Header-aware DPR (Sec-CH-DPR)

For most use cases, density-descriptor srcset (densities()) is the right delivery model — works on every browser, every CDN, every backend, no negotiation in the request path.

If you specifically need server-side Sec-CH-DPR Client Hint reading, it’s a userland concern: read the header in your controller and apply ->dpr() at the call site. It is NOT a library feature. The reasons:

• Browser support is Chromium-only. Safari and Firefox do not send Client Hints.
• Page setup is non-trivial. The HTML response must emit Accept-CH: Sec-CH-DPR. Cross-origin asset hosts need Permissions-Policy delegation.
• Cache poisoning risk. Any HTML cache (CDN, Varnish, page-cache plugins) needs Vary: Sec-CH-DPR or DPR-1 visitors get poisoned with DPR-2 markup.

Recipe

Apply the hint where you build the image. Image is immutable, so ->dpr() returns a new instance:

$image = $factory->image('photo.jpg')->width(800);

if ($dpr = $request->headers->get('Sec-CH-DPR')) {
    $image = $image->dpr((float) $dpr);
}

echo $image;

The application is responsible for emitting the appropriate response headers (Accept-CH, Vary) — Chainsaw does not infer them.