safe-upload 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Sivaguru Ravi
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,135 @@
-# Temporary Holding Version
+# safe-upload
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+See and remove what a photo reveals **before it leaves the device**: GPS position, capture time and time zone, phone and lens serial numbers, owner names, people tagged in the photo, edit history, embedded previews that still show the uncropped picture, hidden motion-photo video, and AI generation prompts.
+
+- **Lossless.** Metadata is cut out of the file; the compressed picture stays byte-for-byte identical. No re-encoding, no quality loss.
+- **Choose what goes.** Everything is grouped into 14 plain-language categories (`location`, `device`, `people`, `hidden`, …). Remove all of them, or only some.
+- **JPEG, PNG, WebP, HEIC and AVIF.** EXIF, XMP, IPTC/Photoshop, PNG text chunks, HEIF items, and data stored after the end of a JPEG.
+- **Zero dependencies, runs anywhere.** Browsers, Web Workers, Node ≥ 18, Deno, Bun. About 20 KB minified and gzipped.
+- **Optional on-device face redaction** (`safe-upload/browser`), using MediaPipe if you install it.
+
+Live demo: **https://reveal.shinigami-rog.cc**, which runs this package entirely in your browser.
+
+## Install
+
+```bash
+npm install safe-upload
+```
+
+## Clean a photo before uploading it
+
+```js
+import { strip } from 'safe-upload';
+
+input.addEventListener('change', async () => {
+  const file = input.files[0];
+  const clean = await strip(file); // default: remove everything except camera settings and C2PA credentials
+  const body = new FormData();
+  body.append('photo', new Blob([clean.bytes], { type: clean.mime }), file.name);
+  await fetch('/upload', { method: 'POST', body });
+});
+```
+
+## See what a photo reveals
+
+```js
+import { inspect } from 'safe-upload';
+
+const report = await inspect(file);
+report.categories;          // ['location', 'people', 'thumbnail', 'device', 'time', ...]
+report.summary.gps;         // { latitude: 29.55935, longitude: -95.09065, altitude: 12, direction: 271 }
+report.summary.device;      // 'Canon EOS R5'
+report.summary.serialNumbers; // ['DEMO-0123456789']
+report.summary.people;      // names tagged in the photo
+report.thumbnails;          // embedded preview images (Uint8Array JPEGs)
+report.hidden;              // motion-photo video, depth maps, gain maps…
+report.findings;            // every item: { category, label, value, source, removable }
+```
+
+## Remove only some categories
+
+```js
+const r = await strip(file, { remove: ['location', 'people', 'hidden'] });
+r.removed;   // categories that were present and are now gone
+r.retained;  // items this format cannot drop in place (e.g. HEIC thumbnails)
+r.notes;     // e.g. "The XMP metadata block was removed as a whole."
+```
+
+`remove: 'all'` removes every category, including camera settings and content credentials.
+
+### Categories
+
+| Category | Removed by default | Examples |
+|----------|:-:|----------|
+| `location` | ✓ | GPS position, altitude, camera direction, city/country fields |
+| `people` | ✓ | People tagged by photo apps (XMP regions, PersonInImage) |
+| `hidden` | ✓ | Motion-photo video, depth maps, HDR gain maps, data after the image |
+| `thumbnail` | ✓ | Embedded previews, which can show the picture before cropping |
+| `author` | ✓ | Artist, owner, copyright, creator contact |
+| `device` | ✓ | Make, model, body and lens serial numbers, maker notes |
+| `time` | ✓ | Capture/edit dates, time zone, GPS timestamp |
+| `ai` | ✓ | Prompts and workflows written by image generators |
+| `descriptions` | ✓ | Captions, keywords, titles, comments |
+| `history` | ✓ | Edit history, document IDs, source documents |
+| `software` | ✓ | Apps used to create or edit the picture |
+| `other` | ✓ | Vendor or unrecognised blocks |
+| `provenance` |  | C2PA content credentials |
+| `settings` |  | Exposure, aperture, ISO, focal length |
+
+Orientation, colour profiles and everything needed to display the picture are always kept.
+
+## Check the file name
+
+Browsers send the file name with every upload, and camera apps and messengers write the date, device and app into it (`PXL_20241016_103122123.MP.jpg` says: Pixel, 16 Oct 2024 10:31 UTC, motion photo).
+
+```js
+import { inspectFileName, neutralFileName } from 'safe-upload';
+
+inspectFileName('Screenshot_20241016-103122_WhatsApp.jpg').findings;
+// [{ label: 'Screenshot', value: 'Android screenshot' }, { label: 'Taken (from file name)', value: '2024-10-16 10:31:22' }, { label: 'App on screen', value: 'WhatsApp' }]
+
+form.append('photo', cleanBlob, neutralFileName(clean.mime)); // "photo.jpg"
+```
+
+## Hide faces on-device (browser)
+
+```bash
+npm install safe-upload @mediapipe/tasks-vision
+```
+
+```js
+import { detectFaces, redact, pad } from 'safe-upload/browser';
+
+const opts = { wasmBaseUrl: '/mediapipe/', modelAssetUrl: '/models/blaze_face_full_range.tflite' }; // self-host both
+const faces = await detectFaces(imageElement, opts);
+const regions = faces.map((f) => pad(f, 0.22, imageElement.naturalWidth, imageElement.naturalHeight));
+const { blob } = await redact(file, regions, { style: 'pixelate', remove: ['location', 'device'] });
+```
+
+### Find revealing objects
+
+Metadata is only half of it. `detectObjects` (EfficientDet-Lite0, 80 everyday classes, on-device) and `objectHints` point out screens, papers, vehicles, home interiors, street signs and similar things that can identify people or places:
+
+```js
+import { detectObjects, objectHints } from 'safe-upload/browser';
+
+const objects = await detectObjects(imageElement, { wasmBaseUrl: '/mediapipe/', modelAssetUrl: '/models/efficientdet_lite0.tflite' });
+for (const h of objectHints(objects)) console.log(h.title, '-', h.hint); // "1 screen - Screens can show messages, emails, maps…"
+```
+
+`redact` re-encodes the picture (it has to, the pixels change) and copies over only the EXIF categories you keep, with orientation reset to upright. Detection can miss faces, so always show the result and let people add boxes themselves. Copy `vision_wasm_internal.js` and `.wasm` from `@mediapipe/tasks-vision/wasm`, and the model from MediaPipe's model page, to your own server.
+
+## How it is tested
+
+Every format is checked against two independent tools: **exiftool** must find none of the removed tags in the output, and **ImageMagick's pixel signature** must be identical before and after. A Playwright suite runs the demo site in Chromium, Firefox, WebKit and a mobile profile, and fails if the page makes any request to another origin.
+
+## Limits
+
+- XMP and IPTC blocks are removed as a whole when any category inside them is removed.
+- The vendor MakerNote is dropped whenever EXIF has to be rewritten, because its internal offsets break when moved.
+- In HEIC and AVIF, embedded thumbnails and auxiliary images (depth, gain map) cannot be removed in place. They are reported in `retained`. Convert the photo to remove them.
+- Metadata hidden in the pixels themselves (watermarks, steganography) is out of scope.
+
+## Licence
+
+MIT © Sivaguru Ravi

package/dist/api.d.ts

@@ -0,0 +1,25 @@
+import type { Category, Format, Input, Report, StripOptions, StripResult } from './types.js';
+export declare function toBytes(input: Input): Promise<Uint8Array>;
+export declare function detectFormat(b: Uint8Array): Format;
+export declare class UnsupportedFormatError extends Error {
+    constructor();
+}
+/** Read every metadata block in a photo and describe what it reveals. Never modifies the input. */
+export declare function inspect(input: Input): Promise<Report>;
+/**
+ * Remove metadata by category without re-encoding: the compressed picture stays byte-identical.
+ * Default removes everything except camera settings and content credentials.
+ */
+export declare function strip(input: Input, options?: StripOptions): Promise<StripResult>;
+/** Convenience: strip and return a Blob ready for FormData/fetch. */
+export declare function stripToBlob(input: Input, options?: StripOptions): Promise<Blob>;
+/**
+ * Copy the kept EXIF categories from an original photo into a freshly encoded JPEG or PNG
+ * (for example after blurring faces on a canvas). Orientation is reset to 1 because canvas
+ * output is already upright; thumbnails are dropped because they no longer match.
+ */
+export declare function carryExif(original: Input, encoded: Input, options: StripOptions & {
+    width: number;
+    height: number;
+}): Promise<Uint8Array>;
+export declare function describeCategory(c: Category): import("./categories.js").CategoryInfo;

package/dist/api.js

@@ -0,0 +1,172 @@
+import { concat, putU16be } from './bytes.js';
+import { CATEGORY_INFO, resolveRemove, sortCategories } from './categories.js';
+import { Collector } from './collect.js';
+import { buildTiff, EXIF_HEADER, parseTiff } from './exif.js';
+import { heifFormat, inspectHeif, stripHeif } from './heif.js';
+import { inspectJpeg, isJpeg, parseJpeg, stripJpeg } from './jpeg.js';
+import { insertPngExif, inspectPng, isPng, stripPng } from './png.js';
+import { inspectWebp, isWebp, stripWebp } from './webp.js';
+const MIME = {
+    jpeg: 'image/jpeg',
+    png: 'image/png',
+    webp: 'image/webp',
+    heic: 'image/heic',
+    avif: 'image/avif',
+    unknown: 'application/octet-stream',
+};
+export async function toBytes(input) {
+    if (input instanceof Uint8Array)
+        return input;
+    if (input instanceof ArrayBuffer)
+        return new Uint8Array(input);
+    if (typeof Blob !== 'undefined' && input instanceof Blob)
+        return new Uint8Array(await input.arrayBuffer());
+    throw new TypeError('Expected a Blob, File, ArrayBuffer or Uint8Array');
+}
+export function detectFormat(b) {
+    if (isJpeg(b))
+        return 'jpeg';
+    if (isPng(b))
+        return 'png';
+    if (isWebp(b))
+        return 'webp';
+    return heifFormat(b) ?? 'unknown';
+}
+export class UnsupportedFormatError extends Error {
+    constructor() {
+        super('Unsupported file type. safe-upload reads JPEG, PNG, WebP, HEIC and AVIF.');
+        this.name = 'UnsupportedFormatError';
+    }
+}
+/** Read every metadata block in a photo and describe what it reveals. Never modifies the input. */
+export async function inspect(input) {
+    const b = await toBytes(input);
+    const format = detectFormat(b);
+    const c = new Collector(format, MIME[format], b.length);
+    switch (format) {
+        case 'jpeg':
+            inspectJpeg(b, c);
+            break;
+        case 'png':
+            await inspectPng(b, c);
+            break;
+        case 'webp':
+            inspectWebp(b, c);
+            break;
+        case 'heic':
+        case 'avif':
+            inspectHeif(b, c);
+            break;
+        default:
+            throw new UnsupportedFormatError();
+    }
+    return c.finish();
+}
+/**
+ * Remove metadata by category without re-encoding: the compressed picture stays byte-identical.
+ * Default removes everything except camera settings and content credentials.
+ */
+export async function strip(input, options = {}) {
+    const b = await toBytes(input);
+    const format = detectFormat(b);
+    const remove = resolveRemove(options.remove);
+    let r;
+    switch (format) {
+        case 'jpeg':
+            r = stripJpeg(b, remove);
+            break;
+        case 'png':
+            r = await stripPng(b, remove);
+            break;
+        case 'webp':
+            r = stripWebp(b, remove);
+            break;
+        case 'heic':
+        case 'avif':
+            r = stripHeif(b, remove);
+            break;
+        default:
+            throw new UnsupportedFormatError();
+    }
+    return {
+        bytes: r.bytes,
+        mime: MIME[format],
+        format,
+        lossless: true,
+        removed: sortCategories(r.removed),
+        retained: r.retained,
+        notes: [...new Set(r.notes)],
+    };
+}
+/** Convenience: strip and return a Blob ready for FormData/fetch. */
+export async function stripToBlob(input, options = {}) {
+    const r = await strip(input, options);
+    return new Blob([r.bytes], { type: r.mime });
+}
+/**
+ * Copy the kept EXIF categories from an original photo into a freshly encoded JPEG or PNG
+ * (for example after blurring faces on a canvas). Orientation is reset to 1 because canvas
+ * output is already upright; thumbnails are dropped because they no longer match.
+ */
+export async function carryExif(original, encoded, options) {
+    const src = await toBytes(original);
+    const dst = await toBytes(encoded);
+    const tiffBytes = await extractTiff(src);
+    if (!tiffBytes)
+        return dst;
+    const tiff = parseTiff(tiffBytes);
+    if (!tiff)
+        return dst;
+    const remove = resolveRemove(options.remove);
+    remove.add('thumbnail');
+    const built = buildTiff(tiff, { remove, orientation: 1, dimensions: { width: options.width, height: options.height } });
+    if (!built.bytes)
+        return dst;
+    if (isJpeg(dst)) {
+        const j = parseJpeg(dst);
+        // Insert after JFIF APP0 if present, otherwise right after SOI.
+        const jfif = j.head.find((s) => s.kind === 'jfif');
+        const at = jfif ? jfif.end : 2;
+        const payload = concat([EXIF_HEADER, built.bytes]);
+        const seg = new Uint8Array(4 + payload.length);
+        seg[0] = 0xff;
+        seg[1] = 0xe1;
+        putU16be(seg, 2, payload.length + 2);
+        seg.set(payload, 4);
+        return concat([dst.subarray(0, at), seg, dst.subarray(at)]);
+    }
+    if (isPng(dst))
+        return insertPngExif(dst, built.bytes);
+    return dst;
+}
+/** Locate the raw TIFF/EXIF block inside a JPEG, PNG, WebP or HEIF file. */
+async function extractTiff(b) {
+    const fmt = detectFormat(b);
+    if (fmt === 'jpeg') {
+        const seg = parseJpeg(b).head.find((s) => s.kind === 'exif');
+        return seg ? seg.payload.subarray(6) : null;
+    }
+    // For other formats reuse inspect-time parsing via a tiny collector.
+    const holder = {};
+    const c = new Collector(fmt, '', b.length);
+    const orig = c.tiff.bind(c);
+    c.tiff = (bytes, source, removable) => {
+        holder.tiff ??= bytes;
+        return orig(bytes, source, removable);
+    };
+    try {
+        if (fmt === 'webp')
+            inspectWebp(b, c);
+        else if (fmt === 'heic' || fmt === 'avif')
+            inspectHeif(b, c);
+        else if (fmt === 'png')
+            await inspectPng(b, c);
+    }
+    catch {
+        return null;
+    }
+    return holder.tiff ?? null;
+}
+export function describeCategory(c) {
+    return CATEGORY_INFO[c];
+}

package/dist/browser/canvas.d.ts

@@ -0,0 +1,20 @@
+export type AnyCanvas = OffscreenCanvas | HTMLCanvasElement;
+export type Ctx = OffscreenCanvasRenderingContext2D | CanvasRenderingContext2D;
+/** iOS Safari refuses canvases larger than this many pixels (4096 × 4096). */
+export declare const IOS_CANVAS_LIMIT = 16777216;
+export declare function makeCanvas(width: number, height: number): AnyCanvas;
+export declare function ctx2d(c: AnyCanvas): Ctx;
+export declare function encode(c: AnyCanvas, type: string, quality: number): Promise<Blob>;
+export interface Decoded {
+    source: ImageBitmap | HTMLImageElement;
+    width: number;
+    height: number;
+    close(): void;
+}
+/**
+ * Decode a photo with its EXIF orientation applied, so pixels are upright. Falls back to an
+ * <img> element when createImageBitmap refuses very large pictures (seen on mobile Safari).
+ */
+export declare function decodeImage(input: Blob): Promise<Decoded>;
+/** @deprecated use decodeImage */
+export declare function decode(input: Blob): Promise<ImageBitmap>;

package/dist/browser/canvas.js

@@ -0,0 +1,53 @@
+/** iOS Safari refuses canvases larger than this many pixels (4096 × 4096). */
+export const IOS_CANVAS_LIMIT = 16_777_216;
+export function makeCanvas(width, height) {
+    if (typeof OffscreenCanvas !== 'undefined')
+        return new OffscreenCanvas(width, height);
+    const c = document.createElement('canvas');
+    c.width = width;
+    c.height = height;
+    return c;
+}
+export function ctx2d(c) {
+    const ctx = c.getContext('2d');
+    if (!ctx)
+        throw new Error('2D canvas is not available');
+    return ctx;
+}
+export async function encode(c, type, quality) {
+    if ('convertToBlob' in c)
+        return c.convertToBlob({ type, quality });
+    return new Promise((resolve, reject) => c.toBlob((b) => (b ? resolve(b) : reject(new Error('Canvas encoding failed'))), type, quality));
+}
+/**
+ * Decode a photo with its EXIF orientation applied, so pixels are upright. Falls back to an
+ * <img> element when createImageBitmap refuses very large pictures (seen on mobile Safari).
+ */
+export async function decodeImage(input) {
+    try {
+        const b = await createImageBitmap(input, { imageOrientation: 'from-image' });
+        return { source: b, width: b.width, height: b.height, close: () => b.close() };
+    }
+    catch {
+        if (typeof document === 'undefined')
+            throw unsupported();
+        const url = URL.createObjectURL(input);
+        try {
+            const img = new Image();
+            img.src = url;
+            await img.decode();
+            return { source: img, width: img.naturalWidth, height: img.naturalHeight, close: () => URL.revokeObjectURL(url) };
+        }
+        catch {
+            URL.revokeObjectURL(url);
+            throw unsupported();
+        }
+    }
+}
+function unsupported() {
+    return new Error('This browser cannot decode this image format (HEIC needs Safari). Metadata removal still works.');
+}
+/** @deprecated use decodeImage */
+export async function decode(input) {
+    return createImageBitmap(input, { imageOrientation: 'from-image' });
+}

package/dist/browser/faces.d.ts

@@ -0,0 +1,26 @@
+import { visionSupported, VisionUnavailableError, type Box } from './mediapipe.js';
+export type { Box };
+export interface FaceBox extends Box {
+    score: number;
+}
+export interface FaceDetectionOptions {
+    /** URL of the folder holding MediaPipe's vision_wasm_internal.{js,wasm} (self-host it). */
+    wasmBaseUrl: string;
+    /** URL of a BlazeFace .tflite model, e.g. blaze_face_full_range.tflite (self-host it). */
+    modelAssetUrl: string;
+    /** Minimum detection confidence, 0..1. Default 0.4 (favours recall: a missed face is worse). */
+    minScore?: number;
+}
+/** @deprecated use visionSupported */
+export declare const faceDetectionSupported: typeof visionSupported;
+export { VisionUnavailableError as FaceDetectionUnavailableError };
+/** Load the detector ahead of time (downloads the WASM runtime and model). */
+export declare function preloadFaceDetector(o: FaceDetectionOptions): Promise<void>;
+/**
+ * Find faces on-device. Runs on the whole picture and on overlapping tiles so small faces in
+ * large group photos are found too. Coordinates are in the source's pixel space.
+ */
+export declare function detectFaces(source: ImageBitmap | HTMLImageElement | HTMLCanvasElement, options: FaceDetectionOptions): Promise<FaceBox[]>;
+export declare function clampBox<T extends Box>(b: T, W: number, H: number): T;
+/** Grow a box by a fraction on each side (faces need margin for hair and ears). */
+export declare function pad(b: Box, fraction: number, maxW: number, maxH: number): Box;

package/dist/browser/faces.js

@@ -0,0 +1,68 @@
+import { ctx2d, makeCanvas } from './canvas.js';
+import { containment, iou, loadVision, sizeOf, tiles, visionSupported, VisionUnavailableError } from './mediapipe.js';
+let cached;
+/** @deprecated use visionSupported */
+export const faceDetectionSupported = visionSupported;
+export { VisionUnavailableError as FaceDetectionUnavailableError };
+async function getDetector(o) {
+    const key = `${o.wasmBaseUrl}|${o.modelAssetUrl}|${o.minScore ?? 0.4}`;
+    if (cached?.key === key)
+        return cached.detector;
+    const detector = (async () => {
+        const { vision, fileset } = await loadVision(o.wasmBaseUrl);
+        return (await vision.FaceDetector.createFromOptions(fileset, {
+            baseOptions: { modelAssetPath: o.modelAssetUrl, delegate: 'CPU' },
+            runningMode: 'IMAGE',
+            minDetectionConfidence: o.minScore ?? 0.4,
+            minSuppressionThreshold: 0.3,
+        }));
+    })();
+    cached = { key, detector };
+    detector.catch(() => (cached = undefined));
+    return detector;
+}
+/** Load the detector ahead of time (downloads the WASM runtime and model). */
+export async function preloadFaceDetector(o) {
+    await getDetector(o);
+}
+/**
+ * Find faces on-device. Runs on the whole picture and on overlapping tiles so small faces in
+ * large group photos are found too. Coordinates are in the source's pixel space.
+ */
+export async function detectFaces(source, options) {
+    const det = await getDetector(options);
+    const { W, H } = sizeOf(source);
+    const found = [];
+    for (const t of tiles(W, H)) {
+        const scale = Math.min(1, 1024 / Math.max(t.width, t.height));
+        const cw = Math.max(1, Math.round(t.width * scale));
+        const ch = Math.max(1, Math.round(t.height * scale));
+        const ctx = ctx2d(makeCanvas(cw, ch));
+        ctx.drawImage(source, t.x, t.y, t.width, t.height, 0, 0, cw, ch);
+        // Raw pixels go straight into WASM memory.
+        for (const d of det.detect(ctx.getImageData(0, 0, cw, ch)).detections) {
+            const bb = d.boundingBox;
+            if (bb)
+                found.push({ x: t.x + bb.originX / scale, y: t.y + bb.originY / scale, width: bb.width / scale, height: bb.height / scale, score: d.categories[0]?.score ?? 0 });
+        }
+    }
+    found.sort((a, b) => b.score - a.score);
+    const kept = [];
+    for (const f of found)
+        if (!kept.some((k) => iou(k, f) > 0.3 || containment(k, f) > 0.6))
+            kept.push(f);
+    return kept.map((f) => clampBox(f, W, H));
+}
+export function clampBox(b, W, H) {
+    const x = Math.max(0, b.x);
+    const y = Math.max(0, b.y);
+    return { ...b, x, y, width: Math.min(b.width - (x - b.x), W - x), height: Math.min(b.height - (y - b.y), H - y) };
+}
+/** Grow a box by a fraction on each side (faces need margin for hair and ears). */
+export function pad(b, fraction, maxW, maxH) {
+    const dx = b.width * fraction;
+    const dy = b.height * fraction;
+    const x = Math.max(0, b.x - dx);
+    const y = Math.max(0, b.y - dy * 1.4);
+    return { x, y, width: Math.min(maxW - x, b.width + 2 * dx), height: Math.min(maxH - y, b.height + dy * 2.4) };
+}

package/dist/browser/index.d.ts

@@ -0,0 +1,9 @@
+export { detectFaces, preloadFaceDetector, pad, faceDetectionSupported, FaceDetectionUnavailableError } from './faces.js';
+export type { FaceBox, FaceDetectionOptions } from './faces.js';
+export { detectObjects, objectHints } from './objects.js';
+export type { DetectedObject, ObjectDetectionOptions, ObjectHint, HintKind } from './objects.js';
+export { visionSupported, VisionUnavailableError } from './mediapipe.js';
+export type { Box } from './mediapipe.js';
+export { redact } from './redact.js';
+export type { RedactOptions, RedactResult, RedactStyle } from './redact.js';
+export { decode, decodeImage, IOS_CANVAS_LIMIT } from './canvas.js';

package/dist/browser/index.js

@@ -0,0 +1,5 @@
+export { detectFaces, preloadFaceDetector, pad, faceDetectionSupported, FaceDetectionUnavailableError } from './faces.js';
+export { detectObjects, objectHints } from './objects.js';
+export { visionSupported, VisionUnavailableError } from './mediapipe.js';
+export { redact } from './redact.js';
+export { decode, decodeImage, IOS_CANVAS_LIMIT } from './canvas.js';

package/dist/browser/mediapipe.d.ts

@@ -0,0 +1,28 @@
+/** Loads MediaPipe's vision module and WASM runtime once, shared by face and object detection. */
+type Vision = typeof import('@mediapipe/tasks-vision');
+type Fileset = Awaited<ReturnType<Vision['FilesetResolver']['forVisionTasks']>>;
+/** MediaPipe needs WebGL even on its CPU path. False when the browser has WebGL turned off. */
+export declare function visionSupported(): boolean;
+export declare class VisionUnavailableError extends Error {
+    constructor();
+}
+export declare function loadVision(wasmBaseUrl: string): Promise<{
+    vision: Vision;
+    fileset: Fileset;
+}>;
+export interface Box {
+    x: number;
+    y: number;
+    width: number;
+    height: number;
+}
+export declare function sizeOf(source: ImageBitmap | HTMLImageElement | HTMLCanvasElement): {
+    W: number;
+    H: number;
+};
+/** Whole picture plus overlapping tiles, so small things in large photos are found too. */
+export declare function tiles(W: number, H: number): Box[];
+export declare function iou(a: Box, b: Box): number;
+/** Overlap relative to the smaller box, to merge a thing found whole and again in a tile. */
+export declare function containment(a: Box, b: Box): number;
+export {};

package/dist/browser/mediapipe.js

@@ -0,0 +1,69 @@
+let cache;
+/** MediaPipe needs WebGL even on its CPU path. False when the browser has WebGL turned off. */
+export function visionSupported() {
+    try {
+        const c = typeof OffscreenCanvas !== 'undefined' ? new OffscreenCanvas(1, 1) : document.createElement('canvas');
+        return !!(c.getContext('webgl2') ?? c.getContext('webgl'));
+    }
+    catch {
+        return false;
+    }
+}
+export class VisionUnavailableError extends Error {
+    constructor() {
+        super('On-device detection needs WebGL, which is turned off in this browser.');
+        this.name = 'VisionUnavailableError';
+    }
+}
+export function loadVision(wasmBaseUrl) {
+    if (cache?.base === wasmBaseUrl)
+        return cache.promise;
+    if (!visionSupported())
+        throw new VisionUnavailableError();
+    const promise = (async () => {
+        const vision = await import('@mediapipe/tasks-vision');
+        const fileset = await vision.FilesetResolver.forVisionTasks(wasmBaseUrl);
+        return { vision, fileset };
+    })();
+    cache = { base: wasmBaseUrl, promise };
+    promise.catch(() => (cache = undefined));
+    return promise;
+}
+export function sizeOf(source) {
+    return 'naturalWidth' in source ? { W: source.naturalWidth, H: source.naturalHeight } : { W: source.width, H: source.height };
+}
+/** Whole picture plus overlapping tiles, so small things in large photos are found too. */
+export function tiles(W, H) {
+    const out = [{ x: 0, y: 0, width: W, height: H }];
+    const longest = Math.max(W, H);
+    const grids = longest > 2400 ? [2, 3] : longest > 1000 ? [2] : [];
+    for (const n of grids) {
+        const tw = W / n;
+        const th = H / n;
+        for (let gy = 0; gy < n; gy++)
+            for (let gx = 0; gx < n; gx++) {
+                const x = Math.max(0, gx * tw - tw * 0.25);
+                const y = Math.max(0, gy * th - th * 0.25);
+                out.push({ x, y, width: Math.min(W - x, tw * 1.5), height: Math.min(H - y, th * 1.5) });
+            }
+    }
+    return out;
+}
+export function iou(a, b) {
+    const x1 = Math.max(a.x, b.x);
+    const y1 = Math.max(a.y, b.y);
+    const x2 = Math.min(a.x + a.width, b.x + b.width);
+    const y2 = Math.min(a.y + a.height, b.y + b.height);
+    const inter = Math.max(0, x2 - x1) * Math.max(0, y2 - y1);
+    const union = a.width * a.height + b.width * b.height - inter;
+    return union > 0 ? inter / union : 0;
+}
+/** Overlap relative to the smaller box, to merge a thing found whole and again in a tile. */
+export function containment(a, b) {
+    const x1 = Math.max(a.x, b.x);
+    const y1 = Math.max(a.y, b.y);
+    const x2 = Math.min(a.x + a.width, b.x + b.width);
+    const y2 = Math.min(a.y + a.height, b.y + b.height);
+    const inter = Math.max(0, x2 - x1) * Math.max(0, y2 - y1);
+    return inter / Math.min(a.width * a.height, b.width * b.height);
+}