1.1.0: changelog, README quick start without a clone, help and in-app changelog

The quick start downloads two files and pulls the image; no clone, no
build. README figures brought up to date (it still said Astro 5, 124
tests, 16 migrations). Upgrade notes for 1.0 installs: the volume
ownership change and the basic-ftp NAT behaviour. Help page and in-app
changelog in English and German.

.dockerignore

@@ -5,3 +5,8 @@ dist
 *.log
 .env
 # Do NOT ignore migrations/ — they are read at runtime, on every boot.
+docs
+tests
+.github
+*.md
+!README.md

.github/workflows/ci.yml

@@ -10,9 +10,9 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: '22'
           cache: npm

.github/workflows/image.yml

@@ -0,0 +1,62 @@
+name: Container image
+
+# Builds the image that docker-compose.yaml pulls, for amd64 and arm64
+# (a Raspberry Pi 4/5 or an ARM VPS runs the same image).
+#
+#   push to main   -> ghcr.io/tillheidrich/klarbild:edge
+#   tag v1.2.3     -> :1.2.3, :1.2, :1 and :latest
+#
+# Nothing to configure: the workflow pushes with its own GITHUB_TOKEN.
+
+on:
+  push:
+    branches: [main]
+    tags: ['v*.*.*']
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+concurrency:
+  group: image-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  image:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
+
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ github.repository_owner }}/klarbild
+          tags: |
+            type=edge,branch=main
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
+          labels: |
+            org.opencontainers.image.title=Klarbild
+            org.opencontainers.image.description=Self-hosted print studio: pictures on paper at exactly the size you asked for.
+            org.opencontainers.image.licenses=AGPL-3.0-only
+
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

CHANGELOG.md

@@ -1,5 +1,63 @@
 # Changelog
 
+## 1.1.0 — 2026-10-10
+
+**Install without cloning or building**
+
+- **Prebuilt image** for linux/amd64 and linux/arm64 at
+  `ghcr.io/tillheidrich/klarbild`. The compose files pull `:1`, which follows every
+  1.x release; an update is `docker compose pull && docker compose up -d`. The quick
+  start needs two downloaded files instead of a clone and a build.
+- The image is two-stage: no compiler, no dev dependencies, no source tree at runtime.
+  It **runs as uid 1000**, not root.
+
+**First visit**
+
+- On a print-only instance the print studio no longer offers "Pick from the library" —
+  the library belongs to the AI module, and on an instance without it the button
+  opened an empty picker. In its place: **Try it with a sample photo**, an original
+  illustration that goes through the normal upload.
+- A favicon and an iPhone home-screen icon.
+
+**Trash (AI module)**
+
+- Deleting moves an image into the **trash** instead of removing it on the spot. It is
+  hidden from the library, share links, ZIPs, deliveries, the mirror, print sources and
+  the print history, and comes back unchanged on restore. "Undo" in the toast, a trash
+  view with days left, restore, delete for good, empty.
+- Maintenance purges after `trash_days` (default 30, Admin → Storage & cleanup). 0
+  switches the trash off.
+- An image trashed while queued is skipped instead of being generated and billed.
+- Purging removes only files no other image still uses: alternatives share their source
+  with the original.
+- API: `DELETE /api/items/:id` now trashes (`?purge=1` for good), `GET|POST|DELETE
+  /api/trash`. See `/llms.txt`.
+
+**Fixed**
+
+- Only the file route checked who may see an image. Rename, delete, retry, alternative,
+  reuse and the selection ZIP accepted any id from any signed-in account. One rule now
+  (`src/lib/itemaccess.ts`): read your own, or a shared library but never a private
+  session; change only your own; admins everything. A refused id answers 404.
+- README said Astro 5; it is Astro 7.
+
+**Dependencies**
+
+- nodemailer 10, basic-ftp 6, argon2 0.45, archiver 8, ssh2-sftp-client 12,
+  @astrojs/react 7, Astro 7.3.8, sharp 0.35.5 — `npm audit` 0 (was 7, six high).
+- Node ≥ 22.12.
+- Not taken yet: pg-boss 12 (it cannot migrate the v10 queue schema in place) and
+  TypeScript 7.
+
+**Upgrading from 1.0**
+
+- If you built 1.0 yourself with the old compose file, your files volume belongs to
+  root. The new image runs as uid 1000, so hand the volume over once:
+  `docker compose run --rm --user root app chown -R 1000:1000 /data`
+- basic-ftp 6 no longer silently redirects the data connection when an FTP server
+  behind NAT announces its private address. If a delivery target that worked fails
+  now, "Test connection" names the cause.
+
 ## 1.0.0 — first public release
 
 The first open-source release of Klarbild. Everything before this lived in a

CONTRIBUTING.md

@@ -16,7 +16,7 @@ You need a PostgreSQL to point `DATABASE_URL` at; `docker compose up db` gives y
 one. Migrations run themselves on the first request.
 
 ```bash
-npm test          # 124 tests, no database needed
+npm test          # 130 tests, no database needed
 npx tsc --noEmit  # must be clean
 npm run build
 ```

Dockerfile

@@ -1,22 +1,34 @@
-FROM node:22-bookworm-slim
+# Klarbild — two stages. The first builds, the second only runs: no compiler,
+# no dev dependencies, no source tree in the image that ends up on your server.
 
+FROM node:22-bookworm-slim AS build
 WORKDIR /app
-ENV NODE_ENV=production PORT=4321 HOST=0.0.0.0
-
-# Build tools for the native modules (argon2). sharp ships a prebuilt libvips.
-RUN apt-get update && apt-get install -y --no-install-recommends \
-      python3 make g++ ca-certificates \
-    && rm -rf /var/lib/apt/lists/*
-
 # The lockfile comes first and `npm ci` honours it, so the image is built from
 # the exact versions CI tested — not from whatever `^` resolved to today.
+# Native modules (argon2, sharp) ship prebuilt binaries for amd64 and arm64,
+# so no compiler is needed in either stage.
 COPY package.json package-lock.json ./
 RUN npm ci --no-audit --no-fund
-
 COPY . .
-RUN npm run build
+RUN npm run build && npm prune --omit=dev --no-audit --no-fund
+
+FROM node:22-bookworm-slim
+WORKDIR /app
+ENV NODE_ENV=production PORT=4321 HOST=0.0.0.0 STORAGE_DIR=/data
+
+COPY --from=build --chown=node:node /app/package.json ./
+COPY --from=build --chown=node:node /app/node_modules ./node_modules
+COPY --from=build --chown=node:node /app/dist ./dist
+# Read at runtime, on every boot.
+COPY --from=build --chown=node:node /app/migrations ./migrations
+
+# Not root. A fresh named volume mounted at /data takes over this ownership;
+# for a bind mount, give the directory to uid 1000 (`chown 1000:1000 ./data`).
+RUN mkdir -p /data && chown node:node /data
+USER node
 
 EXPOSE 4321
+VOLUME ["/data"]
 
 HEALTHCHECK --interval=30s --timeout=5s --start-period=40s --retries=3 \
   CMD node -e "fetch('http://127.0.0.1:'+(process.env.PORT||4321)+'/api/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"

README.md

@@ -21,12 +21,18 @@ page runs this repository's own layout engine client-side and hands you the PDF.
 nothing uploaded.
 
 ```bash
-git clone https://github.com/tillheidrich/klarbild.git && cd klarbild
+mkdir klarbild && cd klarbild
-cp .env.example .env          # four values at the top; the file says which
+curl -fsSLO https://raw.githubusercontent.com/tillheidrich/klarbild/main/docker-compose.yaml
+curl -fsSL  https://raw.githubusercontent.com/tillheidrich/klarbild/main/.env.example -o .env
+nano .env                     # four values at the top; the file says which
 docker compose up -d
 docker compose logs app       # your admin password is printed here, once
 ```
 
+No clone, no build: the compose file pulls a prebuilt image for amd64 and arm64
+(a Raspberry Pi 4 or 5 runs it). Open `http://localhost:4321`, sign in, and press
+**Try it with a sample photo** if you have no picture at hand.
+
 ![Klarbild's print studio: eight passport photos laid out on one A4 sheet with corner marks](docs/screenshots/print-studio.png)
 
 ---
@@ -75,7 +81,7 @@ of the PDF above measures 210.00 × 297.00 mm, because that is what A4 is.
 | Module | What it adds | What it needs |
 |---|---|---|
 | `print` | everything above | nothing — always on |
-| `ai` | clean up screenshots, convert, combine, generate | a key for an images API (paid per image) |
+| `ai` | clean up screenshots, convert, combine, generate — plus the library, with folders, flags and a 30-day trash | a key for an images API (paid per image) |
 | `delivery` | push finished files to an SFTP/FTPS server you already have | that server |
 | `mirror` | a second copy of every result, sorted by month | a second target |
 | `share` | public links: expiring, revocable, optional passphrase, ZIP download | a public URL |
@@ -119,12 +125,12 @@ visitor per hour, deleted after 90 days.
 
 ## Stack and shape
 
-Astro 5 (SSR, Node standalone) with React islands · PostgreSQL · `sharp` ·
+Astro 7 (SSR, Node standalone) with React islands · PostgreSQL · `sharp` ·
 `pdf-lib` · `pg-boss` · OKLCH design tokens, no Tailwind. Files go to a volume by
 default; S3/MinIO is available but not required.
 
-About 13,700 lines across 117 files, 124 tests, 16 forward-only idempotent
+About 13,800 lines across 115 files, 130 tests, 17 forward-only idempotent
-migrations that run themselves on boot. English and German interface — 1,067
+migrations that run themselves on boot. English and German interface — 1,095
 entries, covering every translatable string in the source. The English sentence is
 the translation key, so there is no key file to keep in sync and a missing entry
 degrades to readable English rather than to `print.sheet.title`.
@@ -136,6 +142,17 @@ and Postgres, files on a volume. `docker-compose.full.yaml` adds MinIO and turns
 every module on. Both read their secrets from `.env` and refuse to start rather than
 boot with a default password.
 
+Both pull `ghcr.io/tillheidrich/klarbild:1`, which follows every 1.x release.
+Updating is
+
+```bash
+docker compose pull && docker compose up -d
+```
+
+and the migrations run themselves on the next boot. The container runs as uid
+1000, not root. Prefer to build the image yourself? Swap the `image:` line in the
+compose file for `build: .` and run it from a clone.
+
 **From source.**
 
 ```bash

SECURITY.md

@@ -2,7 +2,7 @@
 
 ## Reporting a vulnerability
 
-Please do **not** open a public issue. Mail **security@heidrich-digital.de** with
+Please do **not** open a public issue. Mail **mail@tillheidrich.de** with
 what you found and how to reproduce it. You will get an acknowledgement within a
 few days. There is no bounty programme — this is a one-person project — but
 credit in the release notes is yours if you want it.

astro.config.mjs

@@ -10,22 +10,27 @@ export default defineConfig({
   // CSRF: handled by our own SameSite=Lax session cookie. Astro's checkOrigin
   // breaks multipart uploads behind a reverse proxy, because the proxy speaks
   // http to the app while the browser spoke https and the origins no longer match.
-  security: { checkOrigin: false },
+  //
   // Content-Security-Policy with hashes instead of 'unsafe-inline': Astro computes
   // the hash of every inline script and style it emits, at build time. The remaining
   // directives are set by the middleware (src/middleware.ts).
-  // Graduated out of `experimental` in Astro 7.
+  // Astro 7 graduated this out of `experimental` and it lives under `security` now.
-  csp: {
+  // Careful: a top-level `csp` key is swallowed without a warning and the site then
-    directives: [
+  // runs with no policy at all.
-      "default-src 'self'",
+  security: {
-      "img-src 'self' data: blob:",
+    checkOrigin: false,
-      "font-src 'self'",
+    csp: {
-      "connect-src 'self'",
+      directives: [
-      "object-src 'none'",
+        "default-src 'self'",
-      "base-uri 'self'",
+        "img-src 'self' data: blob:",
-      "form-action 'self'",
+        "font-src 'self'",
-      "frame-ancestors 'none'",
+        "connect-src 'self'",
-    ],
+        "object-src 'none'",
+        "base-uri 'self'",
+        "form-action 'self'",
+        "frame-ancestors 'none'",
+      ],
+    },
   },
   server: { host: true, port: Number(process.env.PORT) || 4321 },
   vite: {

docker-compose.full.yaml

@@ -9,9 +9,11 @@
 
 services:
   app:
-    build:
+    # The prebuilt image (amd64 and arm64). `:1` follows every 1.x release, so
-      context: .
+    # `docker compose pull && docker compose up -d` is the whole update.
-      dockerfile: Dockerfile
+    image: ghcr.io/tillheidrich/klarbild:${KLARBILD_VERSION:-1}
+    # Rather build it yourself from this checkout? Swap the line above for:
+    # build: .
     environment:
       PORT: "4321"
       DATABASE_URL: "postgres://klarbild:${DB_PASSWORD:?set DB_PASSWORD in .env}@db:5432/klarbild"

docker-compose.yaml

@@ -1,6 +1,6 @@
 # Klarbild — the default stack: the print studio and a database. That is all.
 #
-#   cp .env.example .env     # fill in the three secrets at the top
+#   cp .env.example .env     # fill in the values at the top; the file says which
 #   docker compose up -d
 #   docker compose logs app  # the first-start password is printed once, here
 #
@@ -9,9 +9,11 @@
 
 services:
   app:
-    build:
+    # The prebuilt image (amd64 and arm64). `:1` follows every 1.x release, so
-      context: .
+    # `docker compose pull && docker compose up -d` is the whole update.
-      dockerfile: Dockerfile
+    image: ghcr.io/tillheidrich/klarbild:${KLARBILD_VERSION:-1}
+    # Rather build it yourself from this checkout? Swap the line above for:
+    # build: .
     environment:
       PORT: "4321"
       DATABASE_URL: "postgres://klarbild:${DB_PASSWORD:?set DB_PASSWORD in .env}@db:5432/klarbild"

migrations/017_trash.sql

@@ -0,0 +1,12 @@
+-- Trash instead of deleting for good ----------------------------------------
+--
+-- Deleting an image used to remove the row and the result file on the spot. One
+-- slip in the library and the result was gone — including what it had cost to
+-- generate. Now a delete only sets `deleted_at`. The image disappears from every
+-- view, every share link and every delivery, and comes back unchanged when it is
+-- restored. Maintenance removes it for good after `settings.trash_days`.
+ALTER TABLE items ADD COLUMN IF NOT EXISTS deleted_at timestamptz;
+CREATE INDEX IF NOT EXISTS items_deleted_at_idx ON items (deleted_at) WHERE deleted_at IS NOT NULL;
+
+-- 0 = no trash: a delete is final, as before.
+ALTER TABLE settings ADD COLUMN IF NOT EXISTS trash_days int NOT NULL DEFAULT 30;

package.json

@@ -1,6 +1,6 @@
 {
   "name": "klarbild",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Self-hosted print studio: put pictures on paper at exactly the size you asked for. Sheet layout with crop marks, tiling, 1:1 PDF. Optional AI, delivery, sharing and Telegram modules.",
   "license": "AGPL-3.0-only",
   "author": "Till Heidrich",
@@ -26,7 +26,7 @@
   ],
   "type": "module",
   "engines": {
-    "node": ">=22.6"
+    "node": ">=22.12"
   },
   "scripts": {
     "dev": "astro dev",
@@ -38,32 +38,32 @@
     "scan": "node scripts/secret-scan.mjs"
   },
   "dependencies": {
-    "@astrojs/node": "^11.1.5",
+    "@astrojs/node": "^11.1.7",
-    "@astrojs/react": "^6.0.5",
+    "@astrojs/react": "^7.0.1",
-    "@aws-sdk/client-s3": "^3.700.0",
+    "@aws-sdk/client-s3": "^3.1149.0",
     "@fontsource/space-grotesk": "^5.1.0",
     "@fontsource/space-mono": "^5.1.0",
-    "archiver": "^7.0.1",
+    "archiver": "^8.0.0",
-    "argon2": "^0.41.1",
+    "argon2": "^0.45.1",
-    "astro": "^7.3.2",
+    "astro": "^7.3.8",
-    "basic-ftp": "^5.0.5",
+    "basic-ftp": "^6.2.3",
-    "grammy": "^1.30.0",
+    "grammy": "^1.46.0",
     "heic-convert": "^2.1.0",
-    "nodemailer": "^9.1.0",
+    "nodemailer": "^10.0.16",
     "pdf-lib": "^1.17.1",
-    "pg": "^8.13.1",
+    "pg": "^8.23.1",
     "pg-boss": "^10.1.5",
-    "react": "^19.0.0",
+    "react": "^19.3.0",
-    "react-dom": "^19.0.0",
+    "react-dom": "^19.3.0",
-    "sharp": "^0.35.4",
+    "sharp": "^0.35.5",
-    "ssh2-sftp-client": "^11.0.0"
+    "ssh2-sftp-client": "^12.1.1"
   },
   "devDependencies": {
-    "@types/node": "^26.5.1",
+    "@types/archiver": "^8.0.0",
-    "@types/nodemailer": "^8.0.1",
+    "@types/node": "^26.6.5",
-    "@types/pg": "^8.11.10",
+    "@types/pg": "^8.23.1",
-    "@types/react": "^19.0.0",
+    "@types/react": "^19.3.0",
-    "@types/react-dom": "^19.0.0",
+    "@types/react-dom": "^19.3.0",
     "@types/ssh2-sftp-client": "^9.0.6",
     "typescript": "^5.7.2"
   }

public/favicon.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32"><rect width="32" height="32" rx="7" fill="#F6F6F1"/><circle cx="16" cy="16" r="8.5" fill="none" stroke="#1B3BE0" stroke-width="2.2"/><path d="M16 3.5v25M3.5 16h25" stroke="#1B3BE0" stroke-width="2.2" stroke-linecap="round"/></svg>

public/samples/README.md

@@ -0,0 +1,9 @@
+# Sample image
+
+`lake-at-dusk.jpg` is an original illustration drawn for Klarbild as vector
+shapes and rendered to JPEG. It contains no third-party material and is
+covered by the repository's licence like everything else here.
+
+It exists so that the first visit to a fresh instance can end in a printed
+sheet: the "Try it with a sample photo" button in the print studio uploads
+it through the normal upload path.

src/components/AdminApp.tsx

@@ -88,6 +88,7 @@ export default function AdminApp({ locale, dict }: { locale?: Locale; dict?: Dic
       output_ext: s.output_ext || 'png',
       cricut_sheet_cm: s.cricut_sheet_cm, monthly_budget: s.monthly_budget, n8n_webhook_url: s.n8n_webhook_url,
       keep_sources: !!s.keep_sources, make_thumbnails: s.make_thumbnails !== false, retention_days: s.retention_days,
+      trash_days: s.trash_days ?? 30,
       delivery_metadata_sidecar: !!s.delivery_metadata_sidecar, mirror_metadata_sidecar: !!s.mirror_metadata_sidecar,
       library_visibility: s.library_visibility || 'own', anonymous_generations: !!s.anonymous_generations,
       private_allowed: !!s.private_allowed, allow_nsfw: !!s.allow_nsfw,
@@ -337,6 +338,9 @@ export default function AdminApp({ locale, dict }: { locale?: Locale; dict?: Dic
           <div className="field"><label>{t('Retention (days)')}</label>
             <input className="input" type="number" min={0} placeholder={t('empty = unlimited')} value={s.retention_days ?? ''} onChange={(e) => field('retention_days', e.target.value)} />
             <div className="hint">{t('Older images are removed automatically (daily). Empty = delete nothing.')}</div></div>
+          <div className="field"><label>{t('Trash (days)')}</label>
+            <input className="input" type="number" min={0} max={3650} value={s.trash_days ?? 30} onChange={(e) => field('trash_days', e.target.value)} />
+            <div className="hint">{t('Deleted images wait this long in the trash and can be restored until then. 0 = no trash, a delete is final.')}</div></div>
           <div className="row">
             <button className="mini" onClick={() => storageAction('purge_sources', t('Delete the source images of all finished items? Results are kept.'))}>{t('Delete sources now')}</button>
             <button className="mini" onClick={() => storageAction('rebuild_thumbs')}>{t('Generate missing preview images')}</button>

src/components/LibraryApp.tsx

@@ -30,8 +30,16 @@ export default function LibraryApp({ locale, dict }: { locale?: Locale; dict?: D
   const [tagMenu, setTagMenu] = useState<string | null>(null);
   const [share, setShare] = useState<ShareTarget | null>(null);
   const [tagFilter, setTagFilter] = useState<string | null>(null);
-  const [toast, setToast] = useState<string | null>(null);
+  const [toast, setToast] = useState<{ msg: string; undo?: () => void } | null>(null);
-  const notify = (msg: string) => { setToast(msg); setTimeout(() => setToast(null), 2400); };
+  const toastTimer = React.useRef<ReturnType<typeof setTimeout> | null>(null);
+  // With an undo button the toast stays longer — long enough to notice the slip.
+  const notify = (msg: string, undo?: () => void) => {
+    if (toastTimer.current) clearTimeout(toastTimer.current);
+    setToast({ msg, undo });
+    toastTimer.current = setTimeout(() => setToast(null), undo ? 7000 : 2400);
+  };
+  const [trashView, setTrashView] = useState(false);
+  const [trash, setTrash] = useState<{ days: number; items: (Item & { deleted_at: string; days_left: number })[] }>({ days: 30, items: [] });
 
   // Model name: the admin label, otherwise the readable tail of the model ID.
   const modelName = (id: string | null) => {
@@ -42,12 +50,14 @@ export default function LibraryApp({ locale, dict }: { locale?: Locale; dict?: D
   };
 
   const load = useCallback(async () => {
-    const [i, f, m] = await Promise.all([
+    const [i, f, m, tr] = await Promise.all([
       fetch('/api/items').then((r) => r.json()).catch(() => ({ items: [] })),
       fetch('/api/folders').then((r) => r.json()).catch(() => ({ folders: [] })),
       fetch('/api/models').then((r) => r.json()).catch(() => ({ models: [] })),
+      fetch('/api/trash').then((r) => r.json()).catch(() => ({ days: 30, items: [] })),
     ]);
     setItems(i.items || []); setFolders(f.folders || []); setModels(m.models || []);
+    setTrash({ days: tr.days ?? 30, items: tr.items || [] });
   }, []);
   useEffect(() => { load(); }, [load]);
 
@@ -62,8 +72,30 @@ export default function LibraryApp({ locale, dict }: { locale?: Locale; dict?: D
     await fetch(`/api/items/${id}`, { method: 'PATCH', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ folder_id }) });
     load();
   };
-  const del = async (id: string) => { await fetch(`/api/items/${id}`, { method: 'DELETE' }); setItems((x) => x.filter((y) => y.id !== id)); };
+  const trashAction = (action: 'trash' | 'restore' | 'purge', ids: string[]) =>
-  const delSelected = async () => { for (const id of pick) await fetch(`/api/items/${id}`, { method: 'DELETE' }); setPick(new Set()); load(); notify(t('Deleted.')); };
+    fetch('/api/trash', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ action, ids }) })
+      .then((r) => r.json()).catch(() => ({ ids: [] }));
+  // Deleting moves into the trash; the toast offers to take it back right there.
+  const del = async (ids: string[]) => {
+    if (!ids.length) return;
+    setItems((x) => x.filter((y) => !ids.includes(y.id)));
+    const r = await trashAction('trash', ids);
+    setPick(new Set()); load();
+    const n = (r.ids || []).length;
+    if (trash.days === 0) { notify(n === 1 ? t('Deleted.') : t('{n} deleted.', { n })); return; }
+    notify(n === 1 ? t('Moved to the trash.') : t('{n} moved to the trash.', { n }),
+      async () => { await trashAction('restore', r.ids || []); setToast(null); load(); });
+  };
+  const delSelected = () => del([...pick]);
+  const restore = async (ids: string[]) => { await trashAction('restore', ids); load(); notify(t('Restored.')); };
+  const purge = async (ids: string[]) => {
+    if (!confirm(ids.length === 1 ? t('Delete this image for good? This cannot be undone.') : t('Delete {n} images for good? This cannot be undone.', { n: ids.length }))) return;
+    await trashAction('purge', ids); load(); notify(t('Deleted for good.'));
+  };
+  const emptyTrash = async () => {
+    if (!confirm(t('Empty the trash? {n} images will be deleted for good.', { n: trash.items.length }))) return;
+    await fetch('/api/trash', { method: 'DELETE' }); load(); notify(t('Trash emptied.'));
+  };
   const deliverSelected = async () => {
     notify(t('Sending to the delivery target …'));
     const r = await fetch('/api/deliver', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ itemIds: [...pick] }) }).then((x) => x.json());
@@ -131,9 +163,10 @@ export default function LibraryApp({ locale, dict }: { locale?: Locale; dict?: D
   return (
     <div>
       <div className="head-row">
-        <span className="mono-label">{t('Library')}{filtered.length ? ` · ${filtered.length}` : ''}</span>
+        <span className="mono-label">{trashView ? t('Trash · {n}', { n: trash.items.length })
+          : <>{t('Library')}{filtered.length ? ` · ${filtered.length}` : ''}</>}</span>
         <div className="row">
-          {pick.size > 0 && <>
+          {pick.size > 0 && !trashView && <>
             <span className="hint">{t('{n} selected', { n: pick.size })}</span>
             <button className="mini strong" onClick={deliverSelected}>{t('Deliver')}</button>
             <button className="mini" onClick={() => setShare({ itemIds: [...pick] })}>{t('Share')}</button>
@@ -145,10 +178,43 @@ export default function LibraryApp({ locale, dict }: { locale?: Locale; dict?: D
             </select>
             <button className="mini" onClick={delSelected}>{t('Delete')}</button>
           </>}
-          <button className="mini" onClick={newFolder}>{t('New folder')}</button>
+          {!trashView && <button className="mini" onClick={newFolder}>{t('New folder')}</button>}
+          {(trash.items.length > 0 || trashView) && (
+            <button className={`mini ${trashView ? 'strong' : ''}`} onClick={() => setTrashView(!trashView)}>
+              {trashView ? t('Back to the library') : t('Trash · {n}', { n: trash.items.length })}</button>
+          )}
         </div>
       </div>
 
+      {trashView ? (
+        <div className="trash">
+          <div className="hint notice">{trash.days > 0
+            ? t('Deleted images stay here for {days} days and can be restored until then. They are hidden from the library, from every share link and from every delivery.', { days: trash.days })
+            : t('The trash is switched off — deleting is final.')}</div>
+          {trash.items.length === 0 ? (
+            <div className="empty"><span className="regmark" /><h3>{t('The trash is empty')}</h3></div>
+          ) : (<>
+            <div className="row" style={{ marginBottom: 12 }}>
+              <button className="mini" onClick={() => restore(trash.items.map((x) => x.id))}>{t('Restore all')}</button>
+              <button className="mini danger" onClick={emptyTrash}>{t('Empty the trash')}</button>
+            </div>
+            <div className="gallery">
+              {trash.items.map((v) => (
+                <article key={v.id} className="tile trashed">
+                  <div className="tile-image"><img src={`/api/items/${v.id}/file?thumb=1`} alt="" loading="lazy" /></div>
+                  <div className="name static">{v.filename || '—'}</div>
+                  <div className="meta">{v.days_left === 0 ? t('Removed at the next cleanup') : v.days_left === 1 ? t('1 day left') : t('{n} days left', { n: v.days_left })}</div>
+                  <div className="row tight">
+                    <button className="mini strong2" onClick={() => restore([v.id])}>{t('Restore')}</button>
+                    <button className="mini" onClick={() => purge([v.id])}>{t('Delete for good')}</button>
+                  </div>
+                </article>
+              ))}
+            </div>
+          </>)}
+        </div>
+      ) : (<>
+
       {/* Folder filter */}
       <div className="folderbar">
         <button className={`chip ${!folderFilter ? 'active' : ''}`} onClick={() => setFolderFilter(null)}>{t('All')} · {items.length}</button>
@@ -238,7 +304,7 @@ export default function LibraryApp({ locale, dict }: { locale?: Locale; dict?: D
                     <option value="">{t('No folder')}</option>
                     {folders.map((o) => <option key={o.id} value={o.id}>{o.name}</option>)}
                   </select>
-                  <button className="mini" onClick={() => del(v.id)}>✕</button>
+                  <button className="mini" onClick={() => del([v.id])} title={t('Move to the trash')}>✕</button>
                 </div>
               </article>
             );
@@ -246,6 +312,8 @@ export default function LibraryApp({ locale, dict }: { locale?: Locale; dict?: D
         </div>
       )}
 
+      </>)}
+
       {share && (
         <ShareDialog target={share} onClose={() => setShare(null)} locale={locale} dict={dict} />
       )}
@@ -286,7 +354,8 @@ export default function LibraryApp({ locale, dict }: { locale?: Locale; dict?: D
           </div>
         </div>
       )}
-      {toast && <div className="toast">{toast}</div>}
+      {toast && <div className="toast" role="status">{toast.msg}
+        {toast.undo && <button className="toast-undo" onClick={toast.undo}>{t('Undo')}</button>}</div>}
       <LibStyles />
     </div>
   );
@@ -359,6 +428,10 @@ function LibStyles() {
     .promptbox{background:var(--card);border-radius:var(--radius);max-width:min(92vw,620px);width:100%;padding:16px;display:flex;flex-direction:column;gap:10px;}
     .pb-head{display:flex;justify-content:space-between;align-items:center;gap:10px;}
     .pb-text{white-space:pre-wrap;word-break:break-word;font-family:var(--font-mono);font-size:12.5px;line-height:1.5;background:var(--paper);border:1px solid var(--line);border-radius:4px;padding:12px;max-height:50vh;overflow:auto;margin:0;}
-    .toast{position:fixed;left:50%;bottom:26px;transform:translateX(-50%);background:var(--ink);color:#FBFBF7;padding:10px 18px;border-radius:3px;font-size:13.5px;z-index:60;}
+    .toast{position:fixed;left:50%;bottom:26px;transform:translateX(-50%);background:var(--ink);color:#FBFBF7;padding:10px 18px;border-radius:3px;font-size:13.5px;z-index:60;display:flex;align-items:center;gap:14px;}
+    .toast-undo{background:none;border:1px solid rgba(251,251,247,.5);color:#FBFBF7;border-radius:3px;padding:4px 10px;font-family:inherit;font-size:12.5px;cursor:pointer;}
+    .mini.danger{border-color:var(--err);color:var(--err);}
+    .tile.trashed .tile-image img{opacity:.6;filter:grayscale(.6);}
+    .name.static{font-family:var(--font-mono);font-size:12px;margin-top:8px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;}
   `}</style>;
 }

src/components/PrintApp.tsx

@@ -110,8 +110,8 @@ function shrink(dataUrl: string, maxEdge = 700): Promise<{ url: string; w: numbe
 
 /* ========================================================================== */
 
-export default function PrintApp({ locale, dict, canDeliver = false }:
+export default function PrintApp({ locale, dict, canDeliver = false, hasLibrary = true }:
-  { locale?: Locale; dict?: Dict | null; canDeliver?: boolean }) {
+  { locale?: Locale; dict?: Dict | null; canDeliver?: boolean; hasLibrary?: boolean }) {
   const t = useT(dict);
   const [cells, setCells] = useState<Cell[]>([]);
   const [paperId, setPaperId] = useState('A4');
@@ -335,6 +335,17 @@ export default function PrintApp({ locale, dict, canDeliver = false }:
     } catch { notify(t('These settings could not be applied.'), true); }
   };
 
+  // A photo to try it with, for the first visit — before anyone has picked a
+  // picture of their own. It goes through the normal upload, so what follows is
+  // exactly what happens with a real image. (An original illustration made for
+  // Klarbild; public/samples/README.md says so.)
+  const addSample = async () => {
+    try {
+      const blob = await fetch('/samples/lake-at-dusk.jpg').then((r) => { if (!r.ok) throw new Error(); return r.blob(); });
+      await addFiles([new File([blob], 'lake-at-dusk.jpg', { type: 'image/jpeg' })]);
+    } catch { notify(t('The sample photo could not be loaded.')); }
+  };
+
   const addFromLibrary = (it: any) => {
     const [w, h] = String(it.output_px || '').split(/[x×]/).map((n: string) => parseInt(n, 10) || 0);
     const id = uid();
@@ -500,7 +511,7 @@ export default function PrintApp({ locale, dict, canDeliver = false }:
         <div className="col work-left">
           <Card nr="1" title={t('Images')} actions={
             <>
-              <button className="link" onClick={() => setPicker(true)}>{t('From the library')}</button>
+              {hasLibrary && <button className="link" onClick={() => setPicker(true)}>{t('From the library')}</button>}
               {cells.length > 0 && (
                 <button className="link danger"
                   onClick={() => { if (confirm(t('Remove {images}?',
@@ -528,10 +539,20 @@ export default function PrintApp({ locale, dict, canDeliver = false }:
                       already in Klarbild and need not be exported and uploaded
                       again first. */}
                   <div className="or"><span>{t('or')}</span></div>
-                  <button type="button" className="drop drop-lib" onClick={() => setPicker(true)}>
+                  {hasLibrary ? (
-                    <span className="drop-title">{t('Pick from the library')}</span>
+                    <button type="button" className="drop drop-lib" onClick={() => setPicker(true)}>
-                    <span className="drop-hint">{t('Everything Klarbild has already made — with search, by folder, and several at once')}</span>
+                      <span className="drop-title">{t('Pick from the library')}</span>
-                  </button>
+                      <span className="drop-hint">{t('Everything Klarbild has already made — with search, by folder, and several at once')}</span>
+                    </button>
+                  ) : (
+                    // Print-only instance: there is no library to pick from. The
+                    // second way in is a sample, so the first visit ends in a
+                    // sheet and not in an empty box.
+                    <button type="button" className="drop drop-lib" onClick={addSample}>
+                      <span className="drop-title">{t('Try it with a sample photo')}</span>
+                      <span className="drop-hint">{t('No picture at hand? Take ours, pick a preset below and make the PDF.')}</span>
+                    </button>
+                  )}
                   {presets.length > 0 && (
                     <div className="quickstart">
                       <span className="mono-label">{t('Or start from a preset')}</span>
@@ -559,7 +580,7 @@ export default function PrintApp({ locale, dict, canDeliver = false }:
                   ))}
                   <div className="cell-add-group">
                     <button className="cell-add" onClick={() => fileRef.current?.click()}>{t('＋ Upload')}</button>
-                    <button className="cell-add" onClick={() => setPicker(true)}>{t('＋ From the library')}</button>
+                    {hasLibrary && <button className="cell-add" onClick={() => setPicker(true)}>{t('＋ From the library')}</button>}
                   </div>
                 </div>
               )}

src/layouts/Base.astro

@@ -59,6 +59,8 @@ const ICONS: Record<string, string> = {
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" />
     <meta name="theme-color" content="#EAEAE3" />
+    <link rel="icon" href="/favicon.svg" type="image/svg+xml" />
+    <link rel="apple-touch-icon" href="/apple-touch-icon.png" />
     <title>{title}</title>
   </head>
   <body>

src/lib/backup.ts

@@ -64,7 +64,7 @@ export async function backupAll(): Promise<{ items: number; mirrored: number; fa
   const dests = await backupDestinations();
   if (!dests.length) return { items: 0, mirrored: 0, failed: 0 };
   const rows = await query<{ id: string }>(
-    `SELECT id FROM items WHERE status='done' AND result_path IS NOT NULL ORDER BY created_at`);
+    `SELECT id FROM items WHERE status='done' AND result_path IS NOT NULL AND deleted_at IS NULL ORDER BY created_at`);
   let mirrored = 0, failed = 0;
   for (const it of rows) { const r = await backupItem(it.id); mirrored += r.mirrored; failed += r.failed; }
   return { items: rows.length, mirrored, failed };

src/lib/delivery.ts

@@ -80,6 +80,6 @@ export async function deliverItem(itemId: string): Promise<{ ok: boolean; messag
 /** Work through all deliveries of a job that are still open (pending). */
 export async function deliverPendingForJob(jobId: string): Promise<void> {
   const items = await query<{ id: string }>(
-    `SELECT id FROM items WHERE job_id=$1 AND delivery_status='pending' AND status='done'`, [jobId]);
+    `SELECT id FROM items WHERE job_id=$1 AND delivery_status='pending' AND status='done' AND deleted_at IS NULL`, [jobId]);
   for (const it of items) await deliverItem(it.id);
 }

src/lib/itemaccess.ts

@@ -0,0 +1,49 @@
+// Who may do what with an image.
+//
+// One rule, in one place. Before this file, only the file route checked access;
+// renaming, deleting, retrying and zipping took any id from any signed-in user.
+// On a single-user install that changes nothing. On a family install it meant
+// one account could delete another account's images by id.
+import { one } from './db.ts';
+
+export interface Viewer { uid: string | null; role: string }
+
+export interface ItemAccessRow {
+  id: string;
+  created_by: string | null;
+  private: boolean | null;
+  deleted_at: string | null;
+}
+
+/** Reading: your own images, everything as admin, others' only in a shared library and never from a private session. */
+export function canRead(v: Viewer, it: Pick<ItemAccessRow, 'created_by' | 'private'>, libraryShared: boolean): boolean {
+  if (v.role === 'admin') return true;
+  if (v.uid && it.created_by === v.uid) return true;
+  return libraryShared && !it.private;
+}
+
+/** Changing or deleting: only your own images, or as admin. A shared library is for looking, not for tidying up other people's work. */
+export function canWrite(v: Viewer, it: Pick<ItemAccessRow, 'created_by'>): boolean {
+  if (v.role === 'admin') return true;
+  return !!v.uid && it.created_by === v.uid;
+}
+
+/**
+ * Loads an image together with what the access decision needs.
+ * Returns null both for "does not exist" and for "not yours" — a caller must not
+ * be able to tell the two apart by trying ids.
+ */
+export async function loadItemFor(
+  v: Viewer, id: string, mode: 'read' | 'write', opts: { includeTrashed?: boolean } = {},
+): Promise<ItemAccessRow | null> {
+  if (!/^[0-9a-f-]{36}$/i.test(id)) return null;
+  const it = await one<ItemAccessRow & { library_visibility: string | null }>(
+    `SELECT i.id, j.created_by, j.private, i.deleted_at,
+            (SELECT library_visibility FROM settings WHERE id=1) AS library_visibility
+       FROM items i LEFT JOIN jobs j ON j.id = i.job_id
+      WHERE i.id = $1`, [id]);
+  if (!it) return null;
+  if (it.deleted_at && !opts.includeTrashed) return null;
+  const ok = mode === 'write' ? canWrite(v, it) : canRead(v, it, it.library_visibility === 'shared');
+  return ok ? it : null;
+}

src/lib/maintenance.ts

@@ -138,6 +138,9 @@ export function startMaintenance(): void {
         const r = await runRetention(s.retention_days);
         if (r.deleted) console.log(`[maintenance] Retention: ${r.deleted} old items removed.`);
       }
+      const { purgeExpiredTrash } = await import('./trash');
+      const tr = await purgeExpiredTrash();
+      if (tr) console.log(`[maintenance] Trash: ${tr} images removed for good.`);
       const p = await purgePrivate(60);
       if (p.deleted) console.log(`[maintenance] Private: ${p.deleted} results forgotten.`);
       const t = await purgeTracking(90);

src/lib/printruns.ts

@@ -100,7 +100,7 @@ export async function recordRun(e: RunInput): Promise<string | null> {
     await query(
       `INSERT INTO print_run_items (run_id, item_id)
        SELECT $1, x FROM unnest($2::uuid[]) AS x
-        WHERE EXISTS (SELECT 1 FROM items WHERE id = x)
+        WHERE EXISTS (SELECT 1 FROM items WHERE id = x AND deleted_at IS NULL)
        ON CONFLICT DO NOTHING`, [run.id, ids]).catch((err) =>
       console.error('[printruns] image references not stored:', err?.message || err));
   }
@@ -143,7 +143,7 @@ export async function listRuns(userId: string | null, isAdmin: boolean, limit =
   const images = await query<{ run_id: string; id: string; filename: string | null }>(
     `SELECT ri.run_id, i.id, i.filename
        FROM print_run_items ri JOIN items i ON i.id = ri.item_id
-      WHERE ri.run_id = ANY($1::uuid[]) AND i.status = 'done' AND i.result_path IS NOT NULL`,
+      WHERE ri.run_id = ANY($1::uuid[]) AND i.status = 'done' AND i.result_path IS NOT NULL AND i.deleted_at IS NULL`,
     [runs.map((r) => r.id)]);
 
   const byRun = new Map<string, { id: string; filename: string | null }[]>();

src/lib/printsource.ts

@@ -37,7 +37,7 @@ export async function loadSourceNamed(src: PrintSource, user: SessionUser): Prom
   if (src.kind === 'item') {
     const item = await one<any>(
       `SELECT i.result_path, i.filename, j.created_by, j.private
-         FROM items i JOIN jobs j ON j.id = i.job_id WHERE i.id = $1`, [src.id]);
+         FROM items i JOIN jobs j ON j.id = i.job_id WHERE i.id = $1 AND i.deleted_at IS NULL`, [src.id]);
     if (!item?.result_path) throw new Error('Image not found.');
     const isAdmin = user.role === 'admin';
     const own = item.created_by === user.uid;

src/lib/process.ts

@@ -61,9 +61,15 @@ export interface ProcessResult { ok: boolean; cost: number; error?: string; }
 
 /** Processes one item completely and updates its record. */
 export async function processItem(itemId: string): Promise<ProcessResult> {
-  const item = await one<{ id: string; job_id: string; source_path: string | null; source_paths: string[] | null; filename: string | null }>(
+  const item = await one<{ id: string; job_id: string; source_path: string | null; source_paths: string[] | null; filename: string | null; deleted_at: string | null }>(
-    'SELECT id, job_id, source_path, source_paths, filename FROM items WHERE id=$1', [itemId]);
+    'SELECT id, job_id, source_path, source_paths, filename, deleted_at FROM items WHERE id=$1', [itemId]);
   if (!item) return { ok: false, cost: 0, error: 'Item not found' };
+  // Moved to the trash while it was still waiting: do not pay a model for an
+  // image nobody wants any more.
+  if (item.deleted_at) {
+    await query(`UPDATE items SET status='skipped' WHERE id=$1 AND status IN ('queued','running')`, [itemId]);
+    return { ok: true, cost: 0 };
+  }
 
   const job = await one<{ recipe_snapshot: RecipeSnapshot; mode: Mode; private: boolean }>(
     'SELECT recipe_snapshot, mode, private FROM jobs WHERE id=$1', [item.job_id]);

src/lib/shares.ts

@@ -153,14 +153,16 @@ export async function shareItems(shareId: string): Promise<ShareBild[]> {
     `SELECT i.id, i.filename, i.output_px, i.created_at
        FROM share_items si
        JOIN items i ON i.id = si.item_id
-      WHERE si.share_id = $1 AND i.status = 'done' AND i.result_path IS NOT NULL
+      WHERE si.share_id = $1 AND i.status = 'done' AND i.result_path IS NOT NULL AND i.deleted_at IS NULL
       ORDER BY si.position, i.created_at`, [shareId]);
 }
 
 /** Does this image belong to this link? Cross-check before every delivery. */
 export async function shareHasItem(shareId: string, itemId: string): Promise<boolean> {
   const r = await one<{ item_id: string }>(
-    'SELECT item_id FROM share_items WHERE share_id=$1 AND item_id=$2', [shareId, itemId]);
+    // An image in the trash is not part of any link until it is restored.
+    `SELECT si.item_id FROM share_items si JOIN items i ON i.id = si.item_id
+      WHERE si.share_id=$1 AND si.item_id=$2 AND i.deleted_at IS NULL`, [shareId, itemId]);
   return !!r;
 }
 
@@ -233,7 +235,7 @@ export async function listShares(userId: string | null, isAdmin: boolean): Promi
     // share_views: with many accesses this page turned sluggish otherwise.
     `SELECT s.*,
             (SELECT count(*)::int FROM share_items si JOIN items i ON i.id = si.item_id
-              WHERE si.share_id = s.id AND i.status='done' AND i.result_path IS NOT NULL) AS count,
+              WHERE si.share_id = s.id AND i.status='done' AND i.result_path IS NOT NULL AND i.deleted_at IS NULL) AS count,
             s.visitor
        FROM shares s
       WHERE $2::boolean OR s.created_by = $1

src/lib/trash.ts

@@ -0,0 +1,100 @@
+// The trash: delete softly, restore, empty, and let maintenance finish the job.
+import { one, query } from './db.ts';
+import { deleteObject } from './storage.ts';
+import type { Viewer } from './itemaccess.ts';
+
+export const DEFAULT_TRASH_DAYS = 30;
+
+/** Every stored object an image row points to. */
+export function objectKeysOf(it: {
+  source_path?: string | null; source_paths?: string[] | null; result_path?: string | null; thumb_path?: string | null;
+}): string[] {
+  const keys = [it.source_path, it.result_path, it.thumb_path, ...(it.source_paths || [])]
+    .filter((k): k is string => typeof k === 'string' && k.length > 0);
+  return [...new Set(keys)];
+}
+
+/**
+ * Days until an image in the trash is removed for good. Rounded up, never below
+ * zero: "0 days" means the next maintenance run takes it.
+ */
+export function daysLeft(deletedAt: Date | string, trashDays: number, now: Date = new Date()): number {
+  const gone = new Date(deletedAt).getTime() + trashDays * 86_400_000;
+  return Math.max(0, Math.ceil((gone - now.getTime()) / 86_400_000));
+}
+
+export async function trashDays(): Promise<number> {
+  const s = await one<{ trash_days: number | null }>('SELECT trash_days FROM settings WHERE id=1');
+  const d = s?.trash_days;
+  return typeof d === 'number' && d >= 0 ? d : DEFAULT_TRASH_DAYS;
+}
+
+/** SQL condition: rows this viewer may change. `$1` = uid, `$2` = is admin. */
+const OWN = `($2::boolean OR i.job_id IN (SELECT id FROM jobs WHERE created_by = $1))`;
+
+/** Moves images into the trash. Returns the ids that actually moved. */
+export async function trashItems(v: Viewer, ids: string[]): Promise<string[]> {
+  if (!ids.length) return [];
+  if ((await trashDays()) === 0) return purgeItems(v, ids, { onlyTrashed: false });
+  const rows = await query<{ id: string }>(
+    `UPDATE items i SET deleted_at = now()
+      WHERE i.id = ANY($3::uuid[]) AND i.deleted_at IS NULL AND ${OWN}
+      RETURNING i.id`, [v.uid, v.role === 'admin', ids]);
+  return rows.map((r) => r.id);
+}
+
+export async function restoreItems(v: Viewer, ids: string[]): Promise<string[]> {
+  if (!ids.length) return [];
+  const rows = await query<{ id: string }>(
+    `UPDATE items i SET deleted_at = NULL
+      WHERE i.id = ANY($3::uuid[]) AND i.deleted_at IS NOT NULL AND ${OWN}
+      RETURNING i.id`, [v.uid, v.role === 'admin', ids]);
+  return rows.map((r) => r.id);
+}
+
+/**
+ * Removes images for good: the row and every file that no other image still
+ * uses. That last part matters — an alternative version shares its source file
+ * with the original, and deleting the original must not take the source of the
+ * alternative with it.
+ */
+export async function purgeItems(v: Viewer | null, ids: string[], opts: { onlyTrashed?: boolean } = {}): Promise<string[]> {
+  if (!ids.length) return [];
+  const onlyTrashed = opts.onlyTrashed !== false;
+  const admin = !v || v.role === 'admin';
+  const rows = await query<{ id: string; source_path: string | null; source_paths: string[] | null; result_path: string | null; thumb_path: string | null }>(
+    `DELETE FROM items i
+      WHERE i.id = ANY($3::uuid[]) ${onlyTrashed ? 'AND i.deleted_at IS NOT NULL' : ''} AND ${OWN}
+      RETURNING i.id, i.source_path, i.source_paths, i.result_path, i.thumb_path`,
+    [v?.uid ?? null, admin, ids]);
+  for (const r of rows) {
+    for (const k of objectKeysOf(r)) {
+      // `source_paths` is jsonb, not a Postgres array. A failure here must not stop
+      // the loop: the rows are already gone, and a skipped file is only wasted
+      // space, while an exception would skip every file after it.
+      try {
+        const still = await one<{ n: number }>(
+          `SELECT count(*)::int AS n FROM items
+            WHERE source_path = $1 OR result_path = $1 OR thumb_path = $1
+               OR source_paths @> jsonb_build_array($1::text)`, [k]);
+        if (!still?.n) await deleteObject(k);
+      } catch (e) { console.error('[trash] could not remove', k, (e as Error)?.message); }
+    }
+  }
+  return rows.map((r) => r.id);
+}
+
+/** Empties the trash: the viewer's own images, or all of them for an admin. */
+export async function emptyTrash(v: Viewer): Promise<number> {
+  const ids = await query<{ id: string }>(
+    `SELECT i.id FROM items i WHERE i.deleted_at IS NOT NULL AND ${OWN}`, [v.uid, v.role === 'admin']);
+  return (await purgeItems(v, ids.map((r) => r.id))).length;
+}
+
+/** Maintenance: everything that has been in the trash longer than the setting allows. */
+export async function purgeExpiredTrash(): Promise<number> {
+  const days = await trashDays();
+  const ids = await query<{ id: string }>(
+    `SELECT id FROM items WHERE deleted_at IS NOT NULL AND deleted_at < now() - ($1 || ' days')::interval`, [String(days)]);
+  return (await purgeItems(null, ids.map((r) => r.id))).length;
+}

src/locales/de.json

@@ -5,10 +5,13 @@
   ".md on": ".md an",
   "0 = unlimited.": "0 = unbegrenzt.",
   "1 Sep 2026": "01.09.2026",
+  "1 day left": "Noch 1 Tag",
   "1 image": "1 Bild",
   "1 year": "1 Jahr",
   "1 year from now": "1 Jahr ab jetzt",
   "1 · Edit an image": "1 · Bild bearbeiten",
+  "1.1 — a trash, a sample photo, and an image you do not have to build": "1.1 — ein Papierkorb, ein Beispielfoto und ein Image, das du nicht selbst bauen musst",
+  "10 Oct 2026": "10.10.2026",
   "13 × 18 cm → measured 130.1 × 180.1 mm": "13 × 18 cm → gemessen 130,1 × 180,1 mm",
   "150 — draft": "150 — Entwurf",
   "16:9 TV (30 cm wide)": "16:9 TV 16:9 (30 cm breit)",
@@ -85,6 +88,8 @@
   "<b>Cutting guides</b>: <b>corner marks</b> (fine marks outside the final format, as in Photoshop and InDesign) or <b>continuous lines</b> across the whole sheet for the cutting ruler. The continuous lines never run through another subject.": "<b>Schnitthilfen</b>: <b>Eckmarken</b> (feine Marken außerhalb des Endformats, wie in Photoshop und InDesign) oder <b>durchgehende Linien</b> über den ganzen Bogen fürs Schneidelineal. Die durchgehenden Linien laufen nie durch ein anderes Motiv.",
   "<b>Decide the caption yourself.</b> The small line under the sheet can be switched off, given your own text and placed in one of six spots (top or bottom, left, centre or right). If there is no room free at the chosen edge it is dropped automatically — nothing is ever printed over an image.": "<b>Beschriftung selbst bestimmen.</b> Die kleine Zeile unter dem Bogen lässt sich ausschalten, mit eigenem Text versehen und an eine von sechs Stellen legen (oben oder unten, links, mittig oder rechts). Ist an der gewählten Kante kein Platz frei, entfällt sie automatisch — über ein Bild wird nie gedruckt.",
   "<b>Delete a job</b> straight from the queue (for old or failed jobs). Missing sources now report a clear notice instead of a cryptic technical error.": "<b>Auftrag löschen</b> direkt aus der Warteschlange (für alte/fehlgeschlagene Aufträge). Fehlende Quellen melden jetzt einen klaren Hinweis statt kryptischer Technikfehler.",
+  "<b>Deleting is no longer final on the spot.</b> ✕ moves an image into the trash, and for a few seconds the bottom of the screen offers <b>Undo</b>. Noticed later? The library shows a <b>Trash</b> button; everything in there can be restored for 30 days, then Klarbild clears it away by itself.": "<b>Löschen ist nicht mehr sofort endgültig.</b> ✕ legt ein Bild in den Papierkorb, und unten steht für ein paar Sekunden <b>Rückgängig</b>. Später gemerkt? In der Bibliothek steht dann <b>Papierkorb</b>; alles darin lässt sich 30 Tage lang wiederherstellen, danach räumt Klarbild es von selbst weg.",
+  "<b>Deleting</b> (✕) moves an image into the <b>trash</b>, with <b>Undo</b> right after. The trash (a button top right, once something is in it) keeps it for 30 days — and while it is there it appears in no share link and no delivery.": "<b>Löschen</b> (✕) legt ein Bild in den <b>Papierkorb</b>, direkt danach mit <b>Rückgängig</b>. Der Papierkorb (Knopf oben rechts, sobald etwas drinliegt) hebt es 30 Tage auf — und solange es dort liegt, taucht es in keinem geteilten Link und bei keiner Auslieferung auf.",
   "<b>Delivery-target tools in Admin:</b> “Show folders” (what sits where over SFTP) and “Clean up leftovers” (remove .tmp files left behind).": "<b>Werkzeuge fürs Auslieferungsziel im Admin:</b> „Ordner anzeigen\" (was liegt per SFTP wo) und „Reste aufräumen\" (liegengebliebene.tmp-Dateien entfernen).",
   "<b>Download singly</b>: one image at exactly its size as PNG/JPG with dpi metadata — without a sheet.": "<b>Einzeln herunterladen</b>: ein Bild exakt auf Maß als PNG/JPG mit dpi-Metadaten — ohne Bogen.",
   "<b>Download</b> saves the file at full resolution. On a phone it also works like this: press and hold an image, then save it.": "<b>Herunterladen</b> speichert die Datei in voller Auflösung. Am Handy geht es auch so: lange auf ein Bild drücken und speichern.",
@@ -113,6 +118,7 @@
   "<b>If the image does not fit the format</b>, you decide for each image: <b>Crop</b> (the format is filled, something is missing at the edges — the default) or <b>Letterbox</b> (the whole image stays visible, with the <b>border colour</b> around it — white, black, paper-coloured or freely chosen). <b>Nothing is ever distorted.</b>": "<b>Wenn das Bild nicht zum Format passt</b>, entscheidest du je Bild: <b>Zuschneiden</b> (das Format wird ausgefüllt, außen fehlt etwas — Standard) oder <b>Rand lassen</b> (das ganze Bild bleibt sichtbar, außen steht die <b>Randfarbe</b> — weiß, schwarz, papierfarben oder frei gewählt). <b>Verzerrt wird nie.</b>",
   "<b>Images from the library into the print area.</b> Until now you had to upload a file even when Klarbild had it already. The print area now offers <b>“Choose from the library”</b> — with search, by folder, and several at once.": "<b>Bilder aus der Bibliothek in den Druckbereich.</b> Bisher musstest du eine Datei hochladen, auch wenn Klarbild sie längst hatte. Jetzt steht im Druckbereich <b>„Aus der Bibliothek wählen\"</b> — mit Suche, nach Ordner, und mehrere auf einmal.",
   "<b>Important when printing:</b> in the print dialog choose “Actual size” or “100%” — <b>not</b> “fit to page”. Otherwise the size no longer holds. If you can print borderless, set the margin to 0; otherwise 3–5 mm, or the printer cuts the marks away.": "<b>Wichtig beim Drucken:</b> im Druckdialog „Tatsächliche Größe\" bzw. „100 %\" wählen — <b>nicht</b> „an Seitengröße anpassen\". Sonst stimmt das Maß nicht mehr. Wer randlos drucken kann, setzt den Rand auf 0; sonst 3–5 mm, sonst schneidet der Drucker die Marken weg.",
+  "<b>Its own icon</b> in the browser tab and on the iPhone home screen.": "<b>Ein eigenes Symbol</b> im Browser-Tab und auf dem iPhone-Homebildschirm.",
   "<b>Keep editing:</b> simply send a finished image from the bot back to it.": "<b>Weiterbearbeiten:</b> ein fertiges Bild vom Bot einfach wieder zurückschicken.",
   "<b>Keep editing:</b> take a finished image as a new source and edit it again.": "<b>Weiterbearbeiten:</b> ein fertiges Bild als neue Vorlage übernehmen und erneut bearbeiten.",
   "<b>Keep editing</b>: takes a finished image into the studio as a new source — edit it again there, bring it to the next format, or mix it with further images in Combine mode.": "<b>Weiterbearbeiten</b>: übernimmt ein fertiges Bild als neue Vorlage ins Studio — dort erneut bearbeiten, ins nächste Format bringen oder im Modus Kombinieren mit weiteren Bildern mischen.",
@@ -161,6 +167,7 @@
   "<b>The same image at two sizes?</b> Tap <b>Duplicate</b> — the image appears a second time in the list and gets its own size there. No more renaming and uploading again.": "<b>Dasselbe Bild in zwei Maßen?</b> <b>Duplizieren</b> antippen — das Bild erscheint ein zweites Mal in der Liste und bekommt dort sein eigenes Maß. Kein Umbenennen und erneutes Hochladen mehr.",
   "<b>The time is local time</b>, not UTC. An image made at 00:30 now carries the right date instead of the previous day's.": "<b>Uhrzeit in deutscher Zeit</b>, nicht in UTC. Ein Bild von 0:30 Uhr trägt jetzt das richtige Datum und nicht mehr das des Vortags.",
   "<b>Thumbnails</b> for the library (fast & frugal).": "<b>Vorschaubilder</b> für die Bibliothek (schnell & sparsam).",
+  "<b>Try it with a sample photo.</b> An instance with only the print studio used to offer “Pick from the library” — without having a library. Now that place holds a sample photo, so a first visit ends in a printed sheet.": "<b>Mit einem Beispielfoto ausprobieren.</b> Eine Installation nur mit Druckstudio bot bisher „Aus der Bibliothek wählen“ an — ohne eine Bibliothek zu haben. An der Stelle steht jetzt ein Beispielfoto, damit der erste Besuch mit einem fertigen Bogen endet.",
   "<b>Where to?</b>: the finished sheet can also be put on the delivery target, on the backup mirror or on an extra target — like the images from the studio.": "<b>Wohin?</b>: der fertige Bogen kann zusätzlich an das Auslieferungsziel, auf den Spiegel oder an ein Zusatzziel gelegt werden — wie die Bilder aus dem Studio.",
   "<b>Without filling up the disk:</b> what is kept is not the PDFs — an A3 sheet is quickly 20 to 80 MB — but only the settings, a few kilobytes. Because the print area computes without AI, the same job yields exactly the same sheet again. That is why “Print again” only appears when all the images came from the library and are still there; otherwise the entry says what is in the way. The last 100 prints are kept.": "<b>Ohne die Platte vollzumachen:</b> Aufgehoben werden nicht die PDFs — ein A3-Bogen wären schnell 20 bis 80 MB — sondern nur die Einstellung, ein paar Kilobyte. Weil der Druckbereich ohne KI rechnet, ergibt derselbe Auftrag wieder exakt dasselbe Blatt. „Nochmal drucken\" gibt es deshalb nur, wenn alle Bilder aus der Bibliothek kamen und noch da sind; sonst steht am Eintrag, woran es liegt. Aufgehoben werden die letzten 100 Drucke.",
   "<b>“Deliver again”</b> uploads every already delivered image once more under its new name. The old files stay behind on the target — you clear those away there yourself, so that nothing disappears from the client's view by accident.": "<b>„Erneut ausliefern\"</b> lädt alle schon ausgelieferten Bilder unter dem neuen Namen erneut hoch. Die alten Dateien bleiben am Ziel liegen — die räumst du am Ziel selbst weg, damit nichts versehentlich beim Kunden verschwindet.",
@@ -218,6 +225,7 @@
   "Assign images to this folder from the folder menu.": "Weise Bildern über das Ordner-Menü diesen Ordner zu.",
   "Automated tests for the geometry plus a raster sample of the finished PDFs at 254 dpi (= 10 px/mm) with edge measurement.": "Automatische Tests für die Geometrie plus Rasterprobe der fertigen PDFs bei 254 dpi (= 10 px/mm) mit Kantenmessung.",
   "Automation / MCP access": "Automatisierung / MCP-Zugriff",
+  "Back to the library": "Zurück zur Bibliothek",
   "Back up all existing images to the mirror": "Alle vorhandenen Bilder auf den Sicherungsspiegel sichern",
   "Back up all finished images to every backup target (mirror + marked targets)?": "Alle fertigen Bilder auf alle Backup-Ziele (Sicherungsspiegel + markierte Ziele) sichern?",
   "Back up all finished images to the mirror?": "Alle fertigen Bilder auf den Sicherungsspiegel sichern?",
@@ -349,6 +357,7 @@
   "Delete": "Löschen",
   "Delete folder": "Ordner löschen",
   "Delete folder? The images are kept.": "Ordner löschen? Die Bilder bleiben erhalten.",
+  "Delete for good": "Endgültig löschen",
   "Delete items older than {days} days now?": "Positionen älter als {days} Tage jetzt löschen?",
   "Delete preset": "Vorlage löschen",
   "Delete preset?": "Vorlage löschen?",
@@ -357,7 +366,12 @@
   "Delete target?": "Ziel löschen?",
   "Delete the link \"{name}\" for good?\n\nIt cannot be opened afterwards and the access figures are gone. Just switching it off is usually enough.": "Den Link „{name}\" endgültig löschen?\n\nEr lässt sich danach nicht mehr öffnen und die Zugriffszahlen sind weg. Nur abschalten reicht meistens.",
   "Delete the source images of all finished items? Results are kept.": "Alle Quellbilder fertiger Positionen löschen? Ergebnisse bleiben erhalten.",
+  "Delete this image for good? This cannot be undone.": "Dieses Bild endgültig löschen? Das lässt sich nicht rückgängig machen.",
   "Delete this job?": "Diesen Auftrag löschen?",
+  "Delete {n} images for good? This cannot be undone.": "{n} Bilder endgültig löschen? Das lässt sich nicht rückgängig machen.",
+  "Deleted for good.": "Endgültig gelöscht.",
+  "Deleted images stay here for {days} days and can be restored until then. They are hidden from the library, from every share link and from every delivery.": "Gelöschte Bilder bleiben {days} Tage hier und lassen sich bis dahin wiederherstellen. In der Bibliothek, in Freigabelinks und bei der Auslieferung tauchen sie nicht mehr auf.",
+  "Deleted images wait this long in the trash and can be restored until then. 0 = no trash, a delete is final.": "So lange bleiben gelöschte Bilder im Papierkorb und lassen sich bis dahin wiederherstellen. 0 = kein Papierkorb, Löschen ist endgültig.",
   "Deleted.": "Gelöscht.",
   "Deletes all images, jobs and folders irreversibly, so you can start over cleanly. Users, settings, models and preset recipes are kept. Tip: run “Back up all existing images to the mirror” first.": "Löscht alle Bilder, Aufträge und Ordner unwiderruflich, um sauber neu zu starten. Nutzer, Einstellungen, Modelle und Rezepte bleiben erhalten. Tipp: vorher „Alle Bilder auf den Sicherungsspiegel sichern\".",
   "Deliver": "Ausliefern",
@@ -388,6 +402,8 @@
   "Email address and notifications.": "E-Mail-Adresse und Benachrichtigungen.",
   "Empty = everyone with the link gets in": "Leer = jeder mit dem Link kommt rein",
   "Empty = username. It has to belong to the mailbox, otherwise recipients reject the mail.": "Leer = Benutzername. Muss zum Postfach gehören, sonst lehnen Empfänger die Mail ab.",
+  "Empty the trash": "Papierkorb leeren",
+  "Empty the trash? {n} images will be deleted for good.": "Papierkorb leeren? {n} Bilder werden endgültig gelöscht.",
   "Enable the backup mirror and save first.": "Sicherungsspiegel erst aktivieren & speichern.",
   "Enter a host and save first.": "Erst Host eintragen und speichern.",
   "Enter a new key to replace it": "Neuen Key eingeben zum Wechseln",
@@ -523,7 +539,9 @@
   "Monthly budget ($)": "Monatliches Budget ($)",
   "More output targets (FTP/SFTP)": "Weitere Ausgabeziele (FTP/SFTP)",
   "More settings": "Mehr einstellen",
+  "Move to the trash": "In den Papierkorb",
   "Moved into the folder.": "In Ordner verschoben.",
+  "Moved to the trash.": "In den Papierkorb gelegt.",
   "My account": "Mein Konto",
   "My account · Klarbild": "Mein Konto · Klarbild",
   "My account, sharing & email": "Mein Konto, Teilen & E-Mail",
@@ -552,6 +570,7 @@
   "No mail sending is set up on this server yet — the address is stored, but nothing arrives yet. An admin sets that up under Admin → Email.": "Auf diesem Server ist noch kein E-Mail-Versand eingerichtet — die Adresse wird zwar gespeichert, es kommt aber noch nichts an. Ein Admin richtet das unter Admin → E-Mail ein.",
   "No models yet. Add one from the available ones:": "Noch keine Modelle. Aus verfügbaren hinzufügen:",
   "No paired chats yet.": "Noch keine gekoppelten Chats.",
+  "No picture at hand? Take ours, pick a preset below and make the PDF.": "Gerade kein Bild zur Hand? Nimm unseres, wähl unten eine Vorlage und mach das PDF.",
   "No sending set up yet — forgotten password, job notices and mailing share links do not work until then.": "Noch kein Versand eingerichtet — Passwort vergessen, Auftragshinweise und der Mailversand von Teilen-Links funktionieren bis dahin nicht.",
   "No token generated yet.": "Noch kein Token erzeugt.",
   "No valid image size chosen yet.": "Noch kein gültiges Bildmaß gewählt.",
@@ -689,6 +708,7 @@
   "Remove frame, wall and shop interface.": "Rahmen, Wand und Shop-Oberfläche entfernen.",
   "Remove {images}?": "{images} entfernen?",
   "Remove {name}": "{name} entfernen",
+  "Removed at the next cleanup": "Wird beim nächsten Aufräumen entfernt",
   "Removed from the folder.": "Aus Ordner entfernt.",
   "Rename folder": "Ordner umbenennen",
   "Rename folder:": "Ordner umbenennen:",
@@ -699,6 +719,9 @@
   "Reset library & jobs": "Bibliothek & Aufträge zurücksetzen",
   "Resetting …": "Setze zurück …",
   "Resolution (dpi)": "Auflösung (dpi)",
+  "Restore": "Wiederherstellen",
+  "Restore all": "Alle wiederherstellen",
+  "Restored.": "Wiederhergestellt.",
   "Results land under base folder / YYYY-MM /. Credentials are stored encrypted.": "Ergebnisse landen unter Basisordner / JJJJ-MM /. Zugangsdaten werden verschlüsselt gespeichert.",
   "Resume": "Fortsetzen",
   "Retention (days)": "Aufbewahrung (Tage)",
@@ -833,7 +856,10 @@
   "The password is stored encrypted and never shown again.": "Das Passwort wird verschlüsselt gespeichert und nie wieder angezeigt.",
   "The problem": "Das Problem",
   "The same image once more — for a second format, say": "Dasselbe Bild noch einmal — z. B. für ein zweites Format",
+  "The sample photo could not be loaded.": "Das Beispielfoto ließ sich nicht laden.",
   "The second way out for large sizes: the image is spread across several sheets. The tiles overlap by a glue flap, which is printed on both neighbouring sheets and marked with a dashed line. Every sheet carries its number with row and column.": "Der zweite Weg für große Maße: Das Bild wird auf mehrere Blätter verteilt. Die Kacheln überlappen sich um einen Klebefalz, der auf beiden Nachbarblättern gedruckt und gestrichelt markiert wird. Jedes Blatt trägt seine Nummer samt Reihe und Spalte.",
+  "The trash is empty": "Der Papierkorb ist leer",
+  "The trash is switched off — deleting is final.": "Der Papierkorb ist abgeschaltet — Löschen ist endgültig.",
   "The two entries do not match.": "Die beiden Eingaben stimmen nicht überein.",
   "The usual route runs through a layout program or through the printer driver, and both of them mean too well: “fit to page”, “scale to fit”, “scale borderless”. What comes out is a print that is almost right. For a passport photo, “almost” is too little, and using a whole A4 sheet for a 4 × 3 snapshot, only because it would otherwise not fit on the page at 100% size, is plain waste.": "Der übliche Weg führt über ein Layoutprogramm oder über den Druckertreiber, und beide meinen es zu gut: „an Seitengröße anpassen“, „einpassen“, „randlos skalieren“. Am Ende liegt ein Ausdruck vor, der fast stimmt. Für ein Passbild ist „fast“ zu wenig, und für ein 4 × 3-Bildchen ein ganzes DIN-A4-Blatt zu verbrauchen, nur weil es sonst nicht in 100 % Größe auf die Seite passt, ist schlicht Verschwendung.",
   "The whole image stays visible, with a border around it": "Ganzes Bild bleibt sichtbar, außen entsteht ein Rand",
@@ -855,12 +881,17 @@
   "Today ${today} · 7 days ${week}": "Heute ${today} · 7 Tage ${week}",
   "Too large": "Zu groß",
   "Too many attempts. Please try again in a quarter of an hour.": "Zu viele Versuche. Bitte in einer Viertelstunde noch einmal.",
+  "Trash (days)": "Papierkorb (Tage)",
+  "Trash emptied.": "Papierkorb geleert.",
+  "Trash · {n}": "Papierkorb · {n}",
   "True to size": "Maßhaltig",
   "Try again": "Noch einmal versuchen",
+  "Try it with a sample photo": "Mit einem Beispielfoto ausprobieren",
   "US visa 51 × 51 mm (2 × 2 in)": "Visum USA 51 × 51 mm (2 × 2 in)",
   "Under <b>“File names”</b> the existing library can be brought onto the unique naming scheme. <b>“Check library”</b> first shows what would change and how many names are currently used twice; <b>“Rename now”</b> carries it out. The image files themselves are left untouched — they sit in storage under their id, not under their name. A second run changes nothing. <b>“Deliver again”</b> then uploads every already delivered image under its new name; the old files stay on the delivery target and you clear them away there yourself.": "Unter <b>„Dateinamen\"</b> lässt sich die vorhandene Bibliothek auf das eindeutige Namensschema bringen. <b>„Bibliothek prüfen\"</b> zeigt zuerst, was sich ändern würde und wie viele Namen aktuell doppelt vergeben sind; <b>„Jetzt umbenennen\"</b> setzt es um. Die Bilddateien selbst bleiben dabei unangetastet — sie liegen im Speicher unter ihrer Kennung, nicht unter ihrem Namen. Ein zweiter Lauf ändert nichts mehr. <b>„Erneut ausliefern\"</b> lädt danach alle schon ausgelieferten Bilder unter dem neuen Namen erneut hoch; die alten Dateien bleiben am Ziel liegen und räumst du dort selbst weg.",
   "Under the hood": "Unter der Haube",
   "Under the hood: a real cost cap, reliable job completion, a reachability check for the mirror.": "Unter der Haube: echter Kostendeckel, verlässlicher Auftragsabschluss, Erreichbarkeits-Diagnose für den Spiegel.",
+  "Undo": "Rückgängig",
   "Unique file names — images no longer overwrite each other": "Eindeutige Dateinamen — Bilder überschreiben sich nicht mehr",
   "Unit": "Einheit",
   "Unlink": "Trennen",
@@ -894,6 +925,7 @@
   "When fitting in, the border colour stays around the outside.": "Beim Einpassen bleibt außen die Randfarbe stehen.",
   "When it is reached the queue stops.": "Bei Erreichen hält die Warteschlange an.",
   "Where to?": "Wohin?",
+  "While an image is in the trash it is gone from <b>share links</b> too — and comes back there when you restore it. An image deleted while it is still waiting in the queue is not generated at all, so it costs nothing.": "Solange ein Bild im Papierkorb liegt, ist es auch aus <b>geteilten Links</b> verschwunden — und kommt beim Wiederherstellen dorthin zurück. Ein Bild, das noch in der Warteschlange wartet, wird gar nicht erst erzeugt und kostet nichts.",
   "Who generated an image is hidden from non-admins.": "Wer ein Bild erzeugt hat, wird für Nicht-Admins ausgeblendet.",
   "Who sees which generations?": "Wer sieht welche Generierungen?",
   "Whoever sent you this link can see <b>when</b> it was opened and with what kind of device. Not <b>who</b> opened it: only an unrecognisable number is stored for your internet address, and that is deleted after 90 days.": "Wer dir diesen Link geschickt hat, sieht, <b>wann</b> und mit welcher Art Gerät er geöffnet wurde. Nicht, <b>wer</b> das war: Von deiner Internet-Adresse wird nur ein unkenntlicher Zahlenwert gespeichert, und der wird nach 90 Tagen gelöscht.",
@@ -1015,6 +1047,8 @@
   "{images} on this sheet": "{images} auf diesem Bogen",
   "{n} copies to backup targets, {failed} errors.": "{n} Kopien auf Backup-Ziele, {failed} Fehler.",
   "{n} copies to backup targets.": "{n} Kopien auf Backup-Ziele.",
+  "{n} days left": "Noch {n} Tage",
+  "{n} deleted.": "{n} gelöscht.",
   "{n} entries in {path}": "{n} Einträge in {path}",
   "{n} extra sheet": "{n} Extrabogen",
   "{n} extra sheets": "{n} Extrabogen",
@@ -1029,6 +1063,7 @@
   "{n} images renamed, {ok} were already fine.": "{n} Bilder umbenannt, {ok} waren schon in Ordnung.",
   "{n} leftovers removed from “{folder}”.": "{n} Reste in „{folder}\" entfernt.",
   "{n} min ago": "vor {n} min",
+  "{n} moved to the trash.": "{n} in den Papierkorb gelegt.",
   "{n} names were used twice": "{n} Namen waren doppelt vergeben",
   "{n} of {checked} images would get a new name — {dupes} names are currently used twice.": "{n} von {checked} Bildern bekämen einen neuen Namen — {dupes} Namen sind aktuell doppelt vergeben.",
   "{n} of {checked} images would get a new name.": "{n} von {checked} Bildern bekämen einen neuen Namen.",

src/pages/api/admin/settings.ts

@@ -42,6 +42,7 @@ export const GET: APIRoute = async () => {
     smtp_effective: mail ? { host: mail.cfg.host, port: mail.cfg.port, user: mail.cfg.user, from: mail.cfg.from } : null,
     // Sharing
     share_default_days: s.share_default_days,
+    trash_days: s.trash_days,
   } });
 };
 
@@ -64,9 +65,16 @@ export const PATCH: APIRoute = async ({ request }) => {
     'delivery_metadata_sidecar', 'mirror_metadata_sidecar', 'output_ext',
     'library_visibility', 'anonymous_generations', 'private_allowed', 'allow_nsfw',
     'mirror_enabled', 'mirror_host', 'mirror_protocol', 'mirror_port', 'mirror_user', 'mirror_base_path',
-    'smtp_host', 'smtp_port', 'smtp_secure', 'smtp_user', 'smtp_from', 'share_default_days']) {
+    'smtp_host', 'smtp_port', 'smtp_secure', 'smtp_user', 'smtp_from', 'share_default_days', 'trash_days']) {
     if (col in b) {
       const raw = b[col];
+      if (col === 'trash_days') {
+        // NOT NULL in the database: empty means the default, anything else a whole number of days.
+        const n = raw === '' || raw == null ? 30 : Math.round(Number(raw));
+        if (!Number.isFinite(n) || n < 0 || n > 3650) return json({ error: 'Trash: 0 to 3650 days.' }, 400);
+        set(col, n);
+        continue;
+      }
       const val = boolCols.includes(col) ? !!raw : (raw === '' ? null : raw);
       set(col, val);
     }

src/pages/api/admin/stats.ts

@@ -4,7 +4,7 @@ import { query, one } from '../../../lib/db';
 export const prerender = false;
 
 export const GET: APIRoute = async () => {
-  const total = await one<{ n: string }>(`SELECT count(*)::text n FROM items WHERE status='done'`);
+  const total = await one<{ n: string }>(`SELECT count(*)::text n FROM items WHERE status='done' AND deleted_at IS NULL`);
   const failed = await one<{ n: string }>(`SELECT count(*)::text n FROM items WHERE status='failed'`);
   const cost = async (days: number | null) => (await one<{ c: string }>(
     `SELECT COALESCE(sum(cost),0)::text c FROM items WHERE cost IS NOT NULL` +

src/pages/api/folders/index.ts

@@ -7,7 +7,7 @@ const json = (b: unknown, s = 200) =>
 
 export const GET: APIRoute = async ({ locals }) => {
   if (!locals.user) return new Response('Unauthorized', { status: 401 });
-  const rows = await query(`SELECT f.*, (SELECT count(*) FROM items WHERE folder_id=f.id)::int AS count
+  const rows = await query(`SELECT f.*, (SELECT count(*) FROM items WHERE folder_id=f.id AND deleted_at IS NULL)::int AS count
                             FROM folders f ORDER BY f.name`);
   return json({ folders: rows });
 };

src/pages/api/items/[id].ts

@@ -1,6 +1,7 @@
 import type { APIRoute } from 'astro';
-import { one, query } from '../../../lib/db';
+import { one } from '../../../lib/db';
-import { deleteObject } from '../../../lib/storage';
+import { loadItemFor } from '../../../lib/itemaccess';
+import { trashItems, purgeItems } from '../../../lib/trash';
 
 export const prerender = false;
 const json = (b: unknown, s = 200) =>
@@ -8,7 +9,8 @@ const json = (b: unknown, s = 200) =>
 
 export const PATCH: APIRoute = async ({ params, request, locals }) => {
   if (!locals.user) return new Response('Unauthorized', { status: 401 });
-  const b = await request.json();
+  if (!(await loadItemFor(locals.user, params.id!, 'write'))) return json({ error: 'Not found.' }, 404);
+  const b = await request.json().catch(() => ({} as any));
   const sets: string[] = []; const args: any[] = [];
   if (typeof b.filename === 'string') { args.push(b.filename.trim()); sets.push(`filename=$${args.length}`); }
   if ('folder_id' in b) { args.push(b.folder_id || null); sets.push(`folder_id=$${args.length}`); }
@@ -22,10 +24,20 @@ export const PATCH: APIRoute = async ({ params, request, locals }) => {
   return json({ item: row });
 };
 
-export const DELETE: APIRoute = async ({ params, locals }) => {
+/**
+ * Moves the image into the trash. `?purge=1` removes an image that is already in
+ * the trash for good. With the trash switched off (trash_days = 0) a delete is
+ * final straight away, as it used to be.
+ */
+export const DELETE: APIRoute = async ({ params, url, locals }) => {
   if (!locals.user) return new Response('Unauthorized', { status: 401 });
-  const it = await one<{ result_path: string | null }>('SELECT result_path FROM items WHERE id=$1', [params.id]);
+  const purge = url.searchParams.get('purge') === '1';
-  if (it?.result_path) await deleteObject(it.result_path).catch(() => {});
+  const it = await loadItemFor(locals.user, params.id!, 'write', { includeTrashed: purge });
-  await query('DELETE FROM items WHERE id=$1', [params.id]);
+  if (!it) return json({ error: 'Not found.' }, 404);
-  return json({ ok: true });
+  if (purge) {
+    const gone = await purgeItems(locals.user, [it.id]);
+    return json({ ok: gone.length === 1, purged: gone.length });
+  }
+  const moved = await trashItems(locals.user, [it.id]);
+  return json({ ok: moved.length === 1, trashed: moved.length });
 };

src/pages/api/items/[id]/alternative.ts

@@ -2,6 +2,7 @@ import type { APIRoute } from 'astro';
 import { one, query } from '../../../../lib/db';
 import { enqueue } from '../../../../lib/queue';
 import { has, moduleOff } from '../../../../lib/modules';
+import { loadItemFor } from '../../../../lib/itemaccess';
 
 export const prerender = false;
 const json = (b: unknown, s = 200) =>
@@ -11,6 +12,7 @@ const json = (b: unknown, s = 200) =>
 export const POST: APIRoute = async ({ params, locals }) => {
   if (!has('ai')) return moduleOff('ai');
   if (!locals.user) return new Response('Unauthorized', { status: 401 });
+  if (!(await loadItemFor(locals.user, params.id!, 'write'))) return json({ error: 'Not found.' }, 404);
   const item = await one<any>(
     `SELECT id, job_id, source_path, source_paths, filename, variant_of FROM items WHERE id=$1`, [params.id]);
   if (!item) return json({ error: 'Not found.' }, 404);

src/pages/api/items/[id]/retry.ts

@@ -2,6 +2,7 @@ import type { APIRoute } from 'astro';
 import { one, query } from '../../../../lib/db';
 import { enqueue } from '../../../../lib/queue';
 import { has, moduleOff } from '../../../../lib/modules';
+import { loadItemFor } from '../../../../lib/itemaccess';
 
 export const prerender = false;
 const json = (b: unknown, s = 200) =>
@@ -10,6 +11,7 @@ const json = (b: unknown, s = 200) =>
 export const POST: APIRoute = async ({ params, locals }) => {
   if (!has('ai')) return moduleOff('ai');
   if (!locals.user) return new Response('Unauthorized', { status: 401 });
+  if (!(await loadItemFor(locals.user, params.id!, 'write'))) return json({ error: 'Not found.' }, 404);
   const item = await one<{ id: string; job_id: string }>(
     'SELECT id, job_id FROM items WHERE id=$1', [params.id]);
   if (!item) return json({ error: 'Not found.' }, 404);

src/pages/api/items/[id]/reuse.ts

@@ -2,6 +2,7 @@ import type { APIRoute } from 'astro';
 import { randomUUID } from 'node:crypto';
 import { one } from '../../../../lib/db';
 import { getObject, putObject, sourceKey } from '../../../../lib/storage';
+import { loadItemFor } from '../../../../lib/itemaccess';
 
 export const prerender = false;
 const json = (b: unknown, s = 200) =>
@@ -11,6 +12,7 @@ const json = (b: unknown, s = 200) =>
  *  the studio as a starting point. */
 export const POST: APIRoute = async ({ params, locals }) => {
   if (!locals.user) return new Response('Unauthorized', { status: 401 });
+  if (!(await loadItemFor(locals.user, params.id!, 'read'))) return json({ error: 'There is no result.' }, 404);
   const it = await one<{ result_path: string | null; filename: string | null }>(
     'SELECT result_path, filename FROM items WHERE id=$1', [params.id]);
   if (!it?.result_path) return json({ error: 'There is no result.' }, 404);

src/pages/api/items/index.ts

@@ -13,7 +13,7 @@ export const GET: APIRoute = async ({ url, locals }) => {
   const isAdmin = locals.user.role === 'admin';
   const shared = s?.library_visibility === 'shared';
   // Private jobs never show up in the library; visibility follows the setting.
-  const where: string[] = [`i.status='done'`, `j.private=false`];
+  const where: string[] = [`i.status='done'`, `j.private=false`, `i.deleted_at IS NULL`];
   const args: any[] = [];
   const add = (cond: string, val: any) => { args.push(val); where.push(cond.replace('?', `$${args.length}`)); };
   if (!isAdmin && !shared) add('j.created_by = ?', locals.user.uid);

src/pages/api/items/zip.ts

@@ -1,6 +1,6 @@
 import type { APIRoute } from 'astro';
 import { buildSelectionZipName } from '../../../lib/naming';
-import archiver from 'archiver';
+import { ZipArchive } from 'archiver';
 import { query } from '../../../lib/db';
 import { getObject } from '../../../lib/storage';
 
@@ -13,11 +13,17 @@ export const POST: APIRoute = async ({ request, locals }) => {
   const ids: string[] = b.itemIds || [];
   if (!ids.length) return new Response('Nothing selected.', { status: 400 });
 
+  // Only images this account may see, and none from the trash. Before, any id
+  // from any account went into the archive.
   const rows = await query<{ id: string; result_path: string | null; filename: string | null }>(
-    `SELECT id, result_path, filename FROM items WHERE id = ANY($1) AND result_path IS NOT NULL`, [ids]);
+    `SELECT i.id, i.result_path, i.filename FROM items i JOIN jobs j ON j.id = i.job_id
+      WHERE i.id = ANY($1::uuid[]) AND i.result_path IS NOT NULL AND i.deleted_at IS NULL
+        AND ($3::boolean OR j.created_by = $2
+             OR (NOT j.private AND (SELECT library_visibility FROM settings WHERE id=1) = 'shared'))`,
+    [ids.filter((x) => /^[0-9a-f-]{36}$/i.test(String(x))), locals.user.uid, locals.user.role === 'admin']);
   if (!rows.length) return new Response('No results.', { status: 404 });
 
-  const archive = archiver('zip', { zlib: { level: 6 } });
+  const archive = new ZipArchive({ zlib: { level: 6 } });
   const seen: Record<string, number> = {};
   for (const r of rows) {
     try {

src/pages/api/jobs/[id]/[action].ts

@@ -31,7 +31,7 @@ export const POST: APIRoute = async ({ params, locals }) => {
       break;
     case 'retry-failed': {
       const items = await query<{ id: string }>(
-        `UPDATE items SET status='queued', error_message=NULL WHERE job_id=$1 AND status='failed' RETURNING id`, [id]);
+        `UPDATE items SET status='queued', error_message=NULL WHERE job_id=$1 AND status='failed' AND deleted_at IS NULL RETURNING id`, [id]);
       await query(`UPDATE jobs SET status='queued', failed_count=0 WHERE id=$1`, [id]);
       for (const it of items) await enqueue({ itemId: it.id, jobId: id });
       break;

src/pages/api/s/[slug]/zip.ts

@@ -1,5 +1,5 @@
 import type { APIRoute } from 'astro';
-import archiver from 'archiver';
+import { ZipArchive } from 'archiver';
 import { Readable } from 'node:stream';
 import { once } from 'node:events';
 import { query } from '../../../../lib/db';
@@ -62,11 +62,11 @@ export const GET: APIRoute = async ({ params, request, clientAddress }) => {
 
   const paths = await query<{ id: string; result_path: string; filename: string | null }>(
     `SELECT id, result_path, filename FROM items
-      WHERE id = ANY($1::uuid[]) AND result_path IS NOT NULL`,
+      WHERE id = ANY($1::uuid[]) AND result_path IS NOT NULL AND deleted_at IS NULL`,
     [images.map((b) => b.id)]);
   const byId = new Map(paths.map((p) => [p.id, p]));
 
-  const archive = archiver('zip', { zlib: { level: 6 } });
+  const archive = new ZipArchive({ zlib: { level: 6 } });
   // Errors must not take the process with them; the stream then breaks off.
   archive.on('error', (e: any) => console.error('[share/zip]', e?.message || e));
   archive.on('warning', (e: any) => console.error('[share/zip] warning:', e?.message || e));

src/pages/api/shares/index.ts

@@ -37,15 +37,15 @@ export const POST: APIRoute = async ({ request, locals }) => {
 
   const isAdmin = locals.user.role === 'admin';
   // One query instead of one per image: with 500 images that was 500 round trips.
-  const found = await query<{ id: string; status: string; result_path: string | null; created_by: string | null; private: boolean; library_visibility: string }>(
+  const found = await query<{ id: string; status: string; result_path: string | null; deleted_at: string | null; created_by: string | null; private: boolean; library_visibility: string }>(
-    `SELECT i.id, i.status, i.result_path, j.created_by, j.private,
+    `SELECT i.id, i.status, i.result_path, i.deleted_at, j.created_by, j.private,
             (SELECT library_visibility FROM settings WHERE id=1) AS library_visibility
        FROM items i JOIN jobs j ON j.id = i.job_id
       WHERE i.id = ANY($1::uuid[])`, [ids]);
   if (found.length !== ids.length) return json({ error: 'One of the images is no longer available.' }, 404);
 
   for (const it of found) {
-    if (!it.result_path || it.status !== 'done') return json({ error: 'One of the images is no longer available.' }, 404);
+    if (!it.result_path || it.status !== 'done' || it.deleted_at) return json({ error: 'One of the images is no longer available.' }, 404);
     // Private jobs are deliberately never shared — the whole point is that they
     // leave no trace.
     if (it.private) return json({ error: 'Images from private sessions cannot be shared.' }, 403);

src/pages/api/trash.ts

@@ -0,0 +1,42 @@
+import type { APIRoute } from 'astro';
+import { query } from '../../lib/db';
+import { has, moduleOff } from '../../lib/modules';
+import { trashItems, restoreItems, purgeItems, emptyTrash, trashDays, daysLeft } from '../../lib/trash';
+
+export const prerender = false;
+const json = (b: unknown, s = 200) =>
+  new Response(JSON.stringify(b), { status: s, headers: { 'Content-Type': 'application/json' } });
+const UUID = /^[0-9a-f-]{36}$/i;
+
+/** What is in the trash — your own images, or all of them for an admin. */
+export const GET: APIRoute = async ({ locals }) => {
+  if (!has('ai')) return moduleOff('ai');
+  if (!locals.user) return new Response('Unauthorized', { status: 401 });
+  const days = await trashDays();
+  const rows = await query<any>(
+    `SELECT i.id, i.filename, i.output_px, i.has_alpha, i.thumb_path, i.deleted_at, i.created_at
+       FROM items i JOIN jobs j ON j.id = i.job_id
+      WHERE i.deleted_at IS NOT NULL AND ($2::boolean OR j.created_by = $1)
+      ORDER BY i.deleted_at DESC LIMIT 400`, [locals.user.uid, locals.user.role === 'admin']);
+  return json({ days, items: rows.map((r) => ({ ...r, days_left: daysLeft(r.deleted_at, days) })) });
+};
+
+/** Body { action: 'trash' | 'restore' | 'purge', ids: [...] } — several at once, one round trip. */
+export const POST: APIRoute = async ({ request, locals }) => {
+  if (!has('ai')) return moduleOff('ai');
+  if (!locals.user) return new Response('Unauthorized', { status: 401 });
+  const b = await request.json().catch(() => ({} as any));
+  const ids: string[] = Array.isArray(b.ids) ? b.ids.filter((x: unknown) => typeof x === 'string' && UUID.test(x)).slice(0, 500) : [];
+  if (!ids.length) return json({ error: 'No images selected.' }, 400);
+  if (b.action === 'trash') return json({ ok: true, ids: await trashItems(locals.user, ids) });
+  if (b.action === 'restore') return json({ ok: true, ids: await restoreItems(locals.user, ids) });
+  if (b.action === 'purge') return json({ ok: true, ids: await purgeItems(locals.user, ids) });
+  return json({ error: 'Unknown action.' }, 400);
+};
+
+/** Empties the trash. */
+export const DELETE: APIRoute = async ({ locals }) => {
+  if (!has('ai')) return moduleOff('ai');
+  if (!locals.user) return new Response('Unauthorized', { status: 401 });
+  return json({ ok: true, purged: await emptyTrash(locals.user) });
+};

src/pages/changelog.astro

@@ -13,6 +13,16 @@ const dict = dictFor(locale);
     </div>
     <p class="lead">{t('What is new in Klarbild. Newest changes at the top.')}</p>
 
+    <section>
+      <div class="ver"><span class="tag">{t('10 Oct 2026')}</span><h2>{t('1.1 — a trash, a sample photo, and an image you do not have to build')}</h2></div>
+      <ul>
+        <li set:html={t('<b>Deleting is no longer final on the spot.</b> ✕ moves an image into the trash, and for a few seconds the bottom of the screen offers <b>Undo</b>. Noticed later? The library shows a <b>Trash</b> button; everything in there can be restored for 30 days, then Klarbild clears it away by itself.')} />
+        <li set:html={t('While an image is in the trash it is gone from <b>share links</b> too — and comes back there when you restore it. An image deleted while it is still waiting in the queue is not generated at all, so it costs nothing.')} />
+        <li set:html={t('<b>Try it with a sample photo.</b> An instance with only the print studio used to offer “Pick from the library” — without having a library. Now that place holds a sample photo, so a first visit ends in a printed sheet.')} />
+        <li set:html={t('<b>Its own icon</b> in the browser tab and on the iPhone home screen.')} />
+      </ul>
+    </section>
+
     <section>
       <div class="ver"><span class="tag">{t('1 Sep 2026')}</span><h2>{t('Print: images from the library, and what you printed last')}</h2></div>
       <ul>

src/pages/help.astro

@@ -46,6 +46,7 @@ const dict = dictFor(locale);
         <li set:html={t('<b>Before/after</b>: shows the comparison source ↔ result (not available for images made from text alone).')} />
         <li set:html={t('<b>Manage folders</b>: tap the folder chip, then ✎ to rename it (including its folder on the target) or ✕ to delete it (the images are kept).')} />
         <li set:html={t('<b>Several at once</b>: select images, then <b>download them as a ZIP</b> or move them <b>into a folder</b> together.')} />
+        <li set:html={t('<b>Deleting</b> (✕) moves an image into the <b>trash</b>, with <b>Undo</b> right after. The trash (a button top right, once something is in it) keeps it for 30 days — and while it is there it appears in no share link and no delivery.')} />
       </ul>
       <p class="notice" set:html={t("<b>File names are unique.</b> Every result is called <code>YYYY-MM-DD_HHMMSS_subject_format_shortid</code>, for example <code>2026-08-20_143207_ada-badge_the-frame_a3f9.jpg</code>. Because date and time come first, every file listing — the delivery target, the backup mirror, the file manager — sorts chronologically by itself. The short id at the end comes from the image's id: <b>two images can no longer overwrite each other on delivery</b>, even if you generate the same subject in the same format twice on one day. (Before 21 Aug 2026 that was different — the first image was lost in such a case. Under <b>Admin → File names</b> the existing library can be renamed after the fact.)")} />
     </section>

src/pages/llms.txt.ts

@@ -68,6 +68,10 @@ world such a module does not exist.
 - GET  /api/jobs — the most recent jobs. GET /api/jobs/:id — job plus items (incl. error_message, finished_at).
 - POST /api/jobs/:id/{pause|resume|cancel|retry-failed|delete}.
 - POST /api/items/:id/{retry|reuse|alternative}.
+- DELETE /api/items/:id — moves the image into the trash (restorable for settings.trash_days, default 30).
+  ?purge=1 removes an image that is already in the trash for good.
+- GET  /api/trash — the trash, with days_left per image. POST /api/trash { action: trash|restore|purge, ids[] }.
+  DELETE /api/trash — empty it. Only your own images (admins: all).
 - GET  /api/items/:id/file — the result image. Query: ?thumb=1 (preview), ?preview=1 (small JPG for full screen),
   ?download=1 (as a file), ?src=1 (the source). The content type is taken from the magic bytes (PNG/JPG/WEBP).
 

src/pages/print.astro

@@ -12,7 +12,7 @@ const dict = dictFor(locale);
   <p class="page-lead">
     {t('No AI: bring images to exact sizes and place several of them at 100% size with crop marks on one sheet — from the biometric passport photo through the school photo set to the 30 × 40 poster.')}
   </p>
-  <PrintApp client:load locale={locale} dict={dict} canDeliver={has('delivery') || has('mirror')} />
+  <PrintApp client:load locale={locale} dict={dict} canDeliver={has('delivery') || has('mirror')} hasLibrary={has('ai')} />
   <style>
     .page-title{font-family:var(--font-display);font-size:1.6rem;margin:6px 0 4px;letter-spacing:-.02em;}
     .page-lead{color:var(--soft);font-size:13.5px;margin:0 0 16px;max-width:64ch;line-height:1.55;}

src/types/archiver.d.ts

@@ -1,35 +0,0 @@
-/**
- * Minimal typings for `archiver`.
- *
- * The published `@types/archiver` describes an API this version does not have:
- * it exports classes (`ZipArchive`, …) but no callable default, while the
- * runtime is exactly the other way round — `archiver('zip', opts)` works and
- * the classes do not exist. Rather than pin a mismatched types package, this
- * declares the two things Klarbild actually uses.
- */
-declare module 'archiver' {
-  import { Transform } from 'node:stream';
-
-  interface ArchiverOptions {
-    zlib?: { level?: number };
-    store?: boolean;
-  }
-
-  interface EntryData {
-    name: string;
-    date?: Date | string;
-  }
-
-  interface Archiver extends Transform {
-    append(source: Buffer | NodeJS.ReadableStream | string, data: EntryData): this;
-    finalize(): Promise<void>;
-    abort(): this;
-    pointer(): number;
-    on(event: 'error' | 'warning', listener: (err: Error & { code?: string }) => void): this;
-    on(event: 'entry', listener: (entry: EntryData) => void): this;
-    on(event: string, listener: (...args: any[]) => void): this;
-  }
-
-  function archiver(format: 'zip' | 'tar', options?: ArchiverOptions): Archiver;
-  export default archiver;
-}

tests/config.test.ts

@@ -0,0 +1,27 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import config from '../astro.config.mjs';
+
+/**
+ * Astro's config schema ignores keys it does not know — silently, with no
+ * warning. That is how the Content-Security-Policy went missing once: Astro 7
+ * moved `csp` from `experimental` to `security`, a top-level `csp` key kept
+ * type-checking and building, and the deployed site served no policy at all.
+ * Nothing in the build output said so. This test does.
+ */
+test('The CSP lives where Astro 7 reads it', () => {
+  const security = (config as any).security;
+  assert.ok(security, 'astro.config.mjs has no `security` block');
+  assert.ok(security.csp, 'the CSP must sit at `security.csp` — a top-level `csp` is ignored');
+  assert.ok(Array.isArray(security.csp.directives), '`security.csp.directives` must be a list');
+
+  // The directives the middleware does not add itself.
+  for (const d of ["default-src 'self'", "object-src 'none'", "frame-ancestors 'none'", "base-uri 'self'", "form-action 'self'"]) {
+    assert.ok(security.csp.directives.includes(d), `missing directive: ${d}`);
+  }
+});
+
+test('No stray top-level `csp` or `experimental.csp` key', () => {
+  assert.equal((config as any).csp, undefined, 'a top-level `csp` key is ignored by Astro 7');
+  assert.equal((config as any).experimental?.csp, undefined, '`experimental.csp` is gone in Astro 7');
+});

tests/trash.test.ts

@@ -0,0 +1,41 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { objectKeysOf, daysLeft } from '../src/lib/trash.ts';
+import { canRead, canWrite } from '../src/lib/itemaccess.ts';
+
+test('Every stored file of an image is found, each once', () => {
+  assert.deepEqual(
+    objectKeysOf({ source_path: 'sources/a.png', result_path: 'results/a.png', thumb_path: 'thumbs/a.webp',
+      source_paths: ['sources/a.png', 'sources/b.png'] }),
+    ['sources/a.png', 'results/a.png', 'thumbs/a.webp', 'sources/b.png']);
+  assert.deepEqual(objectKeysOf({ source_path: null, result_path: '', thumb_path: undefined, source_paths: null }), []);
+});
+
+test('Days left in the trash count down and never go negative', () => {
+  const now = new Date('2026-10-10T12:00:00Z');
+  assert.equal(daysLeft('2026-10-10T12:00:00Z', 30, now), 30);
+  assert.equal(daysLeft('2026-10-09T12:00:00Z', 30, now), 29);
+  assert.equal(daysLeft('2026-10-09T11:00:00Z', 30, now), 29);   // 28.96 days -> rounded up
+  assert.equal(daysLeft('2026-09-10T12:00:00Z', 30, now), 0);    // exactly due
+  assert.equal(daysLeft('2026-01-01T00:00:00Z', 30, now), 0);    // long overdue
+  assert.equal(daysLeft('2026-10-10T12:00:00Z', 0, now), 0);     // trash switched off
+});
+
+test('Reading: own, admin, or a shared library — never another person\'s private session', () => {
+  const me = { uid: 'u1', role: 'user' }, admin = { uid: 'a', role: 'admin' };
+  const mine = { created_by: 'u1', private: false }, theirs = { created_by: 'u2', private: false };
+  const theirsPrivate = { created_by: 'u2', private: true };
+  assert.equal(canRead(me, mine, false), true);
+  assert.equal(canRead(me, theirs, false), false);
+  assert.equal(canRead(me, theirs, true), true);
+  assert.equal(canRead(me, theirsPrivate, true), false);
+  assert.equal(canRead(admin, theirsPrivate, false), true);
+});
+
+test('Writing: own or admin only — a shared library is for looking, not for deleting', () => {
+  const me = { uid: 'u1', role: 'user' };
+  assert.equal(canWrite(me, { created_by: 'u1' }), true);
+  assert.equal(canWrite(me, { created_by: 'u2' }), false);
+  assert.equal(canWrite({ uid: null, role: 'user' }, { created_by: null }), false);
+  assert.equal(canWrite({ uid: 'x', role: 'admin' }, { created_by: 'u2' }), true);
+});

tsconfig.json

@@ -2,12 +2,6 @@
   "extends": "astro/tsconfigs/strict",
   "compilerOptions": {
     "jsx": "react-jsx",
-    "baseUrl": ".",
-    "paths": {
-      "@/*": [
-        "src/*"
-      ]
-    },
     "esModuleInterop": true,
     "allowSyntheticDefaultImports": true,
     "types": [