Replace batch DTOs with per-mode endpoints, persist ciphertext with file-type checks, and return a hashed delete token for future revocation.
Split item shapes, array caps from config, and password-protected zk item transform.