Header-aware DPR (Sec-CH-DPR)

For most use cases, density-descriptor srcset (densities()) is the right delivery model — works on every browser, every CDN, every backend, no negotiation in the request path.

If you specifically need server-side Sec-CH-DPR Client Hint reading, this is supported as a userland concern via the PSR-14 events system, NOT as a library feature. The reasons:

• Browser support is Chromium-only. Safari and Firefox do not send Client Hints.
• Page setup is non-trivial. The HTML response must emit Accept-CH: Sec-CH-DPR. Cross-origin asset hosts need Permissions-Policy delegation.
• Cache poisoning risk. Any HTML cache (CDN, Varnish, page-cache plugins) needs Vary: Sec-CH-DPR or DPR-1 visitors get poisoned with DPR-2 markup.

Recipe

use Timber\Chainsaw\Event\PreUrlGenerated;

$dispatcher->addListener(PreUrlGenerated::class, function (PreUrlGenerated $e) use ($request) {
    if ($dpr = $request->headers->get('Sec-CH-DPR')) {
        $e->image = $e->image->dpr((float) $dpr);
    }
});

The application is responsible for emitting the appropriate response headers (Accept-CH, Vary) — Chainsaw does not infer them.