@openclaw/diffs 2026.9.5 → 2026.9.7

package/dist/index.js

@@ -1,20 +1,20 @@
-import { definePluginEntry, resolvePreferredOpenClawTmpDir } from "./api.js";
-import { resolveRequestClientIp } from "./runtime-api.js";
-import { a as getServedViewerAsset, r as VIEWER_RUNTIME_PATH } from "./.setup/viewer-assets-D3qrnaxI.mjs";
-import { buildPluginConfigSchema } from "openclaw/plugin-sdk/plugin-entry";
+import { a as getServedViewerAsset, r as VIEWER_RUNTIME_PATH } from "./.setup/viewer-assets-Bg9efLih.mjs";
+import { buildPluginConfigSchema, definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
 import { mapPluginConfigIssues } from "openclaw/plugin-sdk/extension-shared";
 import { z } from "zod";
 import { resolveGatewayPublicOrigin } from "openclaw/plugin-sdk/config-contracts";
-import { resolveGatewayPort } from "openclaw/plugin-sdk/gateway-config-runtime";
 import fs from "node:fs";
 import path from "node:path";
 import { resolveLivePluginConfigObject } from "openclaw/plugin-sdk/plugin-config-runtime";
+import { resolvePreferredOpenClawTmpDir } from "openclaw/plugin-sdk/temp-path";
 import { isLoopbackHost } from "openclaw/plugin-sdk/ssrf-runtime";
 import { asNonArrayRecord, normalizeLowercaseStringOrEmpty, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
-import { createAuthRateLimiter } from "openclaw/plugin-sdk/webhook-ingress";
+import { createAuthRateLimiter, resolveRequestClientIp } from "openclaw/plugin-sdk/webhook-ingress";
 import crypto from "node:crypto";
 import fs$1 from "node:fs/promises";
+import { promisify } from "node:util";
 import { gunzip, gzip } from "node:zlib";
+import { runTasksWithConcurrency } from "openclaw/plugin-sdk/concurrency-runtime";
 import { MAX_DATE_TIMESTAMP_MS, timestampMsToIsoString } from "openclaw/plugin-sdk/number-runtime";
 import { safeEqualSecret } from "openclaw/plugin-sdk/security-runtime";
 import { optionalFiniteNumberSchema, stringEnum } from "openclaw/plugin-sdk/channel-actions";
@@ -25,6 +25,32 @@ import { Type } from "typebox";
 import { parsePatchFiles, resolveLanguage } from "@pierre/diffs";
 import { preloadDiffHTML } from "@pierre/diffs/ssr";
 import { escapeHtml } from "openclaw/plugin-sdk/text-utility-runtime";
+//#region \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
+//#endregion
 //#region extensions/diffs/src/types.ts
 const DIFF_LAYOUTS = ["unified", "split"];
 const DIFF_MODES = [
@@ -48,6 +74,145 @@ const DIFF_OUTPUT_FORMATS = ["png", "pdf"];
 const DIFF_ARTIFACT_ID_PATTERN = /^[0-9a-f]{20}$/;
 const DIFF_ARTIFACT_TOKEN_PATTERN = /^[0-9a-f]{48}$/;
 //#endregion
+//#region src/gateway/gateway-http-route-contracts.ts
+const GATEWAY_PROBE_ROUTES = /* @__PURE__ */ new Map([
+	["/health", "live"],
+	["/healthz", "live"],
+	["/ready", "ready"],
+	["/readyz", "ready"],
+	["/startup", "startup"],
+	["/startupz", "startup"]
+]);
+function classifyGatewayProbePath(pathname) {
+	for (const [root, status] of GATEWAY_PROBE_ROUTES) {
+		if (pathname === root) return status;
+		if (pathname.startsWith(`${root}/`)) return "namespace";
+	}
+	return "outside";
+}
+//#endregion
+//#region packages/normalization-core/src/string-coerce.ts
+/** Trims string input and returns null for non-strings or empty strings. */
+function normalizeNullableString(value) {
+	if (typeof value !== "string") return null;
+	const trimmed = value.trim();
+	return trimmed ? trimmed : null;
+}
+/** Trims string input and returns undefined for non-strings or empty strings. */
+function normalizeOptionalString$1(value) {
+	return normalizeNullableString(value) ?? void 0;
+}
+/** Lowercases a normalized optional string. */
+function normalizeOptionalLowercaseString(value) {
+	return normalizeOptionalString$1(value)?.toLowerCase();
+}
+/** Lowercases a normalized string or returns an empty string when absent. */
+function normalizeLowercaseStringOrEmpty$1(value) {
+	return normalizeOptionalLowercaseString(value) ?? "";
+}
+//#endregion
+//#region src/plugins/http-path-prefix.ts
+function prefixMatchPath(pathname, prefix) {
+	return pathname === prefix || pathname.startsWith(`${prefix}/`) || pathname.startsWith(`${prefix}%`);
+}
+//#endregion
+//#region src/gateway/security-path.ts
+const MAX_PATH_DECODE_PASSES = 32;
+function normalizePathSeparators(pathname) {
+	const collapsed = pathname.replace(/\/{2,}/g, "/");
+	if (collapsed.length <= 1) return collapsed;
+	return collapsed.replace(/\/+$/, "");
+}
+function resolveDotSegments(pathname) {
+	try {
+		return new URL(pathname, "http://localhost").pathname;
+	} catch {
+		return pathname;
+	}
+}
+function normalizePathForSecurity(pathname) {
+	return normalizePathSeparators(normalizeLowercaseStringOrEmpty$1(resolveDotSegments(pathname))) || "/";
+}
+function buildCanonicalPathCandidates(pathname, maxDecodePasses = MAX_PATH_DECODE_PASSES) {
+	const candidates = /* @__PURE__ */ new Set([normalizePathForSecurity(pathname)]);
+	let decoded = pathname;
+	let malformedEncoding = false;
+	let decodePasses = 0;
+	for (let pass = 0; pass < maxDecodePasses; pass++) {
+		let nextDecoded;
+		try {
+			nextDecoded = decodeURIComponent(decoded);
+		} catch {
+			malformedEncoding = true;
+			break;
+		}
+		if (nextDecoded === decoded) break;
+		decodePasses += 1;
+		decoded = nextDecoded;
+		candidates.add(normalizePathForSecurity(decoded));
+	}
+	let decodePassLimitReached = false;
+	if (!malformedEncoding) try {
+		decodePassLimitReached = decodeURIComponent(decoded) !== decoded;
+	} catch {
+		malformedEncoding = true;
+	}
+	return {
+		candidates: [...candidates],
+		decodePasses,
+		decodePassLimitReached,
+		malformedEncoding
+	};
+}
+function canonicalizePathForSecurity(pathname) {
+	const { candidates, decodePasses, decodePassLimitReached, malformedEncoding } = buildCanonicalPathCandidates(pathname);
+	return {
+		canonicalPath: candidates[candidates.length - 1] ?? "/",
+		candidates,
+		decodePasses,
+		decodePassLimitReached,
+		malformedEncoding,
+		rawNormalizedPath: normalizePathSeparators(normalizeLowercaseStringOrEmpty$1(pathname)) || "/"
+	};
+}
+const PROTECTED_PLUGIN_ROUTE_PREFIXES = ["/api/channels"];
+//#endregion
+//#region src/gateway/server/plugins-http/path-context.ts
+function normalizeProtectedPrefix(prefix) {
+	const collapsed = normalizeLowercaseStringOrEmpty$1(prefix).replace(/\/{2,}/g, "/");
+	if (collapsed.length <= 1) return collapsed || "/";
+	return collapsed.replace(/\/+$/, "");
+}
+const NORMALIZED_PROTECTED_PLUGIN_ROUTE_PREFIXES = PROTECTED_PLUGIN_ROUTE_PREFIXES.map(normalizeProtectedPrefix);
+/** Returns true when any decoded path candidate targets a protected route. */
+function isProtectedPluginRoutePathFromContext(context) {
+	if (context.candidates.some((candidate) => NORMALIZED_PROTECTED_PLUGIN_ROUTE_PREFIXES.some((prefix) => prefixMatchPath(candidate, prefix)))) return true;
+	if (context.decodePassLimitReached) return true;
+	if (!context.malformedEncoding) return false;
+	return NORMALIZED_PROTECTED_PLUGIN_ROUTE_PREFIXES.some((prefix) => prefixMatchPath(context.rawNormalizedPath, prefix));
+}
+/** Builds all security-relevant decoded path candidates for a request path. */
+function resolvePluginRoutePathContext(pathname) {
+	const canonical = canonicalizePathForSecurity(pathname);
+	return {
+		pathname,
+		canonicalPath: canonical.canonicalPath,
+		candidates: canonical.candidates,
+		malformedEncoding: canonical.malformedEncoding,
+		decodePassLimitReached: canonical.decodePassLimitReached,
+		rawNormalizedPath: canonical.rawNormalizedPath
+	};
+}
+//#endregion
+//#region \0openclaw:bundled-sdk:openclaw/plugin-sdk/gateway-config-runtime
+var gateway_config_runtime_exports = /* @__PURE__ */ __exportAll({
+	classifyGatewayProbePath: () => classifyGatewayProbePath,
+	isProtectedPluginRoutePathFromContext: () => isProtectedPluginRoutePathFromContext,
+	resolvePluginRoutePathContext: () => resolvePluginRoutePathContext
+});
+import * as import_openclaw_plugin_sdk_gateway_config_runtime from "openclaw/plugin-sdk/gateway-config-runtime";
+__reExport(gateway_config_runtime_exports, import_openclaw_plugin_sdk_gateway_config_runtime);
+//#endregion
 //#region extensions/diffs/src/url.ts
 function buildViewerUrl(params) {
 	const normalizedBase = normalizeViewerBaseUrl(params.baseUrl?.trim() || params.viewerBaseUrl?.trim() || resolveGatewayPublicOrigin(params.config) || resolveGatewayBaseUrl(params.config));
@@ -74,7 +239,7 @@ function normalizeViewerBaseUrl(raw, fieldName = "baseUrl") {
 }
 function resolveGatewayBaseUrl(config) {
 	const scheme = config.gateway?.tls?.enabled ? "https" : "http";
-	const port = resolveGatewayPort(config);
+	const port = (0, gateway_config_runtime_exports.resolveGatewayPort)(config);
 	const customHost = config.gateway?.customBindHost?.trim();
 	if (config.gateway?.bind === "custom" && customHost) return `${scheme}://${customHost}:${port}`;
 	return `${scheme}://127.0.0.1:${port}`;
@@ -182,10 +347,6 @@ const diffsPluginConfigSchema = {
 		}
 	}
 };
-function resolveConfiguredValue(options) {
-	const alias = options.aliases.find((value) => value !== void 0);
-	return options.primary ?? alias;
-}
 function buildDiffsPluginConfigShape(config) {
 	const viewerBaseUrl = resolveDiffsPluginViewerBaseUrl(config);
 	return {
@@ -198,23 +359,9 @@ function resolveDiffsPluginDefaults(config) {
 	if (!config || typeof config !== "object" || Array.isArray(config)) return { ...DEFAULT_DIFFS_TOOL_DEFAULTS };
 	const defaults = config.defaults;
 	if (!defaults || typeof defaults !== "object" || Array.isArray(defaults)) return { ...DEFAULT_DIFFS_TOOL_DEFAULTS };
-	const fileQuality = normalizeFileQuality$1(resolveConfiguredValue({
-		primary: defaults.fileQuality,
-		aliases: [defaults.imageQuality]
-	}));
+	const fileQuality = normalizeFileQuality$1(defaults.fileQuality ?? defaults.imageQuality);
 	const profile = DEFAULT_IMAGE_QUALITY_PROFILES[fileQuality];
-	const fileFormat = resolveConfiguredValue({
-		primary: defaults.fileFormat,
-		aliases: [defaults.imageFormat, defaults.format]
-	});
-	const fileScale = resolveConfiguredValue({
-		primary: defaults.fileScale,
-		aliases: [defaults.imageScale]
-	});
-	const fileMaxWidth = resolveConfiguredValue({
-		primary: defaults.fileMaxWidth,
-		aliases: [defaults.imageMaxWidth]
-	});
+	const fileFormat = defaults.fileFormat ?? (defaults.imageFormat !== void 0 ? defaults.imageFormat : defaults.format);
 	return {
 		fontFamily: normalizeFontFamily(defaults.fontFamily),
 		fontSize: normalizeDiffFontSize(defaults.fontSize),
@@ -227,8 +374,8 @@ function resolveDiffsPluginDefaults(config) {
 		theme: normalizeTheme$1(defaults.theme),
 		fileFormat: normalizeFileFormat(fileFormat),
 		fileQuality,
-		fileScale: normalizeFileScale(fileScale, profile.scale),
-		fileMaxWidth: normalizeFileMaxWidth(fileMaxWidth, profile.maxWidth),
+		fileScale: normalizeFileScale(defaults.fileScale ?? defaults.imageScale, profile.scale),
+		fileMaxWidth: normalizeFileMaxWidth(defaults.fileMaxWidth ?? defaults.imageMaxWidth, profile.maxWidth),
 		mode: normalizeMode$1(defaults.mode),
 		ttlSeconds: normalizeTtlSeconds(defaults.ttlSeconds)
 	};
@@ -438,9 +585,6 @@ function normalizeRemoteClientKey(remoteAddress) {
 	if (!normalized) return "unknown";
 	return normalized.startsWith("::ffff:") ? normalized.slice(7) : normalized;
 }
-function isLoopbackClientIp(clientIp) {
-	return isLoopbackHost(clientIp);
-}
 function hasProxyForwardingHints(req) {
 	const headers = req.headers ?? {};
 	return Boolean(headers["x-forwarded-for"] || headers["x-real-ip"] || headers.forwarded || headers["x-forwarded-host"] || headers["x-forwarded-proto"]);
@@ -451,7 +595,7 @@ function resolveViewerAccess(req, params) {
 	const remoteKey = normalizeRemoteClientKey(clientIp ?? req.socket?.remoteAddress);
 	return {
 		remoteKey,
-		localRequest: !proxyHintsPresent && typeof clientIp === "string" && isLoopbackClientIp(remoteKey)
+		localRequest: !proxyHintsPresent && typeof clientIp === "string" && isLoopbackHost(remoteKey)
 	};
 }
 function recordRemoteFailure(limiter, access) {
@@ -476,10 +620,13 @@ const DEFAULT_TTL_MS = 18e5;
 const MAX_TTL_MS = 216e5;
 const SWEEP_FALLBACK_AGE_MS = 864e5;
 const DEFAULT_CLEANUP_INTERVAL_MS = 3e5;
+const CLEANUP_CONCURRENCY = 4;
 const MAX_DECODED_HTML_BYTES = 67108864;
 const ARTIFACT_ID_ATTEMPTS = 8;
 const VIEWER_PREFIX = "/plugins/diffs/view";
 const EMPTY_BLOB = /* @__PURE__ */ new Uint8Array();
+const gzipAsync = promisify(gzip);
+const gunzipAsync = promisify(gunzip);
 function isBlobLimitError(error) {
 	return typeof error === "object" && error !== null && "code" in error && error.code === "PLUGIN_BLOB_LIMIT_EXCEEDED";
 }
@@ -487,6 +634,7 @@ var DiffArtifactStore = class {
 	constructor(params) {
 		this.renderingFileIds = /* @__PURE__ */ new Set();
 		this.cleanupInFlight = null;
+		this.cleanupStopped = false;
 		this.nextCleanupAt = 0;
 		this.rootDir = path.resolve(params.rootDir);
 		this.blobStore = params.blobStore;
@@ -525,7 +673,7 @@ var DiffArtifactStore = class {
 		if (!isViewerMetadata(entry.metadata)) return null;
 		const tokenHash = hashToken(token);
 		if (!safeEqualSecret(tokenHash, entry.metadata.tokenHash)) return null;
-		const html = await gunzipAsync(entry.bytes, MAX_DECODED_HTML_BYTES);
+		const html = await gunzipAsync(entry.bytes, { maxOutputLength: MAX_DECODED_HTML_BYTES });
 		if (html.byteLength !== entry.metadata.decodedBytes) throw new Error(`Diff artifact ${id} decoded size does not match its metadata.`);
 		return {
 			artifact: viewerEntryToMeta(entry, token),
@@ -592,26 +740,44 @@ var DiffArtifactStore = class {
 			force: true
 		}).catch(() => {});
 	}
-	scheduleCleanup() {
-		this.maybeCleanupExpired();
+	startCleanup() {
+		this.cleanupStopped = false;
 	}
-	async cleanupExpired() {
+	async stopCleanup() {
+		this.cleanupStopped = true;
+		await this.cleanupInFlight?.catch(() => void 0);
+	}
+	cleanupExpired() {
+		if (!this.cleanupInFlight) this.cleanupInFlight = this.runCleanupExpired().finally(() => {
+			this.cleanupInFlight = null;
+		});
+		return this.cleanupInFlight;
+	}
+	async runCleanupExpired() {
 		const expired = await this.blobStore.deleteExpired();
-		await Promise.all(expired.map(async (entry) => await this.deleteExpiredFile(entry)));
+		const expiredCleanup = await runTasksWithConcurrency({
+			tasks: expired.map((entry) => () => this.deleteExpiredFile(entry)),
+			limit: CLEANUP_CONCURRENCY
+		});
+		if (expiredCleanup.hasError) throw expiredCleanup.firstError;
 		const entries = await fs$1.readdir(this.rootDir, { withFileTypes: true }).catch((error) => {
 			if (isFileNotFound(error)) return [];
 			throw error;
 		});
 		const now = Date.now();
-		await Promise.all(entries.filter((entry) => entry.isDirectory() && DIFF_ARTIFACT_ID_PATTERN.test(entry.name)).map(async (entry) => {
-			if (this.renderingFileIds.has(entry.name)) return;
-			const artifactDir = this.artifactDir(entry.name);
-			const stats = await fs$1.stat(artifactDir).catch(() => null);
-			if (stats && now - stats.mtimeMs > SWEEP_FALLBACK_AGE_MS && !await this.blobStore.lookup(entry.name)) await fs$1.rm(artifactDir, {
-				recursive: true,
-				force: true
-			}).catch(() => {});
-		}));
+		const orphanCleanup = await runTasksWithConcurrency({
+			tasks: entries.filter((entry) => entry.isDirectory() && DIFF_ARTIFACT_ID_PATTERN.test(entry.name)).map((entry) => async () => {
+				if (this.renderingFileIds.has(entry.name)) return;
+				const artifactDir = this.artifactDir(entry.name);
+				const stats = await fs$1.stat(artifactDir).catch(() => null);
+				if (stats && now - stats.mtimeMs > SWEEP_FALLBACK_AGE_MS && !await this.blobStore.lookup(entry.name)) await fs$1.rm(artifactDir, {
+					recursive: true,
+					force: true
+				}).catch(() => {});
+			}),
+			limit: CLEANUP_CONCURRENCY
+		});
+		if (orphanCleanup.hasError) throw orphanCleanup.firstError;
 	}
 	async registerUnique(bytes, metadata, ttlMs) {
 		for (let attempt = 0; attempt < ARTIFACT_ID_ATTEMPTS; attempt += 1) {
@@ -639,17 +805,14 @@ var DiffArtifactStore = class {
 			force: true
 		}).catch(() => {});
 	}
-	maybeCleanupExpired() {
+	scheduleCleanup() {
 		const now = Date.now();
-		if (this.cleanupInFlight || now < this.nextCleanupAt) return;
+		if (this.cleanupStopped || this.cleanupInFlight || now < this.nextCleanupAt) return;
 		this.nextCleanupAt = now + this.cleanupIntervalMs;
-		const cleanupPromise = this.cleanupExpired().catch((error) => {
+		this.cleanupExpired().catch((error) => {
 			this.nextCleanupAt = 0;
 			this.logger?.warn(`Failed to clean expired diff artifacts: ${String(error)}`);
-		}).finally(() => {
-			if (this.cleanupInFlight === cleanupPromise) this.cleanupInFlight = null;
 		});
-		this.cleanupInFlight = cleanupPromise;
 	}
 	artifactDir(id) {
 		if (!DIFF_ARTIFACT_ID_PATTERN.test(id)) throw new Error(`Invalid diff artifact id: ${id}`);
@@ -704,28 +867,6 @@ function isArtifactContext(value) {
 	]);
 	return Object.entries(context).every(([key, entry]) => allowed.has(key) && (entry === void 0 || typeof entry === "string"));
 }
-async function gzipAsync(input) {
-	return await new Promise((resolve, reject) => {
-		gzip(input, (error, result) => {
-			if (error) {
-				reject(error);
-				return;
-			}
-			resolve(result);
-		});
-	});
-}
-async function gunzipAsync(input, maxOutputLength) {
-	return await new Promise((resolve, reject) => {
-		gunzip(input, { maxOutputLength }, (error, result) => {
-			if (error) {
-				reject(error);
-				return;
-			}
-			resolve(result);
-		});
-	});
-}
 function isFileExists(error) {
 	return error instanceof Error && "code" in error && error.code === "EEXIST";
 }
@@ -979,7 +1120,6 @@ async function normalizeSupportedLanguageHints(values, options) {
 		if (!normalized) continue;
 		supported.add(normalized);
 	}
-	if (options.fallbackToText && supported.size === 0) supported.add("text");
 	return [...supported];
 }
 function collectDiffPayloadLanguageHints(payload) {
@@ -994,13 +1134,9 @@ async function normalizeDiffPayloadFileLanguage(file, options) {
 	if (typeof file.lang !== "string") return file;
 	const normalized = await normalizeSupportedLanguageHint(file.lang, options);
 	if (file.lang === normalized) return file;
-	if (!normalized) return {
-		...file,
-		lang: "text"
-	};
 	return {
 		...file,
-		lang: normalized
+		lang: normalized ?? "text"
 	};
 }
 async function normalizeDiffViewerPayloadLanguages(payload, options = {}) {
@@ -1008,10 +1144,7 @@ async function normalizeDiffViewerPayloadLanguages(payload, options = {}) {
 		normalizeDiffPayloadFileLanguage(payload.fileDiff, options),
 		normalizeDiffPayloadFileLanguage(payload.oldFile, options),
 		normalizeDiffPayloadFileLanguage(payload.newFile, options),
-		normalizeSupportedLanguageHints(payload.langs, {
-			fallbackToText: false,
-			...options
-		})
+		normalizeSupportedLanguageHints(payload.langs, options)
 	]);
 	const langs = new Set(payloadLangs);
 	for (const lang of collectDiffPayloadLanguageHints({
@@ -1165,16 +1298,15 @@ function buildImageRenderOptions(options) {
 		}
 	};
 }
-function shouldRenderViewer(target) {
-	return target === "viewer" || target === "both";
-}
-function shouldRenderImage(target) {
-	return target === "image" || target === "both";
-}
-function buildRenderVariants(params) {
+function buildRenderVariants(options, target) {
+	const viewerOptions = target === "viewer" || target === "both" ? buildDiffOptions(options) : void 0;
+	const imageOptions = target === "image" || target === "both" ? buildDiffOptions(buildImageRenderOptions(options)) : void 0;
+	const preloadOptions = viewerOptions ?? imageOptions;
+	if (!preloadOptions) throw new Error(`Unsupported diff render target: ${target}`);
 	return {
-		...shouldRenderViewer(params.target) ? { viewerOptions: buildDiffOptions(params.options) } : {},
-		...shouldRenderImage(params.target) ? { imageOptions: buildDiffOptions(buildImageRenderOptions(params.options)) } : {}
+		viewerOptions,
+		imageOptions,
+		preloadOptions
 	};
 }
 function renderDiffCard(payload, anchorId) {
@@ -1420,14 +1552,26 @@ ${imageTypographyCss}
   </body>
 </html>`;
 }
-function payloadUsesLanguagePack(payload) {
-	return payload?.langs.some((lang) => !isBaseDiffViewerLanguage(lang)) ?? false;
-}
-function buildRenderedSection(params) {
+async function renderSection(input, { viewerOptions, imageOptions, preloadOptions }, languagePackAvailable, anchorId) {
+	const payload = await normalizeDiffViewerPayloadLanguages({
+		prerenderedHTML: await preloadDiffHTMLWithFallback({
+			...input,
+			options: preloadOptions
+		}),
+		...input,
+		options: preloadOptions,
+		langs: collectDiffPayloadLanguageHints(input)
+	}, { languagePackAvailable });
 	return {
-		...params.viewerPayload ? { viewer: renderDiffCard(params.viewerPayload, params.anchorId) } : {},
-		...params.imagePayload ? { image: renderDiffCard(params.imagePayload, params.anchorId) } : {},
-		usesLanguagePack: payloadUsesLanguagePack(params.viewerPayload) || payloadUsesLanguagePack(params.imagePayload)
+		...viewerOptions ? { viewer: renderDiffCard({
+			...payload,
+			options: viewerOptions
+		}, anchorId) } : {},
+		...imageOptions ? { image: renderDiffCard({
+			...payload,
+			options: imageOptions
+		}, anchorId) } : {},
+		usesLanguagePack: payload.langs.some((lang) => !isBaseDiffViewerLanguage(lang))
 	};
 }
 function buildRenderedBodies(sections, leadingHtml) {
@@ -1446,48 +1590,18 @@ async function renderBeforeAfterDiff(input, options, target) {
 		input,
 		lang
 	});
-	const oldFile = {
-		name: fileName,
-		contents: input.before,
-		...lang ? { lang } : {}
-	};
-	const newFile = {
-		name: fileName,
-		contents: input.after,
-		...lang ? { lang } : {}
-	};
-	const { viewerOptions, imageOptions } = buildRenderVariants({
-		options,
-		target
-	});
-	const preloadOptions = viewerOptions ?? imageOptions;
-	if (!preloadOptions) throw new Error(`Unsupported diff render target: ${target}`);
-	const normalizedPayload = await normalizeDiffViewerPayloadLanguages({
-		prerenderedHTML: await preloadDiffHTMLWithFallback({
-			oldFile,
-			newFile,
-			options: preloadOptions
-		}),
-		oldFile,
-		newFile,
-		options: preloadOptions,
-		langs: collectDiffPayloadLanguageHints({
-			oldFile,
-			newFile
-		})
-	}, { languagePackAvailable });
-	const viewerPayload = viewerOptions ? {
-		...normalizedPayload,
-		options: viewerOptions
-	} : void 0;
-	const imagePayload = imageOptions ? {
-		...normalizedPayload,
-		options: imageOptions
-	} : void 0;
-	const section = buildRenderedSection({
-		...viewerPayload ? { viewerPayload } : {},
-		...imagePayload ? { imagePayload } : {}
-	});
+	const section = await renderSection({
+		oldFile: {
+			name: fileName,
+			contents: input.before,
+			...lang ? { lang } : {}
+		},
+		newFile: {
+			name: fileName,
+			contents: input.after,
+			...lang ? { lang } : {}
+		}
+	}, buildRenderVariants(options, target), languagePackAvailable);
 	return {
 		...buildRenderedBodies([section]),
 		fileCount: 1,
@@ -1504,41 +1618,13 @@ async function renderPatchDiff(input, options, target) {
 		const unifiedLines = Number.isFinite(fileDiff.unifiedLineCount) ? fileDiff.unifiedLineCount : 0;
 		return sum + Math.max(splitLines, unifiedLines, 0);
 	}, 0) > MAX_PATCH_TOTAL_LINES) throw new DiffRenderInputError(`Patch input is too large to render (max ${MAX_PATCH_TOTAL_LINES} lines).`);
-	const { viewerOptions, imageOptions } = buildRenderVariants({
-		options,
-		target
-	});
-	const preloadOptions = viewerOptions ?? imageOptions;
-	if (!preloadOptions) throw new Error(`Unsupported diff render target: ${target}`);
+	const variants = buildRenderVariants(options, target);
 	const navEntries = files.map((fileDiff, index) => ({
 		anchorId: `oc-diff-file-${index + 1}`,
 		fileDiff,
 		stats: computeFileDiffStats(fileDiff)
 	}));
-	const sections = await Promise.all(files.map(async (fileDiff, index) => {
-		const normalizedPayload = await normalizeDiffViewerPayloadLanguages({
-			prerenderedHTML: await preloadDiffHTMLWithFallback({
-				fileDiff,
-				options: preloadOptions
-			}),
-			fileDiff,
-			options: preloadOptions,
-			langs: collectDiffPayloadLanguageHints({ fileDiff })
-		}, { languagePackAvailable });
-		const viewerPayload = viewerOptions ? {
-			...normalizedPayload,
-			options: viewerOptions
-		} : void 0;
-		const imagePayload = imageOptions ? {
-			...normalizedPayload,
-			options: imageOptions
-		} : void 0;
-		return buildRenderedSection({
-			...viewerPayload ? { viewerPayload } : {},
-			...imagePayload ? { imagePayload } : {},
-			anchorId: navEntries[index]?.anchorId
-		});
-	}));
+	const sections = await Promise.all(files.map((fileDiff, index) => renderSection({ fileDiff }, variants, languagePackAvailable, navEntries[index]?.anchorId)));
 	return {
 		...buildRenderedBodies(sections, files.length > 1 ? renderFileSummaryNav(navEntries) : void 0),
 		fileCount: files.length,
@@ -1602,7 +1688,7 @@ const MAX_TITLE_BYTES = 1024;
 const MAX_PATH_BYTES = 2048;
 const MAX_LANG_BYTES = 128;
 const MAX_DIFF_ARTIFACT_TTL_SECONDS = 21600;
-const loadDiffsBrowserRuntime = createLazyRuntimeModule(() => import("./.setup/browser.runtime-VjaO3wrj.mjs"));
+const loadDiffsBrowserRuntime = createLazyRuntimeModule(() => import("./.setup/browser.runtime-v15gbeC0.mjs"));
 const DiffsToolSchema = Type.Object({
 	before: Type.Optional(Type.String({ description: "Original text content." })),
 	after: Type.Optional(Type.String({ description: "Updated text content." })),
@@ -1697,41 +1783,7 @@ function createDiffsTool(params) {
 				if (error instanceof DiffRenderInputError) throw new PluginToolInputError(error.message);
 				throw error;
 			});
-			if (isArtifactOnlyMode(mode)) {
-				const artifactFile = await renderDiffArtifactFile({
-					screenshotter: await loadScreenshotter(config),
-					store: params.store,
-					html: requireRenderedHtml(rendered.imageHtml, "image"),
-					theme,
-					image,
-					ttlMs,
-					context: artifactContext
-				});
-				return {
-					content: [{
-						type: "text",
-						text: buildFileArtifactMessage({
-							format: image.format,
-							filePath: artifactFile.path
-						})
-					}],
-					details: buildArtifactDetails({
-						baseDetails: {
-							changed: true,
-							...artifactFile.artifactId ? { artifactId: artifactFile.artifactId } : {},
-							...artifactFile.expiresAt ? { expiresAt: artifactFile.expiresAt } : {},
-							title: rendered.title,
-							inputKind: rendered.inputKind,
-							fileCount: rendered.fileCount,
-							mode,
-							...artifactContext ? { context: artifactContext } : {}
-						},
-						artifactFile,
-						image
-					})
-				};
-			}
-			const artifact = await params.store.createArtifact({
+			const artifact = isArtifactOnlyMode(mode) ? void 0 : await params.store.createArtifact({
 				html: requireRenderedHtml(rendered.html, "viewer"),
 				title: rendered.title,
 				inputKind: rendered.inputKind,
@@ -1739,13 +1791,13 @@ function createDiffsTool(params) {
 				ttlMs,
 				context: artifactContext
 			});
-			const viewerUrl = buildViewerUrl({
+			const viewerUrl = artifact ? buildViewerUrl({
 				config,
 				viewerPath: artifact.viewerPath,
 				baseUrl: normalizeBaseUrl(toolParams.baseUrl),
 				viewerBaseUrl: params.viewerBaseUrl
-			});
-			const baseDetails = {
+			}) : void 0;
+			const viewerDetails = artifact ? {
 				changed: true,
 				artifactId: artifact.id,
 				viewerUrl,
@@ -1756,13 +1808,13 @@ function createDiffsTool(params) {
 				fileCount: artifact.fileCount,
 				mode,
 				...artifactContext ? { context: artifactContext } : {}
-			};
+			} : void 0;
 			if (mode === "view") return {
 				content: [{
 					type: "text",
 					text: `Diff viewer ready.\n${viewerUrl}`
 				}],
-				details: baseDetails
+				details: viewerDetails
 			};
 			try {
 				const artifactFile = await renderDiffArtifactFile({
@@ -1784,7 +1836,16 @@ function createDiffsTool(params) {
 						})
 					}],
 					details: buildArtifactDetails({
-						baseDetails,
+						baseDetails: viewerDetails ?? {
+							changed: true,
+							...artifactFile.artifactId ? { artifactId: artifactFile.artifactId } : {},
+							...artifactFile.expiresAt ? { expiresAt: artifactFile.expiresAt } : {},
+							title: rendered.title,
+							inputKind: rendered.inputKind,
+							fileCount: rendered.fileCount,
+							mode,
+							...artifactContext ? { context: artifactContext } : {}
+						},
 						artifactFile,
 						image
 					})
@@ -1798,7 +1859,7 @@ function createDiffsTool(params) {
 							text: `Diff viewer ready.\n${viewerUrl}\nFile rendering failed: ${errorMessage}`
 						}],
 						details: {
-							...baseDetails,
+							...viewerDetails,
 							fileError: errorMessage
 						}
 					};
@@ -1969,6 +2030,11 @@ function registerDiffsPlugin(api) {
 		}),
 		logger: api.logger
 	});
+	api.registerService({
+		id: "diffs-artifact-cleanup",
+		start: () => store.startCleanup(),
+		stop: () => store.stopCleanup()
+	});
 	const resolveCurrentPluginConfig = () => resolveLivePluginConfigObject(api.runtime.config?.current ? () => api.runtime.config.current() : void 0, "diffs", api.pluginConfig) ?? {};
 	const resolveCurrentAccessConfig = () => {
 		const currentConfig = api.runtime.config?.current?.() ?? api.config;