feat: validate declared source format against sniffed magic bytes

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/mime.js

@@ -27,3 +27,27 @@ export function outputMimeType(targetFormat) {
   }
   return mime;
 }
+
+const UNDETECTABLE_TEXT_FORMATS = {
+  txt: 'text/plain',
+  html: 'text/html',
+};
+
+function normalizeFormat(format) {
+  return format === 'jpg' ? 'jpeg' : format;
+}
+
+export async function resolveInputFormat(filePath, declaredFormat) {
+  const detected = await detectInputMime(filePath);
+
+  if (!detected) {
+    const fallbackMime = UNDETECTABLE_TEXT_FORMATS[declaredFormat];
+    if (fallbackMime) {
+      return { mime: fallbackMime, valid: true };
+    }
+    return { mime: null, valid: false };
+  }
+
+  const valid = normalizeFormat(detected.ext) === normalizeFormat(declaredFormat);
+  return { mime: detected.mime, valid };
+}