dewee-webchat 0.4.1 → 0.5.0-beta.1

package/dist/server.js

@@ -13,7 +13,7 @@ import {
   parseJobAccessLaunch,
   serializePageContext,
   stripPageBlock
-} from "./chunk-EVZ5K7BN.js";
+} from "./chunk-WHHQ6FKK.js";
 
 // src/server/admission-errors.ts
 var MESSAGES = {
@@ -49,15 +49,17 @@ function admissionErrorResponse(code, retryAfterMs) {
 // src/server/gateway-client.ts
 var GatewayError = class extends Error {
   /** `retryAfterMs` is the gateway's raw value for retryable refusals (`RATE_LIMITED`), unvalidated. */
-  constructor(message, code, remediation, retryAfterMs) {
+  constructor(message, code, remediation, retryAfterMs, reason) {
     super(message);
     this.code = code;
     this.remediation = remediation;
     this.retryAfterMs = retryAfterMs;
+    this.reason = reason;
   }
   code;
   remediation;
   retryAfterMs;
+  reason;
 };
 function parseRemediation(raw) {
   if (raw === null || typeof raw !== "object") return void 0;
@@ -110,12 +112,14 @@ var GatewayConnection = class _GatewayConnection {
   pending = /* @__PURE__ */ new Map();
   listeners = /* @__PURE__ */ new Set();
   closed = false;
+  pageContextVersions = [];
   static async connect(creds, actor, timeoutMs = 15e3) {
     const conn = new _GatewayConnection(await openSocket(creds.url, timeoutMs));
     const params = typeof actor === "string" ? { token: creds.token, user_id: actor } : { token: creds.token, identity_session: actor.identitySession };
     if (creds.tenantId) params.tenant_id = creds.tenantId;
     try {
       const res = await conn.call("connect", params, timeoutMs);
+      conn.pageContextVersions = Array.isArray(res?.page_context_versions) && res.page_context_versions.includes(1) ? [1] : [];
       if (typeof actor !== "string" && !isIdentityUser(res?.user_id)) {
         throw new GatewayError("Gateway did not apply the identity session", "SOURCE_UNAVAILABLE", { action: "retry_later", audience: "operator" });
       }
@@ -173,7 +177,7 @@ var GatewayConnection = class _GatewayConnection {
       if (frame.ok) p.resolve(frame.payload);
       else {
         const e = frame.error;
-        p.reject(new GatewayError(e?.message || "Gateway request failed", e?.code, parseRemediation(e?.details?.remediation), e?.retryAfterMs));
+        p.reject(new GatewayError(e?.message || "Gateway request failed", e?.code, parseRemediation(e?.details?.remediation), e?.retryAfterMs, e?.details?.reason));
       }
     } else if (frame.type === "event" && frame.event) {
       for (const cb of this.listeners) cb(frame.event, frame.payload);
@@ -243,11 +247,12 @@ async function* streamChat(opts) {
     end();
   };
   opts.signal?.addEventListener("abort", onAbort, { once: true });
-  conn.call("chat.send", { agentId: opts.agent, sessionKey: opts.sessionKey, message: opts.message, stream: true }, opts.timeoutMs ?? 18e4).then((res) => {
+  conn.call("chat.send", { agentId: opts.agent, sessionKey: opts.sessionKey, message: opts.message, stream: true, ...opts.pageContext !== void 0 ? { pageContext: opts.pageContext } : {} }, opts.timeoutMs ?? 18e4).then((res) => {
     push({ type: "done", content: res?.content ?? "", usage: res?.usage });
     end();
   }).catch((err) => {
-    if (!finished && isAdmissionErrorCode(err.code)) push(admissionErrorEvent(err.code, err.retryAfterMs, err.message));
+    if (!finished && (err.reason === "page_context_invalid" || err.reason === "page_context_unsupported")) push({ type: "error", code: err.reason, message: err.reason === "page_context_invalid" ? "Invalid page context" : "Page context is not supported" });
+    else if (!finished && isAdmissionErrorCode(err.code)) push(admissionErrorEvent(err.code, err.retryAfterMs, err.message));
     else if (!finished) push(err.remediation ? { type: "error", message: err.message, code: err.code, remediation: err.remediation } : { type: "error", message: err.message, code: err.code });
     end();
   });
@@ -760,6 +765,67 @@ function resolveTransport(o) {
   return transport;
 }
 
+// src/server/page-context.ts
+async function readChatBody(request) {
+  const limit = 128 * 1024;
+  const length = request.headers.get("content-length");
+  if (length && (!/^\d+$/.test(length) || Number(length) > limit)) return { error: "too_large" };
+  if (!request.body) return { error: "invalid" };
+  const reader = request.body.getReader();
+  const chunks = [];
+  let size = 0;
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      size += value.byteLength;
+      if (size > limit) {
+        await reader.cancel();
+        return { error: "too_large" };
+      }
+      chunks.push(value);
+    }
+    const bytes = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+      bytes.set(chunk, offset);
+      offset += chunk.length;
+    }
+    return { body: JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes)) };
+  } catch {
+    return { error: "invalid" };
+  } finally {
+    reader.releaseLock();
+  }
+}
+function validPageContext(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const o = value;
+  const allowed = /* @__PURE__ */ new Set(["version", "url", "title", "description", "captured_at", "selection", "content", "source", "trust_level"]);
+  if (Object.keys(o).some((key) => !allowed.has(key)) || o.version !== 1 || typeof o.url !== "string") return false;
+  if (new TextEncoder().encode(JSON.stringify(o)).length > 65536 || new TextEncoder().encode(o.url).length > 2048) return false;
+  try {
+    const url = new URL(o.url);
+    if (!["http:", "https:"].includes(url.protocol) || !url.hostname || url.username || url.password) return false;
+  } catch {
+    return false;
+  }
+  const limits = { title: 300, description: 1e3, selection: 2e3, captured_at: 64 };
+  for (const [key, max] of Object.entries(limits)) {
+    const item = o[key];
+    if (item != null && (typeof item !== "string" || Array.from(item).length > max)) return false;
+  }
+  if (o.content != null) {
+    if (typeof o.content !== "object" || Array.isArray(o.content)) return false;
+    const c = o.content;
+    if (Object.keys(c).some((key) => !["format", "text", "truncated"].includes(key))) return false;
+    if (c.format != null && c.format !== "text" && c.format !== "markdown") return false;
+    if (c.text != null && (typeof c.text !== "string" || Array.from(c.text).length > 12e3)) return false;
+    if (c.truncated != null && typeof c.truncated !== "boolean") return false;
+  }
+  return true;
+}
+
 // src/server/job-access.ts
 var JobAccessRefusal = class extends Error {
   constructor(code) {
@@ -827,6 +893,10 @@ function browserErrorFor(e, route) {
     if (e.code === "rate_limited" || e.code === "concurrency_limited" || e.status === 429) return { status: 429, code: "RATE_LIMITED", message: "", admission: "RATE_LIMITED", retryAfterMs };
   }
   switch (e.code) {
+    case "page_context_invalid":
+      return { status: 400, code: e.code, message: "Invalid page context" };
+    case "page_context_unsupported":
+      return { status: 400, code: e.code, message: "Page context is not supported" };
     case "invalid_request":
       log("error", "- the ingress refused the request shape; check the dewee-webchat version");
       return { status: 400, code: "bad_request", message: "Invalid request" };
@@ -909,7 +979,8 @@ function parseConfig(data) {
     // Reasoning and tool activity stay hidden unless the integration turns them on explicitly.
     showThinking: data.show_thinking === true,
     showToolActivity: data.show_tool_activity === true,
-    maxMessageChars: Number.isInteger(max) && max > 0 ? max : Number.POSITIVE_INFINITY
+    maxMessageChars: Number.isInteger(max) && max > 0 ? max : Number.POSITIVE_INFINITY,
+    pageContextVersions: Array.isArray(data.page_context?.versions) && data.page_context.versions.includes(1) ? [1] : []
   };
 }
 function numericUsage(raw) {
@@ -994,7 +1065,8 @@ function createCcpTransport(client, identity) {
         message: input.message,
         conversation_id: input.conversationId,
         ...withAgent(input.agent),
-        ...input.identitySession ? { identity_session: input.identitySession } : {}
+        ...input.identitySession ? { identity_session: input.identitySession } : {},
+        ...input.pageContext !== void 0 ? { page_context: input.pageContext } : {}
       };
       return withEdge(ctx, visitorId, sealed, (edge) => client.send("chat", { ...base(ctx), body, session: edge.token, accept: "text/event-stream", signal: input.signal }));
     },
@@ -1152,14 +1224,401 @@ function createCcpTransport(client, identity) {
   };
 }
 
+// src/server/identity-session-store.ts
+function memoryIdentitySessionStore(limit = 1e3) {
+  const subjects = /* @__PURE__ */ new Map();
+  const revision = () => crypto.randomUUID();
+  const get = (subjectKey) => {
+    let entry = subjects.get(subjectKey);
+    if (!entry) entry = { revision: revision(), sessions: /* @__PURE__ */ new Map() };
+    subjects.delete(subjectKey);
+    subjects.set(subjectKey, entry);
+    while (subjects.size > limit) subjects.delete(subjects.keys().next().value);
+    return entry;
+  };
+  return {
+    async read(subjectKey, agent) {
+      const entry = get(subjectKey);
+      return { revision: entry.revision, session: entry.sessions.get(agent) ?? null };
+    },
+    async check(subjectKey, expected) {
+      return subjects.get(subjectKey)?.revision === expected;
+    },
+    async commit(subjectKey, agent, expected, session) {
+      const entry = subjects.get(subjectKey);
+      if (!entry || entry.revision !== expected) return false;
+      entry.sessions.set(agent, session);
+      entry.revision = revision();
+      return true;
+    },
+    async deleteToken(namespace, token) {
+      for (const [subjectKey, entry] of subjects) if (subjectKey.startsWith(namespace + ":")) {
+        for (const [agent, session] of entry.sessions) if (session.sessionToken === token) {
+          entry.sessions.delete(agent);
+          entry.revision = revision();
+        }
+      }
+    },
+    async takeSubject(subjectKey) {
+      const entry = get(subjectKey);
+      const held = [...entry.sessions].map(([agent, session]) => ({ agent, session }));
+      entry.sessions.clear();
+      entry.revision = revision();
+      return held;
+    }
+  };
+}
+
+// src/server/image-proxy.ts
+var utf8 = new TextEncoder();
+var encode = (data) => btoa(String.fromCharCode(...data)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+var decode = (data) => Uint8Array.from(atob(data.replace(/-/g, "+").replace(/_/g, "/") + "===".slice((data.length + 3) % 4)), (c) => c.charCodeAt(0));
+async function readImageTicketBody(request) {
+  if (!request.body) return null;
+  const reader = request.body.getReader();
+  const chunks = [];
+  let size = 0;
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      size += value.byteLength;
+      if (size > 8192) {
+        await reader.cancel();
+        return null;
+      }
+      chunks.push(value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  const all = new Uint8Array(size);
+  let offset = 0;
+  for (const chunk of chunks) {
+    all.set(chunk, offset);
+    offset += chunk.length;
+  }
+  return new TextDecoder().decode(all);
+}
+async function ticketKey(secret) {
+  const base = await crypto.subtle.importKey("raw", utf8.encode(secret), "HKDF", false, ["deriveKey"]);
+  return crypto.subtle.deriveKey({ name: "HKDF", hash: "SHA-256", salt: utf8.encode("dewee-webchat"), info: utf8.encode("dewee-webchat:image-ticket:aes-256-gcm:v1") }, base, { name: "AES-GCM", length: 256 }, false, ["encrypt", "decrypt"]);
+}
+async function issueImageTicket(secret, namespace, visitor, source) {
+  const iv = crypto.getRandomValues(new Uint8Array(12));
+  const payload = utf8.encode(JSON.stringify({ v: visitor, u: source, exp: Date.now() + 6e4 }));
+  const ciphertext = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv, additionalData: utf8.encode(`dewee-image-v1:${namespace}`) }, await ticketKey(secret), payload));
+  const result = new Uint8Array(iv.length + ciphertext.length);
+  result.set(iv);
+  result.set(ciphertext, iv.length);
+  return encode(result);
+}
+async function verifyImageTicket(secret, namespace, ticket) {
+  try {
+    if (ticket.length > 8192 || !/^[A-Za-z0-9_-]+$/.test(ticket)) return null;
+    const raw = decode(ticket);
+    if (raw.length <= 28) return null;
+    const plaintext = await crypto.subtle.decrypt({ name: "AES-GCM", iv: raw.slice(0, 12), additionalData: utf8.encode(`dewee-image-v1:${namespace}`) }, await ticketKey(secret), raw.slice(12));
+    const data = JSON.parse(new TextDecoder().decode(plaintext));
+    return typeof data.v === "string" && /^[A-Za-z0-9_-]{8,64}$/.test(data.v) && typeof data.u === "string" && data.u.length <= 4096 && Number.isSafeInteger(data.exp) && data.exp > Date.now() && data.exp <= Date.now() + 6e4 ? { visitor: data.v, source: data.u } : null;
+  } catch {
+    return null;
+  }
+}
+function allowedImageSource(raw, prefixes, endpoint, cloudflare) {
+  try {
+    if (!raw || raw.length > 4096 || /[\u0000-\u0020\u007f\\]/.test(raw)) return null;
+    const match = /^https:\/\/[^/?#]+([^?#]*)/i.exec(raw);
+    if (!match || /%(?:2f|5c|25|2e|0[0-9a-f]|1[0-9a-f]|7f)/i.test(match[1])) return null;
+    const source = new URL(raw);
+    if (source.protocol !== "https:" || source.username || source.password || source.hash || source.port) return null;
+    const parent = endpoint.pathname.replace(/\/+$/, "").replace(/\/(?:image|image-ticket)$/, "");
+    if (parent && (source.pathname === parent || source.pathname.startsWith(`${parent}/`))) return null;
+    if (!parent && /^\/(?:image|image-ticket)(?:\/|$)/.test(source.pathname)) return null;
+    if (cloudflare) {
+      const suffix = endpoint.hostname.split(".").slice(-2).join(".");
+      if (source.hostname === suffix || source.hostname.endsWith(`.${suffix}`)) return null;
+    }
+    return prefixes.some((prefix) => prefix.origin === source.origin && source.pathname.startsWith(prefix.pathname)) ? source : null;
+  } catch {
+    return null;
+  }
+}
+function safeRasterDimensions(bytes, type) {
+  const ascii = (start, end) => String.fromCharCode(...bytes.slice(start, end));
+  const u16 = (at, little = false) => little ? bytes[at] + bytes[at + 1] * 256 : bytes[at] * 256 + bytes[at + 1];
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  const u32 = (at, little = false) => view.getUint32(at, little);
+  const sizeOK = (w, h) => w > 0 && h > 0 && w <= 4096 && h <= 4096 && w * h <= 16e6;
+  let width = 0, height = 0;
+  if (type === "image/png") {
+    let pos = 8, header = false, data = false, end = false;
+    while (pos + 12 <= bytes.length) {
+      const length = u32(pos), name = ascii(pos + 4, pos + 8);
+      if (length > bytes.length - pos - 12) return false;
+      if (name === "IHDR") {
+        if (header || pos !== 8 || length !== 13) return false;
+        header = true;
+        width = u32(pos + 8);
+        height = u32(pos + 12);
+      } else if (name === "acTL" || name === "fcTL" || name === "fdAT") return false;
+      else if (name === "IDAT") data = true;
+      else if (name === "IEND") {
+        end = length === 0;
+        break;
+      }
+      pos += length + 12;
+    }
+    if (!header || !data || !end) return false;
+  } else if (type === "image/gif" && bytes.length >= 13) {
+    width = u16(6, true);
+    height = u16(8, true);
+    let pos = 13 + (bytes[10] & 128 ? 3 * (1 << (bytes[10] & 7) + 1) : 0), frames = 0, end = false;
+    const blocks = () => {
+      while (pos < bytes.length) {
+        const n = bytes[pos++];
+        if (n === 0) return true;
+        if (n > bytes.length - pos) return false;
+        pos += n;
+      }
+      return false;
+    };
+    while (pos < bytes.length) {
+      const marker = bytes[pos++];
+      if (marker === 59) {
+        end = true;
+        break;
+      }
+      if (marker === 33) {
+        if (pos >= bytes.length) return false;
+        pos++;
+        if (!blocks()) return false;
+        continue;
+      }
+      if (marker !== 44 || pos + 9 > bytes.length || ++frames > 1) return false;
+      const left = u16(pos, true), top = u16(pos + 2, true), w = u16(pos + 4, true), h = u16(pos + 6, true), flags = bytes[pos + 8];
+      if (!sizeOK(w, h) || left + w > width || top + h > height) return false;
+      pos += 9 + (flags & 128 ? 3 * (1 << (flags & 7) + 1) : 0);
+      if (pos >= bytes.length) return false;
+      pos++;
+      if (!blocks()) return false;
+    }
+    if (frames !== 1 || !end) return false;
+  } else if (type === "image/jpeg") {
+    let pos = 2, frames = 0, end = false;
+    while (pos + 1 < bytes.length && bytes[pos] === 255) {
+      while (bytes[pos] === 255) pos++;
+      const marker = bytes[pos++];
+      if (marker === 217) {
+        end = true;
+        break;
+      }
+      if (marker === 1 || marker >= 208 && marker <= 215) continue;
+      if (pos + 2 > bytes.length) return false;
+      const length = u16(pos);
+      if (length < 2 || pos + length > bytes.length) return false;
+      if ([192, 193, 194, 195, 197, 198, 199, 201, 202, 203, 205, 206, 207].includes(marker)) {
+        if (++frames !== 1 || length < 7) return false;
+        height = u16(pos + 3);
+        width = u16(pos + 5);
+      }
+      pos += length;
+      if (marker === 218) {
+        while (pos + 1 < bytes.length) {
+          if (bytes[pos] !== 255) {
+            pos++;
+            continue;
+          }
+          const next = bytes[pos + 1];
+          if (next === 0 || next >= 208 && next <= 215) {
+            pos += 2;
+            continue;
+          }
+          break;
+        }
+      }
+    }
+    if (frames !== 1 || !end) return false;
+  } else if (type === "image/webp" && bytes.length >= 20) {
+    const total = u32(4, true) + 8;
+    if (total > bytes.length || total < 20) return false;
+    let pos = 12, images = 0, canvasW = 0, canvasH = 0;
+    while (pos + 8 <= total) {
+      const chunk = ascii(pos, pos + 4), length = u32(pos + 4, true), start = pos + 8;
+      if (length > total - start || start + length + (length & 1) > total || chunk === "ANIM" || chunk === "ANMF") return false;
+      if (chunk === "VP8X") {
+        if (length !== 10 || canvasW || bytes[start] & 2) return false;
+        canvasW = 1 + bytes[start + 4] + (bytes[start + 5] << 8) + (bytes[start + 6] << 16);
+        canvasH = 1 + bytes[start + 7] + (bytes[start + 8] << 8) + (bytes[start + 9] << 16);
+      } else if (chunk === "VP8L" && length >= 5 && bytes[start] === 47) {
+        images++;
+        width = 1 + bytes[start + 1] + ((bytes[start + 2] & 63) << 8);
+        height = 1 + (bytes[start + 2] >> 6) + (bytes[start + 3] << 2) + ((bytes[start + 4] & 15) << 10);
+      } else if (chunk === "VP8 " && length >= 10 && bytes[start + 3] === 157 && bytes[start + 4] === 1 && bytes[start + 5] === 42) {
+        images++;
+        width = u16(start + 6, true) & 16383;
+        height = u16(start + 8, true) & 16383;
+      }
+      pos = start + length + (length & 1);
+    }
+    if (pos !== total || images !== 1 || canvasW && (canvasW !== width || canvasH !== height)) return false;
+  }
+  return sizeOK(width, height);
+}
+async function fetchRasterImage(url, fetcher, redirect = "error") {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), 1e4);
+  try {
+    const response = await fetcher(url, { method: "GET", redirect, credentials: "omit", signal: controller.signal, headers: { accept: "image/png,image/jpeg,image/gif,image/webp" } });
+    if (!response.ok || !response.body) {
+      await response.body?.cancel();
+      return null;
+    }
+    const type = response.headers.get("content-type")?.split(";", 1)[0].trim().toLowerCase();
+    if (!type || !["image/png", "image/jpeg", "image/gif", "image/webp"].includes(type)) {
+      await response.body.cancel();
+      return null;
+    }
+    const length = response.headers.get("content-length");
+    const maxBytes = 2 * 1024 * 1024;
+    if (length && (!/^\d+$/.test(length) || Number(length) > maxBytes)) {
+      await response.body.cancel();
+      return null;
+    }
+    const reader = response.body.getReader();
+    const chunks = [];
+    let size = 0;
+    try {
+      for (; ; ) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        size += value.byteLength;
+        if (size > maxBytes) {
+          await reader.cancel();
+          return null;
+        }
+        chunks.push(value);
+      }
+    } finally {
+      reader.releaseLock();
+    }
+    const bytes = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+      bytes.set(chunk, offset);
+      offset += chunk.length;
+    }
+    const starts = (...signature) => signature.every((value, index) => bytes[index] === value);
+    const ascii = (start, end) => String.fromCharCode(...bytes.slice(start, end));
+    const valid = type === "image/png" ? starts(137, 80, 78, 71, 13, 10, 26, 10) : type === "image/jpeg" ? starts(255, 216, 255) : type === "image/gif" ? ["GIF87a", "GIF89a"].includes(ascii(0, 6)) : ascii(0, 4) === "RIFF" && ascii(8, 12) === "WEBP";
+    if (!valid || !safeRasterDimensions(bytes, type)) return null;
+    return new Response(bytes, { headers: { "content-type": type, "x-content-type-options": "nosniff", "cache-control": "private, no-store", "content-security-policy": "default-src 'none'; sandbox" } });
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// src/server/public-image-fetch-node.ts
+async function publicImageFetchNode(input, init) {
+  if (typeof input !== "string") throw new Error("Invalid image URL");
+  const url = new URL(input);
+  if (url.protocol !== "https:" || url.username || url.password || url.port && url.port !== "443") throw new Error("Invalid image URL");
+  const prefix = "node:";
+  const dns = await import(prefix + "dns/promises");
+  const net = await import(prefix + "net");
+  const https = await import(prefix + "https");
+  if (net.isIP(url.hostname)) throw new Error("IP literals are not allowed");
+  const lookup = dns.lookup(url.hostname, { all: true, verbatim: true });
+  const signal = init?.signal;
+  const addresses = signal ? await new Promise((resolve, reject) => {
+    if (signal.aborted) {
+      reject(new Error("Image request timed out"));
+      return;
+    }
+    const abort = () => reject(new Error("Image request timed out"));
+    signal.addEventListener("abort", abort, { once: true });
+    lookup.then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
+  }) : await lookup;
+  if (!addresses.length) throw new Error("No image address");
+  if (!publicImageAddresses(addresses, net.BlockList)) throw new Error("Non-public image address");
+  const chosen = addresses.find((entry) => entry.family === 4) ?? addresses[0];
+  return new Promise((resolve, reject) => {
+    const request = https.request(url, {
+      method: "GET",
+      headers: { accept: "image/png,image/jpeg,image/gif,image/webp" },
+      signal: init?.signal ?? void 0,
+      family: chosen.family,
+      lookup: (_host, _options, callback) => callback(null, chosen.address, chosen.family)
+    }, (response) => {
+      if (!response.statusCode || response.statusCode < 200 || response.statusCode >= 300 || response.statusCode === 204 || response.statusCode === 205) {
+        response.destroy();
+        reject(new Error("Image upstream refused"));
+        return;
+      }
+      const headers = new Headers();
+      for (const [name, value] of Object.entries(response.headers)) if (typeof value === "string") headers.set(name, value);
+      let received = 0;
+      let settled = false;
+      const body = new ReadableStream({
+        start(controller) {
+          response.pause();
+          response.on("data", (chunk) => {
+            response.pause();
+            received += chunk.length;
+            if (received > 2 * 1024 * 1024) {
+              settled = true;
+              response.destroy();
+              controller.error(new Error("Image too large"));
+            } else controller.enqueue(new Uint8Array(chunk));
+          });
+          response.on("end", () => {
+            if (!settled) {
+              settled = true;
+              controller.close();
+            }
+          });
+          response.on("error", (error) => {
+            if (!settled) {
+              settled = true;
+              controller.error(error);
+            }
+          });
+        },
+        pull() {
+          response.resume();
+        },
+        cancel() {
+          settled = true;
+          response.destroy();
+        }
+      });
+      resolve(new Response(body, { status: response.statusCode ?? 502, headers }));
+    });
+    request.on("error", reject);
+    request.end();
+  });
+}
+function publicImageAddresses(addresses, BlockList) {
+  const denied4 = new BlockList();
+  const denied6 = new BlockList();
+  for (const [ip, bits] of [["0.0.0.0", 8], ["10.0.0.0", 8], ["100.64.0.0", 10], ["127.0.0.0", 8], ["169.254.0.0", 16], ["172.16.0.0", 12], ["192.0.0.0", 24], ["192.0.2.0", 24], ["192.88.99.0", 24], ["192.168.0.0", 16], ["198.18.0.0", 15], ["198.51.100.0", 24], ["203.0.113.0", 24], ["224.0.0.0", 4], ["240.0.0.0", 4]]) denied4.addSubnet(ip, bits, "ipv4");
+  for (const [ip, bits] of [["::", 128], ["::1", 128], ["::ffff:0:0", 96], ["64:ff9b::", 96], ["100::", 64], ["2001::", 23], ["2001:db8::", 32], ["2002::", 16], ["3fff::", 20], ["fc00::", 7], ["fe80::", 10], ["ff00::", 8]]) denied6.addSubnet(ip, bits, "ipv6");
+  const publicV6 = new BlockList();
+  publicV6.addSubnet("2000::", 3, "ipv6");
+  return addresses.length > 0 && addresses.every(({ address, family }) => family === 6 ? !denied6.check(address, "ipv6") && publicV6.check(address, "ipv6") : family === 4 && !denied4.check(address, "ipv4"));
+}
+
 // src/server/handler.ts
+var IdentityStoreError = class extends Error {
+};
 var ID_RE = /^[A-Za-z0-9_-]{6,64}$/;
 var AGENT_RE = /^[A-Za-z0-9_.:-]{1,64}$/;
 var IDEMPOTENCY_KEY_RE = /^[\x21-\x7E]{1,255}$/;
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var DEFAULT_IDENTITY_TTL_MS = 36e5;
 var MAX_IDENTITY_TTL_MS = 432e5;
-var MAX_CACHED_SESSIONS = 1e3;
 var ANON_REUSE_MS = 864e5;
 var VERIFIED_REUSE_MIN_MS = 12e4;
 function checkIdentityOptions(o, staticAgents, transport) {
@@ -1205,11 +1664,30 @@ function createDeweeHandler(options) {
     ...options
   };
   const transport = resolveTransport(o);
+  if (o.imageSources !== void 0 && !Array.isArray(o.imageSources)) throw new Error("[dewee-webchat] imageSources must be an array");
+  const imageSources = (o.imageSources ?? []).map((origin) => {
+    let url;
+    try {
+      url = new URL(origin);
+    } catch {
+      throw new Error("[dewee-webchat] Invalid image origin");
+    }
+    if (url.protocol !== "https:" || url.username || url.password || url.search || url.hash || url.port || !url.pathname.endsWith("/") || /%(?:2f|5c|25|2e|0[0-9a-f]|1[0-9a-f]|7f)/i.test(url.pathname)) throw new Error("[dewee-webchat] Image sources must be HTTPS directory prefixes on the default port");
+    return url;
+  });
+  let activeImages = 0;
+  const imageNamespace = `${o.ccp?.chatUrl ?? o.gatewayUrl ?? ""}
+${o.ccp?.integrationId ?? o.tenantId ?? ""}`;
+  if (o.allowedHeaders !== void 0 && (!Array.isArray(o.allowedHeaders) || o.allowedHeaders.some((name) => typeof name !== "string" || !/^[A-Za-z0-9-]+$/.test(name)))) {
+    throw new Error("[dewee-webchat] allowedHeaders must contain valid header names (letters, digits and hyphens)");
+  }
   let secret = o.secret;
   if (!secret) {
+    if (o.allowEphemeralSecret !== true) throw new Error("[dewee-webchat] Configure secret (DEWEE_WEBCHAT_SECRET), or explicitly enable allowEphemeralSecret for development");
     secret = randomId(32);
     console.warn("[dewee-webchat] No secret configured: using an ephemeral one. Visitor sessions reset on restart.");
   }
+  if (new TextEncoder().encode(secret).length < 32) throw new Error("[dewee-webchat] secret (DEWEE_WEBCHAT_SECRET) must be at least 32 bytes");
   const limiter = o.rateLimit === false ? null : o.rateLimit ?? memoryRateLimiter({ chat: [20, 6e4], session: [10, 6e5], preauth: [120, 6e4], verified: [30, 6e5], link: [5, 6e5] });
   const staticAgents = o.agents === "*" ? [] : (o.agents ?? []).map((a) => typeof a === "string" ? { id: a } : a);
   const wildcardAgents = o.agents === "*";
@@ -1280,7 +1758,7 @@ function createDeweeHandler(options) {
     return {
       "Access-Control-Allow-Origin": origin,
       "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
-      "Access-Control-Allow-Headers": `content-type, authorization, ${HEADER_GATEWAY_URL}, ${HEADER_GATEWAY_TOKEN}`,
+      "Access-Control-Allow-Headers": [.../* @__PURE__ */ new Set(["content-type", "authorization", HEADER_GATEWAY_URL, HEADER_GATEWAY_TOKEN, ...(o.allowedHeaders ?? []).map((h) => h.toLowerCase())])].join(", "),
       "Access-Control-Max-Age": "600",
       Vary: "Origin"
     };
@@ -1300,27 +1778,27 @@ function createDeweeHandler(options) {
     return json(req, { error: { message: e.message, code, remediation: remediation ?? { action: e.action, audience: "end_user" } } }, e.status);
   };
   const misconfigured = (req) => fail(req, 500, "Signed-in chat is misconfigured on this server", "identity_misconfigured");
-  function ccpFail(req, e, route, sessionToken) {
+  async function ccpFail(req, e, route, sessionToken) {
     const b = browserErrorFor(e, route);
     if (b.admission) {
       const r = admissionErrorResponse(b.admission, b.retryAfterMs);
       return json(req, r.body, r.status, r.headers);
     }
     if (b.identity) {
-      if (sessionToken && DEAD_SESSION_CODES.has(b.identity)) forgetCachedSession(sessionToken);
+      if (sessionToken && DEAD_SESSION_CODES.has(b.identity)) await forgetCachedSession(sessionToken);
       return identityFail(req, b.identity, b.remediation);
     }
     const res = fail(req, b.status, b.message, b.code);
     if (b.retryAfterSeconds) res.headers.set("retry-after", String(Math.ceil(b.retryAfterSeconds)));
     return res;
   }
-  const gatewayFail = (req, e, sessionToken) => {
+  const gatewayFail = async (req, e, sessionToken) => {
     if (e instanceof GatewayError && isAdmissionErrorCode(e.code)) {
       const r = admissionErrorResponse(e.code, e.retryAfterMs);
       return json(req, r.body, r.status, r.headers);
     }
     if (!(e instanceof GatewayError && isIdentityErrorCode(e.code))) return fail(req, 502, e.message, "gateway_error");
-    if (sessionToken && DEAD_SESSION_CODES.has(e.code)) forgetCachedSession(sessionToken);
+    if (sessionToken && DEAD_SESSION_CODES.has(e.code)) await forgetCachedSession(sessionToken);
     if (e.remediation?.audience === "operator") console.error(`[dewee-webchat] identity: ${e.message} (${e.code})`);
     return identityFail(req, e.code, e.remediation);
   };
@@ -1354,7 +1832,7 @@ function createDeweeHandler(options) {
     }
     return ccpFail(req, e, "identity/exchange");
   };
-  const linkFail = (req, e, sessionToken) => {
+  const linkFail = async (req, e, sessionToken) => {
     const code = e?.code;
     if (code === "IDEMPOTENCY_KEY_REUSED") return fail(req, 409, "This idempotency key was already used for a different link request", "idempotency_key_reused");
     if (code === "FAILED_PRECONDITION") return fail(req, 409, "A link is already in progress. Use its code or wait until it expires.", "link_in_progress");
@@ -1362,7 +1840,7 @@ function createDeweeHandler(options) {
       console.error("[dewee-webchat] identity link start: the gateway has identity exchange switched off");
       return fail(req, 503, "Linking is not available right now", "linking_unavailable");
     }
-    if (typeof code === "string" && DEAD_SESSION_CODES.has(code)) forgetCachedSession(sessionToken);
+    if (typeof code === "string" && DEAD_SESSION_CODES.has(code)) await forgetCachedSession(sessionToken);
     return sdkFail(req, e, "link start");
   };
   const clientIp = (req) => req.headers.get("cf-connecting-ip") || req.headers.get("x-real-ip") || req.headers.get("x-forwarded-for")?.split(",")[0].trim() || "unknown";
@@ -1395,7 +1873,7 @@ function createDeweeHandler(options) {
     const current = !!user && typeof user.subject === "string" && user.subject !== "" ? await subjectDigest(secret, user.subject) : null;
     if (current && claims.sub && constantTimeEqual(current, claims.sub)) return null;
     if (ccp && current && claims.sub) {
-      forgetCachedSession(claims.ids);
+      await forgetCachedSession(claims.ids);
       await ccp.revoke(visitorContext(req), claims.v, sealedEdge(claims), claims.ids, claims.ida);
     }
     return identityFail(req, "IDENTITY_REQUIRED");
@@ -1409,22 +1887,20 @@ function createDeweeHandler(options) {
     if (idn.assertionSecret) return { applicationId: idn.appId, issuer: idn.issuer, secret: idn.assertionSecret };
     return { applicationId: idn.appId, issuer: idn.issuer, privateKeyJwk: idn.privateKeyJwk, algorithm: idn.algorithm };
   }
-  const sessionCache = /* @__PURE__ */ new Map();
+  const sessionStore = idn?.sessionStore ?? memoryIdentitySessionStore();
   const exchanges = /* @__PURE__ */ new Map();
-  function forgetCachedSession(sessionToken) {
-    for (const [k, c] of sessionCache) if (c.sessionToken === sessionToken) sessionCache.delete(k);
-  }
-  function rememberSession(key, c) {
-    sessionCache.delete(key);
-    sessionCache.set(key, c);
-    if (sessionCache.size <= MAX_CACHED_SESSIONS) return;
-    const now = Date.now();
-    for (const [k, v] of sessionCache) if (v.deadline - now <= v.margin) sessionCache.delete(k);
-    for (const k of sessionCache.keys()) {
-      if (sessionCache.size <= MAX_CACHED_SESSIONS) break;
-      sessionCache.delete(k);
+  async function storeOperation(operation) {
+    try {
+      return await operation();
+    } catch {
+      throw new IdentityStoreError("Identity session store unavailable");
     }
   }
+  async function forgetCachedSession(sessionToken) {
+    await storeOperation(async () => sessionStore.deleteToken(await storeNamespace(), sessionToken));
+  }
+  const storeNamespace = () => subjectDigest(secret, JSON.stringify([o.ccp?.chatUrl ?? o.gatewayUrl ?? "", o.ccp?.integrationId ?? o.tenantId ?? "", idn.appId, idn.issuer]));
+  const storeSubject = async (subject) => `${await storeNamespace()}:${await subjectDigest(secret, subject)}`;
   async function exchangeFor(subject, req, sealed) {
     if (ccp) return ccpExchangeFor(subject, req, sealed);
     const session = await idn.sdk.exchangeSession({
@@ -1477,28 +1953,44 @@ function createDeweeHandler(options) {
     } catch (e) {
       return ccpFail(req, e, "config");
     }
-    const key = `${agent}
-${subject}`;
-    let s = sessionCache.get(key);
+    const subjectKey = await storeSubject(subject);
+    const key = JSON.stringify([subjectKey, agent]);
+    const observed = await storeOperation(() => sessionStore.read(subjectKey, agent));
+    let s = observed.session;
     const userVisitor = ccp ? await deriveVisitorId(secret, `subject:${subject}`) : void 0;
     const sealed = hint && hint.ids && hint.v === userVisitor ? sealedEdge(hint) : void 0;
     if (!s || s.deadline - Date.now() <= s.margin) {
-      const reused = await verifiedReuse(req, hint, subject, agent, userVisitor);
-      if (reused) {
-        s = reused;
-      } else {
-        let pending = exchanges.get(key);
-        if (!pending) {
-          pending = exchangeFor(subject, req, sealed).finally(() => exchanges.delete(key));
-          exchanges.set(key, pending);
-        }
-        try {
-          s = await pending;
-        } catch (e) {
-          return ccp ? ccpExchangeFail(req, e) : exchangeFail(req, e);
-        }
+      let pending = exchanges.get(key);
+      if (!pending) {
+        pending = (async () => {
+          const reused = await verifiedReuse(req, hint, subject, agent, userVisitor);
+          const candidate = reused ?? await exchangeFor(subject, req, sealed);
+          const revokeMinted = async () => {
+            if (ccp && !reused) await ccp.revoke(visitorContext(req), candidate.visitorId, sealed, candidate.sessionToken, agent).catch(() => {
+            });
+          };
+          try {
+            const committed = await storeOperation(() => sessionStore.commit(subjectKey, agent, observed.revision, candidate));
+            if (!committed) {
+              const current = await storeOperation(() => sessionStore.read(subjectKey, agent));
+              if (current.session?.sessionToken !== candidate.sessionToken) throw new IdentityStoreError("Identity session changed");
+            }
+            return candidate;
+          } catch (error) {
+            await revokeMinted();
+            throw error;
+          }
+        })().finally(() => exchanges.delete(key));
+        exchanges.set(key, pending);
+      }
+      try {
+        s = await pending;
+      } catch (e) {
+        if (e instanceof IdentityStoreError) throw e;
+        return ccp ? ccpExchangeFail(req, e) : exchangeFail(req, e);
       }
-      rememberSession(key, s);
+    } else if (!await storeOperation(() => sessionStore.check(subjectKey, observed.revision))) {
+      return identityFail(req, "SOURCE_UNAVAILABLE", { action: "retry_later", audience: "end_user" });
     }
     const now = Date.now();
     const expiresAt = Math.min(s.deadline, now + o.sessionTtlMs);
@@ -1546,6 +2038,15 @@ ${subject}`;
       maxMessageLength: o.maxMessageLength,
       version: VERSION
     };
+    if (creds && new URL(req.url).searchParams.get("pageContext") === "1") {
+      if (limiter && !await limiter(clientIp(req), "preauth")) return fail(req, 429, "Too many requests, slow down", "rate_limited");
+      try {
+        const probe = await GatewayConnection.connect(creds, o.userIdPrefix + "capability-probe");
+        if (probe.pageContextVersions.length) body.pageContextVersions = probe.pageContextVersions;
+        probe.close();
+      } catch {
+      }
+    }
     if (idn) {
       body.defaultAgent = identityAgent;
       body.allowAgentSwitch = false;
@@ -1570,6 +2071,7 @@ ${subject}`;
       turnstileSiteKey: o.turnstile?.siteKey,
       ...o.turnstile ? { refreshWithoutTurnstile: true } : {},
       maxMessageLength: Math.min(o.maxMessageLength, cfg.maxMessageChars),
+      ...cfg.pageContextVersions.length ? { pageContextVersions: cfg.pageContextVersions } : {},
       version: VERSION
     };
     if (idn) {
@@ -1605,7 +2107,7 @@ ${subject}`;
     if (!(ccp && previous) && !await turnstilePassed(body, ip)) return fail(req, 403, "Verification failed", "turnstile_failed");
     const visitorId = previous?.v ?? randomId(16);
     const expiresAt = Date.now() + o.sessionTtlMs;
-    if (!ccp) return json(req, { visitorId, token: await signVisitorToken(secret, { v: visitorId, exp: expiresAt }), expiresAt });
+    if (!ccp) return json(req, { visitorId, token: await signVisitorToken(secret, { v: visitorId, exp: expiresAt }), expiresAt, expiresIn: Math.max(0, expiresAt - Date.now()) });
     let edge;
     try {
       edge = await ccp.edgeFor(visitorContext(req), visitorId, sealedEdge(previous), void 0, EDGE_RESEAL_MS);
@@ -1642,7 +2144,7 @@ ${subject}`;
     const previous = await anonymousPrevious(body);
     if (previous && previous.exp - Date.now() > ANON_REUSE_MS) {
       if (!ccp) {
-        const reused = { visitorId: previous.v, token: body.token, expiresAt: previous.exp };
+        const reused = { visitorId: previous.v, token: body.token, expiresAt: previous.exp, expiresIn: Math.max(0, previous.exp - Date.now()) };
         return json(req, reused);
       }
       const edge = sealedEdge(previous);
@@ -1666,7 +2168,10 @@ ${subject}`;
     const { creds, byo: isByo, error } = resolveCreds(req);
     if (error) return fail(req, 400, error, "bad_credentials");
     if (!creds && !ccp) return fail(req, 500, "Gateway is not configured", "not_configured");
-    const body = await req.json().catch(() => null);
+    const input = await readChatBody(req);
+    if ("error" in input) return fail(req, input.error === "too_large" ? 413 : 400, input.error === "too_large" ? "Request is too large" : "Invalid request", input.error === "too_large" ? "too_long" : "bad_request");
+    if (!input.body || typeof input.body !== "object" || Array.isArray(input.body)) return fail(req, 400, "Invalid request", "bad_request");
+    const body = input.body;
     const message = typeof body?.message === "string" ? body.message.trim() : "";
     if (!message) return fail(req, 400, "Message is required");
     if (message.length > o.maxMessageLength) return fail(req, 413, `Message exceeds ${o.maxMessageLength} characters`, "too_long");
@@ -1686,15 +2191,23 @@ ${subject}`;
       if (e instanceof ActionInputError) return fail(req, e.status, e.message, e.code);
       throw e;
     }
-    if (ccp) return ccpChat(req, claims, { message: pageBlock + message, rawMessage: message, conversationId, agent, actionsHash });
+    if (body?.page_context != null) {
+      if (typeof body.page_context === "object" && Number.isInteger(body.page_context.version) && body.page_context.version !== 1) return fail(req, 400, "Page context is not supported", "page_context_unsupported");
+      if (!validPageContext(body.page_context)) return fail(req, 400, "Invalid page context", "page_context_invalid");
+    }
+    if (ccp) return ccpChat(req, claims, { message: pageBlock + message, rawMessage: message, conversationId, agent, actionsHash, pageContext: body?.page_context });
     if (!creds) return fail(req, 500, "Gateway is not configured", "not_configured");
     let connection;
-    if (claims.ids) {
+    if (claims.ids || body?.page_context != null) {
       try {
-        connection = await GatewayConnection.connect(creds, { identitySession: claims.ids });
+        connection = await GatewayConnection.connect(creds, claims.ids ? { identitySession: claims.ids } : o.userIdPrefix + visitorId);
       } catch (e) {
         return gatewayFail(req, e, claims.ids);
       }
+      if (body?.page_context != null && !connection.pageContextVersions.includes(1)) {
+        connection.close();
+        return fail(req, 400, "Page context is not supported", "page_context_unsupported");
+      }
     }
     const sessionKey = buildSessionKey(agent, `webchat-${visitorId}-${conversationId}`);
     const abort = new AbortController();
@@ -1712,12 +2225,12 @@ ${subject}`;
       try {
         await send(actionsHash ? { type: "start", conversationId, agent, actionsHash } : { type: "start", conversationId, agent });
         const who = connection ? { connection } : { userId: o.userIdPrefix + visitorId };
-        for await (const ev of streamChat({ creds, ...who, agent, sessionKey, message: pageBlock + message, signal: abort.signal, timeoutMs: o.timeoutMs })) {
+        for await (const ev of streamChat({ creds, ...who, agent, sessionKey, message: pageBlock + message, pageContext: body?.page_context ?? void 0, signal: abort.signal, timeoutMs: o.timeoutMs })) {
           if (ev.type === "start") continue;
           if (ev.type === "done") reply = ev.content;
           if (ev.type === "error") {
             errMsg = gatewayReasonOf(ev) ?? ev.message;
-            if (claims.ids && ev.code && DEAD_SESSION_CODES.has(ev.code)) forgetCachedSession(claims.ids);
+            if (claims.ids && ev.code && DEAD_SESSION_CODES.has(ev.code)) await forgetCachedSession(claims.ids);
           }
           await send(ev);
           if (abort.signal.aborted) break;
@@ -1773,6 +2286,20 @@ ${subject}`;
     let upstream;
     try {
       cfg = await ccp.config();
+      if (turn.pageContext != null) {
+        if (!cfg.pageContextVersions.includes(1)) {
+          cleanup();
+          return fail(req, 400, "Page context is not supported", "page_context_unsupported");
+        }
+        if (typeof turn.pageContext === "object" && "version" in turn.pageContext && Number.isInteger(turn.pageContext.version) && turn.pageContext.version !== 1) {
+          cleanup();
+          return fail(req, 400, "Page context is not supported", "page_context_unsupported");
+        }
+        if (!validPageContext(turn.pageContext)) {
+          cleanup();
+          return fail(req, 400, "Invalid page context", "page_context_invalid");
+        }
+      }
       if (turn.rawMessage.length > cfg.maxMessageChars) {
         cleanup();
         return fail(req, 413, `Message exceeds ${cfg.maxMessageChars} characters`, "too_long");
@@ -1782,6 +2309,7 @@ ${subject}`;
         conversationId: turn.conversationId,
         agent: turn.agent || void 0,
         identitySession: claims.ids,
+        pageContext: turn.pageContext ?? void 0,
         signal: abort.signal
       });
     } catch (e) {
@@ -1828,7 +2356,7 @@ ${subject}`;
           if (ev.type === "error") {
             errMsg = ev.message;
             finished = true;
-            if (claims.ids && ev.code && DEAD_SESSION_CODES.has(ev.code)) forgetCachedSession(claims.ids);
+            if (claims.ids && ev.code && DEAD_SESSION_CODES.has(ev.code)) await forgetCachedSession(claims.ids);
           }
           await send(ev);
           if (abort.signal.aborted) break;
@@ -1969,10 +2497,12 @@ ${subject}`;
   async function revoke(subject, request, token) {
     if (!idn || typeof subject !== "string" || subject === "") return;
     try {
-      const held = [];
-      for (const [k, c] of sessionCache) {
-        const cut = k.indexOf("\n");
-        if (k.slice(cut + 1) === subject) held.push({ agent: k.slice(0, cut), session: c });
+      const subjectKey = await storeSubject(subject);
+      let held = [];
+      try {
+        held = await storeOperation(() => sessionStore.takeSubject(subjectKey));
+      } catch {
+        console.warn("[dewee-webchat] identity session store unavailable during revoke");
       }
       if (ccp && typeof token === "string" && token !== "") {
         const c = await verifyReuseHint(secret, token) ?? await verifyVisitorToken(secret, token);
@@ -1980,7 +2510,6 @@ ${subject}`;
           held.push({ agent: c.ida, session: { sessionToken: c.ids, visitorId: c.v, deadline: c.exp, margin: 0 }, edge: sealedEdge(c) });
         }
       }
-      for (const { session } of held) forgetCachedSession(session.sessionToken);
       if (!ccp) return;
       const fromRequest = request ? visitorContext(request) : null;
       await Promise.all(
@@ -1999,6 +2528,44 @@ ${subject}`;
     if (!originAllowed(req)) return fail(req, 403, "Origin not allowed", "forbidden_origin");
     const action = new URL(req.url).pathname.replace(/\/+$/, "").split("/").pop();
     try {
+      if (req.method === "POST" && action === "image-ticket" && imageSources.length) {
+        const claims = await visitorFrom(req);
+        if (!claims) return fail(req, 401, "Missing or expired visitor session", "unauthorized");
+        if (idn?.required && !claims.ids) return identityFail(req, "IDENTITY_REQUIRED");
+        const refused = await rebindRefusal(req, claims);
+        if (refused) return refused;
+        if (limiter && !await limiter(`image-ticket:${claims.v}`, "preauth")) return fail(req, 429, "Too many requests, try again later", "rate_limited");
+        const body = await readImageTicketBody(req);
+        if (body === null) return fail(req, 413, "Invalid image", "invalid_request");
+        let parsed;
+        try {
+          parsed = JSON.parse(body);
+        } catch {
+          return fail(req, 400, "Invalid image", "invalid_request");
+        }
+        const raw = parsed?.url;
+        const worker = globalThis.navigator?.userAgent === "Cloudflare-Workers";
+        const source = typeof raw === "string" ? allowedImageSource(raw, imageSources, new URL(req.url), worker) : null;
+        if (!source) return fail(req, 403, "Image not allowed", "forbidden_image");
+        return json(req, { ticket: await issueImageTicket(secret, imageNamespace, claims.v, source.href) });
+      }
+      if (req.method === "GET" && action === "image" && imageSources.length) {
+        const ticket = new URL(req.url).searchParams.get("ticket") ?? "";
+        const claims = await verifyImageTicket(secret, imageNamespace, ticket);
+        if (!claims) return fail(req, 401, "Image ticket expired", "unauthorized");
+        const worker = globalThis.navigator?.userAgent === "Cloudflare-Workers";
+        const source = allowedImageSource(claims.source, imageSources, new URL(req.url), worker);
+        if (!source) return fail(req, 403, "Image not allowed", "forbidden_image");
+        if (limiter && !await limiter(`image:${claims.visitor}`, "preauth")) return fail(req, 429, "Too many requests, try again later", "rate_limited");
+        if (activeImages >= 8) return fail(req, 429, "Too many requests, try again later", "rate_limited");
+        activeImages++;
+        try {
+          const result = await fetchRasterImage(source.href, worker ? globalThis.fetch : publicImageFetchNode, worker ? "manual" : "error");
+          return result ?? fail(req, 502, "Image unavailable", "image_unavailable");
+        } finally {
+          activeImages--;
+        }
+      }
       if (req.method === "GET" && action === "config") return await handleConfig(req);
       if (req.method === "POST" && action === "session") return await handleSession(req);
       if (req.method === "POST" && action === "chat") return await handleChat(req);
@@ -2007,6 +2574,7 @@ ${subject}`;
       if (req.method === "POST" && action === "job-access" && idn) return await handleJobAccess(req);
       return fail(req, 404, "Not found", "not_found");
     } catch (e) {
+      if (e instanceof IdentityStoreError) return identityFail(req, "SOURCE_UNAVAILABLE", { action: "retry_later", audience: "end_user" });
       if (!ccp) return fail(req, 500, e.message || "Internal error", "internal");
       console.error("[dewee-webchat] internal error:", e instanceof CcpError ? e.code : e);
       return fail(req, 500, "Internal error", "internal");
@@ -2037,6 +2605,7 @@ function optionsFromEnv(env, overrides = {}) {
     agents,
     defaultAgent: env.DEWEE_DEFAULT_AGENT,
     allowedOrigins: origins,
+    imageSources: list(env.DEEWEE_IMAGE_SOURCES),
     allowClientCredentials: env.DEWEE_ALLOW_CLIENT_CREDENTIALS === "true" ? byoHosts?.length ? { allowedHosts: byoHosts } : true : false,
     turnstile: env.TURNSTILE_SITE_KEY && env.TURNSTILE_SECRET_KEY ? { siteKey: env.TURNSTILE_SITE_KEY, secretKey: env.TURNSTILE_SECRET_KEY } : void 0,
     // undefined overrides must not erase env-derived values
@@ -2110,6 +2679,7 @@ export {
   hashManifest,
   isAdmissionErrorCode,
   listAgents,
+  memoryIdentitySessionStore,
   memoryRateLimiter,
   normalizeManifest,
   optionsFromEnv,