dexterm-cli 0.0.0-stage → 0.1.2

package/dist/packages/data/src/images/cache.js

@@ -0,0 +1,141 @@
+// @dexterm/data — on-disk coin-image cache (task-1326). Lives under the app data dir (next to dexterm.db):
+// `<dir>/images/<sha256(url)[0..31]>.png` holds OUR re-encoded thumbnail (never the bytes the host sent),
+// so nothing downstream — the popup page, a future export — ever parses third-party image data. A
+// `.fail` marker remembers a refused/undecodable URL for a while so a dead IPFS link is not retried on
+// every launch. LRU by file mtime: a hit touches the file; when the directory grows past `maxBytes` the
+// oldest files go. Every filesystem failure is swallowed (a cache must never break the app).
+import { createHash } from 'node:crypto';
+import { mkdirSync, readFileSync, writeFileSync, readdirSync, statSync, unlinkSync, utimesSync, renameSync } from 'node:fs';
+import { join } from 'node:path';
+export function imageCacheKey(url) {
+    return createHash('sha256').update(url).digest('hex').slice(0, 32);
+}
+export class ImageDiskCache {
+    dir;
+    maxBytes;
+    failTtlMs;
+    now;
+    ready = false;
+    lastTouch = new Map();
+    stats = { files: 0, bytes: 0, hits: 0, misses: 0, writes: 0, evictions: 0 };
+    constructor(opts) {
+        this.dir = opts.dir;
+        this.maxBytes = opts.maxBytes ?? 32 * 1024 * 1024;
+        this.failTtlMs = opts.failTtlMs ?? 6 * 3_600_000;
+        this.now = opts.now ?? (() => Date.now());
+    }
+    ensure() {
+        if (this.ready)
+            return true;
+        try {
+            mkdirSync(this.dir, { recursive: true, mode: 0o700 });
+            this.ready = true;
+        }
+        catch { /* unwritable: cache off */ }
+        return this.ready;
+    }
+    pathFor(key, ext) { return join(this.dir, `${key}.${ext}`); }
+    /** Our stored thumbnail PNG for a URL key, or null. Touches the file (LRU). */
+    get(key) {
+        if (!this.ensure())
+            return null;
+        try {
+            const p = this.pathFor(key, 'png');
+            const buf = readFileSync(p);
+            this.stats.hits += 1;
+            const t = this.now();
+            if ((this.lastTouch.get(key) ?? 0) + 600_000 < t) {
+                this.lastTouch.set(key, t);
+                try {
+                    utimesSync(p, new Date(t), new Date(t));
+                }
+                catch { /* read-only fs: LRU just degrades */ }
+            }
+            return buf;
+        }
+        catch {
+            this.stats.misses += 1;
+            return null;
+        }
+    }
+    /** True when a failure marker younger than failTtl exists for this key (the marker carries its own timestamp). */
+    failed(key) {
+        if (!this.ensure())
+            return false;
+        try {
+            const text = readFileSync(this.pathFor(key, 'fail'), 'utf8');
+            const at = Number(text.split('\n')[0]);
+            return Number.isFinite(at) && this.now() - at < this.failTtlMs;
+        }
+        catch {
+            return false;
+        }
+    }
+    markFailed(key, reason) {
+        if (!this.ensure())
+            return;
+        try {
+            writeFileSync(this.pathFor(key, 'fail'), `${this.now()}\n${reason.slice(0, 200)}`, { mode: 0o600 });
+        }
+        catch { /* ignore */ }
+    }
+    /** Store our PNG thumbnail (atomic rename), then evict the oldest files past the byte cap. */
+    put(key, png) {
+        if (!this.ensure())
+            return;
+        try {
+            const p = this.pathFor(key, 'png');
+            const tmp = `${p}.${process.pid}.tmp`;
+            writeFileSync(tmp, png, { mode: 0o600 });
+            renameSync(tmp, p);
+            try {
+                const t = new Date(this.now());
+                utimesSync(p, t, t);
+            }
+            catch { /* LRU just degrades */ }
+            try {
+                unlinkSync(this.pathFor(key, 'fail'));
+            }
+            catch { /* no marker */ }
+            this.stats.writes += 1;
+            this.lastTouch.set(key, this.now());
+            this.evict();
+        }
+        catch { /* ignore */ }
+    }
+    /** Drop oldest files until the directory is under the cap. Also measures the directory. */
+    evict() {
+        let entries = [];
+        try {
+            for (const name of readdirSync(this.dir)) {
+                if (!name.endsWith('.png') && !name.endsWith('.fail'))
+                    continue;
+                try {
+                    const st = statSync(join(this.dir, name));
+                    entries.push({ name, size: st.size, mtime: st.mtimeMs });
+                }
+                catch { /* vanished */ }
+            }
+        }
+        catch {
+            return;
+        }
+        let total = entries.reduce((s, e) => s + e.size, 0);
+        this.stats.files = entries.length;
+        if (total > this.maxBytes) {
+            entries = entries.sort((a, b) => a.mtime - b.mtime);
+            for (const e of entries) {
+                if (total <= this.maxBytes * 0.9)
+                    break;
+                try {
+                    unlinkSync(join(this.dir, e.name));
+                    total -= e.size;
+                    this.stats.evictions += 1;
+                    this.stats.files -= 1;
+                }
+                catch { /* ignore */ }
+            }
+        }
+        this.stats.bytes = total;
+    }
+}

package/dist/packages/data/src/images/decode-worker.js

@@ -0,0 +1,28 @@
+// @dexterm/data — worker-thread entry for coin-image decoding (task-1326). Decoding a 800×800 PNG or a
+// baseline JPEG takes 5–60 ms of pure JS; on the render thread that is one to two dropped frames per
+// image at 30 fps, so the ImageService runs the decode + thumbnail + PNG re-encode here and only ever
+// receives small transferable buffers back. Anything thrown (hostile bytes, caps) comes back as a message.
+import { parentPort } from 'node:worker_threads';
+import { decodeThumbnail } from "./decode.js";
+import { encodePng } from "./png.js";
+/** Pure job runner (also used by the main-thread fallback). */
+export function runDecodeJob(job) {
+    try {
+        const d = decodeThumbnail(job.bytes, job.thumbMax);
+        const png = encodePng({ w: d.w, h: d.h, rgba: d.rgba });
+        // own copies: a pooled Buffer slab and a subarray view are not transferable across the worker boundary
+        return { id: job.id, ok: true, w: d.w, h: d.h, rgba: new Uint8Array(d.rgba), png: new Uint8Array(png), format: d.format, srcW: d.srcW, srcH: d.srcH };
+    }
+    catch (e) {
+        return { id: job.id, ok: false, error: e.message ?? String(e) };
+    }
+}
+if (parentPort) {
+    parentPort.on('message', (job) => {
+        const r = runDecodeJob(job);
+        if (r.ok)
+            parentPort.postMessage(r, [r.rgba.buffer, r.png.buffer]);
+        else
+            parentPort.postMessage(r);
+    });
+}

package/dist/packages/data/src/images/decode.js

@@ -0,0 +1,81 @@
+import { DEFAULT_LIMITS, ImageDecodeError, sniffFormat } from "./types.js";
+import { decodePng } from "./png.js";
+import { decodeJpeg } from "./jpeg.js";
+import { decodeGif } from "./gif.js";
+/** Decode any supported container. Throws ImageDecodeError for junk, unsupported formats or capped inputs. */
+export function decodeImage(bytes, limits = DEFAULT_LIMITS) {
+    if (bytes.length > limits.maxBytes)
+        throw new ImageDecodeError(`input is ${bytes.length} bytes, over the ${limits.maxBytes} byte cap`);
+    const format = sniffFormat(bytes);
+    if (!format)
+        throw new ImageDecodeError('not a png/jpeg/gif/webp (magic bytes)');
+    if (format === 'webp')
+        throw new ImageDecodeError('unsupported: webp (no decoder in the zero-dependency tree)');
+    const img = format === 'png' ? decodePng(bytes, limits) : format === 'jpeg' ? decodeJpeg(bytes, limits) : decodeGif(bytes, limits);
+    return { img, format };
+}
+/**
+ * Area-average resample to exactly `dw × dh` (box filter over the source rectangle each destination pixel
+ * covers). Alpha is averaged premultiplied so transparent edge pixels do not bleed their (usually black)
+ * colour into the thumbnail. Works for down- and up-scaling.
+ */
+export function resample(src, dw, dh) {
+    dw = Math.max(1, Math.floor(dw));
+    dh = Math.max(1, Math.floor(dh));
+    const { w: sw, h: sh, rgba } = src;
+    const out = new Uint8Array(dw * dh * 4);
+    const xs = sw / dw, ys = sh / dh;
+    for (let y = 0; y < dh; y++) {
+        const y0 = y * ys, y1 = (y + 1) * ys;
+        const iy0 = Math.floor(y0), iy1 = Math.min(sh, Math.ceil(y1));
+        for (let x = 0; x < dw; x++) {
+            const x0 = x * xs, x1 = (x + 1) * xs;
+            const ix0 = Math.floor(x0), ix1 = Math.min(sw, Math.ceil(x1));
+            let r = 0, g = 0, b = 0, a = 0, wsum = 0;
+            for (let sy = iy0; sy < iy1; sy++) {
+                const wy = Math.min(y1, sy + 1) - Math.max(y0, sy);
+                if (wy <= 0)
+                    continue;
+                for (let sx = ix0; sx < ix1; sx++) {
+                    const wx = Math.min(x1, sx + 1) - Math.max(x0, sx);
+                    if (wx <= 0)
+                        continue;
+                    const wgt = wx * wy;
+                    const o = (sy * sw + sx) * 4;
+                    const al = rgba[o + 3] / 255;
+                    r += rgba[o] * al * wgt;
+                    g += rgba[o + 1] * al * wgt;
+                    b += rgba[o + 2] * al * wgt;
+                    a += al * wgt;
+                    wsum += wgt;
+                }
+            }
+            const oo = (y * dw + x) * 4;
+            if (wsum <= 0 || a <= 0) {
+                out[oo] = 0;
+                out[oo + 1] = 0;
+                out[oo + 2] = 0;
+                out[oo + 3] = 0;
+                continue;
+            }
+            out[oo] = Math.round(r / a);
+            out[oo + 1] = Math.round(g / a);
+            out[oo + 2] = Math.round(b / a);
+            out[oo + 3] = Math.round((a / wsum) * 255);
+        }
+    }
+    return { w: dw, h: dh, rgba: out };
+}
+/** Shrink to fit inside `max × max` keeping the aspect ratio; never upscales. */
+export function fitWithin(src, max) {
+    if (src.w <= max && src.h <= max)
+        return src;
+    const s = max / Math.max(src.w, src.h);
+    return resample(src, Math.max(1, Math.round(src.w * s)), Math.max(1, Math.round(src.h * s)));
+}
+/** Decode + shrink to a thumbnail no larger than `thumbMax` on its longer side. */
+export function decodeThumbnail(bytes, thumbMax = 96, limits = DEFAULT_LIMITS) {
+    const { img, format } = decodeImage(bytes, limits);
+    const small = fitWithin(img, thumbMax);
+    return { ...small, format, srcW: img.w, srcH: img.h };
+}

package/dist/packages/data/src/images/fetch.js

@@ -0,0 +1,162 @@
+// @dexterm/data — SSRF-safe binary GET for coin images (task-1326). Same policy as the LARP detector's
+// safeFetch (larp/safe-fetch.ts): http/https only, no credentials, every hostname resolved and refused
+// when ANY address is private/loopback/link-local/CGNAT/multicast/reserved, the socket pinned to the
+// validated address, redirects followed manually (each hop re-validated, max 3), hard byte and time caps.
+// Differences for images: the body is BINARY and capped by Content-Length up front, the Accept header asks
+// for the formats we can decode (no webp), and there is no per-origin pacing (a CDN serving 40 icons is
+// not a target site; the ImageService bounds concurrency instead). Never throws for a bad image/host:
+// returns { ok:false, reason } so the UI can draw the placeholder.
+import { request as httpRequest } from 'node:http';
+import { request as httpsRequest } from 'node:https';
+import { isIP } from 'node:net';
+import { assertPublicUrl, publicAddresses, SsrfError } from "../larp/safe-fetch.js";
+import { lookup as dnsLookup } from 'node:dns';
+import { promisify } from 'node:util';
+const lookupAll = promisify(dnsLookup);
+async function defaultResolve(host) {
+    const res = await lookupAll(host, { all: true });
+    return res.map((r) => r.address);
+}
+const DEFAULTS = { maxBytes: 2 * 1024 * 1024, timeoutMs: 8000, maxRedirects: 3 };
+export const IMAGE_ACCEPT = 'image/png,image/jpeg,image/gif;q=0.9,*/*;q=0.1';
+export const IMAGE_USER_AGENT = 'dexterm/0.0.1 (+local terminal screener; coin image thumbnail, read-only)';
+/** Node http/https transport with the DNS answer pinned to the validated public address. */
+export function pinnedBytesTransport(resolve) {
+    return (url, { headers, maxBytes, signal }) => new Promise((yes, no) => {
+        const req = (url.protocol === 'https:' ? httpsRequest : httpRequest)(url, {
+            method: 'GET', agent: false, signal, headers,
+            lookup(host, options, cb) {
+                void publicAddresses(host, resolve).then((ips) => {
+                    if (options.all)
+                        cb(null, ips.map((address) => ({ address, family: isIP(address) })));
+                    else
+                        cb(null, ips[0], isIP(ips[0]));
+                }, (err) => cb(err, '', 4));
+            },
+        }, (res) => {
+            const headers = {};
+            for (const [k, v] of Object.entries(res.headers))
+                headers[k] = Array.isArray(v) ? v.join(', ') : v;
+            const status = res.statusCode ?? 502;
+            const cl = Number(headers['content-length']);
+            if (Number.isFinite(cl) && cl > maxBytes) {
+                res.destroy();
+                yes({ status, headers, body: new Uint8Array(0) });
+                return;
+            }
+            const chunks = [];
+            let total = 0;
+            res.on('data', (d) => {
+                if (total > maxBytes)
+                    return;
+                chunks.push(d);
+                total += d.length;
+                if (total > maxBytes)
+                    res.destroy(); // over the cap: stop reading; the caller sees length > maxBytes
+            });
+            res.on('end', () => yes({ status, headers, body: Buffer.concat(chunks, total) }));
+            res.on('close', () => yes({ status, headers, body: Buffer.concat(chunks, total) }));
+            res.on('error', (e) => { if (total > maxBytes)
+                yes({ status, headers, body: Buffer.concat(chunks, total) });
+            else
+                no(e); });
+        });
+        req.on('error', no);
+        req.end();
+    });
+}
+/**
+ * Rewrite known CDN URLs to ask for a small rendition: DexScreener's image CDN takes width/height query
+ * params (the screener's `info.imageUrl` asks for 800×800 PNGs, ~125 KB each; 128×128 is ~10 KB). Any other
+ * host is left untouched. Pure.
+ */
+/** DexScreener's image CDN (the host most coin pictures come from); it honours width/height query params. */
+export const DEXSCREENER_IMAGE_CDN = 'https://cdn.dexscreener.com';
+export function thumbnailUrl(raw, px = 128) {
+    try {
+        const u = new URL(raw);
+        if (u.protocol !== 'https:' && u.protocol !== 'http:')
+            return raw;
+        if (u.origin === DEXSCREENER_IMAGE_CDN && u.pathname.startsWith('/cms/images/')) {
+            u.searchParams.set('width', String(px));
+            u.searchParams.set('height', String(px));
+            if (!u.searchParams.has('quality'))
+                u.searchParams.set('quality', '90');
+            return u.toString();
+        }
+        return raw;
+    }
+    catch {
+        return raw;
+    }
+}
+/** Binary SSRF-safe GET with manual, re-validated redirects. Never throws for policy/network failures. */
+export async function fetchBytes(rawUrl, opts = {}) {
+    const maxBytes = opts.maxBytes ?? DEFAULTS.maxBytes;
+    const timeoutMs = opts.timeoutMs ?? DEFAULTS.timeoutMs;
+    const maxRedirects = opts.maxRedirects ?? DEFAULTS.maxRedirects;
+    const resolve = opts.resolve ?? defaultResolve;
+    const transport = opts.requestImpl ?? pinnedBytesTransport(resolve);
+    const started = Date.now();
+    const ctl = new AbortController();
+    const timer = setTimeout(() => ctl.abort(new Error('timed out')), timeoutMs);
+    timer.unref?.();
+    const onOuter = () => ctl.abort(opts.signal?.reason ?? new Error('aborted'));
+    if (opts.signal) {
+        if (opts.signal.aborted)
+            onOuter();
+        else
+            opts.signal.addEventListener('abort', onOuter, { once: true });
+    }
+    const redirects = [];
+    const fail = (reason, status = 0, finalUrl = rawUrl) => ({ ok: false, status, finalUrl, contentType: null, bytes: new Uint8Array(0), redirects, reason, elapsedMs: Date.now() - started });
+    try {
+        let current = rawUrl;
+        for (let hop = 0; hop <= maxRedirects; hop++) {
+            let u;
+            try {
+                u = await assertPublicUrl(current, resolve);
+            }
+            catch (e) {
+                return fail(e instanceof SsrfError ? e.reason : String(e));
+            }
+            if (ctl.signal.aborted)
+                return fail('timed out', 0, current);
+            let res;
+            try {
+                res = await transport(u, { headers: { 'user-agent': opts.userAgent ?? IMAGE_USER_AGENT, accept: opts.accept ?? IMAGE_ACCEPT, 'accept-encoding': 'identity' }, maxBytes, signal: ctl.signal });
+            }
+            catch (e) {
+                return fail(ctl.signal.aborted ? 'timed out' : `fetch failed: ${e.message}`, 0, current);
+            }
+            if (res.status >= 300 && res.status < 400) {
+                const loc = res.headers.location;
+                if (!loc)
+                    return fail(`${res.status} redirect without location`, res.status, current);
+                if (hop >= maxRedirects)
+                    return fail(`too many redirects (> ${maxRedirects})`, res.status, current);
+                let next;
+                try {
+                    next = new URL(loc, u).toString();
+                }
+                catch {
+                    return fail('bad redirect location', res.status, current);
+                }
+                redirects.push(u.toString());
+                current = next;
+                continue;
+            }
+            const ct = res.headers['content-type'] ?? null;
+            if (res.status < 200 || res.status >= 300)
+                return fail(`HTTP ${res.status}`, res.status, u.toString());
+            if (res.body.length > maxBytes)
+                return fail(`body over the ${maxBytes} byte cap`, res.status, u.toString());
+            return { ok: true, status: res.status, finalUrl: u.toString(), contentType: ct, bytes: res.body, redirects, reason: null, elapsedMs: Date.now() - started };
+        }
+        return fail(`too many redirects (> ${maxRedirects})`);
+    }
+    finally {
+        clearTimeout(timer);
+        opts.signal?.removeEventListener('abort', onOuter);
+    }
+}

package/dist/packages/data/src/images/gif.js

@@ -0,0 +1,214 @@
+import { DEFAULT_LIMITS, ImageDecodeError, checkDims } from "./types.js";
+function readSubBlocks(b, pos, cap) {
+    const parts = [];
+    let total = 0;
+    for (;;) {
+        if (pos >= b.length)
+            throw new ImageDecodeError('gif: truncated sub-blocks');
+        const n = b[pos];
+        pos += 1;
+        if (n === 0)
+            break;
+        if (pos + n > b.length)
+            throw new ImageDecodeError('gif: truncated sub-block');
+        parts.push(b.subarray(pos, pos + n));
+        total += n;
+        if (total > cap)
+            throw new ImageDecodeError('gif: data over the byte cap');
+        pos += n;
+    }
+    const data = new Uint8Array(total);
+    let o = 0;
+    for (const p of parts) {
+        data.set(p, o);
+        o += p.length;
+    }
+    return { data, next: pos };
+}
+/** LZW decode `data` into `npix` palette indices. */
+function lzw(data, minCodeSize, npix) {
+    if (minCodeSize < 2 || minCodeSize > 11)
+        throw new ImageDecodeError('gif: bad LZW code size');
+    const out = new Uint8Array(npix);
+    const clear = 1 << minCodeSize;
+    const eoi = clear + 1;
+    const MAX = 4096;
+    const prefix = new Int32Array(MAX);
+    const suffix = new Uint8Array(MAX);
+    const lengths = new Uint16Array(MAX);
+    for (let i = 0; i < clear; i++) {
+        prefix[i] = -1;
+        suffix[i] = i;
+        lengths[i] = 1;
+    }
+    let codeSize = minCodeSize + 1;
+    let next = eoi + 1;
+    let prev = -1;
+    let bitBuf = 0, bitCnt = 0, pos = 0, op = 0;
+    const stack = new Uint8Array(MAX + 1);
+    while (op < npix) {
+        while (bitCnt < codeSize) {
+            if (pos >= data.length)
+                return out; // stream ended early: keep what we have
+            bitBuf |= data[pos++] << bitCnt;
+            bitCnt += 8;
+        }
+        const code = bitBuf & ((1 << codeSize) - 1);
+        bitBuf >>>= codeSize;
+        bitCnt -= codeSize;
+        if (code === clear) {
+            codeSize = minCodeSize + 1;
+            next = eoi + 1;
+            prev = -1;
+            continue;
+        }
+        if (code === eoi)
+            break;
+        let cur = code;
+        let first;
+        if (code < next) {
+            // known code: emit its string
+            let n = lengths[code];
+            let c = code;
+            for (let i = n - 1; i >= 0; i--) {
+                stack[i] = suffix[c];
+                c = prefix[c];
+            }
+            first = stack[0];
+            for (let i = 0; i < n && op < npix; i++)
+                out[op++] = stack[i];
+        }
+        else if (code === next && prev >= 0) {
+            // KwKwK case: prev string + its first char
+            const n = lengths[prev];
+            let c = prev;
+            for (let i = n - 1; i >= 0; i--) {
+                stack[i] = suffix[c];
+                c = prefix[c];
+            }
+            stack[n] = stack[0];
+            first = stack[0];
+            for (let i = 0; i <= n && op < npix; i++)
+                out[op++] = stack[i];
+        }
+        else {
+            throw new ImageDecodeError('gif: corrupt LZW stream');
+        }
+        if (prev >= 0 && next < MAX) {
+            prefix[next] = prev;
+            suffix[next] = first;
+            lengths[next] = lengths[prev] + 1;
+            next += 1;
+            if (next === (1 << codeSize) && codeSize < 12)
+                codeSize += 1;
+        }
+        prev = cur;
+    }
+    return out;
+}
+export function decodeGif(b, limits = DEFAULT_LIMITS) {
+    if (b.length < 13 || String.fromCharCode(b[0], b[1], b[2]) !== 'GIF')
+        throw new ImageDecodeError('gif: bad signature');
+    const w = b[6] | (b[7] << 8), h = b[8] | (b[9] << 8);
+    checkDims(w, h, limits, 'gif');
+    const flags = b[10];
+    const bgIndex = b[11];
+    let pos = 13;
+    let gct = null;
+    if (flags & 0x80) {
+        const n = 3 * (1 << ((flags & 7) + 1));
+        if (pos + n > b.length)
+            throw new ImageDecodeError('gif: truncated palette');
+        gct = b.subarray(pos, pos + n);
+        pos += n;
+    }
+    let transparent = -1;
+    const out = new Uint8Array(w * h * 4); // transparent canvas
+    void bgIndex;
+    while (pos < b.length) {
+        const tag = b[pos];
+        if (tag === 0x3b)
+            break; // trailer
+        if (tag === 0x21) { // extension
+            const label = b[pos + 1];
+            pos += 2;
+            if (label === 0xf9) { // GCE: size, flags, delay(2), transparent index, 0
+                const size = b[pos];
+                if (size >= 4 && pos + 5 < b.length) {
+                    if (b[pos + 1] & 1)
+                        transparent = b[pos + 4];
+                }
+                pos += 1 + size;
+                if (b[pos] !== 0) {
+                    pos = readSubBlocks(b, pos, limits.maxBytes).next;
+                }
+                else
+                    pos += 1;
+            }
+            else {
+                pos = readSubBlocks(b, pos, limits.maxBytes).next;
+            }
+            continue;
+        }
+        if (tag === 0x2c) { // image descriptor
+            if (pos + 10 > b.length)
+                throw new ImageDecodeError('gif: truncated image descriptor');
+            const left = b[pos + 1] | (b[pos + 2] << 8), top = b[pos + 3] | (b[pos + 4] << 8);
+            const iw = b[pos + 5] | (b[pos + 6] << 8), ih = b[pos + 7] | (b[pos + 8] << 8);
+            const iflags = b[pos + 9];
+            pos += 10;
+            checkDims(iw, ih, limits, 'gif frame');
+            let pal = gct;
+            if (iflags & 0x80) {
+                const n = 3 * (1 << ((iflags & 7) + 1));
+                if (pos + n > b.length)
+                    throw new ImageDecodeError('gif: truncated local palette');
+                pal = b.subarray(pos, pos + n);
+                pos += n;
+            }
+            if (!pal)
+                throw new ImageDecodeError('gif: no palette');
+            const minCode = b[pos];
+            pos += 1;
+            const { data, next } = readSubBlocks(b, pos, limits.maxBytes);
+            pos = next;
+            const idx = lzw(data, minCode, iw * ih);
+            const interlaced = (iflags & 0x40) !== 0;
+            const rowOrder = [];
+            if (interlaced) {
+                for (let y = 0; y < ih; y += 8)
+                    rowOrder.push(y);
+                for (let y = 4; y < ih; y += 8)
+                    rowOrder.push(y);
+                for (let y = 2; y < ih; y += 4)
+                    rowOrder.push(y);
+                for (let y = 1; y < ih; y += 2)
+                    rowOrder.push(y);
+            }
+            for (let r = 0; r < ih; r++) {
+                const y = interlaced ? rowOrder[r] : r;
+                const dy = top + y;
+                if (dy < 0 || dy >= h)
+                    continue;
+                for (let x = 0; x < iw; x++) {
+                    const dx = left + x;
+                    if (dx < 0 || dx >= w)
+                        continue;
+                    const ci = idx[r * iw + x];
+                    if (ci === transparent)
+                        continue;
+                    if (ci * 3 + 2 >= pal.length)
+                        continue; // out-of-palette index: leave transparent
+                    const o = (dy * w + dx) * 4;
+                    out[o] = pal[ci * 3];
+                    out[o + 1] = pal[ci * 3 + 1];
+                    out[o + 2] = pal[ci * 3 + 2];
+                    out[o + 3] = 255;
+                }
+            }
+            return { w, h, rgba: out }; // first frame only
+        }
+        throw new ImageDecodeError(`gif: unknown block 0x${tag.toString(16)}`);
+    }
+    throw new ImageDecodeError('gif: no image data');
+}

package/dist/packages/data/src/images/index.js

@@ -0,0 +1,10 @@
+// @dexterm/data — coin images (task-1326): pure-TS decoders, SSRF-safe binary fetch, disk LRU, service.
+export * from "./types.js";
+export { decodePng, encodePng, isPng } from "./png.js";
+export { decodeJpeg } from "./jpeg.js";
+export { decodeGif } from "./gif.js";
+export { decodeImage, decodeThumbnail, resample, fitWithin } from "./decode.js";
+export { fetchBytes, thumbnailUrl, pinnedBytesTransport, DEXSCREENER_IMAGE_CDN, IMAGE_ACCEPT, IMAGE_USER_AGENT } from "./fetch.js";
+export { ImageDiskCache, imageCacheKey } from "./cache.js";
+export { ImageService } from "./service.js";
+export { runDecodeJob } from "./decode-worker.js";