dsh-image-gen 0.10.2 → 0.10.3

package/lib/index.js

@@ -1,9 +1,11 @@
 import { createRequire } from "node:module";
 import { Context, Service } from "@deepseek-ai/cordis";
 import z from "@deepseek-ai/schemastery";
-import { lstat, mkdir, readFile, readdir, realpath, rename, stat, unlink, writeFile } from "node:fs/promises";
+import { homedir, tmpdir } from "node:os";
+import { lstat, mkdir, mkdtemp, readFile, readdir, realpath, rename, rm, rmdir, stat, unlink, writeFile } from "node:fs/promises";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { crc32 } from "node:zlib";
 import http from "node:http";
 //#region node_modules/.pnpm/@deepseek-ai+dsh-scope@0.1._0271d3a82adfe807020938592f267574/node_modules/@deepseek-ai/dsh-scope/lib/index.js
 /**
@@ -5693,6 +5695,18 @@ function watermarkProfile(config, provider, model) {
 //#region lib/types/shared.js
 /** Browser route used by the generated-image card. */
 const IMAGE_ROUTE = "/plugins/dsh-image-gen/image";
+/** Decode a GET query value; the caller supplies the reference parser. */
+function decodeImageRef(value, parse) {
+	try {
+		const base64 = value.replace(/-/g, "+").replace(/_/g, "/");
+		const padded = base64 + "=".repeat((4 - base64.length % 4) % 4);
+		const binary = atob(padded);
+		const bytes = Uint8Array.from(binary, (character) => character.charCodeAt(0));
+		return parse(JSON.parse(new TextDecoder().decode(bytes)));
+	} catch {
+		return;
+	}
+}
 /** Browser route that uploads user-picked images as DSH attachments. */
 const IMPORT_ROUTE = "/plugins/dsh-image-gen/import";
 /** Browser route used for deleting generated images and workspace files. */
@@ -5703,6 +5717,17 @@ const STUDIO_ROUTE = "/plugins/dsh-image-gen/studio";
 const INSPIRATION_ROUTE = "/plugins/dsh-image-gen/inspiration";
 /** Browser route used for saving generated images to workspace on demand. */
 const SAVE_WORKSPACE_ROUTE = "/plugins/dsh-image-gen/save-workspace";
+/** Browser route that streams a ZIP export of the selected gallery images. */
+const ZIP_ROUTE = "/plugins/dsh-image-gen/zip";
+/** Browser route that serves host-rendered gallery thumbnails. */
+const THUMB_ROUTE = "/plugins/dsh-image-gen/thumb";
+const PREVIEW_ROUTE = "/plugins/dsh-image-gen/preview";
+const VAULT_ROUTE = "/plugins/dsh-image-gen/vault";
+const VAULT_REFS_ROUTE = "/plugins/dsh-image-gen/vault-refs";
+const VAULT_DELETE_ROUTE = "/plugins/dsh-image-gen/vault-delete";
+const ZIP_PROGRESS_ROUTE = "/plugins/dsh-image-gen/zip/progress";
+const ZIP_CANCEL_ROUTE = "/plugins/dsh-image-gen/zip/cancel";
+const STORAGE_STATS_ROUTE = "/plugins/dsh-image-gen/storage-stats";
 /** Browser route the settings card probes provider connectivity through. */
 const TEST_CONNECTION_ROUTE = "/plugins/dsh-image-gen/test";
 /** Non-secret settings capability probe, available even when the host cannot serve a form. */
@@ -6109,7 +6134,13 @@ const Config = z.object({
 	comfyuiTimeoutMs: volatile(z.number().min(1e3).max(36e5).default(DEFAULT_COMFYUI_TIMEOUT_MS)),
 	saveToWorkspace: volatile(z.boolean().default(true)),
 	workspaceFolder: volatile(z.string().default(DEFAULT_WORKSPACE_FOLDER)),
-	showProviderPill: volatile(z.boolean().default(false))
+	showProviderPill: volatile(z.boolean().default(false)),
+	requestCachePrune: volatile(z.boolean().default(true)),
+	requestCacheTtlDays: volatile(z.number().min(1).max(365).default(14)),
+	requestCacheMaxBytes: volatile(z.number().min(0).default(268435456)),
+	requestCacheDir: volatile(z.string().default("")),
+	vaultEnabled: volatile(z.boolean().default(true)),
+	vaultDir: volatile(z.string().default(""))
 });
 /** Resolve exactly one provider profile for a tool call. */
 function resolveProvider(config) {
@@ -6775,24 +6806,24 @@ const MAX_NODE_COUNT = 1e5;
 const MAX_SELECTION_COUNT = 1e3;
 /** Serve one canvas-state push. */
 async function serveCanvasState(req, res, deps) {
-	if (req.method !== "POST") return jsonError$6(res, 405, "method-not-allowed");
-	if (!(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json")) return jsonError$6(res, 415, "json-required");
+	if (req.method !== "POST") return jsonError$11(res, 405, "method-not-allowed");
+	if (!(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json")) return jsonError$11(res, 415, "json-required");
 	const origin = req.headers.origin;
 	const host = req.headers.host;
-	if (origin !== void 0 && host !== void 0 && origin !== `http://${host}` && origin !== `https://${host}`) return jsonError$6(res, 403, "origin-rejected");
+	if (origin !== void 0 && host !== void 0 && origin !== `http://${host}` && origin !== `https://${host}`) return jsonError$11(res, 403, "origin-rejected");
 	let body;
 	try {
-		body = JSON.parse(await readBody$5(req, deps.maxBodyBytes));
+		body = JSON.parse(await readBody$8(req, deps.maxBodyBytes));
 	} catch (error) {
-		return jsonError$6(res, error instanceof Error && error.message === "request-too-large" ? 413 : 400, "invalid-request");
+		return jsonError$11(res, error instanceof Error && error.message === "request-too-large" ? 413 : 400, "invalid-request");
 	}
 	const push = parseCanvasStatePush(body);
-	if (push === void 0) return jsonError$6(res, 400, "invalid-canvas-state");
+	if (push === void 0) return jsonError$11(res, 400, "invalid-canvas-state");
 	let selectionImage;
 	if (push.selectionImage !== void 0) {
 		const decoded = decodeSelectionImage(push.selectionImage);
-		if (decoded === void 0) return jsonError$6(res, 400, "invalid-selection-image");
-		if (decoded.data.byteLength > deps.maxImageBytes) return jsonError$6(res, 413, "selection-image-too-large");
+		if (decoded === void 0) return jsonError$11(res, 400, "invalid-selection-image");
+		if (decoded.data.byteLength > deps.maxImageBytes) return jsonError$11(res, 413, "selection-image-too-large");
 		selectionImage = decoded;
 	}
 	deps.mirror.apply(push, selectionImage);
@@ -6960,7 +6991,7 @@ function optionalDimension(value) {
 function nonNegativeInteger(value) {
 	return typeof value === "number" && Number.isInteger(value) && value >= 0;
 }
-async function readBody$5(req, maxBytes) {
+async function readBody$8(req, maxBytes) {
 	const chunks = [];
 	let bytes = 0;
 	for await (const chunk of req) {
@@ -6971,7 +7002,7 @@ async function readBody$5(req, maxBytes) {
 	}
 	return Buffer.concat(chunks).toString("utf8");
 }
-function jsonError$6(res, status, code) {
+function jsonError$11(res, status, code) {
 	res.writeHead(status, {
 		"content-type": "application/json",
 		"cache-control": "no-store"
@@ -7921,7 +7952,7 @@ async function readBoundedText$2(response, maxBytes, label) {
 //#region lib/types/workspace-save.js
 /** Persist one generated image as a file under the session workspace. */
 /** File extension for each supported image media type. */
-const EXTENSION = {
+const EXTENSION$1 = {
 	"image/png": "png",
 	"image/jpeg": "jpg",
 	"image/webp": "webp",
@@ -7938,7 +7969,7 @@ const EXTENSION = {
 * @returns the file name (no directory).
 */
 function workspaceImageName(attachmentId, mediaType) {
-	return `image-${(attachmentId.startsWith("sha256:") ? attachmentId.slice(7) : attachmentId).slice(0, 8).padEnd(8, "0")}.${EXTENSION[mediaType]}`;
+	return `image-${(attachmentId.startsWith("sha256:") ? attachmentId.slice(7) : attachmentId).slice(0, 8).padEnd(8, "0")}.${EXTENSION$1[mediaType]}`;
 }
 /**
 * Resolve the configured image folder inside the session workspace. The
@@ -8146,19 +8177,20 @@ async function deleteImageFromWorkspace(filePath, allowedWorkspaceRoots) {
 const MAX_BODY_BYTES$2 = 65536;
 /** Serve one verified durable image reference to a same-origin browser request. */
 async function serveImage(req, res, deps) {
-	if (req.method !== "POST") return jsonError$5(res, 405, "method-not-allowed");
-	if (!(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json")) return jsonError$5(res, 415, "json-required");
+	if (req.method === "GET") return serveCachedImage(req, res, deps);
+	if (req.method !== "POST") return jsonError$10(res, 405, "method-not-allowed");
+	if (!(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json")) return jsonError$10(res, 415, "json-required");
 	const origin = req.headers.origin;
 	const host = req.headers.host;
-	if (origin !== void 0 && host !== void 0 && origin !== `http://${host}` && origin !== `https://${host}`) return jsonError$5(res, 403, "origin-rejected");
+	if (origin !== void 0 && host !== void 0 && origin !== `http://${host}` && origin !== `https://${host}`) return jsonError$10(res, 403, "origin-rejected");
 	let body;
 	try {
-		body = JSON.parse(await readBody$4(req));
+		body = JSON.parse(await readBody$7(req));
 	} catch {
-		return jsonError$5(res, 400, "invalid-request");
+		return jsonError$10(res, 400, "invalid-request");
 	}
 	const attachment = attachmentFromRequest(body);
-	if (attachment === void 0) return jsonError$5(res, 400, "invalid-attachment");
+	if (attachment === void 0) return jsonError$10(res, 400, "invalid-attachment");
 	try {
 		const stored = await deps.readImage(attachment);
 		res.writeHead(200, {
@@ -8169,10 +8201,44 @@ async function serveImage(req, res, deps) {
 		});
 		res.end(stored.data);
 	} catch {
-		jsonError$5(res, 404, "image-unavailable");
+		jsonError$10(res, 404, "image-unavailable");
 	}
 }
-function sameOrigin$4(req) {
+/**
+* Cacheable GET form: attachments are content-addressed, so the response can be
+* marked immutable and revalidated with a stable ETag. Preview, copy and
+* download then hit the browser cache instead of re-reading the host.
+*/
+async function serveCachedImage(req, res, deps) {
+	if (!sameOrigin$8(req)) return jsonError$10(res, 403, "origin-rejected");
+	const raw = new URL(req.url ?? "/", "http://x").searchParams.get("ref");
+	const attachment = raw === null ? void 0 : decodeImageRef(raw, parseImageAttachmentRef);
+	if (attachment === void 0) return jsonError$10(res, 400, "invalid-attachment");
+	const etag = "\"" + String(attachment.attachmentId) + "\"";
+	const cacheHeaders = {
+		"cache-control": "private, max-age=31536000, immutable",
+		etag
+	};
+	const ifNoneMatch = req.headers["if-none-match"];
+	if (typeof ifNoneMatch === "string" && ifNoneMatch.split(",").some((value) => value.trim() === etag)) {
+		res.writeHead(304, cacheHeaders);
+		res.end();
+		return;
+	}
+	try {
+		const stored = await deps.readImage(attachment);
+		res.writeHead(200, {
+			"content-type": stored.ref.mediaType,
+			"content-length": String(stored.data.byteLength),
+			"x-content-type-options": "nosniff",
+			...cacheHeaders
+		});
+		res.end(stored.data);
+	} catch {
+		jsonError$10(res, 404, "image-unavailable");
+	}
+}
+function sameOrigin$8(req) {
 	const origin = req.headers.origin;
 	const host = req.headers.host;
 	if (origin !== void 0 && host !== void 0 && origin !== `http://${host}` && origin !== `https://${host}`) return false;
@@ -8180,14 +8246,14 @@ function sameOrigin$4(req) {
 }
 /** Safely delete one or more generated image files from the workspace disk. */
 async function serveDelete(req, res, deps) {
-	if (req.method !== "POST") return jsonError$5(res, 405, "method-not-allowed");
-	if (!(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json")) return jsonError$5(res, 415, "json-required");
-	if (!sameOrigin$4(req)) return jsonError$5(res, 403, "origin-rejected");
+	if (req.method !== "POST") return jsonError$10(res, 405, "method-not-allowed");
+	if (!(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json")) return jsonError$10(res, 415, "json-required");
+	if (!sameOrigin$8(req)) return jsonError$10(res, 403, "origin-rejected");
 	let body;
 	try {
-		body = JSON.parse(await readBody$4(req));
+		body = JSON.parse(await readBody$7(req));
 	} catch {
-		return jsonError$5(res, 400, "invalid-request");
+		return jsonError$10(res, 400, "invalid-request");
 	}
 	const rawPaths = typeof body === "object" && body !== null && "paths" in body && Array.isArray(body.paths) ? body.paths : [];
 	const deletedFiles = [];
@@ -8217,13 +8283,13 @@ async function serveDelete(req, res, deps) {
 }
 /** Serve on-demand image persistence into the workspace. */
 async function serveSaveWorkspace(req, res, deps) {
-	if (!sameOrigin$4(req)) return jsonError$5(res, 403, "origin-rejected");
-	if (req.method !== "POST") return jsonError$5(res, 405, "method-not-allowed");
-	if (!(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json")) return jsonError$5(res, 415, "json-required");
+	if (!sameOrigin$8(req)) return jsonError$10(res, 403, "origin-rejected");
+	if (req.method !== "POST") return jsonError$10(res, 405, "method-not-allowed");
+	if (!(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json")) return jsonError$10(res, 415, "json-required");
 	try {
-		const raw = JSON.parse(await readBody$4(req));
+		const raw = JSON.parse(await readBody$7(req));
 		const attachment = parseImageAttachmentRef(raw.attachment);
-		if (!attachment) return jsonError$5(res, 400, "invalid-attachment");
+		if (!attachment) return jsonError$10(res, 400, "invalid-attachment");
 		if (!deps.isSaveEnabled()) {
 			res.writeHead(200, {
 				"content-type": "application/json",
@@ -8241,10 +8307,10 @@ async function serveSaveWorkspace(req, res, deps) {
 		try {
 			targetRoot = await assertWorkspaceAllowed(rawTarget, allowedRoots);
 		} catch {
-			return jsonError$5(res, 403, "workspace-root-not-allowed");
+			return jsonError$10(res, 403, "workspace-root-not-allowed");
 		}
 		const stored = await deps.readImage(attachment);
-		if (!stored || !stored.data) return jsonError$5(res, 404, "image-not-found");
+		if (!stored || !stored.data) return jsonError$10(res, 404, "image-not-found");
 		const savedTo = await deps.saveToWorkspace({
 			workspaceRoot: targetRoot,
 			attachmentId: String(attachment.attachmentId),
@@ -8276,119 +8342,1807 @@ function imageAttachmentFromMeta(meta) {
 	if (value?.kind !== "dsh-image-gen") return void 0;
 	return parseImageAttachmentRef(value.attachment);
 }
-function attachmentFromRequest(value) {
-	return parseImageAttachmentRef(record$4(value)?.attachment);
+function attachmentFromRequest(value) {
+	return parseImageAttachmentRef(record$4(value)?.attachment);
+}
+function record$4(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+}
+async function readBody$7(req) {
+	const chunks = [];
+	let bytes = 0;
+	for await (const chunk of req) {
+		const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+		bytes += buffer.byteLength;
+		if (bytes > MAX_BODY_BYTES$2) throw new Error("request too large");
+		chunks.push(buffer);
+	}
+	return Buffer.concat(chunks).toString("utf8");
+}
+function jsonError$10(res, status, code) {
+	res.writeHead(status, {
+		"content-type": "application/json",
+		"cache-control": "no-store"
+	});
+	res.end(JSON.stringify({ error: code }));
+}
+//#endregion
+//#region lib/types/multipart.js
+var MultipartError = class extends Error {
+	status;
+	code;
+	constructor(status, code) {
+		super(code);
+		this.status = status;
+		this.code = code;
+		this.name = "MultipartError";
+	}
+};
+const CRLF = Buffer.from("\r\n");
+const DASH = Buffer.from("--");
+const HEADER_LIMIT = 16384;
+/**
+* Parse a multipart body incrementally. Only one part is buffered at a time,
+* so an 8 x 40 MiB upload never holds the whole request in memory.
+*/
+async function readMultipart(req, boundary, options) {
+	if (boundary.length === 0 || boundary.length > 200) throw new MultipartError(400, "invalid-boundary");
+	const first = Buffer.from("--" + boundary);
+	const delimiter = Buffer.from("\r\n--" + boundary);
+	let buffer = Buffer.alloc(0);
+	let state = "preamble";
+	let part;
+	const append = (chunk) => {
+		if (part === void 0 || chunk.length === 0) return;
+		part.bytes += chunk.length;
+		if (part.tooLarge) return;
+		if (part.bytes > options.maxPartBytes) {
+			part.tooLarge = true;
+			part.chunks = [];
+			return;
+		}
+		part.chunks.push(Buffer.from(chunk));
+	};
+	const finishPart = async () => {
+		if (part === void 0) return;
+		const completed = part;
+		part = void 0;
+		if (completed.name !== "images") return;
+		await options.onPart({
+			name: completed.name,
+			...completed.filename === void 0 ? {} : { filename: completed.filename },
+			...completed.mediaType === void 0 ? {} : { mediaType: completed.mediaType },
+			data: completed.tooLarge ? Buffer.alloc(0) : Buffer.concat(completed.chunks, completed.bytes),
+			tooLarge: completed.tooLarge,
+			bytes: completed.bytes
+		});
+	};
+	const consume = async () => {
+		while (true) {
+			if (state === "done") {
+				buffer = Buffer.alloc(0);
+				return;
+			}
+			if (state === "preamble") {
+				const index = buffer.indexOf(first);
+				if (index === -1) {
+					if (buffer.length > first.length + 4) buffer = buffer.subarray(buffer.length - (first.length + 4));
+					return;
+				}
+				if (buffer.length < index + first.length + 2) return;
+				const suffix = buffer.subarray(index + first.length, index + first.length + 2);
+				if (suffix.equals(DASH)) {
+					state = "done";
+					buffer = Buffer.alloc(0);
+					return;
+				}
+				if (!suffix.equals(CRLF)) throw new MultipartError(400, "invalid-multipart");
+				buffer = buffer.subarray(index + first.length + 2);
+				state = "headers";
+				continue;
+			}
+			if (state === "headers") {
+				const end = buffer.indexOf("\r\n\r\n");
+				if (end === -1) {
+					if (buffer.length > HEADER_LIMIT) throw new MultipartError(400, "invalid-headers");
+					return;
+				}
+				const headerBuffer = buffer.subarray(0, end);
+				buffer = buffer.subarray(end + 4);
+				const headers = parsePartHeaders(headerBuffer);
+				if (headers.name.length === 0) throw new MultipartError(400, "invalid-headers");
+				part = {
+					name: headers.name,
+					...headers.filename === void 0 ? {} : { filename: headers.filename },
+					...headers.mediaType === void 0 ? {} : { mediaType: headers.mediaType },
+					chunks: [],
+					bytes: 0,
+					tooLarge: false
+				};
+				state = "body";
+				continue;
+			}
+			if (state === "body") {
+				const found = findDelimiter(buffer, delimiter);
+				if (found === -1) {
+					const keep = delimiter.length + 2;
+					if (buffer.length > keep) {
+						append(buffer.subarray(0, buffer.length - keep));
+						buffer = buffer.subarray(buffer.length - keep);
+					}
+					return;
+				}
+				append(buffer.subarray(0, found));
+				buffer = buffer.subarray(found + delimiter.length);
+				const suffix = buffer.subarray(0, 2);
+				buffer = buffer.subarray(2);
+				await finishPart();
+				if (suffix.equals(DASH)) {
+					state = "done";
+					buffer = Buffer.alloc(0);
+					return;
+				}
+				if (!suffix.equals(CRLF)) throw new MultipartError(400, "invalid-multipart");
+				state = "headers";
+				continue;
+			}
+		}
+	};
+	for await (const chunk of req) {
+		if (state === "done") continue;
+		const incoming = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+		buffer = buffer.length === 0 ? incoming : Buffer.concat([buffer, incoming]);
+		await consume();
+	}
+	await consume();
+	if (state !== "done") throw new MultipartError(400, "truncated-multipart");
+}
+/** Locate a delimiter whose following two bytes are CRLF or a closing dash. */
+function findDelimiter(buffer, delimiter) {
+	let from = 0;
+	while (true) {
+		const index = buffer.indexOf(delimiter, from);
+		if (index === -1) return -1;
+		if (buffer.length < index + delimiter.length + 2) return -1;
+		const suffix = buffer.subarray(index + delimiter.length, index + delimiter.length + 2);
+		if (suffix.equals(CRLF) || suffix.equals(DASH)) return index;
+		from = index + 1;
+	}
+}
+function parsePartHeaders(raw) {
+	let name = "";
+	let filename;
+	let mediaType;
+	for (const line of raw.toString("utf8").split("\r\n")) {
+		const colon = line.indexOf(":");
+		if (colon === -1) continue;
+		const key = line.slice(0, colon).trim().toLowerCase();
+		const value = line.slice(colon + 1).trim();
+		if (key === "content-disposition") {
+			name = dispositionParam(value, "name") ?? "";
+			filename = dispositionParam(value, "filename");
+		} else if (key === "content-type") mediaType = value.split(";")[0]?.trim() || void 0;
+	}
+	return {
+		name,
+		...filename === void 0 ? {} : { filename },
+		...mediaType === void 0 ? {} : { mediaType }
+	};
+}
+function dispositionParam(value, key) {
+	const params = [];
+	let start = 0;
+	let quoted = false;
+	let escaped = false;
+	for (let index = 0; index < value.length; index += 1) {
+		const char = value[index];
+		if (escaped) {
+			escaped = false;
+			continue;
+		}
+		if (quoted && char === "\\") {
+			escaped = true;
+			continue;
+		}
+		if (char === "\"") {
+			quoted = !quoted;
+			continue;
+		}
+		if (char === ";" && !quoted) {
+			params.push(value.slice(start, index));
+			start = index + 1;
+		}
+	}
+	params.push(value.slice(start));
+	for (const param of params) {
+		const equals = param.indexOf("=");
+		if (equals <= 0 || param.slice(0, equals).trim().toLowerCase() !== key.toLowerCase()) continue;
+		const raw = param.slice(equals + 1).trim();
+		if (raw.length >= 2 && raw.startsWith("\"") && raw.endsWith("\"")) return raw.slice(1, -1).replace(/\\(.)/g, "$1");
+		return raw;
+	}
+}
+//#endregion
+//#region lib/types/import-route.js
+const MAX_IMAGES_PER_REQUEST = 8;
+const BASE64_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+const BASE64_LOOKUP = (() => {
+	const table = /* @__PURE__ */ new Uint8Array(128);
+	for (let index = 0; index < 64; index++) table[BASE64_ALPHABET.charCodeAt(index)] = 1;
+	return table;
+})();
+/**
+* Validate base64 in linear time. A backtracking regexp looks harmless but V8
+* throws RangeError ("Maximum call stack size exceeded") once the input passes
+* a few megabytes, which turned every large import into a bare HTTP 400.
+*/
+function isValidBase64(value) {
+	if (value.length % 4 !== 0) return false;
+	const padding = value.endsWith("==") ? 2 : value.endsWith("=") ? 1 : 0;
+	const end = value.length - padding;
+	for (let index = 0; index < end; index++) {
+		const code = value.charCodeAt(index);
+		if (code > 127 || BASE64_LOOKUP[code] !== 1) return false;
+	}
+	return true;
+}
+/** base64 inflates bytes by 4/3; allow one full batch plus JSON overhead. */
+function bodyLimit(maxImageBytes) {
+	return MAX_IMAGES_PER_REQUEST * Math.ceil(maxImageBytes * 1.4) + 4096;
+}
+async function serveImport(req, res, deps) {
+	if (req.method !== "POST") return jsonError$9(res, 405, "method-not-allowed");
+	const origin = req.headers.origin;
+	const host = req.headers.host;
+	if (origin !== void 0 && host !== void 0 && origin !== `http://${host}` && origin !== `https://${host}`) return jsonError$9(res, 403, "origin-rejected");
+	const contentType = req.headers["content-type"] ?? "";
+	const boundary = multipartBoundary(contentType);
+	if (boundary !== void 0) return serveMultipartImport(req, res, deps, boundary);
+	if (!contentType.toLowerCase().startsWith("application/json")) return jsonError$9(res, 415, "json-required");
+	let body;
+	try {
+		body = JSON.parse(await readBody$6(req, bodyLimit(deps.maxImageBytes)));
+	} catch {
+		return jsonError$9(res, 400, "invalid-request");
+	}
+	const images = typeof body === "object" && body !== null ? body.images : void 0;
+	if (!Array.isArray(images) || images.length === 0 || images.length > MAX_IMAGES_PER_REQUEST) return jsonError$9(res, 400, "invalid-image-count");
+	const saved = [];
+	const failures = [];
+	for (const [index, item] of images.entries()) try {
+		const record = typeof item === "object" && item !== null ? item : void 0;
+		if (record === void 0 || typeof record.data !== "string" || typeof record.mediaType !== "string") {
+			failures.push({
+				index,
+				error: "invalid-item"
+			});
+			continue;
+		}
+		if (!deps.mediaTypes.includes(record.mediaType)) {
+			failures.push({
+				index,
+				error: `unsupported-media-type: ${record.mediaType}`
+			});
+			continue;
+		}
+		if (!isValidBase64(record.data)) {
+			failures.push({
+				index,
+				error: "invalid-base64"
+			});
+			continue;
+		}
+		const bytes = Buffer.from(record.data, "base64");
+		if (bytes.byteLength === 0 || bytes.byteLength > deps.maxImageBytes) {
+			failures.push({
+				index,
+				error: `size-out-of-range (max ${String(deps.maxImageBytes)} bytes)`
+			});
+			continue;
+		}
+		try {
+			const persisted = await persistImport(deps, bytes, record.mediaType, record.name);
+			saved.push(persisted);
+			try {
+				deps.warmThumbnail?.(persisted.attachment);
+			} catch {}
+		} catch {
+			failures.push({
+				index,
+				error: "save-failed"
+			});
+		}
+	} catch {
+		failures.push({
+			index,
+			error: "internal-error"
+		});
+	}
+	res.writeHead(200, {
+		"content-type": "application/json",
+		"cache-control": "no-store"
+	});
+	res.end(JSON.stringify({
+		images: saved,
+		failures
+	}));
+}
+async function serveMultipartImport(req, res, deps, boundary) {
+	const saved = [];
+	const failures = [];
+	let tempDir;
+	try {
+		tempDir = await mkdtemp(join(tmpdir(), "dsh-image-import-"));
+		const spooled = [];
+		let index = 0;
+		await readMultipart(req, boundary, {
+			maxPartBytes: deps.maxImageBytes,
+			onPart: async (part) => {
+				const current = index++;
+				if (current >= MAX_IMAGES_PER_REQUEST) {
+					failures.push({
+						index: current,
+						error: "invalid-image-count"
+					});
+					return;
+				}
+				if (part.tooLarge || part.bytes === 0 || part.bytes > deps.maxImageBytes) {
+					failures.push({
+						index: current,
+						error: "size-out-of-range (max " + String(deps.maxImageBytes) + " bytes)"
+					});
+					return;
+				}
+				const declared = part.mediaType !== void 0 && deps.mediaTypes.includes(part.mediaType) ? part.mediaType : mediaTypeFromFilename(part.filename);
+				if (declared === void 0 || !deps.mediaTypes.includes(declared)) {
+					failures.push({
+						index: current,
+						error: "unsupported-media-type: " + (declared ?? "unknown")
+					});
+					return;
+				}
+				const path = join(tempDir, String(current) + ".part");
+				await writeFile(path, part.data);
+				spooled.push({
+					index: current,
+					path,
+					mediaType: declared,
+					...part.filename === void 0 ? {} : { filename: part.filename },
+					bytes: part.bytes
+				});
+			}
+		});
+		for (const part of spooled) try {
+			const persisted = await persistImport(deps, await readFile(part.path), part.mediaType, part.filename);
+			saved.push(persisted);
+			try {
+				deps.warmThumbnail?.(persisted.attachment);
+			} catch {}
+		} catch {
+			failures.push({
+				index: part.index,
+				error: "save-failed"
+			});
+		}
+	} catch (err) {
+		if (err instanceof MultipartError) return jsonError$9(res, err.status, err.code);
+		return jsonError$9(res, 400, "invalid-request");
+	} finally {
+		if (tempDir !== void 0) await rm(tempDir, {
+			recursive: true,
+			force: true
+		}).catch(() => void 0);
+	}
+	if (saved.length === 0 && failures.length === 0) return jsonError$9(res, 400, "invalid-image-count");
+	failures.sort((a, b) => a.index - b.index);
+	res.writeHead(200, {
+		"content-type": "application/json",
+		"cache-control": "no-store"
+	});
+	res.end(JSON.stringify({
+		images: saved,
+		failures
+	}));
+}
+/** Save one image and, when the attachment layer normalized it, keep the raw copy. */
+async function persistImport(deps, bytes, mediaType, name) {
+	const attachment = await deps.saveImage({
+		data: bytes,
+		mediaType,
+		...typeof name === "string" && name.length > 0 ? { name } : {}
+	});
+	let original;
+	if (deps.saveOriginal !== void 0 && (attachment.mediaType !== mediaType || attachment.bytes !== bytes.byteLength)) original = await deps.saveOriginal({
+		data: bytes,
+		mediaType
+	});
+	return {
+		attachment,
+		...original === void 0 ? {} : { original }
+	};
+}
+function multipartBoundary(contentType) {
+	if (!contentType.toLowerCase().startsWith("multipart/form-data")) return void 0;
+	const match = /boundary=(?:"([^"]+)"|([^;]+))/i.exec(contentType);
+	const value = (match?.[1] ?? match?.[2] ?? "").trim();
+	return value.length > 0 ? value : void 0;
+}
+const FILENAME_MEDIA_TYPES = {
+	png: "image/png",
+	jpg: "image/jpeg",
+	jpeg: "image/jpeg",
+	webp: "image/webp",
+	gif: "image/gif"
+};
+function mediaTypeFromFilename(name) {
+	if (name === void 0) return void 0;
+	const dot = name.lastIndexOf(".");
+	if (dot === -1) return void 0;
+	return FILENAME_MEDIA_TYPES[name.slice(dot + 1).toLowerCase()];
+}
+async function readBody$6(req, maxBytes) {
+	const chunks = [];
+	let bytes = 0;
+	for await (const chunk of req) {
+		const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+		bytes += buffer.byteLength;
+		if (bytes > maxBytes) throw new Error("request-too-large");
+		chunks.push(buffer);
+	}
+	return Buffer.concat(chunks).toString("utf8");
+}
+function jsonError$9(res, status, code) {
+	res.writeHead(status, {
+		"content-type": "application/json",
+		"cache-control": "no-store"
+	});
+	res.end(JSON.stringify({ error: code }));
+}
+//#endregion
+//#region lib/types/zip-stream.js
+const LOCAL_HEADER_BYTES = 30;
+const CENTRAL_HEADER_BYTES = 46;
+const END_OF_CENTRAL_BYTES = 22;
+const ZIP64_END_BYTES = 56;
+const ZIP64_LOCATOR_BYTES = 20;
+const ZIP64_EXTRA_ID = 1;
+const ZIP64_VERSION = 45;
+const ZIP32_VERSION = 20;
+const UINT32_MAX = 4294967295;
+const UINT16_MAX = 65535;
+const MAX_ENTRIES = 4294967294;
+/** Raised when the selection cannot be represented even with ZIP64 records. */
+var ZipTooLargeError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "ZipTooLargeError";
+	}
+};
+/**
+* Write a ZIP archive straight to an HTTP response.
+*
+* Images are already compressed, so entries are stored (method 0) and the only
+* CPU work is the CRC — `zlib.crc32` runs in native code. Sizes are known before
+* each header is written, so no data descriptor is needed; entries that cross
+* the ZIP32 limits get ZIP64 extra fields, and the archive ends with a ZIP64
+* end-of-central-directory record when any entry needs one.
+*/
+var ZipStreamWriter = class {
+	res;
+	options;
+	central = [];
+	names = /* @__PURE__ */ new Set();
+	offset = 0;
+	entries = 0;
+	closed = false;
+	zip64Archive = false;
+	constructor(res, options = {}) {
+		this.res = res;
+		this.options = options;
+	}
+	get entryCount() {
+		return this.entries;
+	}
+	get bytesWritten() {
+		return this.offset;
+	}
+	get isClosed() {
+		return this.closed;
+	}
+	/** Stop writing as soon as the browser closes the download. */
+	markClientClosed() {
+		this.closed = true;
+	}
+	/** Append one file entry. */
+	async add(name, data) {
+		if (this.entries >= MAX_ENTRIES) throw new ZipTooLargeError("ZIP export exceeds the entry limit");
+		const safeName = this.uniqueName(name);
+		const nameBytes = Buffer.from(safeName, "utf8");
+		const size = data.byteLength;
+		const checksum = crc32(data);
+		const { time, date } = dosDateTime();
+		const headerOffset = this.offset;
+		const zip64 = this.options.zip64 ?? "auto";
+		const size64 = zip64 === "always" || size >= UINT32_MAX;
+		const offset64 = zip64 === "always" || headerOffset >= UINT32_MAX;
+		if (size64 || offset64) this.zip64Archive = true;
+		const localExtra = size64 ? zip64Extra([size, size]) : Buffer.alloc(0);
+		const version = size64 ? ZIP64_VERSION : ZIP32_VERSION;
+		const local = Buffer.alloc(LOCAL_HEADER_BYTES);
+		local.writeUInt32LE(67324752, 0);
+		local.writeUInt16LE(version, 4);
+		local.writeUInt16LE(2048, 6);
+		local.writeUInt16LE(0, 8);
+		local.writeUInt16LE(time, 10);
+		local.writeUInt16LE(date, 12);
+		local.writeUInt32LE(checksum, 14);
+		local.writeUInt32LE(size64 ? UINT32_MAX : size, 18);
+		local.writeUInt32LE(size64 ? UINT32_MAX : size, 22);
+		local.writeUInt16LE(nameBytes.length, 26);
+		local.writeUInt16LE(localExtra.length, 28);
+		await this.write(local);
+		await this.write(nameBytes);
+		if (localExtra.length > 0) await this.write(localExtra);
+		await this.write(data);
+		this.central.push(this.centralRecord({
+			nameBytes,
+			checksum,
+			size,
+			headerOffset,
+			size64,
+			offset64,
+			time,
+			date
+		}));
+		this.entries += 1;
+	}
+	/** Write the central directory and finish the response. */
+	async finish() {
+		const centralOffset = this.offset;
+		let centralSize = 0;
+		for (const record of this.central) centralSize += record.byteLength;
+		const zip64 = this.zip64Archive || this.entries > UINT16_MAX || centralOffset >= UINT32_MAX || centralSize >= UINT32_MAX;
+		if (zip64) this.zip64Archive = true;
+		for (const record of this.central) await this.write(record);
+		if (zip64) {
+			const zip64Offset = this.offset;
+			const end64 = Buffer.alloc(ZIP64_END_BYTES);
+			end64.writeUInt32LE(101075792, 0);
+			end64.writeBigUInt64LE(44n, 4);
+			end64.writeUInt16LE(ZIP64_VERSION, 12);
+			end64.writeUInt16LE(ZIP64_VERSION, 14);
+			end64.writeUInt32LE(0, 16);
+			end64.writeUInt32LE(0, 20);
+			end64.writeBigUInt64LE(BigInt(this.entries), 24);
+			end64.writeBigUInt64LE(BigInt(this.entries), 32);
+			end64.writeBigUInt64LE(BigInt(centralSize), 40);
+			end64.writeBigUInt64LE(BigInt(centralOffset), 48);
+			await this.write(end64);
+			const locator = Buffer.alloc(ZIP64_LOCATOR_BYTES);
+			locator.writeUInt32LE(117853008, 0);
+			locator.writeUInt32LE(0, 4);
+			locator.writeBigUInt64LE(BigInt(zip64Offset), 8);
+			locator.writeUInt32LE(1, 16);
+			await this.write(locator);
+		}
+		const end = Buffer.alloc(END_OF_CENTRAL_BYTES);
+		end.writeUInt32LE(101010256, 0);
+		end.writeUInt16LE(0, 4);
+		end.writeUInt16LE(0, 6);
+		end.writeUInt16LE(zip64 ? UINT16_MAX : this.entries, 8);
+		end.writeUInt16LE(zip64 ? UINT16_MAX : this.entries, 10);
+		end.writeUInt32LE(zip64 ? UINT32_MAX : centralSize, 12);
+		end.writeUInt32LE(zip64 ? UINT32_MAX : centralOffset, 16);
+		end.writeUInt16LE(0, 20);
+		await this.write(end);
+		this.res.end();
+	}
+	centralRecord(entry) {
+		const extraValues = [...entry.size64 ? [entry.size, entry.size] : [], ...entry.offset64 ? [entry.headerOffset] : []];
+		const extra = extraValues.length > 0 ? zip64Extra(extraValues) : Buffer.alloc(0);
+		const central = Buffer.alloc(CENTRAL_HEADER_BYTES);
+		central.writeUInt32LE(33639248, 0);
+		central.writeUInt16LE(entry.size64 || entry.offset64 ? ZIP64_VERSION : ZIP32_VERSION, 4);
+		central.writeUInt16LE(entry.size64 || entry.offset64 ? ZIP64_VERSION : ZIP32_VERSION, 6);
+		central.writeUInt16LE(2048, 8);
+		central.writeUInt16LE(0, 10);
+		central.writeUInt16LE(entry.time, 12);
+		central.writeUInt16LE(entry.date, 14);
+		central.writeUInt32LE(entry.checksum, 16);
+		central.writeUInt32LE(entry.size64 ? UINT32_MAX : entry.size, 20);
+		central.writeUInt32LE(entry.size64 ? UINT32_MAX : entry.size, 24);
+		central.writeUInt16LE(entry.nameBytes.length, 28);
+		central.writeUInt16LE(extra.length, 30);
+		central.writeUInt16LE(0, 32);
+		central.writeUInt16LE(0, 34);
+		central.writeUInt16LE(0, 36);
+		central.writeUInt32LE(0, 38);
+		central.writeUInt32LE(entry.offset64 ? UINT32_MAX : entry.headerOffset, 42);
+		return Buffer.concat([
+			central,
+			entry.nameBytes,
+			extra
+		]);
+	}
+	async write(chunk) {
+		if (this.closed) throw new Error("client closed the download");
+		if (this.offset + chunk.byteLength > (this.options.maxBytes ?? Number.POSITIVE_INFINITY)) throw new ZipTooLargeError("ZIP export exceeds the archive byte limit");
+		this.offset += chunk.byteLength;
+		if (this.res.write(chunk)) return;
+		await new Promise((resolve, reject) => {
+			const cleanup = () => {
+				this.res.off("drain", onDrain);
+				this.res.off("close", onClose);
+			};
+			const onDrain = () => {
+				cleanup();
+				resolve();
+			};
+			const onClose = () => {
+				cleanup();
+				reject(/* @__PURE__ */ new Error("client closed the download"));
+			};
+			this.res.once("drain", onDrain);
+			this.res.once("close", onClose);
+		});
+	}
+	uniqueName(raw) {
+		const cleaned = sanitizeName(raw);
+		if (!this.names.has(cleaned)) {
+			this.names.add(cleaned);
+			return cleaned;
+		}
+		const dot = cleaned.lastIndexOf(".");
+		const stem = dot > 0 ? cleaned.slice(0, dot) : cleaned;
+		const extension = dot > 0 ? cleaned.slice(dot) : "";
+		let suffix = 1;
+		let candidate = cleaned;
+		while (this.names.has(candidate)) {
+			candidate = stem + "-" + suffix + extension;
+			suffix += 1;
+		}
+		this.names.add(candidate);
+		return candidate;
+	}
+};
+/** Encode a ZIP64 extra field: id, size, then one or more 8-byte values. */
+function zip64Extra(values) {
+	const body = Buffer.alloc(values.length * 8);
+	values.forEach((value, index) => body.writeBigUInt64LE(BigInt(value), index * 8));
+	const extra = Buffer.alloc(4 + body.length);
+	extra.writeUInt16LE(ZIP64_EXTRA_ID, 0);
+	extra.writeUInt16LE(body.length, 2);
+	body.copy(extra, 4);
+	return extra;
+}
+/** Keep download names portable: no paths, no control characters, bounded length. */
+function sanitizeName(raw) {
+	const cleaned = (raw.split(/[\\/]/).pop() ?? "image").replace(/[^A-Za-z0-9._@-]+/g, "_").replace(/^[._]+/, "").slice(0, 120);
+	return cleaned.length > 0 ? cleaned : "image";
+}
+function dosDateTime(when = /* @__PURE__ */ new Date()) {
+	return {
+		time: when.getHours() << 11 | when.getMinutes() << 5 | Math.floor(when.getSeconds() / 2),
+		date: (Math.max(when.getFullYear() - 1980, 0) << 9 | when.getMonth() + 1 << 5 | when.getDate()) & 65535
+	};
+}
+//#endregion
+//#region lib/types/zip-progress.js
+const jobs = /* @__PURE__ */ new Map();
+const TOKEN_PATTERN = /^[A-Za-z0-9_-]{8,64}$/;
+const JOB_TTL_MS = 6e5;
+/** Tokens are client-generated identifiers; anything else is ignored. */
+function isValidZipToken(token) {
+	return TOKEN_PATTERN.test(token);
+}
+function notify(job) {
+	job.updatedAt = Date.now();
+	for (const listener of [...job.listeners]) listener();
+}
+function prune() {
+	const cutoff = Date.now() - JOB_TTL_MS;
+	for (const [token, job] of jobs) if (job.updatedAt < cutoff) jobs.delete(token);
+}
+function ensureJob(token) {
+	if (!isValidZipToken(token)) return void 0;
+	let job = jobs.get(token);
+	if (job === void 0) {
+		prune();
+		job = {
+			token,
+			total: 0,
+			done: 0,
+			state: "running",
+			cancelled: false,
+			listeners: /* @__PURE__ */ new Set(),
+			updatedAt: Date.now()
+		};
+		jobs.set(token, job);
+	}
+	return job;
+}
+/** The SSE listener may connect first; createZipJob then fills in the total. */
+function createZipJob(token, total) {
+	const job = ensureJob(token);
+	if (job === void 0) return;
+	job.total = total;
+	job.done = 0;
+	job.state = "running";
+	notify(job);
+}
+function updateZipJob(token, done) {
+	const job = jobs.get(token);
+	if (job === void 0 || job.state !== "running") return;
+	job.done = Math.max(job.done, done);
+	notify(job);
+}
+function finishZipJob(token, state) {
+	const job = jobs.get(token);
+	if (job === void 0 || job.state !== "running") return;
+	job.state = state;
+	if (state === "done") job.done = job.total;
+	notify(job);
+	for (const listener of [...job.listeners]) job.listeners.delete(listener);
+}
+function isZipJobCancelled(token) {
+	return jobs.get(token)?.cancelled === true;
+}
+function cancelZipJob(token) {
+	const job = jobs.get(token);
+	if (job === void 0) return false;
+	if (job.state !== "running") return false;
+	job.cancelled = true;
+	notify(job);
+	return true;
+}
+/**
+* Server-sent events for one export: the client keeps the fast iframe download
+* and still sees "N/M" progress plus completion.
+*/
+function serveZipProgress(req, res) {
+	if (req.method !== "GET") return jsonError$8(res, 405, "method-not-allowed");
+	const job = ensureJob(new URL(req.url ?? "/", "http://x").searchParams.get("token") ?? "");
+	if (job === void 0) return jsonError$8(res, 404, "unknown-job");
+	res.writeHead(200, {
+		"content-type": "text/event-stream; charset=utf-8",
+		"cache-control": "no-store",
+		connection: "keep-alive",
+		"x-accel-buffering": "no"
+	});
+	const send = () => {
+		if (res.writableEnded) return;
+		res.write("event: progress\ndata: " + JSON.stringify({
+			done: job.done,
+			total: job.total,
+			state: job.state
+		}) + "\n\n");
+		if (job.state !== "running") {
+			job.listeners.delete(send);
+			res.end();
+		}
+	};
+	send();
+	if (job.state === "running") {
+		job.listeners.add(send);
+		const heartbeat = setInterval(() => {
+			if (!res.writableEnded) res.write(": ping\n\n");
+		}, 15e3);
+		heartbeat.unref?.();
+		res.on("close", () => {
+			clearInterval(heartbeat);
+			job.listeners.delete(send);
+		});
+	}
+}
+/** Stop an in-flight export; the ZIP response is destroyed so the download fails. */
+function serveZipCancel(req, res) {
+	if (req.method !== "POST") return jsonError$8(res, 405, "method-not-allowed");
+	const ok = cancelZipJob(new URL(req.url ?? "/", "http://x").searchParams.get("token") ?? "");
+	res.writeHead(200, {
+		"content-type": "application/json; charset=utf-8",
+		"cache-control": "no-store"
+	});
+	res.end(JSON.stringify({ ok }));
+}
+function jsonError$8(res, status, code) {
+	res.writeHead(status, {
+		"content-type": "application/json; charset=utf-8",
+		"cache-control": "no-store"
+	});
+	res.end(JSON.stringify({ error: code }));
+}
+//#endregion
+//#region lib/types/vault-store.js
+/** Content-addressed store for original image bytes the attachment layer normalized. */
+const VAULT_KEY_PATTERN = /^[a-f0-9]{64}$/;
+const EXTENSION = {
+	"image/png": "png",
+	"image/jpeg": "jpg",
+	"image/webp": "webp",
+	"image/gif": "gif"
+};
+const MEDIA_TYPE = {
+	png: "image/png",
+	jpg: "image/jpeg",
+	webp: "image/webp",
+	gif: "image/gif"
+};
+function resolveDshHome$1(home) {
+	return home?.trim() || process.env.DSH_HOME?.trim() || join(homedir(), ".dsh");
+}
+function resolveVaultDir(home) {
+	return join(resolveDshHome$1(home), "image-gen", "vault");
+}
+/** Resolve a configured vault path; relative values stay below the DSH home, not the process cwd. */
+function resolveVaultPath(configured, home) {
+	const value = configured.trim();
+	if (value.length === 0) return resolveVaultDir(home);
+	return isAbsolute(value) ? value : join(resolveDshHome$1(home), value);
+}
+function isValidVaultKey(key) {
+	return VAULT_KEY_PATTERN.test(key);
+}
+/** Persist one original file; the same bytes are shared through content addressing. */
+async function saveOriginal(config, input) {
+	if (!config.enabled) return void 0;
+	const extension = EXTENSION[input.mediaType];
+	if (extension === void 0) return void 0;
+	const key = createHash("sha256").update(input.data).digest("hex");
+	const target = join(config.dir, key.slice(0, 2), key + "." + extension);
+	try {
+		const existing = await stat(target);
+		if (existing.size === input.data.byteLength) return {
+			key,
+			bytes: existing.size,
+			mediaType: input.mediaType
+		};
+	} catch {}
+	await mkdir(dirname(target), { recursive: true });
+	const temporary = target + ".tmp-" + randomUUID();
+	try {
+		await writeFile(temporary, input.data);
+		await rename(temporary, target);
+	} catch (err) {
+		await unlink(temporary).catch(() => void 0);
+		throw err;
+	}
+	return {
+		key,
+		bytes: input.data.byteLength,
+		mediaType: input.mediaType
+	};
+}
+async function readOriginal(config, key, preferredMediaType) {
+	if (!config.enabled || !isValidVaultKey(key)) return void 0;
+	const preferred = preferredMediaType === void 0 ? void 0 : EXTENSION[preferredMediaType];
+	const all = Object.entries(MEDIA_TYPE);
+	const candidates = preferred === void 0 ? all : [[preferred, preferredMediaType], ...all.filter(([extension]) => extension !== preferred)];
+	for (const [extension, mediaType] of candidates) try {
+		return {
+			data: await readFile(join(config.dir, key.slice(0, 2), key + "." + extension)),
+			mediaType
+		};
+	} catch {}
+}
+async function listVaultKeys(config) {
+	return (await listVaultFiles(config)).map((file) => file.key);
+}
+async function deleteVaultKeys(config, keys) {
+	if (!config.enabled) return {
+		removed: 0,
+		bytes: 0
+	};
+	const targets = /* @__PURE__ */ new Set();
+	for (const key of keys) if (isValidVaultKey(key)) targets.add(key);
+	if (targets.size === 0) return {
+		removed: 0,
+		bytes: 0
+	};
+	const files = await listVaultFiles(config);
+	let removed = 0;
+	let bytes = 0;
+	for (const file of files) {
+		if (!targets.has(file.key)) continue;
+		try {
+			await unlink(file.path);
+			removed += 1;
+			bytes += file.bytes;
+		} catch {}
+	}
+	await removeEmptyShards(config);
+	return {
+		removed,
+		bytes
+	};
+}
+async function removeEmptyShards(config) {
+	try {
+		for (const shard of await readdir(config.dir, { withFileTypes: true })) {
+			if (!shard.isDirectory() || !/^[a-f0-9]{2}$/.test(shard.name)) continue;
+			try {
+				await rmdir(join(config.dir, shard.name));
+			} catch {}
+		}
+	} catch {}
+}
+async function listVaultFiles(config) {
+	const files = [];
+	try {
+		for (const shard of await readdir(config.dir, { withFileTypes: true })) {
+			if (!shard.isDirectory() || !/^[a-f0-9]{2}$/.test(shard.name)) continue;
+			for (const entry of await readdir(join(config.dir, shard.name), { withFileTypes: true })) {
+				if (!entry.isFile()) continue;
+				const dot = entry.name.lastIndexOf(".");
+				const key = dot > 0 ? entry.name.slice(0, dot) : entry.name;
+				if (!isValidVaultKey(key)) continue;
+				const path = join(config.dir, shard.name, entry.name);
+				try {
+					const info = await stat(path);
+					files.push({
+						path,
+						key,
+						bytes: info.size,
+						mtimeMs: info.mtimeMs
+					});
+				} catch {}
+			}
+		}
+	} catch {
+		return [];
+	}
+	return files;
+}
+/** Delete only the explicitly requested originals; callers must prove they are unreferenced. */
+//#endregion
+//#region lib/types/zip-route.js
+const DEFAULT_MAX_ENTRIES = 2e3;
+const DEFAULT_MAX_BODY_BYTES = 4194304;
+/** Sanity ceiling: ZIP64 removed the 4 GiB cap, not an accidental 2000 × 40 GiB. */
+const MAX_ARCHIVE_BYTES = 68719476736;
+const IMAGE_EXTENSIONS = {
+	"image/png": "png",
+	"image/jpeg": "jpg",
+	"image/webp": "webp",
+	"image/gif": "gif"
+};
+/**
+* Package selected gallery images into one ZIP and stream it to the browser.
+*
+* The request is a plain form post (`items` = JSON array of {name, attachment}),
+* so the renderer never builds the archive: the browser download manager owns
+* the transfer while this route reads attachments one at a time.
+*/
+async function serveZip(req, res, deps) {
+	if (req.method !== "POST") return jsonError$7(res, 405, "method-not-allowed");
+	if (!(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/x-www-form-urlencoded")) return jsonError$7(res, 415, "form-required");
+	if (!sameOrigin$7(req)) return jsonError$7(res, 403, "origin-rejected");
+	const queryToken = new URL(req.url ?? "/", "http://x").searchParams.get("token") ?? "";
+	let jobToken = isValidZipToken(queryToken) ? queryToken : "";
+	const fail = (status, code) => {
+		if (jobToken !== "") {
+			createZipJob(jobToken, 0);
+			finishZipJob(jobToken, "error");
+		}
+		jsonError$7(res, status, code);
+	};
+	let body;
+	try {
+		body = await readBody$5(req, deps.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES);
+	} catch {
+		return fail(413, "request-too-large");
+	}
+	const params = new URLSearchParams(body);
+	const tokenParam = params.get("token") ?? "";
+	if (jobToken === "" && isValidZipToken(tokenParam)) jobToken = tokenParam;
+	const rawItems = params.get("items");
+	if (rawItems === null) return fail(400, "invalid-request");
+	let parsed;
+	try {
+		parsed = JSON.parse(rawItems);
+	} catch {
+		return fail(400, "invalid-request");
+	}
+	if (!Array.isArray(parsed)) return fail(400, "invalid-request");
+	const items = [];
+	for (const entry of parsed) {
+		const record = typeof entry === "object" && entry !== null && !Array.isArray(entry) ? entry : void 0;
+		const attachment = parseImageAttachmentRef(record?.attachment);
+		if (attachment === void 0) continue;
+		items.push({
+			attachment,
+			...typeof record?.name === "string" ? { name: record.name } : {},
+			...typeof record?.originalKey === "string" && isValidVaultKey(record.originalKey) ? { originalKey: record.originalKey } : {},
+			...typeof record?.originalMediaType === "string" ? { originalMediaType: record.originalMediaType } : {}
+		});
+	}
+	if (items.length === 0) return fail(400, "no-attachments");
+	const maxEntries = deps.maxEntries ?? DEFAULT_MAX_ENTRIES;
+	if (items.length > maxEntries) return fail(413, "too-many-attachments");
+	let declaredBytes = 0;
+	for (const item of items) declaredBytes += item.attachment.bytes;
+	const maxArchiveBytes = deps.maxArchiveBytes ?? MAX_ARCHIVE_BYTES;
+	if (declaredBytes > maxArchiveBytes) return fail(413, "archive-too-large");
+	if (jobToken !== "") createZipJob(jobToken, items.length);
+	const filename = "dsh-gallery-" + (/* @__PURE__ */ new Date()).toISOString().slice(0, 10).replace(/-/g, "") + ".zip";
+	res.writeHead(200, {
+		"content-type": "application/zip",
+		"content-disposition": "attachment; filename=\"" + filename + "\"",
+		"cache-control": "no-store",
+		"x-content-type-options": "nosniff"
+	});
+	const zip = new ZipStreamWriter(res, { maxBytes: maxArchiveBytes });
+	const skipped = [];
+	const onClose = () => {
+		if (res.writableFinished) return;
+		zip.markClientClosed();
+		if (jobToken !== "") finishZipJob(jobToken, "cancelled");
+	};
+	res.on("close", onClose);
+	const stopped = () => {
+		if (zip.isClosed) return true;
+		if (jobToken !== "" && isZipJobCancelled(jobToken)) {
+			finishZipJob(jobToken, "cancelled");
+			res.destroy();
+			return true;
+		}
+		return false;
+	};
+	try {
+		for (let index = 0; index < items.length; index += 1) {
+			if (stopped()) return;
+			const item = items[index];
+			let original;
+			if (item.originalKey !== void 0 && deps.readVault !== void 0) {
+				try {
+					original = await deps.readVault(item.originalKey, item.originalMediaType);
+				} catch {
+					original = void 0;
+				}
+				if (stopped()) return;
+			}
+			const mediaType = original?.mediaType ?? item.attachment.mediaType;
+			const extension = IMAGE_EXTENSIONS[mediaType] ?? "png";
+			const fallback = "dsh-" + String(item.attachment.attachmentId).replace(/^sha256:/, "").slice(0, 8) + "." + extension;
+			const entryName = item.name === void 0 ? fallback : original === void 0 ? replaceExtension(item.name, extension) : item.name;
+			try {
+				if (original !== void 0) await zip.add(entryName, Buffer.from(original.data));
+				else {
+					const stored = await deps.readImage(item.attachment);
+					if (stopped()) return;
+					await zip.add(entryName, Buffer.from(stored.data));
+				}
+			} catch (err) {
+				if (isClosed(zip, err)) return;
+				if (err instanceof ZipTooLargeError) throw err;
+				skipped.push(String(item.attachment.attachmentId) + "	" + (err instanceof Error ? err.message : "unavailable"));
+			}
+			if (jobToken !== "") updateZipJob(jobToken, index + 1);
+		}
+		if (skipped.length > 0) {
+			if (stopped()) return;
+			await zip.add("skipped.txt", Buffer.from(skipped.join("\n") + "\n", "utf8"));
+		}
+		if (stopped()) return;
+		await zip.finish();
+		await waitForResponseFinish(res);
+		if (jobToken !== "") finishZipJob(jobToken, "done");
+	} catch (err) {
+		if (isClosed(zip, err)) return;
+		if (jobToken !== "") finishZipJob(jobToken, "error");
+		if (!res.headersSent) {
+			jsonError$7(res, err instanceof ZipTooLargeError ? 413 : 500, err instanceof ZipTooLargeError ? "archive-too-large" : "zip-failed");
+			return;
+		}
+		res.destroy(err instanceof Error ? err : void 0);
+	} finally {
+		res.off("close", onClose);
+	}
+}
+function waitForResponseFinish(res) {
+	if (res.writableFinished) return Promise.resolve();
+	if (res.destroyed) return Promise.reject(/* @__PURE__ */ new Error("client closed the download"));
+	return new Promise((resolve, reject) => {
+		const cleanup = () => {
+			res.off("finish", onFinish);
+			res.off("close", onClose);
+		};
+		const onFinish = () => {
+			cleanup();
+			resolve();
+		};
+		const onClose = () => {
+			cleanup();
+			reject(/* @__PURE__ */ new Error("client closed the download"));
+		};
+		res.once("finish", onFinish);
+		res.once("close", onClose);
+	});
+}
+function replaceExtension(name, extension) {
+	const slash = Math.max(name.lastIndexOf("/"), name.lastIndexOf("\\"));
+	const dot = name.lastIndexOf(".");
+	return dot <= slash ? name + "." + extension : name.slice(0, dot) + "." + extension;
+}
+function isClosed(zip, err) {
+	return zip.isClosed || err instanceof Error && err.message === "client closed the download";
+}
+function sameOrigin$7(req) {
+	const origin = req.headers.origin;
+	const host = req.headers.host;
+	if (origin !== void 0 && host !== void 0 && origin !== "http://" + host && origin !== "https://" + host) return false;
+	return true;
+}
+async function readBody$5(req, limit) {
+	const chunks = [];
+	let bytes = 0;
+	for await (const chunk of req) {
+		const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+		bytes += buffer.byteLength;
+		if (bytes > limit) throw new Error("request too large");
+		chunks.push(buffer);
+	}
+	return Buffer.concat(chunks).toString("utf8");
+}
+function jsonError$7(res, status, code) {
+	res.writeHead(status, {
+		"content-type": "application/json; charset=utf-8",
+		"cache-control": "no-store"
+	});
+	res.end(JSON.stringify({ error: code }));
+}
+/** The cache layout is <dir>/<2 hex>/<variant hash>; two levels are enough. */
+const MAX_DEPTH = 2;
+/** Resolve the default cache root below DSH_HOME. */
+function resolveRequestImageCacheDir(home) {
+	const root = home?.trim() || process.env.DSH_HOME?.trim() || join(homedir(), ".dsh");
+	return join(root, "cache", "attachments", "request-images");
+}
+/** Durable attachment objects; never a pruning target, even via a broad override. */
+function durableAttachmentsRoot() {
+	return join(process.env.DSH_HOME?.trim() || join(homedir(), ".dsh"), "attachments");
+}
+function comparable(path) {
+	const resolved = resolve(path);
+	return process.platform === "win32" ? resolved.toLowerCase() : resolved;
+}
+function isWithin(path, root) {
+	return path === root || path.startsWith(root + sep);
+}
+/** Resolve through junctions/symlinks, falling back to the nearest existing ancestor. */
+async function canonicalPath(path) {
+	let probe = resolve(path);
+	const suffix = [];
+	while (true) try {
+		const real = await realpath(probe);
+		return comparable(join(real, ...suffix.reverse()));
+	} catch {
+		const parent = dirname(probe);
+		if (parent === probe) return comparable(resolve(path));
+		suffix.push(basename(probe));
+		probe = parent;
+	}
+}
+async function overlapsProtectedRoot(target, roots) {
+	for (const root of roots) {
+		const protectedRoot = await canonicalPath(root);
+		if (target === protectedRoot || isWithin(target, protectedRoot) || isWithin(protectedRoot, target)) return true;
+	}
+	return false;
+}
+/**
+* Remove stale request-image variants.
+*
+* The attachment backend writes one file per (attachment, target) variant and
+* never cleans them up itself, so a gallery full of 320 px thumbnails grows it
+* without bound. Deletion is safe: variants are deterministic and regenerated
+* on demand, so removing an entry only costs one sharp pass next time.
+*/
+async function pruneRequestImageCache(options) {
+	const ttlMs = options.ttlMs ?? 12096e5;
+	const maxBytes = options.maxBytes ?? 268435456;
+	const keepMs = options.keepMs ?? 36e5;
+	const now = options.now ?? Date.now();
+	const protectedRoots = options.protectedRoots ?? [durableAttachmentsRoot()];
+	const cacheRoot = await canonicalPath(options.dir);
+	if (await overlapsProtectedRoot(cacheRoot, protectedRoots)) return {
+		scanned: 0,
+		removed: 0,
+		freedBytes: 0,
+		remainingBytes: 0
+	};
+	const files = [];
+	await collect(options.dir, 0, files, cacheRoot);
+	let remainingBytes = files.reduce((sum, file) => sum + file.bytes, 0);
+	const protectedAfter = now - keepMs;
+	const expiredBefore = now - ttlMs;
+	const doomed = /* @__PURE__ */ new Set();
+	for (const file of files) if (file.mtimeMs < expiredBefore && file.mtimeMs < protectedAfter) {
+		doomed.add(file.path);
+		remainingBytes -= file.bytes;
+	}
+	if (maxBytes > 0 && remainingBytes > maxBytes) {
+		const candidates = files.filter((file) => !doomed.has(file.path) && file.mtimeMs < protectedAfter).sort((a, b) => a.mtimeMs - b.mtimeMs);
+		for (const file of candidates) {
+			if (remainingBytes <= maxBytes) break;
+			doomed.add(file.path);
+			remainingBytes -= file.bytes;
+		}
+	}
+	let removed = 0;
+	let freedBytes = 0;
+	for (const file of files) {
+		if (!doomed.has(file.path)) continue;
+		try {
+			const latest = await lstat(file.path);
+			if (latest.isSymbolicLink() || !latest.isFile() || !isWithin(await canonicalPath(file.path), cacheRoot)) {
+				remainingBytes += file.bytes;
+				continue;
+			}
+			await unlink(file.path);
+			removed += 1;
+			freedBytes += file.bytes;
+		} catch {
+			remainingBytes += file.bytes;
+		}
+	}
+	return {
+		scanned: files.length,
+		removed,
+		freedBytes,
+		remainingBytes
+	};
+}
+async function collect(dir, depth, out, cacheRoot) {
+	let entries;
+	try {
+		entries = await readdir(dir, { withFileTypes: true });
+	} catch {
+		return;
+	}
+	for (const entry of entries) {
+		const path = join(dir, entry.name);
+		let info;
+		try {
+			info = await lstat(path);
+		} catch {
+			continue;
+		}
+		if (info.isSymbolicLink()) continue;
+		if (info.isDirectory()) {
+			if (depth >= MAX_DEPTH) continue;
+			if (!isWithin(await canonicalPath(path), cacheRoot)) continue;
+			await collect(path, depth + 1, out, cacheRoot);
+			continue;
+		}
+		if (!info.isFile()) continue;
+		if (!isWithin(await canonicalPath(path), cacheRoot)) continue;
+		try {
+			const latest = await stat(path);
+			out.push({
+				path,
+				bytes: latest.size,
+				mtimeMs: latest.mtimeMs
+			});
+		} catch {}
+	}
+}
+function resolveDshHome() {
+	return process.env.DSH_HOME?.trim() || join(homedir(), ".dsh");
+}
+function resolveAttachmentsRoot(home = resolveDshHome()) {
+	return join(home, "attachments", "v1", "objects");
+}
+async function scanTree(root) {
+	try {
+		const entries = await readdir(root, {
+			recursive: true,
+			withFileTypes: true
+		});
+		const files = [];
+		let bytes = 0;
+		for (const entry of entries) {
+			if (!entry.isFile()) continue;
+			const parent = entry.parentPath ?? root;
+			try {
+				const info = await stat(join(parent, entry.name));
+				bytes += info.size;
+				files.push({
+					name: entry.name,
+					bytes: info.size
+				});
+			} catch {}
+		}
+		return {
+			count: files.length,
+			bytes,
+			files
+		};
+	} catch {
+		return {
+			count: 0,
+			bytes: 0,
+			files: []
+		};
+	}
+}
+let baseCache = null;
+async function collectStorageStats(attachmentIds, options = {}) {
+	const now = options.now ?? Date.now();
+	const ttl = options.ttlMs ?? 6e5;
+	const injected = options.attachmentsRoot !== void 0;
+	const attachmentsRoot = options.attachmentsRoot ?? resolveAttachmentsRoot();
+	const requestImagesRoot = options.requestImagesRoot ?? resolveRequestImageCacheDir(resolveDshHome());
+	if (!injected && baseCache !== null && baseCache.requestImagesRoot === requestImagesRoot && now - baseCache.at < ttl) return buildStats(baseCache.attachments, baseCache.requestImages, attachmentIds, now);
+	const [attachments, requestImages] = await Promise.all([scanTree(attachmentsRoot), scanTree(requestImagesRoot)]);
+	if (!injected) baseCache = {
+		at: now,
+		attachments,
+		requestImages,
+		requestImagesRoot
+	};
+	return buildStats(attachments, requestImages, attachmentIds, now);
+}
+function buildStats(attachments, requestImages, attachmentIds, now) {
+	const refs = /* @__PURE__ */ new Set();
+	for (const id of attachmentIds) {
+		const value = String(id);
+		refs.add(value);
+		refs.add(value.replace(/^sha256:/, ""));
+	}
+	const orphans = attachments.files.filter((file) => !refs.has(file.name) && !refs.has("sha256:" + file.name)).map((file) => ({
+		id: "sha256:" + file.name,
+		bytes: file.bytes
+	}));
+	return {
+		attachments: {
+			count: attachments.count,
+			bytes: attachments.bytes
+		},
+		requestImages: {
+			count: requestImages.count,
+			bytes: requestImages.bytes
+		},
+		orphans: {
+			count: orphans.length,
+			bytes: orphans.reduce((sum, entry) => sum + entry.bytes, 0),
+			ids: orphans.map((entry) => entry.id)
+		},
+		scannedAt: now
+	};
+}
+/** POST {attachmentIds: string[]} -> read-only usage numbers. */
+async function serveStorageStats(req, res, deps = {}) {
+	if (req.method !== "POST") return jsonError$6(res, 405, "method-not-allowed");
+	if (!sameOrigin$6(req)) return jsonError$6(res, 403, "origin-rejected");
+	let body;
+	try {
+		body = await readBody$4(req, 2097152);
+	} catch {
+		return jsonError$6(res, 413, "request-too-large");
+	}
+	let parsed;
+	try {
+		parsed = JSON.parse(body);
+	} catch {
+		return jsonError$6(res, 400, "invalid-request");
+	}
+	const ids = parsed?.attachmentIds;
+	if (!Array.isArray(ids)) return jsonError$6(res, 400, "invalid-request");
+	const stats = await collectStorageStats(ids.filter((id) => typeof id === "string"), deps.requestImagesRoot === void 0 ? {} : { requestImagesRoot: deps.requestImagesRoot });
+	res.writeHead(200, {
+		"content-type": "application/json; charset=utf-8",
+		"cache-control": "no-store"
+	});
+	res.end(JSON.stringify(stats));
 }
-function record$4(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+function sameOrigin$6(req) {
+	const origin = req.headers.origin;
+	const host = req.headers.host;
+	if (origin !== void 0 && host !== void 0 && origin !== "http://" + host && origin !== "https://" + host) return false;
+	return true;
 }
-async function readBody$4(req) {
+async function readBody$4(req, limit) {
 	const chunks = [];
 	let bytes = 0;
 	for await (const chunk of req) {
 		const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
 		bytes += buffer.byteLength;
-		if (bytes > MAX_BODY_BYTES$2) throw new Error("request too large");
+		if (bytes > limit) throw new Error("request too large");
 		chunks.push(buffer);
 	}
 	return Buffer.concat(chunks).toString("utf8");
 }
-function jsonError$5(res, status, code) {
+function jsonError$6(res, status, code) {
 	res.writeHead(status, {
-		"content-type": "application/json",
+		"content-type": "application/json; charset=utf-8",
 		"cache-control": "no-store"
 	});
 	res.end(JSON.stringify({ error: code }));
 }
 //#endregion
-//#region lib/types/import-route.js
-const MAX_IMAGES_PER_REQUEST = 8;
-const BASE64_PATTERN = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
-/** base64 inflates bytes by 4/3; allow one full batch plus JSON overhead. */
-function bodyLimit(maxImageBytes) {
-	return MAX_IMAGES_PER_REQUEST * Math.ceil(maxImageBytes * 1.4) + 4096;
+//#region lib/types/vault-registry.js
+/** Persistent per-profile vault references so one client cannot delete another client's originals. */
+const REGISTRY_FILE = ".refs.json";
+const PROFILE_PATTERN = /^[A-Za-z0-9_-]{8,128}$/;
+function isValidVaultProfileId(value) {
+	return typeof value === "string" && PROFILE_PATTERN.test(value);
 }
-async function serveImport(req, res, deps) {
-	if (req.method !== "POST") return jsonError$4(res, 405, "method-not-allowed");
-	if (!(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json")) return jsonError$4(res, 415, "json-required");
-	const origin = req.headers.origin;
-	const host = req.headers.host;
-	if (origin !== void 0 && host !== void 0 && origin !== `http://${host}` && origin !== `https://${host}`) return jsonError$4(res, 403, "origin-rejected");
+function registryPath(dir) {
+	return join(dir, REGISTRY_FILE);
+}
+function normalizeRegistry(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+	const raw = value;
+	if (raw.version !== 1 || typeof raw.profiles !== "object" || raw.profiles === null || Array.isArray(raw.profiles)) return void 0;
+	const profiles = Object.create(null);
+	for (const [profileId, profile] of Object.entries(raw.profiles)) {
+		if (!isValidVaultProfileId(profileId) || typeof profile !== "object" || profile === null || Array.isArray(profile)) return void 0;
+		const { keys, updatedAt } = profile;
+		if (!Array.isArray(keys) || !keys.every((key) => typeof key === "string" && isValidVaultKey(key))) return void 0;
+		if (typeof updatedAt !== "number" || !Number.isFinite(updatedAt) || updatedAt < 0) return void 0;
+		profiles[profileId] = {
+			keys: Array.from(new Set(keys)),
+			updatedAt
+		};
+	}
+	return {
+		version: 1,
+		profiles
+	};
+}
+async function loadVaultRegistry(dir) {
+	try {
+		const registry = normalizeRegistry(JSON.parse(await readFile(registryPath(dir), "utf8")));
+		return registry === void 0 ? { status: "corrupt" } : {
+			status: "ok",
+			registry
+		};
+	} catch (err) {
+		if (err.code === "ENOENT") return { status: "missing" };
+		return { status: "corrupt" };
+	}
+}
+const queues = /* @__PURE__ */ new Map();
+/** Canonicalize existing ancestors too, so aliases share a lock before creation. */
+async function vaultTransactionKey(dir) {
+	let parent = resolve(dir);
+	const suffix = [];
+	while (true) try {
+		const canonical = join(await realpath(parent), ...suffix);
+		return process.platform === "win32" ? canonical.toLowerCase() : canonical;
+	} catch (error) {
+		if (error.code !== "ENOENT" || dirname(parent) === parent) throw error;
+		suffix.unshift(basename(parent));
+		parent = dirname(parent);
+	}
+}
+/** Serialize reference mutations and deletion together within this host. */
+async function inVaultTransaction(dir, run) {
+	const key = await vaultTransactionKey(dir);
+	const operation = (queues.get(key) ?? Promise.resolve()).then(run);
+	const tail = operation.then(() => void 0, () => void 0);
+	queues.set(key, tail);
+	tail.then(() => {
+		if (queues.get(key) === tail) queues.delete(key);
+	});
+	return operation;
+}
+/** Persist a complete profile only after all newly claimed originals exist. */
+async function writeVaultProfile(dir, profileId, keys, loaded) {
+	if (loaded.status === "corrupt" || !isValidVaultProfileId(profileId) || profileId === "legacy-vault" || !keys.every(isValidVaultKey)) return void 0;
+	const registry = loaded.registry ?? {
+		version: 1,
+		profiles: {}
+	};
+	const accepted = Array.from(new Set(keys));
+	const previous = new Set(registry.profiles[profileId]?.keys ?? []);
+	let existing;
+	if (loaded.status === "missing" || accepted.some((key) => !previous.has(key))) {
+		existing = await listVaultKeys({
+			enabled: true,
+			dir
+		});
+		const available = new Set(existing);
+		if (accepted.some((key) => !available.has(key))) return void 0;
+	}
+	if (loaded.status === "missing") {
+		const legacy = existing.filter((key) => !accepted.includes(key));
+		if (legacy.length > 0) registry.profiles["legacy-vault"] = {
+			keys: legacy,
+			updatedAt: 0
+		};
+	}
+	Object.defineProperty(registry.profiles, profileId, {
+		value: {
+			keys: accepted,
+			updatedAt: Date.now()
+		},
+		enumerable: true,
+		writable: true,
+		configurable: true
+	});
+	await persistRegistry(dir, registry);
+	return registry;
+}
+async function persistRegistry(dir, registry) {
+	await mkdir(dir, { recursive: true });
+	const target = registryPath(dir);
+	const temporary = target + ".tmp-" + randomUUID();
+	try {
+		await writeFile(temporary, JSON.stringify(registry, null, 2), "utf8");
+		await rename(temporary, target);
+	} finally {
+		await unlink(temporary).catch(() => void 0);
+	}
+}
+/** Store and claim an import in the same transaction used by explicit deletion. */
+function saveImportedOriginal(config, input, profileId) {
+	if (!config.enabled) return Promise.resolve(void 0);
+	return inVaultTransaction(config.dir, async () => {
+		if (profileId !== void 0 && (!isValidVaultProfileId(profileId) || profileId === "legacy-vault")) throw new Error("invalid-vault-profile");
+		const loaded = await loadVaultRegistry(config.dir);
+		if (loaded.status === "corrupt") throw new Error("registry-unavailable");
+		const registry = loaded.registry ?? {
+			version: 1,
+			profiles: {}
+		};
+		if (loaded.status === "missing") {
+			const legacy = await listVaultKeys(config);
+			if (legacy.length > 0) registry.profiles["legacy-vault"] = {
+				keys: legacy,
+				updatedAt: 0
+			};
+		}
+		const saved = await saveOriginal(config, input);
+		if (saved === void 0) return void 0;
+		const owner = profileId ?? "legacy-vault";
+		Object.defineProperty(registry.profiles, owner, {
+			value: {
+				keys: [.../* @__PURE__ */ new Set([...registry.profiles[owner]?.keys ?? [], saved.key])],
+				updatedAt: Date.now()
+			},
+			enumerable: true,
+			configurable: true,
+			writable: true
+		});
+		await persistRegistry(config.dir, registry);
+		return saved;
+	});
+}
+/**
+* Merge one profile's complete key set into the persistent registry.
+*
+* On first creation, pre-existing vault files that the syncing profile does
+* not already reference are placed in a reserved legacy profile, so a browser
+* that has not opened yet cannot lose an original. Once a profile syncs a
+* legacy key, the unknown legacy owners remain protected too.
+*/
+function updateVaultRegistry(dir, profileId, keys) {
+	return inVaultTransaction(dir, async () => {
+		const loaded = await loadVaultRegistry(dir);
+		return writeVaultProfile(dir, profileId, [...loaded.registry?.profiles[profileId]?.keys ?? [], ...keys], loaded);
+	}).catch(() => void 0);
+}
+/** Remove explicitly owned keys using the same transaction as reference sync. */
+function deleteUnreferencedOriginals(config, profileId, keys, deleteKeys) {
+	return inVaultTransaction(config.dir, async () => {
+		const loaded = await loadVaultRegistry(config.dir);
+		if (loaded.status !== "ok" || loaded.registry === void 0) return void 0;
+		const previouslyOwned = new Set(loaded.registry.profiles[profileId]?.keys ?? []);
+		const removedKeys = new Set(deleteKeys);
+		const remaining = [...previouslyOwned].filter((key) => !removedKeys.has(key));
+		const registry = await writeVaultProfile(config.dir, profileId, [...remaining, ...keys], loaded);
+		if (registry === void 0) return void 0;
+		const referenced = new Set(unionVaultKeys(registry));
+		return deleteVaultKeys(config, deleteKeys.filter((key) => previouslyOwned.has(key) && !referenced.has(key)));
+	}).catch(() => void 0);
+}
+function unionVaultKeys(registry) {
+	const keys = /* @__PURE__ */ new Set();
+	for (const profile of Object.values(registry.profiles)) for (const key of profile.keys) keys.add(key);
+	return Array.from(keys);
+}
+//#endregion
+//#region lib/types/vault-route.js
+async function serveVault(req, res, config) {
+	if (req.method !== "GET") return jsonError$5(res, 405, "method-not-allowed");
+	if (!sameOrigin$5(req)) return jsonError$5(res, 403, "origin-rejected");
+	const params = new URL(req.url ?? "/", "http://x").searchParams;
+	const key = params.get("key") ?? "";
+	if (!isValidVaultKey(key)) return jsonError$5(res, 400, "invalid-key");
+	const original = await readOriginal(config, key, params.get("mediaType") ?? void 0);
+	if (original === void 0) return jsonError$5(res, 404, "not-found");
+	const etag = "\"sha256:" + key + "\"";
+	const cacheControl = "private, max-age=31536000, immutable";
+	const noneMatch = req.headers["if-none-match"];
+	if (typeof noneMatch === "string" && noneMatch.split(",").some((value) => value.trim() === etag)) {
+		res.writeHead(304, {
+			"cache-control": cacheControl,
+			etag
+		});
+		res.end();
+		return;
+	}
+	res.writeHead(200, {
+		"content-type": original.mediaType,
+		"content-length": String(original.data.byteLength),
+		"cache-control": cacheControl,
+		etag,
+		"x-content-type-options": "nosniff"
+	});
+	res.end(original.data);
+}
+/** Sync one browser profile's references; never deletes originals. */
+async function serveVaultRefs(req, res, config) {
+	if (req.method !== "POST") return jsonError$5(res, 405, "method-not-allowed");
+	if (!sameOrigin$5(req)) return jsonError$5(res, 403, "origin-rejected");
+	const payload = await readJson(req, res);
+	if (payload === void 0) return;
+	const profileId = payload.profileId;
+	const keys = payload.keys;
+	if (!isValidVaultProfileId(profileId)) {
+		jsonOk(res, {
+			removed: 0,
+			bytes: 0
+		});
+		return;
+	}
+	if (!validKeys(keys) || profileId === "legacy-vault") return jsonError$5(res, 400, "invalid-request");
+	const registry = await updateVaultRegistry(config.dir, profileId, keys);
+	if (registry === void 0) return jsonError$5(res, 409, "registry-unavailable");
+	jsonOk(res, {
+		removed: 0,
+		bytes: 0,
+		profiles: Object.keys(registry.profiles).length
+	});
+}
+/** Explicit gallery deletion: remove only keys no profile still references. */
+async function serveVaultDelete(req, res, config) {
+	if (req.method !== "POST") return jsonError$5(res, 405, "method-not-allowed");
+	if (!sameOrigin$5(req)) return jsonError$5(res, 403, "origin-rejected");
+	const payload = await readJson(req, res);
+	if (payload === void 0) return;
+	const profileId = payload.profileId;
+	const keys = payload.keys;
+	const deleteKeys = payload.deleteKeys;
+	if (!isValidVaultProfileId(profileId) || profileId === "legacy-vault") return jsonError$5(res, 400, "invalid-profile");
+	if (!validKeys(keys) || !validKeys(deleteKeys) || payload.confirm !== true) return jsonError$5(res, 400, "invalid-request");
+	const stats = await deleteUnreferencedOriginals(config, profileId, keys, deleteKeys);
+	if (stats === void 0) return jsonError$5(res, 409, "registry-unavailable");
+	jsonOk(res, stats);
+}
+function validKeys(value) {
+	return Array.isArray(value) && value.every((key) => typeof key === "string" && isValidVaultKey(key));
+}
+async function readJson(req, res) {
 	let body;
 	try {
-		body = JSON.parse(await readBody$3(req, bodyLimit(deps.maxImageBytes)));
+		body = await readBody$3(req, 4194304);
 	} catch {
-		return jsonError$4(res, 400, "invalid-request");
+		jsonError$5(res, 413, "request-too-large");
+		return;
 	}
-	const images = typeof body === "object" && body !== null ? body.images : void 0;
-	if (!Array.isArray(images) || images.length === 0 || images.length > MAX_IMAGES_PER_REQUEST) return jsonError$4(res, 400, "invalid-image-count");
-	const saved = [];
-	const failures = [];
-	for (const [index, item] of images.entries()) {
-		const record = typeof item === "object" && item !== null ? item : void 0;
-		if (record === void 0 || typeof record.data !== "string" || typeof record.mediaType !== "string") {
-			failures.push({
-				index,
-				error: "invalid-item"
-			});
-			continue;
-		}
-		if (!deps.mediaTypes.includes(record.mediaType)) {
-			failures.push({
-				index,
-				error: `unsupported-media-type: ${record.mediaType}`
-			});
-			continue;
-		}
-		if (!BASE64_PATTERN.test(record.data)) {
-			failures.push({
-				index,
-				error: "invalid-base64"
-			});
-			continue;
-		}
-		const bytes = Buffer.from(record.data, "base64");
-		if (bytes.byteLength === 0 || bytes.byteLength > deps.maxImageBytes) {
-			failures.push({
-				index,
-				error: `size-out-of-range (max ${String(deps.maxImageBytes)} bytes)`
-			});
-			continue;
-		}
-		try {
-			const attachment = await deps.saveImage({
-				data: bytes,
-				mediaType: record.mediaType,
-				...typeof record.name === "string" && record.name.length > 0 ? { name: record.name } : {}
-			});
-			saved.push({ attachment });
-		} catch {
-			failures.push({
-				index,
-				error: "save-failed"
-			});
+	try {
+		const parsed = JSON.parse(body);
+		if (typeof parsed !== "object" || parsed === null) {
+			jsonError$5(res, 400, "invalid-request");
+			return;
 		}
+		return parsed;
+	} catch {
+		jsonError$5(res, 400, "invalid-request");
+		return;
 	}
+}
+function jsonOk(res, value) {
 	res.writeHead(200, {
-		"content-type": "application/json",
+		"content-type": "application/json; charset=utf-8",
 		"cache-control": "no-store"
 	});
-	res.end(JSON.stringify({
-		images: saved,
-		failures
-	}));
+	res.end(JSON.stringify(value));
+}
+function sameOrigin$5(req) {
+	const origin = req.headers.origin;
+	const host = req.headers.host;
+	if (origin !== void 0 && host !== void 0 && origin !== "http://" + host && origin !== "https://" + host) return false;
+	return true;
 }
-async function readBody$3(req, maxBytes) {
+async function readBody$3(req, limit) {
 	const chunks = [];
 	let bytes = 0;
 	for await (const chunk of req) {
 		const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
 		bytes += buffer.byteLength;
-		if (bytes > maxBytes) throw new Error("request-too-large");
+		if (bytes > limit) throw new Error("request too large");
 		chunks.push(buffer);
 	}
 	return Buffer.concat(chunks).toString("utf8");
 }
+function jsonError$5(res, status, code) {
+	res.writeHead(status, {
+		"content-type": "application/json; charset=utf-8",
+		"cache-control": "no-store"
+	});
+	res.end(JSON.stringify({ error: code }));
+}
+//#endregion
+//#region lib/types/thumb-route.js
+const THUMB = {
+	defaultWidth: 320,
+	minWidth: 64,
+	maxWidth: 1024,
+	/** Generous for a 320 px tile, so the quality ladder stays at its top rung. */
+	maxBytes: 98304,
+	unavailableCode: "thumbnail-unavailable"
+};
+/**
+* A 1600 px long edge keeps lightbox decoding small (a 33.5 MP original costs
+* roughly 130 MB as RGBA) while staying sharp on a desktop window.
+*/
+const PREVIEW = {
+	defaultWidth: 1600,
+	minWidth: 256,
+	maxWidth: 2048,
+	maxBytes: 524288,
+	unavailableCode: "preview-unavailable"
+};
+/**
+* Serve one downscaled, cached thumbnail.
+*
+* The attachment backend already derives deterministic request images (resize by
+* long edge + JPEG/WebP quality ladder) and caches them on disk, so the gallery
+* can render a tile without transferring the original to the renderer at all.
+*/
+async function serveThumb(req, res, deps) {
+	return serveVariant(req, res, deps, THUMB);
+}
+/** Serve the mid-size variant used by the lightbox preview. */
+async function servePreview(req, res, deps) {
+	return serveVariant(req, res, deps, PREVIEW);
+}
+async function serveVariant(req, res, deps, config) {
+	if (req.method !== "GET") return jsonError$4(res, 405, "method-not-allowed");
+	if (!sameOrigin$4(req)) return jsonError$4(res, 403, "origin-rejected");
+	const url = new URL(req.url ?? "/", "http://x");
+	const rawRef = url.searchParams.get("ref");
+	const attachment = rawRef === null ? void 0 : decodeImageRef(rawRef, parseImageAttachmentRef);
+	if (attachment === void 0) return jsonError$4(res, 400, "invalid-attachment");
+	const requested = Number(url.searchParams.get("w") ?? config.defaultWidth);
+	const width = Number.isFinite(requested) ? Math.min(config.maxWidth, Math.max(config.minWidth, Math.round(requested))) : config.defaultWidth;
+	try {
+		const variant = await deps.readImageRequest(attachment, {
+			width,
+			height: width,
+			maxBytes: config.maxBytes
+		});
+		const etag = "\"" + String(variant.variantId) + "\"";
+		const headers = {
+			"cache-control": "private, max-age=31536000, immutable",
+			etag
+		};
+		const ifNoneMatch = req.headers["if-none-match"];
+		if (typeof ifNoneMatch === "string" && ifNoneMatch.split(",").some((value) => value.trim() === etag)) {
+			res.writeHead(304, headers);
+			res.end();
+			return;
+		}
+		res.writeHead(200, {
+			"content-type": variant.mediaType,
+			"content-length": String(variant.data.byteLength),
+			"x-content-type-options": "nosniff",
+			...headers
+		});
+		res.end(variant.data);
+	} catch {
+		jsonError$4(res, 404, config.unavailableCode);
+	}
+}
+function sameOrigin$4(req) {
+	const origin = req.headers.origin;
+	const host = req.headers.host;
+	if (origin !== void 0 && host !== void 0 && origin !== `http://${host}` && origin !== `https://${host}`) return false;
+	return true;
+}
 function jsonError$4(res, status, code) {
 	res.writeHead(status, {
 		"content-type": "application/json",
@@ -8535,26 +10289,66 @@ async function editOpenAICompatibleImage(input) {
 			body: form
 		}), input.apiKey), "openai", input);
 	}
-	const form = new FormData();
-	const imageField = input.sourceImages.length > 1 ? "image[]" : "image";
-	input.sourceImages.forEach((sourceImage, index) => {
-		const uploadBytes = new Uint8Array(sourceImage.data);
-		const blob = new Blob([uploadBytes], { type: sourceImage.mediaType });
-		const filename = `reference-${index + 1}.${extensionOf(sourceImage.mediaType)}`;
-		form.append(imageField, blob, filename);
-	});
-	form.append("prompt", input.prompt);
-	form.append("model", input.model);
-	if (input.size !== void 0 && input.size.length > 0) form.append("size", input.size);
-	if (input.quality !== void 0) form.append("quality", input.quality);
-	for (const [key, value] of Object.entries(input.extraBody ?? {})) form.append(key, String(value));
-	return parseImageResponse(await guardedFetch("openai image edit request", input.signal, () => fetch(imageEndpoint$1(input.baseURL, "edits"), {
+	const responseFormat = input.editResponseFormat ?? "url";
+	const explicitResponseFormat = Object.prototype.hasOwnProperty.call(input.extraBody ?? {}, "response_format");
+	const buildEditForm = (includeResponseFormat) => {
+		const form = new FormData();
+		const imageField = input.sourceImages.length > 1 ? "image[]" : "image";
+		input.sourceImages.forEach((sourceImage, index) => {
+			const uploadBytes = new Uint8Array(sourceImage.data);
+			const blob = new Blob([uploadBytes], { type: sourceImage.mediaType });
+			const filename = `reference-${index + 1}.${extensionOf(sourceImage.mediaType)}`;
+			form.append(imageField, blob, filename);
+		});
+		form.append("prompt", input.prompt);
+		form.append("model", input.model);
+		if (input.size !== void 0 && input.size.length > 0) form.append("size", input.size);
+		if (input.quality !== void 0) form.append("quality", input.quality);
+		if (includeResponseFormat && !explicitResponseFormat) form.append("response_format", "b64_json");
+		for (const [key, value] of Object.entries(input.extraBody ?? {})) {
+			if (value === void 0) continue;
+			form.append(key, String(value));
+		}
+		return form;
+	};
+	const sendEdit = (form) => guardedFetch("openai image edit request", input.signal, () => fetch(imageEndpoint$1(input.baseURL, "edits"), {
 		method: "POST",
 		redirect: "error",
 		signal: input.signal,
 		headers: { authorization: `Bearer ${input.apiKey}` },
 		body: form
-	}), input.apiKey), "openai", input);
+	}), input.apiKey);
+	let response = await sendEdit(buildEditForm(responseFormat !== "url"));
+	if (responseFormat === "auto" && !explicitResponseFormat && (response.status === 400 || response.status === 422)) {
+		const text = await readBoundedText$1(response, ERROR_LIMIT$1);
+		if (!rejectsResponseFormat(text)) throw new Error(`openai image request failed (${response.status}): ${redactSecrets(text, input.apiKey).slice(0, ERROR_LIMIT$1)}`);
+		input.onResponseFormatRetry?.(response.status);
+		response = await sendEdit(buildEditForm(false));
+	}
+	return parseImageResponse(response, "openai", input);
+}
+function rejectsResponseFormat(text) {
+	let message = text;
+	try {
+		const body = JSON.parse(text);
+		if (typeof body === "string") message = body;
+		else if (body !== null && typeof body === "object") {
+			const error = typeof body.error === "object" && body.error !== null ? body.error : void 0;
+			if (typeof error?.param === "string") return error.param === "response_format";
+			if (Array.isArray(body.detail)) return body.detail.length > 0 && body.detail.every((entry) => {
+				const loc = entry !== null && typeof entry === "object" ? entry.loc : void 0;
+				return Array.isArray(loc) && loc.includes("response_format");
+			});
+			message = [
+				typeof body.error === "string" ? body.error : void 0,
+				error?.message,
+				error?.code,
+				body.message,
+				body.detail
+			].filter((value) => typeof value === "string").join(" ");
+		}
+	} catch {}
+	return /(?:response[_ -]?format|b64_json)/i.test(message) && /(?:unsupported|not\s+(?:support|allowed|permitted|accepted|implemented)|unknown|unrecognized|unexpected|invalid|extra\s+(?:field|input)|不支持|不允许|未知|无效|未识别)/i.test(message);
 }
 async function parseImageResponse(response, provider, input) {
 	const text = await readBoundedText$1(response, Math.ceil(input.maxBytes * 1.4) + ERROR_LIMIT$1);
@@ -8614,17 +10408,19 @@ async function downloadImage$1(url, provider, input) {
 			mediaType: detectImageMediaType(data) ?? imageMediaType$2(parsed.mediaType) ?? "image/png"
 		};
 	}
-	const sameOrigin = new URL(url).origin === new URL(input.baseURL).origin;
-	let response = await guardedFetch(`${provider} image download`, input.signal, () => fetch(url, {
-		redirect: "follow",
-		signal: input.signal,
-		...input.apiKey === void 0 || !sameOrigin ? {} : { headers: { authorization: `Bearer ${input.apiKey}` } }
-	}), input.apiKey);
-	if (!response.ok && input.apiKey !== void 0 && sameOrigin) response = await guardedFetch(`${provider} image download`, input.signal, () => fetch(url, {
-		redirect: "follow",
-		signal: input.signal
-	}), input.apiKey);
-	if (!response.ok) throw new Error(`${provider} image download failed (${response.status})`);
+	const candidates = imageDownloadCandidates(url, input.baseURL, provider);
+	let response;
+	let failure;
+	for (const candidate of candidates) try {
+		response = await requestImageCandidate(candidate, provider, input);
+		if (response.ok) break;
+		failure = /* @__PURE__ */ new Error(`${provider} image download failed (${response.status})`);
+		await response.body?.cancel().catch(() => void 0);
+		response = void 0;
+	} catch (err) {
+		failure = err;
+	}
+	if (response === void 0) throw failure instanceof Error ? failure : /* @__PURE__ */ new Error(`${provider} image download failed`);
 	const data = await readBoundedBytes$1(response, input.maxBytes);
 	const mediaType = detectImageMediaType(data) ?? imageMediaType$2(response.headers.get("content-type"));
 	if (mediaType === void 0) throw new Error(`${provider} image download returned unsupported content type`);
@@ -8633,6 +10429,34 @@ async function downloadImage$1(url, provider, input) {
 		mediaType
 	};
 }
+function imageDownloadCandidates(url, baseURL, provider) {
+	const candidates = [];
+	try {
+		candidates.push(new URL(url, baseURL.endsWith("/") ? baseURL : baseURL + "/").toString());
+	} catch {}
+	if (url.startsWith("/")) try {
+		const stripped = new URL(baseURL).origin + url.replace(/^\/v1(?=\/)/, "");
+		if (!candidates.includes(stripped)) candidates.push(stripped);
+	} catch {}
+	if (candidates.length === 0) throw new Error(provider + " image download URL is not absolute");
+	return candidates;
+}
+async function requestImageCandidate(candidate, provider, input) {
+	const sameOrigin = new URL(candidate).origin === new URL(input.baseURL).origin;
+	let response = await guardedFetch(provider + " image download", input.signal, () => fetch(candidate, {
+		redirect: "follow",
+		signal: input.signal,
+		...input.apiKey === void 0 || !sameOrigin ? {} : { headers: { authorization: "Bearer " + input.apiKey } }
+	}), input.apiKey);
+	if (!response.ok && input.apiKey !== void 0 && sameOrigin) {
+		await response.body?.cancel().catch(() => void 0);
+		response = await guardedFetch(provider + " image download", input.signal, () => fetch(candidate, {
+			redirect: "follow",
+			signal: input.signal
+		}), input.apiKey);
+	}
+	return response;
+}
 function parseDataUrl(value) {
 	const match = /^data:([^;,]+);base64,(.*)$/s.exec(value.trim());
 	return match?.[1] !== void 0 && match[2] !== void 0 ? {
@@ -8675,6 +10499,9 @@ async function readBoundedBytes$1(response, maxBytes) {
 			if (bytes > maxBytes) throw new Error(`Image response exceeded the ${String(maxBytes)} byte limit`);
 			chunks.push(next.value);
 		}
+	} catch (error) {
+		await reader.cancel().catch(() => void 0);
+		throw error;
 	} finally {
 		reader.releaseLock();
 	}
@@ -8760,9 +10587,15 @@ async function downloadImage(url, input) {
 		redirect: "follow",
 		signal: input.signal
 	}), input.apiKey);
-	if (!response.ok) throw new Error(`seedream image download failed (${response.status})`);
+	if (!response.ok) {
+		await response.body?.cancel().catch(() => void 0);
+		throw new Error(`seedream image download failed (${response.status})`);
+	}
 	const mediaType = imageMediaType$1(response.headers.get("content-type"));
-	if (mediaType === void 0) throw new Error("seedream image download returned unsupported content type");
+	if (mediaType === void 0) {
+		await response.body?.cancel().catch(() => void 0);
+		throw new Error("seedream image download returned unsupported content type");
+	}
 	return {
 		data: await readBoundedBytes(response, input.maxBytes),
 		mediaType
@@ -8795,6 +10628,9 @@ async function readBoundedBytes(response, maxBytes) {
 			if (bytes > maxBytes) throw new Error(`Image response exceeded the ${String(maxBytes)} byte limit`);
 			chunks.push(next.value);
 		}
+	} catch (error) {
+		await reader.cancel().catch(() => void 0);
+		throw error;
 	} finally {
 		reader.releaseLock();
 	}
@@ -29124,6 +30960,13 @@ function apply(ctx, config = {}) {
 			if (revision === imageContextRevision) configuredImageProviders = providers;
 		} catch {}
 	};
+	const vaultConfig = () => {
+		const config = current();
+		return {
+			enabled: config.vaultEnabled !== false,
+			dir: resolveVaultPath(config.vaultDir ?? "")
+		};
+	};
 	const settingsHealth = installImageSettings(ctx, current(), {
 		setSource: (source) => {
 			current = () => migrateOpenAICompatConfig(plainConfig(source()));
@@ -29132,6 +30975,33 @@ function apply(ctx, config = {}) {
 			refreshImageToolContext();
 		}
 	});
+	ctx.effect(() => {
+		const run = () => {
+			const config = current();
+			if (config.requestCachePrune === false) return;
+			const ttlDays = config.requestCacheTtlDays ?? 14;
+			const maxBytes = config.requestCacheMaxBytes ?? 268435456;
+			const configured = config.requestCacheDir ?? "";
+			pruneRequestImageCache({
+				dir: configured.length > 0 ? configured : resolveRequestImageCacheDir(),
+				ttlMs: ttlDays * 24 * 60 * 60 * 1e3,
+				maxBytes,
+				protectedRoots: [durableAttachmentsRoot(), vaultConfig().dir]
+			}).then((stats) => {
+				if (stats.removed > 0) ctx.logger.info("dsh-image-gen: pruned " + String(stats.removed) + " request-image variants (" + String(stats.freedBytes) + " bytes)");
+			}).catch((error) => {
+				ctx.logger.warn("dsh-image-gen: request-image cache prune failed: " + (error instanceof Error ? error.message : String(error)));
+			});
+		};
+		const startup = setTimeout(run, 3e4);
+		const daily = setInterval(run, 864e5);
+		startup.unref();
+		daily.unref();
+		return () => {
+			clearTimeout(startup);
+			clearInterval(daily);
+		};
+	}, "dsh-image-gen: request image cache upkeep");
 	let webAdmission;
 	ctx.inject(["connection"], (connectionCtx) => {
 		webAdmission = (request) => connectionCtx.connection.requestRejection(request);
@@ -29149,15 +31019,75 @@ function apply(ctx, config = {}) {
 			path: IMAGE_ROUTE,
 			handler: (req, res) => serveImage(req, res, { readImage: (ref) => ctx.attachments.readImage(ref) })
 		}), "dsh-image-gen: image route");
+		webCtx.effect(() => register({
+			kind: "exact",
+			path: THUMB_ROUTE,
+			handler: (req, res) => serveThumb(req, res, { readImageRequest: (ref, target, signal) => ctx.attachments.readImageRequest(ref, target, signal) })
+		}), "dsh-image-gen: thumbnail route");
+		webCtx.effect(() => register({
+			kind: "exact",
+			path: PREVIEW_ROUTE,
+			handler: (req, res) => servePreview(req, res, { readImageRequest: (ref, target, signal) => ctx.attachments.readImageRequest(ref, target, signal) })
+		}), "dsh-image-gen: preview route");
 		webCtx.effect(() => register({
 			kind: "exact",
 			path: IMPORT_ROUTE,
 			handler: (req, res) => serveImport(req, res, {
 				saveImage: (image) => ctx.attachments.saveImage(image),
 				maxImageBytes: ctx.attachments.imageLimits.maxImageBytes,
-				mediaTypes: ctx.attachments.imageLimits.mediaTypes
+				mediaTypes: ctx.attachments.imageLimits.mediaTypes,
+				warmThumbnail: (ref) => {
+					ctx.attachments.readImageRequest(ref, {
+						width: 320,
+						height: 320,
+						maxBytes: 98304
+					}).catch(() => void 0);
+				},
+				saveOriginal: (input) => saveImportedOriginal(vaultConfig(), input, typeof req.headers["x-dsh-vault-profile"] === "string" ? req.headers["x-dsh-vault-profile"] : void 0)
 			})
 		}), "dsh-image-gen: import route");
+		webCtx.effect(() => register({
+			kind: "exact",
+			path: ZIP_ROUTE,
+			handler: (req, res) => serveZip(req, res, {
+				readImage: (ref) => ctx.attachments.readImage(ref),
+				readVault: (key, mediaType) => readOriginal(vaultConfig(), key, mediaType),
+				maxEntries: 2e3
+			})
+		}), "dsh-image-gen: zip export route");
+		webCtx.effect(() => register({
+			kind: "exact",
+			path: ZIP_PROGRESS_ROUTE,
+			handler: (req, res) => serveZipProgress(req, res)
+		}), "dsh-image-gen: zip progress route");
+		webCtx.effect(() => register({
+			kind: "exact",
+			path: ZIP_CANCEL_ROUTE,
+			handler: (req, res) => serveZipCancel(req, res)
+		}), "dsh-image-gen: zip cancel route");
+		webCtx.effect(() => register({
+			kind: "exact",
+			path: VAULT_ROUTE,
+			handler: (req, res) => serveVault(req, res, vaultConfig())
+		}), "dsh-image-gen: vault route");
+		webCtx.effect(() => register({
+			kind: "exact",
+			path: VAULT_REFS_ROUTE,
+			handler: (req, res) => serveVaultRefs(req, res, vaultConfig())
+		}), "dsh-image-gen: vault refs route");
+		webCtx.effect(() => register({
+			kind: "exact",
+			path: VAULT_DELETE_ROUTE,
+			handler: (req, res) => serveVaultDelete(req, res, vaultConfig())
+		}), "dsh-image-gen: vault delete route");
+		webCtx.effect(() => register({
+			kind: "exact",
+			path: STORAGE_STATS_ROUTE,
+			handler: (req, res) => {
+				const configured = current().requestCacheDir?.trim() ?? "";
+				serveStorageStats(req, res, { requestImagesRoot: configured.length > 0 ? configured : resolveRequestImageCacheDir() });
+			}
+		}), "dsh-image-gen: storage stats route");
 		webCtx.effect(() => register({
 			kind: "exact",
 			path: DELETE_ROUTE,
@@ -29885,7 +31815,11 @@ function apply(ctx, config = {}) {
 					...active.provider === "openai-compat" ? {
 						editFormat: active.editFormat,
 						editExtra: active.editExtra,
-						editSizeMode: requestConfig.openaiCompatEditSizeMode ?? "auto"
+						editSizeMode: requestConfig.openaiCompatEditSizeMode ?? "auto",
+						editResponseFormat: "auto",
+						onResponseFormatRetry: (status) => {
+							ctx.logger.warn("dsh-image-gen: openai-compatible relay rejected response_format=b64_json (" + String(status) + "); retrying without it");
+						}
 					} : active.provider === "xai" ? {
 						editFormat: "xaiJson",
 						...xaiExtraBody === void 0 ? {} : { extraBody: xaiExtraBody }