ima2-gen 3.13.1 → 3.14.0

package/routes/events.js

@@ -1,16 +1,7 @@
-import { subscribe, replaySince, hasReplayGap, replayOldestId, MAX_SSE_LISTENERS } from "../lib/eventBus.js";
+import { subscribe, replaySince, hasReplayGap, replayOldestId, latestEventId, MAX_SSE_LISTENERS } from "../lib/eventBus.js";
+import { SSE_STREAM_POLICY } from "../lib/eventsPolicy.js";
 let activeConnections = 0;
-function safeWrite(res, chunk) {
-    if (res.writableEnded || res.destroyed)
-        return false;
-    try {
-        res.write(chunk);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
+const HEARTBEAT_MS = 15_000;
 function formatSse(ev) {
     // jobSeq and envelope are additive: the publisher already built them, so this
     // only serializes. Consumers that ignore the new fields see the old payload.
@@ -25,6 +16,140 @@ function parseLastEventIdHeader(value) {
     const raw = Array.isArray(value) ? value[0] : value;
     return parseInt(raw?.split(",", 1)[0]?.trim() ?? "", 10);
 }
+class EventConnection {
+    req;
+    res;
+    cursor;
+    closed = false;
+    pumping = false;
+    blocked = false;
+    unsubscribe = () => { };
+    heartbeat;
+    deadline;
+    constructor(req, res, cursor) {
+        this.req = req;
+        this.res = res;
+        this.cursor = cursor;
+    }
+    start() {
+        activeConnections++;
+        this.req.on("close", this.close);
+        this.res.on("close", this.close);
+        this.res.on("error", this.close);
+        this.res.on("drain", this.drain);
+        try {
+            this.res.setHeader("Content-Type", "text/event-stream; charset=utf-8");
+            this.res.setHeader("Cache-Control", "no-cache, no-transform");
+            this.res.setHeader("Connection", "keep-alive");
+            this.res.setHeader("X-Accel-Buffering", "no");
+            this.res.setHeader("x-ima2-event-cursor", String(this.cursor));
+            this.res.flushHeaders?.();
+            if (this.closed)
+                return;
+            this.unsubscribe = subscribe(this.live);
+            this.pump();
+            if (!this.closed)
+                this.heartbeat = setInterval(this.ping, HEARTBEAT_MS);
+        }
+        catch {
+            this.close();
+        }
+    }
+    write(chunk) {
+        if (this.closed || this.blocked)
+            return false;
+        if (this.res.writableEnded || this.res.destroyed) {
+            this.close();
+            return false;
+        }
+        try {
+            const ready = this.res.write(chunk);
+            if (this.closed)
+                return false;
+            if (!ready) {
+                this.blocked = true;
+                this.deadline = setTimeout(this.close, SSE_STREAM_POLICY.drainTimeoutMs);
+            }
+            return ready;
+        }
+        catch {
+            this.close();
+            return false;
+        }
+    }
+    gap() {
+        if (!hasReplayGap(this.cursor))
+            return true;
+        const oldestAvailableId = replayOldestId();
+        const data = JSON.stringify({ lastEventId: this.cursor, oldestAvailableId });
+        this.cursor = oldestAvailableId === null ? latestEventId() : oldestAvailableId - 1;
+        return this.write(`event: replay-gap\ndata: ${data}\n\n`);
+    }
+    pump() {
+        if (this.closed || this.blocked || this.pumping)
+            return;
+        this.pumping = true;
+        try {
+            do {
+                if (!this.gap())
+                    return;
+                for (const ev of replaySince(this.cursor)) {
+                    // write(false) accepts the chunk; drain must start AFTER this ID.
+                    this.cursor = ev.id;
+                    if (!this.write(formatSse(ev)))
+                        return;
+                }
+            } while (!this.closed && this.cursor < latestEventId());
+        }
+        finally {
+            this.pumping = false;
+        }
+    }
+    live = (ev) => {
+        if (this.closed || this.blocked || this.pumping || ev.id <= this.cursor)
+            return;
+        if (ev.id !== this.cursor + 1) {
+            this.pump();
+            return;
+        }
+        this.pumping = true;
+        try {
+            this.cursor = ev.id;
+            this.write(formatSse(ev));
+        }
+        finally {
+            this.pumping = false;
+        }
+        this.pump();
+    };
+    ping = () => {
+        if (!this.blocked && !this.pumping)
+            this.write(": ping\n\n");
+    };
+    drain = () => {
+        if (this.closed || !this.blocked)
+            return;
+        clearTimeout(this.deadline);
+        this.deadline = undefined;
+        this.blocked = false;
+        this.pump();
+    };
+    close = () => {
+        if (this.closed)
+            return;
+        this.closed = true;
+        this.unsubscribe();
+        clearInterval(this.heartbeat);
+        clearTimeout(this.deadline);
+        this.req.off("close", this.close);
+        this.res.off("close", this.close);
+        this.res.off("error", this.close);
+        this.res.off("drain", this.drain);
+        activeConnections--;
+        if (!this.res.destroyed)
+            this.res.destroy();
+    };
+}
 export function registerEventsRoute(app, _ctx) {
     app.get("/api/events", (req, res) => {
         if (activeConnections >= MAX_SSE_LISTENERS) {
@@ -32,58 +157,10 @@ export function registerEventsRoute(app, _ctx) {
                 error: { code: "SSE_CAPACITY", message: "Too many event stream connections" },
             });
         }
-        res.setHeader("Content-Type", "text/event-stream; charset=utf-8");
-        res.setHeader("Cache-Control", "no-cache, no-transform");
-        res.setHeader("Connection", "keep-alive");
-        res.setHeader("X-Accel-Buffering", "no");
-        res.flushHeaders?.();
-        activeConnections++;
         const headerLastId = parseLastEventIdHeader(req.headers["last-event-id"]);
         const queryLastId = parseInt(String(req.query.lastEventId ?? ""), 10);
-        const lastId = !Number.isNaN(headerLastId) ? headerLastId : queryLastId;
-        if (!Number.isNaN(lastId)) {
-            if (hasReplayGap(lastId)) {
-                const gapPayload = JSON.stringify({
-                    lastEventId: lastId,
-                    oldestAvailableId: replayOldestId(),
-                });
-                if (!safeWrite(res, `event: replay-gap\ndata: ${gapPayload}\n\n`)) {
-                    activeConnections = Math.max(0, activeConnections - 1);
-                    return;
-                }
-            }
-            for (const ev of replaySince(lastId)) {
-                if (!safeWrite(res, formatSse(ev)))
-                    break;
-            }
-        }
-        let cleaned = false;
-        const unsub = subscribe((ev) => {
-            if (!safeWrite(res, formatSse(ev)))
-                cleanup();
-        });
-        const heartbeat = setInterval(() => {
-            if (!safeWrite(res, ": ping\n\n"))
-                cleanup();
-        }, 15_000);
-        function cleanup() {
-            if (cleaned)
-                return;
-            cleaned = true;
-            unsub();
-            clearInterval(heartbeat);
-            activeConnections = Math.max(0, activeConnections - 1);
-            if (!res.writableEnded && !res.destroyed) {
-                try {
-                    res.end();
-                }
-                catch {
-                    /* socket already torn down */
-                }
-            }
-        }
-        req.on("close", cleanup);
-        res.on("close", cleanup);
-        res.on("error", cleanup);
+        const lastId = Number.isSafeInteger(headerLastId) ? headerLastId : queryLastId;
+        const cursor = Number.isSafeInteger(lastId) ? Math.max(0, lastId) : latestEventId();
+        new EventConnection(req, res, cursor).start();
     });
 }

package/routes/mcpMedia.js

@@ -160,8 +160,16 @@ async function runMediaAction(input) {
         if (input.mode === "fallback" && input.decision === "local-ffmpeg-concat") {
             setJobPhase(requestId, "media-processing");
             publishJobEvent(requestId, "progress", { phase: "media-processing" });
-            const tempOut = join(ctx.config.storage.generatedDir, `.tmp-concat-${requestId}.mp4`);
-            await deps.concat(input.resolvedFiles, tempOut, { signal: input.signal });
+            const tempOut = join(ctx.config.storage.generatedDir, `.tmp-concat-${randomBytes(16).toString("hex")}.mp4`);
+            try {
+                await deps.concat(input.resolvedFiles, tempOut, { signal: input.signal });
+            }
+            catch (concatError) {
+                // Concat can leave a partial file; retain its error if cleanup also fails.
+                await rm(tempOut, { force: true }).catch(() => undefined);
+                throw concatError;
+            }
+            // Successful concat hands cleanup to commitMediaResult, before its done event.
             await commitMediaResult({
                 ctx, deps, requestId, kind: "video",
                 tempPath: tempOut, cleanup: () => rm(tempOut, { force: true }),

package/routes/models.js

@@ -7,7 +7,8 @@ import { getProviderAdapter } from "../lib/providers/adapters/index.js";
 import { MAX_VIDEO_DURATION, MIN_VIDEO_DURATION, VALID_VIDEO_ASPECT_RATIOS, VALID_VIDEO_RESOLUTIONS, } from "../lib/imageModels.js";
 import { getProviderModels, } from "../lib/mcp/modelsCatalog.js";
 import { listProviders, } from "../lib/mcp/providerRegistry.js";
-import { deriveModels } from "../lib/providers/derive.js";
+import { deriveModels, deriveProviderIds, getProviderSurfaceSupport } from "../lib/providers/derive.js";
+import { PROVIDER_SURFACES } from "../lib/providers/surfaceSupport.js";
 import { listWorkflows } from "../lib/comfyWorkflowStore.js";
 import { probeComfyOrigins } from "../lib/comfyImageAdapter.js";
 import { requireRuntimeContext, } from "../lib/runtimeContext.js";
@@ -21,20 +22,15 @@ function emptyModels() {
 function capabilities(inputRoles = [], parameters = [], aspectRatios = []) {
     return { source: "verified-contract", aspectRatios, parameters, inputRoles };
 }
-/**
- * Text-only lanes. The default in `entries` advertises image_references, which
- * would be a lie for a lane whose routes answer NAI_REF_UNSUPPORTED.
- */
-function textOnlyCapabilities() {
-    return capabilities(["text"]);
-}
-function entries(ids, caps) {
+function entries(provider, ids, caps) {
     return [...ids].map((id) => ({
         id,
         label: id,
         capabilities: caps
             ? { ...caps, aspectRatios: [...caps.aspectRatios], parameters: [...caps.parameters], inputRoles: [...caps.inputRoles] }
-            : capabilities(["text", "image_references"]),
+            // CoreProviderId comes from the same registry as the getter: never null.
+            : capabilities(getProviderSurfaceSupport(provider, "generate").references
+                ? ["text", "image_references"] : ["text"]),
     }));
 }
 function videoCapabilities() {
@@ -91,21 +87,21 @@ function grokLaneState(ctx) {
             return { status: "ready", reason: UNPROBED_GROK_REASON };
     }
 }
-function grokLane(ctx) {
+function grokLane(ctx, provider = "grok") {
     const state = grokLaneState(ctx);
     return lane(state, {
         image: ctx.config.grokProvider.defaultImageModel,
         video: ctx.config.grokProvider.defaultVideoModel,
     }, {
-        image: entries(deriveModels("grok", "image")),
-        video: entries([...deriveModels("grok", "video")].filter((model) => model !== "grok-imagine-video-1.5-preview"), videoCapabilities()),
+        image: entries(provider, deriveModels(provider, "image")),
+        video: entries(provider, [...deriveModels("grok", "video")].filter((model) => model !== "grok-imagine-video-1.5-preview"), videoCapabilities()),
     });
 }
 function grokApiLane(ctx) {
     const state = ctx.xaiApiKey
         ? { status: "ready" }
         : { status: "key-missing", reason: "xAI API key missing" };
-    const grok = grokLane(ctx);
+    const grok = grokLane(ctx, "grok-api");
     return lane(state, { ...grok.defaults }, grok.models);
 }
 function agyLane(installed) {
@@ -113,7 +109,7 @@ function agyLane(installed) {
         ? { status: "ready", reason: "binary installed; login cannot be probed" }
         : { status: "disconnected", reason: "binary not installed" };
     return lane(state, { image: "nano-banana-2" }, {
-        image: entries(deriveModels("agy", "image")), video: [],
+        image: entries("agy", deriveModels("agy", "image")), video: [],
     });
 }
 function geminiLane(ctx) {
@@ -122,7 +118,7 @@ function geminiLane(ctx) {
         ? { status: "ready" }
         : { status: "key-missing", reason: "Gemini API or Vertex credentials missing" };
     return lane(state, { image: "nano-banana-2" }, {
-        image: entries(deriveModels("gemini-api", "image")), video: [],
+        image: entries("gemini-api", deriveModels("gemini-api", "image")), video: [],
     });
 }
 function atlasCloudLane(ctx) {
@@ -135,7 +131,7 @@ function atlasCloudLane(ctx) {
             ? { status: "ready" }
             : { status: "key-missing", reason: "Atlas Cloud API key missing" };
         return lane(fallback, { image: ATLASCLOUD_TEXT_TO_IMAGE_MODEL }, {
-            image: entries(deriveModels("atlascloud", "image")), video: [],
+            image: entries("atlascloud", deriveModels("atlascloud", "image")), video: [],
         });
     }
     const auth = adapter.validateAuth();
@@ -143,7 +139,7 @@ function atlasCloudLane(ctx) {
         ? { status: "ready" }
         : { status: "key-missing", reason: auth.reason ?? "Atlas Cloud API key missing" };
     return lane(state, { image: ATLASCLOUD_TEXT_TO_IMAGE_MODEL }, {
-        image: entries(adapter.listModels().map((model) => model.id)), video: [],
+        image: entries("atlascloud", adapter.listModels().map((model) => model.id)), video: [],
     });
 }
 function minimaxLane(ctx) {
@@ -156,7 +152,7 @@ function minimaxLane(ctx) {
             ? { status: "ready" }
             : { status: "key-missing", reason: "MiniMax API key missing" };
         return lane(fallback, { image: MINIMAX_TEXT_TO_IMAGE_MODEL }, {
-            image: entries(deriveModels("minimax", "image")), video: [],
+            image: entries("minimax", deriveModels("minimax", "image")), video: [],
         });
     }
     const auth = adapter.validateAuth();
@@ -164,7 +160,7 @@ function minimaxLane(ctx) {
         ? { status: "ready" }
         : { status: "key-missing", reason: auth.reason ?? "MiniMax API key missing" };
     return lane(state, { image: MINIMAX_TEXT_TO_IMAGE_MODEL }, {
-        image: entries(adapter.listModels().map((model) => model.id)), video: [],
+        image: entries("minimax", adapter.listModels().map((model) => model.id)), video: [],
     });
 }
 function naiLane(ctx) {
@@ -174,7 +170,7 @@ function naiLane(ctx) {
             ? { status: "ready" }
             : { status: "key-missing", reason: "NovelAI API token missing" };
         return lane(fallback, { image: NAI_DEFAULT_IMAGE_MODEL }, {
-            image: entries(deriveModels("nai", "image"), textOnlyCapabilities()), video: [],
+            image: entries("nai", deriveModels("nai", "image")), video: [],
         });
     }
     const auth = adapter.validateAuth();
@@ -182,7 +178,7 @@ function naiLane(ctx) {
         ? { status: "ready" }
         : { status: "key-missing", reason: auth.reason ?? "NovelAI API token missing" };
     return lane(state, { image: NAI_DEFAULT_IMAGE_MODEL }, {
-        image: entries(adapter.listModels().map((model) => model.id), textOnlyCapabilities()), video: [],
+        image: entries("nai", adapter.listModels().map((model) => model.id)), video: [],
     });
 }
 /**
@@ -232,10 +228,10 @@ async function comfyLane(ctx, deps = {}) {
     });
 }
 async function buildCoreLanes(ctx, agyInstalled, deps = {}) {
-    const gptModels = entries(ctx.config.imageModels.valid);
-    return {
+    const gptModels = entries("oauth", ctx.config.imageModels.valid);
+    const lanes = {
         oauth: oauthLane(ctx, gptModels),
-        api: apiLane(ctx, entries(ctx.config.imageModels.valid)),
+        api: apiLane(ctx, entries("api", ctx.config.imageModels.valid)),
         grok: grokLane(ctx),
         "grok-api": grokApiLane(ctx),
         agy: agyLane(agyInstalled),
@@ -245,6 +241,13 @@ async function buildCoreLanes(ctx, agyInstalled, deps = {}) {
         nai: naiLane(ctx),
         comfy: await comfyLane(ctx, deps),
     };
+    for (const id of deriveProviderIds()) {
+        // Both ids and surfaces exhaust the canonical registry; MCP is never decorated.
+        lanes[id].surfaces = Object.fromEntries(PROVIDER_SURFACES.map((surface) => [
+            surface, getProviderSurfaceSupport(id, surface),
+        ]));
+    }
+    return lanes;
 }
 function detectAgyInstalled() {
     return new Promise((resolve) => {

package/routes/videoExtended.js

@@ -8,19 +8,19 @@ import { downloadVideo, generateVideoViaGrok, pollVideoUntilDone } from "../lib/
 import { invalidateHistoryIndex } from "../lib/historyIndex.js";
 import { ACTIVE_VIDEO_PROMPT_GUIDANCE, appendVideoContinuityEntry, lineageFromVideoMetadata, readVideoSidecar } from "../lib/videoContinuity.js";
 import { assertLocalMp4, extractGeneratedVideoFrameB64, extractVideoFrame, safeGeneratedFilePath } from "../lib/videoFrameExtract.js";
-import { finishJob, INFLIGHT_RETRY_AFTER_SECONDS, isJobCanceled, isStartJobFailure, registerJobAbortController, setJobPhase, startJob, updateJobAdmission } from "../lib/inflight.js";
+import { finishJob, INFLIGHT_RETRY_AFTER_SECONDS, isJobCanceled, isStartJobFailure, registerJobAbortController, startJob, updateJobAdmission } from "../lib/inflight.js";
 import { makeGenerationCanceledError } from "../lib/generationCancel.js";
-import { publish } from "../lib/eventBus.js";
 import { publishJobEvent } from "../lib/ssePublish.js";
 import { normalizeBodyRequestId } from "../lib/generationInputValidation.js";
 import { normalizeGrokVideoModel, normalizeVideoAspectRatio, normalizeVideoDuration, normalizeVideoResolution, validateVideoResolutionForRequest } from "../lib/imageModels.js";
 import { persistVideoArtifact } from "../lib/videoArtifactPersistence.js";
-import { deriveChildVideoLineage, normalizeVideoLineage } from "../lib/videoLineage.js";
+import { normalizeVideoLineage } from "../lib/videoLineage.js";
 import { getMotionFragment, MOTION_PRESETS } from "../lib/videoMotionPresets.js";
 import { errInfo } from "../lib/errInfo.js";
-import { codedVideoError as codedError, emitPhase, envDeadline, extractError, requestSignal, requirePrompt, retryableData } from "../lib/videoExtendedHelpers.js";
+import { codedVideoError as codedError, emitPhase, envDeadline, requestSignal, requirePrompt, retryableData } from "../lib/videoExtendedHelpers.js";
 import { DEFAULT_GROK_PLANNER_MODEL } from "../config.js";
 import { errorEnvelopeFields } from "../lib/errors/envelope.js";
+import { runLastFrameI2v } from "../lib/videoExtendI2vOperation.js";
 function validationError(value) {
     if (!value || typeof value !== "object" || !("error" in value))
         return null;
@@ -312,70 +312,11 @@ export function registerVideoExtendedRoutes(app, ctxRaw, dependencies = {}) {
         updateJobAdmission(requestId, { prompt, meta: { workflow: "last-frame-i2v", sourceVideoId, provider, model } });
         emitPhase(requestId, "queued");
         res.status(202).json({ ok: true, requestId, sourceVideoId, workflow: "last-frame-i2v" });
-        void (async () => {
-            const startedAt = Date.now();
-            let stage = "extracting-frame";
-            try {
-                emitPhase(requestId, stage);
-                let sourceImage;
-                try {
-                    sourceImage = await extractFrame(ctx.config.storage.generatedDir, sourceVideoId, "last", { signal: cancelController.signal });
-                }
-                catch (error) {
-                    throw extractError(error, cancelController.signal);
-                }
-                if (cancelController.signal.aborted)
-                    throw makeGenerationCanceledError();
-                const parentContinuity = lineageFromVideoMetadata(sourceVideoId, parent);
-                const onEvent = (event) => {
-                    setJobPhase(requestId, event.phase === "submitted" ? "streaming" : event.phase);
-                    publish(requestId, event.phase, {
-                        requestId,
-                        ...(event.phase === "submitted" ? { xaiVideoRequestId: event.xaiVideoRequestId, requestedModel: event.requestedModel, effectiveModel: event.effectiveModel, modelFallback: event.modelFallback ?? null } : {}),
-                        ...(event.phase === "progress" ? { progress: typeof event.progress === "number" ? event.progress / 100 : null, stalled: Boolean(event.stalled) } : {}),
-                    });
-                };
-                const compiledPrompt = motion.fragment ? `${prompt}\n\nCamera motion: ${motion.fragment}.` : prompt;
-                const result = await generateVideo(compiledPrompt, ctx, {
-                    model, mode: "image-to-video", duration, resolution, aspectRatio,
-                    sourceImage, sourceMime: "image/png", signal: cancelController.signal,
-                    requestId, continuityLineage: parentContinuity,
-                    directApiKey: provider === "grok-api" ? ctx.xaiApiKey ?? undefined : undefined,
-                    onEvent,
-                });
-                if (cancelController.signal.aborted)
-                    throw makeGenerationCanceledError();
-                stage = "persisting";
-                emitPhase(requestId, stage);
-                const filename = createFilename(ctx);
-                const createdAt = Date.now();
-                const videoLineage = deriveChildVideoLineage(filename, sourceVideoId, parent);
-                const videoContinuity = appendVideoContinuityEntry(parentContinuity, { filename, userPrompt: prompt, revisedPrompt: result.revisedPrompt, createdAt });
-                const elapsed = +((createdAt - startedAt) / 1000).toFixed(1);
-                const video = { operation: "extend", mode: "image-to-video", sourceVideoId, sourceFrame: "last", duration: result.duration, resolution: result.resolution, aspectRatio: result.aspectRatio, xaiVideoRequestId: result.xaiVideoRequestId };
-                const metadata = { kind: "video", mediaType: "video", providerUrl: result.url, requestId, prompt, userPrompt: prompt, revisedPrompt: result.revisedPrompt, motionPresetIds: motion.ids, provider, model: result.effectiveModel, createdAt, elapsed, usage: result.usage, webSearchCalls: result.webSearchCalls, video, videoLineage, videoContinuity };
-                try {
-                    await persistArtifact(ctx.config.storage.generatedDir, filename, result.videoBuffer, metadata);
-                }
-                catch (error) {
-                    throw codedError(errInfo(error).message, 500, "VIDEO_PERSIST_FAILED");
-                }
-                invalidateHistoryIndex();
-                const done = { requestId, filename, url: `/generated/${encodeURIComponent(filename)}`, providerUrl: result.url, mediaType: "video", provider, model: result.effectiveModel, prompt, userPrompt: prompt, revisedPrompt: result.revisedPrompt, createdAt, elapsed, usage: result.usage, webSearchCalls: result.webSearchCalls, video, videoLineage, videoContinuity };
-                // finishJob BEFORE done (audit blocker B4): a done event must never be
-                // followed by an error from a failing inflight-completion write.
-                finishJob(requestId, { status: "completed", meta: { filename, xaiVideoRequestId: result.xaiVideoRequestId } });
-                publishJobEvent(requestId, "done", done);
-            }
-            catch (error) {
-                if (!isJobCanceled(requestId)) {
-                    const info = errInfo(error);
-                    // #151 stage 2: terminal failure carries the canonical envelope.
-                    publishJobEvent(requestId, "error", { requestId, error: info.message, code: info.code ?? "VIDEO_EXTEND_FAILED", status: info.status ?? 500, ...retryableData(error), ...errorEnvelopeFields(error) });
-                    finishJob(requestId, { status: "error", httpStatus: info.status ?? 500, errorCode: info.code ?? "VIDEO_EXTEND_FAILED", meta: { stage } });
-                }
-            }
-        })();
+        void runLastFrameI2v({
+            ctx, requestId, sourceVideoId, prompt, model, provider, duration, resolution,
+            aspectRatio, parent, motion, cancelController, extractFrame, generateVideo,
+            persistArtifact, createFilename,
+        });
     });
     // --- Provider-native legacy extension ---
     app.post("/api/video/extend/native", async (req, res) => {

package/server.js

@@ -15,7 +15,10 @@ import { configureLogger, logError } from "./lib/logger.js";
 import { createRequestLogger } from "./lib/requestLogger.js";
 import { configureApiCachePolicy } from "./lib/apiCachePolicy.js";
 import { configureRoutes } from "./routes/index.js";
-import { config } from "./config.js";
+import { API_REQUEST_POLICY, config } from "./config.js";
+import { createApiRequestBudget } from "./lib/apiRequestBudget.js";
+import { createLocalLanAccess, createLanApiGuard as tokenOnlyLanApiGuard } from "./lib/localLanAccess.js";
+import { createGeneratedMediaAccess } from "./lib/generatedMediaAccess.js";
 import { getServerPort, listenWithPortFallback } from "./lib/runtimePorts.js";
 import { shutdownServerAndMcp, startMcpRestoreAfterListen } from "./lib/mcp/shutdown.js";
 import { closeDb } from "./lib/db.js";
@@ -23,7 +26,6 @@ import { stopAgentQueueWorker } from "./lib/agentQueueWorker.js";
 import { reapCardNewsJobs } from "./lib/cardNewsJobStore.js";
 import { reapTerminalJobs } from "./lib/inflight.js";
 import { errInfo } from "./lib/errInfo.js";
-import { timingSafeEqual } from "node:crypto";
 import { cleanupExpiredMcpTempReferences, MCP_TEMP_REFERENCE_JSON_BODY_LIMIT_BYTES, MCP_TEMP_REFERENCE_SWEEP_INTERVAL_MS, } from "./lib/mcpTempReferenceStore.js";
 const rootDir = dirname(fileURLToPath(import.meta.url));
 async function loadApiKey() {
@@ -210,6 +212,8 @@ function setUiStaticHeaders(res, filePath) {
     const normalized = filePath.replace(/\\/g, "/");
     if (normalized.endsWith("/index.html")) {
         res.setHeader("Cache-Control", "no-store, max-age=0");
+        res.setHeader("Referrer-Policy", "no-referrer");
+        res.setHeader("Content-Security-Policy", "frame-ancestors 'none'");
         return;
     }
     if (normalized.includes("/assets/")) {
@@ -221,44 +225,29 @@ export function isLoopbackHost(host) {
     return normalized === "127.0.0.1" || normalized === "::1" || normalized === "localhost";
 }
 export function assertLanAccessConfiguration(host, token) {
-    if (isLoopbackHost(host) || token)
+    if (isLoopbackHost(host))
         return;
-    const message = `[server.security] Refusing non-loopback host ${host || "<empty>"}: set IMA2_LAN_TOKEN to enable LAN access.`;
+    if (token && Buffer.byteLength(token) <= config.security.lanTokenMaxBytes)
+        return;
+    const message = "[server.security] Set a nonempty IMA2_LAN_TOKEN of at most 4096 UTF-8 bytes to enable LAN access.";
     console.error(message);
     throw new Error(message);
 }
-function tokenMatches(actual, expected) {
-    if (typeof actual !== "string")
-        return false;
-    const actualBuffer = Buffer.from(actual);
-    const expectedBuffer = Buffer.from(expected);
-    return actualBuffer.length === expectedBuffer.length && timingSafeEqual(actualBuffer, expectedBuffer);
-}
 export function createLanApiGuard(host, token) {
-    const requiredToken = isLoopbackHost(host) ? "" : String(token || "");
-    return function lanApiGuard(req, res, next) {
-        if (!requiredToken || !req.path.startsWith("/api"))
-            return next();
-        // OAuth redirect endpoints are conventionally unauthenticated: the provider's
-        // browser redirect cannot carry x-ima2-token. Security boundary for this single
-        // path is the single-use unguessable OAuth state + PKCE (030 WP3 audit round 2);
-        // an invalid state is rejected with 400 before any token exchange.
-        if (req.path === "/api/mcp/oauth/callback")
-            return next();
-        const supplied = req.get("x-ima2-token") ?? req.query.token;
-        if (tokenMatches(supplied, requiredToken))
-            return next();
-        return res.status(401).json({
-            error: { code: "LAN_TOKEN_REQUIRED", message: "A valid IMA2 LAN token is required" },
-        });
-    };
+    return tokenOnlyLanApiGuard(host, token);
 }
 export function buildApp(ctx) {
     const app = express();
+    const access = createLocalLanAccess(ctx);
+    const budget = createApiRequestBudget(API_REQUEST_POLICY);
+    const locals = Object.assign(app.locals, { disposeLocalLanAccess: access.dispose });
     configureApiCachePolicy(app);
     configureLogger({ level: ctx.config.log.level });
     app.use(createRequestLogger());
-    app.use(createLanApiGuard(ctx.config.server.host, ctx.config.server.lanToken));
+    app.use(access.mediaHeaders);
+    access.registerSessionRoutes(app, budget);
+    app.use(access.guard);
+    app.use(budget);
     app.use("/api/mcp/temp-references", express.json({ limit: MCP_TEMP_REFERENCE_JSON_BODY_LIMIT_BYTES }));
     app.use(express.json({ limit: ctx.config.server.bodyLimit }));
     app.use(express.static(join(ctx.rootDir, "ui", "dist"), {
@@ -267,22 +256,7 @@ export function buildApp(ctx) {
     app.use("/assets", (_req, res) => {
         res.status(404).type("text/plain").send("Asset not found");
     });
-    app.use("/generated", (req, res, next) => {
-        if (req.path.endsWith(".json"))
-            return res.status(404).type("text/plain").send("Generated metadata is not public");
-        if (req.path.toLowerCase().endsWith(".svg")) {
-            // SVG is an active document under top-level navigation, and /generated sits
-            // outside the LAN token guard (which only covers /api). Traced output is
-            // machine-generated, but the guarantee should not rest on writer discipline:
-            // this neuters script execution for any .svg served from here, now or later.
-            res.setHeader("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline'");
-            res.setHeader("X-Content-Type-Options", "nosniff");
-        }
-        return next();
-    }, express.static(ctx.config.storage.generatedDir, {
-        maxAge: ctx.config.storage.staticMaxAge,
-        immutable: true,
-    }));
+    app.use("/generated", ...createGeneratedMediaAccess(ctx, access));
     configureRoutes(app, ctx);
     app.use((_req, res) => {
         res.status(404).json({ error: { code: "NOT_FOUND", message: "Route not found" } });
@@ -302,7 +276,7 @@ export function buildApp(ctx) {
             },
         });
     });
-    return app;
+    return Object.assign(app, { locals });
 }
 function runtimeHostUrl(host) {
     if (!host || host === "0.0.0.0" || host === "::")
@@ -472,6 +446,8 @@ export async function createRuntimeContext(overrides = {}) {
 export async function startServer(overrides = {}) {
     const ctx = await createRuntimeContext(overrides);
     assertLanAccessConfiguration(ctx.config.server.host, ctx.config.server.lanToken);
+    // Validate the lazy origin configuration before any storage migration.
+    void ctx.config.server.publicOrigins;
     await migrateGeneratedStorage(ctx);
     try {
         await cleanupExpiredMcpTempReferences(ctx.config.storage.generatedDir);
@@ -547,6 +523,7 @@ export async function startServer(overrides = {}) {
         clearInterval(reapTimer);
         if (tempReferenceReapTimer)
             clearInterval(tempReferenceReapTimer);
+        app.locals.disposeLocalLanAccess();
         await shutdownServerAndMcp({
             closeServer: () => new Promise((resolve) => {
                 if (server)
@@ -567,6 +544,7 @@ export async function startServer(overrides = {}) {
         },
     });
     ctx.serverActualPort = getServerPort(server) || ctx.config.server.port;
+    server.once("close", app.locals.disposeLocalLanAccess);
     ctx.serverUrl = `http://${runtimeHostUrl(ctx.config.server.host)}:${ctx.serverActualPort}`;
     void startMcpRestoreAfterListen(ctx).catch((error) => {
         console.warn(`[mcp.restore] code=${String(error?.message ?? error).split(":")[0]}`);