dsh-background-by-model 0.9.2 → 0.11.0

package/lib/index.js

@@ -5,15 +5,31 @@ const HOLIDAYS = [{
 	id: "mid-autumn",
 	slot: "h-midautumn",
 	asset: "mid-autumn.webp",
+	source: "/bfs/new_dyn/42e22801827aff71267b03c95fcfd7834168597.png@1672w.webp",
 	color: "#384A77",
 	kind: "lunar"
 }, {
 	id: "national-day",
 	slot: "h-nationalday",
 	asset: "national-day.webp",
+	source: "/bfs/new_dyn/30e97211189f7869dae83b909d2a3cc84168597.png@3456w.webp",
 	color: "#FFF6EB",
 	kind: "gregorian"
 }];
+/**
+* The generation a holiday's ART belongs to, for the on-disk cache.
+*
+* The BFS path is content-addressed (`bfs/new_dyn/<sha1 of the upload>`), so the
+* first eight characters of that hash are a content identity: change the art, change
+* the directory, and a cache keyed by this cannot answer a new upload with the
+* previous bytes. That is the property the pinned assets release tag used to provide
+* and the reason it is now derivable instead of remembered — there is no version
+* constant to bump, and a forgotten bump is not possible.
+*/
+function holidayArtGeneration(def) {
+	const hash = /new_dyn\/([0-9a-f]+)/.exec(def.source);
+	return hash === null ? "v1" : hash[1].slice(0, 8);
+}
 //#endregion
 //#region src/schema.ts
 /**
@@ -108,6 +124,28 @@ const DEFAULT_TRANSITION = {
 	easing: "ease",
 	durationMs: 320
 };
+/**
+* One image entry for a place that CREATES a picture rather than reads one back
+* (a fresh holiday, and every upload in the panel).
+*
+* The two effects whose neutral value is also the shipped default are written
+* explicitly (`opacity`, `blur`), even though `normalizeImage` would default them:
+* the read-time lifts key off the ABSENCE of a key, so an entry created without one
+* would come back as "written before this field existed" and inherit whatever the
+* rule happened to carry. `brightness` is the one field whose absence is meaningful
+* (see `BgImage.brightness`), so it is left out — "untouched" is exactly what a new
+* picture is.
+*/
+function defaultImage(slot, color = null, bgMode = "fit") {
+	return {
+		slot,
+		bgMode,
+		bgState: { ...DEFAULT_BG_STATE },
+		color,
+		opacity: 1,
+		blur: 0
+	};
+}
 const DEFAULT_CHAT_TEXT_OPACITY = .35;
 const DEFAULT_TRAJECTORY_OPACITY = .73;
 const DEFAULT_RIGHTBAR_OPACITY = .45;
@@ -156,18 +194,10 @@ function defaultHolidayRule(def) {
 	const color = hexToHsl(def.color);
 	return {
 		id: def.id,
-		images: [{
-			slot: def.slot,
-			bgMode: "fill",
-			bgState: { ...DEFAULT_BG_STATE },
-			color
-		}],
+		images: [defaultImage(def.slot, color, "fill")],
 		match: "",
 		enabled: true,
 		color,
-		wallpaperOpacity: 1,
-		brightness: 100,
-		blur: 0,
 		rotate: defaultRotation()
 	};
 }
@@ -187,9 +217,6 @@ function blankRule(id) {
 		match: "",
 		enabled: true,
 		color: null,
-		wallpaperOpacity: 1,
-		brightness: 100,
-		blur: 0,
 		rotate: defaultRotation()
 	};
 }
@@ -276,28 +303,41 @@ function normalizeTransition(raw, legacyMs) {
 		durationMs: clamp(t.durationMs, 0, TRANSITION_MAX_MS, fallback)
 	};
 }
+/** The inherit block for a caller that has no rule-level values at all. */
+const DEFAULT_IMAGE_INHERIT = {
+	color: null,
+	opacity: 1,
+	brightness: void 0,
+	blur: 0
+};
 /**
 * Coerce one persisted image entry, or null when it lacks a usable slot.
 *
-* `inherit` (the RULE's colour) is applied only to an entry with no `color` KEY at
-* all — the shape written before per-image colours, where the rule's colour was the
-* only one there was. The key's PRESENCE is the whole distinction: `color: null` is
-* a deliberate "follow the system theme" and must not be re-inherited on every load.
+* `inherit` is the rule-level block this entry may take its values from, and each
+* field is lifted ONLY when the entry has no key of its own — that absence is the
+* whole signal. `color: null` is a deliberate "follow the system theme" and must
+* not be re-inherited on every load; `brightness` keeps its key absent when neither
+* side ever named one, so an upgrade never writes a default nobody chose.
 *
 * `inheritMode` is the same one-shot lift for the layout mode. It is the caller's to
 * resolve because the callers answer differently: a user rule passes the mode its
 * config carried at the RULE level (schema 5), a holiday passes its own `fill`. An
 * entry that HAS a `bgMode` key keeps it, even when it equals the default.
 */
-function normalizeImage(raw, inherit = null, inheritMode = "fit") {
+function normalizeImage(raw, inherit = DEFAULT_IMAGE_INHERIT, inheritMode = "fit") {
 	const i = raw ?? {};
 	if (typeof i.slot !== "string" || !SLOT_RE.test(i.slot)) return null;
-	return {
+	const image = {
 		slot: i.slot,
 		bgMode: BG_MODES.includes(i.bgMode) ? i.bgMode : inheritMode,
 		bgState: normalizeBgState(i.bgState),
-		color: hasOwn(i, "color") ? normalizeHsl(i.color) : inherit
+		color: hasOwn(i, "color") ? normalizeHsl(i.color) : inherit.color,
+		opacity: clamp01(i.opacity, inherit.opacity),
+		blur: clamp(i.blur, 0, 60, inherit.blur)
 	};
+	const brightness = i.brightness === void 0 ? inherit.brightness : clamp(i.brightness, 0, 200, 100);
+	if (brightness !== void 0) image.brightness = brightness;
+	return image;
 }
 /**
 * Coerce one persisted rule, or null when it names no image ANYWHERE.
@@ -322,38 +362,45 @@ function normalizeRule(raw) {
 	if (id === null) return null;
 	const color = normalizeHsl(r.color);
 	const mode = BG_MODES.includes(r.bgMode) ? r.bgMode : "fit";
+	const inherit = {
+		color,
+		opacity: clamp01(r.wallpaperOpacity, 1),
+		brightness: r.brightness === void 0 ? void 0 : clamp(r.brightness, 0, 200, 100),
+		blur: clamp(r.blur, 0, 60, 0)
+	};
 	const images = [];
 	const seen = /* @__PURE__ */ new Set();
 	const hadList = Array.isArray(r.images);
 	if (hadList) for (const entry of r.images) {
-		const image = normalizeImage(entry, color, mode);
+		const image = normalizeImage(entry, inherit, mode);
 		if (image === null || seen.has(image.slot)) continue;
 		seen.add(image.slot);
 		images.push(image);
 	}
 	const legacySlot = typeof r.slot === "string" && SLOT_RE.test(r.slot) ? r.slot : null;
-	if (images.length === 0 && legacySlot !== null) images.push({
-		slot: legacySlot,
-		bgMode: mode,
-		bgState: normalizeBgState(r.bgState),
-		color
-	});
+	if (images.length === 0 && legacySlot !== null) {
+		const image = {
+			slot: legacySlot,
+			bgMode: mode,
+			bgState: normalizeBgState(r.bgState),
+			color,
+			opacity: inherit.opacity,
+			blur: inherit.blur
+		};
+		if (inherit.brightness !== void 0) image.brightness = inherit.brightness;
+		images.push(image);
+	}
 	if (images.length === 0 && !hadList) return null;
 	const rotate = normalizeRotation(r.rotate);
 	if (images.length < 2) rotate.enabled = false;
-	const brightness = r.brightness === void 0 ? void 0 : clamp(r.brightness, 0, 200, 100);
-	const rule = {
+	return {
 		id,
 		images,
 		match: typeof r.match === "string" ? r.match : "",
 		enabled: r.enabled !== false,
 		color,
-		wallpaperOpacity: clamp01(r.wallpaperOpacity, 1),
-		blur: clamp(r.blur, 0, 60, 0),
 		rotate
 	};
-	if (brightness !== void 0) rule.brightness = brightness;
-	return rule;
 }
 /**
 * Coerce one persisted holiday entry.
@@ -370,17 +417,29 @@ function normalizeHolidayRule(def, raw) {
 	return {
 		...base,
 		enabled: r.enabled !== false,
-		wallpaperOpacity: clamp01(r.wallpaperOpacity, base.wallpaperOpacity),
-		brightness: clamp(r.brightness, 0, 200, base.brightness ?? 100),
-		blur: clamp(r.blur, 0, 60, base.blur),
-		images: base.images.map((image) => ({
-			slot: image.slot,
-			bgMode: image.bgMode,
-			bgState: normalizeBgState(r.images?.[0]?.bgState ?? r.bgState),
-			color: image.color
-		}))
+		images: base.images.map((image) => {
+			const stored = r.images?.[0];
+			const merged = {
+				slot: image.slot,
+				bgMode: image.bgMode,
+				bgState: normalizeBgState(stored?.bgState ?? r.bgState),
+				color: image.color,
+				opacity: clamp01(stored?.opacity ?? legacyWallpaperOpacity(r.wallpaperOpacity), image.opacity),
+				blur: clamp(stored?.blur ?? r.blur, 0, 60, image.blur)
+			};
+			const brightness = stored?.brightness === void 0 ? r.brightness === void 0 ? void 0 : clamp(r.brightness, 0, 200, 100) : clamp(stored.brightness, 0, 200, 100);
+			if (brightness !== void 0) merged.brightness = brightness;
+			return merged;
+		})
 	};
 }
+/**
+* The rule-level opacity a schema-9 holiday entry carried, or `undefined` so the
+* caller can tell "absent" from "set to 1" and leave `clamp01` its default.
+*/
+function legacyWallpaperOpacity(raw) {
+	return typeof raw === "number" && isFinite(raw) ? raw : void 0;
+}
 /** Coerce the whole holiday block; unknown ids are dropped, missing ones defaulted. */
 function normalizeHolidays(raw) {
 	const r = raw ?? {};
@@ -432,20 +491,21 @@ function normalizeConfig(raw) {
 *
 * Three reasons are terminal, and each for its own:
 *
-*   - `missing` — the host says the file is not there. The profile follows a
-*     BRANCH (see `PRESET_ASSET_HOSTS` in ./index), so a renamed or deleted file
-*     has to reach the user as a loud failure NAMING the slot — and it has to
-*     reach them FAST: paying two more rounds for a file that is provably absent
-*     only makes the sentence later, on a button the user is watching.
+*   - `missing` — the host says the file is not there. A BFS path is a hash of an
+*     upload (see `PROFILE_HOSTS` in ./profile), so a 404 is not a flake that might
+*     clear: the picture it names either exists or never will. It has to reach the
+*     user as a loud failure NAMING the slot — and it has to reach them FAST:
+*     paying two more rounds for a file that is provably absent only makes the
+*     sentence later, on a button the user is watching.
 *   - `oversized` — the bytes are the problem, and the next round would serve the
 *     same bytes.
-*   - `timeout` — sixty seconds of silence is not weather. Both mirrors were
-*     already asked inside the SAME round, so a retry round would re-ask two hosts
-*     that each just spent a minute not answering. This is also what keeps the
-*     worst case for one file at three minutes instead of six: a round in which BOTH
-*     mirrors were silent is over immediately (two minutes, exactly what it cost
-*     before there were rounds at all), and only a round that mixed a silent mirror
-*     with a transient one can carry a minute into the next round.
+*   - `timeout` — sixty seconds of silence is not weather. Every host was already
+*     asked inside the SAME round, so a retry round would re-ask hosts that each
+*     just spent a minute not answering. This is also what keeps the worst case for
+*     one file at three minutes instead of nine: a round in which every edge was
+*     silent is over immediately (three minutes, exactly what it cost before there
+*     were rounds at all), and only a round that mixed a silent edge with a
+*     transient one can carry a round's worth of latency into the next one.
 *
 * Everything else is a hiccup: a thrown connection, a 5xx, a 429, a 408, or a 200
 * with no body.
@@ -457,7 +517,7 @@ function presetRetryable(reason) {
 * The delay before the round that follows `failedAttempt` (1-based), in ms.
 *
 * Doubling rather than fixed: the second retry is the one that has to survive a
-* mirror having a bad few hundred milliseconds, and it is still short enough that
+* edge having a bad few hundred milliseconds, and it is still short enough that
 * a user staring at "downloading" does not read it as a hang.
 */
 function presetRetryDelayMs(failedAttempt) {
@@ -499,6 +559,88 @@ function orphanSlots(stored, referenced, kept = []) {
 	return stored.filter((slot) => !live.has(slot));
 }
 //#endregion
+//#region src/profile.ts
+/**
+* Where the pictures are hosted.
+*
+* Three hosts, tried in order, and they are not mirrors of each other by
+* configuration — `i0`/`i1`/`i2.hdslb.com` are separate BFS edges that answer the
+* same path with the same bytes (verified by sha1), which is the same arrangement
+* the festival art already relies on.
+*/
+const PROFILE_HOSTS = [
+	"https://i0.hdslb.com",
+	"https://i1.hdslb.com",
+	"https://i2.hdslb.com"
+];
+/**
+* The BFS transform that turns the uploaded PNG into the file this plugin stores.
+*
+* Load-bearing, and the reason it is spelled out once here:
+*
+*   - the UPLOADED files are 2.4–12 MB PNGs (76 MB for the set). `PRESET_IMAGE_MAX`
+*     is 8 MB and the store keeps full fidelity, so serving them as uploaded would
+*     both refuse the largest ones and put a 76 MB wallpaper collection on disk;
+*   - `@3840w.webp` answers 250–365 KB at 3840×2160, which is what the previous
+*     asset host served and what an existing store already holds — the sha1 of the
+*     bytes is identical, so this is the same picture, not a re-encode;
+*   - the suffix is plain arithmetic rather than a CDN feature that may move: the
+*     path before it is `bfs/new_dyn/<sha1 of the upload>`, i.e. CONTENT-ADDRESSED,
+*     so a URL here can never be re-pointed at different bytes the way a git tag
+*     can.
+*/
+const BFS_SUFFIX = "@3840w.webp";
+/**
+* Slot → BFS path, for the seven wallpapers the profile is made of.
+*
+* The slots are `m1`..`m7` rather than names, because a slot is a FILENAME
+* (`modelbg-<slot>`) and `nextSlot` hands out exactly this namespace. The mapping
+* to a model is the rule list below, never the slot name.
+*/
+const IMAGE_PATHS = [
+	{
+		slot: "m1",
+		path: "/bfs/new_dyn/e4565384e7e5b2d75756e577f505534b4168597.png"
+	},
+	{
+		slot: "m2",
+		path: "/bfs/new_dyn/aa6e8649701c91e5ac8f43ff28b97a924168597.png"
+	},
+	{
+		slot: "m3",
+		path: "/bfs/new_dyn/5da92b31df5ee2a20b17ec6be353cf5c4168597.png"
+	},
+	{
+		slot: "m4",
+		path: "/bfs/new_dyn/14bb1e53cb2c13ca80bd23e3c1d2a04e4168597.png"
+	},
+	{
+		slot: "m5",
+		path: "/bfs/new_dyn/f51fff40de2d6eaa5a73d177f7bbfa794168597.png"
+	},
+	{
+		slot: "m6",
+		path: "/bfs/new_dyn/cfa71d4e60a2f12aaeec3efe1aa680b34168597.png"
+	},
+	{
+		slot: "m7",
+		path: "/bfs/new_dyn/c09d34b79d9b447d7db98da68b97afc54168597.png"
+	}
+];
+IMAGE_PATHS.map((i) => i.slot);
+/**
+* The URL one slot's wallpaper is fetched from, on the first host — `${host}${url}`
+* is how a caller builds the other two.
+*
+* Returns null for a slot this profile does not carry, and that null is the whole
+* whitelist: `fetchPresetImage` (./index) answers `bad slot` for it, so a caller on
+* the public RPC cannot name a file of its own.
+*/
+function profileImagePath(slot) {
+	const entry = IMAGE_PATHS.find((i) => i.slot === slot);
+	return entry === void 0 ? null : `${entry.path}${BFS_SUFFIX}`;
+}
+//#endregion
 //#region src/index.ts
 /**
 * Node half of dsh-background-by-model: file-backed rule persistence.
@@ -508,8 +650,9 @@ function orphanSlots(stored, referenced, kept = []) {
 * `/api`, which slash commands own).
 *
 *   theme-config.json     the ordered rule list + the global interface settings
-*   modelbg-<slot>        one background image per rule (raw bytes, no extension;
-*                         the MIME is sniffed from the magic bytes when served)
+*   theme-config.json.bak the last config that parsed, rotated in before every save
+*   modelbg-<slot>        one background image (raw bytes, no extension; the MIME is
+*                         sniffed from the magic bytes when served)
 *   holiday-cache/<tag>/  festival art downloaded from the CDN, one directory per
 *                         pinned release, deliberately NOT in the slot namespace
 *
@@ -521,6 +664,20 @@ const name = "dsh-background-by-model";
 const inject = ["connection", "webServer"];
 const DATA_DIR = ".dsh-background-by-model-data";
 const CONFIG_FILE = "theme-config.json";
+/**
+* The last config that was known to parse, kept beside the live one.
+*
+* A config file is the whole rule list, and it is rewritten on every edit. Writing
+* it in place meant a crash, a full disk or a pulled power cable could leave half a
+* JSON document behind — which `readConfig` greets by silently falling back to the
+* defaults, so the next slider drag would persist those defaults over the ruined
+* file and the original rules were gone for good. Two pieces fix that, and they are
+* one feature: the write is atomic (temp + rename), and the previous good file is
+* rotated to `.bak` before it is replaced, so even a lost file has a copy.
+*/
+const CONFIG_BACKUP = "theme-config.json.bak";
+/** Suffix of the in-flight write. Deliberately outside `listSlots`' `modelbg-` prefix. */
+const CONFIG_TEMP = ".tmp";
 const IMAGE_PREFIX = "modelbg-";
 const LEGACY_WALLPAPER = "wallpaper.jpg";
 const LEGACY_FILES = [
@@ -535,96 +692,70 @@ const LEGACY_FILES = [
 const WALLPAPER_FETCH_MAX = 26214400;
 const WALLPAPER_FETCH_TIMEOUT = 2e4;
 /**
-* Where the festival art is hosted, and which revision of it this build wants.
+* Where the festival art is hosted.
 *
-* The art is fetched from the `assets` repository the first time a holiday needs it
-* (see `readHolidayAsset`), never shipped in the package.
+* Three edges of Bilibili's image CDN, tried in order. They are not mirrors by
+* configuration — `i0`/`i1`/`i2.hdslb.com` answer the same path with the same bytes
+* (checked by sha1) — which is the same arrangement the recommended profile uses
+* (see `PROFILE_HOSTS` in ./profile).
 *
-* The reference is a **release tag**, never a branch: runtime art has to be
-* immutable, and a branch reference would let a reshuffle of the documentation
-* screenshots silently kill a shipped feature. One tag also means one version of
-* everything the plugin fetches (art, profile, README screenshots). A MOVED tag
-* does not reach jsDelivr's edge on its own, so new art means a new tag, never a
-* force-push of the old one.
+* A path under `bfs/new_dyn/` is CONTENT-ADDRESSED (the tail is a hash of the
+* upload), so nothing here needs a version constant: the art a build names cannot be
+* swapped under it the way a re-pointed git tag could, and `holidayArtGeneration`
+* (./holiday) derives the cache's directory from that same hash.
 */
-const HOLIDAY_ASSETS_REPO = "HarmlessFunny/assets";
-const HOLIDAY_ASSETS_REF = "v0.1.0";
-const HOLIDAY_ASSETS_DIR = "dsh-background-by-model/holiday";
-/**
-* Mirrors, tried in order: jsDelivr is reachable where `raw.githubusercontent.com`
-* is not, and raw is the fallback for a CDN that is blocked or down. Both serve the
-* same version, so a fallback cannot mix revisions.
-*/
-const HOLIDAY_ASSET_HOSTS = [`https://cdn.jsdelivr.net/gh/${HOLIDAY_ASSETS_REPO}@${HOLIDAY_ASSETS_REF}/${HOLIDAY_ASSETS_DIR}`, `https://raw.githubusercontent.com/${HOLIDAY_ASSETS_REPO}/${HOLIDAY_ASSETS_REF}/${HOLIDAY_ASSETS_DIR}`];
+const HOLIDAY_HOSTS = [
+	"https://i0.hdslb.com",
+	"https://i1.hdslb.com",
+	"https://i2.hdslb.com"
+];
 /**
 * Sub-directory of the store holding downloaded festival art: one directory per
-* release of the asset repository, one file per asset inside it.
+* GENERATION of the art (see `holidayArtGeneration`), one file per asset inside it.
 *
 * NOT part of the slot namespace, and must never become part of it: files are named
-* after the ASSET and their parent after the pinned release, never after a slot, so
-* nothing here can be mistaken for a user's `modelbg-<slot>`. That is what lets a
+* after the ASSET and their parent after the art's content hash, never after a slot,
+* so nothing here can be mistaken for a user's `modelbg-<slot>`. That is what lets a
 * holiday slot stay read-only while the art itself is downloaded.
 *
-* The version segment is load-bearing: a cache keyed by asset name alone would
-* answer a NEW generation with the OLD bytes and say nothing about it. With the tag
-* in the path, a build that pins a new tag looks in a directory nobody has written
-* to yet, so the first holiday after an update is a miss. Superseded generations
-* are swept by `pruneHolidayCache`.
+* The generation segment is load-bearing: a cache keyed by asset name alone would
+* answer a NEW upload with the OLD bytes and say nothing about it. With the hash in
+* the path, a build that names new art looks in a directory nobody has written to
+* yet, so the first holiday after an update is a miss. Superseded generations are
+* swept by `pruneHolidayCache`.
 */
 const HOLIDAY_CACHE_DIR = "holiday-cache";
-/** Cap and timeout for one asset download; these files are 228 KB and 500 KB. */
+/** Cap and timeout for one asset download; these files are 207 KB and 446 KB. */
 const HOLIDAY_FETCH_MAX = 8388608;
 const HOLIDAY_FETCH_TIMEOUT = 1e4;
 /**
-* The recommended profile, served from the same assets repository as the festival
-* art — as a DIRECTORY in the store's own shape: a readable `theme-config.json`
-* plus one raw file per slot. Publishing it is a `cp` out of the data directory,
-* not an export step.
-*
-* Nothing lists the images: the request set is DERIVED from the config's own
-* `rules[].images[].slot`, so adding a wallpaper is a rule entry and a file.
-*
-* Referenced by the same release tag as the art (one tag = one version of
-* everything the plugin fetches). The re-pointed-tag case is why `presetKey`
-* exists: an edge that has not been purged can still answer with the previous
-* bytes of the same URL, and a resumed download must not glue two revisions
-* together (see `fetchPresetConfig`). A profile written for a config shape this
-* build cannot read is refused by the `preset.json` gate.
-*/
-const PRESET_ASSETS_REPO = "HarmlessFunny/assets";
-const PRESET_ASSETS_REF = "v0.1.0";
-const PRESET_ASSET_DIR = "dsh-background-by-model/preset";
-/** The shape gate: `{"version": 9}` — see SCHEMA_VERSION in ./schema. */
-const PRESET_MANIFEST = "preset.json";
-const PRESET_CONFIG = "theme-config.json";
-/** Images are named after the slot they fill, exactly as they are on disk. */
-const PRESET_IMAGE_PREFIX = "modelbg-";
-/** Mirrors, tried in order — same reason as the festival art's. */
-const PRESET_ASSET_HOSTS = [`https://cdn.jsdelivr.net/gh/${PRESET_ASSETS_REPO}@${PRESET_ASSETS_REF}/${PRESET_ASSET_DIR}`, `https://raw.githubusercontent.com/${PRESET_ASSETS_REPO}/${PRESET_ASSETS_REF}/${PRESET_ASSET_DIR}`];
-/**
-* Caps for the profile, now per file rather than for one document: a profile is a
-* SET of transfers, and each has a different way of going wrong.
-*
-* The count is the one that matters — the request set is derived from the config,
-* so a hostile config could name a thousand slots and turn one button press into a
-* thousand downloads. `SLOT_RE` bounds each name, `PRESET_IMAGE_COUNT_MAX` bounds
-* how many there are, and the running TOTAL is bounded on the client, which is the
-* only side that sees more than one file.
-*
-* The timeout is set by measurement: a 350 KB wallpaper takes a second or two over
-* jsDelivr, and the fallback mirror is the slower one, so a tight budget would fail
-* exactly in the situation it exists for.
+* Caps for the recommended profile's pictures.
+*
+* A profile is a SET of transfers, and what can go wrong is different per file: the
+* node half bounds ONE download (`PRESET_IMAGE_MAX`) and the client bounds the
+* running TOTAL, because it is the only side that sees more than one file.
+*
+* The count is a constant now rather than something a remote config declares
+* (`PROFILE_SLOTS` in ./profile), so there is nothing left to bound: seven names,
+* each already inside `SLOT_RE`. The timeout is set by measurement — a 250–365 KB
+* wallpaper takes a second or two over the CDN, and the second edge is the slower
+* one, so a tight budget would fail exactly in the situation it exists for.
 */
-const PRESET_MANIFEST_MAX = 65536;
-const PRESET_CONFIG_MAX = 1048576;
 const PRESET_IMAGE_MAX = 8388608;
-const PRESET_IMAGE_COUNT_MAX = 64;
 const PRESET_FETCH_TIMEOUT = 6e4;
 const dataDir = () => dshHomePath(DATA_DIR);
 const configPath = () => dshHomePath(DATA_DIR, CONFIG_FILE);
+const configBackupPath = () => dshHomePath(DATA_DIR, CONFIG_BACKUP);
+const configTempPath = () => dshHomePath(DATA_DIR, `${CONFIG_FILE}${CONFIG_TEMP}`);
 const legacyWallpaperPath = () => dshHomePath(DATA_DIR, LEGACY_WALLPAPER);
 const imagePath = (slot) => dshHomePath(DATA_DIR, `${IMAGE_PREFIX}${slot}`);
-const holidayCachePath = (asset) => dshHomePath(DATA_DIR, HOLIDAY_CACHE_DIR, HOLIDAY_ASSETS_REF, asset);
+/** The cache directory of one GENERATION of the festival art (see `holidayCachePath`). */
+const holidayGenerationPath = (generation) => dshHomePath(DATA_DIR, HOLIDAY_CACHE_DIR, generation);
+/** The cached file of one asset: its own generation directory, named by the asset. */
+const holidayCachePath = (asset) => {
+	const def = HOLIDAYS.find((h) => h.asset === asset);
+	return dshHomePath(DATA_DIR, HOLIDAY_CACHE_DIR, def === void 0 ? "v1" : holidayArtGeneration(def), asset);
+};
 const exists = async (p) => {
 	try {
 		await access(p);
@@ -670,14 +801,15 @@ async function migrateLegacy(raw) {
 			images: [{
 				slot: "m1",
 				bgMode: typeof r.bgMode === "string" ? r.bgMode : "fit",
-				bgState: r.bgState ?? {}
+				bgState: r.bgState ?? {},
+				color: Array.isArray(r.color) ? r.color : null,
+				opacity: typeof r.wallpaperOpacity === "number" ? r.wallpaperOpacity : 1,
+				...typeof r.brightness === "number" ? { brightness: r.brightness } : {},
+				blur: typeof r.blur === "number" ? r.blur : 0
 			}],
 			match: "",
 			enabled: true,
-			color: Array.isArray(r.color) ? r.color : null,
-			wallpaperOpacity: typeof r.wallpaperOpacity === "number" ? r.wallpaperOpacity : 1,
-			brightness: typeof r.brightness === "number" ? r.brightness : 100,
-			blur: typeof r.blur === "number" ? r.blur : 0
+			color: Array.isArray(r.color) ? r.color : null
 		}],
 		opacities: r.opacities,
 		settingsOpacity: r.settingsOpacity,
@@ -686,7 +818,7 @@ async function migrateLegacy(raw) {
 		rightbarOpacity: r.rightbarOpacity
 	};
 	try {
-		await writeFile(configPath(), JSON.stringify(next, null, 2), "utf8");
+		await writeConfigFile(serializeConfig(next));
 	} catch (e) {
 		console.warn("dsh-background-by-model: could not rewrite the migrated config", e);
 	}
@@ -699,11 +831,121 @@ async function ensureDir() {
 		console.warn(`dsh-background-by-model: cannot create data dir "${dataDir()}"`, e);
 	}
 }
+/** The exact bytes a config file should hold. */
+function serializeConfig(config) {
+	return JSON.stringify(config, null, 2);
+}
+/**
+* Whether a string is a config this build would accept: JSON, and an object.
+*
+* Deliberately looser than `normalizeConfig` (which accepts anything and defaults
+* every field): this is the test for "is there something worth keeping", so a
+* schema-3 file and a hand-edited one both count. What it rejects is the two ways a
+* write can be interrupted — half a document, and an empty one.
+*/
+function parsesAsConfig(text) {
+	try {
+		const value = JSON.parse(text);
+		return value !== null && typeof value === "object" && !Array.isArray(value);
+	} catch {
+		return false;
+	}
+}
+/**
+* Write one config file so that no reader can ever see a partial document, keeping
+* the previous good one as `.bak`.
+*
+* Two steps, in this order, because the order is what makes the copy worth having:
+*
+*   1. the file on disk NOW is copied to `theme-config.json.bak` — but only when it
+*      parses. A corrupted live file must never overwrite the last good backup, or
+*      the first write after the corruption would also destroy the copy that could
+*      have replaced it;
+*   2. the new bytes go to a temp name and are RENAMED over the live path. A rename
+*      is atomic within one directory, so a crash either leaves the old file or the
+*      new one — never half of either.
+*
+* The rename is not `writeFile` for the same reason: writing in place truncates
+* first, and a crash between the truncation and the last byte is exactly the state
+* that used to eat a rule list.
+*/
+async function writeConfigFile(text) {
+	await ensureDir();
+	const target = configPath();
+	try {
+		const current = await readFile(target, "utf8");
+		if (parsesAsConfig(current)) {
+			const backupTemp = `${configBackupPath()}${CONFIG_TEMP}`;
+			await writeFile(backupTemp, current, "utf8");
+			await renameOver(backupTemp, configBackupPath());
+		}
+	} catch {}
+	const temp = configTempPath();
+	await writeFile(temp, text, "utf8");
+	await renameOver(temp, target);
+}
+/**
+* `rename` over an existing file, which replaces it atomically on POSIX.
+*
+* Windows refuses to rename onto a name that exists (EEXIST / EPERM), so the one
+* platform that cannot do this in one step gets a two-step fallback — and the
+* difference matters: unlinking first leaves a window with NO file, which is the
+* state this whole function exists to avoid, so on POSIX the unlink must never be
+* attempted. The fallback is only reached when the rename itself said the target is
+* in the way, which is exactly the Windows case.
+*/
+async function renameOver(from, to) {
+	try {
+		await rename(from, to);
+	} catch (e) {
+		const code = e?.code;
+		if (code !== "EEXIST" && code !== "EPERM" && code !== "ENOTEMPTY") throw e;
+		await rm(to, { force: true });
+		await rename(from, to);
+	}
+}
+/**
+* The last good config that can be restored, as raw text — or null when there is
+* none.
+*
+* Two candidates, in order of authority: the live file (when it parses, which is
+* the ordinary case and costs one read) and the `.bak`. The backup is only
+* consulted for a live file that is missing or corrupt, so a half-written document
+* from an interrupted save is answered with the copy rather than with the shipped
+* defaults — which is the difference between "your rules are back" and "your rules
+* were never there".
+*/
+async function readConfigFile() {
+	try {
+		const text = await readFile(configPath(), "utf8");
+		if (parsesAsConfig(text)) return {
+			text,
+			source: "live"
+		};
+	} catch {}
+	try {
+		const text = await readFile(configBackupPath(), "utf8");
+		if (!parsesAsConfig(text)) return null;
+		try {
+			await writeConfigFile(text);
+		} catch (e) {
+			console.warn("dsh-background-by-model: could not restore the config from its backup", e);
+		}
+		console.warn("dsh-background-by-model: \"theme-config.json\" was missing or unreadable; restored the last saved copy from \"theme-config.json.bak\"");
+		return {
+			text,
+			source: "backup"
+		};
+	} catch {
+		return null;
+	}
+}
 async function readConfig() {
 	await ensureDir();
+	const file = await readConfigFile();
 	let raw = {};
-	try {
-		raw = JSON.parse(await readFile(configPath(), "utf8"));
+	if (file !== null) try {
+		raw = JSON.parse(file.text);
 	} catch {
 		raw = {};
 	}
@@ -712,21 +954,21 @@ async function readConfig() {
 /**
 * The config, plus whether it is safe to decide what the store still owns from it.
 *
-* `readConfig` deliberately swallows a corrupt file and answers with defaults —
-* right for painting (a broken file must not leave a blank panel) and WRONG for
-* the cleanup, which would then see zero referenced slots and treat every image on
-* disk as an orphan. That is the one way this feature could delete a user's whole
-* wallpaper collection, so the two cases are told apart here and the sweep refuses
-* rather than guesses:
-*
-*   - no file at all → trusted. A fresh store has images only if something wrote
-*     them, and nothing did;
-*   - a file that parses to an object → trusted (its rules are what they say);
-*   - a file that is there but does not parse, or is not an object → NOT trusted.
-*
-* A config whose `rules` are missing entirely is trusted: `normalizeConfig` seeds
-* one blank rule for that case, which owns no slot, and the sanitizer's answer is
-* exactly what a reload would paint.
+* `readConfig` deliberately swallows a corrupt file and answers with the last good
+* copy (or, when there is none, with defaults) — right for painting and WRONG as a
+* basis for deleting images, because a store whose config could not be read at all
+* would then have zero referenced slots and every file on disk would look like an
+* orphan. That is the one way this feature could destroy a wallpaper collection, so
+* the two cases are told apart here and the sweep refuses rather than guesses:
+*
+*   - a live file that parses to an object → trusted (its rules are what they say);
+*   - no live file, and no backup either → trusted. A fresh store has images only
+*     if something wrote them, and nothing did;
+*   - a live file that is there but does not parse, or is not an object → the
+*     BACKUP is the answer, and only because it is exactly the config `readConfig`
+*     would restore: pruning against it is pruning against the rules the user is
+*     about to get back. When there is no parseable backup, this is `untrusted` and
+*     the sweep refuses.
 *
 * The untrusted branch deliberately does NOT go through `migrateLegacy`: that one
 * WRITES a repaired config back to disk for the shapes earlier releases left
@@ -737,31 +979,33 @@ async function readConfig() {
 */
 async function readConfigForSweep() {
 	await ensureDir();
-	let text;
+	let live = null;
 	try {
-		text = await readFile(configPath(), "utf8");
+		live = await readFile(configPath(), "utf8");
 	} catch {
-		return {
-			config: await readConfig(),
-			trusted: true
-		};
+		live = null;
 	}
-	let raw;
+	if (live !== null && parsesAsConfig(live)) return {
+		config: normalizeConfig(await migrateLegacy(JSON.parse(live))),
+		trusted: true
+	};
+	let backup = null;
 	try {
-		raw = JSON.parse(text);
+		backup = await readFile(configBackupPath(), "utf8");
 	} catch {
-		return {
-			config: normalizeConfig({}),
-			trusted: false
-		};
+		backup = null;
 	}
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return {
+	if (backup !== null && parsesAsConfig(backup)) return {
+		config: normalizeConfig(JSON.parse(backup)),
+		trusted: true
+	};
+	if (live === null && backup === null) return {
 		config: normalizeConfig({}),
-		trusted: false
+		trusted: true
 	};
 	return {
-		config: normalizeConfig(await migrateLegacy(raw)),
-		trusted: true
+		config: normalizeConfig({}),
+		trusted: false
 	};
 }
 const LEGACY_CONFIG_KEYS = /* @__PURE__ */ new Set([
@@ -775,7 +1019,10 @@ const LEGACY_CONFIG_KEYS = /* @__PURE__ */ new Set([
 const LEGACY_RULE_KEYS = /* @__PURE__ */ new Set([
 	"slot",
 	"bgState",
-	"bgMode"
+	"bgMode",
+	"wallpaperOpacity",
+	"brightness",
+	"blur"
 ]);
 const LEGACY_NESTED_KEYS = /* @__PURE__ */ new Set(["rules[].rotate.fadeMs"]);
 const warnedConfigKeys = /* @__PURE__ */ new Set();
@@ -829,11 +1076,10 @@ function warnUnknownConfigKeys(raw, normalized) {
 	}
 }
 async function writeConfig(config) {
-	await ensureDir();
 	try {
 		const normalized = normalizeConfig(config);
 		warnUnknownConfigKeys(config, normalized);
-		await writeFile(configPath(), JSON.stringify(normalized, null, 2), "utf8");
+		await writeConfigFile(serializeConfig(normalized));
 		return true;
 	} catch (e) {
 		console.error(`dsh-background-by-model: failed to write "${CONFIG_FILE}"`, e);
@@ -846,7 +1092,7 @@ async function writeConfig(config) {
 *
 * The null answer is what a DOWNLOAD is checked against (see `fetchHolidayAsset`):
 * neither a status code nor a `content-type` header survives contact with a
-* misconfigured mirror, so the payload's own magic bytes are the only claim that
+* misconfigured origin, so the payload's own magic bytes are the only claim that
 * cannot lie.
 */
 function imageMimeOrNull(buf) {
@@ -919,10 +1165,12 @@ async function readHolidayAsset(asset) {
 	holidayInFlight.set(asset, task);
 	return await task;
 }
-/** Try every mirror in turn; the first usable answer is cached and returned. */
+/** Try every host in turn; the first usable answer is cached and returned. */
 async function downloadHolidayAsset(asset) {
-	for (const host of HOLIDAY_ASSET_HOSTS) {
-		const buf = await fetchHolidayAsset(`${host}/${asset}`);
+	const def = HOLIDAYS.find((h) => h.asset === asset);
+	if (def === void 0) return null;
+	for (const host of HOLIDAY_HOSTS) {
+		const buf = await fetchHolidayAsset(`${host}${def.source}`);
 		if (buf === null) continue;
 		await writeHolidayCache(asset, buf);
 		return buf;
@@ -983,18 +1231,18 @@ async function fetchAsset(url, max, timeout) {
 	}
 }
 /**
-* The status codes worth another round: 5xx is a mirror having a bad moment, 429 one
+* The status codes worth another round: 5xx is a host having a bad moment, 429 one
 * asking to be left alone, 408 one giving up on us. Every other non-2xx means the
-* file is not there (jsDelivr answers 403 outside the repository, 404 for a missing
-* file), and that answer must arrive fast and unchanged.
+* file is not there (404 for a missing path, 403 for a refused one), and that answer
+* must arrive fast and unchanged.
 */
 function fetchFailureForStatus(status) {
 	return status >= 500 || status === 429 || status === 408 ? "server" : "missing";
 }
 /**
-* One festival picture, or null when no mirror served an image.
+* One festival picture, or null when no host served an image.
 *
-* One round, unlike the profile's (`fetchPresetFile`): this is fetched during boot,
+* One round, unlike the profile's (`fetchProfileFile`): this is fetched during boot,
 * before the first wallpaper is painted, and a retry round would delay that paint.
 * The art is cached once it arrives and every later read tries again.
 */
@@ -1003,19 +1251,20 @@ async function fetchHolidayAsset(url) {
 	return !got.ok || imageMimeOrNull(got.buf) === null ? null : got.buf;
 }
 /**
-* One file out of the profile directory, or null when no mirror served it.
+* One of the profile's pictures, or null when no host served it.
 *
-* Every mirror is asked in every round, so a round is "all the hosts there are" and
-* the rounds are the retry (a mirror that answers 502 once and correctly the next
+* Every host is asked in every round, so a round is "all the hosts there are" and
+* the rounds are the retry (a host that answers 502 once and correctly the next
 * time, on the sixth of seven files). A round whose failures were all terminal — the
-* file is gone, or too big — ends the attempts outright, so a renamed file costs two
-* requests and a sentence naming the slot (`presetRetryable`, ./preset).
+* path is gone, or too big — ends the attempts outright, so a wrong URL costs three
+* requests rather than nine and a sentence naming the slot (`presetRetryable`,
+* ./preset).
 */
-async function fetchPresetFile(name, max) {
+async function fetchProfileFile(path, max) {
 	for (let attempt = 1; attempt <= 3; attempt++) {
 		let retryable = false;
-		for (const host of PRESET_ASSET_HOSTS) {
-			const got = await fetchAsset(`${host}/${name}`, max, PRESET_FETCH_TIMEOUT);
+		for (const host of PROFILE_HOSTS) {
+			const got = await fetchAsset(`${host}${path}`, max, PRESET_FETCH_TIMEOUT);
 			if (got.ok) return got.buf;
 			if (presetRetryable(got.reason)) retryable = true;
 		}
@@ -1025,102 +1274,30 @@ async function fetchPresetFile(name, max) {
 	return null;
 }
 /**
-* The profile's shape gate and its configuration, in one answer.
-*
-* Two files in order: the manifest says what SHAPE the config is written for, and a
-* config this build cannot read is refused here — before anything is downloaded in
-* earnest, long before anything is deleted. The config then says what the profile IS.
+* One of the profile's wallpapers, as a data URL ready to be written into a slot.
 *
-* The sanitizer runs on this side on purpose: the download list is DERIVED from
-* `rules[].images[].slot`, so an unsanitized config would let a remote file choose
-* what this process requests. After `normalizeConfig` every slot has passed `SLOT_RE`
-* (`normalizeImage`). Holiday slots are then DROPPED rather than refused: they are
-* named legally in `holidays.items`, have no file at all, and `writeImage` refuses
-* them anyway, so a rule pointing at one is already inert on the client.
+* The same two checks the festival art gets, for the same reason: the bytes must
+* actually be an image (`imageMimeOrNull`, never the `content-type` header — a CDN
+* may label a transform it does not serve), and the slot must be one this build is
+* willing to write. The slot name is re-checked here because this is a public RPC:
+* `profileImagePath` is the whitelist, and a name it does not carry has no URL at
+* all, so a caller cannot ask this process for a file of its own choosing.
 *
 * Nothing is cached to disk, unlike the festival art: that cache exists because the
 * art is fetched on a schedule and must work offline afterwards, while this is a
 * button whose whole point is to fetch what is there NOW.
 */
-async function fetchPresetConfig() {
-	const manifestRaw = await fetchPresetFile(PRESET_MANIFEST, PRESET_MANIFEST_MAX);
-	if (manifestRaw === null) return {
-		ok: false,
-		error: "download failed"
-	};
-	let manifest;
-	try {
-		manifest = JSON.parse(manifestRaw.toString("utf8"));
-	} catch {
-		return {
-			ok: false,
-			error: "not a profile"
-		};
-	}
-	const declared = manifest?.version;
-	if (typeof declared !== "number" || !isFinite(declared)) return {
-		ok: false,
-		error: "not a profile"
-	};
-	if (declared > 9) {
-		console.warn(`dsh-background-by-model: the recommended profile declares schema ${declared}, this build writes 9`);
-		return {
-			ok: false,
-			error: "newer version"
-		};
-	}
-	if (declared < 9) console.warn(`dsh-background-by-model: the recommended profile is written for schema ${declared}; importing it with defaults for the fields it predates`);
-	const configRaw = await fetchPresetFile(PRESET_CONFIG, PRESET_CONFIG_MAX);
-	if (configRaw === null) return {
-		ok: false,
-		error: "download failed"
-	};
-	let raw;
-	try {
-		raw = JSON.parse(configRaw.toString("utf8"));
-	} catch {
-		return {
-			ok: false,
-			error: "not a profile"
-		};
-	}
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return {
-		ok: false,
-		error: "not a profile"
-	};
-	const config = normalizeConfig(raw);
-	const slots = /* @__PURE__ */ new Set();
-	for (const rule of config.rules) for (const image of rule.images) {
-		if (holidayAssetFor(image.slot) !== null) continue;
-		slots.add(image.slot);
-	}
-	if (slots.size > PRESET_IMAGE_COUNT_MAX) return {
-		ok: false,
-		error: "too many images"
-	};
-	return {
-		ok: true,
-		version: declared,
-		config,
-		slots: [...slots]
-	};
-}
-/**
-* One of the profile's wallpapers, as a data URL ready to be written into a slot.
-*
-* The same two checks the festival art gets, for the same reason: the bytes must
-* actually be an image (`imageMimeOrNull`, never the `content-type` header — the
-* mirror serves extensionless files as `application/octet-stream`), and the slot
-* must be one this process is willing to write. The slot name is re-checked here
-* because this is a public RPC: the list this side hands out is not the only
-* thing a caller could ask for.
-*/
 async function fetchPresetImage(slot) {
 	if (!SLOT_RE.test(slot) || holidayAssetFor(slot) !== null) return {
 		ok: false,
 		error: "bad slot"
 	};
-	const buf = await fetchPresetFile(`${PRESET_IMAGE_PREFIX}${slot}`, PRESET_IMAGE_MAX);
+	const path = profileImagePath(slot);
+	if (path === null) return {
+		ok: false,
+		error: "bad slot"
+	};
+	const buf = await fetchProfileFile(path, PRESET_IMAGE_MAX);
 	if (buf === null) return {
 		ok: false,
 		error: "download failed"
@@ -1145,7 +1322,9 @@ async function fetchPresetImage(slot) {
 async function writeHolidayCache(asset, buf) {
 	try {
 		await ensureDir();
-		await mkdir(dshHomePath(DATA_DIR, HOLIDAY_CACHE_DIR, HOLIDAY_ASSETS_REF), { recursive: true });
+		const def = HOLIDAYS.find((h) => h.asset === asset);
+		if (def === void 0) return;
+		await mkdir(holidayGenerationPath(holidayArtGeneration(def)), { recursive: true });
 		const target = holidayCachePath(asset);
 		const temp = `${target}.tmp`;
 		await writeFile(temp, buf);
@@ -1155,21 +1334,28 @@ async function writeHolidayCache(asset, buf) {
 		console.warn(`dsh-background-by-model: could not cache the "${asset}" holiday art`, e);
 	}
 }
+/** The generation directories this build still reads — one per holiday, deduped. */
+function holidayGenerations() {
+	return [...new Set(HOLIDAYS.map(holidayArtGeneration))];
+}
 /**
-* Drop every generation of the cache except the one this build reads.
+* Drop every generation of the cache except the ones this build reads.
 *
-* Called AFTER a successful download, never before it: a pinned release that turns
-* out to be unreachable must not cost the user the art they already had.
+* Called AFTER a successful download, never before it: a build whose art turns out
+* to be unreachable must not cost the user the art they already had.
 *
-* It walks the cache ROOT and compares GENERATION names, never asset names, so the
-* generation in use cannot be touched. That also makes an upgrade clean up after
-* itself (0.7.9's flat `holiday-cache/<asset>` files are removed here).
+* It walks the cache ROOT and compares GENERATION names, never asset names, so a
+* generation in use cannot be touched. That is also what makes an upgrade clean up
+* after itself twice over: the release-tag directories of every earlier version
+* (`holiday-cache/<tag>/`) and 0.7.9's flat `holiday-cache/<asset>` files are both
+* gone from here, because neither name is a content hash.
 */
 async function pruneHolidayCache() {
 	try {
 		const root = dshHomePath(DATA_DIR, HOLIDAY_CACHE_DIR);
+		const keep = new Set(holidayGenerations());
 		for (const entry of await readdir(root)) {
-			if (entry === HOLIDAY_ASSETS_REF) continue;
+			if (keep.has(entry)) continue;
 			await rm(dshHomePath(DATA_DIR, HOLIDAY_CACHE_DIR, entry), {
 				recursive: true,
 				force: true
@@ -1216,7 +1402,7 @@ async function listSlots() {
 	}
 }
 /**
-* Empty the store: the config and every rule image, and nothing else.
+* Empty the store: the config, its backup and every rule image, and nothing else.
 *
 * The hard reset behind "use the recommended profile", and it has to be a real one
 * rather than a config overwrite: `nextSlot` hands out `m1`, `m2`, … as a running
@@ -1224,6 +1410,10 @@ async function listSlots() {
 * as a matter of course. Emptying first is what makes the profile's own slots free
 * to write, which is why no slot remapping is needed.
 *
+* The backup goes WITH the live file: a `.bak` left behind would be restored by the
+* next read, which would quietly undo the very replacement this call exists to
+* perform (`applyThemeFile`'s `wipeFirst`).
+*
 * `holiday-cache/` is deliberately untouched: downloaded art that belongs to no
 * slot and costs a round trip to get back. Pruning generations is
 * `pruneHolidayCache`'s job.
@@ -1234,8 +1424,8 @@ async function listSlots() {
 */
 async function resetStore() {
 	let ok = true;
-	try {
-		await rm(configPath(), { force: true });
+	for (const path of [configPath(), configBackupPath()]) try {
+		await rm(path, { force: true });
 	} catch (e) {
 		ok = false;
 		console.warn(`dsh-background-by-model: failed to remove "${CONFIG_FILE}"`, e);
@@ -1476,7 +1666,7 @@ async function handleRpcMethod(ctx, endpoint, payload) {
 				value: {
 					config: await readConfig(),
 					slots: await listSlots(),
-					schema: 9
+					schema: 10
 				}
 			};
 			case "writeConfig": return {
@@ -1522,10 +1712,6 @@ async function handleRpcMethod(ctx, endpoint, payload) {
 					ok: true,
 					value: await fetchImageUrl(slot, payload?.url ?? null)
 				};
-			case "fetchPresetConfig": return {
-				ok: true,
-				value: await fetchPresetConfig()
-			};
 			case "fetchPresetImage":
 				if (slot === null) return {
 					ok: true,