Scale both sides of a fit=cover image by the same amount (part of #282)

cropCentreAndResize cut the centre to whole source pixels and forced
that to the requested size, so the two sides were scaled by different
amounts: a 16x16 source at 100x60 came out squashed by 4%. It now
widens the centre to whole source pixels and lets thumbnail with a
centre crop scale that by the one amount next uses and cut the output
from it. thumbnail copies the scaled image into memory, which is larger
than the output by less than one scaled source pixel on each side.
TODO.md says so.

Model: opus-5-5

README.md

@@ -336,12 +336,6 @@ either side may be; so is a size with `fit=outside`, which scales the image to
 cover the size and so past it on one side, when that side would come out
 above 8192.
 
-An AVIF image of more than 16,777,216 pixels, the number 4096x4096 and 8192x2048
-have, is refused with 400 before anything is decoded, as its encode could take
-more than 40 seconds (see below). That includes `orig` of an AVIF source, and
-`auto` when it chooses AVIF, so a client whose `Accept` names `image/avif` but
-not `image/jxl` is refused such a size.
-
 The source image may be JPEG, PNG, GIF, WebP, AVIF or JPEG XL. The upstream's
 `Content-Type` must name its format, and the image's first bytes must match it.
 An upstream answering with any other `Content-Type`, SVG included, is refused
@@ -391,18 +385,14 @@ transcode that stops this way is answered 503 with the error
 ended. govips gives pixa no way to stop libvips once an encode has begun, so an
 encode keeps its slot until it finishes, which can be after
 `downstream_timeout`. The limit of 8192 on each side of the source and of the
-output, and for AVIF the limit of 16,777,216 pixels, bound how long that takes.
+output bounds how long that takes. With one libvips thread, as pixad runs it,
-With one libvips thread, as pixad runs it, encoding 8192x8192 random pixels
+encoding 8192x8192 random pixels takes up to about 1 second as JPEG, 15 as PNG,
-takes up to about 1 second as JPEG, 15 as PNG and 16 as GIF, the slowest of 8 or
+16 as GIF, 63 as WebP, 110 as AVIF and 96 as JPEG XL, the slowest of 8 or 16
-16 bits per sample, with or without an alpha channel. The WebP and JPEG XL
+bits per sample, with or without an alpha channel. WebP, AVIF and JPEG XL are
-encoders run below libvips' default effort, and AVIF at the lowest effort govips
+that slow only with an alpha channel: 8-bit RGB takes about 44, 53 and 28
-can set, so that no encode takes more than 40 seconds of the default
+seconds. Decoding such a source adds up to about 11 seconds. A WebP, AVIF or
-`downstream_timeout` of 60: at any quality and 8 or 16 bits per sample,
+JPEG XL encode can therefore hold its slot past the default `downstream_timeout`
-8192x8192 random pixels with an alpha channel take up to about 23 seconds as
+of 60 seconds.
-WebP and 27 as JPEG XL, and 4096x4096, 8192x2048 or 2048x8192 up to about 34 as
-AVIF, which at quality 85 would take about 96 at 8192x8192. Without an alpha
-channel they take up to about 16, 13 and 22 seconds. Decoding such a source adds
-up to about 11 seconds.
 
 The login form (`POST /`) is limited to 5 attempts per minute per client
 address, counting an IPv6 client by its /64; an attempt over the limit is
@@ -454,8 +444,7 @@ nor change what it asks for.
    sent with an empty format, or none, also makes a JPEG XL URL. Width and
    height both empty or `0` keep the original size; if only one of them is empty
    or `0`, that side is scaled to keep the image's proportions. A URL whose
-   scaled side would come out above 8192 answers 400, and so does an AVIF URL of
+   scaled side would come out above 8192 answers 400.
-   more than 16,777,216 pixels (see Routes).
 3. The page shows the URL, `https://<host>/v1/e/<token>/img.<format>`, and when
    it expires. `<host>` is the host the page was opened on, and the URL starts
    with `http` instead while `debug` is on. The name after the token is ignored

TODO.md

@@ -30,18 +30,18 @@ P2: security: per-origin rate limiting
 
 # Completed Steps
 
-- 2026-10-15 a WebP, AVIF or JPEG XL encode at the limits takes at most about 34
+- 2026-10-15 a thin source requested with `fit=cover` no longer makes libvips
-  seconds (closes #272): with one libvips thread, 8192x8192 random pixels with
+  build a huge image (closes #282): libvips' thumbnail scaled the whole source
-  an alpha channel took about 61 seconds to encode as WebP, 96 as AVIF and 81 as
+  to cover the requested size and copied that into memory before it cut out the
-  JPEG XL, so with the default `downstream_timeout` of 60 seconds such an image
+  centre, so an 8192x64 source at 8192x8192 made it allocate about 24 GiB, and
-  was never delivered, yet its encode held a processing slot to the end. WebP is
+  an 8192x1 source answered 500. The image processor now first cuts the centre
-  now saved at effort 2 and JPEG XL at effort 4, which take up to about 23 and
+  of the source, widened to whole source pixels, and thumbnail scales and cuts
-  27 seconds. AVIF was already at the lowest effort govips can set, so an AVIF
+  only that, by the same amount on both sides as before. What it copies into
-  output of more than 16,777,216 pixels is refused with 400 before anything is
+  memory is then larger than the output by less than one scaled source pixel on
-  decoded; 4096x4096, 8192x2048 or 2048x8192 takes up to about 34 seconds. Each
+  each side. With the runtime image's libvips and JPEG output at 8192x8192,
-  time is the slowest at any quality. Resizing with `fit=cover` already decodes
+  resident memory peaked at about 242 MiB for the 8192x64 source and 431 MiB for
-  the input, so the output's dimensions are worked out before resizing.
+  the 8192x1 one. The output can sit a fraction of an output pixel from where it
-  `README.md` gives the limit and the new times.
+  was.
 - 2026-10-15 the README says how a source URL with a query is written into an
   image URL, and the image route accepts it (closes #255): the query follows the
   source path after `%3F`. pixa now reads the image URL's path decoded once, so

internal/handlers/avif_too_large_internal_test.go

@@ -1,49 +0,0 @@
-package handlers
-
-import (
-	"fmt"
-	"log/slog"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-
-	"sneak.berlin/go/pixa/internal/imageprocessor"
-	"sneak.berlin/go/pixa/internal/imgcache"
-)
-
-// TestAVIFOutputTooLargeAnswers400 checks that respondImageError and
-// handleImageError, which answer the errors of the two image routes, answer
-// 400 naming the AVIF pixel limit when the image processor refuses an AVIF
-// output above it, wrapped as the service wraps it. The request's source only
-// goes into a log line, so it is left empty.
-func TestAVIFOutputTooLargeAnswers400(t *testing.T) {
-	t.Parallel()
-
-	h := &Handlers{log: slog.New(slog.DiscardHandler)}
-	err := fmt.Errorf("image processing failed: %w: 4097x4096",
-		imageprocessor.ErrAVIFOutputTooLarge)
-	wantBody := fmt.Sprintf("above %d pixels", imageprocessor.MaxAVIFOutputPixels)
-
-	plain := httptest.NewRecorder()
-	h.respondImageError(plain, &imgcache.ImageRequest{}, err)
-
-	encrypted := httptest.NewRecorder()
-	h.handleImageError(encrypted, err)
-
-	for name, rec := range map[string]*httptest.ResponseRecorder{
-		"respondImageError": plain, "handleImageError": encrypted,
-	} {
-		t.Logf("%s: status = %d, body = %q", name, rec.Code, rec.Body.String())
-
-		if rec.Code != http.StatusBadRequest {
-			t.Errorf("%s: status = %d, want %d",
-				name, rec.Code, http.StatusBadRequest)
-		}
-
-		if !strings.Contains(rec.Body.String(), wantBody) {
-			t.Errorf("%s: body = %q, want it to say %q",
-				name, rec.Body.String(), wantBody)
-		}
-	}
-}

internal/handlers/image.go

@@ -264,14 +264,6 @@ func (s *Handlers) respondImageError(
 		return
 	}
 
-	if errors.Is(err, imageprocessor.ErrAVIFOutputTooLarge) {
-		s.respondError(w, fmt.Sprintf("size too large for AVIF: the output "+
-			"would be above %d pixels", imageprocessor.MaxAVIFOutputPixels),
-			http.StatusBadRequest)
-
-		return
-	}
-
 	s.respondError(w, "internal error", http.StatusInternalServerError)
 }
 

internal/handlers/imageenc.go

@@ -170,10 +170,6 @@ func (s *Handlers) handleImageError(w http.ResponseWriter, err error) {
 		s.respondError(w, fmt.Sprintf("size too large for the source: the side "+
 			"computed from its proportions is above %d",
 			imageprocessor.MaxOutputDimension), http.StatusBadRequest)
-	case errors.Is(err, imageprocessor.ErrAVIFOutputTooLarge):
-		s.respondError(w, fmt.Sprintf("size too large for AVIF: the output "+
-			"would be above %d pixels", imageprocessor.MaxAVIFOutputPixels),
-			http.StatusBadRequest)
 	default:
 		s.log.Error("image request failed", "error", err)
 		s.respondError(w, "internal error", http.StatusInternalServerError)

internal/imageprocessor/avif_too_large_internal_test.go

@@ -1,64 +0,0 @@
-package imageprocessor
-
-import (
-	"bytes"
-	"errors"
-	"testing"
-)
-
-// TestImageProcessor_RefusesAVIFAboveMaxPixels verifies that an AVIF output
-// of more than MaxAVIFOutputPixels is refused with ErrAVIFOutputTooLarge
-// before anything is decoded, whatever size and fit give it, and that an AVIF
-// output of at most that many pixels, or one in another format, is not. The
-// input is a 64x32 PNG cut off in its pixel data: libvips reads its size from
-// its header but fails when it decodes it, so a request that gets that failure
-// was not refused, and a refusal came before any decoding.
-func TestImageProcessor_RefusesAVIFAboveMaxPixels(t *testing.T) {
-	t.Parallel()
-
-	whole := createTestPNG(t, 64, 32)
-	cutOff := whole[:len(whole)/2]
-
-	tests := []struct {
-		name          string
-		format        Format
-		width, height int
-		fit           FitMode
-		refused       bool
-	}{
-		{"AVIF at the limit", FormatAVIF, 4096, 4096, FitCover, false},
-		{"AVIF above the limit", FormatAVIF, 4096, 4097, FitCover, true},
-		{"WebP above the AVIF limit", FormatWebP, 4096, 4097, FitCover, false},
-		// FitInside does not enlarge, so the output stays 64x32
-		{"AVIF inside a larger size", FormatAVIF, 8192, 8192, FitInside, false},
-		// FitOutside scales 64x32 by 128 to cover 8192x1: 8192x4096
-		{"AVIF outside a smaller size", FormatAVIF, 8192, 1, FitOutside, true},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			_, err := New(Params{}).Process(t.Context(), bytes.NewReader(cutOff),
-				&Request{
-					Size:    Size{Width: tt.width, Height: tt.height},
-					Format:  tt.format,
-					FitMode: tt.fit,
-				})
-			t.Logf("Process() error = %v", err)
-
-			if tt.refused {
-				if !errors.Is(err, ErrAVIFOutputTooLarge) {
-					t.Errorf("Process() error = %v, want %v", err, ErrAVIFOutputTooLarge)
-				}
-
-				return
-			}
-
-			if err == nil || errors.Is(err, ErrAVIFOutputTooLarge) {
-				t.Errorf("Process() error = %v, want the failure to decode "+
-					"the cut-off input", err)
-			}
-		})
-	}
-}

internal/imageprocessor/encoder_settings_internal_test.go

@@ -77,10 +77,10 @@ func TestImageProcessor_PNGIsCompressed(t *testing.T) {
 	}
 }
 
-// TestImageProcessor_WebPAtEffort2 verifies that WebP is saved at effort 2,
+// TestImageProcessor_WebPAtDefaultEffort verifies that WebP is saved at
-// not libvips' default of 4: the output is the size of the same image saved
+// libvips' default effort, 4: the output is the size of the same image saved
-// at effort 2.
+// at that effort.
-func TestImageProcessor_WebPAtEffort2(t *testing.T) {
+func TestImageProcessor_WebPAtDefaultEffort(t *testing.T) {
 	t.Parallel()
 
 	input := createTestJPEG(t, 200, 150)
@@ -90,14 +90,14 @@ func TestImageProcessor_WebPAtEffort2(t *testing.T) {
 	want, _, err := decode(t, input).ExportWebp(&vips.WebpExportParams{
 		StripMetadata:   true,
 		Quality:         85,
-		ReductionEffort: 2,
+		ReductionEffort: 4,
 	})
 	if err != nil {
 		t.Fatalf("ExportWebp() error = %v", err)
 	}
 
 	if size != int64(len(want)) {
-		t.Errorf("WebP output is %d bytes, want %d, the size at effort 2",
+		t.Errorf("WebP output is %d bytes, want %d, the size at effort 4",
 			size, len(want))
 	}
 }
@@ -143,29 +143,3 @@ func TestImageProcessor_AVIFAtEffort1(t *testing.T) {
 			"and 8 bits", size, len(want))
 	}
 }
-
-// TestImageProcessor_JPEGXLAtEffort4 verifies that JPEG XL is saved at
-// effort 4, not libvips' default of 7: the output is the size of the same
-// image saved at effort 4, with the distance exportJXL gives quality 85.
-func TestImageProcessor_JPEGXLAtEffort4(t *testing.T) {
-	t.Parallel()
-
-	input := createTestJPEG(t, 200, 150)
-
-	size := processedSize(t, input, &Request{Format: FormatJXL, Quality: 85})
-
-	params := vips.NewJxlExportParams()
-	params.Quality = 85
-	params.Distance = jxlDistance(85)
-	params.Effort = 4
-
-	want, _, err := decode(t, input).ExportJxl(params)
-	if err != nil {
-		t.Fatalf("ExportJxl() error = %v", err)
-	}
-
-	if size != int64(len(want)) {
-		t.Errorf("JPEG XL output is %d bytes, want %d, the size at effort 4",
-			size, len(want))
-	}
-}

internal/imageprocessor/fit_cover_internal_test.go

@@ -0,0 +1,268 @@
+package imageprocessor
+
+import (
+	"bytes"
+	"image"
+	"image/color"
+	"image/png"
+	"math"
+	"testing"
+)
+
+// TestImageProcessor_FitCoverServesThinSource verifies that FitCover serves
+// a thin source at the requested size. An 8192x1 source scaled to cover
+// 8192x8192 is 8192 times as long as the output on its long side. The centre
+// of an 8192x1 source with the proportions of 1x8192 is 1/8192 of a pixel
+// wide. Each case is also turned on its side.
+func TestImageProcessor_FitCoverServesThinSource(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name                    string
+		inputWidth, inputHeight int
+		size                    Size
+	}{
+		{"8192x1 at 8192x8192", 8192, 1, Size{Width: 8192, Height: 8192}},
+		{"8192x1 at 1x8192", 8192, 1, Size{Width: 1, Height: 8192}},
+		{"1x8192 at 8192x8192", 1, 8192, Size{Width: 8192, Height: 8192}},
+		{"1x8192 at 8192x1", 1, 8192, Size{Width: 8192, Height: 1}},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			input := createTestJPEG(t, tt.inputWidth, tt.inputHeight)
+
+			result, err := New(Params{}).Process(t.Context(),
+				bytes.NewReader(input),
+				&Request{Size: tt.size, Format: FormatJPEG, FitMode: FitCover})
+			if err != nil {
+				t.Fatalf("Process() error = %v", err)
+			}
+
+			defer func() { _ = result.Content.Close() }()
+
+			t.Logf("Process() made %dx%d", result.Width, result.Height)
+
+			if result.Width != tt.size.Width || result.Height != tt.size.Height {
+				t.Errorf("Process() made %dx%d, want %dx%d",
+					result.Width, result.Height, tt.size.Width, tt.size.Height)
+			}
+		})
+	}
+}
+
+// createBandsPNG creates a PNG of three equal bands, red, green and blue,
+// side by side when it is wider than tall and top to bottom otherwise.
+func createBandsPNG(t *testing.T, width, height int) []byte {
+	t.Helper()
+
+	bands := []color.RGBA{
+		{R: 255, A: 255},
+		{G: 255, A: 255},
+		{B: 255, A: 255},
+	}
+
+	img := image.NewRGBA(image.Rect(0, 0, width, height))
+	for y := range height {
+		for x := range width {
+			band := 3 * y / height
+			if width > height {
+				band = 3 * x / width
+			}
+
+			img.Set(x, y, bands[band])
+		}
+	}
+
+	return encodePNG(t, img)
+}
+
+// TestImageProcessor_FitCoverCropsTheCentre verifies that FitCover keeps the
+// centre of the source: a 300x100 source of red, green and blue bands side
+// by side, or a 100x300 one with them top to bottom, comes out at 50x50 as
+// its green band.
+func TestImageProcessor_FitCoverCropsTheCentre(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name                    string
+		inputWidth, inputHeight int
+	}{
+		{"bands side by side", 300, 100},
+		{"bands top to bottom", 100, 300},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			input := createBandsPNG(t, tt.inputWidth, tt.inputHeight)
+
+			result, err := New(Params{}).Process(t.Context(),
+				bytes.NewReader(input),
+				&Request{
+					Size:    Size{Width: 50, Height: 50},
+					Format:  FormatPNG,
+					FitMode: FitCover,
+				})
+			if err != nil {
+				t.Fatalf("Process() error = %v", err)
+			}
+
+			defer func() { _ = result.Content.Close() }()
+
+			output, err := png.Decode(result.Content)
+			if err != nil {
+				t.Fatalf("failed to decode output: %v", err)
+			}
+
+			bounds := output.Bounds()
+			t.Logf("Process() made %dx%d", bounds.Dx(), bounds.Dy())
+
+			if bounds.Dx() != 50 || bounds.Dy() != 50 {
+				t.Fatalf("Process() made %dx%d, want 50x50",
+					bounds.Dx(), bounds.Dy())
+			}
+
+			// Resampling may blend a little of the bands beside the
+			// green one into the output's edges.
+			for y := bounds.Min.Y; y < bounds.Max.Y; y++ {
+				for x := bounds.Min.X; x < bounds.Max.X; x++ {
+					r, g, b, _ := output.At(x, y).RGBA()
+					if r>>8 > 64 || g>>8 < 192 || b>>8 > 64 {
+						t.Fatalf("output pixel %d,%d is %d,%d,%d, want green",
+							x, y, r>>8, g>>8, b>>8)
+					}
+				}
+			}
+		})
+	}
+}
+
+// The greys of createSquarePNG, and the grey halfway between them.
+const (
+	backgroundGrey = 192
+	squareGrey     = 64
+	halfwayGrey    = (backgroundGrey + squareGrey) / 2
+)
+
+// createSquarePNG creates a grey PNG side pixels square with a darker grey
+// square squareSide pixels wide in its centre.
+func createSquarePNG(t *testing.T, side, squareSide int) []byte {
+	t.Helper()
+
+	first := (side - squareSide) / 2
+	last := first + squareSide - 1
+
+	img := image.NewGray(image.Rect(0, 0, side, side))
+	for y := range side {
+		for x := range side {
+			grey := uint8(backgroundGrey)
+			if x >= first && x <= last && y >= first && y <= last {
+				grey = squareGrey
+			}
+
+			img.SetGray(x, y, color.Gray{Y: grey})
+		}
+	}
+
+	return encodePNG(t, img)
+}
+
+// squareLength returns how long the square is along greys, the greys of a
+// row or column of the output that crosses it: the distance between the
+// first and the last point where greys passes halfwayGrey, or 0 when there
+// is no such point. Resampling blurs the square's edges over several
+// pixels, and each point is placed between the two pixels on either side
+// of it in proportion to their greys, so the length is measured to a
+// fraction of a pixel.
+func squareLength(greys []float64) float64 {
+	first, last := -1.0, -1.0
+
+	for i := 1; i < len(greys); i++ {
+		before, after := greys[i-1], greys[i]
+		if (before > halfwayGrey) == (after > halfwayGrey) {
+			continue
+		}
+
+		point := float64(i-1) + (before-halfwayGrey)/(before-after)
+		if first < 0 {
+			first = point
+		}
+
+		last = point
+	}
+
+	return last - first
+}
+
+// TestImageProcessor_FitCoverKeepsProportions verifies that FitCover scales
+// both sides of the source by the same amount: a square in the centre of
+// the source comes out square. Its width and height are measured along the
+// output's middle row and column.
+func TestImageProcessor_FitCoverKeepsProportions(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name             string
+		side, squareSide int
+		size             Size
+	}{
+		{"16x16 at 100x60", 16, 8, Size{Width: 100, Height: 60}},
+		{"16x16 at 60x100", 16, 8, Size{Width: 60, Height: 100}},
+		{"10x10 at 100x35", 10, 2, Size{Width: 100, Height: 35}},
+		{"10x10 at 35x100", 10, 2, Size{Width: 35, Height: 100}},
+		{"64x64 at 300x100", 64, 16, Size{Width: 300, Height: 100}},
+		{"64x64 at 100x300", 64, 16, Size{Width: 100, Height: 300}},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			input := createSquarePNG(t, tt.side, tt.squareSide)
+
+			result, err := New(Params{}).Process(t.Context(),
+				bytes.NewReader(input),
+				&Request{Size: tt.size, Format: FormatPNG, FitMode: FitCover})
+			if err != nil {
+				t.Fatalf("Process() error = %v", err)
+			}
+
+			defer func() { _ = result.Content.Close() }()
+
+			output, err := png.Decode(result.Content)
+			if err != nil {
+				t.Fatalf("failed to decode output: %v", err)
+			}
+
+			bounds := output.Bounds()
+			if bounds.Dx() != tt.size.Width || bounds.Dy() != tt.size.Height {
+				t.Fatalf("Process() made %dx%d, want %dx%d",
+					bounds.Dx(), bounds.Dy(), tt.size.Width, tt.size.Height)
+			}
+
+			row := make([]float64, bounds.Dx())
+			for x := range row {
+				r, _, _, _ := output.At(x, bounds.Dy()/2).RGBA()
+				row[x] = float64(r >> 8)
+			}
+
+			column := make([]float64, bounds.Dy())
+			for y := range column {
+				r, _, _, _ := output.At(bounds.Dx()/2, y).RGBA()
+				column[y] = float64(r >> 8)
+			}
+
+			width, height := squareLength(row), squareLength(column)
+			t.Logf("square is %.2f wide and %.2f high", width, height)
+
+			if width == 0 || math.Abs(width-height) > 0.5 {
+				t.Errorf("square is %.2f wide and %.2f high, want it square",
+					width, height)
+			}
+		})
+	}
+}

internal/imageprocessor/imageprocessor.go

@@ -142,19 +142,6 @@ const MaxOutputDimension = 8192
 // requested size.
 var ErrOutputTooLarge = errors.New("output image dimensions exceed maximum")
 
-// MaxAVIFOutputPixels is the most pixels an AVIF output may have, so that an
-// encode takes at most 40 seconds of the default downstream_timeout of 60
-// seconds; AVIF is already at the lowest effort govips can set (avifEffort).
-// With one thread, as pixad runs libvips, saving 4096x4096, 8192x2048 or
-// 2048x8192 random pixels with an alpha channel takes up to about 34
-// seconds, the slowest at any quality and at 8 or 16 bits per sample, and
-// 5120x4096 at 8 bits already takes about 36.
-const MaxAVIFOutputPixels = 4096 * 4096
-
-// ErrAVIFOutputTooLarge is returned, before anything is decoded, when an AVIF
-// output would have more than MaxAVIFOutputPixels pixels.
-var ErrAVIFOutputTooLarge = errors.New("AVIF output has too many pixels")
-
 // ErrUnsupportedOutputFormat is returned when the requested output format is
 // not supported.
 var ErrUnsupportedOutputFormat = errors.New("unsupported output format")
@@ -223,8 +210,7 @@ func New(params Params) *ImageProcessor {
 // ErrTooManyImages. When ctx has ended once Process has a slot, or before it
 // encodes, it returns ctx's error and gives the slot back. govips gives pixa
 // no way to stop libvips once an encode has begun, so an encode keeps its
-// slot until it finishes. An AVIF output of more than MaxAVIFOutputPixels is
+// slot until it finishes.
-// refused with ErrAVIFOutputTooLarge before anything is decoded.
 func (p *ImageProcessor) Process(
 	ctx context.Context,
 	input io.Reader,
@@ -237,9 +223,18 @@ func (p *ImageProcessor) Process(
 
 	defer release()
 
-	data, err := p.readInput(input)
+	// Read input with a size limit to prevent unbounded memory consumption.
+	// We read at most maxInputBytes+1 so we can detect if the input exceeds
+	// the limit without consuming additional memory.
+	limited := io.LimitReader(input, p.maxInputBytes+1)
+
+	data, err := io.ReadAll(limited)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("failed to read input: %w", err)
+	}
+
+	if int64(len(data)) > p.maxInputBytes {
+		return nil, ErrInputDataTooLarge
 	}
 
 	// govips picks the libvips loader from the input's first bytes with
@@ -282,28 +277,20 @@ func (p *ImageProcessor) Process(
 		return nil, err
 	}
 
+	// Resize if needed
+	if targetWidth != origWidth || targetHeight != origHeight {
+		err := p.resize(img, targetWidth, targetHeight, req.FitMode)
+		if err != nil {
+			return nil, fmt.Errorf("failed to resize: %w", err)
+		}
+	}
+
 	// orig is the source's own format; encode refuses an empty format
 	outputFormat := req.Format
 	if outputFormat == FormatOriginal {
 		outputFormat = sourceFormat
 	}
 
-	// Determine output dimensions; too large ones are refused before
-	// resizing, which with FitCover already decodes the input
-	outputWidth, outputHeight, err := outputDimensions(origWidth, origHeight,
-		targetWidth, targetHeight, req.FitMode, outputFormat)
-	if err != nil {
-		return nil, err
-	}
-
-	// Resize if needed
-	if targetWidth != origWidth || targetHeight != origHeight {
-		err := p.resize(img, outputWidth, outputHeight, req.FitMode)
-		if err != nil {
-			return nil, fmt.Errorf("failed to resize: %w", err)
-		}
-	}
-
 	// Encode to target format
 	output, err := p.encode(ctx, img, outputFormat, req.Quality)
 	if err != nil {
@@ -456,23 +443,6 @@ func (p *ImageProcessor) acquireSlot(ctx context.Context) (func(), error) {
 	return release, nil
 }
 
-// readInput reads input with a size limit to prevent unbounded memory
-// consumption, refusing more than maxInputBytes with ErrInputDataTooLarge. It
-// reads at most maxInputBytes+1 so it can detect if the input exceeds the
-// limit without consuming additional memory.
-func (p *ImageProcessor) readInput(input io.Reader) ([]byte, error) {
-	data, err := io.ReadAll(io.LimitReader(input, p.maxInputBytes+1))
-	if err != nil {
-		return nil, fmt.Errorf("failed to read input: %w", err)
-	}
-
-	if int64(len(data)) > p.maxInputBytes {
-		return nil, ErrInputDataTooLarge
-	}
-
-	return data, nil
-}
-
 // detectFormat returns the format string for a govips image type.
 func (p *ImageProcessor) detectFormat(imageType vips.ImageType) string {
 	switch imageType {
@@ -497,89 +467,101 @@ func (p *ImageProcessor) detectFormat(imageType vips.ImageType) string {
 	}
 }
 
-// outputDimensions returns the dimensions resize gives an image of imgWidth x
+// resize resizes the image according to the fit mode. With FitOutside one
-// imgHeight for the target dimensions and fit mode, without resizing it, and
+// side can come out larger than requested; when it would be above
-// refuses an output too large for format. With FitOutside one side can come
+// MaxOutputDimension, resize returns ErrOutputTooLarge without resizing.
-// out larger than the target; when it would be above MaxOutputDimension,
-// outputDimensions returns ErrOutputTooLarge. An AVIF output of more than
-// MaxAVIFOutputPixels is ErrAVIFOutputTooLarge.
-func outputDimensions(
-	imgWidth, imgHeight, width, height int, fit FitMode, format Format,
-) (int, int, error) {
-	scaleW := float64(width) / float64(imgWidth)
-	scaleH := float64(height) / float64(imgHeight)
-	outputWidth, outputHeight := width, height
-
-	switch fit {
-	case FitCover, FitFill, "":
-		// Cover crops, and fill stretches, to exactly the target dimensions
-
-	case FitContain:
-		// Fit within the target dimensions, maintaining aspect ratio
-		scale := min(scaleW, scaleH)
-		outputWidth = int(float64(imgWidth) * scale)
-		outputHeight = int(float64(imgHeight) * scale)
-
-	case FitInside:
-		// Same as contain, but only shrink
-		scale := min(scaleW, scaleH, 1)
-		outputWidth = int(float64(imgWidth) * scale)
-		outputHeight = int(float64(imgHeight) * scale)
-
-	case FitOutside:
-		// The smallest dimension fits, the other may exceed the target
-		scale := max(scaleW, scaleH)
-		outputWidth = int(float64(imgWidth) * scale)
-		outputHeight = int(float64(imgHeight) * scale)
-
-	default:
-		return 0, 0, fmt.Errorf("%w: %s", ErrInvalidFitMode, fit)
-	}
-
-	// The side FitOutside scales past the target is held to the maximum too
-	if max(outputWidth, outputHeight) > MaxOutputDimension {
-		return 0, 0, fmt.Errorf("%w: %dx%d is above %d", ErrOutputTooLarge,
-			outputWidth, outputHeight, MaxOutputDimension)
-	}
-
-	if format == FormatAVIF && outputWidth*outputHeight > MaxAVIFOutputPixels {
-		return 0, 0, fmt.Errorf("%w: %dx%d is above %d pixels",
-			ErrAVIFOutputTooLarge, outputWidth, outputHeight, MaxAVIFOutputPixels)
-	}
-
-	return outputWidth, outputHeight, nil
-}
-
-// resize resizes the image to width x height, the dimensions
-// outputDimensions gives for the fit mode.
 func (p *ImageProcessor) resize(
 	img *vips.ImageRef, width, height int, fit FitMode,
 ) error {
 	switch fit {
 	case FitCover, "":
-		// Resize and crop to fill exact dimensions (default)
+		// Crop the centre and resize to fill exact dimensions (default)
-		return img.Thumbnail(width, height, vips.InterestingCentre)
+		return cropCentreAndResize(img, width, height)
+
+	case FitContain:
+		// Resize to fit within dimensions, maintaining aspect ratio
+		imgW, imgH := img.Width(), img.Height()
+		scaleW := float64(width) / float64(imgW)
+		scaleH := float64(height) / float64(imgH)
+		scale := min(scaleW, scaleH)
+		newW := int(float64(imgW) * scale)
+		newH := int(float64(imgH) * scale)
+
+		return img.Thumbnail(newW, newH, vips.InterestingNone)
 
 	case FitFill:
 		// Resize to exact dimensions (may distort)
 		return img.ThumbnailWithSize(width, height, vips.InterestingNone, vips.SizeForce)
 
 	case FitInside:
-		// outputDimensions keeps the dimensions of an image that already fits
+		// Same as contain, but only shrink
-		if img.Width() == width && img.Height() == height {
+		if img.Width() <= width && img.Height() <= height {
-			return nil
+			return nil // Already fits
 		}
 
-		return img.Thumbnail(width, height, vips.InterestingNone)
+		imgW, imgH := img.Width(), img.Height()
+		scaleW := float64(width) / float64(imgW)
+		scaleH := float64(height) / float64(imgH)
+		scale := min(scaleW, scaleH)
+		newW := int(float64(imgW) * scale)
+		newH := int(float64(imgH) * scale)
 
-	case FitContain, FitOutside:
+		return img.Thumbnail(newW, newH, vips.InterestingNone)
-		return img.Thumbnail(width, height, vips.InterestingNone)
+
+	case FitOutside:
+		// Resize so smallest dimension fits, may exceed target on other dimension
+		imgW, imgH := img.Width(), img.Height()
+		scaleW := float64(width) / float64(imgW)
+		scaleH := float64(height) / float64(imgH)
+		scale := max(scaleW, scaleH)
+		newW := int(float64(imgW) * scale)
+		newH := int(float64(imgH) * scale)
+
+		// The dimension that exceeds the target is held to the maximum too
+		if newW > MaxOutputDimension || newH > MaxOutputDimension {
+			return fmt.Errorf("%w: %dx%d is above %d", ErrOutputTooLarge,
+				newW, newH, MaxOutputDimension)
+		}
+
+		return img.Thumbnail(newW, newH, vips.InterestingNone)
 
 	default:
 		return fmt.Errorf("%w: %s", ErrInvalidFitMode, fit)
 	}
 }
 
+// cropCentreAndResize scales img by the same amount on both sides, the
+// least that makes it cover width x height, and cuts the centre width x
+// height out of it, as libvips' thumbnail does with InterestingCentre.
+// thumbnail alone scales the whole image and copies the result into memory
+// before it cuts, and for a thin image that is far larger than the image or
+// the output: 8192x64 at 8192x8192 is 1048576x8192, about 24 GiB. So the
+// centre is cut from img first, widened to whole pixels of img, which adds
+// less than one pixel of img on each side, and thumbnail scales and cuts
+// only that.
+func cropCentreAndResize(img *vips.ImageRef, width, height int) error {
+	imgW, imgH := img.Width(), img.Height()
+
+	// An image wider than the requested proportions keeps its height and
+	// loses width down to imgH*width/height, any other keeps its width and
+	// loses height down to imgW*height/width. Half of what is lost comes
+	// off each side, rounded down to whole pixels, so the part kept holds
+	// all of the centre.
+	left, top := 0, 0
+	if imgW*height > imgH*width {
+		left = (imgW*height - imgH*width) / (2 * height) //nolint:mnd // each side
+	} else {
+		top = (imgH*width - imgW*height) / (2 * width) //nolint:mnd // each side
+	}
+
+	err := img.ExtractArea(left, top, imgW-2*left, imgH-2*top)
+	if err != nil {
+		return err
+	}
+
+	return img.Thumbnail(width, height, vips.InterestingCentre)
+}
+
 const defaultQuality = 85
 
 // encode encodes an image to the specified format. govips gives pixa no way
@@ -677,16 +659,11 @@ func exportGIF(img *vips.ImageRef) ([]byte, error) {
 	return output, err
 }
 
-// webpEffort is the WebP effort, from 0 (fastest) to 6. It is below libvips'
+// webpEffort is libvips' default WebP effort, from 0 (fastest) to 6.
-// default of 4 so that an encode takes at most 40 seconds of the default
+const webpEffort = 4
-// downstream_timeout of 60 seconds. With one thread, as pixad runs libvips,
-// saving an 8192x8192 image of random pixels with an alpha channel takes up
-// to about 23 seconds at 2, and up to about 16 without one, at any quality;
-// with an alpha channel, 3 takes about 50 seconds and 4 about 61.
-const webpEffort = 2
 
-// exportWebP encodes img as lossy WebP at quality and webpEffort, without
+// exportWebP encodes img as lossy WebP at quality and libvips' default
-// metadata.
+// effort, without metadata.
 func exportWebP(img *vips.ImageRef, quality int) ([]byte, error) {
 	output, _, err := img.ExportWebp(&vips.WebpExportParams{
 		StripMetadata:   true,
@@ -698,13 +675,12 @@ func exportWebP(img *vips.ImageRef, quality int) ([]byte, error) {
 }
 
 // avifEffort is the AVIF effort, from 0 (fastest) to 9; 1 is the lowest
-// govips can set. With one thread, as pixad runs libvips, 1 takes about 52
+// govips can set. With one thread, as pixad runs libvips, 1 takes about 51
-// seconds to save an 8192x8192 RGB image of random pixels at quality 85,
+// seconds to save an 8192x8192 RGB image of random pixels, and about 110
-// and about 96 with an alpha channel, against the default
+// with an alpha channel, the worst case, against the default
-// downstream_timeout of 60 seconds, so an AVIF output is held to
+// downstream_timeout of 60 seconds. On an image of milder noise, which 1
-// MaxAVIFOutputPixels. On an image of milder noise, which 1 saves in about
+// saves in about 12 seconds, 2 takes nearly a minute and libvips' default,
-// 12 seconds, 2 takes nearly a minute and libvips' default, 4, takes
+// 4, takes minutes.
-// minutes.
 const avifEffort = 1
 
 // avifBitdepth is the AVIF bit depth, 8 bits per sample for every image.
@@ -731,18 +707,10 @@ func exportAVIF(img *vips.ImageRef, quality int) ([]byte, error) {
 // JPEG that names none.
 const jxlResolution = 72 / 25.4
 
-// jxlEffort is the JPEG XL effort, from 1 (fastest) to 9. It is below
+// exportJXL encodes img as JPEG XL at quality, with libvips' default effort
-// libvips' default of 7 so that an encode takes at most 40 seconds of the
+// and without metadata. govips sends libvips a distance, the JPEG XL
-// default downstream_timeout of 60 seconds. With one thread, as pixad runs
+// encoder's own measure of quality, along with the quality, and libvips then
-// libvips, saving an 8192x8192 image of random pixels with an alpha channel
+// uses the distance alone, so the quality is also given as a distance.
-// takes up to about 27 seconds at 4, and up to about 13 without one, at any
-// quality; with an alpha channel, 5 takes about 43 seconds and 7 about 81.
-const jxlEffort = 4
-
-// exportJXL encodes img as JPEG XL at quality and jxlEffort, without
-// metadata. govips sends libvips a distance, the JPEG XL encoder's own
-// measure of quality, along with the quality, and libvips then uses the
-// distance alone, so the quality is also given as a distance.
 func exportJXL(img *vips.ImageRef, quality int) ([]byte, error) {
 	// libvips converts a CMYK image to sRGB before it saves WebP, AVIF or
 	// PNG, but cannot save one as JPEG XL. encode has already converted
@@ -781,7 +749,6 @@ func exportJXL(img *vips.ImageRef, quality int) ([]byte, error) {
 	params := vips.NewJxlExportParams()
 	params.Quality = quality
 	params.Distance = jxlDistance(quality)
-	params.Effort = jxlEffort
 
 	output, _, err := toSave.ExportJxl(params)
 	if err != nil {