/**
 * Magic-byte image sniffing — PLANNING.md §7/§10: "never trust Content-Type".
 * A cheap first gate before sharp does the authoritative decode. Recognises the
 * formats a phone or camera produces; anything else is rejected up front.
 */
export type SniffedImage = 'jpeg' | 'png' | 'webp' | 'gif' | 'tiff' | 'avif' | 'heic';

export function sniffImage(buf: Buffer): SniffedImage | null {
  if (buf.length < 12) return null;

  // JPEG: FF D8 FF
  if (buf[0] === 0xff && buf[1] === 0xd8 && buf[2] === 0xff) return 'jpeg';

  // PNG: 89 50 4E 47 0D 0A 1A 0A
  if (buf.subarray(0, 8).equals(Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]))) {
    return 'png';
  }

  // GIF: "GIF87a" / "GIF89a"
  if (buf.subarray(0, 3).toString('latin1') === 'GIF') return 'gif';

  // TIFF: "II*\0" (LE) or "MM\0*" (BE)
  const tiffLE = buf[0] === 0x49 && buf[1] === 0x49 && buf[2] === 0x2a && buf[3] === 0x00;
  const tiffBE = buf[0] === 0x4d && buf[1] === 0x4d && buf[2] === 0x00 && buf[3] === 0x2a;
  if (tiffLE || tiffBE) return 'tiff';

  // RIFF container: "RIFF"....(size)...."WEBP"
  if (
    buf.subarray(0, 4).toString('latin1') === 'RIFF' &&
    buf.subarray(8, 12).toString('latin1') === 'WEBP'
  ) {
    return 'webp';
  }

  // ISO-BMFF: bytes 4..8 == "ftyp", brand at 8..12
  if (buf.subarray(4, 8).toString('latin1') === 'ftyp') {
    const brand = buf.subarray(8, 12).toString('latin1');
    if (brand === 'avif' || brand === 'avis') return 'avif';
    if (brand.startsWith('hei') || brand === 'mif1' || brand === 'msf1') return 'heic';
  }

  return null;
}