@gentbajko/slopify 0.1.0

package/dist/slices/settings/keys.js

@@ -0,0 +1,55 @@
+import { providerById } from "./model.js";
+import { deleteKey, hasKey, keyOf, upsertKey } from "./repo.js";
+// `logic/02` step 1 says the field shows the key masked and points at
+// `mockup/03-settings.md`, which draws it with nothing legible in it; the scenario's own
+// invariant is that keys never appear outside a provider call. So the mask is a
+// constant: it carries no character of the key and not even its length. Every response
+// that reports a stored key reports this string and nothing else about the value.
+export const keyMask = "••••••••••••";
+export function keyStatus(deps, provider) {
+    const stored = hasKey(deps.db, provider);
+    return { provider, hasKey: stored, masked: stored ? keyMask : null };
+}
+// `logic/02` step 1: trimmed, stored as given, overwriting any previous one. No format
+// check and no test call (§Q11, §Q17, §Q18).
+export function saveProviderKey(deps, provider, key) {
+    if (providerById(provider).auth === "cli") {
+        return { ok: false, reason: "cli-provider" };
+    }
+    const trimmed = key.trim();
+    if (trimmed === "") {
+        return { ok: false, reason: "blank" };
+    }
+    try {
+        upsertKey(deps.db, provider, trimmed, deps.clock.now().toISOString());
+    }
+    catch (error) {
+        // The only statement in this app whose parameters include a key. node:sqlite names
+        // columns and result codes, never bound values, but the error from this one call is
+        // rewritten anyway so nothing derived from it can reach a log line or a 500 body.
+        throw new Error(`the ${provider} key could not be stored: ${codeOf(error)}`);
+    }
+    return { ok: true };
+}
+export function removeProviderKey(deps, provider) {
+    if (providerById(provider).auth === "cli") {
+        return { ok: false, reason: "cli-provider" };
+    }
+    return deleteKey(deps.db, provider) ? { ok: true } : { ok: false, reason: "absent" };
+}
+// `logic/02` step 7: the key is read at the moment an attempt starts. This reads the row
+// every time and hands back a plain string, so an attempt holds the value it started
+// with and a save or a remove landing mid-run reaches the next attempt only (§Q16).
+export function keyForAttempt(deps, provider) {
+    if (providerById(provider).auth === "cli") {
+        return { ok: false, reason: "cli-provider" };
+    }
+    const key = keyOf(deps.db, provider);
+    return key === undefined ? { ok: false, reason: "key-missing" } : { ok: true, key };
+}
+function codeOf(error) {
+    if (error instanceof Error && "errcode" in error && typeof error.errcode === "number") {
+        return `sqlite error ${String(error.errcode)}`;
+    }
+    return "sqlite error";
+}

package/dist/slices/settings/model.js

@@ -0,0 +1,54 @@
+// The provider catalogue and the settings domain types (02-models, `logic/02`).
+// The three families are the three ports, so the set is named beside them.
+export { providerFamilies } from "../../kernel/ports/model.js";
+// The supported set is `05-dependencies` External services. OpenAI ships two adapters
+// with two ids, one per family: `provider_keys.provider` is the primary key, and a row
+// per family is what lets a user key TTS without keying image generation.
+export const providerIds = [
+    "openrouter",
+    "claude-code",
+    "codex",
+    "elevenlabs",
+    "openai-tts",
+    "cartesia",
+    "fal",
+    "replicate",
+    "openai-image",
+];
+export const providers = [
+    { id: "openrouter", family: "llm", displayName: "OpenRouter", auth: "key" },
+    {
+        id: "claude-code",
+        family: "llm",
+        displayName: "Claude Code CLI",
+        auth: "cli",
+        binary: "claude",
+        versionArgs: ["--version"],
+    },
+    {
+        id: "codex",
+        family: "llm",
+        displayName: "Codex CLI",
+        auth: "cli",
+        binary: "codex",
+        versionArgs: ["--version"],
+    },
+    { id: "elevenlabs", family: "tts", displayName: "ElevenLabs", auth: "key" },
+    { id: "openai-tts", family: "tts", displayName: "OpenAI", auth: "key" },
+    { id: "cartesia", family: "tts", displayName: "Cartesia", auth: "key" },
+    { id: "fal", family: "image", displayName: "fal.ai", auth: "key" },
+    { id: "replicate", family: "image", displayName: "Replicate", auth: "key" },
+    { id: "openai-image", family: "image", displayName: "OpenAI", auth: "key" },
+];
+export function providerById(id) {
+    const found = providers.find((provider) => provider.id === id);
+    if (found === undefined) {
+        // Unreachable while ProviderId is derived from the catalogue; a new id added to one
+        // and not the other is a bug, not a user error.
+        throw new Error(`the provider catalogue has no entry for ${id}`);
+    }
+    return found;
+}
+// uiux §Q19: the theme override the Appearance control writes.
+export const appearances = ["system", "light", "dark"];
+export const defaultSettings = { silenceGapSeconds: 3, appearance: "system" };

package/dist/slices/settings/playback.js

@@ -0,0 +1,60 @@
+import { z } from "zod";
+import { silenceGapSecondsMax } from "../admission/rules.js";
+import { appearances, defaultSettings } from "./model.js";
+import { readSetting, writeSetting } from "./repo.js";
+// The `settings` table is key/value, so each setting is its own row and a value the app
+// does not understand costs only that one setting.
+const silenceGapKey = "silenceGapSeconds";
+const appearanceKey = "appearance";
+const silenceGapValue = z.number().int().min(0).max(silenceGapSecondsMax);
+const appearanceValue = z.enum(appearances);
+export function readSettings(deps) {
+    return {
+        silenceGapSeconds: parsed(deps, silenceGapKey, silenceGapValue, defaultSettings.silenceGapSeconds),
+        appearance: parsed(deps, appearanceKey, appearanceValue, defaultSettings.appearance),
+    };
+}
+export function saveSettings(deps, settings) {
+    const fields = [];
+    if (!silenceGapValue.safeParse(settings.silenceGapSeconds).success) {
+        fields.push({
+            field: "silenceGapSeconds",
+            message: `The silence gap is a whole number of seconds between 0 and ${String(silenceGapSecondsMax)}.`,
+        });
+    }
+    if (!appearanceValue.safeParse(settings.appearance).success) {
+        fields.push({ field: "appearance", message: "Pick System, Light or Dark." });
+    }
+    if (fields.length > 0) {
+        return { ok: false, fields };
+    }
+    writeSetting(deps.db, silenceGapKey, JSON.stringify(settings.silenceGapSeconds));
+    writeSetting(deps.db, appearanceKey, JSON.stringify(settings.appearance));
+    return { ok: true, settings };
+}
+// A stored value is JSON, and a hand-edited database is the only way it can be anything
+// but what was saved. Such a row falls back to the default and says so in the log rather
+// than reaching the app or taking the settings page down.
+function parsed(deps, key, schema, fallback) {
+    const stored = readSetting(deps.db, key);
+    if (stored === undefined) {
+        return fallback;
+    }
+    const result = schema.safeParse(jsonOf(stored));
+    if (result.success) {
+        return result.data;
+    }
+    deps.log.write("warn", "settings.invalid", {
+        detail: `setting ${key} is not a value this build understands; using the default`,
+    });
+    return fallback;
+}
+function jsonOf(stored) {
+    try {
+        return JSON.parse(stored);
+    }
+    catch {
+        // Not JSON at all: the same answer as JSON of the wrong shape, decided by the caller.
+        return undefined;
+    }
+}

package/dist/slices/settings/readiness.js

@@ -0,0 +1,21 @@
+import { cliReadiness } from "./cli-status.js";
+import { providers } from "./model.js";
+import { keyedProviders } from "./repo.js";
+// `logic/02` step 5 and §Q135: every supported provider is listed, keyed or not, found
+// or not, so Play can grey one out with a reason instead of hiding it. A keyed provider
+// is ready when a key is stored; a CLI provider when its binary answers. Readiness is
+// computed per request and nothing about a CLI is stored.
+export async function providerStatuses(deps) {
+    const keyed = keyedProviders(deps.db);
+    return await Promise.all(providers.map(async (provider) => ({
+        id: provider.id,
+        family: provider.family,
+        displayName: provider.displayName,
+        readiness: provider.auth === "cli"
+            ? await cliReadiness(deps.probe, provider)
+            : keyedReadiness(keyed, provider.id),
+    })));
+}
+function keyedReadiness(keyed, id) {
+    return { kind: "keyed", hasKey: keyed.has(id) };
+}

package/dist/slices/settings/repo.js

@@ -0,0 +1,59 @@
+import { z } from "zod";
+import { providerIds } from "./model.js";
+const keyRow = z.object({ key: z.string() });
+const providerRow = z.object({ provider: z.enum(providerIds) });
+// A row naming a provider this build does not know can only come from a hand-edited
+// database or a downgrade. Parsing throws rather than hiding a voice the user saved.
+const voiceRow = z.object({
+    id: z.string(),
+    provider: z.enum(providerIds),
+    name: z.string(),
+    voice_id: z.string(),
+});
+const settingRow = z.object({ value: z.string() });
+export function upsertKey(db, provider, key, updatedAt) {
+    db.prepare("INSERT INTO provider_keys (provider, key, updated_at) VALUES (?, ?, ?)" +
+        " ON CONFLICT(provider) DO UPDATE SET key = excluded.key, updated_at = excluded.updated_at").run(provider, key, updatedAt);
+}
+export function deleteKey(db, provider) {
+    const result = db.prepare("DELETE FROM provider_keys WHERE provider = ?").run(provider);
+    return Number(result.changes) > 0;
+}
+// The one place a key value leaves the database. Every caller reads it for a single
+// provider call and holds it no longer (`logic/02` §Q16). Nothing under `edge/` calls
+// this: a route asks the two functions below, which never select the `key` column.
+export function keyOf(db, provider) {
+    const row = db.prepare("SELECT key FROM provider_keys WHERE provider = ?").get(provider);
+    return row === undefined ? undefined : keyRow.parse(row).key;
+}
+// Presence without values: what readiness needs, in one statement.
+export function keyedProviders(db) {
+    const rows = db.prepare("SELECT provider FROM provider_keys").all();
+    return new Set(rows.map((row) => providerRow.parse(row).provider));
+}
+export function hasKey(db, provider) {
+    return db.prepare("SELECT 1 FROM provider_keys WHERE provider = ?").get(provider) !== undefined;
+}
+export function insertVoice(db, voice) {
+    db.prepare("INSERT INTO voices (id, provider, name, voice_id) VALUES (?, ?, ?, ?)").run(voice.id, voice.provider, voice.name, voice.voiceId);
+}
+export function listVoices(db) {
+    return db
+        .prepare("SELECT id, provider, name, voice_id FROM voices ORDER BY provider, name, voice_id")
+        .all()
+        .map((row) => toVoice(voiceRow.parse(row)));
+}
+export function deleteVoice(db, id) {
+    return Number(db.prepare("DELETE FROM voices WHERE id = ?").run(id).changes) > 0;
+}
+export function readSetting(db, key) {
+    const row = db.prepare("SELECT value FROM settings WHERE key = ?").get(key);
+    return row === undefined ? undefined : settingRow.parse(row).value;
+}
+export function writeSetting(db, key, value) {
+    db.prepare("INSERT INTO settings (key, value) VALUES (?, ?)" +
+        " ON CONFLICT(key) DO UPDATE SET value = excluded.value").run(key, value);
+}
+function toVoice(row) {
+    return { id: row.id, provider: row.provider, name: row.name, voiceId: row.voice_id };
+}

package/dist/slices/settings/voices.js

@@ -0,0 +1,48 @@
+import { isUniqueConstraint } from "../../kernel/db/index.js";
+import { providerById } from "./model.js";
+import { deleteVoice, insertVoice, listVoices } from "./repo.js";
+export const voiceNameMax = 200;
+export const voiceIdMax = 200;
+// `logic/02` step 3: a non-empty name and a non-empty voice ID, the ID unique within its
+// provider, names free to repeat. Nothing is verified against the provider - a wrong ID
+// is discovered when the audio stage uses it (§Q14), which is why a key is not required
+// here either.
+export function addVoice(deps, draft) {
+    if (providerById(draft.provider).family !== "tts") {
+        return { ok: false, reason: "not-a-tts-provider" };
+    }
+    const name = draft.name.trim();
+    const voiceId = draft.voiceId.trim();
+    if (name === "") {
+        return { ok: false, reason: "blank-name" };
+    }
+    if (name.length > voiceNameMax) {
+        return { ok: false, reason: "name-too-long" };
+    }
+    if (voiceId === "") {
+        return { ok: false, reason: "blank-voice-id" };
+    }
+    if (voiceId.length > voiceIdMax) {
+        return { ok: false, reason: "voice-id-too-long" };
+    }
+    const voice = { id: deps.ids.next(), provider: draft.provider, name, voiceId };
+    try {
+        insertVoice(deps.db, voice);
+    }
+    catch (error) {
+        // UNIQUE(provider, voice_id) is the rule, so the schema is what enforces it: a
+        // read-then-write check would answer from a row that a second writer could delete
+        // between the two statements. The raw SQLite error never leaves this function.
+        if (isUniqueConstraint(error)) {
+            return { ok: false, reason: "duplicate-voice-id" };
+        }
+        throw error;
+    }
+    return { ok: true, voice };
+}
+export function removeVoice(deps, id) {
+    return deleteVoice(deps.db, id) ? { ok: true } : { ok: false };
+}
+export function voices(deps) {
+    return listVoices(deps.db);
+}

package/dist/slices/storage/asset-name.js

@@ -0,0 +1,16 @@
+// The asset name in `/files/:projectId/:asset`. It sits apart from `downloads.ts` because
+// the project page builds the same URL for every image, player and download link it
+// draws, and `downloads.ts` reads the disk: importing it into the SPA would drag
+// `node:fs` and the zip encoder into the browser bundle. Nothing here touches IO.
+// An output's role is its asset name; images add their place in the slideshow, and the
+// instructions add their stage, those being the two roles a project holds more than one of
+// (logic/06 step 4 and logic/07 step 4 both store what the stage sent).
+export function assetOf(output) {
+    const asset = output.role.replaceAll("_", "-");
+    if (output.role === "instructions") {
+        return `${output.stageKind}-${asset}`;
+    }
+    return output.role === "image" && output.meta.index !== undefined
+        ? `${asset}-${String(output.meta.index)}`
+        : asset;
+}

package/dist/slices/storage/delete-project.js

@@ -0,0 +1,35 @@
+import { rmSync } from "node:fs";
+import { derive } from "../../kernel/runner/graph.js";
+import { projectExists, stagesOf } from "../admission/repo.js";
+import { projectDir } from "./layout.js";
+export function deleteProject(deps, projectId) {
+    if (!projectExists(deps.db, projectId)) {
+        return { ok: false, reason: "no-project" };
+    }
+    if (derive(stagesOf(deps.db, projectId)) === "running") {
+        return { ok: false, reason: "running" };
+    }
+    // Files first, rows second. A folder that would not go leaves the project listed, which
+    // is what `logic/14`'s unhappy path asks for; rows removed first would leave the files
+    // orphaned under a project nothing names.
+    const dir = projectDir(deps.paths, projectId);
+    try {
+        rmSync(dir, { recursive: true, force: true });
+    }
+    catch (error) {
+        deps.log.write("warn", "project.delete", {
+            projectId,
+            detail: messageOf(error),
+        });
+        return { ok: false, reason: "files", detail: messageOf(error) };
+    }
+    // Stages, attempts, pieces and outputs go with it: every one of those tables declares
+    // ON DELETE CASCADE on the project, and the connection runs with foreign keys on
+    // (kernel/db/index.ts). The invariant of `logic/14` is that a deleted project leaves no
+    // files and no rows.
+    deps.db.prepare("DELETE FROM projects WHERE id = ?").run(projectId);
+    return { ok: true };
+}
+function messageOf(error) {
+    return error instanceof Error ? error.message : String(error);
+}

package/dist/slices/storage/downloads.js

@@ -0,0 +1,100 @@
+import { readFileSync, statSync } from "node:fs";
+import { extname } from "node:path";
+import { zipSync } from "fflate";
+import { assetOf } from "./asset-name.js";
+import { outputPath } from "./layout.js";
+import { outputsOf, projectTitle } from "./repo.js";
+const contentTypes = {
+    ".md": "text/markdown; charset=utf-8",
+    ".txt": "text/plain; charset=utf-8",
+    ".json": "application/json",
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".webp": "image/webp",
+    ".mp3": "audio/mpeg",
+    ".m4a": "audio/mp4",
+    ".wav": "audio/wav",
+    ".flac": "audio/flac",
+    ".ogg": "audio/ogg",
+    ".opus": "audio/opus",
+    ".mp4": "video/mp4",
+};
+// Leaves room for "-<asset>.<ext>" inside a 255-byte filename, and keeps a download
+// folder readable when a title runs to the 200 characters the schema allows.
+const slugLimit = 60;
+export function slugOf(title) {
+    const slug = title
+        .normalize("NFKD")
+        .replace(/[\u0300-\u036f]/g, "")
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "-")
+        .slice(0, slugLimit)
+        .replace(/^-+|-+$/g, "");
+    return slug === "" ? "project" : slug;
+}
+// `assetOf` moved to asset-name.ts so the SPA can build the same URLs; it is still part
+// of this module's surface, because a download name is built from it.
+export { assetOf };
+// logic/14 §Q116: "single files as `<title-slug>-<asset>.<ext>`".
+export function downloadName(slug, output) {
+    return `${slug}-${assetOf(output)}${extname(output.path)}`;
+}
+export function findDownload(deps, projectId, asset) {
+    const title = projectTitle(deps.db, projectId);
+    if (title === undefined) {
+        return { ok: false, reason: "unknown-project" };
+    }
+    const output = outputsOf(deps.db, projectId).find((candidate) => assetOf(candidate) === asset);
+    if (output === undefined) {
+        return { ok: false, reason: "unknown-asset" };
+    }
+    const path = outputPath(deps.paths, projectId, output.path);
+    const stats = sizeOf(path);
+    if (stats === undefined) {
+        return { ok: false, reason: "missing-file" };
+    }
+    return {
+        ok: true,
+        download: {
+            path,
+            filename: downloadName(slugOf(title), output),
+            bytes: stats,
+            contentType: contentTypes[extname(output.path).toLowerCase()] ?? "application/octet-stream",
+        },
+    };
+}
+// logic/14 §Q116: "download all" images as `<title-slug>-images.zip`, thumbnail included.
+export function imagesZip(deps, projectId) {
+    const title = projectTitle(deps.db, projectId);
+    if (title === undefined) {
+        return { ok: false, reason: "unknown-project" };
+    }
+    const slug = slugOf(title);
+    const entries = {};
+    for (const output of outputsOf(deps.db, projectId)) {
+        if (output.role !== "image" && output.role !== "thumbnail") {
+            continue;
+        }
+        const path = outputPath(deps.paths, projectId, output.path);
+        if (sizeOf(path) === undefined) {
+            // A missing file is the project page's problem per logic/14; the rest still zips.
+            continue;
+        }
+        // Images are already compressed formats, so deflating them costs time and saves
+        // nothing. ceiling: 60 images (logic/05 §Q39) are read into memory at once; a set
+        // large enough to hurt would move to fflate's streaming Zip.
+        entries[`${slug}-${assetOf(output)}${extname(output.path)}`] = [
+            readFileSync(path),
+            { level: 0 },
+        ];
+    }
+    if (Object.keys(entries).length === 0) {
+        return { ok: false, reason: "no-images" };
+    }
+    return { ok: true, filename: `${slug}-images.zip`, bytes: zipSync(entries) };
+}
+function sizeOf(path) {
+    const stats = statSync(path, { throwIfNoEntry: false });
+    return stats === undefined || !stats.isFile() ? undefined : stats.size;
+}

package/dist/slices/storage/layout.js

@@ -0,0 +1,59 @@
+import { extname, isAbsolute, relative, resolve } from "node:path";
+export function projectDir(paths, projectId) {
+    return contained(paths.projects, projectId);
+}
+export function outputPath(paths, projectId, relativePath) {
+    return contained(projectDir(paths, projectId), relativePath);
+}
+export function stagingPath(paths, stagedFileId) {
+    return contained(paths.staging, stagedFileId);
+}
+// Every asset of a project lives under its own folder (logic/14 §Q115); an id or a
+// stored path that resolves anywhere else is a bug in whatever produced it.
+function contained(root, path) {
+    const target = resolve(root, path);
+    const inside = relative(root, target);
+    if (inside === "" || inside.startsWith("..") || isAbsolute(inside)) {
+        throw new Error(`${path} resolves outside ${root}`);
+    }
+    return target;
+}
+// logic/14 step 2 fixes the names inside a project folder, so a provided file is
+// stored under the name its role dictates and keeps only its extension. The stage is part
+// of the name for the one role more than one stage produces: research and the article each
+// store what they sent (logic/06 step 4, logic/07 step 4), and the project page offers
+// them per stage ("Show instructions", uiux/screens/08-project).
+export function outputFileName(role, index, extension, stageKind) {
+    switch (role) {
+        case "notes":
+            return "research.txt";
+        case "article_md":
+            return "article.md";
+        case "article_txt":
+            return "article.txt";
+        case "sources":
+            return "sources.txt";
+        case "glossary":
+            return "glossary.txt";
+        case "render_params":
+            return "render.json";
+        case "instructions":
+            return `instructions-${stageKind}.txt`;
+        case "video":
+            return "video.mp4";
+        case "audio_body":
+            return `audio-body${extension}`;
+        case "audio_intro":
+            return `audio-intro${extension}`;
+        case "audio_outro":
+            return `audio-outro${extension}`;
+        case "thumbnail":
+            return `thumbnail${extension}`;
+        case "image":
+            return `images/${String(index).padStart(3, "0")}${extension}`;
+    }
+}
+export function extensionOf(filename) {
+    const extension = extname(filename).toLowerCase();
+    return /^\.[a-z0-9]{1,8}$/.test(extension) ? extension : "";
+}

package/dist/slices/storage/model.js

@@ -0,0 +1,20 @@
+export { stageKinds } from "../../kernel/pipeline.js";
+// The stages whose content arrives as a file. Research and article take pasted text
+// instead (logic/05 §Q37), and video is always generated (logic/01 step 5).
+export const uploadableStageKinds = ["audio", "images", "thumbnail"];
+export const outputRoles = [
+    "notes",
+    "article_md",
+    "article_txt",
+    "sources",
+    "glossary",
+    "audio_body",
+    "audio_intro",
+    "audio_outro",
+    "image",
+    "thumbnail",
+    "video",
+    "render_params",
+    "instructions",
+];
+export const stagedFileStates = ["copying", "staged"];

package/dist/slices/storage/reconcile.js

@@ -0,0 +1,102 @@
+import { readdirSync, rmSync, unlinkSync } from "node:fs";
+import { join, relative, sep } from "node:path";
+// Files the database does not know about, and staged uploads that never reached a
+// project, are removed at start (logic/05 §Q44, logic/14 step 5).
+export function reconcileStorage(db, paths) {
+    const projects = idsOf(db, "SELECT id FROM projects", "id");
+    const kept = new Set();
+    for (const row of db.prepare("SELECT project_id, path FROM outputs").all()) {
+        const projectId = row.project_id;
+        const path = row.path;
+        if (typeof projectId === "string" && typeof path === "string") {
+            kept.add(`${projectId}/${slashed(path)}`);
+        }
+    }
+    // A stage's unfinished work is on the project too: `logic/08` §Q66 keeps the audio
+    // chunks a previous run finished so a manual retry re-runs only the failed ones, and
+    // `logic/13` step 2 keeps them through a cancel. A chunk is not an output - the
+    // concatenated body is the project's only body audio (§Q65) - so the file it wrote is
+    // named by its `stage_pieces` payload instead, and that is as much of a record as an
+    // outputs row.
+    for (const row of db
+        .prepare("SELECT stages.project_id AS project_id, stage_pieces.payload AS payload FROM stage_pieces JOIN stages ON stages.id = stage_pieces.stage_id WHERE stage_pieces.payload IS NOT NULL")
+        .all()) {
+        const projectId = row.project_id;
+        const file = pieceFile(row.payload);
+        if (typeof projectId === "string" && file !== undefined) {
+            kept.add(`${projectId}/${slashed(file)}`);
+        }
+    }
+    let orphanFiles = 0;
+    for (const entry of readdirSync(paths.projects, { withFileTypes: true })) {
+        const path = join(paths.projects, entry.name);
+        if (!entry.isDirectory()) {
+            unlinkSync(path);
+            orphanFiles += 1;
+            continue;
+        }
+        if (!projects.has(entry.name)) {
+            orphanFiles += filesUnder(path).length;
+            rmSync(path, { recursive: true, force: true });
+            continue;
+        }
+        for (const file of filesUnder(path)) {
+            if (kept.has(`${entry.name}/${slashed(file)}`)) {
+                continue;
+            }
+            unlinkSync(join(path, file));
+            orphanFiles += 1;
+        }
+    }
+    let stagedFiles = 0;
+    for (const file of filesUnder(paths.staging)) {
+        unlinkSync(join(paths.staging, file));
+        stagedFiles += 1;
+    }
+    db.exec("DELETE FROM staged_files");
+    return { orphanFiles, stagedFiles };
+}
+// The one field read inside a payload whose shape belongs to the stage that wrote it: a
+// project-relative path the piece left on disk. A payload without one is any other kind
+// of piece and names no file. Exported because a re-run drops the same pieces the boot
+// sweep keeps, and the two have to agree on which file a piece is holding.
+export function pieceFile(payload) {
+    if (typeof payload !== "string") {
+        return undefined;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(payload);
+    }
+    catch {
+        return undefined;
+    }
+    if (typeof parsed !== "object" || parsed === null || !("file" in parsed)) {
+        return undefined;
+    }
+    const file = parsed.file;
+    return typeof file === "string" && file !== "" ? file : undefined;
+}
+function idsOf(db, sql, column) {
+    const ids = new Set();
+    for (const row of db.prepare(sql).all()) {
+        const id = row[column];
+        if (typeof id === "string") {
+            ids.add(id);
+        }
+    }
+    return ids;
+}
+function filesUnder(root) {
+    const files = [];
+    for (const entry of readdirSync(root, { withFileTypes: true, recursive: true })) {
+        if (entry.isFile()) {
+            files.push(relative(root, join(entry.parentPath, entry.name)));
+        }
+    }
+    return files;
+}
+// outputs.path is stored with forward slashes; the filesystem may hand back backslashes.
+function slashed(path) {
+    return path.split(sep).join("/");
+}