Crate imgx 

imgx — image proxy and transform server. Module tree mirrors zimgx’s src/*.zig 1:1 for reviewability; see docs/INVARIANTS.md for the behaviors that must survive the port.

All unsafe is quarantined in the imgx-vips crate (the FFI/audit boundary) — this crate forbids it entirely.

Modules

cache

Cache interface. Ported from src/cache/cache.zig. Zig used a manual vtable (fat pointer + fn-ptr table) for dynamic dispatch; Rust’s trait system replaces that directly. The backend set is closed (Memory, Noop, R2, Tiered), so TieredCache is generic over its L1/L2 backends rather than using dyn Cache — no need for object safety here.

config

Configuration for imgx.

http

origin

router

URL routing. Ported from src/router.zig. See docs/INVARIANTS.md INV-4 (path traversal is never reachable) and INV-5 (fixed image/ prefix, OPTIONS segment comes first, source image path is the remainder). Pure logic, no I/O – testable in isolation.

s3

server

HTTP server wiring. Ported from src/server.zig, on axum/tokio instead of Zig’s std.http.Server + bounded thread pool (see the approved plan at /Users/christopherw/.claude/plans/recursive-meandering-crescent.md). CPU-bound vips work runs in spawn_blocking gated by a Semaphore (permits = available_parallelism) rather than a fixed 256-thread pool with an atomic connection counter; the invariant that survives is “reject new work under saturation rather than queueing it unboundedly,” not the specific mechanism.

transform