dsh-background-by-model 0.7.4 → 0.7.6

package/lib/index.js

@@ -1,5 +1,4 @@
 import { access, mkdir, readFile, readdir, rename, rm, writeFile } from "node:fs/promises";
-import { fileURLToPath } from "node:url";
 import { dshHomePath } from "@deepseek-ai/dsh-home-paths";
 //#region src/holiday.ts
 const HOLIDAYS = [{
@@ -76,18 +75,22 @@ function defaultRotation() {
 *   `sidebar` sidebar (`--dsw-specific-sidebar-fill`)
 *   `card`    cards/panels (`--dsw-alias-bg-layer-1/2/3`, `--dsw-specific-menu`
 *             and its 0.1.7 alias `--dsw-menu-surface-fill`)
+*   `code`    code blocks, banner included (`--dsw-alias-markdown-code-block`,
+*             `--dsw-alias-markdown-code-block-banner`)
 *   `input`   input/control surfaces (`--dsw-specific-input-major`)
 */
 const PART_OPACITY_KEYS = [
 	"bg",
 	"sidebar",
 	"card",
+	"code",
 	"input"
 ];
 const DEFAULT_PART_OPACITIES = {
 	bg: .85,
 	sidebar: .93,
 	card: 1,
+	code: 1,
 	input: 1
 };
 /**
@@ -185,7 +188,9 @@ function hexToHsl(hex) {
 *
 * Holidays default to `fill` rather than a rule's `fit`: these are full-bleed
 * festival wallpapers, and `fit` would letterbox them on every aspect ratio the
-* art was not cut for.
+* art was not cut for. The mode now lives on the IMAGE (see `BgImage.bgMode`), so
+* that default is written there — and `fill` is what a holiday's read-back
+* sanitizer refuses to lose (see `normalizeHolidayRule`).
 */
 function defaultHolidayRule(def) {
 	const color = hexToHsl(def.color);
@@ -193,13 +198,13 @@ function defaultHolidayRule(def) {
 		id: def.id,
 		images: [{
 			slot: def.slot,
+			bgMode: "fill",
 			bgState: { ...DEFAULT_BG_STATE },
 			color
 		}],
 		match: "",
 		enabled: true,
 		color,
-		bgMode: "fill",
 		wallpaperOpacity: 1,
 		blur: 0,
 		rotate: defaultRotation()
@@ -308,12 +313,21 @@ function normalizeTransition(raw, legacyMs) {
 * same as absent: an entry with `color: null` is an image the user explicitly set
 * to "follow the system theme", and re-inheriting the rule's color over that
 * would undo a deliberate choice on every load.
+*
+* `inheritMode` is the same one-shot lift for the layout mode, and it is the
+* caller's to resolve because the two callers answer differently: a user rule
+* passes the mode its config carried at the RULE level (a schema-5 config, where
+* 适应/填充 was one choice for the whole rotation), a holiday passes `fill` (its
+* own default, which is not up for the lift to change). An entry that HAS a
+* `bgMode` key keeps it — including one that has just been set to a value equal
+* to the default, which is a decision and not an absence.
 */
-function normalizeImage(raw, inherit = null) {
+function normalizeImage(raw, inherit = null, inheritMode = "fit") {
 	const i = raw ?? {};
 	if (typeof i.slot !== "string" || !SLOT_RE.test(i.slot)) return null;
 	return {
 		slot: i.slot,
+		bgMode: BG_MODES.includes(i.bgMode) ? i.bgMode : inheritMode,
 		bgState: normalizeBgState(i.bgState),
 		color: hasOwn(i, "color") ? normalizeHsl(i.color) : inherit
 	};
@@ -333,6 +347,14 @@ function normalizeImage(raw, inherit = null) {
 * it as well: it is not a default for its images at paint time any more, but it
 * is still what the rule paints once its last picture is gone.
 *
+* The layout mode makes the same trip in the other direction, and this is the
+* last release that has to: a config written before 0.7.5 keeps `bgMode` at the RULE
+* level, where one value covered every picture of a rotation, so it is read here
+* once and handed to each image as its inherited mode. What the user chose
+* therefore survives the move the same way it survived the color's — the mode is
+* not reset to the default on upgrade, and the field it used to live on is simply
+* not written back.
+*
 * An EMPTY list is a legitimate rule, not a broken one: removing a rule's last
 * picture has to be expressible, and forcing an entry back in is what produced a
 * phantom blank image that took slot 1 and could never be deleted again (the next
@@ -347,11 +369,12 @@ function normalizeRule(raw) {
 	const id = typeof r.id === "string" && r.id !== "" ? r.id : null;
 	if (id === null) return null;
 	const color = normalizeHsl(r.color);
+	const mode = BG_MODES.includes(r.bgMode) ? r.bgMode : "fit";
 	const images = [];
 	const seen = /* @__PURE__ */ new Set();
 	const hadList = Array.isArray(r.images);
 	if (hadList) for (const entry of r.images) {
-		const image = normalizeImage(entry, color);
+		const image = normalizeImage(entry, color, mode);
 		if (image === null || seen.has(image.slot)) continue;
 		seen.add(image.slot);
 		images.push(image);
@@ -359,21 +382,22 @@ function normalizeRule(raw) {
 	const legacySlot = typeof r.slot === "string" && SLOT_RE.test(r.slot) ? r.slot : null;
 	if (images.length === 0 && legacySlot !== null) images.push({
 		slot: legacySlot,
+		bgMode: mode,
 		bgState: normalizeBgState(r.bgState),
 		color
 	});
 	if (images.length === 0 && !hadList) return null;
-	const mode = BG_MODES.includes(r.bgMode) ? r.bgMode : "fit";
+	const rotate = normalizeRotation(r.rotate);
+	if (images.length < 2) rotate.enabled = false;
 	return {
 		id,
 		images,
 		match: typeof r.match === "string" ? r.match : "",
 		enabled: r.enabled !== false,
 		color,
-		bgMode: mode,
 		wallpaperOpacity: clamp01(r.wallpaperOpacity, 1),
 		blur: clamp(r.blur, 0, 60, 0),
-		rotate: normalizeRotation(r.rotate)
+		rotate
 	};
 }
 /**
@@ -384,9 +408,12 @@ function normalizeRule(raw) {
 * its bytes, and its theme color is a fixed part of what that holiday looks like —
 * so a stale or hand-edited value would either orphan the wallpaper, point the
 * holiday at a rule's image, or paint a festival in a color it does not have.
-* Everything else is sanitized exactly like a rule's field — except the image
-* list and the rotation, which stay the definition's own single image and stay
-* off, so a festival can never be swapped or cycled.
+* Everything else is sanitized exactly like a rule's field — except three things
+* that stay the definition's own: the image list and the rotation (so a festival
+* can never be swapped or cycled), and the layout mode, which is the definition's
+* `fill` for the same reason the color is its own — full-bleed art letterboxed by
+* a stale `fit` is the one thing this feature must not do, and the mode is not
+* editable for a holiday anywhere in the panel.
 */
 function normalizeHolidayRule(def, raw) {
 	const r = raw ?? {};
@@ -394,11 +421,11 @@ function normalizeHolidayRule(def, raw) {
 	return {
 		...base,
 		enabled: r.enabled !== false,
-		bgMode: BG_MODES.includes(r.bgMode) ? r.bgMode : base.bgMode,
 		wallpaperOpacity: clamp01(r.wallpaperOpacity, base.wallpaperOpacity),
 		blur: clamp(r.blur, 0, 60, base.blur),
 		images: base.images.map((image) => ({
 			slot: image.slot,
+			bgMode: image.bgMode,
 			bgState: normalizeBgState(r.images?.[0]?.bgState ?? r.bgState),
 			color: image.color
 		}))
@@ -452,6 +479,8 @@ function normalizeConfig(raw) {
 *   theme-config.json   the ordered rule list + the global interface settings
 *   modelbg-<slot>      one background image per rule (raw bytes, no extension;
 *                       the MIME is sniffed from the magic bytes when served)
+*   holiday-cache/      festival art downloaded from the CDN, one file per
+*                       holiday asset — deliberately NOT a slot (see below)
 *
 * Images travel as data URLs over the RPC channel — there is no separate HTTP
 * image route. A legacy single-wallpaper / video-background store is migrated
@@ -474,10 +503,123 @@ const LEGACY_FILES = [
 ];
 const WALLPAPER_FETCH_MAX = 26214400;
 const WALLPAPER_FETCH_TIMEOUT = 2e4;
+/**
+* Where the festival art is hosted, and which revision of it this build wants.
+*
+* The two holiday wallpapers used to ship inside the package. They do not any
+* more: they were 746 KB of the 1.1 MB tarball — two thirds of everything anyone
+* downloaded — for art that is looked at on one day a year, and they are the one
+* part of the package that is a picture rather than code. The bytes now live in
+* the `assets` repository beside the README screenshots and are fetched from a
+* CDN the first time a holiday actually needs one (see `readHolidayAsset`).
+*
+* The reference is a **commit**, never a branch. Runtime art has to be
+* immutable: a branch reference would let a later reshuffle of the documentation
+* screenshots silently kill a shipped feature, on a day nobody is watching, with
+* nothing in the log — and jsDelivr caches a commit reference forever, which is
+* exactly what a file that never changes wants. The cost is that new art means a
+* new commit and a new hash here.
+*/
+const HOLIDAY_ASSETS_REPO = "HarmlessFunny/assets";
+const HOLIDAY_ASSETS_COMMIT = "58a9e107ac9e1993035c494397dfe77bbb7e8720";
+const HOLIDAY_ASSETS_DIR = "dsh-background-by-model/holiday";
+/**
+* Mirrors, tried in order. jsDelivr first because it is reachable from networks
+* where `raw.githubusercontent.com` is not; raw second because a CDN can be
+* blocked, rate-limited or down, and one dead mirror must not cost the easter
+* egg. Every mirror serves the same commit, so a fallback cannot mix revisions.
+*/
+const HOLIDAY_ASSET_HOSTS = [`https://cdn.jsdelivr.net/gh/${HOLIDAY_ASSETS_REPO}@${HOLIDAY_ASSETS_COMMIT}/${HOLIDAY_ASSETS_DIR}`, `https://raw.githubusercontent.com/${HOLIDAY_ASSETS_REPO}/${HOLIDAY_ASSETS_COMMIT}/${HOLIDAY_ASSETS_DIR}`];
+/**
+* Sub-directory of the store holding downloaded festival art.
+*
+* It is NOT part of the slot namespace and must never become part of it: the
+* cached files are named after the ASSET (`mid-autumn.webp`), not after a slot,
+* so nothing here can ever be mistaken for a user's `modelbg-<slot>`. That is
+* what lets a holiday slot stay read-only — `writeImage` still refuses it, and
+* the store still never holds a `modelbg-h-*` file — while the art itself is
+* now fetched rather than shipped.
+*/
+const HOLIDAY_CACHE_DIR = "holiday-cache";
+/** Cap and timeout for one asset download; these files are 228 KB and 500 KB. */
+const HOLIDAY_FETCH_MAX = 8388608;
+const HOLIDAY_FETCH_TIMEOUT = 1e4;
+/**
+* The recommended profile, served from the same assets repository as the
+* festival art — as a DIRECTORY, in the store's own shape.
+*
+* It used to be one theme file with every wallpaper inlined as base64: 2.9 MB
+* where 99.8% of the bytes were a picture, so changing the `match` string of one
+* rule meant finding it inside a single line of several hundred thousand
+* characters. Now the published layout is exactly the layout of
+* `~/.dsh/.dsh-background-by-model-data/` — a readable `theme-config.json` and
+* one raw file per slot — which makes the configuration editable in place and
+* makes publishing it a `cp` out of the data directory rather than a special
+* export step. The bytes on the wire are the same; only their arrangement is
+* different.
+*
+* Nothing lists the images: the request set is DERIVED from the config's own
+* `rules[].images[].slot`, so adding a wallpaper is adding a rule entry and a
+* file, with no second place to keep in sync.
+*
+* Referenced by BRANCH, unlike the festival art, and deliberately so. The reason
+* that art is pinned to a commit does not apply here: its rationale is that a
+* reshuffle of the assets repository would make a shipped feature disappear
+* SILENTLY, on a day nobody is watching. A profile fails LOUDLY — the user
+* clicks a button and gets an error naming what went missing — so the failure
+* immutability buys protection from cannot happen. What branch referencing buys
+* instead is the ability to fix a recommendation without a plugin release:
+* pinning would mean editing one JSON file costs a new commit, a new hash in
+* this file and a new version on npm, and every user on an older build would
+* keep getting the old recommendation forever.
+*
+* The risk that IS real — a profile written for a config shape this build cannot
+* read — is what `preset.json` exists for (see `fetchPresetConfig`).
+*/
+const PRESET_ASSETS_REPO = "HarmlessFunny/assets";
+const PRESET_ASSETS_REF = "main";
+const PRESET_ASSET_DIR = "dsh-background-by-model/preset";
+/** The shape gate: `{"version": 6}` — see SCHEMA_VERSION in ./schema. */
+const PRESET_MANIFEST = "preset.json";
+const PRESET_CONFIG = "theme-config.json";
+/** Images are named after the slot they fill, exactly as they are on disk. */
+const PRESET_IMAGE_PREFIX = "modelbg-";
+/** Mirrors, tried in order — same reason as the festival art's. */
+const PRESET_ASSET_HOSTS = [`https://cdn.jsdelivr.net/gh/${PRESET_ASSETS_REPO}@${PRESET_ASSETS_REF}/${PRESET_ASSET_DIR}`, `https://raw.githubusercontent.com/${PRESET_ASSETS_REPO}/${PRESET_ASSETS_REF}/${PRESET_ASSET_DIR}`];
+/**
+* Caps for the profile, now per file rather than for one document.
+*
+* Three of them, because a profile is now a SET of transfers and each has a
+* different way of going wrong. The manifest and the config are small by nature
+* — a manifest is one field, a config is a few kilobytes of JSON — so their caps
+* are what stops a mirror from answering with something enormous instead. The
+* images are the payload, so their cap is about the content.
+*
+* The count is the one that matters: the request set is derived from the config,
+* so a hostile or broken config could name a thousand slots and turn one button
+* press into a thousand downloads. `SLOT_RE` bounds each name and
+* `PRESET_IMAGE_COUNT_MAX` bounds how many names there can be. The running TOTAL
+* of what those transfers add up to is bounded on the client instead, because
+* these calls are independent and this side never sees more than one file.
+*
+* The timeout is set by measurement, not by symmetry with the festival art's
+* 10 s. A 350 KB wallpaper takes a second or two over jsDelivr from a normal
+* connection, and the mirror that exists for the case where jsDelivr does not
+* answer is the slower one — so a tight budget would fail exactly in the
+* situation it was written for. A minute tolerates a slow link and is still
+* bounded; the user is watching a button that says it is downloading, which is
+* the one place waiting is honest.
+*/
+const PRESET_MANIFEST_MAX = 65536;
+const PRESET_CONFIG_MAX = 1048576;
+const PRESET_IMAGE_MAX = 8388608;
+const PRESET_IMAGE_COUNT_MAX = 64;
+const PRESET_FETCH_TIMEOUT = 6e4;
 const dataDir = () => dshHomePath(DATA_DIR);
 const configPath = () => dshHomePath(DATA_DIR, CONFIG_FILE);
 const legacyWallpaperPath = () => dshHomePath(DATA_DIR, LEGACY_WALLPAPER);
 const imagePath = (slot) => dshHomePath(DATA_DIR, `${IMAGE_PREFIX}${slot}`);
+const holidayCachePath = (asset) => dshHomePath(DATA_DIR, HOLIDAY_CACHE_DIR, asset);
 const exists = async (p) => {
 	try {
 		await access(p);
@@ -517,12 +659,12 @@ async function migrateLegacy(raw) {
 			id: "m1",
 			images: [{
 				slot: "m1",
+				bgMode: typeof r.bgMode === "string" ? r.bgMode : "fit",
 				bgState: r.bgState ?? {}
 			}],
 			match: "",
 			enabled: true,
 			color: Array.isArray(r.color) ? r.color : null,
-			bgMode: typeof r.bgMode === "string" ? r.bgMode : "fit",
 			wallpaperOpacity: typeof r.wallpaperOpacity === "number" ? r.wallpaperOpacity : 1,
 			blur: typeof r.blur === "number" ? r.blur : 0
 		}],
@@ -564,7 +706,11 @@ const LEGACY_CONFIG_KEYS = /* @__PURE__ */ new Set([
 	"blur",
 	"bgState"
 ]);
-const LEGACY_RULE_KEYS = /* @__PURE__ */ new Set(["slot", "bgState"]);
+const LEGACY_RULE_KEYS = /* @__PURE__ */ new Set([
+	"slot",
+	"bgState",
+	"bgMode"
+]);
 const LEGACY_NESTED_KEYS = /* @__PURE__ */ new Set(["rules[].rotate.fadeMs"]);
 const warnedConfigKeys = /* @__PURE__ */ new Set();
 function warnUnknownConfigKeys(raw, normalized) {
@@ -628,29 +774,53 @@ async function writeConfig(config) {
 		return false;
 	}
 }
-/** Sniff an image's MIME from its leading magic bytes (defaults to JPEG). */
-function sniffImageMime(buf) {
+/**
+* Sniff an image's MIME from its leading magic bytes, or null when the bytes are
+* not a recognised image at all.
+*
+* The null answer is what a DOWNLOAD is checked against (see `fetchHolidayAsset`):
+* a CDN that answers 200 with an error page, a captive-portal redirect or a
+* truncated body has to be rejected, and neither a status code nor a
+* `content-type` header survives contact with a misconfigured mirror. The magic
+* bytes of the payload are the only claim that cannot lie.
+*/
+function imageMimeOrNull(buf) {
 	if (buf.length >= 4 && buf[0] === 137 && buf[1] === 80 && buf[2] === 78 && buf[3] === 71) return "image/png";
 	if (buf.length >= 3 && buf[0] === 255 && buf[1] === 216 && buf[2] === 255) return "image/jpeg";
 	if (buf.length >= 6 && buf[0] === 71 && buf[1] === 73 && buf[2] === 70) return "image/gif";
 	if (buf.length >= 12 && buf[0] === 82 && buf[1] === 73 && buf[2] === 70 && buf[3] === 70 && buf[8] === 87 && buf[9] === 69 && buf[10] === 66 && buf[11] === 80) return "image/webp";
 	if (buf.length >= 2 && buf[0] === 66 && buf[1] === 77) return "image/bmp";
-	return "image/jpeg";
+	return null;
+}
+/**
+* Sniff an image's MIME from its leading magic bytes (defaults to JPEG).
+*
+* The default is deliberate for the bytes a USER uploaded: an unrecognised format
+* is better served as a JPEG and left to the browser than refused outright — the
+* browser decides, and it can sniff what this list does not know.
+*/
+function sniffImageMime(buf) {
+	return imageMimeOrNull(buf) ?? "image/jpeg";
 }
 /**
 * Read one slot as a data URL, or null when it has nothing to serve.
 *
-* A holiday slot is answered from the package and from nowhere else — the data
-* directory is never consulted for it, which is what makes the festival art
-* impossible to swap. Everything else is the user's own bytes. Both are resolved
-* lazily, so nothing about the bundled art is loaded — or even looked for — until
-* a holiday actually reaches for it.
+* Two very different sources behind one answer. A holiday slot resolves to the
+* festival art — downloaded on demand and cached, never shipped (see
+* `readHolidayAsset`). Everything else is the user's own bytes on disk. Both are
+* resolved lazily, so neither is read, fetched or even looked for until a
+* wallpaper actually needs it.
+*
+* `null` is a legitimate answer for a holiday — offline, a blocked CDN, a cold
+* cache — and the caller is built for it: `pickHoliday` treats "no bytes" as
+* "this holiday does not take over" and the model rules keep painting. A
+* festival that cannot be downloaded must never blank the interface.
 */
 async function readImage(slot) {
-	const asset = bundledAssetFor(slot);
+	const asset = holidayAssetFor(slot);
 	if (asset !== null) {
-		const bundled = await readFileOrNull(bundledAssetPath(asset));
-		return bundled === null ? null : toDataUrl(bundled);
+		const art = await readHolidayAsset(asset);
+		return art === null ? null : toDataUrl(art);
 	}
 	const own = await readFileOrNull(imagePath(slot));
 	return own === null ? null : toDataUrl(own);
@@ -665,24 +835,245 @@ async function readFileOrNull(path) {
 function toDataUrl(buf) {
 	return `data:${sniffImageMime(buf)};base64,${buf.toString("base64")}`;
 }
-/** Absolute path of one wallpaper bundled inside the package. */
-function bundledAssetPath(asset) {
-	return fileURLToPath(new URL(`../holiday/${asset}`, import.meta.url));
+/** Downloads in flight, so two read paths asking at once share one transfer. */
+const holidayInFlight = /* @__PURE__ */ new Map();
+/**
+* One holiday's art: from the cache if it is there and sound, otherwise from the
+* network.
+*
+* The cached copy is validated rather than trusted — a process killed mid-write
+* (or a full disk) would otherwise leave a permanently truncated file that every
+* later read happily serves, and the holiday would be broken forever with no way
+* back short of deleting a file nobody knows about. A cache entry that is not an
+* image is treated exactly like a miss and overwritten by the next download.
+*
+* The in-flight map matters because the two readers can race: the boot hydrate
+* and the midnight rollover timer both ask for the same slot, and the timer
+* fires precisely when a machine that was asleep all day is waking up. Without
+* it that is two simultaneous half-megabyte transfers for one picture.
+*/
+async function readHolidayAsset(asset) {
+	const cached = await readFileOrNull(holidayCachePath(asset));
+	if (cached !== null && imageMimeOrNull(cached) !== null) return cached;
+	const running = holidayInFlight.get(asset);
+	if (running !== void 0) return await running;
+	const task = downloadHolidayAsset(asset).finally(() => {
+		holidayInFlight.delete(asset);
+	});
+	holidayInFlight.set(asset, task);
+	return await task;
+}
+/** Try every mirror in turn; the first usable answer is cached and returned. */
+async function downloadHolidayAsset(asset) {
+	for (const host of HOLIDAY_ASSET_HOSTS) {
+		const buf = await fetchHolidayAsset(`${host}/${asset}`);
+		if (buf === null) continue;
+		await writeHolidayCache(asset, buf);
+		return buf;
+	}
+	return null;
+}
+/**
+* One asset over the wire, or null for every way it can fail.
+*
+* Never throws: a holiday that cannot be fetched is a holiday that does not paint
+* today, which is a normal state and not an error path the caller should have to
+* wrap. The `content-length` check is a courtesy — a mirror that announces a
+* huge body never gets to send it — while the post-read size check is the one
+* that actually holds.
+*
+* Deliberately says nothing about WHAT the bytes are: the festival art and the
+* recommended profile are both "a file from the assets repository", and the one
+* thing they do not share is how a payload is recognised (magic bytes vs JSON).
+* That check belongs to the caller, which is the only half that knows what it
+* asked for.
+*/
+async function fetchAsset(url, max, timeout) {
+	try {
+		const ctl = new AbortController();
+		const timer = setTimeout(() => ctl.abort(), timeout);
+		try {
+			const res = await fetch(url, {
+				redirect: "follow",
+				signal: ctl.signal
+			});
+			if (!res.ok) return null;
+			const announced = Number(res.headers.get("content-length") ?? "");
+			if (isFinite(announced) && announced > max) return null;
+			const arr = await res.arrayBuffer();
+			if (arr.byteLength === 0 || arr.byteLength > max) return null;
+			return Buffer.from(arr);
+		} finally {
+			clearTimeout(timer);
+		}
+	} catch {
+		return null;
+	}
+}
+/** One festival picture, or null when no mirror served an image. */
+async function fetchHolidayAsset(url) {
+	const buf = await fetchAsset(url, HOLIDAY_FETCH_MAX, HOLIDAY_FETCH_TIMEOUT);
+	return buf === null || imageMimeOrNull(buf) === null ? null : buf;
+}
+/** One file out of the profile directory, or null when no mirror served it. */
+async function fetchPresetFile(name, max) {
+	for (const host of PRESET_ASSET_HOSTS) {
+		const buf = await fetchAsset(`${host}/${name}`, max, PRESET_FETCH_TIMEOUT);
+		if (buf !== null) return buf;
+	}
+	return null;
+}
+/**
+* The profile's shape gate and its configuration, in one answer.
+*
+* Two files, fetched in order, because they answer different questions. The
+* manifest says what SHAPE the config is written for, and a config written for a
+* shape this build cannot read is refused here — before anything is downloaded
+* in earnest and long before anything is deleted. The config then says what the
+* profile IS.
+*
+* The sanitizer runs on this side, and that is not merely tidiness: the list of
+* images to download is DERIVED from `rules[].images[].slot`, so an unsanitized
+* config would let a remote file choose what this process requests. After
+* `normalizeConfig` every slot has passed `SLOT_RE` (see `normalizeImage`), and
+* the only names left to reject are the holiday slots — which a config CAN name,
+* legally, inside `holidays.items`, and which have no file at all.
+*
+* Holiday slots are dropped rather than refused. They are unwritable by design
+* (`writeImage` refuses them), so a rule that points at one is already inert on
+* the client; failing the whole profile over a slot nothing could ever fill
+* would be a worse answer than ignoring it.
+*
+* Nothing is cached to disk, unlike the festival art. That cache exists because
+* the art is fetched on a schedule without anyone asking and must work offline
+* afterwards; this is a button whose entire point is to fetch what is there NOW.
+*/
+async function fetchPresetConfig() {
+	const manifestRaw = await fetchPresetFile(PRESET_MANIFEST, PRESET_MANIFEST_MAX);
+	if (manifestRaw === null) return {
+		ok: false,
+		error: "download failed"
+	};
+	let manifest;
+	try {
+		manifest = JSON.parse(manifestRaw.toString("utf8"));
+	} catch {
+		return {
+			ok: false,
+			error: "not a profile"
+		};
+	}
+	const declared = manifest?.version;
+	if (typeof declared !== "number" || !isFinite(declared)) return {
+		ok: false,
+		error: "not a profile"
+	};
+	if (declared > 6) return {
+		ok: false,
+		error: "newer version"
+	};
+	const configRaw = await fetchPresetFile(PRESET_CONFIG, PRESET_CONFIG_MAX);
+	if (configRaw === null) return {
+		ok: false,
+		error: "download failed"
+	};
+	let raw;
+	try {
+		raw = JSON.parse(configRaw.toString("utf8"));
+	} catch {
+		return {
+			ok: false,
+			error: "not a profile"
+		};
+	}
+	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return {
+		ok: false,
+		error: "not a profile"
+	};
+	const config = normalizeConfig(raw);
+	const slots = /* @__PURE__ */ new Set();
+	for (const rule of config.rules) for (const image of rule.images) {
+		if (holidayAssetFor(image.slot) !== null) continue;
+		slots.add(image.slot);
+	}
+	if (slots.size > PRESET_IMAGE_COUNT_MAX) return {
+		ok: false,
+		error: "too many images"
+	};
+	return {
+		ok: true,
+		version: declared,
+		config,
+		slots: [...slots]
+	};
+}
+/**
+* One of the profile's wallpapers, as a data URL ready to be written into a slot.
+*
+* The same two checks the festival art gets, for the same reason: the bytes must
+* actually be an image (`imageMimeOrNull`, never the `content-type` header — the
+* mirror serves extensionless files as `application/octet-stream`), and the slot
+* must be one this process is willing to write. The slot name is re-checked here
+* because this is a public RPC: the list this side hands out is not the only
+* thing a caller could ask for.
+*/
+async function fetchPresetImage(slot) {
+	if (!SLOT_RE.test(slot) || holidayAssetFor(slot) !== null) return {
+		ok: false,
+		error: "bad slot"
+	};
+	const buf = await fetchPresetFile(`${PRESET_IMAGE_PREFIX}${slot}`, PRESET_IMAGE_MAX);
+	if (buf === null) return {
+		ok: false,
+		error: "download failed"
+	};
+	const mime = imageMimeOrNull(buf);
+	if (mime === null) return {
+		ok: false,
+		error: "not an image"
+	};
+	return {
+		ok: true,
+		dataUrl: `data:${mime};base64,${buf.toString("base64")}`
+	};
+}
+/**
+* Cache one downloaded asset, atomically and best-effort.
+*
+* Written to a temp name and renamed into place, so a reader never sees a partial
+* file even if this process dies between the two calls. A failure to cache is
+* logged and otherwise ignored: the bytes are already in hand and the caller is
+* waiting for them — losing the cache costs a re-download next time, and failing
+* the read over it would cost the holiday.
+*/
+async function writeHolidayCache(asset, buf) {
+	try {
+		await ensureDir();
+		await mkdir(dshHomePath(DATA_DIR, HOLIDAY_CACHE_DIR), { recursive: true });
+		const target = holidayCachePath(asset);
+		const temp = `${target}.tmp`;
+		await writeFile(temp, buf);
+		await rename(temp, target);
+	} catch (e) {
+		console.warn(`dsh-background-by-model: could not cache the "${asset}" holiday art`, e);
+	}
 }
 /**
-* The wallpaper bundled for one slot, or null when the slot is not a holiday's.
+* The wallpaper a holiday slot resolves to, or null when the slot is not a
+* holiday's.
 *
-* This mapping is the ONLY thing that makes a holiday slot read-only and
-* package-served, so both `readImage` and `writeImage` go through it rather than
-* each testing the holiday list on their own. It reads no config: the bundled art
-* has stopped being a fallback that a flag could disable.
+* This mapping is the ONLY thing that makes a holiday slot read-only, so both
+* `readImage` and `writeImage` go through it rather than each testing the holiday
+* list on their own. It reads no config: the festival art has stopped being a
+* fallback that a flag could disable. What changed is only WHERE the bytes come
+* from — the slot's identity, and its refusal to accept a write, are untouched.
 */
-function bundledAssetFor(slot) {
+function holidayAssetFor(slot) {
 	return HOLIDAYS.find((h) => h.slot === slot)?.asset ?? null;
 }
 /** Persist one rule image (null removes it); false keeps the previous file. */
 async function writeImage(slot, dataUrl) {
-	if (bundledAssetFor(slot) !== null) return false;
+	if (holidayAssetFor(slot) !== null) return false;
 	await ensureDir();
 	try {
 		if (dataUrl === null) {
@@ -707,11 +1098,46 @@ async function listSlots() {
 	}
 }
 /**
+* Empty the store: the config and every rule image, and nothing else.
+*
+* The hard reset behind "use the recommended profile", and it has to be a real
+* one rather than a config overwrite. `nextSlot` hands out `m1`, `m2`, … — a
+* running counter, not a random token — so a profile and a store that both have
+* pictures collide on those names as a matter of course. Emptying first is what
+* makes the profile's own slots free to write, and it is why this feature needs
+* no slot remapping: there is nothing left to collide with.
+*
+* `holiday-cache/` is deliberately untouched. It is not the user's
+* configuration: it is downloaded festival art that belongs to no slot, costs a
+* network round trip to get back, and has nothing to do with which profile is
+* selected.
+*
+* Best-effort per entry — one unremovable file must not abort the rest and leave
+* the store half wiped — but the failures are logged rather than swallowed,
+* because the caller is about to write a fresh config over whatever survives.
+*/
+async function resetStore() {
+	let ok = true;
+	try {
+		await rm(configPath(), { force: true });
+	} catch (e) {
+		ok = false;
+		console.warn(`dsh-background-by-model: failed to remove "${CONFIG_FILE}"`, e);
+	}
+	for (const slot of await listSlots()) try {
+		await rm(imagePath(slot), { force: true });
+	} catch (e) {
+		ok = false;
+		console.warn(`dsh-background-by-model: failed to remove the image for slot "${slot}"`, e);
+	}
+	return ok;
+}
+/**
 * Download an image from a network URL into one slot (replacing its bytes).
 * Returns { ok, dataUrl?, error? }; never throws.
 */
 async function fetchImageUrl(slot, url) {
-	if (bundledAssetFor(slot) !== null) return {
+	if (holidayAssetFor(slot) !== null) return {
 		ok: false,
 		error: "read-only slot"
 	};
@@ -818,7 +1244,7 @@ async function handleRpcMethod(ctx, endpoint, payload) {
 				value: {
 					config: await readConfig(),
 					slots: await listSlots(),
-					schema: 5
+					schema: 6
 				}
 			};
 			case "writeConfig": return {
@@ -864,6 +1290,26 @@ async function handleRpcMethod(ctx, endpoint, payload) {
 					ok: true,
 					value: await fetchImageUrl(slot, payload?.url ?? null)
 				};
+			case "fetchPresetConfig": return {
+				ok: true,
+				value: await fetchPresetConfig()
+			};
+			case "fetchPresetImage":
+				if (slot === null) return {
+					ok: true,
+					value: {
+						ok: false,
+						error: "bad slot"
+					}
+				};
+				return {
+					ok: true,
+					value: await fetchPresetImage(slot)
+				};
+			case "resetStore": return {
+				ok: true,
+				value: await resetStore()
+			};
 			case "defaultModel": return {
 				ok: true,
 				value: defaultModel(ctx)