The image the request is about, in any shape Source accepts.
The request. budgetMs and effort are included, because both can change the
bytes that come out.
Prefix for the returned URL. Anything stable; it never leaves the cache.
A URL-shaped key.
A stable key for the artifact a request would produce.
The point of a cache in front of this library is that the expensive path runs once. That only works if the key is canonical: two requests that mean the same thing have to produce the same string, and two that mean different things must not. Option order, absent options and the source itself all have to be normalized, which is easy to get subtly wrong by hand and is why this is here rather than in a README snippet.
The source is identified by the SHA-256 of its bytes rather than by a URL, so the same picture served from two places is one artifact and a picture that changed under a stable URL is not mistaken for the old one.
The result is shaped as a URL because that is what the Workers Cache API takes as a key:
A cache hit costs no CPU at all, which is the only way a request the budget cannot afford still gets served: it is paid for once.