rapier-jxl 1.1.21 → 2.1.0

package/index.mjs

@@ -1,94 +1,41 @@
 // SPDX-License-Identifier: MIT
-// Rapier JXL: a JPEG XL encoder in pure JavaScript, the one Rapier's page carries. This is the module's face for
-// other apps; Rapier's own worker takes the modules directly (images/encoder.mjs). No WebAssembly, no build step,
-// no dependency, nothing read or fetched at run time: pixels in, a bare codestream out.
-import {inspectPixels, encodeLossless} from './lossless.mjs';
-import {encodeLossy} from './lossy.mjs';
-import {transcodeJPEG} from './vardct.mjs';
-import {parseJPEG} from './jpeg.mjs';
-import {LIMITS} from './bits.mjs';
+// Rapier JXL: a JPEG XL encoder in pure JavaScript, the one Rapier's page carries. This is the core: pixels in, a bare
+// codestream out, exact or lossy, alpha exact. A JPEG is carried by jpeg.mjs and a photograph written by photo.mjs;
+// a module's author takes the layers from writer.mjs. No WebAssembly, no build step, no dependency, nothing read or
+// fetched at run time.
+import {inspectPixels, losslessSteps} from './lossless.mjs';
+import {lossySteps} from './lossy.mjs';
+import {LIMITS, complete, part} from './bits.mjs';
+import {admitOptions, admitPixels, job} from './admit.mjs';
 
 // What one call takes at most (bits.mjs): the 16 MiB codestream, 24 million pixels, 16,384 on a side. Larger asks are
 // refused with a coded error before any work, the way a decoder would refuse them after it.
 export {LIMITS};
 
-const fault = (code, message) => Object.assign(new Error(message), {code});
-function admitSize(width, height) {
-  if (!Number.isInteger(width) || !Number.isInteger(height) || width < 1 || height < 1) throw fault('JXL_INPUT', 'A picture is at least one pixel wide and high, in whole pixels.');
-  if (width > LIMITS.edge || height > LIMITS.edge) throw fault('JXL_DIMENSIONS', 'A picture is at most ' + LIMITS.edge + ' pixels on a side.');
-  if (width * height > LIMITS.pixels) throw fault('JXL_DIMENSIONS', 'A picture is at most ' + LIMITS.pixels.toLocaleString('en-US') + ' pixels.');
-}
-function admitPixels(data, width, height) {
-  admitSize(width, height);
-  if (!(data instanceof Uint8Array) && !(data instanceof Uint8ClampedArray)) throw fault('JXL_INPUT', 'Pixels are a Uint8Array or Uint8ClampedArray of RGBA bytes.');
-  if (data.length !== width * height * 4) throw fault('JXL_INPUT', 'Pixels are width * height * 4 bytes: straight (not premultiplied) RGBA, row by row.');
-}
-function admitQuality(quality) {
-  if (typeof quality !== 'number' || !Number.isFinite(quality) || quality < 1 || quality > 100) throw fault('JXL_INPUT', 'Quality is a number from 1 to 100.');
-}
-function answer(bytes) {
-  if (bytes.length > LIMITS.bytes) throw fault('JXL_SIZE', 'The encoded picture exceeds 16 MiB.');
-  return bytes;
-}
-function guard(work) {
-  try { return work(); }
-  catch (error) { if (error instanceof RangeError && !error.code) throw fault('JXL_MEMORY', 'Not enough memory for this picture.'); throw error; }
-}
+// Straight RGBA bytes, row by row, to a codestream. Quality 100 (the default) is exact: an opaque alpha is dropped, a
+// grey picture keeps one channel, up to 2048 colours use a palette when its complete stream is smaller, and direct
+// colour goes through reversible YCoCg with gradient or average prediction chosen by samples. Quality 1 to 99 is lossy
+// modular on libjxl's quality-to-distance curve (not equivalent PSNR), alpha still exact; a picture of few colours is
+// answered exact when that is fewer bytes. The samples are sRGB, or Display P3 with {colorSpace: 'display-p3'}: the
+// header declares the space and the samples are written as they are. The options are read before any work.
+export function encode(data, width, height, options) { return complete(encodeSteps(data, width, height, options)); }
 
-// Exact: every pixel comes back as it went in. An opaque alpha is dropped, a grey picture keeps one channel,
-// up to 2048 colours may use a palette when its complete stream wins. Direct colour uses reversible YCoCg
-// with sampled gradient/average prediction; compare the complete direct and palette streams by actual bytes.
-export function encodeLosslessRGBA(data, width, height) {
+// The same work as a job (admit.mjs): the call admitted at once, then a group of one pass per step, the same bytes.
+export function encodeSteps(data, width, height, options) {
+  const {quality, colorSpace} = admitOptions(options);
   admitPixels(data, width, height);
-  return guard(() => answer(encodeLossless(data, width, height, {shape: inspectPixels(data, width, height)})));
+  return job(pixelSteps(data, width, height, quality, colorSpace));
 }
 
-// Lossy modular at a quality from 1 to 99, using libjxl's quality-to-distance curve (not equivalent PSNR).
-// Alpha stays exact. A picture of few colours is answered
-// exact when that is fewer bytes. Quality 100 is the lossless answer.
-export function encodeLossyRGBA(data, width, height, quality = 90) {
-  admitPixels(data, width, height);
-  admitQuality(quality);
-  return guard(() => {
-    const shape = inspectPixels(data, width, height);
-    if (quality >= 100) return answer(encodeLossless(data, width, height, {shape}));
-    if (!shape.palette) return answer(encodeLossy(data, width, height, {quality, shape}));
-    // The exact stream of a few-colour picture is cheap to make (256-pixel sections), so it is made first: a lossy
-    // attempt that runs out of memory (its planes and Squeeze copies cost eight bytes a pixel and more) still answers.
-    const exact = encodeLossless(data, width, height, {shape});
-    let bytes;
-    try { bytes = encodeLossy(data, width, height, {quality, shape}); }
-    catch (error) { if (!(error instanceof RangeError) || error.code) throw error; bytes = exact; }
-    return answer(exact.length <= bytes.length ? exact : bytes);
-  });
+function* pixelSteps(data, width, height, quality, colorSpace) {
+  const shape = inspectPixels(data, width, height);
+  if (quality >= 100) return yield* losslessSteps(data, width, height, {shape, colorSpace});
+  if (!shape.palette) return yield* lossySteps(data, width, height, {quality, shape, colorSpace});
+  // The exact stream of a few-colour picture is cheap to make (256-pixel sections), so it is made first: a lossy
+  // attempt that runs out of memory or stream space still leaves that completed answer.
+  const exact = yield* part(losslessSteps(data, width, height, {shape, colorSpace}), 0, 2);
+  let bytes;
+  try { bytes = yield* part(lossySteps(data, width, height, {quality, shape, colorSpace}), 1, 2); }
+  catch (error) { if (error.code !== 'JXL_SIZE' && (!(error instanceof RangeError) || error.code)) throw error; bytes = exact; }
+  return exact.length <= bytes.length ? exact : bytes;
 }
-
-// One call for both: quality 100 (the default) is exact, anything lower is lossy. The options are read before any
-// work: a quality that is not a number from 1 to 100 is JXL_INPUT, never a silent choice.
-export function encode(data, width, height, options = {}) {
-  if (options === null || typeof options !== 'object') throw fault('JXL_INPUT', 'Options are an object: {quality}.');
-  const quality = options.quality === undefined ? 100 : options.quality;
-  admitQuality(quality);
-  return quality >= 100 ? encodeLosslessRGBA(data, width, height) : encodeLossyRGBA(data, width, height, quality);
-}
-
-// A JPEG carried as its coefficients into JPEG XL: the quantised DCT coefficients, quantisation tables, colour and
-// subsampling kept, only the entropy coding changed, so the picture decodes to the JPEG's own pixels at about a
-// fifth fewer bytes. Baseline, extended sequential and progressive scans, with restarts; 8-bit; grey, YCbCr or RGB;
-// an Exif orientation kept. Not carried: the JPEG reconstruction data (the JPEG file itself cannot be rebuilt from
-// the stream), ICC, Exif beyond the orientation, XMP. A JPEG this path does not take (arithmetic coding, 12-bit,
-// lossless, CMYK, a DNL height, a colour profile other than sRGB, a file cut short) is refused as JXL_JPEG; decode
-// it and encode its pixels instead.
-export function transcode(jpeg) {
-  if (!(jpeg instanceof Uint8Array) || !jpeg.length) throw fault('JXL_INPUT', 'A JPEG is a non-empty Uint8Array.');
-  if (jpeg.length > LIMITS.bytes) throw fault('JXL_SIZE', 'A JPEG is at most 16 MiB.');
-  return guard(() => {
-    const parsed = parseJPEG(jpeg);
-    admitSize(parsed.width, parsed.height);
-    const bytes = answer(transcodeJPEG(jpeg, parsed));
-    const swapped = parsed.orientation >= 5;
-    return {bytes, width: swapped ? parsed.height : parsed.width, height: swapped ? parsed.width : parsed.height, orientation: parsed.orientation};
-  });
-}
-
-export {encodeLossless, encodeLossy, transcodeJPEG, parseJPEG, inspectPixels};

package/jfif.mjs

@@ -0,0 +1,418 @@
+// Rapier's JPEG XL encoder: reading a JPEG's coefficients. MIT (LICENSE).
+// A JPEG is not decoded to pixels here: its quantised DCT coefficients are recovered from the Huffman-coded scans
+// (baseline, extended sequential and progressive, 8-bit, grey or three components) so they can be carried into a
+// JPEG XL frame as they are. Anything else (arithmetic coding, 12-bit, lossless, hierarchical, four components, a
+// height left to a DNL marker, a colour profile other than sRGB or Display P3) is refused with JXL_JPEG and the
+// picture takes the ordinary path instead. So is a JPEG cut short, a scan with bytes missing or left over, a restart
+// marker out of order, or a progressive file whose scans do not finish every coefficient: nothing here invents pixels
+// a file lost.
+// The frame's dimensions are admitted against the carrier's limits (JPEG_LIMITS) before a coefficient plane is
+// allocated, so a header naming a picture the module would never carry costs nothing.
+import {JPEG_LIMITS} from './bits.mjs';
+
+export const ZIGZAG = [0, 1, 8, 16, 9, 2, 3, 10, 17, 24, 32, 25, 18, 11, 4, 5, 12, 19, 26, 33, 40, 48, 41, 34, 27, 20, 13, 6, 7, 14, 21, 28,
+  35, 42, 49, 56, 57, 50, 43, 36, 29, 22, 15, 23, 30, 37, 44, 51, 58, 59, 52, 45, 38, 31, 39, 46, 53, 60, 61, 54, 47, 55, 62, 63];
+
+export function jpegError(message, code = 'JXL_JPEG') { return Object.assign(new Error('JPEG: ' + message), {code}); }
+
+// A 16-bit lookup: entry = (code length << 8) | symbol, 0 for no code.
+function buildHuffman(counts, symbols) {
+  const lookup = new Uint16Array(65536);
+  let code = 0, k = 0;
+  for (let length = 1; length <= 16; length++) {
+    for (let i = 0; i < counts[length - 1]; i++) {
+      const symbol = symbols[k++], start = code << (16 - length), n = 1 << (16 - length);
+      // An all-ones code would turn the required scan padding into a symbol.
+      if (start + n >= 65536) throw jpegError('bad Huffman table');
+      lookup.fill((length << 8) | symbol, start, start + n);
+      code++;
+    }
+    code <<= 1;
+  }
+  return lookup;
+}
+
+// The colour space an ICC profile gives a JPEG's samples, read from what the profile does, never from what it says:
+// RGB into the XYZ connection space through three colorants within 0.004 of sRGB's or Display P3's (D50, Bradford) and
+// the sRGB curve on every channel, or grey on the sRGB curve (the same in both spaces). Lookup tables, another gamut or
+// another curve name no space this module declares: null, and the JPEG is refused.
+const SRGB = [0.436, 0.2225, 0.0139, 0.3851, 0.7169, 0.0971, 0.143, 0.0606, 0.7139];
+const P3 = [0.5151, 0.2412, -0.001, 0.292, 0.6922, 0.0419, 0.1571, 0.0666, 0.7841];
+// The sRGB curve at sixteenths, and its parameters (g, a, b, c, d) as the ICC's parametric curve 3 writes them.
+const CURVE = [0, 0.00516, 0.01435, 0.02934, 0.05088, 0.07958, 0.11602, 0.16068, 0.21404, 0.27652, 0.34851, 0.43039,
+  0.52252, 0.62523, 0.73884, 0.86367, 1];
+const PARAMETERS = [2.4, 1 / 1.055, 0.055 / 1.055, 1 / 12.92, 0.04045];
+function srgbLinear(value) {
+  if (value <= 0.04045) return value / 12.92;
+  const base = (value + 0.055) / 1.055;
+  // base ** 2.4 as fixed arithmetic: the fifth root squared, times base squared. All engines round alike.
+  let root = 1;
+  for (let i = 0; i < 24; i++) root = (4 * root + base / (root * root * root * root)) / 5;
+  return base * base * root * root;
+}
+export function profileSpace(profile) {
+  const size = profile.length;
+  const u16 = at => (profile[at] << 8) | profile[at + 1];
+  const u32 = at => at + 4 <= size ? ((profile[at] << 24) | (profile[at + 1] << 16) | (profile[at + 2] << 8) | profile[at + 3]) >>> 0 : 0;
+  const sig = at => at + 4 <= size ? String.fromCharCode(profile[at], profile[at + 1], profile[at + 2], profile[at + 3]) : '';
+  const s15 = at => (u32(at) | 0) / 65536, tags = u32(128);
+  if (size < 132 || 132 + tags * 12 > size || sig(36) !== 'acsp' || sig(20) !== 'XYZ ') return null;
+  const tag = name => {
+    for (let i = 0; i < tags; i++) { const at = 132 + i * 12, offset = u32(at + 4); if (sig(at) === name) return offset + u32(at + 8) <= size ? offset : -1; }
+    return -1;
+  };
+  const srgbCurve = name => {
+    const at = tag(name);
+    if (at < 0) return false;
+    if (sig(at) === 'para') {
+      const type = u16(at + 8), count = [1, 3, 4, 5, 7][type];
+      if (type !== 3 && type !== 4) return false;
+      for (let i = 0; i < count; i++) if (Math.abs(s15(at + 12 + 4 * i) - (i < 5 ? PARAMETERS[i] : 0)) > (i ? 0.002 : 0.01)) return false;
+      return true;
+    }
+    const n = sig(at) === 'curv' ? u32(at + 8) : 0;
+    if (n < 2 || at + 12 + 2 * n > size) return false;
+    // Matching a few knots cannot identify a transfer curve: a monotonic table can differ between them.
+    // Check every stored value as well as the interpolated knots below, which also reject coarse linear tables.
+    for (let i = 0; i < n; i++) if (Math.abs(u16(at + 12 + 2 * i) / 65535 - srgbLinear(i / (n - 1))) > 0.001) return false;
+    return CURVE.every((want, k) => {
+      const p = k * (n - 1) / 16, i = Math.floor(p), j = Math.min(n - 1, i + 1), f = p - i;
+      return Math.abs((u16(at + 12 + 2 * i) * (1 - f) + u16(at + 12 + 2 * j) * f) / 65535 - want) <= 0.001;
+    });
+  };
+  if (['A2B0', 'A2B1', 'A2B2'].some(name => tag(name) >= 0)) return null;
+  if (sig(16) === 'GRAY') return srgbCurve('kTRC') ? 'srgb' : null;
+  if (sig(16) !== 'RGB ' || !['rTRC', 'gTRC', 'bTRC'].every(srgbCurve)) return null;
+  const colorants = ['rXYZ', 'gXYZ', 'bXYZ'].flatMap(name => { const at = tag(name); return at >= 0 && sig(at) === 'XYZ ' ? [s15(at + 8), s15(at + 12), s15(at + 16)] : [9, 9, 9]; });
+  const near = reference => reference.every((v, i) => Math.abs(colorants[i] - v) <= 0.004);
+  return near(SRGB) ? 'srgb' : near(P3) ? 'display-p3' : null;
+}
+
+export function parseJPEG(bytes) {
+  if (!(bytes.length > 4) || bytes[0] !== 0xFF || bytes[1] !== 0xD8) throw jpegError('not a JPEG');
+  const quant = [], huffman = [[], []], badDC = new Set(), icc = {count: 0, parts: []};
+  let frame = null, restartInterval = 0, adobeTransform = -1, jfif = false, orientation = 1, pos = 2;
+  const u16 = at => (bytes[at] << 8) | bytes[at + 1];
+  const signatureAt = (at, signature) => {
+    for (let i = 0; i < signature.length; i++) if (bytes[at + i] !== signature.charCodeAt(i)) return false;
+    return true;
+  };
+  for (;;) {
+    if (pos >= bytes.length) { if (frame && frame.scans) break; throw jpegError('truncated'); }
+    if (bytes[pos] !== 0xFF) throw jpegError('marker expected');
+    while (bytes[pos] === 0xFF) pos++;
+    const marker = bytes[pos++];
+    if (marker === 0xD9) break;
+    if (marker === 0xD8) throw jpegError('a second start');
+    if (marker >= 0xD0 && marker <= 0xD7) throw jpegError('a restart marker outside a scan');
+    if (marker === 0x01) continue;
+    if (pos + 2 > bytes.length) throw jpegError('truncated');
+    const length = u16(pos), segment = pos + 2, end = pos + length;
+    if (length < 2 || end > bytes.length) throw jpegError('bad segment');
+    pos = end;
+    if (marker === 0xDB) {
+      for (let at = segment; at < end;) {
+        const pq = bytes[at] >> 4, tq = bytes[at] & 15;
+        if (pq > 1 || tq > 3 || at + 1 + (pq ? 128 : 64) > end) throw jpegError('bad quantisation table');
+        at++;
+        const table = new Int32Array(64);
+        for (let k = 0; k < 64; k++) { table[ZIGZAG[k]] = pq ? u16(at) : bytes[at]; at += pq ? 2 : 1; if (!table[ZIGZAG[k]]) throw jpegError('a zero quantisation step'); }
+        if (frame?.progressive && frame.components.some(c => c.tq === tq && c.quant && c.coverage.some(v => v !== 0) && c.quant.some((v, k) => v !== table[k]))) throw jpegError('a quantisation table changed between progressive scans');
+        quant[tq] = table;
+      }
+    } else if (marker === 0xC4) {
+      for (let at = segment; at < end;) {
+        const tc = bytes[at] >> 4, th = bytes[at] & 15;
+        if (tc > 1 || th > 3 || at + 17 > end) throw jpegError('bad Huffman table');
+        at++;
+        const counts = bytes.subarray(at, at + 16);
+        let total = 0;
+        for (const c of counts) total += c;
+        if (total > 256 || at + 16 + total > end) throw jpegError('bad Huffman table');
+        const symbols = bytes.subarray(at + 16, at + 16 + total);
+        huffman[tc][th] = buildHuffman(counts, symbols);
+        // libjpeg refuses a DC table naming a symbol above 15 when a scan first reads DC through it, used or not.
+        if (tc === 0) { if (symbols.some(s => s > 15)) badDC.add(th); else badDC.delete(th); }
+        at += 16 + total;
+      }
+    } else if (marker === 0xC0 || marker === 0xC1 || marker === 0xC2) {
+      if (frame) throw jpegError('two frames');
+      if (end - segment < 6) throw jpegError('bad frame header');
+      if (bytes[segment] !== 8) throw jpegError('only 8-bit samples');
+      const height = u16(segment + 1), width = u16(segment + 3), count = bytes[segment + 5];
+      if (!width || !height) throw jpegError('a height left to a DNL marker');
+      if (count !== 1 && count !== 3) throw jpegError('only grey or three components');
+      if (end - segment < 6 + count * 3) throw jpegError('bad frame header');
+      // Admitted before a plane is allocated: the limits are the module's, the same the checked API keeps.
+      if (width > JPEG_LIMITS.edge || height > JPEG_LIMITS.edge) throw jpegError('a picture past ' + JPEG_LIMITS.edge + ' pixels on a side', 'JXL_DIMENSIONS');
+      if (width * height > JPEG_LIMITS.pixels) throw jpegError('a picture past ' + JPEG_LIMITS.pixels + ' pixels', 'JXL_DIMENSIONS');
+      const components = [];
+      let blocksPerMcu = 0;
+      for (let i = 0, at = segment + 6; i < count; i++, at += 3) {
+        const h = bytes[at + 1] >> 4, v = bytes[at + 1] & 15, tq = bytes[at + 2];
+        if (h < 1 || h > 4 || v < 1 || v > 4) throw jpegError('bad sampling');
+        if (tq > 3) throw jpegError('bad quantisation table');
+        if (components.some(c => c.id === bytes[at])) throw jpegError('two components with one id');
+        blocksPerMcu += h * v;
+        components.push({id: bytes[at], h, v, tq, pred: 0, coverage: new Int8Array(64).fill(-1)});
+      }
+      if (blocksPerMcu > 10) throw jpegError('bad sampling');
+      const hmax = Math.max(...components.map(c => c.h)), vmax = Math.max(...components.map(c => c.v));
+      const mcusX = Math.ceil(width / (8 * hmax)), mcusY = Math.ceil(height / (8 * vmax));
+      for (const c of components) {
+        c.blocksW = Math.ceil(Math.ceil(width * c.h / hmax) / 8); c.blocksH = Math.ceil(Math.ceil(height * c.v / vmax) / 8);
+        c.stride = mcusX * c.h; c.rows = mcusY * c.v;
+        c.coeffs = new Int16Array(c.stride * c.rows * 64);
+      }
+      frame = {progressive: marker === 0xC2, width, height, components, hmax, vmax, mcusX, mcusY, scans: 0};
+    } else if (marker === 0xC3 || (marker >= 0xC5 && marker <= 0xC7) || (marker >= 0xC9 && marker <= 0xCB) || (marker >= 0xCD && marker <= 0xCF)) {
+      throw jpegError('lossless, hierarchical or arithmetic coding');
+    } else if (marker === 0xDD) { if (length < 4) throw jpegError('bad segment'); restartInterval = u16(segment); }
+    else if (marker === 0xDC) throw jpegError('a DNL marker');
+    else if (marker === 0xDA) {
+      if (!frame) throw jpegError('a scan before the frame');
+      const n = bytes[segment], scan = [];
+      if (n < 1 || n > 4 || segment + 1 + n * 2 + 3 > end) throw jpegError('bad scan header');
+      let at = segment + 1;
+      for (let i = 0; i < n; i++, at += 2) {
+        const component = frame.components.find(c => c.id === bytes[at]);
+        if (!component) throw jpegError('a scan of an unknown component');
+        if (scan.some(s => s.component === component)) throw jpegError('a component twice in one scan');
+        // A table may be reused for another component after this one's scans. Keep the table that actually
+        // decoded each component, not whatever happens to occupy its slot at the end of the file.
+        if (!component.quant) component.quant = quant[component.tq];
+        if (!component.quant) throw jpegError('a scan without its quantisation table');
+        scan.push({component, dc: huffman[0][bytes[at + 1] >> 4], ac: huffman[1][bytes[at + 1] & 15], dcSlot: bytes[at + 1] >> 4});
+      }
+      const ss = bytes[at], se = bytes[at + 1], ah = bytes[at + 2] >> 4, al = bytes[at + 2] & 15;
+      if ((!frame.progressive || (ss === 0 && ah === 0)) && scan.some(s => badDC.has(s.dcSlot))) throw jpegError('bad Huffman table');
+      pos = decodeScan(bytes, end, frame, scan, ss, se, ah, al, restartInterval);
+      frame.scans++;
+    } else if (marker === 0xE0) {
+      if (signatureAt(segment, 'JFIF')) jfif = true;
+    } else if (marker === 0xE1) {
+      if (orientation === 1 && signatureAt(segment, 'Exif')) orientation = exifOrientation(bytes, segment + 6, end);
+    } else if (marker === 0xE2) {
+      if (length >= 16 && signatureAt(segment, 'ICC_PROFILE\0')) {
+        const seq = bytes[segment + 12], count = bytes[segment + 13];
+        if (!seq || !count || seq > count || (icc.count && icc.count !== count) || icc.parts[seq]) throw jpegError('a colour profile cut short');
+        icc.count = count; icc.parts[seq] = bytes.subarray(segment + 14, end);
+      }
+    } else if (marker === 0xEE) {
+      if (length >= 14 && signatureAt(segment, 'Adobe')) adobeTransform = bytes[segment + 11];
+    }
+  }
+  if (!frame || !frame.scans) throw jpegError('no picture');
+  for (const c of frame.components) {
+    for (let k = 0; k < 64; k++) if (c.coverage[k] !== 0) throw jpegError(frame.progressive ? 'a progressive JPEG whose scans do not finish every coefficient' : 'a component without its scan');
+  }
+  let colorSpace = 'srgb';
+  if (icc.count) {
+    const parts = [];
+    for (let i = 1; i <= icc.count; i++) { if (!icc.parts[i]) throw jpegError('a colour profile cut short'); parts.push(icc.parts[i]); }
+    const profile = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
+    for (let i = 0, at = 0; i < parts.length; at += parts[i].length, i++) profile.set(parts[i], at);
+    colorSpace = profileSpace(profile);
+    if (!colorSpace) throw jpegError('a colour profile other than sRGB or Display P3 (decode the picture and encode its pixels)');
+  }
+  // Colour as libjxl reads it: JFIF means YCbCr; else an Adobe marker decides; else component ids spelling RGB.
+  let rgb = false;
+  if (frame.components.length === 3 && !jfif) {
+    if (adobeTransform >= 0) rgb = adobeTransform === 0;
+    else rgb = frame.components[0].id === 0x52 && frame.components[1].id === 0x47 && frame.components[2].id === 0x42;
+  }
+  return {width: frame.width, height: frame.height, components: frame.components, progressive: frame.progressive, ycbcr: !rgb, orientation, colorSpace};
+}
+
+// The Exif orientation tag (0x0112) of the first image directory, 1 when absent or unreadable.
+function exifOrientation(bytes, start, end) {
+  const big = bytes[start] === 0x4D && bytes[start + 1] === 0x4D;
+  if (!big && !(bytes[start] === 0x49 && bytes[start + 1] === 0x49)) return 1;
+  const u16 = at => at + 2 > end ? 0 : big ? (bytes[at] << 8) | bytes[at + 1] : bytes[at] | (bytes[at + 1] << 8);
+  const u32 = at => at + 4 > end ? 0 : big ? ((bytes[at] << 24) | (bytes[at + 1] << 16) | (bytes[at + 2] << 8) | bytes[at + 3]) >>> 0 : (bytes[at] | (bytes[at + 1] << 8) | (bytes[at + 2] << 16) | (bytes[at + 3] << 24)) >>> 0;
+  if (u16(start + 2) !== 42) return 1;
+  const ifd = start + u32(start + 4), entries = u16(ifd);
+  for (let i = 0, at = ifd + 2; i < entries && at + 12 <= end; i++, at += 12) {
+    if (u16(at) !== 0x0112) continue;
+    const value = u16(at + 8);
+    return value >= 1 && value <= 8 ? value : 1;
+  }
+  return 1;
+}
+
+// What a scan may be, and what it leaves coded: sequential scans code a component whole at once; progressive scans
+// code the DC first, then AC bands, each bit plane once, from the top down. `coverage[k]` is the lowest bit plane
+// coefficient k has been coded to (-1 never), and the picture is complete only when every one reaches 0.
+function admitScan(frame, scan, ss, se, ah, al) {
+  const progressive = frame.progressive;
+  if (!progressive) {
+    if (ss !== 0 || se !== 63 || ah !== 0 || al !== 0) throw jpegError('a bad spectral selection');
+    for (const s of scan) { if (s.component.coverage.some(v => v !== -1)) throw jpegError('a component coded twice'); s.component.coverage.fill(0); }
+    return;
+  }
+  if (al > 13 || (ah && ah !== al + 1)) throw jpegError('a bad successive approximation');
+  if (ss === 0) {
+    if (se !== 0) throw jpegError('a bad spectral selection');
+    for (const {component} of scan) {
+      if (component.coverage[0] !== (ah ? ah : -1)) throw jpegError(ah ? 'a refinement scan out of order' : 'a DC scan twice');
+      component.coverage[0] = al;
+    }
+    return;
+  }
+  if (scan.length !== 1) throw jpegError('an interleaved AC scan');
+  if (se > 63 || ss > se) throw jpegError('a bad spectral selection');
+  const {coverage} = scan[0].component;
+  if (coverage[0] === -1) throw jpegError('an AC scan before the DC scan');
+  for (let k = ss; k <= se; k++) {
+    if (coverage[k] !== (ah ? ah : -1)) throw jpegError(ah ? 'a refinement scan out of order' : 'a band coded twice');
+    coverage[k] = al;
+  }
+}
+
+function decodeScan(bytes, start, frame, scan, ss, se, ah, al, restartInterval) {
+  admitScan(frame, scan, ss, se, ah, al);
+  // `pad` counts the bits in `buffer` that are not the file's: zero bytes fed once a marker or the end is reached, so
+  // the lookahead always holds 24 bits. A code or a value that would take them is a scan cut short.
+  let pos = start, buffer = 0, count = 0, pad = 0, marker = false;
+  const fill = () => {
+    while (count <= 24) {
+      let byte = 0;
+      if (marker || pos >= bytes.length) { marker = true; pad += 8; }
+      else {
+        byte = bytes[pos];
+        if (byte === 0xFF) {
+          const next = bytes[pos + 1];
+          if (next === 0) pos += 2;
+          else if (next === 0xFF) { pos++; continue; }
+          else { marker = true; byte = 0; pad += 8; }
+        } else pos++;
+      }
+      buffer = ((buffer << 8) | byte) >>> 0; count += 8;
+    }
+  };
+  const short = () => jpegError('a scan cut short');
+  const receive = n => { if (!n) return 0; fill(); if (n > count - pad) throw short(); const value = (buffer >>> (count - n)) & ((1 << n) - 1); count -= n; return value; };
+  const extend = (value, n) => value < (1 << (n - 1)) ? value - (1 << n) + 1 : value;
+  const decode = table => {
+    if (!table) throw jpegError('a scan without its Huffman table');
+    fill();
+    const entry = table[(buffer >>> (count - 16)) & 0xFFFF];
+    if (!entry) throw jpegError('bad Huffman code');
+    if ((entry >> 8) > count - pad) throw short();
+    count -= entry >> 8;
+    return entry & 255;
+  };
+  // The bytes of an interval are consumed whole but for the last one's padding bits; then its marker, in order.
+  const atMarker = () => {
+    const remaining = count - pad;
+    if (remaining >= 8) throw jpegError('bytes left over in a scan');
+    if (eobrun) throw jpegError('an end-of-band run past its interval');
+    if (remaining && ((buffer >>> pad) & ((1 << remaining) - 1)) !== (1 << remaining) - 1) throw jpegError('bad scan padding');
+    while (pos + 1 < bytes.length && bytes[pos] === 0xFF && bytes[pos + 1] === 0xFF) pos++;
+  };
+  const restart = index => {
+    atMarker();
+    if (!(bytes[pos] === 0xFF && bytes[pos + 1] === 0xD0 + (index & 7))) throw jpegError('a restart marker missing or out of order');
+    pos += 2; buffer = 0; count = 0; pad = 0; marker = false;
+    for (const s of scan) s.component.pred = 0;
+    eobrun = 0;
+  };
+  const dcValue = (s, t) => {
+    if (t > 11) throw jpegError('a DC value out of range');
+    const diff = t ? extend(receive(t), t) : 0;
+    s.component.pred += diff;
+    if (s.component.pred > 2047 || s.component.pred < -2048) throw jpegError('a DC value out of range');
+    return s.component.pred;
+  };
+  const acValue = (size, shift) => {
+    if (size > 10) throw jpegError('an AC value out of range');
+    const value = extend(receive(size), size) * (1 << shift);
+    if (value > 1023 || value < -1023) throw jpegError('an AC value out of range');
+    return value;
+  };
+  let eobrun = 0;
+  const single = scan.length === 1, progressive = frame.progressive;
+  const baseline = (s, coeffs, at) => {
+    coeffs[at] = dcValue(s, decode(s.dc));
+    acFirst(s, coeffs, at);
+  };
+  const dcFirst = (s, coeffs, at) => {
+    const value = dcValue(s, decode(s.dc)) * (1 << al);
+    if (value > 2047 || value < -2048) throw jpegError('a DC value out of range');
+    coeffs[at] = value;
+  };
+  const dcRefine = (s, coeffs, at) => { if (receive(1)) coeffs[at] |= 1 << al; };
+  const pastBand = () => jpegError('coefficients past the ' + (progressive ? 'band' : 'block'));
+  // Sequential scans use this same first AC pass after their DC: admission fixes ss=0, se=63, al=0. Only a
+  // progressive scan may carry an end-of-band run across blocks; a sequential nonzero run still refuses here.
+  const acFirst = (s, coeffs, at) => {
+    if (eobrun > 0) { eobrun--; return; }
+    for (let k = ss || 1; k <= se;) {
+      const rs = decode(s.ac), r = rs >> 4, size = rs & 15;
+      if (!size) {
+        if (r < 15) {
+          if (r && !progressive) throw jpegError('an end-of-band run in a sequential scan');
+          eobrun = (1 << r) - 1 + (r ? receive(r) : 0); break;
+        }
+        k += 16; if (k > se + 1) throw pastBand(); continue;
+      }
+      k += r;
+      if (k > se) throw pastBand();
+      coeffs[at + ZIGZAG[k]] = acValue(size, al);
+      k++;
+    }
+  };
+  const acRefine = (s, coeffs, at) => {
+    const p1 = 1 << al, m1 = -1 << al;
+    let k = ss;
+    if (eobrun <= 0) {
+      for (; k <= se; k++) {
+        const rs = decode(s.ac);
+        let r = rs >> 4, value = 0;
+        const size = rs & 15;
+        if (size) { if (size !== 1) throw jpegError('a bad refinement code'); value = receive(1) ? p1 : m1; }
+        else if (r !== 15) { eobrun = 1 << r; if (r) eobrun += receive(r); break; }
+        for (; k <= se; k++) {
+          const z = at + ZIGZAG[k];
+          if (coeffs[z] !== 0) { if (receive(1) && (coeffs[z] & p1) === 0) coeffs[z] += coeffs[z] >= 0 ? p1 : m1; }
+          else if (--r < 0) break;
+        }
+        if (r >= 0 || (value && k > se)) throw jpegError('coefficients past the band');
+        if (value) coeffs[at + ZIGZAG[k]] = value;
+      }
+    }
+    if (eobrun > 0) {
+      for (; k <= se; k++) {
+        const z = at + ZIGZAG[k];
+        if (coeffs[z] !== 0 && receive(1) && (coeffs[z] & p1) === 0) coeffs[z] += coeffs[z] >= 0 ? p1 : m1;
+      }
+      eobrun--;
+    }
+  };
+  const block = !progressive ? baseline : ss === 0 ? (ah === 0 ? dcFirst : dcRefine) : (ah === 0 ? acFirst : acRefine);
+  for (const s of scan) s.component.pred = 0;
+  const first = scan[0].component;
+  const total = single ? first.blocksW * first.blocksH : frame.mcusX * frame.mcusY;
+  for (let unit = 0; unit < total; unit++) {
+    if (restartInterval && unit > 0 && unit % restartInterval === 0) restart(unit / restartInterval - 1);
+    if (single) {
+      const by = (unit / first.blocksW) | 0, bx = unit - by * first.blocksW;
+      block(scan[0], first.coeffs, (by * first.stride + bx) * 64);
+    } else {
+      const my = (unit / frame.mcusX) | 0, mx = unit - my * frame.mcusX;
+      for (const s of scan) {
+        const c = s.component;
+        for (let v = 0; v < c.v; v++) for (let h = 0; h < c.h; h++) block(s, c.coeffs, ((my * c.v + v) * c.stride + mx * c.h + h) * 64);
+      }
+    }
+  }
+  // The scan ends at a marker or EOF. A final complete interval may carry its next restart marker, once.
+  atMarker();
+  if (bytes[pos] === 0xFF && bytes[pos + 1] >= 0xD0 && bytes[pos + 1] <= 0xD7) {
+    if (!restartInterval || total % restartInterval || bytes[pos + 1] !== 0xD0 + ((total / restartInterval - 1) & 7)) throw jpegError('a restart marker out of order');
+    pos += 2;
+    while (pos + 1 < bytes.length && bytes[pos] === 0xFF && bytes[pos + 1] === 0xFF) pos++;
+  }
+  if (pos < bytes.length && !(bytes[pos] === 0xFF && pos + 1 < bytes.length && bytes[pos + 1] !== 0 && bytes[pos + 1] !== 0xFF)) throw jpegError('bytes left over after a scan');
+  return pos;
+}

package/jpeg-ans.d.mts

@@ -0,0 +1,3 @@
+// SPDX-License-Identifier: MIT
+// Same checked JPEG surface; effort 2 also compares a completed ANS candidate.
+export * from './jpeg.mjs';