+            agent: false,
+        }, (res) => {
+            // Headers are in: the hop's absolute timer comes down; the
+            // caller owns the stream (redirect hops drain it, the
+            // final hop reads it).
+            clearTimeout(timer);
+            resolve({ status: res.statusCode ?? 0, headers: res.headers, stream: res });
+        });
+        let timedOut = false;
+        const timer = setTimeout(() => {
+            timedOut = true;
+            req.destroy();
+            reject(new FetchRefusal("timeout", `deadline reached awaiting headers from ${url.hostname}`));
+        }, remaining);
+        // The absolute timer: cleared on headers (above) AND on a
+        // connect-phase error — an early failure must not leave a timer
+        // holding the event loop (or fake clocks) open for the full
+        // remaining budget (Task 3 pickup of Task 2's review P2).
+        req.on("error", (cause) => {
+            clearTimeout(timer);
+            if (timedOut)
+                return; // the destroy() above already rejected
+            reject(new FetchRefusal("network", `connecting to ${url.hostname}: ${cause.message}`));
+        });
+        req.end();
+    });
+}
+/** Read a body stream under the deadline and the byte cap. */
+function readBody(stream, deps, deadline) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let received = 0;
+        const fail = (refusal) => {
+            stream.destroy?.();
+            reject(refusal);
+        };
+        // The whole-fetch deadline: checked on every read and by a
+        // timer, so a drip that stops delivering entirely is cut too.
+        const timer = setTimeout(() => {
+            fail(new FetchRefusal("timeout", "deadline reached reading body"));
+        }, Math.max(0, deadline - deps.now()));
+        stream.on("data", (chunk) => {
+            received += chunk.length;
+            if (received > FETCH_MAX_BYTES) {
+                clearTimeout(timer);
+                fail(new FetchRefusal("too-large", `body over ${FETCH_MAX_BYTES} bytes`));
+                return;
+            }
+            chunks.push(chunk);
+            const remaining = deadline - deps.now();
+            if (remaining <= 0) {
+                clearTimeout(timer);
+                fail(new FetchRefusal("timeout", "deadline reached reading body"));
+            }
+        });
+        stream.on("end", () => {
+            clearTimeout(timer);
+            resolve(Buffer.concat(chunks));
+        });
+        stream.on("error", (cause) => {
+            clearTimeout(timer);
+            fail(new FetchRefusal("network", `reading body: ${cause.message}`));
+        });
+    });
+}
+/** Parse `Cache-Control: max-age=N` from response headers. */
+function maxAgeOf(headers) {
+    const raw = headers["cache-control"];
+    if (raw === undefined)
+        return undefined;
+    for (const header of Array.isArray(raw) ? raw : [raw]) {
+        for (const directive of header.split(",")) {
+            const trimmed = directive.trim();
+            if (trimmed.startsWith("max-age=")) {
+                const parsed = Number(trimmed.slice("max-age=".length));
+                if (Number.isFinite(parsed) && parsed >= 0)
+                    return parsed;
+            }
+        }
+    }
+    return undefined;
+}
+/**
+ * Fetch `u` as an image: resolve-and-vet every hop, follow at most 3
+ * redirects by hand, cap the body, and require the sniffed type.
+ */
+export async function fetchImage(u, deps) {
+    const deadline = deps.now() + FETCH_TIMEOUT_MS;
+    let current;
+    try {
+        current = new URL(u);
+    }
+    catch {
+        throw new FetchRefusal("bad-url", `not a URL: ${u}`);
+    }
+    if (current.protocol !== "https:") {
+        throw new FetchRefusal("scheme", `not https: ${current.protocol}`);
+    }
+    let redirects = 0;
+    // Each loop iteration is one hop: vet, connect, then either take
+    // the redirect (draining and looping) or read the body.
+    for (;;) {
+        // Every hop resolves through `deps.resolve` — including IP
+        // literal hosts (the real resolver, `dns.lookup`, passes literals
+        // through verbatim, so literals get range-checked like any other
+        // answer). Brackets stripped for the resolver and SNI; the Host
+        // header keeps Node's own derivation from the URL. The deadline
+        // is ABSOLUTE here too: a resolver that hangs is cut at it.
+        const bareHost = current.hostname.replace(/^\[|\]$/g, "");
+        const address = await withDeadline(vettedAddress(bareHost, deps), deps, deadline, `resolving ${bareHost}`);
+        const response = await hop({ url: current, address, deps, deadline });
+        const status = response.status;
+        if (status >= 300 && status < 400 && response.headers.location !== undefined) {
+            // Redirect hops count against the same total budget even
+            // when refused for scheme or address — the attempt was made.
+            if (redirects >= FETCH_MAX_REDIRECTS) {
+                void consume(response.stream);
+                throw new FetchRefusal("too-many-redirects", `over ${FETCH_MAX_REDIRECTS} redirects at ${current.toString()}`);
+            }
+            redirects += 1;
+            let target;
+            try {
+                target = new URL(response.headers.location, current);
+            }
+            catch {
+                void consume(response.stream);
+                throw new FetchRefusal("bad-url", `redirect target not a URL: ${u}`);
+            }
+            if (target.protocol !== "https:") {
+                void consume(response.stream);
+                throw new FetchRefusal("redirect-scheme", `redirect to ${target.protocol} refused`);
+            }
+            // Drain the redirect response so the server sees it consumed
+            // and the socket closes cleanly (with `agent: false` there is
+            // no pool for it to return to — the drain is hygiene, not reuse).
+            void consume(response.stream);
+            current = target;
+            continue;
+        }
+        if (status < 200 || status >= 300) {
+            void consume(response.stream);
+            throw new FetchRefusal("http-status", `status ${status} from ${current.toString()}`);
+        }
+        const bytes = await readBody(response.stream, deps, deadline);
+        const sniffed = sniffImage(bytes);
+        if (!isAcceptedImageType(sniffed)) {
+            throw new FetchRefusal("bad-type", sniffed === undefined
+                ? `body did not sniff as an accepted image type`
+                : `body sniffed as ${sniffed}, which is refused`);
+        }
+        const maxAge = maxAgeOf(response.headers);
+        return { bytes, type: sniffed, ...(maxAge === undefined ? {} : { maxAge }) };
+    }
+}
+/** Best-effort drain of a refused hop's response so the server sees
+ * the response consumed and the socket closes cleanly. */
+function consume(stream) {
+    return new Promise((resolve) => {
+        stream.on("data", () => { });
+        stream.on("end", () => resolve());
+        stream.on("error", () => resolve());
+    });
+}

package/dist/server/images/ranges.js

@@ -0,0 +1,42 @@
+/**
+ * The refused-address ranges for image-proxy fetching (UI-blocks U7,
+ * spec §11.2 verbatim): loopback, `0.0.0.0/8`, RFC 1918 private,
+ * link-local, CGNAT `100.64.0.0/10`, unique-local `fc00::/7`,
+ * multicast, and the IPv4-mapped IPv6 forms of all of them.
+ *
+ * IPv4-mapped literals (`::ffff:10.0.0.1`) are normalized by
+ * `BlockList.check`, so the IPv4 rules cover every mapped form in
+ * both dotted and full 8-group notation. Anything that is not an IP
+ * literal at all is refused too (fail closed): the fetcher connects
+ * only to literals the vetting understood.
+ */
+import { BlockList, isIP } from "node:net";
+const REFUSED = new BlockList();
+// IPv4
+REFUSED.addSubnet("0.0.0.0", 8, "ipv4");
+REFUSED.addSubnet("127.0.0.0", 8, "ipv4");
+REFUSED.addSubnet("10.0.0.0", 8, "ipv4");
+REFUSED.addSubnet("172.16.0.0", 12, "ipv4");
+REFUSED.addSubnet("192.168.0.0", 16, "ipv4");
+REFUSED.addSubnet("169.254.0.0", 16, "ipv4");
+REFUSED.addSubnet("100.64.0.0", 10, "ipv4");
+REFUSED.addSubnet("224.0.0.0", 4, "ipv4");
+REFUSED.addAddress("255.255.255.255", "ipv4");
+// IPv6
+// (Spec-level gap, known: the deprecated IPv4-compatible form
+// `::127.0.0.1` is NOT refused — only the IPv4-mapped `::ffff:` form
+// normalizes into the IPv4 rules.)
+REFUSED.addSubnet("::", 128, "ipv6");
+REFUSED.addSubnet("::1", 128, "ipv6");
+REFUSED.addSubnet("fc00::", 7, "ipv6");
+REFUSED.addSubnet("fe80::", 10, "ipv6");
+REFUSED.addSubnet("ff00::", 8, "ipv6");
+/** True when `ip` is an address the image proxy must never connect to. */
+export function isRefusedAddress(ip) {
+    const family = isIP(ip);
+    if (family === 4)
+        return REFUSED.check(ip, "ipv4");
+    if (family === 6)
+        return REFUSED.check(ip, "ipv6");
+    return true;
+}

package/dist/server/images/rewrite.js

@@ -0,0 +1,94 @@
+/**
+ * The image-source rewriter (UI-blocks U7 Task 1, spec §11.1/§11.2):
+ * walks a tree or data JSON value and replaces `https://` image sources
+ * with the signer's proxy URL before the value leaves the server:
+ *
+ * - an `image` block's string `src` (literals only — a binding resolves
+ *   client-side against the data, whose own slots are rewritten below);
+ * - a card `image` slot (a string `image` prop), in a tree's item
+ *   template AND in data items (spec §5.5.1: the slot takes a binding
+ *   relative to the item, so the URL usually lives in the data);
+ * - `![alt](https://…)` markdown image links in any string (markdown
+ *   text, card/callout bodies, and the data strings they bind to).
+ *
+ * `asset:` and `data:` sources are untouched (§11.1). The walk is pure:
+ * the input is never mutated, and a branch is rebuilt only when a
+ * descendant changed (copy-on-write, the discipline of
+ * `shared/blocks/ops.ts`); an untouched subtree is returned by
+ * reference.
+ *
+ * Scope note (a spec-reading decision): the whole-string rewrite keys
+ * on the two shapes the block set defines for image sources — the
+ * `image` block's `src` prop and the card `image` prop — plus markdown
+ * image links. A binding that resolves to an https URL stored in data
+ * under any OTHER prop name is not rewritten (the walk cannot trace
+ * bindings); the webui's `img-src 'self' data:` CSP (Task 3) makes such
+ * a miss fail closed rather than load.
+ */
+/** A markdown image link: `![alt](https://…)`. */
+const MARKDOWN_IMAGE = /(!\[[^\]]*\]\()(https:\/\/[^)\s]+)(\))/g;
+/** Whether `s` is an https image source the rewriter replaces. */
+function isHttps(s) {
+    return s.startsWith("https://");
+}
+/**
+ * Rewrite one string's markdown image links; `null` when nothing
+ * matched (so the caller keeps the original reference).
+ */
+function rewriteMarkdown(text, sign) {
+    let changed = false;
+    const out = text.replace(MARKDOWN_IMAGE, (_all, pre, url, post) => {
+        changed = true;
+        return `${pre}${sign(url)}${post}`;
+    });
+    return changed ? out : null;
+}
+/**
+ * Rewrite every https image source in a tree or data value. Pure; see
+ * the module docstring for the three rewrite shapes and the scope note.
+ */
+export function rewriteImages(value, sign) {
+    return rewrite(value, sign);
+}
+/** The structural walk (copy-on-write: `null`-free, returns a value). */
+function rewrite(value, sign) {
+    if (typeof value === "string") {
+        const md = rewriteMarkdown(value, sign);
+        return md === null ? value : md;
+    }
+    if (Array.isArray(value)) {
+        let changed = false;
+        const out = [];
+        for (const entry of value) {
+            const rewritten = rewrite(entry, sign);
+            if (rewritten !== entry)
+                changed = true;
+            out.push(rewritten);
+        }
+        return changed ? out : value;
+    }
+    if (typeof value === "object" && value !== null) {
+        let changed = false;
+        const out = {};
+        for (const [key, entry] of Object.entries(value)) {
+            let rewritten;
+            if (typeof entry === "string" &&
+                (key === "src" || key === "image") &&
+                isHttps(entry)) {
+                // The two whole-string shapes: an image block's `src` and a
+                // card's `image` slot. Markdown links inside the string (none
+                // in a bare URL) are covered by the string branch below, so
+                // rewrite directly.
+                rewritten = sign(entry);
+            }
+            else {
+                rewritten = rewrite(entry, sign);
+            }
+            if (rewritten !== entry)
+                changed = true;
+            out[key] = rewritten;
+        }
+        return changed ? out : value;
+    }
+    return value;
+}

package/dist/server/images/sign.js

@@ -0,0 +1,84 @@
+/**
+ * The signing half of the image proxy (UI-blocks U7 Task 1, spec §11.2
+ * verbatim):
+ *
+ * - `s` is HMAC-SHA256 (hex) over the exact bytes `u + "\n" + e`, where
+ *   `u` is the URL string as it appeared in the tree — the server never
+ *   re-parses or re-encodes it between verifying and fetching.
+ * - `e` is an expiry 24 hours after signing (epoch milliseconds).
+ * - The key is 32 random bytes at `<stateDir>/image-proxy.key`, mode
+ *   0600, created at first boot and reused after. Deleting the file
+ *   rotates it: old signatures fail and channels re-fetch the surface,
+ *   which re-signs.
+ * - Signatures are not bound to a user; a copied signed URL works for
+ *   any signed-in user until it expires (spec: that reveals nothing the
+ *   URL didn't already).
+ */
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { randomUUID } from "node:crypto";
+/** The key file's name under the state dir. */
+export const IMAGE_PROXY_KEY_FILE = "image-proxy.key";
+/** The signature lifetime (spec §11.2): 24 hours. */
+export const SIGNATURE_TTL_MS = 24 * 60 * 60 * 1000;
+/** The proxy path every signed URL is rooted at. */
+const PROXY_PATH = "/v1/image";
+/** Load (or create) the proxy key at `<stateDir>/image-proxy.key`. */
+export async function loadOrCreateKey(stateDir) {
+    const path = join(stateDir, IMAGE_PROXY_KEY_FILE);
+    try {
+        return await readFile(path);
+    }
+    catch (cause) {
+        if (cause.code !== "ENOENT")
+            throw cause;
+    }
+    // First boot: create the key atomically (stage + chmod + rename, the
+    // same discipline as the stores' `writeFileAtomic` — chmod BEFORE the
+    // rename so there is no window at the wrong mode, and a chmod beats
+    // writeFile's `mode` option because umask masks the latter).
+    await mkdir(stateDir, { recursive: true });
+    const key = randomBytes(32);
+    const staged = `${path}.${randomUUID()}.tmp`;
+    try {
+        await writeFile(staged, key, { mode: 0o600 });
+        await chmod(staged, 0o600);
+        await rename(staged, path);
+    }
+    catch (cause) {
+        await rm(staged, { force: true });
+        throw cause;
+    }
+    return key;
+}
+/** Sign one URL at time `now`: `/v1/image?u=…&e=…&s=…`. */
+export function signUrl(key, u, now) {
+    const e = String(now + SIGNATURE_TTL_MS);
+    const s = signature(key, u, e);
+    return `${PROXY_PATH}?u=${encodeURIComponent(u)}&e=${e}&s=${s}`;
+}
+/**
+ * Verify a signed URL's parts at time `now`: the HMAC matches (constant
+ * time) AND `now <= e`. Malformed parts (a non-numeric `e`, a wrong-length
+ * or non-hex `s`) reject instead of throwing.
+ */
+export function verify(key, u, e, s, now) {
+    if (!/^\d+$/.test(e))
+        return false;
+    if (!/^[0-9a-f]+$/.test(s))
+        return false;
+    const expected = signature(key, u, e);
+    // Constant-time over the fixed 64-byte hex digests; the length check
+    // first because timingSafeEqual throws on a length mismatch.
+    if (s.length !== expected.length)
+        return false;
+    if (!timingSafeEqual(Buffer.from(expected, "utf8"), Buffer.from(s, "utf8"))) {
+        return false;
+    }
+    return now <= Number(e);
+}
+/** The HMAC hex digest over the exact bytes `u + "\n" + e`. */
+function signature(key, u, e) {
+    return createHmac("sha256", key).update(`${u}\n${e}`, "utf8").digest("hex");
+}

package/dist/server/images/sniff.js

@@ -0,0 +1,62 @@
+/**
+ * Content sniffing for image-proxy responses (UI-blocks U7, spec
+ * §11.2): the body must sniff as PNG, JPEG, GIF or WebP — the
+ * `Content-Type` header is never trusted. SVG and AVIF are refused
+ * even when the header says `image/png` (SVG can carry script; AVIF
+ * has no decoder in pi-tui).
+ */
+/**
+ * Sniff `bytes` by magic prefix. Returns `"svg"` / `"avif"` for the
+ * refused-but-recognizable types (so callers can name the reason),
+ * and `undefined` when nothing matches.
+ */
+export function sniffImage(bytes) {
+    if (bytes.length >= 8) {
+        // PNG: 89 50 4E 47 0D 0A 1A 0A
+        if (bytes[0] === 0x89 &&
+            bytes[1] === 0x50 &&
+            bytes[2] === 0x4e &&
+            bytes[3] === 0x47 &&
+            bytes[4] === 0x0d &&
+            bytes[5] === 0x0a &&
+            bytes[6] === 0x1a &&
+            bytes[7] === 0x0a) {
+            return "png";
+        }
+        // GIF: GIF87a / GIF89a
+        if (bytes.subarray(0, 3).toString("latin1") === "GIF" &&
+            (bytes.subarray(3, 6).toString("latin1") === "87a" ||
+                bytes.subarray(3, 6).toString("latin1") === "89a")) {
+            return "gif";
+        }
+    }
+    // JPEG: FF D8 FF
+    if (bytes.length >= 3 && bytes[0] === 0xff && bytes[1] === 0xd8 && bytes[2] === 0xff) {
+        return "jpeg";
+    }
+    // WebP: "RIFF" + len + "WEBP"
+    if (bytes.length >= 12 &&
+        bytes.subarray(0, 4).toString("latin1") === "RIFF" &&
+        bytes.subarray(8, 12).toString("latin1") === "WEBP") {
+        return "webp";
+    }
+    // AVIF/HEIF: "ftyp" box at offset 4; the brand at offset 8 is
+    // avif/avis (or the heic family — refused all the same, but named
+    // avif only for actual avif brands so the reason is honest).
+    if (bytes.length >= 12 && bytes.subarray(4, 8).toString("latin1") === "ftyp") {
+        const brand = bytes.subarray(8, 12).toString("latin1").toLowerCase();
+        if (brand === "avif" || brand === "avis")
+            return "avif";
+    }
+    // SVG: an XML prolog or an `<svg` opening anywhere in the first
+    // 512 bytes (handles BOM, XML decl, comments, and DOCTYPE).
+    const head = bytes.subarray(0, 512).toString("utf8");
+    if (/^\uFEFF?\s*(<\?xml[\s\S]*?\?>\s*)?(<!--[\s\S]*?-->\s*)*(!DOCTYPE[\s\S]*?\]\s*)?<svg/i.test(head)) {
+        return "svg";
+    }
+    return undefined;
+}
+/** True only for the four accepted types (the refused ones reject). */
+export function isAcceptedImageType(type) {
+    return type === "png" || type === "jpeg" || type === "gif" || type === "webp";
+}