←
xmoj — Image CDN & Screenshot API Roadmap
Project timeline & milestones
completed
10
cancelled
1
planned
3
JunJul
2026-05-04 → 2026-05-04
2026-05-04 → 2026-05-04
2026-05-04 → 2026-05-04
2026-05-04 → 2026-05-04
2026-05-04 → 2026-05-04
2026-05-04 → 2026-05-04
2026-05-04 → 2026-05-04
2026-05-04 → 2026-05-04
2026-05-04 → 2026-05-04
2026-05-04 → 2026-05-04
2026-05-04 → 2026-05-04
2026-05-15 → 2026-05-22
2026-05-25 → 2026-06-08
2026-05-25 → 2026-06-08
Milestones Detail
✅ Image transform endpoint (Photon WASM)
completed
Drop-in wsrv.nl format. Resize/crop/WebP conversion via Rust→WASM Photon. 1-year edge cache.
2026-05-04 → 2026-05-04
✅ Screenshot endpoint /shot (Browser Rendering)
completed
Drop-in thum.io path format. Lazy-load placeholder + 7-day cache. CF Browser Rendering backend.
2026-05-04 → 2026-05-04
✅ Migrate 175 wsrv.nl refs across 29 projects
completed
Sed replace wsrv.nl → xmoj.com in source + bulk-redeploy. 0 stale wsrv URLs remain anywhere.
2026-05-04 → 2026-05-04
✅ Image optimization sweep (~7800 imgs, 14 sites)
completed
Wrap raw ![]()
through xmoj on all sites that had no CDN. paroki 2025, lifehack 5728, ayutingting 32 etc.
2026-05-04 → 2026-05-04
✅ Native UI redesign (mobile-first + bottom nav)
completed
Galaxy Fold-friendly. Dark mode auto, sticky topbar, scroll-snap stats strip, system fonts, safe-area insets.
2026-05-04 → 2026-05-04
✅ Live stats + arulez legal pages
completed
/stats live counters (transform/shot/placeholder/hit, 7-day series). /tos /privacy /cookie /disclaimer from arulez.com legal API, KV-cached 1 day.
2026-05-04 → 2026-05-04
✅ Security hardening (SSRF + per-IP rate limit)
completed
SSRF deny-list (RFC1918, IPv4-mapped IPv6, cloud metadata, .internal suffixes, hex/decimal IP encodings). Per-IP rate limit (50K our / 100 external) immune to Referer spoofing. Generic error msgs. CSP + nosniff globally.
2026-05-04 → 2026-05-04
✅ ETag + If-None-Match (conditional GET)
completed
SHA-1 sample(4096) + length-based ETag on transformed images. If-None-Match → 304 with X-Cache: HIT-304 saves bytes on conditional GET.
2026-05-04 → 2026-05-04
✅ Cost-savings dashboard on /stats
completed
7-day savings card. Estimates vs CF Image Resizing $0.50/1k transform + thum.io $0.001/shot retail. Display USD + IDR.
2026-05-04 → 2026-05-04
✅ GitHub repo + apple.vc portfolio entry
completed
Public repo at github.com/jwendyr/xmoj. Listed on apple.vc with finances + score + roadmap.
2026-05-04 → 2026-05-04
❌ AVIF output support
cancelled
CANCELLED: @jsquash/avif WASM is 3.5MB (vs Photon 1.5MB) and AVIF encode is 5-10× slower than WebP. User prioritized speed → trade-off not worth current. Revisit if CF lifts WASM size budget significantly.
2026-05-04 → 2026-05-04
📋 Per-domain analytics (top-callers leaderboard)
planned
Track which sites in OUR_DOMAINS use the most quota. Useful for ops + flagging unexpected callers.
2026-05-15 → 2026-05-22
📋 Smart-format negotiation (Accept header)
planned
Detect Accept: image/avif / image/webp from client and serve the smallest format the browser supports. Falls back to WebP if AVIF support uncertain.
2026-05-25 → 2026-06-08
📋 Vary-aware cache key (Accept + DPR)
planned
When smart-format ships, separate cache entries per Accept-mime + DPR so AVIF and WebP do not poison each other.
2026-05-25 → 2026-06-08