hey

.c8rc.json

@@ -0,0 +1,5 @@
+{
+  "include": ["dist/**", "src/**"],
+  "reporter": ["text-summary", "json-summary", "html"],
+  "report-dir": "coverage"
+}

.gitattributes

@@ -0,0 +1 @@
+tests/unicode/*.txt text eol=lf

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,76 @@
+name: Bug report
+description: Something doesn't behave as expected
+type: Bug
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for reporting this! A short script that shows the problem helps us a lot. For questions about using ImageScript, our [Discord](https://discord.gg/8hPrwAH) is a great place.
+
+  - type: dropdown
+    id: area
+    attributes:
+      label: What is affected?
+      options:
+        - Decoding or encoding an image format
+        - Image manipulation (resize, crop, rotate, filters, color)
+        - Compositing or drawing
+        - Animation (GIF, APNG, WebP)
+        - Text rendering
+        - SVG rendering
+        - Performance or memory usage
+        - Something else
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: ImageScript version
+      placeholder: "3.13.1"
+    validations:
+      required: true
+
+  - type: input
+    id: runtime
+    attributes:
+      label: Runtime and version
+      placeholder: "Node.js 22.13, Deno 2.1, Bun 1.2, Chrome 130, Cloudflare Workers, ..."
+    validations:
+      required: true
+
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened, and what did you expect?
+      description: Screenshots of the result are welcome.
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Code to reproduce
+      render: javascript
+      placeholder: |
+        import { Image } from 'imagescript';
+
+        const image = new Image(64, 64);
+        // ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: files
+    attributes:
+      label: Files
+      description: |
+        Input images, fonts or SVGs that are needed to reproduce the problem. You can drag and drop them here.
+        GitHub doesn't accept every format (for example AVIF, JPEG XL or TIFF), so those work best inside a `.zip`.
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Error output
+      description: Stack trace or console output, if there is any.
+      render: shell

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Questions and help
+    url: https://discord.gg/8hPrwAH
+    about: Ask about using ImageScript in our Discord server.
+  - name: Security vulnerability
+    url: https://github.com/imagescript/ImageScript/security/advisories/new
+    about: Report security issues privately through a GitHub security advisory.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,29 @@
+name: Feature request
+description: Suggest a new function, option or format
+type: Feature
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for sharing your idea! Knowing what you're trying to build helps us find the best way to support it.
+
+  - type: textarea
+    id: use-case
+    attributes:
+      label: What are you trying to do?
+      description: Describe your use case and where ImageScript doesn't cover it yet.
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: What could the solution look like?
+      description: A short code sketch of the API you have in mind is perfect, but a description works too.
+      render: typescript
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: What do you do today?
+      description: Workarounds or other libraries you've used for this.

.github/workflows/bench.yml

@@ -0,0 +1,69 @@
+name: bench
+
+# runs the library comparison in bench/ and commits the results (results.json, installs.json, charts, README) to the
+# default branch. release.yml runs it after a regular release reached npm, measuring the released version; can also
+# be run by hand from the Actions tab, measuring the version bench/package.json has (or the one given)
+on:
+  workflow_call:
+    inputs:
+      version:
+        description: ImageScript version to measure (release.yml passes the released one)
+        type: string
+        default: ''
+  workflow_dispatch:
+    inputs:
+      version:
+        description: ImageScript version to measure (empty keeps bench/package.json's)
+        type: string
+        default: ''
+
+permissions:
+  contents: write
+
+concurrency:
+  group: bench
+  cancel-in-progress: false
+
+jobs:
+  bench:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: bench
+    steps:
+    - uses: actions/checkout@v7
+      with:
+        ref: ${{ github.event.repository.default_branch }}
+    - uses: actions/setup-node@v7
+      with:
+        node-version: 24.x
+
+    - run: npm ci --no-audit --no-fund
+    # a version that was just published can take some minutes to show up on the registry (3.6.0 took more than 2.5);
+    # npm ci cached the package's versions from before, which --prefer-online skips
+    - if: inputs.version != ''
+      run: |
+        for attempt in $(seq 20); do
+          npm install --save-exact --prefer-online --no-audit --no-fund "imagescript@$VERSION" && exit 0
+          sleep 30
+        done
+        exit 1
+      env:
+        VERSION: ${{ inputs.version }}
+
+    - run: node run.js
+    - run: node installs.js
+    - run: node report.js
+
+    # pushes with GITHUB_TOKEN don't trigger other workflows; rebases onto anything pushed meanwhile
+    - run: |
+        git add -A .
+        if git diff --cached --quiet; then echo "nothing changed"; exit 0; fi
+        git config user.name "github-actions[bot]"
+        git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+        git commit -m "benchmark ImageScript $(node -p "require('./node_modules/imagescript/package.json').version")"
+        for attempt in 1 2 3; do
+          git push && exit 0
+          git pull --rebase
+        done
+        exit 1

.github/workflows/coverage.yml

@@ -0,0 +1,84 @@
+name: coverage
+
+# measures the test coverage (npm run coverage) of every pushed branch and pull requests from forks, and how it
+# changed: compared with the commit before the push on master, else with where the branch (or pull request) left
+# master, measured in the same job. The job summary shows it; pushes to master get it as a commit comment, pushes to a
+# branch with a pull request as a comment on it (one, updated by later pushes). Pull requests from forks have no
+# write access: only the job summary
+on:
+  push:
+    branches: ['**']
+  pull_request:
+
+concurrency:
+  group: coverage-${{ github.event_name }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  coverage:
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+    - uses: actions/checkout@v7
+      with:
+        fetch-depth: 0
+    - uses: actions/setup-node@v7
+      with:
+        node-version: 24.x
+
+    - run: npm install
+    - run: npm run coverage
+
+    # the base, measured in a second checkout: skipped without one (a new branch, a force push that dropped it, a
+    # base from before npm run coverage existed), and a base whose tests fail just gives no comparison
+    - id: base
+      continue-on-error: true
+      run: |
+        if [ "$EVENT" = pull_request ]; then base=$(git merge-base "$PR_BASE" HEAD); name="the pull request's base"
+        elif [ "$REF" = refs/heads/master ]; then base=$BEFORE; name="the previous commit on master"
+        else base=$(git merge-base origin/master HEAD); name="master where the branch left it"; fi
+        if [ -z "$base" ] || ! git cat-file -e "$base^{commit}" 2>/dev/null || [ "$base" = "$(git rev-parse HEAD)" ]; then
+          echo "no base to compare with"; exit 0
+        fi
+        git worktree add -q ../base "$base"
+        cd ../base
+        if ! node -e "process.exit(require('./package.json').scripts?.coverage ? 0 : 1)"; then echo "the base has no npm run coverage"; exit 0; fi
+        npm install && npm run coverage
+        echo "summary=$PWD/coverage/coverage-summary.json" >> "$GITHUB_OUTPUT"
+        echo "root=$PWD" >> "$GITHUB_OUTPUT"
+        echo "name=$name (${base:0:7})" >> "$GITHUB_OUTPUT"
+      env:
+        EVENT: ${{ github.event_name }}
+        REF: ${{ github.ref }}
+        BEFORE: ${{ github.event.before }}
+        PR_BASE: ${{ github.event.pull_request.base.sha }}
+    - if: steps.base.outputs.summary
+      run: node scripts/coverage-report.js "$SUMMARY" "$ROOT"
+      env:
+        SUMMARY: ${{ steps.base.outputs.summary }}
+        ROOT: ${{ steps.base.outputs.root }}
+        BASE_NAME: ${{ steps.base.outputs.name }}
+    - run: cat coverage/report.md >> "$GITHUB_STEP_SUMMARY"
+
+    - if: github.event_name == 'push' && github.ref == 'refs/heads/master'
+      run: gh api "repos/$REPOSITORY/commits/$SHA/comments" -F body=@coverage/report.md
+      env:
+        GH_TOKEN: ${{ github.token }}
+        REPOSITORY: ${{ github.repository }}
+        SHA: ${{ github.sha }}
+
+    # the pull request of the pushed branch, if any: its coverage comment is updated, or posted the first time
+    - if: github.event_name == 'push' && github.ref != 'refs/heads/master'
+      run: |
+        pr=$(gh pr list --head "$BRANCH" --state open --json number --jq '.[0].number')
+        if [ -z "$pr" ]; then echo "no pull request"; exit 0; fi
+        comment=$(gh api "repos/$REPOSITORY/issues/$pr/comments" --paginate --jq '.[] | select(.body | startswith("<!-- coverage -->")) | .id' | head -1)
+        if [ -n "$comment" ]; then gh api -X PATCH "repos/$REPOSITORY/issues/comments/$comment" -F body=@coverage/report.md
+        else gh api "repos/$REPOSITORY/issues/$pr/comments" -F body=@coverage/report.md; fi
+      env:
+        GH_TOKEN: ${{ github.token }}
+        REPOSITORY: ${{ github.repository }}
+        BRANCH: ${{ github.ref_name }}

.github/workflows/docs.yml

@@ -0,0 +1,52 @@
+name: docs
+
+# publishes the documentation to GitHub Pages (imagescript.dev). release.yml runs it after a release reached
+# npm, so the site documents what is on npm; can also be run by hand from the Actions tab
+on:
+  workflow_call:
+    inputs:
+      version:
+        description: version to document (release.yml passes the released one; empty keeps package.json's)
+        type: string
+        default: ''
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v7
+    - uses: actions/setup-node@v7
+      with:
+        node-version: 24.x
+
+    - run: npm install
+    - if: inputs.version != ''
+      run: node scripts/version.js "$VERSION"
+      env:
+        VERSION: ${{ inputs.version }}
+    - run: npm run docs
+
+    - uses: actions/configure-pages@v6
+    - uses: actions/upload-pages-artifact@v5
+      with:
+        path: docs
+
+  deploy:
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+    - id: deployment
+      uses: actions/deploy-pages@v5

.github/workflows/jsr.yml

@@ -0,0 +1,43 @@
+name: jsr
+
+# publishes the TypeScript sources to JSR (@matmen/imagescript), authenticated through GitHub OIDC (the package is
+# linked to this repository on jsr.io). release.yml runs it after npm; can also be run by hand from the Actions tab
+on:
+  workflow_call:
+    inputs:
+      version:
+        description: version to publish (release.yml passes the released one; empty keeps jsr.json's)
+        type: string
+        default: ''
+  workflow_dispatch:
+    inputs:
+      version:
+        description: version to publish (empty keeps jsr.json's)
+        type: string
+        default: ''
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    environment:
+      name: jsr
+      url: https://jsr.io/@matmen/imagescript/versions
+    steps:
+    - uses: actions/checkout@v7
+    - if: inputs.version != ''
+      uses: actions/setup-node@v7
+      with:
+        node-version: 24.x
+    - if: inputs.version != ''
+      run: node scripts/version.js "$VERSION"
+      env:
+        VERSION: ${{ inputs.version }}
+    - uses: denoland/setup-deno@v2
+      with:
+        deno-version: v2.x
+    # setting the version changes files, which deno publish otherwise refuses
+    - run: deno publish --allow-dirty