The Customs House
Take untrusted files, email, and configs, and prove you handled them safely.
The ingredients 8 gifts
The idea
Assume everything crossing the border is hostile. Email is hostile. User themes are hostile. That uploaded PDF is hostile. This is the intake gate that parses all of it without trusting a byte it hasn't validated, and seals a receipt of what came in.
The parts + how they wire
Raw email/MIME → ratchet-inline-mime. Uploaded documents → ratchet-pdf-text / exif-parser / ratchet-png-text. User theme/config → loop21-verifyskin + isvalidcsscolor. Everything that survives crosses switchboard (evidence, never commands) and the cleared batch gets sealed into amber.
The one piece you build
The quarantine orchestrator — runs each input through its matching validator, routes rejects to a dead-letter, and decides what 'cleared' means for your app. The validators are done.
The technical breakdown
The 'ratchet' family is strict by construction: ratchet-png-text validates the 8-byte signature and recomputes the CRC-32 over every chunk, rejecting a mismatch, a length past the buffer, or a text chunk missing its null separator — each a thrown Error, never a silently-truncated string. ratchet-pdf-text is a strict content-stream extractor that throws on malformed input rather than pulling in a full PDF engine. exif-parser walks the TIFF/IFD structure and validates before it trusts. The shared rule: a parser that hands you a value out of a corrupt file is lying about the file — so your orchestrator can treat any thrown error as an automatic dead-letter. The theme validators reject the known CSS-injection surface (url(), @import, javascript:, declaration-breakouts) before anything touches a stylesheet, via a safe-character grammar. amber seals the receipt as content-addressed fixity: it seals the exact bytes of the paths you name into a small JSON capsule whose fixity is the content — any later change to any sealed member breaks the seal loudly and names the member.
The honest edge
Two guarantees you must not confuse. loop21-verifyskin proves a value can't break out of a declaration, not that it's meaningful CSS. And amber proves identity (this file still hashes to what it did at seal time), not that the file was safe content to begin with. Fixity is not trust. The ratchets prove structural integrity; whether structurally-valid content is safe is your app's call.
These are ingredients, not instructions you have to follow. If you cook something from them — or something stranger — we want to see it.