[mrgoonie]

Summary

Allow explicitly configured public Worker service bindings to serve approved image directories on sibling Cloudflare hostnames. This keeps the network guard for other same-zone sources and requires both the existing image source allowlist and an unambiguous, uniquely identified service prefix.

Relates to #9; PHP image locking on Windows remains unresolved.

Security and behavior

• The binding receives only a sanitized GET to the approved path; it receives no source query, visitor credentials or cookies. Redirects, non-raster content and oversized images are rejected; failures do not fall back to public fetch.
• Service tickets bind the endpoint origin and service ID, and configuration is revalidated on redemption. Overlapping prefixes and duplicate IDs are rejected. Operators must change the ID when repointing a binding.
• Binding calls bypass hostname security rules; the documented directories must contain public images only.

Testing

• Windows: PHP_BIN=C:/tools/php/php.exe pnpm test: 407 passed, 5 skipped; pnpm typecheck, pnpm build, pnpm test:bundlers, git diff --check passed.
• Miniflare/workerd with two Workers and an actual service binding: ticket 200, approved PNG 200, disallowed path 403; target verified host/path and missing query, cookie and authorization.
• Independent security review completed after fixing overlapping bindings and bounding invalid-ticket decryption.

Compatibility

Opt-in server configuration; existing integrations keep their behavior. Rotate a service ID when repointing its binding. No PHP or widget API change.

Docs follow-up: nextlevelbuilder/dewee-web-v2#134.