dsh-image-gen 0.10.2 → 0.11.0

package/lib/index.js

@@ -1,9 +1,11 @@
 import { createRequire } from "node:module";
 import { Context, Service } from "@deepseek-ai/cordis";
 import z from "@deepseek-ai/schemastery";
-import { lstat, mkdir, readFile, readdir, realpath, rename, stat, unlink, writeFile } from "node:fs/promises";
+import { homedir, tmpdir } from "node:os";
+import { lstat, mkdir, mkdtemp, readFile, readdir, realpath, rename, rm, rmdir, stat, unlink, writeFile } from "node:fs/promises";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { crc32 } from "node:zlib";
 import http from "node:http";
 //#region node_modules/.pnpm/@deepseek-ai+dsh-scope@0.1._0271d3a82adfe807020938592f267574/node_modules/@deepseek-ai/dsh-scope/lib/index.js
 /**
@@ -5693,6 +5695,20 @@ function watermarkProfile(config, provider, model) {
 //#region lib/types/shared.js
 /** Browser route used by the generated-image card. */
 const IMAGE_ROUTE = "/plugins/dsh-image-gen/image";
+/** Decode a GET query value; the caller supplies the reference parser. */
+function decodeImageRef(value, parse) {
+	try {
+		const base64 = value.replace(/-/g, "+").replace(/_/g, "/");
+		const padded = base64 + "=".repeat((4 - base64.length % 4) % 4);
+		const binary = atob(padded);
+		const bytes = Uint8Array.from(binary, (character) => character.charCodeAt(0));
+		return parse(JSON.parse(new TextDecoder().decode(bytes)));
+	} catch {
+		return;
+	}
+}
+/** Content-addressed vault key: the sha256 of the original bytes, validated on both faces. */
+const VAULT_KEY_PATTERN = /^[a-f0-9]{64}$/;
 /** Browser route that uploads user-picked images as DSH attachments. */
 const IMPORT_ROUTE = "/plugins/dsh-image-gen/import";
 /** Browser route used for deleting generated images and workspace files. */
@@ -5703,6 +5719,17 @@ const STUDIO_ROUTE = "/plugins/dsh-image-gen/studio";
 const INSPIRATION_ROUTE = "/plugins/dsh-image-gen/inspiration";
 /** Browser route used for saving generated images to workspace on demand. */
 const SAVE_WORKSPACE_ROUTE = "/plugins/dsh-image-gen/save-workspace";
+/** Browser route that streams a ZIP export of the selected gallery images. */
+const ZIP_ROUTE = "/plugins/dsh-image-gen/zip";
+/** Browser route that serves host-rendered gallery thumbnails. */
+const THUMB_ROUTE = "/plugins/dsh-image-gen/thumb";
+const PREVIEW_ROUTE = "/plugins/dsh-image-gen/preview";
+const VAULT_ROUTE = "/plugins/dsh-image-gen/vault";
+const VAULT_REFS_ROUTE = "/plugins/dsh-image-gen/vault-refs";
+const VAULT_DELETE_ROUTE = "/plugins/dsh-image-gen/vault-delete";
+const ZIP_PROGRESS_ROUTE = "/plugins/dsh-image-gen/zip/progress";
+const ZIP_CANCEL_ROUTE = "/plugins/dsh-image-gen/zip/cancel";
+const STORAGE_STATS_ROUTE = "/plugins/dsh-image-gen/storage-stats";
 /** Browser route the settings card probes provider connectivity through. */
 const TEST_CONNECTION_ROUTE = "/plugins/dsh-image-gen/test";
 /** Non-secret settings capability probe, available even when the host cannot serve a form. */
@@ -5841,6 +5868,15 @@ const DEFAULT_CLOUD_TIMEOUT_MS = 15e4;
 /** Timeout for one subscription image call, shared by the tool path and the
 * studio route so neither drifts from the other. */
 const SUBSCRIPTION_TIMEOUT_MS = 3e5;
+const GIF_FRAME_DURATION_MS_MAX = 2e3;
+const GIF_SHEET_MAX_EDGE = 3840;
+/** A GIF draws every frame in one image call, so it runs longer than a still; the host's HTTP client gives up on response headers after 300 s anyway. */
+const DEFAULT_GIF_TIMEOUT_MS = 3e5;
+/** The cloud timeout for a request: a GIF gets the longer GIF default while the cloud timeout is left at its default. */
+function cloudTimeoutFor(configuredMs, gif) {
+	const timeout = configuredMs ?? 15e4;
+	return gif && timeout === 15e4 ? DEFAULT_GIF_TIMEOUT_MS : timeout;
+}
 /**
 * Credential references resolved through the DSH Credentials service (BYOK).
 * These are POSIX-style reference names, not environment variables: the host
@@ -5899,6 +5935,10 @@ const STUDIO_WATERMARK_VALUES = [
 	"off",
 	"on"
 ];
+/** A model picker/request must use the same operation-specific default. */
+function studioModelForMode(profile, mode) {
+	return mode === "edit" ? profile.editModel ?? profile.model : profile.model;
+}
 function studioModelOptionsForMode(profile, mode) {
 	if (mode === "edit" && profile.editModel !== void 0) return [{
 		value: profile.editModel,
@@ -5954,10 +5994,26 @@ function arkOutputBody(options, { background = true } = {}) {
 }
 /** Default model names. */
 const DEFAULT_GOOGLE_MODEL = "gemini-3.1-flash-image";
-const DEFAULT_OPENAI_MODEL = "gpt-image-2";
-const DEFAULT_SEEDREAM_MODEL = "doubao-seedream-5-0-260128";
+const DEFAULT_OPENAI_MODEL = "gpt-image-2.6-flare";
+const DEFAULT_SEEDREAM_MODEL = "doubao-seedream-5-0-pro-260628";
+/**
+* Seedream models Volcano Ark retires on 2026-11-24 (batch 10), mapped to the
+* model that takes their requests. A saved settings value naming one of them
+* (the plugin's own former default among them) would start failing that day.
+*/
+const RETIRED_SEEDREAM_MODELS = {
+	"doubao-seedream-5-0-260128": DEFAULT_SEEDREAM_MODEL,
+	"doubao-seedream-5-0-lite-260128": DEFAULT_SEEDREAM_MODEL,
+	"doubao-seedream-4-5-251128": DEFAULT_SEEDREAM_MODEL
+};
+/** The Seedream model a request should use: a retired one is replaced, anything else is kept. */
+function currentSeedreamModel(model) {
+	const trimmed = model?.trim();
+	if (trimmed === void 0 || trimmed.length === 0) return DEFAULT_SEEDREAM_MODEL;
+	return RETIRED_SEEDREAM_MODELS[trimmed] ?? trimmed;
+}
 const DEFAULT_DASHSCOPE_MODEL = "qwen-image-3.0";
-const DEFAULT_XAI_MODEL = "grok-imagine-image";
+const DEFAULT_XAI_MODEL = "grok-imagine-image-2.0";
 const DEFAULT_ZHIPU_MODEL = "glm-image";
 /** Named workflows, falling back to the legacy single-workflow fields when the list is empty. */
 function resolveComfyUIWorkflows(source) {
@@ -6007,7 +6063,7 @@ function mergeComfyUIPrompt(preset, user) {
 }
 /** Default models for the subscription channels; fixed by the bridge protocol. */
 const DEFAULT_SUBSCRIPTION_MODELS = {
-	"chatgpt-sub": "gpt-image-2.5-flare",
+	"chatgpt-sub": "gpt-image-2.6-flare",
 	"grok-sub": "grok-imagine-image-2.0",
 	"google-sub": "gemini-3.1-flash-image"
 };
@@ -6109,7 +6165,13 @@ const Config = z.object({
 	comfyuiTimeoutMs: volatile(z.number().min(1e3).max(36e5).default(DEFAULT_COMFYUI_TIMEOUT_MS)),
 	saveToWorkspace: volatile(z.boolean().default(true)),
 	workspaceFolder: volatile(z.string().default(DEFAULT_WORKSPACE_FOLDER)),
-	showProviderPill: volatile(z.boolean().default(false))
+	showProviderPill: volatile(z.boolean().default(false)),
+	requestCachePrune: volatile(z.boolean().default(true)),
+	requestCacheTtlDays: volatile(z.number().min(1).max(365).default(14)),
+	requestCacheMaxBytes: volatile(z.number().min(0).default(268435456)),
+	requestCacheDir: volatile(z.string().default("")),
+	vaultEnabled: volatile(z.boolean().default(true)),
+	vaultDir: volatile(z.string().default(""))
 });
 /** Resolve exactly one provider profile for a tool call. */
 function resolveProvider(config) {
@@ -6117,7 +6179,7 @@ function resolveProvider(config) {
 		case "openai": return {
 			provider: "openai",
 			apiKeyEnv: OPENAI_API_KEY_ENV,
-			model: config.openaiModel ?? "gpt-image-2",
+			model: config.openaiModel ?? "gpt-image-2.6-flare",
 			baseURL: config.openaiBaseURL ?? "https://api.openai.com/v1",
 			imageSize: "1024x1024"
 		};
@@ -6141,7 +6203,7 @@ function resolveProvider(config) {
 			return {
 				provider: "seedream",
 				apiKeyEnv: SEEDREAM_API_KEY_ENV,
-				model: config.seedreamModel ?? "doubao-seedream-5-0-260128",
+				model: currentSeedreamModel(config.seedreamModel),
 				baseURL: config.seedreamBaseURL ?? "https://ark.cn-beijing.volces.com/api/v3",
 				imageSize: "2K",
 				arkOptions: {
@@ -6161,7 +6223,7 @@ function resolveProvider(config) {
 		case "xai": return {
 			provider: "xai",
 			apiKeyEnv: XAI_API_KEY_ENV,
-			model: config.xaiModel ?? "grok-imagine-image",
+			model: config.xaiModel ?? "grok-imagine-image-2.0",
 			baseURL: config.xaiBaseURL ?? "https://api.x.ai/v1",
 			imageSize: "1024x1024"
 		};
@@ -6775,24 +6837,24 @@ const MAX_NODE_COUNT = 1e5;
 const MAX_SELECTION_COUNT = 1e3;
 /** Serve one canvas-state push. */
 async function serveCanvasState(req, res, deps) {
-	if (req.method !== "POST") return jsonError$6(res, 405, "method-not-allowed");
-	if (!(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json")) return jsonError$6(res, 415, "json-required");
+	if (req.method !== "POST") return jsonError$11(res, 405, "method-not-allowed");
+	if (!(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json")) return jsonError$11(res, 415, "json-required");
 	const origin = req.headers.origin;
 	const host = req.headers.host;
-	if (origin !== void 0 && host !== void 0 && origin !== `http://${host}` && origin !== `https://${host}`) return jsonError$6(res, 403, "origin-rejected");
+	if (origin !== void 0 && host !== void 0 && origin !== `http://${host}` && origin !== `https://${host}`) return jsonError$11(res, 403, "origin-rejected");
 	let body;
 	try {
-		body = JSON.parse(await readBody$5(req, deps.maxBodyBytes));
+		body = JSON.parse(await readBody$8(req, deps.maxBodyBytes));
 	} catch (error) {
-		return jsonError$6(res, error instanceof Error && error.message === "request-too-large" ? 413 : 400, "invalid-request");
+		return jsonError$11(res, error instanceof Error && error.message === "request-too-large" ? 413 : 400, "invalid-request");
 	}
 	const push = parseCanvasStatePush(body);
-	if (push === void 0) return jsonError$6(res, 400, "invalid-canvas-state");
+	if (push === void 0) return jsonError$11(res, 400, "invalid-canvas-state");
 	let selectionImage;
 	if (push.selectionImage !== void 0) {
 		const decoded = decodeSelectionImage(push.selectionImage);
-		if (decoded === void 0) return jsonError$6(res, 400, "invalid-selection-image");
-		if (decoded.data.byteLength > deps.maxImageBytes) return jsonError$6(res, 413, "selection-image-too-large");
+		if (decoded === void 0) return jsonError$11(res, 400, "invalid-selection-image");
+		if (decoded.data.byteLength > deps.maxImageBytes) return jsonError$11(res, 413, "selection-image-too-large");
 		selectionImage = decoded;
 	}
 	deps.mirror.apply(push, selectionImage);
@@ -6960,7 +7022,7 @@ function optionalDimension(value) {
 function nonNegativeInteger(value) {
 	return typeof value === "number" && Number.isInteger(value) && value >= 0;
 }
-async function readBody$5(req, maxBytes) {
+async function readBody$8(req, maxBytes) {
 	const chunks = [];
 	let bytes = 0;
 	for await (const chunk of req) {
@@ -6971,7 +7033,7 @@ async function readBody$5(req, maxBytes) {
 	}
 	return Buffer.concat(chunks).toString("utf8");
 }
-function jsonError$6(res, status, code) {
+function jsonError$11(res, status, code) {
 	res.writeHead(status, {
 		"content-type": "application/json",
 		"cache-control": "no-store"
@@ -7308,6 +7370,7 @@ function redactSecrets(text, ...secrets) {
 	let redacted = text;
 	for (const secret of secrets) if (secret !== void 0 && secret.length >= 8) redacted = redacted.split(secret).join(REDACTED);
 	for (const pattern of KEY_SHAPED_PATTERNS) redacted = redacted.replace(pattern, REDACTED);
+	redacted = redacted.replace(/\/\/[^\s/?#@]+@/g, `//${REDACTED}@`);
 	return redacted;
 }
 //#endregion
@@ -7921,7 +7984,7 @@ async function readBoundedText$2(response, maxBytes, label) {
 //#region lib/types/workspace-save.js
 /** Persist one generated image as a file under the session workspace. */
 /** File extension for each supported image media type. */
-const EXTENSION = {
+const EXTENSION$1 = {
 	"image/png": "png",
 	"image/jpeg": "jpg",
 	"image/webp": "webp",
@@ -7938,7 +8001,7 @@ const EXTENSION = {
 * @returns the file name (no directory).
 */
 function workspaceImageName(attachmentId, mediaType) {
-	return `image-${(attachmentId.startsWith("sha256:") ? attachmentId.slice(7) : attachmentId).slice(0, 8).padEnd(8, "0")}.${EXTENSION[mediaType]}`;
+	return `image-${(attachmentId.startsWith("sha256:") ? attachmentId.slice(7) : attachmentId).slice(0, 8).padEnd(8, "0")}.${EXTENSION$1[mediaType]}`;
 }
 /**
 * Resolve the configured image folder inside the session workspace. The
@@ -8146,19 +8209,20 @@ async function deleteImageFromWorkspace(filePath, allowedWorkspaceRoots) {
 const MAX_BODY_BYTES$2 = 65536;
 /** Serve one verified durable image reference to a same-origin browser request. */
 async function serveImage(req, res, deps) {
-	if (req.method !== "POST") return jsonError$5(res, 405, "method-not-allowed");
-	if (!(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json")) return jsonError$5(res, 415, "json-required");
+	if (req.method === "GET") return serveCachedImage(req, res, deps);
+	if (req.method !== "POST") return jsonError$10(res, 405, "method-not-allowed");
+	if (!(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json")) return jsonError$10(res, 415, "json-required");
 	const origin = req.headers.origin;
 	const host = req.headers.host;
-	if (origin !== void 0 && host !== void 0 && origin !== `http://${host}` && origin !== `https://${host}`) return jsonError$5(res, 403, "origin-rejected");
+	if (origin !== void 0 && host !== void 0 && origin !== `http://${host}` && origin !== `https://${host}`) return jsonError$10(res, 403, "origin-rejected");
 	let body;
 	try {
-		body = JSON.parse(await readBody$4(req));
+		body = JSON.parse(await readBody$7(req));
 	} catch {
-		return jsonError$5(res, 400, "invalid-request");
+		return jsonError$10(res, 400, "invalid-request");
 	}
 	const attachment = attachmentFromRequest(body);
-	if (attachment === void 0) return jsonError$5(res, 400, "invalid-attachment");
+	if (attachment === void 0) return jsonError$10(res, 400, "invalid-attachment");
 	try {
 		const stored = await deps.readImage(attachment);
 		res.writeHead(200, {
@@ -8169,10 +8233,44 @@ async function serveImage(req, res, deps) {
 		});
 		res.end(stored.data);
 	} catch {
-		jsonError$5(res, 404, "image-unavailable");
+		jsonError$10(res, 404, "image-unavailable");
 	}
 }
-function sameOrigin$4(req) {
+/**
+* Cacheable GET form: attachments are content-addressed, so the response can be
+* marked immutable and revalidated with a stable ETag. Preview, copy and
+* download then hit the browser cache instead of re-reading the host.
+*/
+async function serveCachedImage(req, res, deps) {
+	if (!sameOrigin$8(req)) return jsonError$10(res, 403, "origin-rejected");
+	const raw = new URL(req.url ?? "/", "http://x").searchParams.get("ref");
+	const attachment = raw === null ? void 0 : decodeImageRef(raw, parseImageAttachmentRef);
+	if (attachment === void 0) return jsonError$10(res, 400, "invalid-attachment");
+	const etag = "\"" + String(attachment.attachmentId) + "\"";
+	const cacheHeaders = {
+		"cache-control": "private, max-age=31536000, immutable",
+		etag
+	};
+	const ifNoneMatch = req.headers["if-none-match"];
+	if (typeof ifNoneMatch === "string" && ifNoneMatch.split(",").some((value) => value.trim() === etag)) {
+		res.writeHead(304, cacheHeaders);
+		res.end();
+		return;
+	}
+	try {
+		const stored = await deps.readImage(attachment);
+		res.writeHead(200, {
+			"content-type": stored.ref.mediaType,
+			"content-length": String(stored.data.byteLength),
+			"x-content-type-options": "nosniff",
+			...cacheHeaders
+		});
+		res.end(stored.data);
+	} catch {
+		jsonError$10(res, 404, "image-unavailable");
+	}
+}
+function sameOrigin$8(req) {
 	const origin = req.headers.origin;
 	const host = req.headers.host;
 	if (origin !== void 0 && host !== void 0 && origin !== `http://${host}` && origin !== `https://${host}`) return false;
@@ -8180,14 +8278,14 @@ function sameOrigin$4(req) {
 }
 /** Safely delete one or more generated image files from the workspace disk. */
 async function serveDelete(req, res, deps) {
-	if (req.method !== "POST") return jsonError$5(res, 405, "method-not-allowed");
-	if (!(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json")) return jsonError$5(res, 415, "json-required");
-	if (!sameOrigin$4(req)) return jsonError$5(res, 403, "origin-rejected");
+	if (req.method !== "POST") return jsonError$10(res, 405, "method-not-allowed");
+	if (!(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json")) return jsonError$10(res, 415, "json-required");
+	if (!sameOrigin$8(req)) return jsonError$10(res, 403, "origin-rejected");
 	let body;
 	try {
-		body = JSON.parse(await readBody$4(req));
+		body = JSON.parse(await readBody$7(req));
 	} catch {
-		return jsonError$5(res, 400, "invalid-request");
+		return jsonError$10(res, 400, "invalid-request");
 	}
 	const rawPaths = typeof body === "object" && body !== null && "paths" in body && Array.isArray(body.paths) ? body.paths : [];
 	const deletedFiles = [];
@@ -8217,13 +8315,13 @@ async function serveDelete(req, res, deps) {
 }
 /** Serve on-demand image persistence into the workspace. */
 async function serveSaveWorkspace(req, res, deps) {
-	if (!sameOrigin$4(req)) return jsonError$5(res, 403, "origin-rejected");
-	if (req.method !== "POST") return jsonError$5(res, 405, "method-not-allowed");
-	if (!(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json")) return jsonError$5(res, 415, "json-required");
+	if (!sameOrigin$8(req)) return jsonError$10(res, 403, "origin-rejected");
+	if (req.method !== "POST") return jsonError$10(res, 405, "method-not-allowed");
+	if (!(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json")) return jsonError$10(res, 415, "json-required");
 	try {
-		const raw = JSON.parse(await readBody$4(req));
+		const raw = JSON.parse(await readBody$7(req));
 		const attachment = parseImageAttachmentRef(raw.attachment);
-		if (!attachment) return jsonError$5(res, 400, "invalid-attachment");
+		if (!attachment) return jsonError$10(res, 400, "invalid-attachment");
 		if (!deps.isSaveEnabled()) {
 			res.writeHead(200, {
 				"content-type": "application/json",
@@ -8241,10 +8339,10 @@ async function serveSaveWorkspace(req, res, deps) {
 		try {
 			targetRoot = await assertWorkspaceAllowed(rawTarget, allowedRoots);
 		} catch {
-			return jsonError$5(res, 403, "workspace-root-not-allowed");
+			return jsonError$10(res, 403, "workspace-root-not-allowed");
 		}
 		const stored = await deps.readImage(attachment);
-		if (!stored || !stored.data) return jsonError$5(res, 404, "image-not-found");
+		if (!stored || !stored.data) return jsonError$10(res, 404, "image-not-found");
 		const savedTo = await deps.saveToWorkspace({
 			workspaceRoot: targetRoot,
 			attachmentId: String(attachment.attachmentId),
@@ -8282,7 +8380,7 @@ function attachmentFromRequest(value) {
 function record$4(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
 }
-async function readBody$4(req) {
+async function readBody$7(req) {
 	const chunks = [];
 	let bytes = 0;
 	for await (const chunk of req) {
@@ -8293,7 +8391,7 @@ async function readBody$4(req) {
 	}
 	return Buffer.concat(chunks).toString("utf8");
 }
-function jsonError$5(res, status, code) {
+function jsonError$10(res, status, code) {
 	res.writeHead(status, {
 		"content-type": "application/json",
 		"cache-control": "no-store"
@@ -8301,30 +8399,249 @@ function jsonError$5(res, status, code) {
 	res.end(JSON.stringify({ error: code }));
 }
 //#endregion
+//#region lib/types/multipart.js
+var MultipartError = class extends Error {
+	status;
+	code;
+	constructor(status, code) {
+		super(code);
+		this.status = status;
+		this.code = code;
+		this.name = "MultipartError";
+	}
+};
+const CRLF = Buffer.from("\r\n");
+const DASH = Buffer.from("--");
+const HEADER_LIMIT = 16384;
+/**
+* Parse a multipart body incrementally. Only one part is buffered at a time,
+* so an 8 x 40 MiB upload never holds the whole request in memory.
+*/
+async function readMultipart(req, boundary, options) {
+	if (boundary.length === 0 || boundary.length > 200) throw new MultipartError(400, "invalid-boundary");
+	const first = Buffer.from("--" + boundary);
+	const delimiter = Buffer.from("\r\n--" + boundary);
+	let buffer = Buffer.alloc(0);
+	let state = "preamble";
+	let part;
+	const append = (chunk) => {
+		if (part === void 0 || chunk.length === 0) return;
+		part.bytes += chunk.length;
+		if (part.tooLarge) return;
+		if (part.bytes > options.maxPartBytes) {
+			part.tooLarge = true;
+			part.chunks = [];
+			return;
+		}
+		part.chunks.push(Buffer.from(chunk));
+	};
+	const finishPart = async () => {
+		if (part === void 0) return;
+		const completed = part;
+		part = void 0;
+		if (completed.name !== "images") return;
+		await options.onPart({
+			name: completed.name,
+			...completed.filename === void 0 ? {} : { filename: completed.filename },
+			...completed.mediaType === void 0 ? {} : { mediaType: completed.mediaType },
+			data: completed.tooLarge ? Buffer.alloc(0) : Buffer.concat(completed.chunks, completed.bytes),
+			tooLarge: completed.tooLarge,
+			bytes: completed.bytes
+		});
+	};
+	const consume = async () => {
+		while (true) {
+			if (state === "done") {
+				buffer = Buffer.alloc(0);
+				return;
+			}
+			if (state === "preamble") {
+				const index = buffer.indexOf(first);
+				if (index === -1) {
+					if (buffer.length > first.length + 4) buffer = buffer.subarray(buffer.length - (first.length + 4));
+					return;
+				}
+				if (buffer.length < index + first.length + 2) return;
+				const suffix = buffer.subarray(index + first.length, index + first.length + 2);
+				if (suffix.equals(DASH)) {
+					state = "done";
+					buffer = Buffer.alloc(0);
+					return;
+				}
+				if (!suffix.equals(CRLF)) throw new MultipartError(400, "invalid-multipart");
+				buffer = buffer.subarray(index + first.length + 2);
+				state = "headers";
+				continue;
+			}
+			if (state === "headers") {
+				const end = buffer.indexOf("\r\n\r\n");
+				if (end === -1) {
+					if (buffer.length > HEADER_LIMIT) throw new MultipartError(400, "invalid-headers");
+					return;
+				}
+				const headerBuffer = buffer.subarray(0, end);
+				buffer = buffer.subarray(end + 4);
+				const headers = parsePartHeaders(headerBuffer);
+				if (headers.name.length === 0) throw new MultipartError(400, "invalid-headers");
+				part = {
+					name: headers.name,
+					...headers.filename === void 0 ? {} : { filename: headers.filename },
+					...headers.mediaType === void 0 ? {} : { mediaType: headers.mediaType },
+					chunks: [],
+					bytes: 0,
+					tooLarge: false
+				};
+				state = "body";
+				continue;
+			}
+			if (state === "body") {
+				const found = findDelimiter(buffer, delimiter);
+				if (found === -1) {
+					const keep = delimiter.length + 2;
+					if (buffer.length > keep) {
+						append(buffer.subarray(0, buffer.length - keep));
+						buffer = buffer.subarray(buffer.length - keep);
+					}
+					return;
+				}
+				append(buffer.subarray(0, found));
+				buffer = buffer.subarray(found + delimiter.length);
+				const suffix = buffer.subarray(0, 2);
+				buffer = buffer.subarray(2);
+				await finishPart();
+				if (suffix.equals(DASH)) {
+					state = "done";
+					buffer = Buffer.alloc(0);
+					return;
+				}
+				if (!suffix.equals(CRLF)) throw new MultipartError(400, "invalid-multipart");
+				state = "headers";
+				continue;
+			}
+		}
+	};
+	for await (const chunk of req) {
+		if (state === "done") continue;
+		const incoming = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+		buffer = buffer.length === 0 ? incoming : Buffer.concat([buffer, incoming]);
+		await consume();
+	}
+	await consume();
+	if (state !== "done") throw new MultipartError(400, "truncated-multipart");
+}
+/** Locate a delimiter whose following two bytes are CRLF or a closing dash. */
+function findDelimiter(buffer, delimiter) {
+	let from = 0;
+	while (true) {
+		const index = buffer.indexOf(delimiter, from);
+		if (index === -1) return -1;
+		if (buffer.length < index + delimiter.length + 2) return -1;
+		const suffix = buffer.subarray(index + delimiter.length, index + delimiter.length + 2);
+		if (suffix.equals(CRLF) || suffix.equals(DASH)) return index;
+		from = index + 1;
+	}
+}
+function parsePartHeaders(raw) {
+	let name = "";
+	let filename;
+	let mediaType;
+	for (const line of raw.toString("utf8").split("\r\n")) {
+		const colon = line.indexOf(":");
+		if (colon === -1) continue;
+		const key = line.slice(0, colon).trim().toLowerCase();
+		const value = line.slice(colon + 1).trim();
+		if (key === "content-disposition") {
+			name = dispositionParam(value, "name") ?? "";
+			filename = dispositionParam(value, "filename");
+		} else if (key === "content-type") mediaType = value.split(";")[0]?.trim() || void 0;
+	}
+	return {
+		name,
+		...filename === void 0 ? {} : { filename },
+		...mediaType === void 0 ? {} : { mediaType }
+	};
+}
+function dispositionParam(value, key) {
+	const params = [];
+	let start = 0;
+	let quoted = false;
+	let escaped = false;
+	for (let index = 0; index < value.length; index += 1) {
+		const char = value[index];
+		if (escaped) {
+			escaped = false;
+			continue;
+		}
+		if (quoted && char === "\\") {
+			escaped = true;
+			continue;
+		}
+		if (char === "\"") {
+			quoted = !quoted;
+			continue;
+		}
+		if (char === ";" && !quoted) {
+			params.push(value.slice(start, index));
+			start = index + 1;
+		}
+	}
+	params.push(value.slice(start));
+	for (const param of params) {
+		const equals = param.indexOf("=");
+		if (equals <= 0 || param.slice(0, equals).trim().toLowerCase() !== key.toLowerCase()) continue;
+		const raw = param.slice(equals + 1).trim();
+		if (raw.length >= 2 && raw.startsWith("\"") && raw.endsWith("\"")) return raw.slice(1, -1).replace(/\\(.)/g, "$1");
+		return raw;
+	}
+}
+//#endregion
 //#region lib/types/import-route.js
 const MAX_IMAGES_PER_REQUEST = 8;
-const BASE64_PATTERN = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
+const BASE64_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+const BASE64_LOOKUP = (() => {
+	const table = /* @__PURE__ */ new Uint8Array(128);
+	for (let index = 0; index < 64; index++) table[BASE64_ALPHABET.charCodeAt(index)] = 1;
+	return table;
+})();
+/**
+* Validate base64 in linear time. A backtracking regexp looks harmless but V8
+* throws RangeError ("Maximum call stack size exceeded") once the input passes
+* a few megabytes, which turned every large import into a bare HTTP 400.
+*/
+function isValidBase64(value) {
+	if (value.length % 4 !== 0) return false;
+	const padding = value.endsWith("==") ? 2 : value.endsWith("=") ? 1 : 0;
+	const end = value.length - padding;
+	for (let index = 0; index < end; index++) {
+		const code = value.charCodeAt(index);
+		if (code > 127 || BASE64_LOOKUP[code] !== 1) return false;
+	}
+	return true;
+}
 /** base64 inflates bytes by 4/3; allow one full batch plus JSON overhead. */
 function bodyLimit(maxImageBytes) {
 	return MAX_IMAGES_PER_REQUEST * Math.ceil(maxImageBytes * 1.4) + 4096;
 }
 async function serveImport(req, res, deps) {
-	if (req.method !== "POST") return jsonError$4(res, 405, "method-not-allowed");
-	if (!(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json")) return jsonError$4(res, 415, "json-required");
+	if (req.method !== "POST") return jsonError$9(res, 405, "method-not-allowed");
 	const origin = req.headers.origin;
 	const host = req.headers.host;
-	if (origin !== void 0 && host !== void 0 && origin !== `http://${host}` && origin !== `https://${host}`) return jsonError$4(res, 403, "origin-rejected");
+	if (origin !== void 0 && host !== void 0 && origin !== `http://${host}` && origin !== `https://${host}`) return jsonError$9(res, 403, "origin-rejected");
+	const contentType = req.headers["content-type"] ?? "";
+	const boundary = multipartBoundary(contentType);
+	if (boundary !== void 0) return serveMultipartImport(req, res, deps, boundary);
+	if (!contentType.toLowerCase().startsWith("application/json")) return jsonError$9(res, 415, "json-required");
 	let body;
 	try {
-		body = JSON.parse(await readBody$3(req, bodyLimit(deps.maxImageBytes)));
+		body = JSON.parse(await readBody$6(req, bodyLimit(deps.maxImageBytes)));
 	} catch {
-		return jsonError$4(res, 400, "invalid-request");
+		return jsonError$9(res, 400, "invalid-request");
 	}
 	const images = typeof body === "object" && body !== null ? body.images : void 0;
-	if (!Array.isArray(images) || images.length === 0 || images.length > MAX_IMAGES_PER_REQUEST) return jsonError$4(res, 400, "invalid-image-count");
+	if (!Array.isArray(images) || images.length === 0 || images.length > MAX_IMAGES_PER_REQUEST) return jsonError$9(res, 400, "invalid-image-count");
 	const saved = [];
 	const failures = [];
-	for (const [index, item] of images.entries()) {
+	for (const [index, item] of images.entries()) try {
 		const record = typeof item === "object" && item !== null ? item : void 0;
 		if (record === void 0 || typeof record.data !== "string" || typeof record.mediaType !== "string") {
 			failures.push({
@@ -8340,7 +8657,7 @@ async function serveImport(req, res, deps) {
 			});
 			continue;
 		}
-		if (!BASE64_PATTERN.test(record.data)) {
+		if (!isValidBase64(record.data)) {
 			failures.push({
 				index,
 				error: "invalid-base64"
@@ -8356,39 +8673,1675 @@ async function serveImport(req, res, deps) {
 			continue;
 		}
 		try {
-			const attachment = await deps.saveImage({
-				data: bytes,
-				mediaType: record.mediaType,
-				...typeof record.name === "string" && record.name.length > 0 ? { name: record.name } : {}
-			});
-			saved.push({ attachment });
+			const persisted = await persistImport(deps, bytes, record.mediaType, record.name);
+			saved.push(persisted);
+			try {
+				deps.warmThumbnail?.(persisted.attachment);
+			} catch {}
 		} catch {
 			failures.push({
 				index,
 				error: "save-failed"
 			});
 		}
+	} catch {
+		failures.push({
+			index,
+			error: "internal-error"
+		});
+	}
+	res.writeHead(200, {
+		"content-type": "application/json",
+		"cache-control": "no-store"
+	});
+	res.end(JSON.stringify({
+		images: saved,
+		failures
+	}));
+}
+async function serveMultipartImport(req, res, deps, boundary) {
+	const saved = [];
+	const failures = [];
+	let tempDir;
+	try {
+		tempDir = await mkdtemp(join(tmpdir(), "dsh-image-import-"));
+		const spooled = [];
+		let index = 0;
+		await readMultipart(req, boundary, {
+			maxPartBytes: deps.maxImageBytes,
+			onPart: async (part) => {
+				const current = index++;
+				if (current >= MAX_IMAGES_PER_REQUEST) {
+					failures.push({
+						index: current,
+						error: "invalid-image-count"
+					});
+					return;
+				}
+				if (part.tooLarge || part.bytes === 0 || part.bytes > deps.maxImageBytes) {
+					failures.push({
+						index: current,
+						error: "size-out-of-range (max " + String(deps.maxImageBytes) + " bytes)"
+					});
+					return;
+				}
+				const declared = part.mediaType !== void 0 && deps.mediaTypes.includes(part.mediaType) ? part.mediaType : mediaTypeFromFilename(part.filename);
+				if (declared === void 0 || !deps.mediaTypes.includes(declared)) {
+					failures.push({
+						index: current,
+						error: "unsupported-media-type: " + (declared ?? "unknown")
+					});
+					return;
+				}
+				const path = join(tempDir, String(current) + ".part");
+				await writeFile(path, part.data);
+				spooled.push({
+					index: current,
+					path,
+					mediaType: declared,
+					...part.filename === void 0 ? {} : { filename: part.filename },
+					bytes: part.bytes
+				});
+			}
+		});
+		for (const part of spooled) try {
+			const persisted = await persistImport(deps, await readFile(part.path), part.mediaType, part.filename);
+			saved.push(persisted);
+			try {
+				deps.warmThumbnail?.(persisted.attachment);
+			} catch {}
+		} catch {
+			failures.push({
+				index: part.index,
+				error: "save-failed"
+			});
+		}
+	} catch (err) {
+		if (err instanceof MultipartError) return jsonError$9(res, err.status, err.code);
+		return jsonError$9(res, 400, "invalid-request");
+	} finally {
+		if (tempDir !== void 0) await rm(tempDir, {
+			recursive: true,
+			force: true
+		}).catch(() => void 0);
+	}
+	if (saved.length === 0 && failures.length === 0) return jsonError$9(res, 400, "invalid-image-count");
+	failures.sort((a, b) => a.index - b.index);
+	res.writeHead(200, {
+		"content-type": "application/json",
+		"cache-control": "no-store"
+	});
+	res.end(JSON.stringify({
+		images: saved,
+		failures
+	}));
+}
+/** Save one image and, when the attachment layer normalized it, keep the raw copy. */
+async function persistImport(deps, bytes, mediaType, name) {
+	const attachment = await deps.saveImage({
+		data: bytes,
+		mediaType,
+		...typeof name === "string" && name.length > 0 ? { name } : {}
+	});
+	let original;
+	if (deps.saveOriginal !== void 0 && (attachment.mediaType !== mediaType || attachment.bytes !== bytes.byteLength)) original = await deps.saveOriginal({
+		data: bytes,
+		mediaType
+	});
+	return {
+		attachment,
+		...original === void 0 ? {} : { original }
+	};
+}
+function multipartBoundary(contentType) {
+	if (!contentType.toLowerCase().startsWith("multipart/form-data")) return void 0;
+	const match = /boundary=(?:"([^"]+)"|([^;]+))/i.exec(contentType);
+	const value = (match?.[1] ?? match?.[2] ?? "").trim();
+	return value.length > 0 ? value : void 0;
+}
+const FILENAME_MEDIA_TYPES = {
+	png: "image/png",
+	jpg: "image/jpeg",
+	jpeg: "image/jpeg",
+	webp: "image/webp",
+	gif: "image/gif"
+};
+function mediaTypeFromFilename(name) {
+	if (name === void 0) return void 0;
+	const dot = name.lastIndexOf(".");
+	if (dot === -1) return void 0;
+	return FILENAME_MEDIA_TYPES[name.slice(dot + 1).toLowerCase()];
+}
+async function readBody$6(req, maxBytes) {
+	const chunks = [];
+	let bytes = 0;
+	for await (const chunk of req) {
+		const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+		bytes += buffer.byteLength;
+		if (bytes > maxBytes) throw new Error("request-too-large");
+		chunks.push(buffer);
+	}
+	return Buffer.concat(chunks).toString("utf8");
+}
+function jsonError$9(res, status, code) {
+	res.writeHead(status, {
+		"content-type": "application/json",
+		"cache-control": "no-store"
+	});
+	res.end(JSON.stringify({ error: code }));
+}
+//#endregion
+//#region lib/types/zip-stream.js
+const LOCAL_HEADER_BYTES = 30;
+const CENTRAL_HEADER_BYTES = 46;
+const END_OF_CENTRAL_BYTES = 22;
+const ZIP64_END_BYTES = 56;
+const ZIP64_LOCATOR_BYTES = 20;
+const ZIP64_EXTRA_ID = 1;
+const ZIP64_VERSION = 45;
+const ZIP32_VERSION = 20;
+const UINT32_MAX = 4294967295;
+const UINT16_MAX = 65535;
+const MAX_ENTRIES = 4294967294;
+/** Raised when the selection cannot be represented even with ZIP64 records. */
+var ZipTooLargeError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "ZipTooLargeError";
+	}
+};
+/**
+* Write a ZIP archive straight to an HTTP response.
+*
+* Images are already compressed, so entries are stored (method 0) and the only
+* CPU work is the CRC — `zlib.crc32` runs in native code. Sizes are known before
+* each header is written, so no data descriptor is needed; entries that cross
+* the ZIP32 limits get ZIP64 extra fields, and the archive ends with a ZIP64
+* end-of-central-directory record when any entry needs one.
+*/
+var ZipStreamWriter = class {
+	res;
+	options;
+	central = [];
+	names = /* @__PURE__ */ new Set();
+	offset = 0;
+	entries = 0;
+	closed = false;
+	zip64Archive = false;
+	constructor(res, options = {}) {
+		this.res = res;
+		this.options = options;
+	}
+	get entryCount() {
+		return this.entries;
+	}
+	get bytesWritten() {
+		return this.offset;
+	}
+	get isClosed() {
+		return this.closed;
+	}
+	/** Stop writing as soon as the browser closes the download. */
+	markClientClosed() {
+		this.closed = true;
+	}
+	/** Append one file entry. */
+	async add(name, data) {
+		if (this.entries >= MAX_ENTRIES) throw new ZipTooLargeError("ZIP export exceeds the entry limit");
+		const safeName = this.uniqueName(name);
+		const nameBytes = Buffer.from(safeName, "utf8");
+		const size = data.byteLength;
+		const checksum = crc32(data);
+		const { time, date } = dosDateTime();
+		const headerOffset = this.offset;
+		const zip64 = this.options.zip64 ?? "auto";
+		const size64 = zip64 === "always" || size >= UINT32_MAX;
+		const offset64 = zip64 === "always" || headerOffset >= UINT32_MAX;
+		if (size64 || offset64) this.zip64Archive = true;
+		const localExtra = size64 ? zip64Extra([size, size]) : Buffer.alloc(0);
+		const version = size64 ? ZIP64_VERSION : ZIP32_VERSION;
+		const local = Buffer.alloc(LOCAL_HEADER_BYTES);
+		local.writeUInt32LE(67324752, 0);
+		local.writeUInt16LE(version, 4);
+		local.writeUInt16LE(2048, 6);
+		local.writeUInt16LE(0, 8);
+		local.writeUInt16LE(time, 10);
+		local.writeUInt16LE(date, 12);
+		local.writeUInt32LE(checksum, 14);
+		local.writeUInt32LE(size64 ? UINT32_MAX : size, 18);
+		local.writeUInt32LE(size64 ? UINT32_MAX : size, 22);
+		local.writeUInt16LE(nameBytes.length, 26);
+		local.writeUInt16LE(localExtra.length, 28);
+		await this.write(local);
+		await this.write(nameBytes);
+		if (localExtra.length > 0) await this.write(localExtra);
+		await this.write(data);
+		this.central.push(this.centralRecord({
+			nameBytes,
+			checksum,
+			size,
+			headerOffset,
+			size64,
+			offset64,
+			time,
+			date
+		}));
+		this.entries += 1;
+	}
+	/** Write the central directory and finish the response. */
+	async finish() {
+		const centralOffset = this.offset;
+		let centralSize = 0;
+		for (const record of this.central) centralSize += record.byteLength;
+		const zip64 = this.zip64Archive || this.entries > UINT16_MAX || centralOffset >= UINT32_MAX || centralSize >= UINT32_MAX;
+		if (zip64) this.zip64Archive = true;
+		for (const record of this.central) await this.write(record);
+		if (zip64) {
+			const zip64Offset = this.offset;
+			const end64 = Buffer.alloc(ZIP64_END_BYTES);
+			end64.writeUInt32LE(101075792, 0);
+			end64.writeBigUInt64LE(44n, 4);
+			end64.writeUInt16LE(ZIP64_VERSION, 12);
+			end64.writeUInt16LE(ZIP64_VERSION, 14);
+			end64.writeUInt32LE(0, 16);
+			end64.writeUInt32LE(0, 20);
+			end64.writeBigUInt64LE(BigInt(this.entries), 24);
+			end64.writeBigUInt64LE(BigInt(this.entries), 32);
+			end64.writeBigUInt64LE(BigInt(centralSize), 40);
+			end64.writeBigUInt64LE(BigInt(centralOffset), 48);
+			await this.write(end64);
+			const locator = Buffer.alloc(ZIP64_LOCATOR_BYTES);
+			locator.writeUInt32LE(117853008, 0);
+			locator.writeUInt32LE(0, 4);
+			locator.writeBigUInt64LE(BigInt(zip64Offset), 8);
+			locator.writeUInt32LE(1, 16);
+			await this.write(locator);
+		}
+		const end = Buffer.alloc(END_OF_CENTRAL_BYTES);
+		end.writeUInt32LE(101010256, 0);
+		end.writeUInt16LE(0, 4);
+		end.writeUInt16LE(0, 6);
+		end.writeUInt16LE(zip64 ? UINT16_MAX : this.entries, 8);
+		end.writeUInt16LE(zip64 ? UINT16_MAX : this.entries, 10);
+		end.writeUInt32LE(zip64 ? UINT32_MAX : centralSize, 12);
+		end.writeUInt32LE(zip64 ? UINT32_MAX : centralOffset, 16);
+		end.writeUInt16LE(0, 20);
+		await this.write(end);
+		this.res.end();
+	}
+	centralRecord(entry) {
+		const extraValues = [...entry.size64 ? [entry.size, entry.size] : [], ...entry.offset64 ? [entry.headerOffset] : []];
+		const extra = extraValues.length > 0 ? zip64Extra(extraValues) : Buffer.alloc(0);
+		const central = Buffer.alloc(CENTRAL_HEADER_BYTES);
+		central.writeUInt32LE(33639248, 0);
+		central.writeUInt16LE(entry.size64 || entry.offset64 ? ZIP64_VERSION : ZIP32_VERSION, 4);
+		central.writeUInt16LE(entry.size64 || entry.offset64 ? ZIP64_VERSION : ZIP32_VERSION, 6);
+		central.writeUInt16LE(2048, 8);
+		central.writeUInt16LE(0, 10);
+		central.writeUInt16LE(entry.time, 12);
+		central.writeUInt16LE(entry.date, 14);
+		central.writeUInt32LE(entry.checksum, 16);
+		central.writeUInt32LE(entry.size64 ? UINT32_MAX : entry.size, 20);
+		central.writeUInt32LE(entry.size64 ? UINT32_MAX : entry.size, 24);
+		central.writeUInt16LE(entry.nameBytes.length, 28);
+		central.writeUInt16LE(extra.length, 30);
+		central.writeUInt16LE(0, 32);
+		central.writeUInt16LE(0, 34);
+		central.writeUInt16LE(0, 36);
+		central.writeUInt32LE(0, 38);
+		central.writeUInt32LE(entry.offset64 ? UINT32_MAX : entry.headerOffset, 42);
+		return Buffer.concat([
+			central,
+			entry.nameBytes,
+			extra
+		]);
+	}
+	async write(chunk) {
+		if (this.closed) throw new Error("client closed the download");
+		if (this.offset + chunk.byteLength > (this.options.maxBytes ?? Number.POSITIVE_INFINITY)) throw new ZipTooLargeError("ZIP export exceeds the archive byte limit");
+		this.offset += chunk.byteLength;
+		if (this.res.write(chunk)) return;
+		await new Promise((resolve, reject) => {
+			const cleanup = () => {
+				this.res.off("drain", onDrain);
+				this.res.off("close", onClose);
+			};
+			const onDrain = () => {
+				cleanup();
+				resolve();
+			};
+			const onClose = () => {
+				cleanup();
+				reject(/* @__PURE__ */ new Error("client closed the download"));
+			};
+			this.res.once("drain", onDrain);
+			this.res.once("close", onClose);
+		});
+	}
+	uniqueName(raw) {
+		const cleaned = sanitizeName(raw);
+		if (!this.names.has(cleaned)) {
+			this.names.add(cleaned);
+			return cleaned;
+		}
+		const dot = cleaned.lastIndexOf(".");
+		const stem = dot > 0 ? cleaned.slice(0, dot) : cleaned;
+		const extension = dot > 0 ? cleaned.slice(dot) : "";
+		let suffix = 1;
+		let candidate = cleaned;
+		while (this.names.has(candidate)) {
+			candidate = stem + "-" + suffix + extension;
+			suffix += 1;
+		}
+		this.names.add(candidate);
+		return candidate;
+	}
+};
+/** Encode a ZIP64 extra field: id, size, then one or more 8-byte values. */
+function zip64Extra(values) {
+	const body = Buffer.alloc(values.length * 8);
+	values.forEach((value, index) => body.writeBigUInt64LE(BigInt(value), index * 8));
+	const extra = Buffer.alloc(4 + body.length);
+	extra.writeUInt16LE(ZIP64_EXTRA_ID, 0);
+	extra.writeUInt16LE(body.length, 2);
+	body.copy(extra, 4);
+	return extra;
+}
+/** Keep download names portable: no paths, no control characters, bounded length. */
+function sanitizeName(raw) {
+	const cleaned = (raw.split(/[\\/]/).pop() ?? "image").replace(/[^A-Za-z0-9._@-]+/g, "_").replace(/^[._]+/, "").slice(0, 120);
+	return cleaned.length > 0 ? cleaned : "image";
+}
+function dosDateTime(when = /* @__PURE__ */ new Date()) {
+	return {
+		time: when.getHours() << 11 | when.getMinutes() << 5 | Math.floor(when.getSeconds() / 2),
+		date: (Math.max(when.getFullYear() - 1980, 0) << 9 | when.getMonth() + 1 << 5 | when.getDate()) & 65535
+	};
+}
+//#endregion
+//#region lib/types/zip-progress.js
+const jobs = /* @__PURE__ */ new Map();
+const TOKEN_PATTERN = /^[A-Za-z0-9_-]{8,64}$/;
+const JOB_TTL_MS = 6e5;
+/** Tokens are client-generated identifiers; anything else is ignored. */
+function isValidZipToken(token) {
+	return TOKEN_PATTERN.test(token);
+}
+function notify(job) {
+	job.updatedAt = Date.now();
+	for (const listener of [...job.listeners]) listener();
+}
+function prune() {
+	const cutoff = Date.now() - JOB_TTL_MS;
+	for (const [token, job] of jobs) if (job.updatedAt < cutoff) jobs.delete(token);
+}
+function ensureJob(token) {
+	if (!isValidZipToken(token)) return void 0;
+	let job = jobs.get(token);
+	if (job === void 0) {
+		prune();
+		job = {
+			token,
+			total: 0,
+			done: 0,
+			state: "running",
+			cancelled: false,
+			listeners: /* @__PURE__ */ new Set(),
+			updatedAt: Date.now()
+		};
+		jobs.set(token, job);
+	}
+	return job;
+}
+/** The SSE listener may connect first; createZipJob then fills in the total. */
+function createZipJob(token, total) {
+	const job = ensureJob(token);
+	if (job === void 0) return;
+	job.total = total;
+	job.done = 0;
+	job.state = "running";
+	notify(job);
+}
+function updateZipJob(token, done) {
+	const job = jobs.get(token);
+	if (job === void 0 || job.state !== "running") return;
+	job.done = Math.max(job.done, done);
+	notify(job);
+}
+function finishZipJob(token, state) {
+	const job = jobs.get(token);
+	if (job === void 0 || job.state !== "running") return;
+	job.state = state;
+	if (state === "done") job.done = job.total;
+	notify(job);
+	for (const listener of [...job.listeners]) job.listeners.delete(listener);
+}
+function isZipJobCancelled(token) {
+	return jobs.get(token)?.cancelled === true;
+}
+function cancelZipJob(token) {
+	const job = jobs.get(token);
+	if (job === void 0) return false;
+	if (job.state !== "running") return false;
+	job.cancelled = true;
+	notify(job);
+	return true;
+}
+/**
+* Server-sent events for one export: the client keeps the fast iframe download
+* and still sees "N/M" progress plus completion.
+*/
+function serveZipProgress(req, res) {
+	if (req.method !== "GET") return jsonError$8(res, 405, "method-not-allowed");
+	const job = ensureJob(new URL(req.url ?? "/", "http://x").searchParams.get("token") ?? "");
+	if (job === void 0) return jsonError$8(res, 404, "unknown-job");
+	res.writeHead(200, {
+		"content-type": "text/event-stream; charset=utf-8",
+		"cache-control": "no-store",
+		connection: "keep-alive",
+		"x-accel-buffering": "no"
+	});
+	const send = () => {
+		if (res.writableEnded) return;
+		res.write("event: progress\ndata: " + JSON.stringify({
+			done: job.done,
+			total: job.total,
+			state: job.state
+		}) + "\n\n");
+		if (job.state !== "running") {
+			job.listeners.delete(send);
+			res.end();
+		}
+	};
+	send();
+	if (job.state === "running") {
+		job.listeners.add(send);
+		const heartbeat = setInterval(() => {
+			if (!res.writableEnded) res.write(": ping\n\n");
+		}, 15e3);
+		heartbeat.unref?.();
+		res.on("close", () => {
+			clearInterval(heartbeat);
+			job.listeners.delete(send);
+		});
+	}
+}
+/** Stop an in-flight export; the ZIP response is destroyed so the download fails. */
+function serveZipCancel(req, res) {
+	if (req.method !== "POST") return jsonError$8(res, 405, "method-not-allowed");
+	const ok = cancelZipJob(new URL(req.url ?? "/", "http://x").searchParams.get("token") ?? "");
+	res.writeHead(200, {
+		"content-type": "application/json; charset=utf-8",
+		"cache-control": "no-store"
+	});
+	res.end(JSON.stringify({ ok }));
+}
+function jsonError$8(res, status, code) {
+	res.writeHead(status, {
+		"content-type": "application/json; charset=utf-8",
+		"cache-control": "no-store"
+	});
+	res.end(JSON.stringify({ error: code }));
+}
+//#endregion
+//#region lib/types/vault-store.js
+/** Content-addressed store for original image bytes the attachment layer normalized. */
+const EXTENSION = {
+	"image/png": "png",
+	"image/jpeg": "jpg",
+	"image/webp": "webp",
+	"image/gif": "gif"
+};
+const MEDIA_TYPE = {
+	png: "image/png",
+	jpg: "image/jpeg",
+	webp: "image/webp",
+	gif: "image/gif"
+};
+function resolveDshHome$1(home) {
+	return home?.trim() || process.env.DSH_HOME?.trim() || join(homedir(), ".dsh");
+}
+function resolveVaultDir(home) {
+	return join(resolveDshHome$1(home), "image-gen", "vault");
+}
+/** Resolve a configured vault path; relative values stay below the DSH home, not the process cwd. */
+function resolveVaultPath(configured, home) {
+	const value = configured.trim();
+	if (value.length === 0) return resolveVaultDir(home);
+	return isAbsolute(value) ? value : join(resolveDshHome$1(home), value);
+}
+function isValidVaultKey(key) {
+	return VAULT_KEY_PATTERN.test(key);
+}
+/** Vault settings as configured: off only when explicitly disabled; a relative dir stays below the DSH home. */
+function vaultConfigOf(config) {
+	return {
+		enabled: config.vaultEnabled !== false,
+		dir: resolveVaultPath(config.vaultDir ?? "")
+	};
+}
+/** Persist one original file; the same bytes are shared through content addressing. */
+async function saveOriginal(config, input) {
+	if (!config.enabled) return void 0;
+	const extension = EXTENSION[input.mediaType];
+	if (extension === void 0) return void 0;
+	const key = createHash("sha256").update(input.data).digest("hex");
+	const target = join(config.dir, key.slice(0, 2), key + "." + extension);
+	try {
+		const existing = await stat(target);
+		if (existing.size === input.data.byteLength) return {
+			key,
+			bytes: existing.size,
+			mediaType: input.mediaType
+		};
+	} catch {}
+	await mkdir(dirname(target), { recursive: true });
+	const temporary = target + ".tmp-" + randomUUID();
+	try {
+		await writeFile(temporary, input.data);
+		await rename(temporary, target);
+	} catch (err) {
+		await unlink(temporary).catch(() => void 0);
+		throw err;
+	}
+	return {
+		key,
+		bytes: input.data.byteLength,
+		mediaType: input.mediaType
+	};
+}
+async function readOriginal(config, key, preferredMediaType) {
+	if (!config.enabled || !isValidVaultKey(key)) return void 0;
+	const preferred = preferredMediaType === void 0 ? void 0 : EXTENSION[preferredMediaType];
+	const all = Object.entries(MEDIA_TYPE);
+	const candidates = preferred === void 0 ? all : [[preferred, preferredMediaType], ...all.filter(([extension]) => extension !== preferred)];
+	for (const [extension, mediaType] of candidates) try {
+		return {
+			data: await readFile(join(config.dir, key.slice(0, 2), key + "." + extension)),
+			mediaType
+		};
+	} catch {}
+}
+async function listVaultKeys(config) {
+	return (await listVaultFiles(config)).map((file) => file.key);
+}
+async function deleteVaultKeys(config, keys) {
+	if (!config.enabled) return {
+		removed: 0,
+		bytes: 0
+	};
+	const targets = /* @__PURE__ */ new Set();
+	for (const key of keys) if (isValidVaultKey(key)) targets.add(key);
+	if (targets.size === 0) return {
+		removed: 0,
+		bytes: 0
+	};
+	const files = await listVaultFiles(config);
+	let removed = 0;
+	let bytes = 0;
+	for (const file of files) {
+		if (!targets.has(file.key)) continue;
+		try {
+			await unlink(file.path);
+			removed += 1;
+			bytes += file.bytes;
+		} catch {}
+	}
+	await removeEmptyShards(config);
+	return {
+		removed,
+		bytes
+	};
+}
+async function removeEmptyShards(config) {
+	try {
+		for (const shard of await readdir(config.dir, { withFileTypes: true })) {
+			if (!shard.isDirectory() || !/^[a-f0-9]{2}$/.test(shard.name)) continue;
+			try {
+				await rmdir(join(config.dir, shard.name));
+			} catch {}
+		}
+	} catch {}
+}
+async function listVaultFiles(config) {
+	const files = [];
+	try {
+		for (const shard of await readdir(config.dir, { withFileTypes: true })) {
+			if (!shard.isDirectory() || !/^[a-f0-9]{2}$/.test(shard.name)) continue;
+			for (const entry of await readdir(join(config.dir, shard.name), { withFileTypes: true })) {
+				if (!entry.isFile()) continue;
+				const dot = entry.name.lastIndexOf(".");
+				const key = dot > 0 ? entry.name.slice(0, dot) : entry.name;
+				if (!isValidVaultKey(key)) continue;
+				const path = join(config.dir, shard.name, entry.name);
+				try {
+					const info = await stat(path);
+					files.push({
+						path,
+						key,
+						bytes: info.size,
+						mtimeMs: info.mtimeMs
+					});
+				} catch {}
+			}
+		}
+	} catch {
+		return [];
+	}
+	return files;
+}
+/** Delete only the explicitly requested originals; callers must prove they are unreferenced. */
+//#endregion
+//#region lib/types/zip-route.js
+const DEFAULT_MAX_ENTRIES = 2e3;
+const DEFAULT_MAX_BODY_BYTES = 4194304;
+/** Sanity ceiling: ZIP64 removed the 4 GiB cap, not an accidental 2000 × 40 GiB. */
+const MAX_ARCHIVE_BYTES = 68719476736;
+const IMAGE_EXTENSIONS = {
+	"image/png": "png",
+	"image/jpeg": "jpg",
+	"image/webp": "webp",
+	"image/gif": "gif"
+};
+/**
+* Package selected gallery images into one ZIP and stream it to the browser.
+*
+* The request is a plain form post (`items` = JSON array of {name, attachment}),
+* so the renderer never builds the archive: the browser download manager owns
+* the transfer while this route reads attachments one at a time.
+*/
+async function serveZip(req, res, deps) {
+	if (req.method !== "POST") return jsonError$7(res, 405, "method-not-allowed");
+	if (!(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/x-www-form-urlencoded")) return jsonError$7(res, 415, "form-required");
+	if (!sameOrigin$7(req)) return jsonError$7(res, 403, "origin-rejected");
+	const queryToken = new URL(req.url ?? "/", "http://x").searchParams.get("token") ?? "";
+	let jobToken = isValidZipToken(queryToken) ? queryToken : "";
+	const fail = (status, code) => {
+		if (jobToken !== "") {
+			createZipJob(jobToken, 0);
+			finishZipJob(jobToken, "error");
+		}
+		jsonError$7(res, status, code);
+	};
+	let body;
+	try {
+		body = await readBody$5(req, deps.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES);
+	} catch {
+		return fail(413, "request-too-large");
+	}
+	const params = new URLSearchParams(body);
+	const tokenParam = params.get("token") ?? "";
+	if (jobToken === "" && isValidZipToken(tokenParam)) jobToken = tokenParam;
+	const rawItems = params.get("items");
+	if (rawItems === null) return fail(400, "invalid-request");
+	let parsed;
+	try {
+		parsed = JSON.parse(rawItems);
+	} catch {
+		return fail(400, "invalid-request");
+	}
+	if (!Array.isArray(parsed)) return fail(400, "invalid-request");
+	const items = [];
+	for (const entry of parsed) {
+		const record = typeof entry === "object" && entry !== null && !Array.isArray(entry) ? entry : void 0;
+		const attachment = parseImageAttachmentRef(record?.attachment);
+		if (attachment === void 0) continue;
+		items.push({
+			attachment,
+			...typeof record?.name === "string" ? { name: record.name } : {},
+			...typeof record?.originalKey === "string" && isValidVaultKey(record.originalKey) ? { originalKey: record.originalKey } : {},
+			...typeof record?.originalMediaType === "string" ? { originalMediaType: record.originalMediaType } : {}
+		});
+	}
+	if (items.length === 0) return fail(400, "no-attachments");
+	const maxEntries = deps.maxEntries ?? DEFAULT_MAX_ENTRIES;
+	if (items.length > maxEntries) return fail(413, "too-many-attachments");
+	let declaredBytes = 0;
+	for (const item of items) declaredBytes += item.attachment.bytes;
+	const maxArchiveBytes = deps.maxArchiveBytes ?? MAX_ARCHIVE_BYTES;
+	if (declaredBytes > maxArchiveBytes) return fail(413, "archive-too-large");
+	if (jobToken !== "") createZipJob(jobToken, items.length);
+	const filename = "dsh-gallery-" + (/* @__PURE__ */ new Date()).toISOString().slice(0, 10).replace(/-/g, "") + ".zip";
+	res.writeHead(200, {
+		"content-type": "application/zip",
+		"content-disposition": "attachment; filename=\"" + filename + "\"",
+		"cache-control": "no-store",
+		"x-content-type-options": "nosniff"
+	});
+	const zip = new ZipStreamWriter(res, { maxBytes: maxArchiveBytes });
+	const skipped = [];
+	const onClose = () => {
+		if (res.writableFinished) return;
+		zip.markClientClosed();
+		if (jobToken !== "") finishZipJob(jobToken, "cancelled");
+	};
+	res.on("close", onClose);
+	const stopped = () => {
+		if (zip.isClosed) return true;
+		if (jobToken !== "" && isZipJobCancelled(jobToken)) {
+			finishZipJob(jobToken, "cancelled");
+			res.destroy();
+			return true;
+		}
+		return false;
+	};
+	try {
+		for (let index = 0; index < items.length; index += 1) {
+			if (stopped()) return;
+			const item = items[index];
+			let original;
+			if (item.originalKey !== void 0 && deps.readVault !== void 0) {
+				try {
+					original = await deps.readVault(item.originalKey, item.originalMediaType);
+				} catch {
+					original = void 0;
+				}
+				if (stopped()) return;
+			}
+			const mediaType = original?.mediaType ?? item.attachment.mediaType;
+			const extension = IMAGE_EXTENSIONS[mediaType] ?? "png";
+			const fallback = "dsh-" + String(item.attachment.attachmentId).replace(/^sha256:/, "").slice(0, 8) + "." + extension;
+			const entryName = item.name === void 0 ? fallback : original === void 0 ? replaceExtension(item.name, extension) : item.name;
+			try {
+				if (original !== void 0) await zip.add(entryName, Buffer.from(original.data));
+				else {
+					const stored = await deps.readImage(item.attachment);
+					if (stopped()) return;
+					await zip.add(entryName, Buffer.from(stored.data));
+				}
+			} catch (err) {
+				if (isClosed(zip, err)) return;
+				if (err instanceof ZipTooLargeError) throw err;
+				skipped.push(String(item.attachment.attachmentId) + "	" + (err instanceof Error ? err.message : "unavailable"));
+			}
+			if (jobToken !== "") updateZipJob(jobToken, index + 1);
+		}
+		if (skipped.length > 0) {
+			if (stopped()) return;
+			await zip.add("skipped.txt", Buffer.from(skipped.join("\n") + "\n", "utf8"));
+		}
+		if (stopped()) return;
+		await zip.finish();
+		await waitForResponseFinish(res);
+		if (jobToken !== "") finishZipJob(jobToken, "done");
+	} catch (err) {
+		if (isClosed(zip, err)) return;
+		if (jobToken !== "") finishZipJob(jobToken, "error");
+		if (!res.headersSent) {
+			jsonError$7(res, err instanceof ZipTooLargeError ? 413 : 500, err instanceof ZipTooLargeError ? "archive-too-large" : "zip-failed");
+			return;
+		}
+		res.destroy(err instanceof Error ? err : void 0);
+	} finally {
+		res.off("close", onClose);
+	}
+}
+function waitForResponseFinish(res) {
+	if (res.writableFinished) return Promise.resolve();
+	if (res.destroyed) return Promise.reject(/* @__PURE__ */ new Error("client closed the download"));
+	return new Promise((resolve, reject) => {
+		const cleanup = () => {
+			res.off("finish", onFinish);
+			res.off("close", onClose);
+		};
+		const onFinish = () => {
+			cleanup();
+			resolve();
+		};
+		const onClose = () => {
+			cleanup();
+			reject(/* @__PURE__ */ new Error("client closed the download"));
+		};
+		res.once("finish", onFinish);
+		res.once("close", onClose);
+	});
+}
+function replaceExtension(name, extension) {
+	const slash = Math.max(name.lastIndexOf("/"), name.lastIndexOf("\\"));
+	const dot = name.lastIndexOf(".");
+	return dot <= slash ? name + "." + extension : name.slice(0, dot) + "." + extension;
+}
+function isClosed(zip, err) {
+	return zip.isClosed || err instanceof Error && err.message === "client closed the download";
+}
+function sameOrigin$7(req) {
+	const origin = req.headers.origin;
+	const host = req.headers.host;
+	if (origin !== void 0 && host !== void 0 && origin !== "http://" + host && origin !== "https://" + host) return false;
+	return true;
+}
+async function readBody$5(req, limit) {
+	const chunks = [];
+	let bytes = 0;
+	for await (const chunk of req) {
+		const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+		bytes += buffer.byteLength;
+		if (bytes > limit) throw new Error("request too large");
+		chunks.push(buffer);
+	}
+	return Buffer.concat(chunks).toString("utf8");
+}
+function jsonError$7(res, status, code) {
+	res.writeHead(status, {
+		"content-type": "application/json; charset=utf-8",
+		"cache-control": "no-store"
+	});
+	res.end(JSON.stringify({ error: code }));
+}
+/** The cache layout is <dir>/<2 hex>/<variant hash>; two levels are enough. */
+const MAX_DEPTH = 2;
+/** Resolve the default cache root below DSH_HOME. */
+function resolveRequestImageCacheDir(home) {
+	const root = home?.trim() || process.env.DSH_HOME?.trim() || join(homedir(), ".dsh");
+	return join(root, "cache", "attachments", "request-images");
+}
+/** Durable attachment objects; never a pruning target, even via a broad override. */
+function durableAttachmentsRoot() {
+	return join(process.env.DSH_HOME?.trim() || join(homedir(), ".dsh"), "attachments");
+}
+function comparable(path) {
+	const resolved = resolve(path);
+	return process.platform === "win32" ? resolved.toLowerCase() : resolved;
+}
+function isWithin(path, root) {
+	return path === root || path.startsWith(root + sep);
+}
+/** Resolve through junctions/symlinks, falling back to the nearest existing ancestor. */
+async function canonicalPath(path) {
+	let probe = resolve(path);
+	const suffix = [];
+	while (true) try {
+		const real = await realpath(probe);
+		return comparable(join(real, ...suffix.reverse()));
+	} catch {
+		const parent = dirname(probe);
+		if (parent === probe) return comparable(resolve(path));
+		suffix.push(basename(probe));
+		probe = parent;
+	}
+}
+async function overlapsProtectedRoot(target, roots) {
+	for (const root of roots) {
+		const protectedRoot = await canonicalPath(root);
+		if (target === protectedRoot || isWithin(target, protectedRoot) || isWithin(protectedRoot, target)) return true;
+	}
+	return false;
+}
+/**
+* Remove stale request-image variants.
+*
+* The attachment backend writes one file per (attachment, target) variant and
+* never cleans them up itself, so a gallery full of 320 px thumbnails grows it
+* without bound. Deletion is safe: variants are deterministic and regenerated
+* on demand, so removing an entry only costs one sharp pass next time.
+*/
+async function pruneRequestImageCache(options) {
+	const ttlMs = options.ttlMs ?? 12096e5;
+	const maxBytes = options.maxBytes ?? 268435456;
+	const keepMs = options.keepMs ?? 36e5;
+	const now = options.now ?? Date.now();
+	const protectedRoots = options.protectedRoots ?? [durableAttachmentsRoot()];
+	const cacheRoot = await canonicalPath(options.dir);
+	if (await overlapsProtectedRoot(cacheRoot, protectedRoots)) return {
+		scanned: 0,
+		removed: 0,
+		freedBytes: 0,
+		remainingBytes: 0
+	};
+	const files = [];
+	await collect(options.dir, 0, files, cacheRoot);
+	let remainingBytes = files.reduce((sum, file) => sum + file.bytes, 0);
+	const protectedAfter = now - keepMs;
+	const expiredBefore = now - ttlMs;
+	const doomed = /* @__PURE__ */ new Set();
+	for (const file of files) if (file.mtimeMs < expiredBefore && file.mtimeMs < protectedAfter) {
+		doomed.add(file.path);
+		remainingBytes -= file.bytes;
+	}
+	if (maxBytes > 0 && remainingBytes > maxBytes) {
+		const candidates = files.filter((file) => !doomed.has(file.path) && file.mtimeMs < protectedAfter).sort((a, b) => a.mtimeMs - b.mtimeMs);
+		for (const file of candidates) {
+			if (remainingBytes <= maxBytes) break;
+			doomed.add(file.path);
+			remainingBytes -= file.bytes;
+		}
+	}
+	let removed = 0;
+	let freedBytes = 0;
+	for (const file of files) {
+		if (!doomed.has(file.path)) continue;
+		try {
+			const latest = await lstat(file.path);
+			if (latest.isSymbolicLink() || !latest.isFile() || !isWithin(await canonicalPath(file.path), cacheRoot)) {
+				remainingBytes += file.bytes;
+				continue;
+			}
+			await unlink(file.path);
+			removed += 1;
+			freedBytes += file.bytes;
+		} catch {
+			remainingBytes += file.bytes;
+		}
+	}
+	return {
+		scanned: files.length,
+		removed,
+		freedBytes,
+		remainingBytes
+	};
+}
+async function collect(dir, depth, out, cacheRoot) {
+	let entries;
+	try {
+		entries = await readdir(dir, { withFileTypes: true });
+	} catch {
+		return;
+	}
+	for (const entry of entries) {
+		const path = join(dir, entry.name);
+		let info;
+		try {
+			info = await lstat(path);
+		} catch {
+			continue;
+		}
+		if (info.isSymbolicLink()) continue;
+		if (info.isDirectory()) {
+			if (depth >= MAX_DEPTH) continue;
+			if (!isWithin(await canonicalPath(path), cacheRoot)) continue;
+			await collect(path, depth + 1, out, cacheRoot);
+			continue;
+		}
+		if (!info.isFile()) continue;
+		if (!isWithin(await canonicalPath(path), cacheRoot)) continue;
+		try {
+			const latest = await stat(path);
+			out.push({
+				path,
+				bytes: latest.size,
+				mtimeMs: latest.mtimeMs
+			});
+		} catch {}
+	}
+}
+function resolveDshHome() {
+	return process.env.DSH_HOME?.trim() || join(homedir(), ".dsh");
+}
+function resolveAttachmentsRoot(home = resolveDshHome()) {
+	return join(home, "attachments", "v1", "objects");
+}
+async function scanTree(root) {
+	try {
+		const entries = await readdir(root, {
+			recursive: true,
+			withFileTypes: true
+		});
+		const files = [];
+		let bytes = 0;
+		for (const entry of entries) {
+			if (!entry.isFile()) continue;
+			const parent = entry.parentPath ?? root;
+			try {
+				const info = await stat(join(parent, entry.name));
+				bytes += info.size;
+				files.push({
+					name: entry.name,
+					bytes: info.size
+				});
+			} catch {}
+		}
+		return {
+			count: files.length,
+			bytes,
+			files
+		};
+	} catch {
+		return {
+			count: 0,
+			bytes: 0,
+			files: []
+		};
+	}
+}
+let baseCache = null;
+async function collectStorageStats(attachmentIds, options = {}) {
+	const now = options.now ?? Date.now();
+	const ttl = options.ttlMs ?? 6e5;
+	const injected = options.attachmentsRoot !== void 0;
+	const attachmentsRoot = options.attachmentsRoot ?? resolveAttachmentsRoot();
+	const requestImagesRoot = options.requestImagesRoot ?? resolveRequestImageCacheDir(resolveDshHome());
+	if (!injected && baseCache !== null && baseCache.requestImagesRoot === requestImagesRoot && now - baseCache.at < ttl) return buildStats(baseCache.attachments, baseCache.requestImages, attachmentIds, now);
+	const [attachments, requestImages] = await Promise.all([scanTree(attachmentsRoot), scanTree(requestImagesRoot)]);
+	if (!injected) baseCache = {
+		at: now,
+		attachments,
+		requestImages,
+		requestImagesRoot
+	};
+	return buildStats(attachments, requestImages, attachmentIds, now);
+}
+function buildStats(attachments, requestImages, attachmentIds, now) {
+	const refs = /* @__PURE__ */ new Set();
+	for (const id of attachmentIds) {
+		const value = String(id);
+		refs.add(value);
+		refs.add(value.replace(/^sha256:/, ""));
+	}
+	const orphans = attachments.files.filter((file) => !refs.has(file.name) && !refs.has("sha256:" + file.name)).map((file) => ({
+		id: "sha256:" + file.name,
+		bytes: file.bytes
+	}));
+	return {
+		attachments: {
+			count: attachments.count,
+			bytes: attachments.bytes
+		},
+		requestImages: {
+			count: requestImages.count,
+			bytes: requestImages.bytes
+		},
+		orphans: {
+			count: orphans.length,
+			bytes: orphans.reduce((sum, entry) => sum + entry.bytes, 0),
+			ids: orphans.map((entry) => entry.id)
+		},
+		scannedAt: now
+	};
+}
+/** POST {attachmentIds: string[]} -> read-only usage numbers. */
+async function serveStorageStats(req, res, deps = {}) {
+	if (req.method !== "POST") return jsonError$6(res, 405, "method-not-allowed");
+	if (!sameOrigin$6(req)) return jsonError$6(res, 403, "origin-rejected");
+	let body;
+	try {
+		body = await readBody$4(req, 2097152);
+	} catch {
+		return jsonError$6(res, 413, "request-too-large");
+	}
+	let parsed;
+	try {
+		parsed = JSON.parse(body);
+	} catch {
+		return jsonError$6(res, 400, "invalid-request");
+	}
+	const ids = parsed?.attachmentIds;
+	if (!Array.isArray(ids)) return jsonError$6(res, 400, "invalid-request");
+	const stats = await collectStorageStats(ids.filter((id) => typeof id === "string"), deps.requestImagesRoot === void 0 ? {} : { requestImagesRoot: deps.requestImagesRoot });
+	res.writeHead(200, {
+		"content-type": "application/json; charset=utf-8",
+		"cache-control": "no-store"
+	});
+	res.end(JSON.stringify(stats));
+}
+function sameOrigin$6(req) {
+	const origin = req.headers.origin;
+	const host = req.headers.host;
+	if (origin !== void 0 && host !== void 0 && origin !== "http://" + host && origin !== "https://" + host) return false;
+	return true;
+}
+async function readBody$4(req, limit) {
+	const chunks = [];
+	let bytes = 0;
+	for await (const chunk of req) {
+		const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+		bytes += buffer.byteLength;
+		if (bytes > limit) throw new Error("request too large");
+		chunks.push(buffer);
+	}
+	return Buffer.concat(chunks).toString("utf8");
+}
+function jsonError$6(res, status, code) {
+	res.writeHead(status, {
+		"content-type": "application/json; charset=utf-8",
+		"cache-control": "no-store"
+	});
+	res.end(JSON.stringify({ error: code }));
+}
+//#endregion
+//#region lib/types/gif-info.js
+/**
+* Frame count, timing and size of a GIF, read from its block structure, plus
+* a speed change that rewrites only the frame delays: no decoding, no node
+* imports, so the browser bundle shares it.
+*/
+/**
+* Read every frame's delay. Returns undefined for anything that is not a GIF
+* with at least one intact frame: callers only decorate a successful result
+* with these facts, so a parse failure must never fail the image.
+*/
+function readGifInfo(bytes) {
+	const delaysMs = [];
+	return walkGif(bytes, (delayMs) => {
+		delaysMs.push(delayMs);
+	}) && delaysMs.length > 0 ? {
+		frames: delaysMs.length,
+		delaysMs,
+		width: u16(bytes, 6),
+		height: u16(bytes, 8)
+	} : void 0;
+}
+/** The most common frame delay (the first one on a tie); 0 without frames. */
+function gifFrameDurationMs(delaysMs) {
+	const counts = /* @__PURE__ */ new Map();
+	for (const delay of delaysMs) counts.set(delay, (counts.get(delay) ?? 0) + 1);
+	let winner = delaysMs[0] ?? 0;
+	for (const [delay, count] of counts) if (count > (counts.get(winner) ?? 0)) winner = delay;
+	return winner;
+}
+/**
+* Walk the block sequence after the header and report each image descriptor
+* with the delay of the Graphic Control Extension that precedes it (and the
+* byte offset of that delay field, when there is one). The walk follows block
+* lengths instead of scanning for byte patterns because the LZW payload can
+* contain anything, including a fake `0x21 0xF9`. Returns true when every
+* block was intact: a missing trailer byte is tolerated, as decoders tolerate
+* it, but a cut block or an unknown block id is not.
+*/
+function walkGif(bytes, onFrame) {
+	if (bytes.length < 13) return false;
+	const signature = String.fromCharCode(...bytes.subarray(0, 6));
+	if (signature !== "GIF87a" && signature !== "GIF89a") return false;
+	let offset = 13 + colorTableBytes(bytes[10]);
+	let pendingDelayMs = 0;
+	let pendingDelayOffset;
+	while (offset < bytes.length) {
+		const block = bytes[offset];
+		if (block === 59) return true;
+		if (block === 33) {
+			const label = bytes[offset + 1];
+			if (label === void 0) return false;
+			let cursor = offset + 2;
+			let first = true;
+			while (true) {
+				const size = bytes[cursor];
+				if (size === void 0) return false;
+				if (size === 0) break;
+				if (first && label === 249 && size >= 3) {
+					pendingDelayOffset = cursor + 2;
+					pendingDelayMs = u16(bytes, pendingDelayOffset) * 10;
+				}
+				first = false;
+				cursor += 1 + size;
+			}
+			offset = cursor + 1;
+			continue;
+		}
+		if (block === 44) {
+			if (offset + 10 > bytes.length) return false;
+			let cursor = offset + 10 + colorTableBytes(bytes[offset + 9]);
+			cursor += 1;
+			while (true) {
+				const size = bytes[cursor];
+				if (size === void 0) return false;
+				if (size === 0) break;
+				cursor += 1 + size;
+			}
+			onFrame(pendingDelayMs, pendingDelayOffset);
+			pendingDelayMs = 0;
+			pendingDelayOffset = void 0;
+			offset = cursor + 1;
+			continue;
+		}
+		return false;
+	}
+	return true;
+}
+function u16(bytes, offset) {
+	return (bytes[offset] ?? 0) | (bytes[offset + 1] ?? 0) << 8;
+}
+/** Byte length of a colour table announced by a packed descriptor byte, 0 when absent. */
+function colorTableBytes(packed) {
+	return (packed & 128) === 0 ? 0 : 3 * (1 << (packed & 7) + 1);
+}
+//#endregion
+//#region lib/types/vault-registry.js
+/** Persistent per-profile vault references so one client cannot delete another client's originals. */
+const REGISTRY_FILE = ".refs.json";
+const PROFILE_PATTERN = /^[A-Za-z0-9_-]{8,128}$/;
+function isValidVaultProfileId(value) {
+	return typeof value === "string" && PROFILE_PATTERN.test(value);
+}
+function registryPath(dir) {
+	return join(dir, REGISTRY_FILE);
+}
+function normalizeRegistry(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+	const raw = value;
+	if (raw.version !== 1 || typeof raw.profiles !== "object" || raw.profiles === null || Array.isArray(raw.profiles)) return void 0;
+	const profiles = Object.create(null);
+	for (const [profileId, profile] of Object.entries(raw.profiles)) {
+		if (!isValidVaultProfileId(profileId) || typeof profile !== "object" || profile === null || Array.isArray(profile)) return void 0;
+		const { keys, updatedAt } = profile;
+		if (!Array.isArray(keys) || !keys.every((key) => typeof key === "string" && isValidVaultKey(key))) return void 0;
+		if (typeof updatedAt !== "number" || !Number.isFinite(updatedAt) || updatedAt < 0) return void 0;
+		profiles[profileId] = {
+			keys: Array.from(new Set(keys)),
+			updatedAt
+		};
+	}
+	return {
+		version: 1,
+		profiles
+	};
+}
+async function loadVaultRegistry(dir) {
+	try {
+		const registry = normalizeRegistry(JSON.parse(await readFile(registryPath(dir), "utf8")));
+		return registry === void 0 ? { status: "corrupt" } : {
+			status: "ok",
+			registry
+		};
+	} catch (err) {
+		if (err.code === "ENOENT") return { status: "missing" };
+		return { status: "corrupt" };
+	}
+}
+const queues = /* @__PURE__ */ new Map();
+/** Canonicalize existing ancestors too, so aliases share a lock before creation. */
+async function vaultTransactionKey(dir) {
+	let parent = resolve(dir);
+	const suffix = [];
+	while (true) try {
+		const canonical = join(await realpath(parent), ...suffix);
+		return process.platform === "win32" ? canonical.toLowerCase() : canonical;
+	} catch (error) {
+		if (error.code !== "ENOENT" || dirname(parent) === parent) throw error;
+		suffix.unshift(basename(parent));
+		parent = dirname(parent);
+	}
+}
+/** Serialize reference mutations and deletion together within this host. */
+async function inVaultTransaction(dir, run) {
+	const key = await vaultTransactionKey(dir);
+	const operation = (queues.get(key) ?? Promise.resolve()).then(run);
+	const tail = operation.then(() => void 0, () => void 0);
+	queues.set(key, tail);
+	tail.then(() => {
+		if (queues.get(key) === tail) queues.delete(key);
+	});
+	return operation;
+}
+/** Persist a complete profile only after all newly claimed originals exist. */
+async function writeVaultProfile(dir, profileId, keys, loaded) {
+	if (loaded.status === "corrupt" || !isValidVaultProfileId(profileId) || profileId === "legacy-vault" || !keys.every(isValidVaultKey)) return void 0;
+	const registry = loaded.registry ?? {
+		version: 1,
+		profiles: {}
+	};
+	const accepted = Array.from(new Set(keys));
+	const previousProfile = registry.profiles[profileId];
+	const previous = new Set(previousProfile?.keys ?? []);
+	if (loaded.status === "ok" && previousProfile !== void 0 && accepted.length === previous.size && accepted.every((key) => previous.has(key))) return registry;
+	let existing;
+	if (loaded.status === "missing" || accepted.some((key) => !previous.has(key))) {
+		existing = await listVaultKeys({
+			enabled: true,
+			dir
+		});
+		const available = new Set(existing);
+		if (accepted.some((key) => !available.has(key))) return void 0;
+	}
+	if (loaded.status === "missing") {
+		const legacy = existing.filter((key) => !accepted.includes(key));
+		if (legacy.length > 0) registry.profiles["legacy-vault"] = {
+			keys: legacy,
+			updatedAt: 0
+		};
+	}
+	Object.defineProperty(registry.profiles, profileId, {
+		value: {
+			keys: accepted,
+			updatedAt: Date.now()
+		},
+		enumerable: true,
+		writable: true,
+		configurable: true
+	});
+	await persistRegistry(dir, registry);
+	return registry;
+}
+async function persistRegistry(dir, registry) {
+	await mkdir(dir, { recursive: true });
+	const target = registryPath(dir);
+	const temporary = target + ".tmp-" + randomUUID();
+	try {
+		await writeFile(temporary, JSON.stringify(registry, null, 2), "utf8");
+		await rename(temporary, target);
+	} finally {
+		await unlink(temporary).catch(() => void 0);
+	}
+}
+/** Store and claim an import in the same transaction used by explicit deletion. */
+function saveImportedOriginal(config, input, profileId) {
+	if (!config.enabled) return Promise.resolve(void 0);
+	return inVaultTransaction(config.dir, async () => {
+		if (profileId !== void 0 && (!isValidVaultProfileId(profileId) || profileId === "legacy-vault")) throw new Error("invalid-vault-profile");
+		const loaded = await loadVaultRegistry(config.dir);
+		if (loaded.status === "corrupt") throw new Error("registry-unavailable");
+		const registry = loaded.registry ?? {
+			version: 1,
+			profiles: {}
+		};
+		if (loaded.status === "missing") {
+			const legacy = await listVaultKeys(config);
+			if (legacy.length > 0) registry.profiles["legacy-vault"] = {
+				keys: legacy,
+				updatedAt: 0
+			};
+		}
+		const saved = await saveOriginal(config, input);
+		if (saved === void 0) return void 0;
+		const owner = profileId ?? "legacy-vault";
+		Object.defineProperty(registry.profiles, owner, {
+			value: {
+				keys: [.../* @__PURE__ */ new Set([...registry.profiles[owner]?.keys ?? [], saved.key])],
+				updatedAt: Date.now()
+			},
+			enumerable: true,
+			configurable: true,
+			writable: true
+		});
+		await persistRegistry(config.dir, registry);
+		return saved;
+	});
+}
+/**
+* Store a generated original without claiming it: the browser profiles that
+* render its card claim it one by one, so it is owned by whoever has seen it.
+* The registry is created here, with the same legacy sweep an import does,
+* because the first single-key claim would otherwise create it and sweep every
+* other unclaimed generated file into the legacy profile, where the gallery
+* could never delete it. A corrupt registry is left alone: it already blocks
+* every sync and deletion, while the file is still worth keeping for playback.
+*/
+function saveGeneratedOriginal(config, input) {
+	if (!config.enabled) return Promise.resolve(void 0);
+	return inVaultTransaction(config.dir, async () => {
+		if ((await loadVaultRegistry(config.dir)).status === "missing") {
+			const legacy = await listVaultKeys(config);
+			const registry = {
+				version: 1,
+				profiles: {}
+			};
+			if (legacy.length > 0) registry.profiles["legacy-vault"] = {
+				keys: legacy,
+				updatedAt: 0
+			};
+			await persistRegistry(config.dir, registry);
+		}
+		return saveOriginal(config, input);
+	});
+}
+/**
+* Keep the raw bytes of a generated GIF when the attachment layer normalized
+* it (a GIF is the only type where normalization drops the animation; a still
+* image loses at most some compression, and its workspace file keeps the
+* original). A single-frame GIF is a still image as well, as the tool result
+* already tells the model, and keeps nothing. The image is already paid for,
+* so a vault failure is reported through `warn` and the result stays usable
+* without the original.
+*/
+async function keepGifOriginal(config, generated, attachment, warn) {
+	if (generated.mediaType !== "image/gif") return void 0;
+	if (attachment.mediaType === "image/gif" && attachment.bytes === generated.data.byteLength) return void 0;
+	if ((readGifInfo(generated.data)?.frames ?? 0) < 2) return void 0;
+	try {
+		return await saveGeneratedOriginal(config, {
+			data: generated.data,
+			mediaType: "image/gif"
+		});
+	} catch (error) {
+		warn(`dsh-image-gen: failed to keep the original GIF: ${error instanceof Error ? error.message : String(error)}`);
+		return;
+	}
+}
+/**
+* Merge one profile's complete key set into the persistent registry.
+*
+* On first creation, pre-existing vault files that the syncing profile does
+* not already reference are placed in a reserved legacy profile, so a browser
+* that has not opened yet cannot lose an original. Once a profile syncs a
+* legacy key, the unknown legacy owners remain protected too.
+*
+* A refused claim is told apart: `'missing-original'` when a key of this
+* request is not on disk (the only refusal a client should drop its reference
+* for), undefined when the registry itself cannot be written.
+*/
+function updateVaultRegistry(dir, profileId, keys) {
+	return inVaultTransaction(dir, async () => {
+		const loaded = await loadVaultRegistry(dir);
+		const registry = await writeVaultProfile(dir, profileId, [...loaded.registry?.profiles[profileId]?.keys ?? [], ...keys], loaded);
+		if (registry !== void 0 || loaded.status === "corrupt") return registry;
+		const available = new Set(await listVaultKeys({
+			enabled: true,
+			dir
+		}));
+		return keys.some((key) => !available.has(key)) ? "missing-original" : void 0;
+	}).catch(() => void 0);
+}
+/** Remove explicitly owned keys using the same transaction as reference sync. */
+function deleteUnreferencedOriginals(config, profileId, keys, deleteKeys) {
+	return inVaultTransaction(config.dir, async () => {
+		const loaded = await loadVaultRegistry(config.dir);
+		if (loaded.status !== "ok" || loaded.registry === void 0) return void 0;
+		const previouslyOwned = new Set(loaded.registry.profiles[profileId]?.keys ?? []);
+		const removedKeys = new Set(deleteKeys);
+		const remaining = [...previouslyOwned].filter((key) => !removedKeys.has(key));
+		const registry = await writeVaultProfile(config.dir, profileId, [...remaining, ...keys], loaded);
+		if (registry === void 0) return void 0;
+		const referenced = new Set(unionVaultKeys(registry));
+		return deleteVaultKeys(config, deleteKeys.filter((key) => previouslyOwned.has(key) && !referenced.has(key)));
+	}).catch(() => void 0);
+}
+function unionVaultKeys(registry) {
+	const keys = /* @__PURE__ */ new Set();
+	for (const profile of Object.values(registry.profiles)) for (const key of profile.keys) keys.add(key);
+	return Array.from(keys);
+}
+//#endregion
+//#region lib/types/vault-route.js
+async function serveVault(req, res, config) {
+	if (req.method !== "GET") return jsonError$5(res, 405, "method-not-allowed");
+	if (!sameOrigin$5(req)) return jsonError$5(res, 403, "origin-rejected");
+	const params = new URL(req.url ?? "/", "http://x").searchParams;
+	const key = params.get("key") ?? "";
+	if (!isValidVaultKey(key)) return jsonError$5(res, 400, "invalid-key");
+	const mediaType = params.get("mediaType") ?? void 0;
+	if (!config.enabled) return jsonError$5(res, 503, "vault-disabled");
+	const original = await readOriginal(config, key, mediaType);
+	if (original === void 0) return jsonError$5(res, 404, "not-found");
+	const etag = "\"sha256:" + key + "\"";
+	const cacheControl = "private, max-age=31536000, immutable";
+	const noneMatch = req.headers["if-none-match"];
+	if (typeof noneMatch === "string" && noneMatch.split(",").some((value) => value.trim() === etag)) {
+		res.writeHead(304, {
+			"cache-control": cacheControl,
+			etag
+		});
+		res.end();
+		return;
+	}
+	res.writeHead(200, {
+		"content-type": original.mediaType,
+		"content-length": String(original.data.byteLength),
+		"cache-control": cacheControl,
+		etag,
+		"x-content-type-options": "nosniff"
+	});
+	res.end(original.data);
+}
+/** Sync one browser profile's references; never deletes originals. 410 names a key that is not on disk, 409 a registry no profile can write. */
+async function serveVaultRefs(req, res, config) {
+	if (req.method !== "POST") return jsonError$5(res, 405, "method-not-allowed");
+	if (!sameOrigin$5(req)) return jsonError$5(res, 403, "origin-rejected");
+	const payload = await readJson(req, res);
+	if (payload === void 0) return;
+	const profileId = payload.profileId;
+	const keys = payload.keys;
+	if (!isValidVaultProfileId(profileId)) {
+		jsonOk(res, {
+			removed: 0,
+			bytes: 0
+		});
+		return;
+	}
+	if (!validKeys(keys) || profileId === "legacy-vault") return jsonError$5(res, 400, "invalid-request");
+	const registry = await updateVaultRegistry(config.dir, profileId, keys);
+	if (registry === "missing-original") return jsonError$5(res, 410, "original-missing");
+	if (registry === void 0) return jsonError$5(res, 409, "registry-unavailable");
+	jsonOk(res, {
+		removed: 0,
+		bytes: 0,
+		profiles: Object.keys(registry.profiles).length
+	});
+}
+/** Explicit gallery deletion: remove only keys no profile still references. */
+async function serveVaultDelete(req, res, config) {
+	if (req.method !== "POST") return jsonError$5(res, 405, "method-not-allowed");
+	if (!sameOrigin$5(req)) return jsonError$5(res, 403, "origin-rejected");
+	const payload = await readJson(req, res);
+	if (payload === void 0) return;
+	const profileId = payload.profileId;
+	const keys = payload.keys;
+	const deleteKeys = payload.deleteKeys;
+	if (!isValidVaultProfileId(profileId) || profileId === "legacy-vault") return jsonError$5(res, 400, "invalid-profile");
+	if (!validKeys(keys) || !validKeys(deleteKeys) || payload.confirm !== true) return jsonError$5(res, 400, "invalid-request");
+	const stats = await deleteUnreferencedOriginals(config, profileId, keys, deleteKeys);
+	if (stats === void 0) return jsonError$5(res, 409, "registry-unavailable");
+	jsonOk(res, stats);
+}
+function validKeys(value) {
+	return Array.isArray(value) && value.every((key) => typeof key === "string" && isValidVaultKey(key));
+}
+async function readJson(req, res) {
+	let body;
+	try {
+		body = await readBody$3(req, 4194304);
+	} catch {
+		jsonError$5(res, 413, "request-too-large");
+		return;
+	}
+	try {
+		const parsed = JSON.parse(body);
+		if (typeof parsed !== "object" || parsed === null) {
+			jsonError$5(res, 400, "invalid-request");
+			return;
+		}
+		return parsed;
+	} catch {
+		jsonError$5(res, 400, "invalid-request");
+		return;
 	}
+}
+function jsonOk(res, value) {
 	res.writeHead(200, {
-		"content-type": "application/json",
+		"content-type": "application/json; charset=utf-8",
 		"cache-control": "no-store"
 	});
-	res.end(JSON.stringify({
-		images: saved,
-		failures
-	}));
+	res.end(JSON.stringify(value));
+}
+function sameOrigin$5(req) {
+	const origin = req.headers.origin;
+	const host = req.headers.host;
+	if (origin !== void 0 && host !== void 0 && origin !== "http://" + host && origin !== "https://" + host) return false;
+	return true;
 }
-async function readBody$3(req, maxBytes) {
+async function readBody$3(req, limit) {
 	const chunks = [];
 	let bytes = 0;
 	for await (const chunk of req) {
 		const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
 		bytes += buffer.byteLength;
-		if (bytes > maxBytes) throw new Error("request-too-large");
+		if (bytes > limit) throw new Error("request too large");
 		chunks.push(buffer);
 	}
 	return Buffer.concat(chunks).toString("utf8");
 }
+function jsonError$5(res, status, code) {
+	res.writeHead(status, {
+		"content-type": "application/json; charset=utf-8",
+		"cache-control": "no-store"
+	});
+	res.end(JSON.stringify({ error: code }));
+}
+//#endregion
+//#region lib/types/thumb-route.js
+const THUMB = {
+	defaultWidth: 320,
+	minWidth: 64,
+	maxWidth: 1024,
+	/** Generous for a 320 px tile, so the quality ladder stays at its top rung. */
+	maxBytes: 98304,
+	unavailableCode: "thumbnail-unavailable"
+};
+/**
+* A 1600 px long edge keeps lightbox decoding small (a 33.5 MP original costs
+* roughly 130 MB as RGBA) while staying sharp on a desktop window.
+*/
+const PREVIEW = {
+	defaultWidth: 1600,
+	minWidth: 256,
+	maxWidth: 2048,
+	maxBytes: 524288,
+	unavailableCode: "preview-unavailable"
+};
+/**
+* Serve one downscaled, cached thumbnail.
+*
+* The attachment backend already derives deterministic request images (resize by
+* long edge + JPEG/WebP quality ladder) and caches them on disk, so the gallery
+* can render a tile without transferring the original to the renderer at all.
+*/
+async function serveThumb(req, res, deps) {
+	return serveVariant(req, res, deps, THUMB);
+}
+/** Serve the mid-size variant used by the lightbox preview. */
+async function servePreview(req, res, deps) {
+	return serveVariant(req, res, deps, PREVIEW);
+}
+async function serveVariant(req, res, deps, config) {
+	if (req.method !== "GET") return jsonError$4(res, 405, "method-not-allowed");
+	if (!sameOrigin$4(req)) return jsonError$4(res, 403, "origin-rejected");
+	const url = new URL(req.url ?? "/", "http://x");
+	const rawRef = url.searchParams.get("ref");
+	const attachment = rawRef === null ? void 0 : decodeImageRef(rawRef, parseImageAttachmentRef);
+	if (attachment === void 0) return jsonError$4(res, 400, "invalid-attachment");
+	const requested = Number(url.searchParams.get("w") ?? config.defaultWidth);
+	const width = Number.isFinite(requested) ? Math.min(config.maxWidth, Math.max(config.minWidth, Math.round(requested))) : config.defaultWidth;
+	try {
+		const variant = await deps.readImageRequest(attachment, {
+			width,
+			height: width,
+			maxBytes: config.maxBytes
+		});
+		const etag = "\"" + String(variant.variantId) + "\"";
+		const headers = {
+			"cache-control": "private, max-age=31536000, immutable",
+			etag
+		};
+		const ifNoneMatch = req.headers["if-none-match"];
+		if (typeof ifNoneMatch === "string" && ifNoneMatch.split(",").some((value) => value.trim() === etag)) {
+			res.writeHead(304, headers);
+			res.end();
+			return;
+		}
+		res.writeHead(200, {
+			"content-type": variant.mediaType,
+			"content-length": String(variant.data.byteLength),
+			"x-content-type-options": "nosniff",
+			...headers
+		});
+		res.end(variant.data);
+	} catch {
+		jsonError$4(res, 404, config.unavailableCode);
+	}
+}
+function sameOrigin$4(req) {
+	const origin = req.headers.origin;
+	const host = req.headers.host;
+	if (origin !== void 0 && host !== void 0 && origin !== `http://${host}` && origin !== `https://${host}`) return false;
+	return true;
+}
 function jsonError$4(res, status, code) {
 	res.writeHead(status, {
 		"content-type": "application/json",
@@ -8535,26 +10488,66 @@ async function editOpenAICompatibleImage(input) {
 			body: form
 		}), input.apiKey), "openai", input);
 	}
-	const form = new FormData();
-	const imageField = input.sourceImages.length > 1 ? "image[]" : "image";
-	input.sourceImages.forEach((sourceImage, index) => {
-		const uploadBytes = new Uint8Array(sourceImage.data);
-		const blob = new Blob([uploadBytes], { type: sourceImage.mediaType });
-		const filename = `reference-${index + 1}.${extensionOf(sourceImage.mediaType)}`;
-		form.append(imageField, blob, filename);
-	});
-	form.append("prompt", input.prompt);
-	form.append("model", input.model);
-	if (input.size !== void 0 && input.size.length > 0) form.append("size", input.size);
-	if (input.quality !== void 0) form.append("quality", input.quality);
-	for (const [key, value] of Object.entries(input.extraBody ?? {})) form.append(key, String(value));
-	return parseImageResponse(await guardedFetch("openai image edit request", input.signal, () => fetch(imageEndpoint$1(input.baseURL, "edits"), {
+	const responseFormat = input.editResponseFormat ?? "url";
+	const explicitResponseFormat = Object.prototype.hasOwnProperty.call(input.extraBody ?? {}, "response_format");
+	const buildEditForm = (includeResponseFormat) => {
+		const form = new FormData();
+		const imageField = input.sourceImages.length > 1 ? "image[]" : "image";
+		input.sourceImages.forEach((sourceImage, index) => {
+			const uploadBytes = new Uint8Array(sourceImage.data);
+			const blob = new Blob([uploadBytes], { type: sourceImage.mediaType });
+			const filename = `reference-${index + 1}.${extensionOf(sourceImage.mediaType)}`;
+			form.append(imageField, blob, filename);
+		});
+		form.append("prompt", input.prompt);
+		form.append("model", input.model);
+		if (input.size !== void 0 && input.size.length > 0) form.append("size", input.size);
+		if (input.quality !== void 0) form.append("quality", input.quality);
+		if (includeResponseFormat && !explicitResponseFormat) form.append("response_format", "b64_json");
+		for (const [key, value] of Object.entries(input.extraBody ?? {})) {
+			if (value === void 0) continue;
+			form.append(key, String(value));
+		}
+		return form;
+	};
+	const sendEdit = (form) => guardedFetch("openai image edit request", input.signal, () => fetch(imageEndpoint$1(input.baseURL, "edits"), {
 		method: "POST",
 		redirect: "error",
 		signal: input.signal,
 		headers: { authorization: `Bearer ${input.apiKey}` },
 		body: form
-	}), input.apiKey), "openai", input);
+	}), input.apiKey);
+	let response = await sendEdit(buildEditForm(responseFormat !== "url"));
+	if (responseFormat === "auto" && !explicitResponseFormat && (response.status === 400 || response.status === 422)) {
+		const text = await readBoundedText$1(response, ERROR_LIMIT$1);
+		if (!rejectsResponseFormat(text)) throw new Error(`openai image request failed (${response.status}): ${redactSecrets(text, input.apiKey).slice(0, ERROR_LIMIT$1)}`);
+		input.onResponseFormatRetry?.(response.status);
+		response = await sendEdit(buildEditForm(false));
+	}
+	return parseImageResponse(response, "openai", input);
+}
+function rejectsResponseFormat(text) {
+	let message = text;
+	try {
+		const body = JSON.parse(text);
+		if (typeof body === "string") message = body;
+		else if (body !== null && typeof body === "object") {
+			const error = typeof body.error === "object" && body.error !== null ? body.error : void 0;
+			if (typeof error?.param === "string") return error.param === "response_format";
+			if (Array.isArray(body.detail)) return body.detail.length > 0 && body.detail.every((entry) => {
+				const loc = entry !== null && typeof entry === "object" ? entry.loc : void 0;
+				return Array.isArray(loc) && loc.includes("response_format");
+			});
+			message = [
+				typeof body.error === "string" ? body.error : void 0,
+				error?.message,
+				error?.code,
+				body.message,
+				body.detail
+			].filter((value) => typeof value === "string").join(" ");
+		}
+	} catch {}
+	return /(?:response[_ -]?format|b64_json)/i.test(message) && /(?:unsupported|not\s+(?:support|allowed|permitted|accepted|implemented)|unknown|unrecognized|unexpected|invalid|extra\s+(?:field|input)|不支持|不允许|未知|无效|未识别)/i.test(message);
 }
 async function parseImageResponse(response, provider, input) {
 	const text = await readBoundedText$1(response, Math.ceil(input.maxBytes * 1.4) + ERROR_LIMIT$1);
@@ -8614,17 +10607,19 @@ async function downloadImage$1(url, provider, input) {
 			mediaType: detectImageMediaType(data) ?? imageMediaType$2(parsed.mediaType) ?? "image/png"
 		};
 	}
-	const sameOrigin = new URL(url).origin === new URL(input.baseURL).origin;
-	let response = await guardedFetch(`${provider} image download`, input.signal, () => fetch(url, {
-		redirect: "follow",
-		signal: input.signal,
-		...input.apiKey === void 0 || !sameOrigin ? {} : { headers: { authorization: `Bearer ${input.apiKey}` } }
-	}), input.apiKey);
-	if (!response.ok && input.apiKey !== void 0 && sameOrigin) response = await guardedFetch(`${provider} image download`, input.signal, () => fetch(url, {
-		redirect: "follow",
-		signal: input.signal
-	}), input.apiKey);
-	if (!response.ok) throw new Error(`${provider} image download failed (${response.status})`);
+	const candidates = imageDownloadCandidates(url, input.baseURL, provider);
+	let response;
+	let failure;
+	for (const candidate of candidates) try {
+		response = await requestImageCandidate(candidate, provider, input);
+		if (response.ok) break;
+		failure = /* @__PURE__ */ new Error(`${provider} image download failed (${response.status})`);
+		await response.body?.cancel().catch(() => void 0);
+		response = void 0;
+	} catch (err) {
+		failure = err;
+	}
+	if (response === void 0) throw failure instanceof Error ? failure : /* @__PURE__ */ new Error(`${provider} image download failed`);
 	const data = await readBoundedBytes$1(response, input.maxBytes);
 	const mediaType = detectImageMediaType(data) ?? imageMediaType$2(response.headers.get("content-type"));
 	if (mediaType === void 0) throw new Error(`${provider} image download returned unsupported content type`);
@@ -8633,6 +10628,34 @@ async function downloadImage$1(url, provider, input) {
 		mediaType
 	};
 }
+function imageDownloadCandidates(url, baseURL, provider) {
+	const candidates = [];
+	try {
+		candidates.push(new URL(url, baseURL.endsWith("/") ? baseURL : baseURL + "/").toString());
+	} catch {}
+	if (url.startsWith("/")) try {
+		const stripped = new URL(baseURL).origin + url.replace(/^\/v1(?=\/)/, "");
+		if (!candidates.includes(stripped)) candidates.push(stripped);
+	} catch {}
+	if (candidates.length === 0) throw new Error(provider + " image download URL is not absolute");
+	return candidates;
+}
+async function requestImageCandidate(candidate, provider, input) {
+	const sameOrigin = new URL(candidate).origin === new URL(input.baseURL).origin;
+	let response = await guardedFetch(provider + " image download", input.signal, () => fetch(candidate, {
+		redirect: "follow",
+		signal: input.signal,
+		...input.apiKey === void 0 || !sameOrigin ? {} : { headers: { authorization: "Bearer " + input.apiKey } }
+	}), input.apiKey);
+	if (!response.ok && input.apiKey !== void 0 && sameOrigin) {
+		await response.body?.cancel().catch(() => void 0);
+		response = await guardedFetch(provider + " image download", input.signal, () => fetch(candidate, {
+			redirect: "follow",
+			signal: input.signal
+		}), input.apiKey);
+	}
+	return response;
+}
 function parseDataUrl(value) {
 	const match = /^data:([^;,]+);base64,(.*)$/s.exec(value.trim());
 	return match?.[1] !== void 0 && match[2] !== void 0 ? {
@@ -8675,6 +10698,9 @@ async function readBoundedBytes$1(response, maxBytes) {
 			if (bytes > maxBytes) throw new Error(`Image response exceeded the ${String(maxBytes)} byte limit`);
 			chunks.push(next.value);
 		}
+	} catch (error) {
+		await reader.cancel().catch(() => void 0);
+		throw error;
 	} finally {
 		reader.releaseLock();
 	}
@@ -8760,9 +10786,15 @@ async function downloadImage(url, input) {
 		redirect: "follow",
 		signal: input.signal
 	}), input.apiKey);
-	if (!response.ok) throw new Error(`seedream image download failed (${response.status})`);
+	if (!response.ok) {
+		await response.body?.cancel().catch(() => void 0);
+		throw new Error(`seedream image download failed (${response.status})`);
+	}
 	const mediaType = imageMediaType$1(response.headers.get("content-type"));
-	if (mediaType === void 0) throw new Error("seedream image download returned unsupported content type");
+	if (mediaType === void 0) {
+		await response.body?.cancel().catch(() => void 0);
+		throw new Error("seedream image download returned unsupported content type");
+	}
 	return {
 		data: await readBoundedBytes(response, input.maxBytes),
 		mediaType
@@ -8795,6 +10827,9 @@ async function readBoundedBytes(response, maxBytes) {
 			if (bytes > maxBytes) throw new Error(`Image response exceeded the ${String(maxBytes)} byte limit`);
 			chunks.push(next.value);
 		}
+	} catch (error) {
+		await reader.cancel().catch(() => void 0);
+		throw error;
 	} finally {
 		reader.releaseLock();
 	}
@@ -9035,9 +11070,10 @@ const CODEX_SCOPE = "openid profile email offline_access api.connectors.read api
 const CODEX_IMAGE_URL = "https://chatgpt.com/backend-api/codex/images/generations";
 /** Where the ChatGPT subscription image edit request goes. */
 const CODEX_IMAGE_EDIT_URL = "https://chatgpt.com/backend-api/codex/images/edits";
-/** The model served by this endpoint (probed live: gpt-image-2.5-flare works
-* on the ChatGPT internal generations route as of 2026-09-14). */
-const CODEX_IMAGE_MODEL = "gpt-image-2.5-flare";
+/** The model served by this endpoint: Images 2.6 (2026-11-04), probed live
+* for stills on 2026-11-08 (2.5-flare before). The route rejects
+* `output_format: gif` (HTTP 400), so GIF stays off this channel. */
+const CODEX_IMAGE_MODEL = "gpt-image-2.6-flare";
 /** Public client id of the Codex CLI; vendor-fixed redirect on port 1455. */
 const CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
 const CODEX_REDIRECT_URI = "http://localhost:1455/auth/callback";
@@ -10112,6 +12148,52 @@ const SEEDREAM_SIZE_TABLE = {
 		"4K": "6240x2656"
 	}
 };
+/**
+* Seedream 5.0 pro / flash tier × ratio table (Ark docs, seedream-5-0-pro):
+* these models take 1K / 1.5K / 2K only, within 921600–4624220 pixels.
+*/
+const SEEDREAM_PRO_SIZE_TABLE = {
+	"1:1": {
+		"1K": "1024x1024",
+		"1.5K": "1536x1536",
+		"2K": "2048x2048"
+	},
+	"4:3": {
+		"1K": "1152x864",
+		"1.5K": "1792x1344",
+		"2K": "2368x1776"
+	},
+	"3:4": {
+		"1K": "864x1152",
+		"1.5K": "1344x1792",
+		"2K": "1776x2368"
+	},
+	"16:9": {
+		"1K": "1424x800",
+		"1.5K": "2048x1152",
+		"2K": "2816x1584"
+	},
+	"9:16": {
+		"1K": "800x1424",
+		"1.5K": "1152x2048",
+		"2K": "1584x2816"
+	},
+	"3:2": {
+		"1K": "1248x832",
+		"1.5K": "1872x1248",
+		"2K": "2496x1664"
+	},
+	"2:3": {
+		"1K": "832x1248",
+		"1.5K": "1248x1872",
+		"2K": "1664x2496"
+	},
+	"21:9": {
+		"1K": "1568x672",
+		"1.5K": "2352x1008",
+		"2K": "3136x1344"
+	}
+};
 /** qwen-image-3.0 pixel sizes within the documented 512*512–2048*2048 area. */
 const DASHSCOPE_SIZE_TABLE = {
 	"1:1": "1024x1024",
@@ -10208,6 +12290,20 @@ const CLOUD_CAPABILITIES = {
 		label: "高清"
 	}], "1:1", "hd", (ratio) => ZHIPU_SIZE_TABLE[ratio] ?? "1280x1280")
 };
+/** Seedream 5.0 pro / flash: a different tier set from the earlier Seedream models. */
+const SEEDREAM_PRO_CAPABILITY = capability(["auto", ...Object.keys(SEEDREAM_PRO_SIZE_TABLE)], [
+	"1K",
+	"1.5K",
+	"2K"
+].map((value) => ({
+	value,
+	label: value
+})), "auto", "2K", (ratio, quality) => ratio === "auto" ? quality : SEEDREAM_PRO_SIZE_TABLE[ratio]?.[quality] ?? quality);
+/** The pickers of a cloud row for the model it runs; only Seedream differs by model today. */
+function cloudCapability(provider, model) {
+	if (provider === "seedream" && /seedream-5-0-(?:pro|flash)(?:$|-)/.test(model)) return SEEDREAM_PRO_CAPABILITY;
+	return CLOUD_CAPABILITIES[provider];
+}
 const SUBSCRIPTION_CAPABILITIES = {
 	"chatgpt-sub": capability(["auto", ...Object.keys(OPENAI_SIZE_TABLE)], [AUTO, ...[
 		"low",
@@ -27843,6 +29939,35 @@ function validateOfficialSize(model, size) {
 	const pixels = width * height;
 	if (!match || width % 16 !== 0 || height % 16 !== 0 || Math.max(width, height) > 3840 || pixels < 655360 || pixels > 8294400 || Math.max(width, height) > 3 * Math.min(width, height)) throw new Error(`OpenAI 尺寸 ${size} 无效：边长须为 16 的倍数且不超过 3840，比例在 1:3 到 3:1，像素数在 655360 到 8294400`);
 }
+/** Fold one call's GIF parameters into OpenAI images request fields; anything but a GIF yields {}. */
+function gifRequestFields(options) {
+	if (options.outputFormat !== "gif") {
+		if (options.frameCount !== void 0 || options.frameDurationMs !== void 0) throw new Error("frame_count / frame_duration_ms 仅在 output_format=gif 时有效");
+		return {};
+	}
+	if (options.frameCount !== void 0 && !inRange(options.frameCount, 2, 16)) throw new Error(`GIF frame_count 须为 ${String(2)} 到 ${String(16)} 的整数`);
+	if (options.frameDurationMs !== void 0 && !inRange(options.frameDurationMs, 20, 2e3)) throw new Error(`GIF frame_duration_ms 须为 ${String(20)} 到 ${String(GIF_FRAME_DURATION_MS_MAX)} 的整数`);
+	return {
+		output_format: "gif",
+		...options.frameCount === void 0 ? {} : { frame_count: options.frameCount },
+		...options.frameDurationMs === void 0 ? {} : { frame_duration_ms: options.frameDurationMs }
+	};
+}
+function inRange(value, min, max) {
+	return Number.isInteger(value) && value >= min && value <= max;
+}
+/**
+* A GIF `size` is the single-frame size: auto or multiples of 16 with the
+* longest edge within the sheet limit. The still-image pixel floor of
+* validateOfficialSize does not apply; the provider judges the frame budget.
+*/
+function validateGifFrameSize(size) {
+	if (size === "auto") return;
+	const match = /^(\d+)x(\d+)$/.exec(size);
+	const width = Number(match?.[1]);
+	const height = Number(match?.[2]);
+	if (!match || width <= 0 || height <= 0 || width % 16 !== 0 || height % 16 !== 0 || Math.max(width, height) > 3840) throw new Error(`GIF 单帧尺寸 ${size} 无效：边长须为 16 的倍数且不超过 ${String(GIF_SHEET_MAX_EDGE)}；所有帧会拼成一张 sheet，其最长边同样不得超过 ${String(GIF_SHEET_MAX_EDGE)}，帧越多单帧应越小`);
+}
 function officialQualityOptions(model) {
 	return [
 		"auto",
@@ -27955,6 +30080,17 @@ function openAIRequestSize(config, ratio, quality) {
 	if (withinBudget.length === 0) throw new Error(`该比例不支持 ${quality} 清晰度，请降低清晰度或更换比例`);
 	return withinBudget.reduce((best, entry) => entry.rank > best.rank ? entry : best).size;
 }
+/** The relay table entry the user picked, if a table is configured and lists this ratio; otherwise nothing. */
+function configuredCompatSize(config, input) {
+	const table = config.openaiCompatSizes;
+	if (table === void 0 || Object.keys(table).length === 0) return void 0;
+	if (!openAICompatTable(config).some((group) => group.ratio === input.ratio)) return void 0;
+	try {
+		return openAIRequestSize(config, input.ratio, input.resolution ?? input.quality);
+	} catch {
+		return;
+	}
+}
 /** Workbench profile derived from the configured relay table. */
 function openAICompatStudioProfile(config, model, configured) {
 	const groups = openAICompatTable(config);
@@ -28032,17 +30168,27 @@ const SUBSCRIPTION_DISPLAY_LABELS = {
 	"grok-sub": "Grok 订阅",
 	"google-sub": "Google 订阅"
 };
+/** A generation on an OpenAI-compatible channel whose extras select GIF is a GIF request even when it carries no `output`. */
+function channelSelectsGif(config, input) {
+	return input.provider === "openai-compat" && input.mode === "generate" && withOpenAICompatChannel(config, input.channel).openaiCompatExtraBody?.output_format === "gif";
+}
 /** Execute one validated browser workbench request using the existing provider adapters. */
 async function generateFromStudio(ctx, config, input, signal, fallbackWorkspaceRoot, subscriptions) {
 	if (isSubscriptionProvider(input.provider)) {
 		if (subscriptions === void 0) throw new Error("订阅生图不可用：订阅管理器未初始化");
-		assertAllowed(subscriptionStudioProfile(input.provider, true), input);
+		assertAllowed(subscriptionStudioProfile(input.provider, true), input, input.output?.format === "gif");
 		return generateSubscriptionFromStudio(ctx, subscriptions, input, signal);
 	}
 	const channel = input.provider === "openai-compat" ? resolveOpenAICompatChannel(config, input.channel) : void 0;
 	const requestConfig = input.provider === "openai-compat" ? withOpenAICompatChannel(config, input.channel) : config;
-	assertAllowed(studioProfile(requestConfig, input.provider, true, channel?.id), input);
-	const active = resolveProvider(withProviderOverrides(requestConfig, input.provider, input.model));
+	const profile = studioProfile(requestConfig, input.provider, true, channel?.id);
+	const model = withGenerationModel(profile, input).model;
+	const channelGif = channelSelectsGif(config, input);
+	assertAllowed(profile, {
+		...input,
+		model
+	}, input.output?.format === "gif" || channelGif);
+	const active = resolveProvider(withProviderOverrides(requestConfig, input.provider, model));
 	if (active.provider === "comfyui") throw new Error("ComfyUI 暂未接入工作台");
 	if (isSubscriptionProvider(active.provider)) throw new Error("订阅生图应通过订阅渠道执行");
 	const wired = active;
@@ -28083,16 +30229,29 @@ async function generateFromStudio(ctx, config, input, signal, fallbackWorkspaceR
 			output = `${aspectRatio}, ${imageSize}`;
 		} else if (wired.provider === "openai" || wired.provider === "openai-compat" || wired.provider === "xai" || wired.provider === "zhipu") {
 			const p = wired.provider;
+			const gifFields = p === "openai" || p === "openai-compat" ? gifRequestFields({
+				outputFormat: input.output?.format ?? (channelGif ? "gif" : void 0),
+				frameCount: input.output?.frameCount,
+				frameDurationMs: input.output?.frameDurationMs
+			}) : {};
+			const gif = gifFields.output_format === "gif";
 			const officialTable = p === "openai" ? officialSizeTable(requestConfig, wired.model) : void 0;
 			const officialResolution = input.resolution ?? (officialTable ? openAICompatTable({ openaiCompatSizes: officialTable }).find((group) => group.ratio === input.ratio)?.tiers[0]?.tier : void 0) ?? "1K";
-			const size = p === "openai-compat" ? openAIRequestSize(requestConfig, input.ratio, input.resolution ?? input.quality) : p === "openai" ? openAIRequestSize({ openaiCompatSizes: officialTable }, input.ratio, officialResolution) : p === "xai" ? void 0 : CLOUD_CAPABILITIES[p].sizeFor?.(input.ratio, input.quality);
-			if (p === "openai" && size !== void 0) validateOfficialSize(wired.model, size);
+			const size = gif ? input.output?.size ?? (p === "openai-compat" ? configuredCompatSize(requestConfig, input) : void 0) : p === "openai-compat" ? openAIRequestSize(requestConfig, input.ratio, input.resolution ?? input.quality) : p === "openai" ? openAIRequestSize({ openaiCompatSizes: officialTable }, input.ratio, officialResolution) : p === "xai" ? void 0 : cloudCapability(p, wired.model).sizeFor?.(input.ratio, input.quality);
+			if (p === "openai" && size !== void 0) {
+				if (gif) validateGifFrameSize(size);
+				else validateOfficialSize(wired.model, size);
+			}
 			const requestedQuality = input.generationQuality ?? input.quality;
 			const quality = p === "openai" ? requestedQuality === "auto" ? void 0 : requestedQuality : p === "openai-compat" ? compatRequestQuality(requestConfig, input.generationQuality) : p === "zhipu" ? "hd" : void 0;
-			const extraBody = p === "xai" ? {
+			const channelExtraBody = p === "xai" ? {
 				aspect_ratio: input.ratio,
 				resolution: input.quality
 			} : p === "openai-compat" ? input.mode === "generate" ? compatGenerationExtraBody(requestConfig, input.watermark) : compatEditExtraBody(requestConfig, input.watermark) : void 0;
+			const extraBody = Object.keys(gifFields).length === 0 ? channelExtraBody : {
+				...channelExtraBody,
+				...gifFields
+			};
 			generated = input.mode === "edit" ? await editOpenAICompatibleImage({
 				apiKey: credential,
 				baseURL: wired.baseURL,
@@ -28123,7 +30282,7 @@ async function generateFromStudio(ctx, config, input, signal, fallbackWorkspaceR
 			});
 			output = size ?? `${input.ratio}, ${input.quality}`;
 		} else if (wired.provider === "seedream") {
-			const size = CLOUD_CAPABILITIES.seedream.sizeFor?.(input.ratio, input.quality) ?? input.quality;
+			const size = cloudCapability("seedream", wired.model).sizeFor?.(input.ratio, input.quality) ?? input.quality;
 			const arkOptions = {
 				...wired.arkOptions,
 				watermark: selectedWatermark(input.watermark, wired.arkOptions.watermark)
@@ -28177,13 +30336,18 @@ async function generateFromStudio(ctx, config, input, signal, fallbackWorkspaceR
 			output = size;
 		} else throw new Error("当前渠道未接入 API 工作台");
 		if (!ctx.attachments.imageLimits.mediaTypes.includes(generated.mediaType)) throw new Error(`当前 DSH 不支持保存 ${generated.mediaType} 图片`);
+		const attachment = await ctx.attachments.saveImage({
+			data: generated.data,
+			mediaType: generated.mediaType,
+			name: count > 1 ? `studio-image-${index + 1}` : "studio-image"
+		});
+		const original = await keepGifOriginal(vaultConfigOf(requestConfig), generated, attachment, (message) => {
+			ctx.logger.warn(message);
+		});
 		return {
-			attachment: await ctx.attachments.saveImage({
-				data: generated.data,
-				mediaType: generated.mediaType,
-				name: count > 1 ? `studio-image-${index + 1}` : "studio-image"
-			}),
-			output
+			attachment,
+			output,
+			...original === void 0 ? {} : { original }
 		};
 	};
 	if (count === 1) {
@@ -28193,14 +30357,15 @@ async function generateFromStudio(ctx, config, input, signal, fallbackWorkspaceR
 			output: single.output,
 			provider: input.provider,
 			...channel === void 0 ? {} : { channel: channel.id },
-			model: input.model,
+			model,
 			prompt: input.prompt,
 			createdAt: Date.now(),
 			elapsedMs: Date.now() - startedAt,
 			requestedCount: 1,
 			failedCount: 0,
 			items: [single],
-			...single.savedTo ? { savedTo: single.savedTo } : {}
+			...single.savedTo ? { savedTo: single.savedTo } : {},
+			...single.original === void 0 ? {} : { original: single.original }
 		};
 	}
 	const poolResults = await runPool(Array.from({ length: count }, (_, i) => () => generateSingle(i)), 2);
@@ -28224,7 +30389,7 @@ async function generateFromStudio(ctx, config, input, signal, fallbackWorkspaceR
 		output: first.output,
 		provider: input.provider,
 		...channel === void 0 ? {} : { channel: channel.id },
-		model: input.model,
+		model,
 		prompt: input.prompt,
 		createdAt: Date.now(),
 		elapsedMs: Date.now() - startedAt,
@@ -28232,7 +30397,8 @@ async function generateFromStudio(ctx, config, input, signal, fallbackWorkspaceR
 		failedCount: errors.length,
 		items: successes,
 		...errors.length > 0 ? { errors } : {},
-		...first.savedTo ? { savedTo: first.savedTo } : {}
+		...first.savedTo ? { savedTo: first.savedTo } : {},
+		...first.original === void 0 ? {} : { original: first.original }
 	};
 }
 async function runPool(tasks, concurrency = 2) {
@@ -28392,7 +30558,7 @@ function cloudStudioProfile(config, provider, configured) {
 			defaultResolution: resolutionOptions[defaultRatio]?.[0]?.value ?? "1K"
 		};
 	}
-	const cap = CLOUD_CAPABILITIES[provider];
+	const cap = cloudCapability(provider, model);
 	return profile(provider, model, configured, cap.ratioOptions, cap.qualityOptions, cap.defaultRatio, cap.defaultQuality);
 }
 /** Output capabilities remain visible before credentials, address or model are configured. */
@@ -28462,12 +30628,29 @@ function option(value) {
 		label: RATIO_LABELS[value] ?? value
 	};
 }
-function assertAllowed(profile, input) {
+/**
+* Regenerating an edit result is a generation, but the card remembers the
+* channel's separate editing model that drew it, which the generation list
+* may not offer. That model is swapped for the channel's generation model;
+* any other unknown model still fails as a stale workbench below.
+*/
+function withGenerationModel(profile, input) {
+	if (input.mode !== "generate" || profile.editModel === void 0 || input.model !== profile.editModel) return input;
+	if (studioModelOptionsForMode(profile, "generate").some((option) => option.value === input.model)) return input;
+	return {
+		...input,
+		model: studioModelForMode(profile, "generate")
+	};
+}
+function assertAllowed(profile, input, gif) {
 	if (!studioModelOptionsForMode(profile, input.mode).some((option) => option.value === input.model)) throw new Error("模型配置已变化，请刷新工作台后重试");
-	if (!profile.ratioOptions.some((option) => option.value === input.ratio)) throw new Error("该 Provider 不支持所选比例");
+	if (input.output !== void 0 && input.provider !== "openai" && input.provider !== "openai-compat") throw new Error("该 Provider 不支持 GIF 输出参数");
 	const selectedQuality = input.provider === "openai" ? input.generationQuality ?? input.quality : input.resolution ?? input.quality;
-	if (!profile.qualityOptions.some((option) => option.value === selectedQuality)) throw new Error("该 Provider 不支持所选清晰度");
-	if (input.resolution !== void 0 && profile.resolutionOptions !== void 0 && !profile.resolutionOptions[input.ratio]?.some((option) => option.value === input.resolution)) throw new Error("该比例不支持所选分辨率");
+	if (!gif) {
+		if (!profile.ratioOptions.some((option) => option.value === input.ratio)) throw new Error("该 Provider 不支持所选比例");
+		if (!profile.qualityOptions.some((option) => option.value === selectedQuality)) throw new Error("该 Provider 不支持所选清晰度");
+		if (input.resolution !== void 0 && profile.resolutionOptions !== void 0 && !profile.resolutionOptions[input.ratio]?.some((option) => option.value === input.resolution)) throw new Error("该比例不支持所选分辨率");
+	} else if (input.provider === "openai" && !profile.qualityOptions.some((option) => option.value === selectedQuality)) throw new Error("该 Provider 不支持所选清晰度");
 	if (input.generationQuality !== void 0 && input.provider === "openai-compat" && !profile.generationQualityOptions?.some((option) => option.value === input.generationQuality)) throw new Error("该 Provider 不支持所选生成质量");
 	if ((input.resolution !== void 0 || input.generationQuality !== void 0) && input.provider !== "openai" && input.provider !== "openai-compat") throw new Error("该 Provider 不支持独立的 OpenAI 输出参数");
 	if (input.watermark !== void 0 && input.watermark !== "default" && studioWatermarkCapability(profile, input.mode).status !== "supported") throw new Error("该渠道尚未确认当前操作的水印控制，请刷新工作台");
@@ -28531,7 +30714,8 @@ async function serveStudio(req, res, deps) {
 			return jsonError$1(res, 400, errorMessage(error, "invalid-request"));
 		}
 		const subscriptionChannel = isSubscriptionProvider(input.provider);
-		const timeoutMs = subscriptionChannel ? SUBSCRIPTION_TIMEOUT_MS : deps.timeoutMs ?? 15e4;
+		const gif = input.output?.format === "gif" || deps.channelSelectsGif?.(input) === true;
+		const timeoutMs = subscriptionChannel ? SUBSCRIPTION_TIMEOUT_MS : cloudTimeoutFor(deps.timeoutMs, gif);
 		const timeout = setTimeout(() => {
 			watchdog.abort();
 		}, timeoutMs);
@@ -28581,9 +30765,11 @@ function parseStudioGenerateRequest(value) {
 	const generationQuality = input.generationQuality === void 0 ? void 0 : requiredText(input.generationQuality, "请选择生成质量", 100);
 	const watermark = input.watermark === void 0 ? void 0 : STUDIO_WATERMARK_VALUES.find((value) => value === input.watermark);
 	if (input.watermark !== void 0 && watermark === void 0) throw new Error("请选择有效的水印选项");
+	const output = input.output === void 0 ? void 0 : parseOutput(input.output);
 	const references = (Array.isArray(input.references) ? input.references : input.reference !== void 0 ? [input.reference] : []).map(parseReference);
 	if (input.mode === "edit" && references.length === 0) throw new Error("图生图需要至少一张参考图");
 	if (references.length > 5) throw new Error("最多支持上传 5 张参考图");
+	if (input.mode === "edit" && output !== void 0 && references.length > 1) throw new Error("动图修改只接受一张参考拼图");
 	const workspaceRoot = typeof input.workspaceRoot === "string" && input.workspaceRoot.trim().length > 0 ? input.workspaceRoot.trim() : void 0;
 	let count;
 	if (input.count !== void 0) {
@@ -28601,6 +30787,7 @@ function parseStudioGenerateRequest(value) {
 		...resolution === void 0 ? {} : { resolution },
 		...generationQuality === void 0 ? {} : { generationQuality },
 		...watermark === void 0 ? {} : { watermark },
+		...output === void 0 ? {} : { output },
 		...count !== void 0 ? { count } : {},
 		...references.length > 0 ? {
 			references,
@@ -28609,6 +30796,19 @@ function parseStudioGenerateRequest(value) {
 		...workspaceRoot !== void 0 ? { workspaceRoot } : {}
 	};
 }
+/** Shape only; the frame ranges are checked where the request fields are built, like the chat tools. */
+function parseOutput(value) {
+	const output = record$1(value);
+	if (output === void 0 || output.format !== "gif") throw new Error("输出格式仅支持 gif");
+	for (const field of ["frameCount", "frameDurationMs"]) if (output[field] !== void 0 && typeof output[field] !== "number") throw new Error("GIF 帧参数须为数字");
+	const size = output.size === void 0 ? void 0 : requiredText(output.size, "GIF 帧尺寸无效", 32);
+	return {
+		format: "gif",
+		...typeof output.frameCount === "number" ? { frameCount: output.frameCount } : {},
+		...typeof output.frameDurationMs === "number" ? { frameDurationMs: output.frameDurationMs } : {},
+		...size === void 0 ? {} : { size }
+	};
+}
 function parseReference(value) {
 	const reference = record$1(value);
 	if (reference === void 0) throw new Error("参考图格式无效");
@@ -29044,6 +31244,20 @@ function serveSettingsHealth(req, res, health) {
 //#endregion
 //#region lib/types/image-tool-context.js
 /** Live, credential-free instructions for the conversation model's image tools. */
+/** Workflow names listed for the model; a long list is cut so the system prompt stays small. */
+const MAX_LISTED_WORKFLOWS = 20;
+/**
+* The ComfyUI workflows the `workflow` argument accepts (#98). Names are user
+* text, so each is JSON-quoted; the list stays absent without workflows.
+*/
+function comfyUIWorkflowLine(config) {
+	const workflows = resolveComfyUIWorkflows(config);
+	if (workflows.length === 0) return [];
+	const listed = workflows.slice(0, MAX_LISTED_WORKFLOWS).map((workflow) => JSON.stringify(workflow.name)).join(", ");
+	const more = workflows.length > MAX_LISTED_WORKFLOWS ? ` (+${String(workflows.length - MAX_LISTED_WORKFLOWS)} more)` : "";
+	const active = activeComfyUIWorkflow(config);
+	return [`ComfyUI workflows available for the workflow argument (provider=comfyui): ${listed}${more}; active: ${JSON.stringify(active?.name ?? "")}. Pass workflow only when the user asks for a specific one; the local ComfyUI server may not be running.`];
+}
 function imageToolContext(config, configuredProviders) {
 	const provider = config.provider ?? "google";
 	const configured = configuredProviders === void 0 ? void 0 : [...configuredProviders];
@@ -29059,6 +31273,7 @@ function imageToolContext(config, configuredProviders) {
 	return [
 		`Image tools current default provider: ${provider}; generation model: ${JSON.stringify(model)}; editing model: ${JSON.stringify(editModel)}.`,
 		...configured === void 0 ? [] : [`Configured image providers (credential saved, subscription logged in, or ComfyUI workflow present): ${configured.length > 0 ? configured.join(", ") : "none"}. Do not select unlisted providers; configuration presence does not guarantee service reachability.`],
+		...comfyUIWorkflowLine(config),
 		"Unless the user explicitly requests a different image provider or model, OMIT provider and model from generate_image, generate_images and edit_image. Do not guess a channel or switch channels after an error.",
 		"Omit unused optional arguments entirely; never fill them with empty strings. size and aspect_ratio are alternatives: provide at most one.",
 		"Subscription parameters: chatgpt-sub accepts size OR aspect_ratio, but NOT image_size. grok-sub image_size: 1K or 2K. google-sub image_size: 1K or 4K. Do not copy parameters from another provider.",
@@ -29084,7 +31299,8 @@ function cleanImageToolArgs(args) {
 		"aspect_ratio",
 		"image_size",
 		"quality",
-		"workflow"
+		"workflow",
+		"output_format"
 	]) {
 		const value = fields[key];
 		if (typeof value !== "string") continue;
@@ -29093,6 +31309,73 @@ function cleanImageToolArgs(args) {
 	}
 	return clean;
 }
+/** GIF output parameters shared by generate_image and generate_images (OpenAI images contract). */
+const gifToolParameters = {
+	output_format: {
+		type: "string",
+		enum: ["gif"],
+		description: "Optional. Only for provider=openai or openai-compat; gif produces a looping animation. For GIF, omit size unless the user asks for exact dimensions: all frames are tiled into one sheet whose longest edge must stay at or below 3840 px. To animate a subject from reference images, use edit_image with output_format=gif instead."
+	},
+	frame_count: {
+		type: "integer",
+		description: "Optional, GIF only: number of frames, 2-16. Omit to use the provider default."
+	},
+	frame_duration_ms: {
+		type: "integer",
+		description: "Optional, GIF only: milliseconds per frame, 20-2000; the provider rounds to 10 ms. Omit to use the provider default."
+	}
+};
+/** The same GIF parameters on edit_image, which animates the reference images. */
+const editGifToolParameters = {
+	...gifToolParameters,
+	output_format: {
+		type: "string",
+		enum: ["gif"],
+		description: "Optional. Only for provider=openai or openai-compat; gif animates the reference images into a looping animation, for example a sticker of the same character in motion. Omit size unless the user asks for exact dimensions: all frames are tiled into one sheet whose longest edge must stay at or below 3840 px. Many OpenAI-compatible relays do not implement image edits; if the relay rejects the edit or returns a still image, tell the user instead of retrying or assembling frames yourself."
+	}
+};
+/** Output schema node for GeneratedValue.animation; every object node must state additionalProperties. */
+const animationSchema = {
+	type: "object",
+	additionalProperties: false,
+	properties: {
+		frames: {
+			type: "integer",
+			required: true
+		},
+		frameDurationMs: {
+			type: "integer",
+			required: true
+		},
+		durationMs: {
+			type: "integer",
+			required: true
+		}
+	}
+};
+/** Output schema node for GeneratedValue.original, the same shape the gallery stores for imports. */
+const originalSchema = {
+	type: "object",
+	additionalProperties: false,
+	properties: {
+		key: {
+			type: "string",
+			required: true
+		},
+		bytes: {
+			type: "integer",
+			required: true
+		},
+		mediaType: {
+			type: "string",
+			required: true
+		}
+	}
+};
+/** GIF fields follow the OpenAI images contract; other providers would drop them silently. */
+function assertGifProvider(args, provider) {
+	if ((args.output_format !== void 0 || args.frame_count !== void 0 || args.frame_duration_ms !== void 0) && provider !== "openai" && provider !== "openai-compat") throw new Error("output_format, frame_count and frame_duration_ms are only supported with provider=openai or openai-compat.");
+}
 /** Validate the untrusted per-call provider override from tool arguments. */
 function providerOverrideOf(value) {
 	if (value === void 0 || value === null || value === "") return void 0;
@@ -29124,6 +31407,7 @@ function apply(ctx, config = {}) {
 			if (revision === imageContextRevision) configuredImageProviders = providers;
 		} catch {}
 	};
+	const vaultConfig = () => vaultConfigOf(current());
 	const settingsHealth = installImageSettings(ctx, current(), {
 		setSource: (source) => {
 			current = () => migrateOpenAICompatConfig(plainConfig(source()));
@@ -29132,6 +31416,33 @@ function apply(ctx, config = {}) {
 			refreshImageToolContext();
 		}
 	});
+	ctx.effect(() => {
+		const run = () => {
+			const config = current();
+			if (config.requestCachePrune === false) return;
+			const ttlDays = config.requestCacheTtlDays ?? 14;
+			const maxBytes = config.requestCacheMaxBytes ?? 268435456;
+			const configured = config.requestCacheDir ?? "";
+			pruneRequestImageCache({
+				dir: configured.length > 0 ? configured : resolveRequestImageCacheDir(),
+				ttlMs: ttlDays * 24 * 60 * 60 * 1e3,
+				maxBytes,
+				protectedRoots: [durableAttachmentsRoot(), vaultConfig().dir]
+			}).then((stats) => {
+				if (stats.removed > 0) ctx.logger.info("dsh-image-gen: pruned " + String(stats.removed) + " request-image variants (" + String(stats.freedBytes) + " bytes)");
+			}).catch((error) => {
+				ctx.logger.warn("dsh-image-gen: request-image cache prune failed: " + (error instanceof Error ? error.message : String(error)));
+			});
+		};
+		const startup = setTimeout(run, 3e4);
+		const daily = setInterval(run, 864e5);
+		startup.unref();
+		daily.unref();
+		return () => {
+			clearTimeout(startup);
+			clearInterval(daily);
+		};
+	}, "dsh-image-gen: request image cache upkeep");
 	let webAdmission;
 	ctx.inject(["connection"], (connectionCtx) => {
 		webAdmission = (request) => connectionCtx.connection.requestRejection(request);
@@ -29149,15 +31460,75 @@ function apply(ctx, config = {}) {
 			path: IMAGE_ROUTE,
 			handler: (req, res) => serveImage(req, res, { readImage: (ref) => ctx.attachments.readImage(ref) })
 		}), "dsh-image-gen: image route");
+		webCtx.effect(() => register({
+			kind: "exact",
+			path: THUMB_ROUTE,
+			handler: (req, res) => serveThumb(req, res, { readImageRequest: (ref, target, signal) => ctx.attachments.readImageRequest(ref, target, signal) })
+		}), "dsh-image-gen: thumbnail route");
+		webCtx.effect(() => register({
+			kind: "exact",
+			path: PREVIEW_ROUTE,
+			handler: (req, res) => servePreview(req, res, { readImageRequest: (ref, target, signal) => ctx.attachments.readImageRequest(ref, target, signal) })
+		}), "dsh-image-gen: preview route");
 		webCtx.effect(() => register({
 			kind: "exact",
 			path: IMPORT_ROUTE,
 			handler: (req, res) => serveImport(req, res, {
 				saveImage: (image) => ctx.attachments.saveImage(image),
 				maxImageBytes: ctx.attachments.imageLimits.maxImageBytes,
-				mediaTypes: ctx.attachments.imageLimits.mediaTypes
+				mediaTypes: ctx.attachments.imageLimits.mediaTypes,
+				warmThumbnail: (ref) => {
+					ctx.attachments.readImageRequest(ref, {
+						width: 320,
+						height: 320,
+						maxBytes: 98304
+					}).catch(() => void 0);
+				},
+				saveOriginal: (input) => saveImportedOriginal(vaultConfig(), input, typeof req.headers["x-dsh-vault-profile"] === "string" ? req.headers["x-dsh-vault-profile"] : void 0)
 			})
 		}), "dsh-image-gen: import route");
+		webCtx.effect(() => register({
+			kind: "exact",
+			path: ZIP_ROUTE,
+			handler: (req, res) => serveZip(req, res, {
+				readImage: (ref) => ctx.attachments.readImage(ref),
+				readVault: (key, mediaType) => readOriginal(vaultConfig(), key, mediaType),
+				maxEntries: 2e3
+			})
+		}), "dsh-image-gen: zip export route");
+		webCtx.effect(() => register({
+			kind: "exact",
+			path: ZIP_PROGRESS_ROUTE,
+			handler: (req, res) => serveZipProgress(req, res)
+		}), "dsh-image-gen: zip progress route");
+		webCtx.effect(() => register({
+			kind: "exact",
+			path: ZIP_CANCEL_ROUTE,
+			handler: (req, res) => serveZipCancel(req, res)
+		}), "dsh-image-gen: zip cancel route");
+		webCtx.effect(() => register({
+			kind: "exact",
+			path: VAULT_ROUTE,
+			handler: (req, res) => serveVault(req, res, vaultConfig())
+		}), "dsh-image-gen: vault route");
+		webCtx.effect(() => register({
+			kind: "exact",
+			path: VAULT_REFS_ROUTE,
+			handler: (req, res) => serveVaultRefs(req, res, vaultConfig())
+		}), "dsh-image-gen: vault refs route");
+		webCtx.effect(() => register({
+			kind: "exact",
+			path: VAULT_DELETE_ROUTE,
+			handler: (req, res) => serveVaultDelete(req, res, vaultConfig())
+		}), "dsh-image-gen: vault delete route");
+		webCtx.effect(() => register({
+			kind: "exact",
+			path: STORAGE_STATS_ROUTE,
+			handler: (req, res) => {
+				const configured = current().requestCacheDir?.trim() ?? "";
+				serveStorageStats(req, res, { requestImagesRoot: configured.length > 0 ? configured : resolveRequestImageCacheDir() });
+			}
+		}), "dsh-image-gen: storage stats route");
 		webCtx.effect(() => register({
 			kind: "exact",
 			path: DELETE_ROUTE,
@@ -29271,7 +31642,8 @@ function apply(ctx, config = {}) {
 					return generateFromStudio(ctx, current(), input, signal, fallbackRoot, subscriptionManager);
 				},
 				maxBodyBytes: Math.ceil(ctx.attachments.imageLimits.maxImageBytes * 1.4 * 5) + 262144,
-				timeoutMs: current().cloudTimeoutMs ?? 15e4
+				timeoutMs: current().cloudTimeoutMs ?? 15e4,
+				channelSelectsGif: (input) => channelSelectsGif(current(), input)
 			})
 		}), "dsh-image-gen: studio route");
 		const serveInspiration = createInspirationRoute();
@@ -29290,6 +31662,7 @@ function apply(ctx, config = {}) {
 		const args = cleanImageToolArgs(rawArgs);
 		const requestConfig = configForToolCall(current(), providerOverrideOf(args.provider), args.channel);
 		const active = resolveProvider(withProviderOverrides(requestConfig, providerOverrideOf(args.provider), args.model));
+		assertGifProvider(args, active.provider);
 		if (active.provider === "comfyui") {
 			const workflow = selectComfyUIWorkflow(active, args.workflow);
 			return saveGenerated(ctx, await generateComfyUIImage({
@@ -29316,7 +31689,7 @@ function apply(ctx, config = {}) {
 				signal: exec.signal
 			}), active.provider, active.model, "subscription", current(), exec, knownWorkspaceRoots);
 		}
-		const runCloud = (operation) => withGenerationTimeout(current().cloudTimeoutMs ?? 15e4, exec.signal, operation);
+		const runCloud = (operation, gif = false) => withGenerationTimeout(cloudTimeoutFor(current().cloudTimeoutMs, gif), exec.signal, operation);
 		const credential = await requireApiKey(ctx, active.provider, "generate_image", active.provider === "openai-compat" ? resolveOpenAICompatChannel(requestConfig, args.channel).keyRef : void 0);
 		if (active.provider === "google") {
 			const aspectRatio = args.aspect_ratio ?? active.aspectRatio;
@@ -29362,24 +31735,40 @@ function apply(ctx, config = {}) {
 				signal
 			})), active.provider, active.model, extraBody.aspect_ratio ?? "auto", current(), exec, knownWorkspaceRoots);
 		}
-		const size = args.size ?? active.imageSize;
+		const channelExtraBody = active.provider === "openai-compat" ? requestConfig.openaiCompatExtraBody ?? {} : void 0;
+		const gifFields = gifRequestFields({
+			outputFormat: args.output_format ?? (channelExtraBody?.output_format === "gif" ? "gif" : void 0),
+			frameCount: args.frame_count,
+			frameDurationMs: args.frame_duration_ms
+		});
+		const gifRequested = gifFields.output_format === "gif";
+		const size = gifRequested && args.size === void 0 ? void 0 : args.size ?? active.imageSize;
 		const arkOptions = active.provider === "seedream" ? active.arkOptions : void 0;
-		if (active.provider === "openai") validateOfficialSize(active.model, size);
+		if (active.provider === "openai" && size !== void 0) {
+			if (gifRequested) validateGifFrameSize(size);
+			else validateOfficialSize(active.model, size);
+		}
 		const quality = active.provider === "openai-compat" ? compatRequestQuality(requestConfig, args.quality) : active.provider === "openai" ? args.quality : void 0;
 		if (active.provider === "openai" && quality !== void 0 && !officialQualityOptions(active.model).some((option) => option.value === quality)) throw new Error("该 OpenAI 模型不支持所选生成质量");
-		const value = await saveGenerated(ctx, await runCloud((signal) => generateOpenAICompatibleImage({
+		const extraBody = channelExtraBody !== void 0 ? {
+			...channelExtraBody,
+			...gifFields
+		} : Object.keys(gifFields).length === 0 ? void 0 : gifFields;
+		const generated = await runCloud((signal) => generateOpenAICompatibleImage({
 			provider: active.provider,
 			apiKey: credential,
 			baseURL: active.baseURL,
 			model: active.model,
 			prompt: args.prompt,
-			size,
+			...size === void 0 ? {} : { size },
 			maxBytes: ctx.attachments.imageLimits.maxImageBytes,
 			signal,
 			...quality === void 0 ? {} : { quality },
-			...active.provider === "openai-compat" ? { extraBody: requestConfig.openaiCompatExtraBody ?? {} } : {},
+			...extraBody === void 0 ? {} : { extraBody },
 			...arkOptions === void 0 ? {} : { arkOptions }
-		})), active.provider, active.model, quality === void 0 ? size : `${size}, quality=${quality}`, current(), exec, knownWorkspaceRoots);
+		}), gifRequested);
+		const output = size ?? "auto";
+		const value = await saveGenerated(ctx, generated, active.provider, active.model, quality === void 0 ? output : `${output}, quality=${quality}`, current(), exec, knownWorkspaceRoots);
 		return active.provider === "openai-compat" ? {
 			...value,
 			channel: resolveOpenAICompatChannel(requestConfig, args.channel).id
@@ -29455,7 +31844,8 @@ function apply(ctx, config = {}) {
 			workflow: {
 				type: "string",
 				description: "Optional name of the ComfyUI workflow to run; omit to use the active workflow from settings. Only meaningful when the ComfyUI provider is selected."
-			}
+			},
+			...gifToolParameters
 		},
 		output: imageOutput("Generated"),
 		async execute(args, exec) {
@@ -29534,7 +31924,8 @@ function apply(ctx, config = {}) {
 			workflow: {
 				type: "string",
 				description: "Optional name of the ComfyUI workflow to run; omit to use the active workflow from settings."
-			}
+			},
+			...gifToolParameters
 		},
 		output: {
 			schema: {
@@ -29605,6 +31996,8 @@ function apply(ctx, config = {}) {
 								savedTo: { type: "string" },
 								saveError: { type: "string" },
 								seed: { type: "integer" },
+								animation: animationSchema,
+								original: originalSchema,
 								prompt: {
 									type: "string",
 									required: true
@@ -29635,10 +32028,10 @@ function apply(ctx, config = {}) {
 					}
 				}
 			},
-			render: (_args, value) => [{
+			render: (args, value) => [{
 				type: "text",
 				text: `Generated ${String(value.images.length)} of ${String(value.images.length + value.failures.length)} images.\n${value.failures.map((failure) => `${failure.prompt.slice(0, 80)} — failed: ${failure.error}`).join("\n")}`
-			}, ...value.images.flatMap((image) => imageOutput("Generated").render({}, image).map((block) => block.type === "text" ? {
+			}, ...value.images.flatMap((image) => imageOutput("Generated").render(args, image).map((block) => block.type === "text" ? {
 				...block,
 				text: `${block.text}\nImage prompt: ${image.prompt}`
 			} : block))],
@@ -29671,7 +32064,10 @@ function apply(ctx, config = {}) {
 						...args.image_size !== void 0 ? { image_size: args.image_size } : {},
 						...args.size !== void 0 ? { size: args.size } : {},
 						...args.quality !== void 0 ? { quality: args.quality } : {},
-						...args.workflow !== void 0 ? { workflow: args.workflow } : {}
+						...args.workflow !== void 0 ? { workflow: args.workflow } : {},
+						...args.output_format !== void 0 ? { output_format: args.output_format } : {},
+						...args.frame_count !== void 0 ? { frame_count: args.frame_count } : {},
+						...args.frame_duration_ms !== void 0 ? { frame_duration_ms: args.frame_duration_ms } : {}
 					}, exec);
 					images.push({
 						...value,
@@ -29694,7 +32090,7 @@ function apply(ctx, config = {}) {
 	}));
 	ctx.tools.register(defineTool({
 		name: "edit_image",
-		description: "Edit, combine, or restyle existing images with the configured provider. Images attached inline to the latest human message are already readable DSH attachments even when no workspace file exists. In that case, call edit_image immediately with prompt only; NEVER call read_image, glob, or shell to locate them, and NEVER invent @ paths. All inline images will be used in upload order. For specific older conversation images use source_attachment_id or source_attachment_ids; both canonical sha256: IDs and full bare SHA-256 digests are accepted. For files the user explicitly names in the workspace use source_path or source_paths. For what the user selected or drew on the image-gen workbench canvas (for example a hand-drawn sketch) use source=canvas_selection; canvas_state can verify a selection exists first. Provide exactly one selector field. Without a selector, images from the latest human message take priority; only when that message has no images does editing fall back to the newest conversation image. When the user wants a person, character, or object from the reference images kept as the same identity, write short hard identity-preservation instructions (use the same subject from the references; do not redesign it or synthesize a similar-looking replacement; change only scene, clothing, pose, lighting, style, or composition) instead of long generic appearance descriptions, which make the model replace the subject with a synthesized lookalike.",
+		description: "Edit, combine, or restyle existing images with the configured provider. Images attached inline to the latest human message are already readable DSH attachments even when no workspace file exists. In that case, call edit_image immediately with prompt only (plus output options such as output_format=gif when the user wants an animation); NEVER call read_image, glob, or shell to locate them, and NEVER invent @ paths. All inline images will be used in upload order. For specific older conversation images use source_attachment_id or source_attachment_ids; both canonical sha256: IDs and full bare SHA-256 digests are accepted. For files the user explicitly names in the workspace use source_path or source_paths. For what the user selected or drew on the image-gen workbench canvas (for example a hand-drawn sketch) use source=canvas_selection; canvas_state can verify a selection exists first. Provide exactly one selector field. Without a selector, images from the latest human message take priority; only when that message has no images does editing fall back to the newest conversation image. When the user wants a person, character, or object from the reference images kept as the same identity, write short hard identity-preservation instructions (use the same subject from the references; do not redesign it or synthesize a similar-looking replacement; change only scene, clothing, pose, lighting, style, or composition) instead of long generic appearance descriptions, which make the model replace the subject with a synthesized lookalike.",
 		parameters: {
 			prompt: {
 				type: "string",
@@ -29785,13 +32181,15 @@ function apply(ctx, config = {}) {
 			workflow: {
 				type: "string",
 				description: "Optional name of the ComfyUI workflow to run; omit to use the active workflow from settings. Only meaningful when the ComfyUI provider is selected."
-			}
+			},
+			...editGifToolParameters
 		},
 		output: imageOutput("Edited"),
 		async execute(rawArgs, exec) {
 			const args = cleanImageToolArgs(rawArgs);
 			const requestConfig = configForToolCall(current(), providerOverrideOf(args.provider), args.channel);
 			const active = resolveProvider(withProviderOverrides(requestConfig, providerOverrideOf(args.provider), args.model, "edit"));
+			assertGifProvider(args, active.provider);
 			const canvasSelection = args.source === "canvas_selection";
 			if (canvasSelection && (args.source_attachment_id !== void 0 || Array.isArray(args.source_attachment_ids) || args.source_path !== void 0 || Array.isArray(args.source_paths))) throw new Error("edit_image source=canvas_selection cannot be combined with source_attachment_id, source_attachment_ids, source_path, or source_paths; provide exactly one selector");
 			const sourceImages = canvasSelection ? await resolveCanvasSelectionReferences({
@@ -29864,7 +32262,17 @@ function apply(ctx, config = {}) {
 			}
 			const size = args.size ?? active.imageSize;
 			if (active.provider === "openai" || active.provider === "openai-compat" || active.provider === "xai" || active.provider === "zhipu") {
-				if (active.provider === "openai") validateOfficialSize(active.model, size);
+				const gifFields = gifRequestFields({
+					outputFormat: args.output_format,
+					frameCount: args.frame_count,
+					frameDurationMs: args.frame_duration_ms
+				});
+				const gifRequested = gifFields.output_format === "gif";
+				const editSize = gifRequested && args.size === void 0 ? void 0 : size;
+				if (active.provider === "openai" && editSize !== void 0) {
+					if (gifRequested) validateGifFrameSize(editSize);
+					else validateOfficialSize(active.model, editSize);
+				}
 				const quality = active.provider === "openai-compat" ? compatRequestQuality(requestConfig, args.quality) : active.provider === "openai" ? args.quality : void 0;
 				if (active.provider === "openai" && quality !== void 0 && !officialQualityOptions(active.model).some((option) => option.value === quality)) throw new Error("该 OpenAI 模型不支持所选生成质量");
 				const xaiExtraBody = active.provider === "xai" ? xaiToolParameters({
@@ -29872,25 +32280,32 @@ function apply(ctx, config = {}) {
 					...args.image_size !== void 0 ? { imageSize: args.image_size } : {},
 					...args.size !== void 0 ? { size: args.size } : {}
 				}) : void 0;
-				const value = await saveGenerated(ctx, await editOpenAICompatibleImage({
+				const generated = await editOpenAICompatibleImage({
 					apiKey: credential,
 					baseURL: active.baseURL,
 					model: active.model,
 					prompt: args.prompt,
 					sourceImages,
-					...active.provider === "xai" ? {} : { size },
+					...active.provider === "xai" || editSize === void 0 ? {} : { size: editSize },
 					...quality === void 0 ? {} : { quality },
 					maxBytes: ctx.attachments.imageLimits.maxImageBytes,
 					signal: exec.signal,
+					...gifRequested ? { extraBody: gifFields } : {},
 					...active.provider === "openai-compat" ? {
 						editFormat: active.editFormat,
 						editExtra: active.editExtra,
-						editSizeMode: requestConfig.openaiCompatEditSizeMode ?? "auto"
+						editSizeMode: requestConfig.openaiCompatEditSizeMode ?? "auto",
+						editResponseFormat: "auto",
+						onResponseFormatRetry: (status) => {
+							ctx.logger.warn("dsh-image-gen: openai-compatible relay rejected response_format=b64_json (" + String(status) + "); retrying without it");
+						}
 					} : active.provider === "xai" ? {
 						editFormat: "xaiJson",
 						...xaiExtraBody === void 0 ? {} : { extraBody: xaiExtraBody }
 					} : {}
-				}), active.provider, active.model, active.provider === "xai" ? xaiExtraBody?.aspect_ratio ?? "auto" : quality === void 0 ? size : `${size}, quality=${quality}`, current(), exec, knownWorkspaceRoots);
+				});
+				const output = editSize ?? "auto";
+				const value = await saveGenerated(ctx, generated, active.provider, active.model, active.provider === "xai" ? xaiExtraBody?.aspect_ratio ?? "auto" : quality === void 0 ? output : `${output}, quality=${quality}`, current(), exec, knownWorkspaceRoots);
 				return active.provider === "openai-compat" ? {
 					...value,
 					channel: resolveOpenAICompatChannel(requestConfig, args.channel).id
@@ -30070,15 +32485,17 @@ function imageOutput(verb) {
 				},
 				savedTo: { type: "string" },
 				saveError: { type: "string" },
-				seed: { type: "integer" }
+				seed: { type: "integer" },
+				animation: animationSchema,
+				original: originalSchema
 			}
 		},
-		render: (_args, value) => {
+		render: (args, value) => {
 			const saved = typeof value.savedTo === "string" ? ` It was also saved to the workspace as ${value.savedTo}.` : typeof value.saveError === "string" ? ` Saving it to the workspace failed: ${value.saveError}.` : " It has no local file path.";
 			const action = verb === "Generated" ? "It is already attached to the conversation." : "The edited image is attached to the conversation.";
 			return [{
 				type: "text",
-				text: `${verb} one image with ${value.provider}/${value.model} (${value.output}). Attachment ID: ${String(value.attachment.attachmentId)}. ${action}${saved} Respond to the user without reading or searching for the image.`
+				text: `${verb} one image with ${value.provider}/${value.model} (${value.output}). Attachment ID: ${String(value.attachment.attachmentId)}. ${action}${saved} Respond to the user without reading or searching for the image.${animationNotes(args, value)}${cardNote(value)}${originalNote(value)}`
 			}, {
 				type: "image",
 				attachment: value.attachment
@@ -30094,10 +32511,67 @@ function imageOutput(verb) {
 			...verb === "Edited" ? { operation: "edit" } : {},
 			...typeof value.savedTo === "string" ? { savedTo: value.savedTo } : {},
 			...typeof value.seed === "number" ? { seed: value.seed } : {},
+			...value.original === void 0 ? {} : { original: {
+				key: value.original.key,
+				bytes: value.original.bytes,
+				mediaType: value.original.mediaType
+			} },
 			prompt: args.prompt
 		})
 	};
 }
+/**
+* What the model needs to know about an animated result: that it is complete
+* (the attached preview may be a still first frame), and whether the provider
+* honoured the GIF parameters it was asked for.
+*/
+function animationNotes(args, value) {
+	const requested = args ?? {};
+	const animation = value.animation;
+	if (animation === void 0) return requested.output_format === "gif" ? " Requested a GIF, but the provider returned a still image (no animation frames); the model or relay may not support GIF output." : "";
+	let notes = ` The image is an animated GIF: ${String(animation.frames)} frames × ${String(animation.frameDurationMs)} ms (${String(animation.durationMs / 1e3)}s loop). It is complete; do not regenerate or redraw individual frames unless the user asks.`;
+	if (value.attachment.mediaType !== "image/gif") notes += " The attached preview shows only its first frame.";
+	const mismatches = [];
+	if (typeof requested.frame_count === "number" && requested.frame_count !== animation.frames) mismatches.push(`Requested ${String(requested.frame_count)} frames but received ${String(animation.frames)}`);
+	if (typeof requested.frame_duration_ms === "number" && Math.abs(requested.frame_duration_ms - animation.frameDurationMs) >= 10) mismatches.push(`Requested ${String(requested.frame_duration_ms)} ms per frame but received ${String(animation.frameDurationMs)} ms`);
+	if (mismatches.length > 0) notes += ` ${mismatches.join(". ")}; the provider may have ignored the GIF parameters.`;
+	return notes;
+}
+/**
+* The result card already shows the image and links its saved file; an embed
+* or a link in the reply shows the same result twice, and a ready-made embed
+* gets copied even when told not to. A GIF the card cannot play (no vault
+* copy, still attachment) is the exception: only an embed of the saved file
+* animates. Inside run_code the program receives the structured value, never
+* this text, so the text only serves direct calls.
+*/
+function cardNote(value) {
+	const animated = value.animation !== void 0;
+	if (animated && value.attachment.mediaType !== "image/gif" && value.original === void 0) return typeof value.savedTo === "string" ? ` To show the animation, embed the saved file in your reply with Markdown: ![animated GIF](<${value.savedTo.replace(/\\/g, "/")}>)` : "";
+	const saved = typeof value.savedTo === "string" ? " and where it was saved" : "";
+	return ` The result card in the conversation already ${animated ? "plays the animation" : "shows the image"}${saved}; do not embed the image or link its file in your reply unless the user asks.`;
+}
+/**
+* A run_code sub-call reaches the client only as this rendered text (no
+* presentationMeta), so the vault reference rides here in a fixed sentence the
+* PTC card parser reads (image-result-node.ts ORIGINAL_NOTE_PATTERN). Without
+* it a GIF made through run_code shows its still first frame only.
+*/
+function originalNote(value) {
+	const original = value.original;
+	return original === void 0 ? "" : ` Original animation (for the result card only): vault ${original.key}, ${String(original.bytes)} bytes, ${original.mediaType}.`;
+}
+/** Frame facts for a GIF result; a single-frame GIF is a still image and gets none. */
+function animationOf(generated) {
+	if (generated.mediaType !== "image/gif") return void 0;
+	const info = readGifInfo(generated.data);
+	if (info === void 0 || info.frames < 2) return void 0;
+	return {
+		frames: info.frames,
+		frameDurationMs: gifFrameDurationMs(info.delaysMs),
+		durationMs: info.delaysMs.reduce((sum, delay) => sum + delay, 0)
+	};
+}
 function attachmentMeta(ref) {
 	return {
 		attachmentId: String(ref.attachmentId),
@@ -30119,12 +32593,18 @@ async function saveGenerated(ctx, generated, provider, model, output, config, ex
 		mediaType: generated.mediaType,
 		name: "generated-image"
 	});
+	const animation = animationOf(generated);
+	const original = await keepGifOriginal(vaultConfigOf(config), generated, attachment, (message) => {
+		ctx.logger.warn(message);
+	});
 	const value = {
 		attachment,
 		provider,
 		model,
 		output,
-		...typeof generated.seed === "number" ? { seed: generated.seed } : {}
+		...typeof generated.seed === "number" ? { seed: generated.seed } : {},
+		...animation === void 0 ? {} : { animation },
+		...original === void 0 ? {} : { original }
 	};
 	if (config.saveToWorkspace === false) return value;
 	const workspaceRoot = exec.agent?.session.header.cwd;