PureJsImage v0.6.0

Added

• Added first-party JPEG 2000 / JP2 decoding for common Part 1 grayscale and RGB still images,
  including reversible 5/3 and irreversible 9/7 reconstruction, all five progression orders,
  multiple tiles, 1-16-bit unsigned samples, strict container validation, public pipeline
  conversion, and checksum-pinned fixtures from independent encoders.
• Added public-domain real-photograph JP2 fixtures with exact OpenJPEG oracle hashes, structured
  container and codestream corruption regressions, a deterministic JP2 mutation campaign, decoded
  allocation-limit tests, and isolated cold/warm RSS gates for the documented full-frame fallback.
• Added ordered, composable spatial stages: crop-after-resize, multiple resize stages, clockwise
  rotate() with arbitrary-angle bilinear sampling, vertical flip(), and horizontal flop().
• Added opt-in keepExif() and keepIcc() pipeline operations with JPEG, PNG, and WebP metadata
  round trips, TIFF ICC round trips, orientation normalization after pixel reorientation, and
  explicit errors for unsupported preservation combinations.
• Added a transform-to-JPEG benchmark profile covering quarter-turn and arbitrary rotation,
  crop-after-resize with a second resize, and combined flip/flop workflows, with isolated timing,
  peak RSS, dimensions, pinned output-pixel validation, and an equivalent-workflow Jimp comparison.
• Added a cross-codec transform contract that runs the full ordered transform chain from every
  supported decoder through JPEG output, plus focused arbitrary-rotation coverage for grayscale,
  RGB, and RGBA sample formats.
• Added a contributor guide covering tests, benchmarks, modular feature design, documentation,
  changelog entries, AI-assisted changes, MIT licensing, and conflict-free pull requests to main.
• Added a repository release skill with explicit authority, validation, packaging, publishing,
  provenance, and post-release consistency gates.
• Added a private vulnerability disclosure policy that defines the dependency-free runtime boundary
  while keeping CI, build, credential, and published-artifact supply-chain risks in scope.
• Added weekly and change-triggered CodeQL analysis for JavaScript and TypeScript using the extended
  security query suite.
• Added runtime validation for custom ImageSource reads, normalizing short, oversized, detached,
  and rejected reads into contextual ImageError results before codec parsing.
• Added a release-gated deterministic corruption campaign with hundreds of bit flips across a
  committed benchmark seed for every codec, saved raw-exception reproducers, and a checked-in
  regression corpus that automatically turns promoted crashes into permanent tests.

Changed

• Kept arbitrary-angle rotation memory bounded with a temporary 32x32 tile spool and small
  destination blocks, without per-pixel promises or temporary sample arrays.