ima2-gen 1.1.4 → 1.1.5

package/routes/generate.js

@@ -11,6 +11,7 @@ import { startJob, finishJob } from "../lib/inflight.js";
 import { getStyleSheet } from "../lib/sessionStore.js";
 import { renderStyleSheetPrefix } from "../lib/styleSheet.js";
 import { logEvent, logError } from "../lib/logger.js";
+import { embedImageMetadataBestEffort } from "../lib/imageMetadataStore.js";
 
 function validateModeration(ctx, moderation) {
   if (typeof moderation !== "string" || !ctx.config.oauth.validModeration.has(moderation)) {
@@ -104,6 +105,8 @@ export function registerGenerateRoutes(app, ctx) {
         return res.status(403).json({ error: "API key provider is disabled. Use OAuth (Codex login).", code: "APIKEY_DISABLED" });
       }
       const client = req.get("x-ima2-client") || "ui";
+      const referenceDiagnostics = refCheck.referenceDiagnostics || [];
+      const referenceMismatchCount = referenceDiagnostics.filter((ref) => ref.warnings?.includes("mime_mismatch")).length;
       logEvent("generate", "request", {
         requestId,
         client,
@@ -114,6 +117,9 @@ export function registerGenerateRoutes(app, ctx) {
         moderation,
         n: count,
         refs: refCheck.refs.length,
+        referenceMismatchCount,
+        refDetectedMimes: [...new Set(referenceDiagnostics.map((ref) => ref.detectedMime).filter(Boolean))].join(","),
+        refDeclaredMimes: [...new Set(referenceDiagnostics.map((ref) => ref.declaredMime).filter(Boolean))].join(","),
         sessionId,
         clientNodeId,
         promptChars: typeof prompt === "string" ? prompt.length : 0,
@@ -136,7 +142,7 @@ export function registerGenerateRoutes(app, ctx) {
               quality,
               size,
               moderation,
-              refCheck.refs,
+              refCheck.refDetails || refCheck.refs,
               requestId,
               normalizedPromptMode,
               ctx,
@@ -165,8 +171,11 @@ export function registerGenerateRoutes(app, ctx) {
         if (r.status === "fulfilled" && r.value.b64) {
           const rand = randomBytes(ctx.config.ids.generatedHexBytes).toString("hex");
           const filename = `${Date.now()}_${rand}_${images.length}.${format}`;
-          await writeFile(join(ctx.config.storage.generatedDir, filename), Buffer.from(r.value.b64, "base64"));
           const meta = {
+            kind: "classic",
+            requestId,
+            sessionId,
+            clientNodeId,
             prompt,
             userPrompt: prompt,
             revisedPrompt: r.value.revisedPrompt || null,
@@ -182,7 +191,21 @@ export function registerGenerateRoutes(app, ctx) {
             createdAt: Date.now(),
             usage: r.value.usage || null,
             webSearchCalls: r.value.webSearchCalls || 0,
+            refsCount: refCheck.refs.length,
           };
+          const rawBuffer = Buffer.from(r.value.b64, "base64");
+          const embedded = await embedImageMetadataBestEffort(rawBuffer, format, meta, {
+            version: ctx.packageVersion,
+          });
+          if (!embedded.embedded) {
+            logEvent("generate", "metadata_embed_skipped", {
+              requestId,
+              filename,
+              code: embedded.code,
+              warning: embedded.warning,
+            });
+          }
+          await writeFile(join(ctx.config.storage.generatedDir, filename), embedded.buffer);
           await writeFile(join(ctx.config.storage.generatedDir, filename + ".json"), JSON.stringify(meta)).catch(() => {});
           images.push({
             image: `data:${mime};base64,${r.value.b64}`,
@@ -214,6 +237,10 @@ export function registerGenerateRoutes(app, ctx) {
             upstreamCode: firstErr.upstreamCode || null,
             upstreamType: firstErr.upstreamType || null,
             upstreamParam: firstErr.upstreamParam || null,
+            diagnosticReason: firstErr.diagnosticReason || null,
+            retryKind: firstErr.retryKind || null,
+            referencesDroppedOnRetry: firstErr.referencesDroppedOnRetry ?? null,
+            errorEventCount: firstErr.eventCount ?? null,
             requestId,
           });
         }
@@ -270,6 +297,10 @@ export function registerGenerateRoutes(app, ctx) {
         upstreamCode: err.upstreamCode || null,
         upstreamType: err.upstreamType || null,
         upstreamParam: err.upstreamParam || null,
+        diagnosticReason: err.diagnosticReason || null,
+        retryKind: err.retryKind || null,
+        referencesDroppedOnRetry: err.referencesDroppedOnRetry ?? null,
+        errorEventCount: err.eventCount ?? null,
         requestId,
       });
     } finally {

package/routes/history.js

@@ -2,6 +2,7 @@ import { listHistoryRows } from "../lib/historyList.js";
 import { trashAsset, restoreAsset } from "../lib/assetLifecycle.js";
 import { getSessionTitleMap } from "../lib/sessionStore.js";
 import { logError, logEvent } from "../lib/logger.js";
+import { getDb } from "../lib/db.js";
 
 export function registerHistoryRoutes(app, ctx) {
   app.get("/api/history", async (req, res) => {
@@ -16,9 +17,18 @@ export function registerHistoryRoutes(app, ctx) {
       const sinceTs = parseInt(req.query.since);
       const sessionId = typeof req.query.sessionId === "string" ? req.query.sessionId : null;
       const groupBy = req.query.groupBy === "session" ? "session" : null;
+      const browserId = req.headers["x-ima2-browser-id"] || null;
 
       const rows = await listHistoryRows(ctx.config.storage.generatedDir);
 
+      // Enrich with favorite status
+      let favoriteSet = new Set();
+      if (browserId) {
+        const db = getDb();
+        const favRows = db.prepare("SELECT filename FROM gallery_favorites WHERE browser_id = ?").all(browserId);
+        favoriteSet = new Set(favRows.map((r) => r.filename));
+      }
+
       let filtered = rows;
       if (Number.isFinite(sinceTs)) {
         filtered = filtered.filter((r) => r.createdAt > sinceTs);
@@ -34,7 +44,7 @@ export function registerHistoryRoutes(app, ctx) {
         filtered = filtered.filter((r) => r.sessionId === sessionId);
       }
 
-      const page = filtered.slice(0, limit);
+      const page = filtered.slice(0, limit).map((r) => ({ ...r, isFavorite: favoriteSet.has(r.filename) }));
       const nextCursor = page.length === limit && filtered.length > limit
         ? { before: page[page.length - 1].createdAt, beforeFilename: page[page.length - 1].filename }
         : null;
@@ -99,4 +109,35 @@ export function registerHistoryRoutes(app, ctx) {
       res.status(err.status || 500).json({ error: err.message });
     }
   });
+
+  app.post("/api/history/favorite", async (req, res) => {
+    try {
+      const db = getDb();
+      const { filename } = req.body || {};
+      const browserId = req.headers["x-ima2-browser-id"];
+
+      if (!filename || typeof filename !== "string") {
+        return res.status(400).json({ error: "filename is required" });
+      }
+      if (!browserId || typeof browserId !== "string") {
+        return res.status(400).json({ error: "X-Ima2-Browser-Id header is required" });
+      }
+
+      const existing = db.prepare("SELECT id FROM gallery_favorites WHERE browser_id = ? AND filename = ?").get(browserId, filename);
+
+      if (existing) {
+        db.prepare("DELETE FROM gallery_favorites WHERE browser_id = ? AND filename = ?").run(browserId, filename);
+        res.json({ isFavorite: false });
+      } else {
+        const id = `${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 8)}`;
+        db.prepare(
+          "INSERT INTO gallery_favorites (id, browser_id, filename, favorited_at) VALUES (?, ?, ?, ?)"
+        ).run(id, browserId, filename, Math.floor(Date.now() / 1000));
+        res.json({ isFavorite: true });
+      }
+    } catch (err) {
+      logError("history", "favorite_error", err);
+      res.status(500).json({ error: err.message });
+    }
+  });
 }

package/routes/index.js

@@ -6,14 +6,18 @@ import { registerNodeRoutes } from "./nodes.js";
 import { registerGenerateRoutes } from "./generate.js";
 import { registerStorageRoutes } from "./storage.js";
 import { registerCardNewsRoutes } from "./cardNews.js";
+import { registerMetadataRoutes } from "./metadata.js";
+import { registerPromptRoutes } from "./prompts.js";
 
 export function configureRoutes(app, ctx) {
   registerHealthRoutes(app, ctx);
   registerStorageRoutes(app, ctx);
+  registerMetadataRoutes(app, ctx);
   registerHistoryRoutes(app, ctx);
   registerSessionRoutes(app, ctx);
   registerEditRoutes(app, ctx);
   registerNodeRoutes(app, ctx);
   if (ctx.config.features.cardNews) registerCardNewsRoutes(app, ctx);
   registerGenerateRoutes(app, ctx);
+  registerPromptRoutes(app, ctx);
 }

package/routes/metadata.js

@@ -0,0 +1,71 @@
+import { Buffer } from "node:buffer";
+import {
+  isSupportedMetadataFormat,
+  normalizeImageMetadataFormat,
+  readEmbeddedImageMetadata,
+} from "../lib/imageMetadataStore.js";
+
+const MIME_FORMATS = {
+  "image/png": "png",
+  "image/jpeg": "jpeg",
+  "image/webp": "webp",
+};
+
+function parseDataUrl(dataUrl) {
+  if (typeof dataUrl !== "string") return null;
+  const match = /^data:([^;,]+);base64,(.+)$/s.exec(dataUrl);
+  if (!match) return null;
+  return { mime: match[1].toLowerCase(), rawB64: match[2] };
+}
+
+export function registerMetadataRoutes(app, ctx) {
+  app.post("/api/metadata/read", async (req, res) => {
+    try {
+      const parsed = parseDataUrl(req.body?.dataUrl);
+      if (!parsed) {
+        return res.status(400).json({
+          ok: false,
+          code: "IMAGE_METADATA_INVALID",
+          error: "A base64 image data URL is required.",
+        });
+      }
+      if (parsed.rawB64.length > ctx.config.limits.maxMetadataReadB64Bytes) {
+        return res.status(413).json({
+          ok: false,
+          code: "IMAGE_METADATA_TOO_LARGE",
+          error: "Image is too large to inspect for metadata.",
+        });
+      }
+      const format = normalizeImageMetadataFormat(MIME_FORMATS[parsed.mime]);
+      if (!isSupportedMetadataFormat(format)) {
+        return res.status(400).json({
+          ok: false,
+          code: "IMAGE_METADATA_UNSUPPORTED_FORMAT",
+          error: "Only PNG, JPEG, and WebP metadata can be inspected.",
+        });
+      }
+      const result = await readEmbeddedImageMetadata(Buffer.from(parsed.rawB64, "base64"));
+      if (!result.metadata) {
+        return res.json({
+          ok: true,
+          metadata: null,
+          source: null,
+          code: "IMAGE_METADATA_NOT_FOUND",
+          warnings: result.warnings,
+        });
+      }
+      return res.json({
+        ok: true,
+        metadata: result.metadata,
+        source: result.source,
+        warnings: result.warnings,
+      });
+    } catch (error) {
+      return res.status(400).json({
+        ok: false,
+        code: error?.code || "IMAGE_METADATA_INVALID",
+        error: error?.message || "Could not read image metadata.",
+      });
+    }
+  });
+}

package/routes/nodes.js

@@ -181,7 +181,10 @@ export function registerNodeRoutes(app, ctx) {
         parentB64 = await loadAssetB64(ctx.rootDir, externalSrc, ctx.config.storage.generatedDir);
       }
       const operation = parentB64 ? "edit" : "generate";
-      const refsForRequest = contextMode === "parent-only" ? [] : refCheck.refs;
+      const referenceDiagnostics = refCheck.referenceDiagnostics || [];
+      const generateReferenceDiagnostics = operation === "generate" ? referenceDiagnostics : [];
+      const referenceMismatchCount = generateReferenceDiagnostics.filter((ref) => ref.warnings?.includes("mime_mismatch")).length;
+      const refsForRequest = contextMode === "parent-only" ? [] : (refCheck.refDetails || refCheck.refs);
       const webSearchEnabled = !parentB64 || searchMode === "on";
       const parentImagePresent = !!parentB64;
       const inputImageCount = (parentImagePresent ? 1 : 0) + refsForRequest.length;
@@ -196,6 +199,9 @@ export function registerNodeRoutes(app, ctx) {
         size,
         moderation,
         refs: refsForRequest.length,
+        referenceMismatchCount,
+        refDetectedMimes: [...new Set(generateReferenceDiagnostics.map((ref) => ref.detectedMime).filter(Boolean))].join(","),
+        refDeclaredMimes: [...new Set(generateReferenceDiagnostics.map((ref) => ref.declaredMime).filter(Boolean))].join(","),
         inputImageCount,
         parentImagePresent,
         contextMode,
@@ -302,6 +308,9 @@ export function registerNodeRoutes(app, ctx) {
           upstreamCode: lastErr?.upstreamCode || lastErr?.code,
           errorEventType: lastErr?.eventType,
           errorEventCount: lastErr?.eventCount,
+          diagnosticReason: lastErr?.diagnosticReason,
+          retryKind: lastErr?.retryKind,
+          referencesDroppedOnRetry: lastErr?.referencesDroppedOnRetry,
           attempts: MAX_RETRIES + 1,
           outerHttpAlreadyCommitted: res.headersSent,
           sseErrorSent: streamResponse,
@@ -318,6 +327,11 @@ export function registerNodeRoutes(app, ctx) {
             upstreamParam: lastErr?.upstreamParam || null,
             errorEventType: lastErr?.eventType || null,
             errorEventCount: lastErr?.eventCount ?? null,
+            diagnosticReason: finalErr.diagnosticReason || lastErr?.diagnosticReason || null,
+            retryKind: finalErr.retryKind || lastErr?.retryKind || null,
+            referencesDroppedOnRetry: finalErr.referencesDroppedOnRetry ?? lastErr?.referencesDroppedOnRetry ?? null,
+            refsCount: finalErr.refsCount ?? lastErr?.refsCount ?? null,
+            inputImageCount: finalErr.inputImageCount ?? lastErr?.inputImageCount ?? null,
           },
         );
       }

package/routes/prompts.js

@@ -0,0 +1,379 @@
+import { logError, logEvent } from "../lib/logger.js";
+import { getDb } from "../lib/db.js";
+
+function getPromptsDb() {
+  return getDb();
+}
+
+function generateId() {
+  return `${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 8)}`;
+}
+
+export function registerPromptRoutes(app, ctx) {
+  // ── Prompts ───────────────────────────────────────────────────────────────
+
+  app.get("/api/prompts", async (req, res) => {
+    try {
+      const db = getPromptsDb();
+      const search = typeof req.query.search === "string" ? req.query.search.trim() : "";
+      const folderId = typeof req.query.folderId === "string" ? req.query.folderId : null;
+      const favoritesOnly = req.query.favoritesOnly === "1" || req.query.favoritesOnly === "true";
+
+      let where = "WHERE 1=1";
+      const params = [];
+
+      if (folderId) {
+        where += " AND p.folder_id = ?";
+        params.push(folderId);
+      } else {
+        where += " AND p.folder_id != '__trash__'";
+      }
+
+      if (favoritesOnly) {
+        where += " AND p.is_favorite = 1";
+      }
+
+      if (search) {
+        where += " AND (p.name LIKE ? OR p.text LIKE ? OR p.tags LIKE ?)";
+        const like = `%${search}%`;
+        params.push(like, like, like);
+      }
+
+      const prompts = db
+        .prepare(
+          `SELECT p.*, f.name as folder_name
+           FROM prompts p
+           LEFT JOIN prompt_folders f ON p.folder_id = f.id
+           ${where}
+           ORDER BY p.updated_at DESC`
+        )
+        .all(...params);
+
+      const folders = db
+        .prepare("SELECT * FROM prompt_folders WHERE id NOT IN ('__root__', '__trash__') ORDER BY name COLLATE NOCASE")
+        .all();
+
+      res.json({ prompts: prompts.map(normalizePrompt), folders: folders.map(normalizeFolder) });
+    } catch (err) {
+      logError("prompts", "list_error", err);
+      res.status(500).json({ error: err.message });
+    }
+  });
+
+  app.post("/api/prompts", async (req, res) => {
+    try {
+      const db = getPromptsDb();
+      const { name, text, tags, folderId, mode } = req.body || {};
+
+      if (!text || typeof text !== "string") {
+        return res.status(400).json({ error: "text is required" });
+      }
+
+      const promptName = typeof name === "string" && name.trim() ? name.trim() : text.slice(0, 30);
+      const folder_id = typeof folderId === "string" && folderId ? folderId : "__root__";
+      const tagsJson = Array.isArray(tags) ? JSON.stringify(tags) : null;
+      const id = generateId();
+      const now = Math.floor(Date.now() / 1000);
+
+      db.prepare(
+        `INSERT INTO prompts (id, folder_id, name, text, tags, mode, created_at, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?)`
+      ).run(id, folder_id, promptName, text, tagsJson, mode || null, now, now);
+
+      logEvent("prompts", "created", { id, folder_id });
+      res.status(201).json({ prompt: normalizePrompt(db.prepare("SELECT * FROM prompts WHERE id = ?").get(id)) });
+    } catch (err) {
+      logError("prompts", "create_error", err);
+      res.status(500).json({ error: err.message });
+    }
+  });
+
+  app.get("/api/prompts/:id", async (req, res) => {
+    try {
+      const db = getPromptsDb();
+      const row = db.prepare("SELECT * FROM prompts WHERE id = ?").get(req.params.id);
+      if (!row) return res.status(404).json({ error: "Not found" });
+      res.json({ prompt: normalizePrompt(row) });
+    } catch (err) {
+      logError("prompts", "get_error", err);
+      res.status(500).json({ error: err.message });
+    }
+  });
+
+  app.patch("/api/prompts/:id", async (req, res) => {
+    try {
+      const db = getPromptsDb();
+      const { name, text, tags, folderId, mode } = req.body || {};
+      const sets = [];
+      const params = [];
+
+      if (typeof name === "string") { sets.push("name = ?"); params.push(name); }
+      if (typeof text === "string") { sets.push("text = ?"); params.push(text); }
+      if (Array.isArray(tags)) { sets.push("tags = ?"); params.push(JSON.stringify(tags)); }
+      if (typeof folderId === "string") { sets.push("folder_id = ?"); params.push(folderId); }
+      if (typeof mode === "string") { sets.push("mode = ?"); params.push(mode); }
+
+      if (sets.length === 0) return res.status(400).json({ error: "No fields to update" });
+
+      sets.push("updated_at = ?");
+      params.push(Math.floor(Date.now() / 1000));
+      params.push(req.params.id);
+
+      db.prepare(`UPDATE prompts SET ${sets.join(", ")} WHERE id = ?`).run(...params);
+
+      const row = db.prepare("SELECT * FROM prompts WHERE id = ?").get(req.params.id);
+      res.json({ prompt: normalizePrompt(row) });
+    } catch (err) {
+      logError("prompts", "patch_error", err);
+      res.status(500).json({ error: err.message });
+    }
+  });
+
+  app.delete("/api/prompts/:id", async (req, res) => {
+    try {
+      const db = getPromptsDb();
+      db.prepare("UPDATE prompts SET folder_id = '__trash__', updated_at = ? WHERE id = ?").run(
+        Math.floor(Date.now() / 1000),
+        req.params.id,
+      );
+      logEvent("prompts", "soft_deleted", { id: req.params.id });
+      res.json({ ok: true });
+    } catch (err) {
+      logError("prompts", "delete_error", err);
+      res.status(500).json({ error: err.message });
+    }
+  });
+
+  app.post("/api/prompts/:id/favorite", async (req, res) => {
+    try {
+      const db = getPromptsDb();
+      const row = db.prepare("SELECT is_favorite FROM prompts WHERE id = ?").get(req.params.id);
+      if (!row) return res.status(404).json({ error: "Not found" });
+
+      const newVal = row.is_favorite ? 0 : 1;
+      const now = Math.floor(Date.now() / 1000);
+      db.prepare("UPDATE prompts SET is_favorite = ?, favorited_at = ? WHERE id = ?").run(
+        newVal,
+        newVal ? now : null,
+        req.params.id,
+      );
+
+      res.json({ isFavorite: !!newVal, favoritedAt: newVal ? now : null });
+    } catch (err) {
+      logError("prompts", "favorite_error", err);
+      res.status(500).json({ error: err.message });
+    }
+  });
+
+  // ── Import / Export ───────────────────────────────────────────────────────
+
+  app.post("/api/prompts/import", async (req, res) => {
+    try {
+      const db = getPromptsDb();
+      const { folders: importFolders = [], prompts: importPrompts = [] } = req.body || {};
+
+      const result = { foldersCreated: 0, promptsImported: 0, duplicatesSkipped: 0 };
+      const now = Math.floor(Date.now() / 1000);
+
+      // Build name→id map for existing folders
+      const existingFolders = db.prepare("SELECT * FROM prompt_folders").all();
+      const folderMap = new Map(existingFolders.map((f) => [f.id, f]));
+      const namePathMap = new Map();
+      for (const f of existingFolders) {
+        const parent = folderMap.get(f.parent_id);
+        const path = parent && parent.id !== "__root__" ? `${parent.name}/${f.name}` : f.name;
+        namePathMap.set(path.toLowerCase(), f.id);
+      }
+
+      // Import folders
+      for (const f of importFolders) {
+        if (!f.name) continue;
+        const path = f.parentId && f.parentId !== "__root__"
+          ? `${folderMap.get(f.parentId)?.name || ""}/${f.name}`
+          : f.name;
+        if (namePathMap.has(path.toLowerCase())) continue;
+
+        const id = f.id || generateId();
+        db.prepare(
+          "INSERT INTO prompt_folders (id, parent_id, name, created_at, updated_at) VALUES (?, ?, ?, ?, ?)"
+        ).run(id, f.parentId || "__root__", f.name, now, now);
+        namePathMap.set(path.toLowerCase(), id);
+        folderMap.set(id, { id, parent_id: f.parentId || "__root__", name: f.name });
+        result.foldersCreated++;
+      }
+
+      // Import prompts
+      for (const p of importPrompts) {
+        if (!p.text) continue;
+        const folderId = p.folderId && folderMap.has(p.folderId) ? p.folderId : "__root__";
+        // Check duplicate by text + folder
+        const dup = db.prepare("SELECT 1 FROM prompts WHERE text = ? AND folder_id = ? LIMIT 1").get(p.text, folderId);
+        if (dup) {
+          result.duplicatesSkipped++;
+          continue;
+        }
+        const id = p.id || generateId();
+        const tagsJson = Array.isArray(p.tags) ? JSON.stringify(p.tags) : null;
+        db.prepare(
+          `INSERT INTO prompts (id, folder_id, name, text, tags, mode, is_favorite, created_at, updated_at)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`
+        ).run(id, folderId, p.name || p.text.slice(0, 30), p.text, tagsJson, p.mode || null, p.isFavorite ? 1 : 0, now, now);
+        result.promptsImported++;
+      }
+
+      logEvent("prompts", "imported", result);
+      res.json(result);
+    } catch (err) {
+      logError("prompts", "import_error", err);
+      res.status(500).json({ error: err.message });
+    }
+  });
+
+  app.get("/api/prompts/export", async (req, res) => {
+    try {
+      const db = getPromptsDb();
+      const prompts = db.prepare("SELECT * FROM prompts WHERE folder_id != '__trash__'").all();
+      const folders = db.prepare("SELECT * FROM prompt_folders WHERE id NOT IN ('__root__', '__trash__')").all();
+
+      res.json({
+        version: 1,
+        exportedAt: new Date().toISOString(),
+        folders: folders.map((f) => ({ id: f.id, name: f.name, parentId: f.parent_id })),
+        prompts: prompts.map((p) => ({
+          id: p.id,
+          name: p.name,
+          text: p.text,
+          tags: p.tags ? JSON.parse(p.tags) : [],
+          folderId: p.folder_id,
+          mode: p.mode,
+          isFavorite: !!p.is_favorite,
+        })),
+      });
+    } catch (err) {
+      logError("prompts", "export_error", err);
+      res.status(500).json({ error: err.message });
+    }
+  });
+
+  // ── Folders ───────────────────────────────────────────────────────────────
+
+  app.get("/api/prompts/folders", async (req, res) => {
+    try {
+      const db = getPromptsDb();
+      const rows = db.prepare("SELECT * FROM prompt_folders WHERE id NOT IN ('__root__', '__trash__') ORDER BY name COLLATE NOCASE").all();
+      res.json({ folders: rows.map(normalizeFolder) });
+    } catch (err) {
+      logError("prompts", "folders_list_error", err);
+      res.status(500).json({ error: err.message });
+    }
+  });
+
+  app.post("/api/prompts/folders", async (req, res) => {
+    try {
+      const db = getPromptsDb();
+      const { name, parentId } = req.body || {};
+      if (!name || typeof name !== "string" || !name.trim()) {
+        return res.status(400).json({ error: "name is required" });
+      }
+
+      const parent_id = typeof parentId === "string" && parentId ? parentId : "__root__";
+      const now = Math.floor(Date.now() / 1000);
+      const id = generateId();
+
+      try {
+        db.prepare(
+          "INSERT INTO prompt_folders (id, parent_id, name, created_at, updated_at) VALUES (?, ?, ?, ?, ?)"
+        ).run(id, parent_id, name.trim(), now, now);
+      } catch (err) {
+        if (err.message && err.message.includes("UNIQUE constraint failed")) {
+          return res.status(409).json({ error: "Folder name already exists in this parent" });
+        }
+        throw err;
+      }
+
+      res.status(201).json({ folder: normalizeFolder(db.prepare("SELECT * FROM prompt_folders WHERE id = ?").get(id)) });
+    } catch (err) {
+      logError("prompts", "folder_create_error", err);
+      res.status(500).json({ error: err.message });
+    }
+  });
+
+  app.patch("/api/prompts/folders/:id", async (req, res) => {
+    try {
+      const db = getPromptsDb();
+      const { name, parentId } = req.body || {};
+      const sets = [];
+      const params = [];
+
+      if (typeof name === "string" && name.trim()) { sets.push("name = ?"); params.push(name.trim()); }
+      if (typeof parentId === "string") { sets.push("parent_id = ?"); params.push(parentId); }
+      if (sets.length === 0) return res.status(400).json({ error: "No fields to update" });
+
+      sets.push("updated_at = ?");
+      params.push(Math.floor(Date.now() / 1000));
+      params.push(req.params.id);
+
+      try {
+        db.prepare(`UPDATE prompt_folders SET ${sets.join(", ")} WHERE id = ?`).run(...params);
+      } catch (err) {
+        if (err.message && err.message.includes("UNIQUE constraint failed")) {
+          return res.status(409).json({ error: "Folder name already exists in this parent" });
+        }
+        throw err;
+      }
+
+      const row = db.prepare("SELECT * FROM prompt_folders WHERE id = ?").get(req.params.id);
+      res.json({ folder: normalizeFolder(row) });
+    } catch (err) {
+      logError("prompts", "folder_patch_error", err);
+      res.status(500).json({ error: err.message });
+    }
+  });
+
+  app.delete("/api/prompts/folders/:id", async (req, res) => {
+    try {
+      const db = getPromptsDb();
+      const strategy = req.query.strategy === "deleteItems" ? "deleteItems" : "moveToRoot";
+
+      if (strategy === "moveToRoot") {
+        db.prepare("UPDATE prompts SET folder_id = '__root__' WHERE folder_id = ?").run(req.params.id);
+      } else {
+        db.prepare("UPDATE prompts SET folder_id = '__trash__' WHERE folder_id = ?").run(req.params.id);
+      }
+
+      db.prepare("DELETE FROM prompt_folders WHERE id = ?").run(req.params.id);
+      logEvent("prompts", "folder_deleted", { id: req.params.id, strategy });
+      res.json({ ok: true });
+    } catch (err) {
+      logError("prompts", "folder_delete_error", err);
+      res.status(500).json({ error: err.message });
+    }
+  });
+}
+
+// ── Helpers ─────────────────────────────────────────────────────────────────
+
+function normalizePrompt(row) {
+  return {
+    id: row.id,
+    folderId: row.folder_id,
+    name: row.name,
+    text: row.text,
+    tags: row.tags ? JSON.parse(row.tags) : [],
+    mode: row.mode,
+    isFavorite: !!row.is_favorite,
+    favoritedAt: row.favorited_at || null,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at,
+  };
+}
+
+function normalizeFolder(row) {
+  return {
+    id: row.id,
+    parentId: row.parent_id,
+    name: row.name,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at,
+  };
+}