@devultur/self-host 0.0.0-stage → 1.0.0

package/dist/chunk-VF4KBW3I.js

@@ -0,0 +1,459 @@
+// src/request-state.ts
+var REQUEST_STATE_VARIABLE = "requestState";
+var INITIAL_STATE = { storagePrefix: "" };
+function getRequestState(context) {
+  return context.get(REQUEST_STATE_VARIABLE) ?? INITIAL_STATE;
+}
+function isAuthenticated(context) {
+  return getRequestState(context).access?.authenticated === true;
+}
+function mergeConfig(current, patch) {
+  if (!patch) return current;
+  const transcode = patch.transcode ? { ...current?.transcode, ...patch.transcode } : current?.transcode;
+  return { ...current, ...patch, ...transcode ? { transcode } : {} };
+}
+function mergeRecord(current, patch) {
+  return patch ? { ...current, ...patch } : current;
+}
+function updateRequestState(context, patch) {
+  const current = getRequestState(context);
+  const config = mergeConfig(current.config, patch.config);
+  const access = mergeRecord(current.access, patch.access);
+  const pluginContext = mergeRecord(current.context, patch.context);
+  const next = {
+    ...current,
+    ...patch,
+    ...config ? { config } : {},
+    ...access ? { access } : {},
+    ...pluginContext ? { context: pluginContext } : {}
+  };
+  context.set(REQUEST_STATE_VARIABLE, next);
+  return next;
+}
+
+// src/types.ts
+var HashAlgorithm = {
+  SHA_256: "SHA-256"
+};
+var HmacAlgorithm = {
+  NAME: "HMAC",
+  HASH: HashAlgorithm.SHA_256
+};
+var MaxResolution = {
+  P720: "720p",
+  P1080: "1080p",
+  P4K: "4k"
+};
+
+// src/helpers.ts
+import { visibilityFromKey } from "@devultur/core";
+
+// src/bearer.ts
+var encoder = new TextEncoder();
+function isConstantTimeEqual(received, expected) {
+  const receivedBytes = encoder.encode(received);
+  const expectedBytes = encoder.encode(expected);
+  let difference = receivedBytes.length ^ expectedBytes.length;
+  for (let index = 0; index < expectedBytes.length; index++) {
+    difference |= (receivedBytes[index] ?? 0) ^ expectedBytes[index];
+  }
+  return difference === 0;
+}
+function isBearerAuthorized(secret, authHeader) {
+  if (!secret || !authHeader) return false;
+  return isConstantTimeEqual(authHeader, `Bearer ${secret}`);
+}
+
+// src/legacy-claims.ts
+var LEGACY_CLAIM_NAMES = {
+  pid: "aud",
+  ppx: "res",
+  pfx: "res",
+  vis: "visibility",
+  mxb: "max_bytes",
+  mxf: "max_files",
+  fttl: "file_ttl",
+  ctx: "context"
+};
+var LEGACY_SCOPES_CLAIM = "scopes";
+function withCurrentClaimNames(payload) {
+  const current = { ...payload };
+  for (const [legacy, name] of Object.entries(LEGACY_CLAIM_NAMES)) {
+    if (!(legacy in current)) continue;
+    if (current[name] === void 0) current[name] = current[legacy];
+    delete current[legacy];
+  }
+  if (LEGACY_SCOPES_CLAIM in current) {
+    const scopes = current[LEGACY_SCOPES_CLAIM];
+    const scope = Array.isArray(scopes) ? scopes.filter((entry) => typeof entry === "string").join(" ") : "";
+    if (current.scope === void 0) current.scope = scope;
+    delete current[LEGACY_SCOPES_CLAIM];
+  }
+  return current;
+}
+
+// src/helpers.ts
+import { contentDispositionAttachment, contentDispositionInline, sanitizeFilename } from "@devultur/core";
+import {
+  encodeEncryptionMeta,
+  encryptBytes,
+  exportEncryptionKey,
+  generateEncryptionKey,
+  generateId,
+  generateIv,
+  importEncryptionKey
+} from "@devultur/core";
+var RESOURCE_SECURITY_HEADER = "X-Devultur-Resource-Security";
+function parseSecurityHeader(raw) {
+  if (!raw) return void 0;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return void 0;
+  }
+}
+function isContentTypeAllowed(contentType, accept) {
+  if (!accept || accept.length === 0) return true;
+  const type = contentType.toLowerCase().split(";")[0].trim();
+  return accept.some((entry) => {
+    const rule = entry.toLowerCase().trim();
+    if (rule === "*" || rule === "*/*") return true;
+    if (rule.endsWith("/*")) return type.startsWith(`${rule.slice(0, -1)}`);
+    return type === rule;
+  });
+}
+function areLocalesAllowed(requested, allowed) {
+  if (!allowed || allowed.length === 0) return true;
+  const allowedSet = new Set(allowed.map((locale) => locale.toLowerCase()));
+  return requested.every((locale) => allowedSet.has(locale.toLowerCase()));
+}
+function storageKey(context, key) {
+  return `${getRequestState(context).storagePrefix}${key}`;
+}
+function storagePrefix(context, prefix) {
+  return `${getRequestState(context).storagePrefix}${prefix}`;
+}
+function isTranscodeWebhookAuthorized(configuredSecret, authHeader) {
+  return isBearerAuthorized(configuredSecret, authHeader);
+}
+function base64UrlDecode(value) {
+  const base64 = value.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(value.length / 4) * 4, "=");
+  const binary = atob(base64);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+  return bytes;
+}
+var SERVICE_SUBJECT_PREFIX = "transcode:";
+var SERVICE_TOKEN_TYPE = "transcode";
+function isServiceToken(payload) {
+  return payload?.typ === SERVICE_TOKEN_TYPE;
+}
+async function verifyViewerToken(token, secret) {
+  if (!token) return null;
+  const parts = token.split(".");
+  if (parts.length !== 3) return null;
+  const [headerB64, payloadB64, signatureB64] = parts;
+  const encoder2 = new TextEncoder();
+  const key = await crypto.subtle.importKey("raw", encoder2.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, [
+    "verify"
+  ]);
+  const valid = await crypto.subtle.verify(
+    "HMAC",
+    key,
+    base64UrlDecode(signatureB64),
+    encoder2.encode(`${headerB64}.${payloadB64}`)
+  );
+  if (!valid) return null;
+  let payload;
+  try {
+    payload = JSON.parse(new TextDecoder().decode(base64UrlDecode(payloadB64)));
+  } catch {
+    return null;
+  }
+  const now = Math.floor(Date.now() / 1e3);
+  if (typeof payload.exp === "number" && payload.exp < now) return null;
+  return withCurrentClaimNames(payload);
+}
+async function createObjectEncryption(keysBucket, objectStorageKey, keyMetadata) {
+  const cryptoKey = await generateEncryptionKey();
+  const iv = generateIv();
+  const keyId = generateId();
+  await keysBucket.put(`${objectStorageKey}/${keyId}`, await exportEncryptionKey(cryptoKey), {
+    ...keyMetadata && Object.keys(keyMetadata).length > 0 ? { customMetadata: keyMetadata } : {}
+  });
+  return { cryptoKey, iv, enc: encodeEncryptionMeta(iv, keyId) };
+}
+async function encryptForStorage(keysBucket, objectStorageKey, body, keyMetadata) {
+  const { cryptoKey, iv, enc } = await createObjectEncryption(keysBucket, objectStorageKey, keyMetadata);
+  return { body: await encryptBytes(body, cryptoKey, iv), enc };
+}
+function shouldEncryptAtRest(policy, key, hasKeysBucket) {
+  const isHlsAsset = key.endsWith(".ts") || key.endsWith(".m3u8");
+  return Boolean(policy.encrypt) && visibilityFromKey(key) === "private" && !isHlsAsset && hasKeysBucket;
+}
+async function loadStorageKey(keysBucket, objectStorageKey, keyId) {
+  if (!keysBucket) return null;
+  const stored = await keysBucket.get(`${objectStorageKey}/${keyId}`);
+  if (!stored) return null;
+  return { key: await importEncryptionKey(await stored.arrayBuffer()), metadata: stored.customMetadata };
+}
+var base64Url = (value) => btoa(value).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+async function signViewerToken(payload, secret) {
+  const encoder2 = new TextEncoder();
+  const header = base64Url(JSON.stringify({ alg: "HS256", typ: "JWT" }));
+  const payloadB64 = base64Url(JSON.stringify(payload));
+  const signingInput = `${header}.${payloadB64}`;
+  const key = await crypto.subtle.importKey("raw", encoder2.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, [
+    "sign"
+  ]);
+  const signature = await crypto.subtle.sign("HMAC", key, encoder2.encode(signingInput));
+  const signatureB64 = base64Url(String.fromCharCode(...new Uint8Array(signature)));
+  return `${signingInput}.${signatureB64}`;
+}
+async function hashKey(key) {
+  const encoder2 = new TextEncoder();
+  const data = encoder2.encode(key);
+  const hashBuffer = await crypto.subtle.digest(HashAlgorithm.SHA_256, data);
+  return Array.from(new Uint8Array(hashBuffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function deletePrefix(bucket, prefix) {
+  let deletedCount = 0;
+  let cursor;
+  do {
+    const listed = await bucket.list({ prefix, cursor });
+    if (listed.objects.length > 0) {
+      await bucket.delete(listed.objects.map((obj) => obj.key));
+      deletedCount += listed.objects.length;
+    }
+    cursor = listed.truncated ? listed.cursor : void 0;
+  } while (cursor);
+  return deletedCount;
+}
+var KV_JOB_TTL_SECONDS = 86400;
+var UPLOAD_TOKEN_TTL_SECONDS = 3600;
+var KvPrefix = {
+  UPLOAD_PENDING: "upload-pending",
+  TRANSCODE_JOB: "transcode",
+  TRANSCODE_META: "transcode-meta",
+  TRANSCODE_STATUS: "transcode-status",
+  // What to do with the raw once the transcode finishes successfully (by videoId: the webhook doesn't carry the job). See
+  // transcode/raw-retention.ts.
+  TRANSCODE_RAW: "transcode-raw",
+  CAPTION_JOB: "caption",
+  CAPTION_GROUP: "caption-group",
+  CAPTION_STORED: "caption-stored"
+};
+
+// src/transcode/job-ticket.ts
+import { generateId as generateId2 } from "@devultur/core";
+var JOB_TICKET_HEADER = "X-Devultur-Job";
+var JOB_TICKET_TYPE = "transcode-job";
+var JOB_TICKET_KEY_SUFFIX = ":transcode-job-ticket";
+var JOB_TICKET_TTL_SECONDS = 2 * 24 * 60 * 60;
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var ticketKey = (secret) => `${secret}${JOB_TICKET_KEY_SUFFIX}`;
+async function signJobTicket(secret, job, nowMs = Date.now()) {
+  const runId = generateId2();
+  const issuedAt = Math.floor(nowMs / 1e3);
+  const ticket = await signViewerToken(
+    {
+      typ: JOB_TICKET_TYPE,
+      sub: job.videoId,
+      jti: runId,
+      iat: issuedAt,
+      exp: issuedAt + JOB_TICKET_TTL_SECONDS,
+      ...job.context ? { context: job.context } : {}
+    },
+    ticketKey(secret)
+  );
+  return { ticket, runId };
+}
+async function verifyJobTicket(secret, ticket, videoId) {
+  const claims = await verifyViewerToken(ticket, ticketKey(secret));
+  if (claims?.typ !== JOB_TICKET_TYPE || claims.sub !== videoId) return null;
+  if (typeof claims.jti !== "string" || typeof claims.iat !== "number") return null;
+  return {
+    runId: claims.jti,
+    videoId,
+    startedAt: claims.iat * 1e3,
+    ...isRecord(claims.context) ? { context: claims.context } : {}
+  };
+}
+
+// src/transcode/runner.ts
+var TranscodeRunnerName = {
+  FLY: "fly",
+  CLOUDFLARE: "cloudflare",
+  HTTP: "http"
+};
+var SCRIPT_ENV_VAR = "TRANSCODE_SCRIPT_B64";
+var RUN_SCRIPT_COMMAND = `echo "$${SCRIPT_ENV_VAR}" | base64 -d | sh`;
+var TranscodeLaunchErrorCode = {
+  NOT_CONFIGURED: "transcode_not_configured",
+  /** No capacity right now (429/5xx exhausted, runner down): retriable (503). */
+  UNAVAILABLE: "transcode_runner_unavailable",
+  /** The provider rejected the job (4xx): retrying won't fix it (500). */
+  LAUNCH_FAILED: "transcode_launch_failed"
+};
+function notConfigured(detail) {
+  return {
+    ok: false,
+    status: 500,
+    error: "Transcode runner not configured",
+    code: TranscodeLaunchErrorCode.NOT_CONFIGURED,
+    detail
+  };
+}
+function launchErrorCode(status) {
+  return status === 503 ? TranscodeLaunchErrorCode.UNAVAILABLE : TranscodeLaunchErrorCode.LAUNCH_FAILED;
+}
+function envWithScript(job) {
+  return { ...job.env, [SCRIPT_ENV_VAR]: btoa(job.script) };
+}
+function parseRunnerName(raw) {
+  const value = raw?.trim().toLowerCase();
+  if (!value) return TranscodeRunnerName.CLOUDFLARE;
+  const names = Object.values(TranscodeRunnerName);
+  return names.includes(value) ? value : null;
+}
+
+// src/transcode/cloudflare.ts
+var CONTAINER_IMAGE_NAME = "transcode";
+var DEFAULT_CF_INSTANCE = "standard-4";
+var JOB_REF_PREFIX = "cf-";
+var INSTANCE_VCPUS = {
+  lite: 1 / 16,
+  basic: 1 / 4,
+  "standard-1": 1 / 2,
+  "standard-2": 1,
+  "standard-3": 2,
+  "standard-4": 4
+};
+function createCloudflareContainerRunner(env) {
+  const instance = env.CF_TRANSCODE_INSTANCE?.trim() || DEFAULT_CF_INSTANCE;
+  const namespace = env.TRANSCODE_CONTAINER;
+  const stubFor = (videoId) => namespace?.get(namespace.idFromName(videoId));
+  async function launch(job) {
+    const stub = stubFor(job.videoId);
+    if (!stub) return notConfigured("TRANSCODE_CONTAINER binding is required for TRANSCODE_RUNNER=cloudflare");
+    if (!(instance in INSTANCE_VCPUS)) return notConfigured(`Unknown CF_TRANSCODE_INSTANCE "${instance}"`);
+    try {
+      const result = await stub.launch({ env: envWithScript(job), instance });
+      if (result.alreadyRunning) console.warn(`[transcode] cloudflare: ${job.videoId} already running, reusing it`);
+      return { ok: true, jobRef: `${JOB_REF_PREFIX}${job.videoId}` };
+    } catch (error) {
+      console.error("[transcode] cloudflare: container launch failed:", error);
+      return {
+        ok: false,
+        status: 503,
+        error: "Failed to start transcode container",
+        code: TranscodeLaunchErrorCode.UNAVAILABLE,
+        detail: String(error)
+      };
+    }
+  }
+  async function cancel(jobRef) {
+    await stubFor(jobRef.replace(JOB_REF_PREFIX, ""))?.cancel();
+  }
+  return { name: "cloudflare", cpus: INSTANCE_VCPUS[instance] ?? 0, launch, cancel };
+}
+function startTranscodeContainer(container, request) {
+  if (!container) throw new Error("Containers are not configured for this Durable Object (see [[containers]])");
+  if (container.running) return { alreadyRunning: true, exited: null };
+  const image = container.images?.[CONTAINER_IMAGE_NAME];
+  if (!image) throw new Error(`Missing [containers.images.${CONTAINER_IMAGE_NAME}] in the wrangler config`);
+  container.start({
+    image,
+    instance: request.instance,
+    // Downloads the raw and uploads the renditions over HTTP to the Worker → needs internet egress.
+    enableInternet: true,
+    entrypoint: ["sh", "-c", RUN_SCRIPT_COMMAND],
+    env: request.env
+  });
+  return { alreadyRunning: false, exited: container.monitor() };
+}
+function exitCodeOf(error) {
+  const exitCode = error?.exitCode;
+  return typeof exitCode === "number" ? exitCode : void 0;
+}
+function isUnreportedCrash(error) {
+  const exitCode = exitCodeOf(error);
+  return exitCode === void 0 || exitCode >= 128;
+}
+async function reportContainerCrash(env, error) {
+  if (!env.CALLBACK_URL || !env.VIDEO_ID) return;
+  const exitCode = exitCodeOf(error);
+  await fetch(env.CALLBACK_URL, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${env.CALLBACK_SECRET ?? ""}`,
+      ...env.JOB_TICKET ? { [JOB_TICKET_HEADER]: env.JOB_TICKET } : {}
+    },
+    body: JSON.stringify({
+      event: "transcode.failed",
+      videoId: env.VIDEO_ID,
+      // The runtime text doesn't travel: this event gets forwarded to the client's webhook. It was already logged in watchContainer.
+      error: `transcode container stopped (${exitCode === void 0 ? "unexpectedly" : `exit ${exitCode}`})`,
+      reason: "internal",
+      retriable: true
+    })
+  });
+}
+async function watchContainer(exited, env) {
+  try {
+    await exited;
+  } catch (error) {
+    if (!isUnreportedCrash(error)) return;
+    console.error("[transcode] cloudflare: container crashed:", error);
+    await reportContainerCrash(env, error).catch(
+      (reportError) => console.error("[transcode] cloudflare: crash report failed:", reportError)
+    );
+  }
+}
+
+export {
+  isBearerAuthorized,
+  getRequestState,
+  isAuthenticated,
+  updateRequestState,
+  MaxResolution,
+  RESOURCE_SECURITY_HEADER,
+  parseSecurityHeader,
+  isContentTypeAllowed,
+  areLocalesAllowed,
+  storageKey,
+  storagePrefix,
+  isTranscodeWebhookAuthorized,
+  base64UrlDecode,
+  SERVICE_SUBJECT_PREFIX,
+  SERVICE_TOKEN_TYPE,
+  isServiceToken,
+  verifyViewerToken,
+  createObjectEncryption,
+  encryptForStorage,
+  shouldEncryptAtRest,
+  loadStorageKey,
+  signViewerToken,
+  hashKey,
+  deletePrefix,
+  KV_JOB_TTL_SECONDS,
+  UPLOAD_TOKEN_TTL_SECONDS,
+  KvPrefix,
+  contentDispositionAttachment,
+  contentDispositionInline,
+  sanitizeFilename,
+  JOB_TICKET_HEADER,
+  signJobTicket,
+  verifyJobTicket,
+  TranscodeRunnerName,
+  RUN_SCRIPT_COMMAND,
+  TranscodeLaunchErrorCode,
+  notConfigured,
+  launchErrorCode,
+  envWithScript,
+  parseRunnerName,
+  createCloudflareContainerRunner,
+  startTranscodeContainer,
+  watchContainer
+};

package/dist/cloudflare-kZ7J3LQ2.d.ts

@@ -0,0 +1,19 @@
+interface ContainerLaunchRequest {
+    env: Record<string, string>;
+    instance: string;
+}
+interface ContainerLaunchResult {
+    alreadyRunning: boolean;
+}
+/** RPC surface of the DO (what the Worker calls on the stub). */
+interface TranscodeContainerRpc {
+    launch(request: ContainerLaunchRequest): Promise<ContainerLaunchResult>;
+    cancel(): Promise<void>;
+}
+/** `TRANSCODE_CONTAINER` binding (DurableObjectNamespace<TranscodeContainer>), typed by what's actually used. */
+interface TranscodeContainerNamespace {
+    idFromName(name: string): DurableObjectId;
+    get(id: DurableObjectId): TranscodeContainerRpc;
+}
+
+export type { ContainerLaunchRequest as C, TranscodeContainerNamespace as T, ContainerLaunchResult as a };

package/dist/codecs-RKUOPKWR.js

@@ -0,0 +1,198 @@
+import {
+  mimeOfFormat
+} from "./chunk-D3KOHAVH.js";
+
+// src/image/codecs.ts
+import avifDecode, { init as initAvifDecode } from "@jsquash/avif/decode";
+import avifEncode, { init as initAvifEncode } from "@jsquash/avif/encode";
+import jpegDecode, { init as initJpegDecode } from "@jsquash/jpeg/decode";
+import jpegEncode, { init as initJpegEncode } from "@jsquash/jpeg/encode";
+import pngDecode, { init as initPngDecode } from "@jsquash/png/decode";
+import pngEncode, { init as initPngEncode } from "@jsquash/png/encode";
+import resize, { initResize } from "@jsquash/resize";
+import webpDecode, { init as initWebpDecode } from "@jsquash/webp/decode";
+import webpEncode, { init as initWebpEncode } from "@jsquash/webp/encode";
+
+// src/image/area-resize.ts
+function axisCoverage(sourceSize, targetSize) {
+  const scale = sourceSize / targetSize;
+  const first = new Int32Array(sourceSize);
+  const split = new Float32Array(sourceSize);
+  for (let index = 0; index < sourceSize; index += 1) {
+    const target = Math.floor(index / scale);
+    const boundary = (target + 1) * scale;
+    first[index] = target;
+    split[index] = boundary >= index + 1 ? 1 : boundary - index;
+  }
+  return { first, split };
+}
+function areaDownscale(source, width, height, region = { x: 0, y: 0, width: source.width, height: source.height }) {
+  const horizontal = axisCoverage(region.width, width);
+  const vertical = axisCoverage(region.height, height);
+  const output = new Uint8ClampedArray(width * height * 4);
+  const rowSum = new Float32Array(width * 4);
+  let currentRow = new Float32Array(width * 4);
+  let nextRow = new Float32Array(width * 4);
+  const normalizer = 1 / (region.width / width * (region.height / height));
+  for (let sourceY = 0; sourceY < region.height; sourceY += 1) {
+    sumRowHorizontally(source, region, sourceY, horizontal, rowSum);
+    const weight = vertical.split[sourceY];
+    for (let index = 0; index < rowSum.length; index += 1) {
+      currentRow[index] += rowSum[index] * weight;
+      nextRow[index] += rowSum[index] * (1 - weight);
+    }
+    const isRowDone = sourceY === region.height - 1 || vertical.first[sourceY + 1] !== vertical.first[sourceY];
+    if (!isRowDone) continue;
+    writeRow(output, vertical.first[sourceY], currentRow, normalizer);
+    [currentRow, nextRow] = [nextRow, currentRow];
+    nextRow.fill(0);
+  }
+  return output;
+}
+function sumRowHorizontally(source, region, sourceY, horizontal, rowSum) {
+  rowSum.fill(0);
+  const pixels = source.data;
+  const lastTarget = rowSum.length - 4;
+  let offset = ((region.y + sourceY) * source.width + region.x) * 4;
+  for (let sourceX = 0; sourceX < region.width; sourceX += 1, offset += 4) {
+    const target = horizontal.first[sourceX] * 4;
+    const alpha = pixels[offset + 3];
+    const weight = horizontal.split[sourceX] * alpha;
+    addPixel(rowSum, target, pixels, offset, weight);
+    if (weight < alpha && target < lastTarget) addPixel(rowSum, target + 4, pixels, offset, alpha - weight);
+  }
+}
+function addPixel(row, target, pixels, offset, weight) {
+  row[target] += pixels[offset] * weight;
+  row[target + 1] += pixels[offset + 1] * weight;
+  row[target + 2] += pixels[offset + 2] * weight;
+  row[target + 3] += weight;
+}
+function writeRow(output, targetY, row, normalizer) {
+  const start = targetY * row.length;
+  for (let index = 0; index < row.length; index += 4) {
+    const alphaSum = row[index + 3];
+    const inverse = alphaSum > 0 ? 1 / alphaSum : 0;
+    output[start + index] = row[index] * inverse;
+    output[start + index + 1] = row[index + 1] * inverse;
+    output[start + index + 2] = row[index + 2] * inverse;
+    output[start + index + 3] = alphaSum * normalizer;
+  }
+}
+
+// src/image/codecs.ts
+var AVIF_DEFAULT_SPEED = 8;
+var ImageDataShim = class {
+  constructor(data, width, height) {
+    this.data = data;
+    this.width = width;
+    this.height = height;
+  }
+  data;
+  width;
+  height;
+  colorSpace = "srgb";
+};
+function ensureImageData() {
+  const scope = globalThis;
+  if (!scope.ImageData) scope.ImageData = ImageDataShim;
+}
+var asModuleInit = (init) => init;
+var EMSCRIPTEN_DECODERS = {
+  "image/jpeg": [initJpegDecode, "jpegDec"],
+  "image/webp": [initWebpDecode, "webpDec"],
+  "image/avif": [initAvifDecode, "avifDec"]
+};
+var EMSCRIPTEN_ENCODERS = {
+  jpeg: [initJpegEncode, "jpegEnc"],
+  webp: [initWebpEncode, "webpEnc"],
+  avif: [initAvifEncode, "avifEnc"]
+};
+var bindgenReady = null;
+async function prepareCodecs(wasm, sourceType, format) {
+  ensureImageData();
+  bindgenReady ??= Promise.all([
+    initResize(wasm.resize),
+    asModuleInit(initPngDecode)(wasm.pngCodec),
+    asModuleInit(initPngEncode)(wasm.pngCodec)
+  ]);
+  const decoder = EMSCRIPTEN_DECODERS[sourceType];
+  const encoder = EMSCRIPTEN_ENCODERS[format];
+  await Promise.all([
+    bindgenReady,
+    decoder ? asModuleInit(decoder[0])(wasm[decoder[1]]) : null,
+    encoder ? asModuleInit(encoder[0])(wasm[encoder[1]]) : null
+  ]);
+}
+async function decodeImage(bytes, contentType) {
+  if (contentType === "image/jpeg") return jpegDecode(bytes, { preserveOrientation: true });
+  if (contentType === "image/png") return pngDecode(bytes);
+  if (contentType === "image/webp") return webpDecode(bytes);
+  if (contentType === "image/avif") {
+    const decoded = await avifDecode(bytes);
+    if (!decoded) throw new Error("AVIF decode failed");
+    return decoded;
+  }
+  throw new Error(`Unsupported source type: ${contentType}`);
+}
+var DEFAULT_RESIZE_OPTIONS = { method: "lanczos3", linearRGB: false };
+async function resizeImage(image, plan, options = DEFAULT_RESIZE_OPTIONS, strategy = "area") {
+  const region = plan.crop ?? { x: 0, y: 0, width: image.width, height: image.height };
+  const isSameSize = region.width === plan.width && region.height === plan.height;
+  const isDownscale = plan.width <= region.width && plan.height <= region.height;
+  const scaled = strategy === "area" && isDownscale && !isSameSize ? makeImageData(areaDownscale(image, plan.width, plan.height, region), plan.width, plan.height) : await resizeWithWasm(image, plan, options);
+  return plan.canvas ? padImage(scaled, plan.canvas) : scaled;
+}
+async function resizeWithWasm(image, plan, options) {
+  const cropped = plan.crop ? cropImage(image, plan.crop) : image;
+  if (cropped.width === plan.width && cropped.height === plan.height) return cropped;
+  return resize(cropped, { width: plan.width, height: plan.height, premultiply: true, ...options });
+}
+async function encodeImage(image, target) {
+  const isFast = (target.effort ?? "fast") === "fast";
+  if (target.format === "jpeg") return jpegEncode(image, { quality: target.quality, progressive: !isFast });
+  if (target.format === "webp") return webpEncode(image, { quality: target.quality, method: isFast ? 2 : 4 });
+  if (target.format === "png") return pngEncode(image);
+  return avifEncode(image, { quality: target.quality, speed: target.avifSpeed ?? AVIF_DEFAULT_SPEED });
+}
+async function transformImage(bytes, contentType, planFor, target, maxDecodedPixels = Number.POSITIVE_INFINITY) {
+  const decoded = await decodeImage(bytes, contentType);
+  if (decoded.width * decoded.height > maxDecodedPixels) {
+    throw new Error(`Decoded ${decoded.width}x${decoded.height} exceeds the header-checked budget`);
+  }
+  const resized = await resizeImage(decoded, planFor(decoded));
+  const body = await encodeImage(resized, target);
+  return { body, contentType: mimeOfFormat(target.format), width: resized.width, height: resized.height };
+}
+function makeImageData(data, width, height) {
+  const Ctor = globalThis.ImageData;
+  return new Ctor(data, width, height);
+}
+function cropImage(image, crop) {
+  const source = new Uint32Array(image.data.buffer, image.data.byteOffset, image.width * image.height);
+  const target = new Uint32Array(crop.width * crop.height);
+  for (let row = 0; row < crop.height; row += 1) {
+    const start = (row + crop.y) * image.width + crop.x;
+    target.set(source.subarray(start, start + crop.width), row * crop.width);
+  }
+  return makeImageData(new Uint8ClampedArray(target.buffer), crop.width, crop.height);
+}
+function padImage(image, canvas) {
+  const target = new Uint32Array(canvas.width * canvas.height).fill(4294967295);
+  const source = new Uint32Array(image.data.buffer, image.data.byteOffset, image.width * image.height);
+  const offsetX = Math.floor((canvas.width - image.width) / 2);
+  const offsetY = Math.floor((canvas.height - image.height) / 2);
+  for (let row = 0; row < image.height; row += 1) {
+    target.set(source.subarray(row * image.width, (row + 1) * image.width), (row + offsetY) * canvas.width + offsetX);
+  }
+  return makeImageData(new Uint8ClampedArray(target.buffer), canvas.width, canvas.height);
+}
+export {
+  AVIF_DEFAULT_SPEED,
+  DEFAULT_RESIZE_OPTIONS,
+  decodeImage,
+  encodeImage,
+  prepareCodecs,
+  resizeImage,
+  transformImage
+};