ppings.
 */
function wp_get_image_editor_output_format( $filename, $mime_type ) {
	$output_format = array(
		'image/heic'          => 'image/jpeg',
		'image/heif'          => 'image/jpeg',
		'image/heic-sequence' => 'image/jpeg',
		'image/heif-sequence' => 'image/jpeg',
	);

	/**
	 * Filters the image editor output format mapping.
	 *
	 * Enables filtering the mime type used to save images. By default HEIC/HEIF images
	 * are converted to JPEGs.
	 *
	 * @see WP_Image_Editor::get_output_format()
	 *
	 * @since 5.8.0
	 * @since 6.7.0 The default was changed from an empty array to an array
	 *              containing the HEIC/HEIF images mime types.
	 *
	 * @param array<string, string> $output_format An array of mime type mappings. Maps a source mime type to a new
	 *                                             destination mime type. By default maps HEIC/HEIF input to JPEG output.
	 * @param string                $filename      Path to the image.
	 * @param string                $mime_type     The source image mime type.
	 */
	return apply_filters( 'image_editor_output_format', $output_format, $filename, $mime_type );
}

/**
 * Checks whether client-side media processing is enabled.
 *
 * Client-side media processing uses the browser's capabilities to handle
 * tasks like image resizing and compression before uploading to the server.
 *
 * @since 7.1.0
 *
 * @return bool Whether client-side media processing is enabled.
 */
function wp_is_client_side_media_processing_enabled(): bool {
	// This is due to SharedArrayBuffer requiring a secure context.
	$host    = strtolower( (string) strtok( $_SERVER['HTTP_HOST'] ?? '', ':' ) );
	$enabled = ( is_ssl() || 'localhost' === $host || str_ends_with( $host, '.localhost' ) );

	/**
	 * Filters whether client-side media processing is enabled.
	 *
	 * @since 7.1.0
	 *
	 * @param bool $enabled Whether client-side media processing is enabled. Default true if the page is served in a secure context.
	 */
	return (bool) apply_filters( 'wp_client_side_media_processing_enabled', $enabled );
}

/**
 * Sets a global JS variable to indicate that client-side media processing is enabled.
 *
 * @since 7.1.0
 */
function wp_set_client_side_media_processing_flag(): void {
	if ( ! wp_is_client_side_media_processing_enabled() ) {
		return;
	}

	wp_add_inline_script( 'wp-block-editor', 'window.__clientSideMediaProcessing = true;', 'before' );

	$chromium_version = wp_get_chromium_major_version();

	if ( null !== $chromium_version && $chromium_version >= 137 ) {
		wp_add_inline_script( 'wp-block-editor', 'window.__documentIsolationPolicy = true;', 'before' );
	}
}

/**
 * Returns the major Chrome/Chromium version from the current request's User-Agent.
 *
 * Matches all Chromium-based browsers (Chrome, Edge, Opera, Brave).
 *
 * @since 7.1.0
 *
 * @return int|null The major Chrome version, or null if not a Chromium browser.
 */
function wp_get_chromium_major_version(): ?int {
	if ( empty( $_SERVER['HTTP_USER_AGENT'] ) ) {
		return null;
	}
	if ( preg_match( '#Chrome/(\d+)#', $_SERVER['HTTP_USER_AGENT'], $matches ) ) {
		return (int) $matches[1];
	}
	return null;
}

/**
 * Enables cross-origin isolation in the block editor.
 *
 * Required for enabling SharedArrayBuffer for WebAssembly-based
 * media processing in the editor. Uses Document-Isolation-Policy
 * on supported browsers (Chromium 137+).
 *
 * Skips setup when a third-party page builder overrides the block
 * editor via a custom `action` query parameter, as DIP would block
 * same-origin iframe access that these editors rely on.
 *
 * @since 7.1.0
 */
function wp_set_up_cross_origin_isolation(): void {
	if ( ! wp_is_client_side_media_processing_enabled() ) {
		return;
	}

	$screen = get_current_screen();

	if ( ! $screen ) {
		return;
	}

	if ( ! $screen->is_block_editor() && 'site-editor' !== $screen->id && ! ( 'widgets' === $screen->id && wp_use_widgets_block_editor() ) ) {
		return;
	}

	/*
	 * Skip when rendering the classic-theme home route, which shows the site
	 * preview in an iframe and must reach its `contentDocument` to neutralize
	 * interactive elements. DIP would block that same-origin access.
	 *
	 * Keyed off $pagenow rather than the current screen so the guard keeps
	 * working if the header set-up is ever moved to an earlier hook (such as
	 * admin_init) where the screen is not yet available.
	 */
	global $pagenow;

	// phpcs:ignore WordPress.Security.NonceVerification.Recommended
	if ( 'site-editor.php' === $pagenow && ! wp_is_block_theme() && ( ! isset( $_GET['p'] ) || '/' === $_GET['p'] ) ) {
		return;
	}

	/*
	 * Skip when a third-party page builder overrides the block editor.
	 * DIP isolates the document into its own agent cluster,
	 * which blocks same-origin iframe access that these editors rely on.
	 */
	if ( isset( $_GET['action'] ) && 'edit' !== $_GET['action'] ) {
		return;
	}

	// Cross-origin isolation is not needed if users can't upload files anyway.
	if ( ! current_user_can( 'upload_files' ) ) {
		return;
	}

	wp_start_cross_origin_isolation_output_buffer();
}

/**
 * Sends the Document-Isolation-Policy header for cross-origin isolation.
 *
 * Uses an output buffer to add crossorigin="anonymous" where needed.
 *
 * @since 7.1.0
 */
function wp_start_cross_origin_isolation_output_buffer(): void {
	$chromium_version = wp_get_chromium_major_version();

	if ( null === $chromium_version || $chromium_version < 137 ) {
		return;
	}

	ob_start(
		static function ( string $output ): string {
			header( 'Document-Isolation-Policy: isolate-and-credentialless' );

			return wp_add_crossorigin_attributes( $output );
		}
	);
}

/**
 * Adds crossorigin="anonymous" to relevant tags in the given HTML string.
 *
 * @since 7.1.0
 *
 * @param string $html HTML input.
 * @return string Modified HTML.
 */
function wp_add_crossorigin_attributes( string $html ): string {
	$site_url = site_url();

	$processor = new WP_HTML_Tag_Processor( $html );

	// See https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/crossorigin.
	$cross_origin_tag_attributes = array(
		'AUDIO'  => array( 'src' ),
		'LINK'   => array( 'href' ),
		'SCRIPT' => array( 'src' ),
		'VIDEO'  => array( 'src', 'poster' ),
		'SOURCE' => array( 'src' ),
	);

	while ( $processor->next_tag() ) {
		$tag = $processor->get_tag();

		if ( ! isset( $cross_origin_tag_attributes[ $tag ] ) ) {
			continue;
		}
		$crossorigin = $processor->get_attribute( 'crossorigin' );
		if ( null !== $crossorigin ) {
			continue;
		}

		if ( 'AUDIO' === $tag || 'VIDEO' === $tag ) {
			$processor->set_bookmark( 'audio-video-parent' );
		}

		$processor->set_bookmark( 'resume' );

		$sought = false;

		$is_cross_origin = false;

		foreach ( $cross_origin_tag_attributes[ $tag ] as $attr ) {
			$url = $processor->get_attribute( $attr );
			if ( is_string( $url ) && ! str_starts_with( $url, $site_url ) && ! str_starts_with( $url, '/' ) ) {
				$is_cross_origin = true;
			}

			if ( $is_cross_origin ) {
				break;
			}
		}

		if ( $is_cross_origin ) {
			if ( 'SOURCE' === $tag ) {
				$sought = $processor->seek( 'audio-video-parent' );

				if ( $sought ) {
					$processor->set_attribute( 'crossorigin', 'anonymous' );
				}
			} else {
				$processor->set_attribute( 'crossorigin', 'anonymous' );
			}

			if ( $sought ) {
				$processor->seek( 'resume' );
				$processor->release_bookmark( 'audio-video-parent' );
			}
		}
	}

	return $processor->get_updated_html();
}