dsh-draw 0.1.0 → 0.1.2

package/CHANGELOG.md

@@ -5,6 +5,26 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.1.2] - 2026-08-22
+
+### Changed
+
+- Upgraded every `@deepseek-ai/dsh-*` devDependency to `0.1.1-rc.2` and the `dshWorkshop.compatibility.dshVersions` declaration to `0.1.1-rc.2` (rc.2 compatibility release); peers stay `>=0.1.0-rc.8 <0.2.0` and `@deepseek-ai/cordis` stays `^4.0.1`.
+- Re-verified the rc.2 credential read/write surface (`resolve`/`describe`/`set`/`unset`) and the attachment `saveImage`/`ImageAttachmentRef`/`ImageAttachmentLimits` face; both remain source-compatible, so no plugin code changes were required.
+- The monthly compat workflow now installs and smokes against DeepSeek Harness `0.1.1-rc.2`.
+
+## [0.1.1] - 2026-08-21
+
+### Changed
+
+- Upgraded every `@deepseek-ai/dsh-*` peer to `>=0.1.0-rc.8 <0.2.0` and every devDependency to `0.1.0-rc.8` (rc.8 compatibility release); `@deepseek-ai/cordis` stays at `^4.0.1`.
+- `tests/harness.ts` pins the rc.8 `ImageAttachmentLimits` face (adds `maxImageDimension`).
+
+### Fixed
+
+- Sessions that used image generation no longer refuse to reopen on rc.6/rc.7 hosts (issue #2). `draw/generated` is declared only by this package, so it sits outside the host's static `KNOWN_SESSION_EVENT_TYPES` whitelist, and those hosts' `Session.append` cannot stamp the `ignorable` envelope — every generated image left the log unloadable after restart with `SessionFormatUnsupportedError`. The append now goes through an adaptive gate (`src/event-gate.ts`): the event is logged only when the host knows the type or a mount-time probe on a detached `SessionStore` proves envelope support. On gated hosts the accounting payload rides a new in-memory fallback ledger (WeakMap-keyed by session), so quota stays exact for the live session and the log stays reloadable; durable, log-folded accounting resumes on hosts with a plugin event surface.
+- Regression coverage: `tests/event-gate.spec.ts` pins the gate decisions, the rc.6 probe reading, fallback-ledger quota accounting, and the append-failure degradation; the assembly regenerate test now asserts the rc.6-safe behavior (clean log, exact quota).
+
 ## [0.1.0] - 2026-08-16
 
 - Initial release: unified image_generate tool with config-driven engine routing, health-aware fallback, durable attachments, per-session quota accounting, and credential-reference key storage.

package/README.es.md

@@ -24,7 +24,7 @@
 
 | Superficie | Estado |
 |---|---|
-| Harness | DeepSeek Harness `0.1.0-rc.6` (compatibilidad declarada para `0.1.0-rc.6`) |
+| Harness | DeepSeek Harness `0.1.1-rc.2` (compatibilidad declarada para `0.1.1-rc.2`) |
 | Node | `^22.19.0 \|\| >=24.0.0` |
 | Motores | Cualquier endpoint de imágenes compatible con OpenAI; presets para OpenAI Images (`gpt-image-1`) y Zhipu CogView (`cogview-3-flash`) |
 | Superficies | Herramienta host `image_generate` + tarjeta de resultado web + pestaña de ajustes de Plugins |
@@ -116,8 +116,8 @@ Ejemplo de sobrescritura en el parche de tu perfil:
 ## Permisos y datos
 
 - **Permisos**: el plugin solo hace llamadas HTTPS salientes a los endpoints de motor configurados; el resto es de solo lectura. Las únicas escrituras de la pestaña de ajustes son las llamadas de establecer/eliminar credenciales en el seam oficial `ctx.credentials`.
-- **Datos**: las imágenes generadas se guardan a través del almacén de adjuntos oficial bajo la política de adjuntos del harness. El uso de cuota se pliega desde los eventos de sesión `draw/generated` — nada más se almacena.
-- **Registro de sesión**: el evento `draw/generated` registra motor, modelo, solicitud estandarizada, totales de bytes e ids de adjunto — los hechos de auditoría, nunca las claves API.
+- **Datos**: las imágenes generadas se guardan a través del almacén de adjuntos oficial bajo la política de adjuntos del harness. El uso de cuota se pliega desde los eventos de sesión `draw/generated`, más el libro auxiliar en memoria en hosts que no pueden registrar esos eventos — nada más se almacena.
+- **Registro de sesión**: el evento `draw/generated` registra motor, modelo, solicitud estandarizada, totales de bytes e ids de adjunto — los hechos de auditoría, nunca las claves API. El evento solo se añade cuando el host conoce el tipo o admite el sobre `ignorable` (sondeado al montar); en hosts rc.6/rc.7 la carga va al libro auxiliar en memoria, de modo que generar imágenes ya no hace que la sesión se niegue a reabrirse.
 
 ## Límites de seguridad
 
@@ -131,13 +131,14 @@ Ejemplo de sobrescritura en el parche de tu perfil:
 - **Solo modelos de imagen.** Sin endpoints de vídeo, audio o edición; sin comprensión visual.
 - **Compatibilidad de motores.** Los motores deben hablar la forma `POST /images/generations` de OpenAI (entrega base64 o URL); los extras específicos de cada proveedor quedan fuera.
 - **La conciencia de coste es estructural.** El plugin cuenta llamadas y bytes pero no conoce el precio de los motores — combínalo con `dsh-budget` para la gobernanza de coste.
+- **Durabilidad de cuota en rc.6/rc.7.** En hosts cuyo registro de sesión no puede llevar `draw/generated` (lista blanca estática de eventos, sin sobre `ignorable`), la cuota sigue exacta en la sesión viva desde el libro auxiliar en memoria pero se reinicia al reiniciar; la contabilidad duradera vuelve en hosts con una superficie de eventos para plugins.
 
 ## Desarrollo
 
 ```sh
 pnpm install        # node ^22.19 || >=24
 pnpm run typecheck  # tsc: src + tests contra el checkout local del harness
-pnpm run typecheck:ci  # tsc contra las caras publicadas 0.1.0-rc.6 (sin paths)
+pnpm run typecheck:ci  # tsc contra las caras publicadas 0.1.1-rc.2 (sin paths)
 pnpm test           # vitest: 77 tests, 11 suites (transporte guionado, Context/Session/ToolRuntime reales)
 pnpm run build      # declaraciones tsc + bundles tsdown (lib/)
 pnpm run verify:self-contained  # las especificaciones de dependencias resuelven desde el registry

package/README.hi.md

@@ -24,7 +24,7 @@
 
 | सतह | स्थिति |
 |---|---|
-| Harness | DeepSeek Harness `0.1.0-rc.6` (`0.1.0-rc.6` के लिए घोषित संगतता) |
+| Harness | DeepSeek Harness `0.1.1-rc.2` (`0.1.1-rc.2` के लिए घोषित संगतता) |
 | Node | `^22.19.0 \|\| >=24.0.0` |
 | इंजन | कोई भी OpenAI-संगत images एंडपॉइंट; OpenAI Images (`gpt-image-1`) और Zhipu CogView (`cogview-3-flash`) प्रीसेट |
 | सतहें | Host `image_generate` टूल + वेब परिणाम कार्ड + Plugins सेटिंग टैब |
@@ -116,8 +116,8 @@ dsh --profile web --dump-config | grep -A2 'id: dsh-draw'
 ## अनुमतियाँ और डेटा
 
 - **अनुमतियाँ**: प्लगइन केवल कॉन्फ़िगर किए इंजन एंडपॉइंट पर आउटबाउंड HTTPS कॉल करता है; बाकी सब केवल-पठन है। सेटिंग टैब का एकमात्र लेखन आधिकारिक `ctx.credentials` सीम पर क्रेडेंशियल सेट/हटाना है।
-- **डेटा**: बनी छवियाँ आधिकारिक अटैचमेंट स्टोर से हार्नेस की अपनी नीति के तहत सहेजी जाती हैं। कोटा उपयोग `draw/generated` सत्र इवेंट से मोड़ा जाता है — और कुछ संग्रहीत नहीं होता।
-- **सत्र लॉग**: `draw/generated` इवेंट इंजन, मॉडल, मानकीकृत अनुरोध, बाइट योग और अटैचमेंट आईडी दर्ज करता है — ऑडिट तथ्य, कभी API कुंजियाँ नहीं।
+- **डेटा**: बनी छवियाँ आधिकारिक अटैचमेंट स्टोर से हार्नेस की अपनी नीति के तहत सहेजी जाती हैं। कोटा उपयोग `draw/generated` सत्र इवेंट से मोड़ा जाता है, साथ में उन होस्ट पर इन-मेमोरी फ़ॉलबैक लेजर से जो उन इवेंट को लॉग नहीं कर सकते — और कुछ संग्रहीत नहीं होता।
+- **सत्र लॉग**: `draw/generated` इवेंट इंजन, मॉडल, मानकीकृत अनुरोध, बाइट योग और अटैचमेंट आईडी दर्ज करता है — ऑडिट तथ्य, कभी API कुंजियाँ नहीं। इवेंट तभी जोड़ा जाता है जब होस्ट उस प्रकार को जानता हो या `ignorable` एनवेलप स्वीकार करता हो (माउंट पर जांचा जाता है); rc.6/rc.7 होस्ट पर पेलोड इन-मेमोरी फ़ॉलबैक लेजर में जाता है, इसलिए इमेज बनाने से सत्र अब दोबारा खुलने से इनकार नहीं करता।
 
 ## सुरक्षा सीमाएँ
 
@@ -131,13 +131,14 @@ dsh --profile web --dump-config | grep -A2 'id: dsh-draw'
 - **केवल छवि मॉडल।** कोई वीडियो, ऑडियो या संपादन एंडपॉइंट नहीं; कोई विज़ुअल समझ नहीं।
 - **इंजन संगतता।** इंजन को OpenAI `POST /images/generations` आकार बोलना चाहिए (base64 या URL डिलीवरी); प्रदाता-विशेष अतिरिक्त दायरे से बाहर हैं।
 - **लागत-जागरूकता संरचनात्मक है।** प्लगइन कॉल और बाइट गिनता है, इंजन मूल्य नहीं जानता — लागत प्रशासन के लिए `dsh-budget` के साथ जोड़ें।
+- **rc.6/rc.7 पर कोटा स्थायित्व।** जिन होस्ट का सत्र लॉग `draw/generated` को सुरक्षित रूप से नहीं रख सकता (स्थिर इवेंट श्वेतसूची, कोई `ignorable` एनवेलप नहीं), कोटा इन-मेमोरी फ़ॉलबैक लेजर से जीवित सत्र में सटीक रहता है लेकिन पुनः आरंभ पर रीसेट हो जाता है; प्लगइन इवेंट सतह वाले होस्ट पर टिकाऊ लेखांकन फिर से शुरू होता है।
 
 ## विकास
 
 ```sh
 pnpm install        # node ^22.19 || >=24
 pnpm run typecheck  # tsc: src + tests स्थानीय हार्नेस चेकआउट के विरुद्ध
-pnpm run typecheck:ci  # tsc प्रकाशित 0.1.0-rc.6 फ़ेस के विरुद्ध (बिना paths)
+pnpm run typecheck:ci  # tsc प्रकाशित 0.1.1-rc.2 फ़ेस के विरुद्ध (बिना paths)
 pnpm test           # vitest: 77 टेस्ट, 11 सुइट (स्क्रिप्टेड ट्रांसपोर्ट, वास्तविक Context/Session/ToolRuntime)
 pnpm run build      # tsc घोषणाएँ + tsdown बंडल (lib/)
 pnpm run verify:self-contained  # निर्भरता स्पेक registry से हल होती हैं

package/README.md

@@ -1,6 +1,7 @@
 <div align="center">
 
 # 🎨 dsh-draw
+[![Gitee](https://img.shields.io/badge/Gitee-mirror-c71d23?logo=gitee)](https://gitee.com/perrylink/dsh-draw)
 
 **Unified static-image generation routing for DeepSeek Harness.**
 
@@ -24,7 +25,7 @@
 
 | Surface | Status |
 |---|---|
-| Harness | DeepSeek Harness `0.1.0-rc.6` (compat declared for `0.1.0-rc.6`) |
+| Harness | DeepSeek Harness `0.1.1-rc.2` (compat declared for `0.1.1-rc.2`) |
 | Node | `^22.19.0 \|\| >=24.0.0` |
 | Engines | Any OpenAI-compatible images endpoint; presets for OpenAI Images (`gpt-image-1`) and Zhipu CogView (`cogview-3-flash`) |
 | Surfaces | Host `image_generate` tool + web result card + Plugins settings tab |
@@ -116,8 +117,8 @@ Example override in your profile patch:
 ## Permissions & data
 
 - **Permissions**: the plugin makes outbound HTTPS calls to the configured engine endpoints only; every other surface is read-only. The settings tab's only writes are credential set/remove calls on the official `ctx.credentials` seam.
-- **Data**: generated images are saved through the official attachment store under the harness's own attachment policy. Quota usage is folded from the `draw/generated` session events — nothing else is stored.
-- **Session log**: the `draw/generated` event records engine, model, standardized request, byte totals, and attachment ids — the audit facts, never the API keys.
+- **Data**: generated images are saved through the official attachment store under the harness's own attachment policy. Quota usage is folded from the `draw/generated` session events, plus the in-memory fallback ledger on hosts that cannot log those events — nothing else is stored.
+- **Session log**: the `draw/generated` event records engine, model, standardized request, byte totals, and attachment ids — the audit facts, never the API keys. The event is appended only when the host knows the type or honors the `ignorable` envelope (probed at mount); on rc.6/rc.7 hosts the payload goes to the in-memory fallback ledger instead, so generating images can no longer make a session refuse to reopen.
 
 ## Security boundaries
 
@@ -131,13 +132,14 @@ Example override in your profile patch:
 - **Image models only.** No video, audio, or edit endpoints; no vision understanding.
 - **Engine compatibility.** Engines must speak the OpenAI `POST /images/generations` shape (base64 or URL delivery); provider-specific extras are out of scope.
 - **Cost awareness is structural.** The plugin counts calls and bytes but does not know engine pricing — pair with `dsh-budget` for cost governance.
+- **Quota durability on rc.6/rc.7.** On hosts whose session log cannot carry `draw/generated` (static event whitelist, no `ignorable` envelope), quota stays exact for the live session from the in-memory fallback ledger but resets on restart; durable accounting resumes on hosts with a plugin event surface.
 
 ## Development
 
 ```sh
 pnpm install        # node ^22.19 || >=24
 pnpm run typecheck  # tsc: src + tests against the local harness checkout
-pnpm run typecheck:ci  # tsc against the published 0.1.0-rc.6 faces (no paths)
+pnpm run typecheck:ci  # tsc against the published 0.1.1-rc.2 faces (no paths)
 pnpm test           # vitest: 77 tests, 11 suites (scripted transport, real Context/Session/ToolRuntime)
 pnpm run build      # tsc declarations + tsdown bundles (lib/)
 pnpm run verify:self-contained  # dependency specs resolve from the registry

package/README.pt.md

@@ -24,7 +24,7 @@
 
 | Superfície | Status |
 |---|---|
-| Harness | DeepSeek Harness `0.1.0-rc.6` (compatibilidade declarada para `0.1.0-rc.6`) |
+| Harness | DeepSeek Harness `0.1.1-rc.2` (compatibilidade declarada para `0.1.1-rc.2`) |
 | Node | `^22.19.0 \|\| >=24.0.0` |
 | Motores | Qualquer endpoint de imagens compatível com OpenAI; presets para OpenAI Images (`gpt-image-1`) e Zhipu CogView (`cogview-3-flash`) |
 | Superfícies | Ferramenta host `image_generate` + cartão de resultado web + aba de ajustes de Plugins |
@@ -116,8 +116,8 @@ Exemplo de sobrescrita no patch do seu perfil:
 ## Permissões e dados
 
 - **Permissões**: o plugin só faz chamadas HTTPS de saída para os endpoints de motor configurados; todo o resto é somente leitura. As únicas escritas da aba de ajustes são as chamadas de definir/remover credenciais no seam oficial `ctx.credentials`.
-- **Dados**: as imagens geradas são salvas através do armazenamento de anexos oficial sob a política de anexos do harness. O uso de cota é dobrado dos eventos de sessão `draw/generated` — nada mais é armazenado.
-- **Registro de sessão**: o evento `draw/generated` registra motor, modelo, solicitação padronizada, totais de bytes e ids de anexo — os fatos de auditoria, nunca as chaves de API.
+- **Dados**: as imagens geradas são salvas através do armazenamento de anexos oficial sob a política de anexos do harness. O uso de cota é dobrado dos eventos de sessão `draw/generated`, mais o livro auxiliar em memória em hosts que não podem registrar esses eventos — nada mais é armazenado.
+- **Registro de sessão**: o evento `draw/generated` registra motor, modelo, solicitação padronizada, totais de bytes e ids de anexo — os fatos de auditoria, nunca as chaves API. O evento só é anexado quando o host conhece o tipo ou honra o envelope `ignorable` (sondado na montagem); em hosts rc.6/rc.7 a carga vai para o livro auxiliar em memória, então gerar imagens não faz mais a sessão recusar reabrir.
 
 ## Limites de segurança
 
@@ -131,13 +131,14 @@ Exemplo de sobrescrita no patch do seu perfil:
 - **Somente modelos de imagem.** Sem endpoints de vídeo, áudio ou edição; sem compreensão visual.
 - **Compatibilidade de motores.** Os motores devem falar a forma `POST /images/generations` da OpenAI (entrega base64 ou URL); extras específicos de cada provedor ficam de fora.
 - **Consciência de custo é estrutural.** O plugin conta chamadas e bytes, mas não conhece o preço dos motores — combine com `dsh-budget` para a governança de custo.
+- **Durabilidade de cota em rc.6/rc.7.** Em hosts cujo registro de sessão não pode carregar `draw/generated` (lista estática de eventos, sem envelope `ignorable`), a cota continua exata na sessão viva a partir do livro auxiliar em memória, mas zera ao reiniciar; a contabilidade durável retorna em hosts com uma superfície de eventos para plugins.
 
 ## Desenvolvimento
 
 ```sh
 pnpm install        # node ^22.19 || >=24
 pnpm run typecheck  # tsc: src + tests contra o checkout local do harness
-pnpm run typecheck:ci  # tsc contra as faces publicadas 0.1.0-rc.6 (sem paths)
+pnpm run typecheck:ci  # tsc contra as faces publicadas 0.1.1-rc.2 (sem paths)
 pnpm test           # vitest: 77 testes, 11 suítes (transporte roteirizado, Context/Session/ToolRuntime reais)
 pnpm run build      # declarações tsc + bundles tsdown (lib/)
 pnpm run verify:self-contained  # as especificações de dependências resolvem pelo registry

package/README.zh.md

@@ -24,7 +24,7 @@
 
 | 方面 | 状态 |
 |---|---|
-| Harness | DeepSeek Harness `0.1.0-rc.6`（声明兼容 `0.1.0-rc.6`） |
+| Harness | DeepSeek Harness `0.1.1-rc.2`（声明兼容 `0.1.1-rc.2`） |
 | Node | `^22.19.0 \|\| >=24.0.0` |
 | 引擎 | 任意 OpenAI 兼容图像端点；内置 OpenAI Images（`gpt-image-1`）与智谱 CogView（`cogview-3-flash`）预设 |
 | 界面 | Host `image_generate` 工具 + Web 结果卡片 + Plugins 设置页签 |
@@ -116,8 +116,8 @@ profile patch 中的覆盖示例：
 ## 权限与数据
 
 - **权限**：插件仅对配置的引擎端点发起 HTTPS 出站请求；其余界面全部只读。设置页签唯一的写入是对官方 `ctx.credentials` 接缝的凭据设置/移除。
-- **数据**：生成的图片经官方附件存储落盘，受 harness 附件策略约束。配额用量从 `draw/generated` 会话事件折叠 —— 不额外存储任何东西。
-- **会话日志**：`draw/generated` 事件记录引擎、模型、标准化请求、字节总量与附件 id —— 审计事实，绝不包含 API 密钥。
+- **数据**：生成的图片经官方附件存储落盘，受 harness 附件策略约束。配额用量从 `draw/generated` 会话事件折叠；在无法安全落盘该事件的宿主上另加内存兜底账簿 —— 除此之外不存储任何东西。
+- **会话日志**：`draw/generated` 事件记录引擎、模型、标准化请求、字节总量与附件 id —— 审计事实，绝不包含 API 密钥。仅当宿主收录该类型或支持 `ignorable` 信封时才落盘（挂载期探测）；在 rc.6/rc.7 宿主上载荷改记内存兜底账簿，生成图片不再导致会话重启后无法打开。
 
 ## 安全边界
 
@@ -131,13 +131,14 @@ profile patch 中的覆盖示例：
 - **仅图像模型。** 无视频、音频或编辑端点；无视觉理解。
 - **引擎兼容性。** 引擎需支持 OpenAI `POST /images/generations` 形状（base64 或 URL 交付）；厂商专属扩展不在范围内。
 - **成本感知是结构性的。** 插件统计调用次数与字节，但不了解引擎定价 —— 与 `dsh-budget` 配合做成本治理。
+- **rc.6/rc.7 上的配额持久性。** 会话日志无法安全携带 `draw/generated` 的宿主（静态事件白名单、无 `ignorable` 信封）上，配额经内存兜底账簿在活会话内保持精确，但重启后重置；宿主具备插件事件面后恢复持久记账。
 
 ## 开发
 
 ```sh
 pnpm install        # node ^22.19 || >=24
 pnpm run typecheck  # tsc：src + tests，对照本地 harness checkout
-pnpm run typecheck:ci  # tsc：对照已发布的 0.1.0-rc.6 类型（无 paths）
+pnpm run typecheck:ci  # tsc：对照已发布的 0.1.1-rc.2 类型（无 paths）
 pnpm test           # vitest：77 个测试、11 个套件（scripted 传输、真实 Context/Session/ToolRuntime）
 pnpm run build      # tsc 声明 + tsdown 打包（lib/）
 pnpm run verify:self-contained  # 依赖声明全部来自 registry

package/lib/index.js

@@ -1,8 +1,9 @@
 import { i as statusToView, n as imageToWire, r as probeToWire, t as DRAW_INVOCATIONS } from "./wire-Cc4JZ3jR.js";
 import { credentialRef } from "@deepseek-ai/dsh-credentials";
 import z from "@deepseek-ai/schemastery";
+import { Context } from "@deepseek-ai/cordis";
+import SessionStore, { KNOWN_SESSION_EVENT_TYPES, SessionId } from "@deepseek-ai/dsh-session";
 import { TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
-import { SessionId } from "@deepseek-ai/dsh-session";
 import { AttachmentId } from "@deepseek-ai/dsh-attachment";
 import { defineTool } from "@deepseek-ai/dsh-tools";
 //#region src/config.ts
@@ -209,7 +210,9 @@ function engineById(config, id) {
 //#endregion
 //#region src/session-events.ts
 /**
-* Append one `draw/generated` event to a session.
+* Append one `draw/generated` event to a session, ungated. Plugin paths use
+* {@link commitDrawGenerated} instead; this raw form remains for tests and
+* hosts that know the type.
 *
 * @param session - owning session.
 * @param event - accounting payload.
@@ -219,6 +222,47 @@ function appendDrawGenerated(session, event) {
 	return session.append("draw/generated", event);
 }
 /**
+* In-memory accounting ledger for hosts whose session log cannot carry
+* `draw/generated` safely (rc.6/rc.7 static whitelist, no ignorable envelope).
+* Keyed by Session identity: the entries live exactly as long as the session.
+*/
+const fallbackLedger = /* @__PURE__ */ new WeakMap();
+/**
+* Commit one completed generation: append the `draw/generated` event when the
+* gate allows (with the ignorable envelope when required), otherwise record
+* the payload in the in-memory fallback ledger. A failed append degrades to
+* the same ledger and never breaks the draw.
+*
+* @param session - owning session.
+* @param event - accounting payload.
+* @param gate - the adaptive gate (event-gate.ts).
+* @param warn - log warning sink for append failures.
+*/
+function commitDrawGenerated(session, event, gate, warn) {
+	const decision = gate("draw/generated");
+	if (decision.append) try {
+		if (decision.ignorable) session.append("draw/generated", event, { ignorable: true });
+		else session.append("draw/generated", event);
+		return;
+	} catch (error) {
+		warn(`draw session event append failed: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	const list = fallbackLedger.get(session) ?? [];
+	list.push(event);
+	fallbackLedger.set(session, list);
+}
+/**
+* The in-memory fallback records of a session, in commit order. Populated
+* only while the host cannot carry `draw/generated` in the log; quota folds
+* these on top of the logged events.
+*
+* @param session - session whose ledger is read.
+* @returns the fallback payloads.
+*/
+function fallbackDrawGeneratedEvents(session) {
+	return fallbackLedger.get(session) ?? [];
+}
+/**
 * Collect the `draw/generated` events of a session in log order. Declaration
 * merging narrows `event.type === 'draw/generated'` to the payload type.
 *
@@ -231,9 +275,11 @@ function drawGeneratedEvents(session) {
 //#endregion
 //#region src/quota.ts
 /**
-* Fold one session's `draw/generated` events into current usage.
+* Fold one session's `draw/generated` events into current usage: logged events
+* first, then the in-memory fallback ledger (disjoint — a commit lands in
+* exactly one of them).
 *
-* @param session - session whose log is folded.
+* @param session - session whose log and ledger are folded.
 * @returns generation and byte totals.
 */
 function quotaState(session) {
@@ -243,6 +289,10 @@ function quotaState(session) {
 		generations += 1;
 		bytes += event.data.bytes;
 	}
+	for (const event of fallbackDrawGeneratedEvents(session)) {
+		generations += 1;
+		bytes += event.bytes;
+	}
 	return {
 		generations,
 		bytes
@@ -366,15 +416,18 @@ var Drawer = class {
 	config;
 	router;
 	deps;
+	events;
 	/**
 	* @param config - resolved plugin configuration.
 	* @param router - the engine router.
 	* @param deps - per-call dependencies (public: the remote service reads them for probes).
+	* @param events - the gated session-event sink (log when safe, in-memory ledger otherwise).
 	*/
-	constructor(config, router, deps) {
+	constructor(config, router, deps, events) {
 		this.config = config;
 		this.router = router;
 		this.deps = deps;
+		this.events = events;
 	}
 	/**
 	* Run one generation end to end: normalize and validate, check quota,
@@ -461,7 +514,7 @@ var Drawer = class {
 			...ref.name !== void 0 ? { name: ref.name } : {}
 		}));
 		const elapsedMs = Date.now() - startedAt;
-		appendDrawGenerated(session, {
+		commitDrawGenerated(session, {
 			engine: routed.engine,
 			model: routed.model,
 			source: options.source,
@@ -472,7 +525,7 @@ var Drawer = class {
 			bytes: totalBytes,
 			attachmentIds: images.map((image) => image.attachmentId),
 			elapsedMs
-		});
+		}, this.events.gate, this.events.warn);
 		const after = checkQuotaGenerations(session, limits);
 		return {
 			ok: true,
@@ -504,6 +557,78 @@ var Drawer = class {
 	}
 };
 //#endregion
+//#region src/event-gate.ts
+/**
+* The session-event adaptive gate. `draw/generated` is declared only in this
+* package's types, so it sits outside every host's `KNOWN_SESSION_EVENT_TYPES`:
+* hosts whose session reader validates a static whitelist (rc.6/rc.7) refuse to
+* reopen a session containing the event unless it carries the `ignorable`
+* envelope — and those hosts' `Session.append` cannot stamp it. The gate
+* therefore appends only when the type is host-known or a mount-time probe
+* proves envelope support; otherwise the accounting payload goes to the
+* in-memory fallback ledger (see session-events.ts) so quota keeps working for
+* the live session without poisoning the log.
+*
+* @module dsh-draw/event-gate
+*/
+/**
+* Build the gate: host-known types append plainly; unknown types append with
+* the ignorable envelope only when the host append honors it; everything else
+* is skipped — an unknown, unmarked event would make the session refuse to
+* load on restart under the rc.6/rc.7 static whitelist.
+*
+* @param knownTypes - the host's KNOWN_SESSION_EVENT_TYPES.
+* @param ignorableAppend - whether the host append stamps the envelope.
+* @returns the decision function.
+*/
+function makeEventGate(knownTypes, ignorableAppend = false) {
+	return (type) => {
+		if (knownTypes.has(type)) return {
+			append: true,
+			ignorable: false
+		};
+		if (ignorableAppend) return {
+			append: true,
+			ignorable: true
+		};
+		return {
+			append: false,
+			ignorable: false
+		};
+	};
+}
+/**
+* Probe whether the host `Session.append` stamps the ignorable envelope. Runs
+* on a fully detached SessionStore — never host persistence — appending one
+* probe event with `{ ignorable: true }` and reading the marker back. rc.6's
+* append silently drops the unknown options key (probe false); every failure
+* is contained as "unsupported".
+*
+* @returns whether the envelope is honored.
+*/
+function probeIgnorableAppend() {
+	try {
+		return new SessionStore(new Context()).create().append("draw/generated", {
+			engine: "probe",
+			model: "probe",
+			source: "tool",
+			prompt: "probe",
+			size: "auto",
+			quality: "auto",
+			count: 0,
+			bytes: 0,
+			attachmentIds: [],
+			elapsedMs: 0
+		}, { ignorable: true })?.ignorable === true;
+	} catch {
+		return false;
+	}
+}
+/** The gate over the host's known types plus the probed envelope support. */
+function makeHostEventGate() {
+	return makeEventGate(KNOWN_SESSION_EVENT_TYPES, probeIgnorableAppend());
+}
+//#endregion
 //#region src/http.ts
 /**
 * A transport-level failure. `status` is absent for network/timeout failures;
@@ -1066,7 +1191,7 @@ var EngineRouter = class {
 * @module dsh-draw/version
 */
 /** Plugin version; must equal the `version` field in `package.json`. */
-const PLUGIN_VERSION = "0.1.0";
+const PLUGIN_VERSION = "0.1.2";
 //#endregion
 //#region src/service.ts
 /**
@@ -1415,6 +1540,9 @@ async function apply(ctx, config) {
 		},
 		attachments: () => ctx.get("attachments"),
 		sessions: () => ctx.get("sessions")
+	}, {
+		gate: makeHostEventGate(),
+		warn: (message) => logger.warn(message)
 	});
 	ctx.effect(() => ctx.tools.register(imageGenerateTool(drawer, resolved)), "dsh-draw: image_generate tool");
 	await ctx.plugin(DrawService, {
@@ -1426,4 +1554,4 @@ async function apply(ctx, config) {
 	logger.info(`image generation enabled: ${resolved.engines.map((engine) => engine.id).join(", ")} (preferred ${resolved.defaultEngine})`);
 }
 //#endregion
-export { Config, DEFAULT_ENGINES, DRAW_INVOCATIONS, DrawService, Drawer, EngineCallError, EngineRouter, HttpError, PLUGIN_VERSION, REDACTED, appendDrawGenerated, apply, callEngine, checkQuotaBytes, checkQuotaGenerations, defaultHttpTransport, drawGeneratedEvents, engineById, fusedSignal, imageGenerateTool, imageToWire, inject, name, normalizeRequest, probeToWire, quotaState, resolveConfig, sanitizeError, sanitizeText, sanitizeUrl, statusToView, translateRequest };
+export { Config, DEFAULT_ENGINES, DRAW_INVOCATIONS, DrawService, Drawer, EngineCallError, EngineRouter, HttpError, PLUGIN_VERSION, REDACTED, appendDrawGenerated, apply, callEngine, checkQuotaBytes, checkQuotaGenerations, commitDrawGenerated, defaultHttpTransport, drawGeneratedEvents, engineById, fallbackDrawGeneratedEvents, fusedSignal, imageGenerateTool, imageToWire, inject, makeEventGate, makeHostEventGate, name, normalizeRequest, probeIgnorableAppend, probeToWire, quotaState, resolveConfig, sanitizeError, sanitizeText, sanitizeUrl, statusToView, translateRequest };

package/lib/types/client/DrawSettingsTab.d.ts

@@ -8,7 +8,7 @@
  */
 import { type ReactElement } from 'react';
 import type { InjectFace, PropsLocale, PropsRuntime } from '@deepseek-ai/dsh-client-ui-slots';
-import type { PresentedDrawPanel } from './present.ts';
+import type { PresentedDrawPanel } from './present.js';
 /** Registration-side injected face: the panel RPCs (RemoteResult already unwrapped). */
 export interface DrawSettingsTabInjected {
     /** Read the panel snapshot. */

package/lib/types/client/index.d.ts

@@ -8,11 +8,11 @@
  * @module dsh-draw/client
  */
 import type { ClientContext } from '@deepseek-ai/dsh-client-runtime/client';
-import { type DrawLocaleKey } from './locales.ts';
-export type { DrawResultCardInjected, DrawResultCardProps } from './DrawResultCard.tsx';
-export type { DrawSettingsTabInjected, DrawSettingsTabProps } from './DrawSettingsTab.tsx';
-export type { DrawLocaleKey } from './locales.ts';
-export { presentDrawPanel, presentDrawResult, type PresentedDrawPanel, type PresentedDrawResult, type PresentedEngineRow } from './present.ts';
+import { type DrawLocaleKey } from './locales.js';
+export type { DrawResultCardInjected, DrawResultCardProps } from './DrawResultCard.js';
+export type { DrawSettingsTabInjected, DrawSettingsTabProps } from './DrawSettingsTab.js';
+export type { DrawLocaleKey } from './locales.js';
+export { presentDrawPanel, presentDrawResult, type PresentedDrawPanel, type PresentedDrawResult, type PresentedEngineRow } from './present.js';
 declare module '@deepseek-ai/dsh-client-ui-slots' {
     interface LocaleNamespaceMap {
         /** Image-generation card and panel copy. */

package/lib/types/client/present.d.ts

@@ -7,7 +7,7 @@
  * @module dsh-draw/client/present
  */
 import type { ToolCallBlock } from '@deepseek-ai/dsh-client-runtime/client';
-import type { DrawStatusSnapshot } from '../wire.ts';
+import type { DrawStatusSnapshot } from '../wire.js';
 /** One image of the presented result card. */
 export interface PresentedImage {
     attachmentId: string;

package/lib/types/client/remote.d.ts

@@ -8,7 +8,7 @@
  * @module dsh-draw/client/remote
  */
 import type { RemoteResult } from '@deepseek-ai/dsh-typert-protocol';
-import type { CredentialActionResult, DrawProbeResult, DrawRegenerateResult, DrawStatusSnapshot } from '../wire.ts';
+import type { CredentialActionResult, DrawProbeResult, DrawRegenerateResult, DrawStatusSnapshot } from '../wire.js';
 declare module '@deepseek-ai/dsh-typert-protocol' {
     interface TypertRemoteNamespace$draw {
         /** Read the panel snapshot (engines, health, credentials, quota). */

package/lib/types/drawer.d.ts

@@ -8,10 +8,11 @@
  */
 import type { AttachmentStore } from '@deepseek-ai/dsh-attachment';
 import type { Session, SessionStore } from '@deepseek-ai/dsh-session';
-import type { ResolvedConfig } from './config.ts';
-import type { EngineDeps } from './engine.ts';
-import { type QuotaLimits, type QuotaState } from './quota.ts';
-import { EngineRouter, type AttemptView } from './router.ts';
+import type { ResolvedConfig } from './config.js';
+import type { EngineDeps } from './engine.js';
+import { type QuotaLimits, type QuotaState } from './quota.js';
+import { EngineRouter, type AttemptView } from './router.js';
+import type { EventGate } from './event-gate.js';
 /** One durable result image as the canonical value and wire carry it. */
 export interface DrawImage {
     /** Opaque attachment id. */
@@ -85,6 +86,13 @@ export interface DrawerDeps {
     /** Per-call session store accessor for the regenerate path. */
     sessions?: () => SessionStore | undefined;
 }
+/** How the drawer commits the `draw/generated` accounting event. */
+export interface DrawerEventSink {
+    /** The adaptive session-event gate, probed at mount. */
+    gate: EventGate;
+    /** Log warning sink for append failures. */
+    warn: (message: string) => void;
+}
 /**
  * The shared generation path.
  */
@@ -92,12 +100,14 @@ export declare class Drawer {
     private readonly config;
     private readonly router;
     readonly deps: DrawerDeps;
+    private readonly events;
     /**
      * @param config - resolved plugin configuration.
      * @param router - the engine router.
      * @param deps - per-call dependencies (public: the remote service reads them for probes).
+     * @param events - the gated session-event sink (log when safe, in-memory ledger otherwise).
      */
-    constructor(config: ResolvedConfig, router: EngineRouter, deps: DrawerDeps);
+    constructor(config: ResolvedConfig, router: EngineRouter, deps: DrawerDeps, events: DrawerEventSink);
     /**
      * Run one generation end to end: normalize and validate, check quota,
      * route through the engine chain, commit images to the attachment store,

package/lib/types/drawer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"drawer.d.ts","sourceRoot":"","sources":["../../src/drawer.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAsB,MAAM,6BAA6B,CAAA;AACtF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AACjD,OAAO,KAAK,EAAE,UAAU,EAAiB,MAAM,aAAa,CAAA;AAC5D,OAAO,EAA0C,KAAK,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAA;AACtG,OAAO,EAAE,YAAY,EAAE,KAAK,WAAW,EAAE,MAAM,aAAa,CAAA;AAI5D,yEAAyE;AACzE,MAAM,WAAW,SAAS;IACxB,4BAA4B;IAC5B,YAAY,EAAE,MAAM,CAAA;IACpB,2BAA2B;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,yBAAyB;IACzB,KAAK,EAAE,MAAM,CAAA;IACb,iCAAiC;IACjC,KAAK,EAAE,MAAM,CAAA;IACb,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAA;IACd,oBAAoB;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,yBAAyB;AACzB,MAAM,WAAW,WAAW;IAC1B,oBAAoB;IACpB,EAAE,EAAE,IAAI,CAAA;IACR,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAA;IACd,yBAAyB;IACzB,KAAK,EAAE,MAAM,CAAA;IACb,qDAAqD;IACrD,IAAI,EAAE,QAAQ,GAAG,WAAW,GAAG,UAAU,GAAG,MAAM,CAAA;IAClD,6BAA6B;IAC7B,MAAM,EAAE,SAAS,SAAS,EAAE,CAAA;IAC5B,6CAA6C;IAC7C,KAAK,EAAE,UAAU,CAAA;IACjB,6BAA6B;IAC7B,MAAM,EAAE,WAAW,CAAA;IACnB,2DAA2D;IAC3D,YAAY,EAAE,OAAO,CAAA;IACrB,iDAAiD;IACjD,SAAS,EAAE,MAAM,CAAA;IACjB,2CAA2C;IAC3C,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAA;CACjC;AAED,kDAAkD;AAClD,MAAM,MAAM,iBAAiB,GACzB,gBAAgB,GAChB,mBAAmB,GACnB,aAAa,GACb,YAAY,GACZ,yBAAyB,GACzB,oBAAoB,CAAA;AAExB,6EAA6E;AAC7E,MAAM,WAAW,WAAW;IAC1B,oBAAoB;IACpB,EAAE,EAAE,KAAK,CAAA;IACT,oCAAoC;IACpC,MAAM,EAAE,iBAAiB,CAAA;IACzB,gCAAgC;IAChC,OAAO,EAAE,MAAM,CAAA;IACf,uDAAuD;IACvD,KAAK,CAAC,EAAE,UAAU,CAAA;IAClB,2CAA2C;IAC3C,QAAQ,CAAC,EAAE,SAAS,WAAW,EAAE,CAAA;CAClC;AAED,oBAAoB;AACpB,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,WAAW,CAAA;AAEnD,kCAAkC;AAClC,MAAM,WAAW,WAAW;IAC1B,2BAA2B;IAC3B,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,4EAA4E;IAC5E,OAAO,EAAE,OAAO,GAAG,SAAS,CAAA;IAC5B,kEAAkE;IAClE,MAAM,EAAE,MAAM,GAAG,YAAY,CAAA;CAC9B;AAED,sFAAsF;AACtF,MAAM,WAAW,UAAU;IACzB,kDAAkD;IAClD,MAAM,EAAE,UAAU,CAAA;IAClB,iFAAiF;IACjF,WAAW,CAAC,EAAE,MAAM,eAAe,GAAG,SAAS,CAAA;IAC/C,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,YAAY,GAAG,SAAS,CAAA;CAC1C;AAED;;GAEG;AACH,qBAAa,MAAM;IAOf,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,QAAQ,CAAC,IAAI,EAAE,UAAU;IAR3B;;;;OAIG;IACH,YACmB,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,YAAY,EAC5B,IAAI,EAAE,UAAU,EACvB;IAEJ;;;;;;;;OAQG;IACG,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAiFxE;IAED,yFAAyF;YAC3E,UAAU;CAqBzB"}
+{"version":3,"file":"drawer.d.ts","sourceRoot":"","sources":["../../src/drawer.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAsB,MAAM,6BAA6B,CAAA;AACtF,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AACjD,OAAO,KAAK,EAAE,UAAU,EAAiB,MAAM,aAAa,CAAA;AAC5D,OAAO,EAA0C,KAAK,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAA;AACtG,OAAO,EAAE,YAAY,EAAE,KAAK,WAAW,EAAE,MAAM,aAAa,CAAA;AAE5D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAGhD,yEAAyE;AACzE,MAAM,WAAW,SAAS;IACxB,4BAA4B;IAC5B,YAAY,EAAE,MAAM,CAAA;IACpB,2BAA2B;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,yBAAyB;IACzB,KAAK,EAAE,MAAM,CAAA;IACb,iCAAiC;IACjC,KAAK,EAAE,MAAM,CAAA;IACb,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAA;IACd,oBAAoB;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,yBAAyB;AACzB,MAAM,WAAW,WAAW;IAC1B,oBAAoB;IACpB,EAAE,EAAE,IAAI,CAAA;IACR,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAA;IACd,yBAAyB;IACzB,KAAK,EAAE,MAAM,CAAA;IACb,qDAAqD;IACrD,IAAI,EAAE,QAAQ,GAAG,WAAW,GAAG,UAAU,GAAG,MAAM,CAAA;IAClD,6BAA6B;IAC7B,MAAM,EAAE,SAAS,SAAS,EAAE,CAAA;IAC5B,6CAA6C;IAC7C,KAAK,EAAE,UAAU,CAAA;IACjB,6BAA6B;IAC7B,MAAM,EAAE,WAAW,CAAA;IACnB,2DAA2D;IAC3D,YAAY,EAAE,OAAO,CAAA;IACrB,iDAAiD;IACjD,SAAS,EAAE,MAAM,CAAA;IACjB,2CAA2C;IAC3C,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAA;CACjC;AAED,kDAAkD;AAClD,MAAM,MAAM,iBAAiB,GACzB,gBAAgB,GAChB,mBAAmB,GACnB,aAAa,GACb,YAAY,GACZ,yBAAyB,GACzB,oBAAoB,CAAA;AAExB,6EAA6E;AAC7E,MAAM,WAAW,WAAW;IAC1B,oBAAoB;IACpB,EAAE,EAAE,KAAK,CAAA;IACT,oCAAoC;IACpC,MAAM,EAAE,iBAAiB,CAAA;IACzB,gCAAgC;IAChC,OAAO,EAAE,MAAM,CAAA;IACf,uDAAuD;IACvD,KAAK,CAAC,EAAE,UAAU,CAAA;IAClB,2CAA2C;IAC3C,QAAQ,CAAC,EAAE,SAAS,WAAW,EAAE,CAAA;CAClC;AAED,oBAAoB;AACpB,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,WAAW,CAAA;AAEnD,kCAAkC;AAClC,MAAM,WAAW,WAAW;IAC1B,2BAA2B;IAC3B,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,4EAA4E;IAC5E,OAAO,EAAE,OAAO,GAAG,SAAS,CAAA;IAC5B,kEAAkE;IAClE,MAAM,EAAE,MAAM,GAAG,YAAY,CAAA;CAC9B;AAED,sFAAsF;AACtF,MAAM,WAAW,UAAU;IACzB,kDAAkD;IAClD,MAAM,EAAE,UAAU,CAAA;IAClB,iFAAiF;IACjF,WAAW,CAAC,EAAE,MAAM,eAAe,GAAG,SAAS,CAAA;IAC/C,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,YAAY,GAAG,SAAS,CAAA;CAC1C;AAED,oEAAoE;AACpE,MAAM,WAAW,eAAe;IAC9B,wDAAwD;IACxD,IAAI,EAAE,SAAS,CAAA;IACf,4CAA4C;IAC5C,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAChC;AAED;;GAEG;AACH,qBAAa,MAAM;IAQf,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,QAAQ,CAAC,IAAI,EAAE,UAAU;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAVzB;;;;;OAKG;IACH,YACmB,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,YAAY,EAC5B,IAAI,EAAE,UAAU,EACR,MAAM,EAAE,eAAe,EACtC;IAEJ;;;;;;;;OAQG;IACG,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAiFxE;IAED,yFAAyF;YAC3E,UAAU;CAqBzB"}

package/lib/types/drawer.js

@@ -7,7 +7,7 @@
  * @module dsh-draw/drawer
  */
 import { checkQuotaBytes, checkQuotaGenerations } from './quota.js';
-import { appendDrawGenerated } from './session-events.js';
+import { commitDrawGenerated } from './session-events.js';
 import { normalizeRequest } from './translate.js';
 /**
  * The shared generation path.
@@ -16,15 +16,18 @@ export class Drawer {
     config;
     router;
     deps;
+    events;
     /**
      * @param config - resolved plugin configuration.
      * @param router - the engine router.
      * @param deps - per-call dependencies (public: the remote service reads them for probes).
+     * @param events - the gated session-event sink (log when safe, in-memory ledger otherwise).
      */
-    constructor(config, router, deps) {
+    constructor(config, router, deps, events) {
         this.config = config;
         this.router = router;
         this.deps = deps;
+        this.events = events;
     }
     /**
      * Run one generation end to end: normalize and validate, check quota,
@@ -92,7 +95,7 @@ export class Drawer {
             ...(ref.name !== undefined ? { name: ref.name } : {}),
         }));
         const elapsedMs = Date.now() - startedAt;
-        appendDrawGenerated(session, {
+        commitDrawGenerated(session, {
             engine: routed.engine,
             model: routed.model,
             source: options.source,
@@ -103,7 +106,7 @@ export class Drawer {
             bytes: totalBytes,
             attachmentIds: images.map(image => image.attachmentId),
             elapsedMs,
-        });
+        }, this.events.gate, this.events.warn);
         const after = checkQuotaGenerations(session, limits);
         return {
             ok: true,

package/lib/types/engine.d.ts

@@ -8,9 +8,9 @@
  * @module dsh-draw/engine
  */
 import type { ImageMediaType } from '@deepseek-ai/dsh-attachment';
-import type { ResolvedEngineConfig } from './config.ts';
-import { type HttpTransport } from './http.ts';
-import type { TranslatedImageRequest } from './translate.ts';
+import type { ResolvedEngineConfig } from './config.js';
+import { type HttpTransport } from './http.js';
+import type { TranslatedImageRequest } from './translate.js';
 /** Failure phases of one engine call, each mapping to a router decision. */
 export type EngineFailurePhase = 'credential' | 'request' | 'parse';
 /**