@gentbajko/slopify 0.1.0

package/dist/edge/http/settings.js

@@ -0,0 +1,90 @@
+import { zValidator } from "@hono/zod-validator";
+import { Hono } from "hono";
+import { z } from "zod";
+import { appearances, providerIds } from "../../slices/settings/model.js";
+import { readSettings, saveSettings } from "../../slices/settings/playback.js";
+import { addVoice, removeVoice, voiceIdMax, voiceNameMax, voices, } from "../../slices/settings/voices.js";
+import { onInvalid, problem, titleOf } from "./problem.js";
+const idParam = z.object({ id: z.string().min(1).max(64) });
+// Shape only. The rules - trimming, emptiness, length, the provider speaking at all -
+// are the slice's, so one set of messages reaches the form (03-conventions).
+const voiceBody = z.object({
+    provider: z.enum(providerIds),
+    name: z.string(),
+    voiceId: z.string(),
+});
+const playbackBody = z.object({
+    silenceGapSeconds: z.number(),
+    appearance: z.enum(appearances),
+});
+// The return type is inferred so Hono keeps the route types the SPA's client is
+// generated from; see stagingRoutes.
+export function settingsRoutes(deps) {
+    const playback = { db: deps.db, log: deps.log };
+    const voiceDeps = { db: deps.db, ids: deps.ids };
+    return new Hono()
+        .get("/", (c) => c.json(readSettings(playback)))
+        .put("/", zValidator("json", playbackBody, onInvalid), (c) => {
+        const result = saveSettings(playback, c.req.valid("json"));
+        if (!result.ok) {
+            return problem(c, {
+                status: 400,
+                title: titleOf(400),
+                detail: "These settings cannot be saved; the listed fields need attention.",
+                extensions: { fields: result.fields },
+            });
+        }
+        return c.json(result.settings);
+    })
+        .get("/voices", (c) => c.json({ voices: voices(voiceDeps) }))
+        .post("/voices", zValidator("json", voiceBody, onInvalid), (c) => {
+        const result = addVoice(voiceDeps, c.req.valid("json"));
+        if (!result.ok) {
+            // `logic/02` §Q18: a voice ID already listed for its provider is a conflict with
+            // a row that exists, which the form shows under the Voice ID input.
+            return result.reason === "duplicate-voice-id"
+                ? problem(c, {
+                    status: 409,
+                    title: titleOf(409),
+                    detail: "This voice ID is already listed for this provider.",
+                })
+                : problem(c, {
+                    status: 400,
+                    title: titleOf(400),
+                    detail: "This voice cannot be added; the listed fields need attention.",
+                    extensions: { fields: [fieldOf(result.reason)] },
+                });
+        }
+        return c.json(result.voice, 201);
+    })
+        .delete("/voices/:id", zValidator("param", idParam, onInvalid), (c) => {
+        if (!removeVoice(voiceDeps, c.req.valid("param").id).ok) {
+            return problem(c, {
+                status: 404,
+                title: titleOf(404),
+                detail: "No voice has that id.",
+            });
+        }
+        return c.body(null, 204);
+    });
+}
+function fieldOf(reason) {
+    switch (reason) {
+        case "blank-name":
+            return { field: "name", message: "A voice name is required." };
+        case "name-too-long":
+            return {
+                field: "name",
+                message: `A voice name is at most ${String(voiceNameMax)} characters.`,
+            };
+        case "blank-voice-id":
+            return { field: "voiceId", message: "A voice ID is required." };
+        case "voice-id-too-long":
+            return {
+                field: "voiceId",
+                message: `A voice ID is at most ${String(voiceIdMax)} characters.`,
+            };
+        case "not-a-tts-provider":
+            return { field: "provider", message: "Pick a text-to-speech provider." };
+    }
+}

package/dist/edge/http/staging.js

@@ -0,0 +1,104 @@
+import { Readable } from "node:stream";
+import { Busboy } from "@fastify/busboy";
+import { zValidator } from "@hono/zod-validator";
+import { Hono } from "hono";
+import { z } from "zod";
+import { uploadableStageKinds } from "../../slices/storage/model.js";
+import { stagedFiles } from "../../slices/storage/repo.js";
+import { discardStagedFile, stageUpload } from "../../slices/storage/staging.js";
+import { onInvalid, problem, titleOf } from "./problem.js";
+const kindParam = z.object({ kind: z.enum(uploadableStageKinds) });
+const idParam = z.object({ id: z.string().min(1).max(64) });
+// The return type is inferred on purpose: annotating it would erase the route types the
+// SPA's client is generated from (02-models §Q27).
+export function stagingRoutes(deps) {
+    const storage = {
+        db: deps.db,
+        paths: deps.paths,
+        ids: deps.ids,
+        clock: deps.clock,
+        log: deps.log,
+        // The slice never reaches for the hub: progress is a function it is handed.
+        emit: (event) => {
+            deps.hub.emitGlobal(event);
+        },
+    };
+    return new Hono()
+        .get("/", (c) => c.json({ files: stagedFiles(deps.db) }))
+        .post("/:kind", zValidator("param", kindParam, onInvalid), async (c) => {
+        const contentType = c.req.header("content-type");
+        if (contentType === undefined || !contentType.startsWith("multipart/form-data")) {
+            return problem(c, {
+                status: 415,
+                title: titleOf(415),
+                detail: "An upload is sent as multipart/form-data with the file in one part.",
+            });
+        }
+        const body = c.req.raw.body;
+        if (body === null) {
+            return problem(c, {
+                status: 400,
+                title: titleOf(400),
+                detail: "The request carried no body.",
+            });
+        }
+        const result = await readUpload(storage, c.req.valid("param").kind, contentType, body);
+        if (result === undefined) {
+            return problem(c, {
+                status: 400,
+                title: titleOf(400),
+                detail: "The request carried no file part.",
+            });
+        }
+        if (!result.ok) {
+            return problem(c, { status: 400, title: titleOf(400), detail: detailOf(result.reason) });
+        }
+        return c.json(result.file, 201);
+    })
+        .delete("/:id", zValidator("param", idParam, onInvalid), (c) => {
+        const result = discardStagedFile(storage, c.req.valid("param").id);
+        if (!result.ok) {
+            return problem(c, {
+                status: 404,
+                title: titleOf(404),
+                detail: "No staged file has that id.",
+            });
+        }
+        return c.body(null, 204);
+    });
+}
+// The bytes go from the socket to the parser to the disk. Nothing collects them: the
+// platform's own formData() materialises a whole part in memory first, which an
+// uncapped audio or video upload cannot afford.
+function readUpload(storage, stageKind, contentType, body) {
+    return new Promise((resolve, reject) => {
+        const parser = new Busboy({
+            headers: { "content-type": contentType },
+            limits: { files: 1, fields: 8 },
+            // The parser hands the name through untouched: silently renaming a file the user
+            // picked would record a name nobody chose, so the slice rejects instead.
+            preservePath: true,
+        });
+        let started = false;
+        parser.on("file", (_field, stream, filename) => {
+            started = true;
+            stageUpload(storage, {
+                stageKind,
+                originalFilename: typeof filename === "string" ? filename : "",
+                content: stream,
+            }).then(resolve, reject);
+        });
+        parser.on("error", reject);
+        parser.on("finish", () => {
+            if (!started) {
+                resolve(undefined);
+            }
+        });
+        Readable.fromWeb(body).pipe(parser);
+    });
+}
+function detailOf(reason) {
+    return reason === "empty-file"
+        ? "The uploaded file is empty."
+        : "The file name may not be empty or contain a path separator.";
+}

package/dist/edge/http/telemetry.js

@@ -0,0 +1,29 @@
+import { Hono } from "hono";
+import { dismissNotice, noticeSeen } from "../../slices/telemetry/machine.js";
+// The return type is inferred so Hono keeps the route types the SPA's client is
+// generated from; see stagingRoutes.
+export function telemetryRoutes(deps) {
+    const telemetry = {
+        db: deps.db,
+        ids: deps.ids,
+        clock: deps.clock,
+        log: deps.log,
+        appVersion: deps.version,
+    };
+    return (new Hono()
+        // What the SPA asks before it shows the first-run notice
+        // (mockup/02-first-run-notice.md). The app version comes with it because the notice
+        // names the version that goes out in every report, and the promise has to be made
+        // with the number it is true of.
+        .get("/notice", (c) => c.json({ seen: noticeSeen(deps.db), appVersion: deps.version }))
+        // "Got it" is the only control on that modal, and pressing it is what creates the
+        // machine id (logic/16 step 1). Idempotent: a second press, a reload or a second tab
+        // finds the machine already there and mints nothing.
+        .post("/notice", (c) => {
+        dismissNotice(telemetry);
+        deps.flushSoon();
+        // The machine id stays on this machine. Nothing needs it here, so nothing sends
+        // it back out of the process that made it.
+        return c.json({ seen: true, appVersion: deps.version });
+    }));
+}

package/dist/edge/http/usage.js

@@ -0,0 +1,19 @@
+import { Hono } from "hono";
+import { allTelemetryEvents, machineOf } from "../../slices/telemetry/repo.js";
+import { usageOf } from "../../slices/telemetry/usage.js";
+// The data behind `uiux/screens/10-usage.md`: the five counters, the "Tokens by stage"
+// table, and the machine id with the app version. logic/16 step 6 computes all of it from
+// the local event log, "independent of delivery", so this route never touches the
+// collector and answers just as well offline.
+// The return type is inferred so Hono keeps the route types the SPA's client is
+// generated from; see stagingRoutes.
+export function usageRoutes(deps) {
+    return new Hono().get("/", (c) => c.json(usageOf({
+        events: allTelemetryEvents(deps.db),
+        // The machine id is shown on this page and goes no further: the server is bound to
+        // loopback and the SPA reading it is this machine's own. Nothing puts it in a
+        // payload - the collector is told it once, in the envelope (logic/16 §Q129).
+        machineId: machineOf(deps.db)?.machineId ?? null,
+        appVersion: deps.version,
+    })));
+}

package/dist/edge/open-browser.js

@@ -0,0 +1,20 @@
+import { spawn } from "node:child_process";
+export function browserCommand(platform, url) {
+    if (platform === "darwin") {
+        return ["open", [url]];
+    }
+    if (platform === "win32") {
+        // `start` is a cmd builtin, and its first quoted argument is the window title.
+        return ["cmd", ["/c", "start", "", url]];
+    }
+    return ["xdg-open", [url]];
+}
+export function openBrowser(url, warn) {
+    const [command, args] = browserCommand(process.platform, url);
+    const child = spawn(command, [...args], { stdio: "ignore", detached: true });
+    // No browser is a nuisance, not a failure: the URL is already on the terminal.
+    child.on("error", (error) => {
+        warn(`Could not open a browser (${error.message}). Open ${url} yourself.`);
+    });
+    child.unref();
+}

package/dist/kernel/clock.js

@@ -0,0 +1,18 @@
+import { setTimeout as delay } from "node:timers/promises";
+export const systemClock = {
+    now: () => new Date(),
+    sleep: async (ms, signal) => {
+        if (signal === undefined) {
+            await delay(ms);
+            return;
+        }
+        try {
+            await delay(ms, undefined, { signal });
+        }
+        catch (error) {
+            // node:timers rejects with its own AbortError; the caller asked to be told why the
+            // wait was cut short, which is what every other abort path in the app carries.
+            throw signal.aborted ? signal.reason : error;
+        }
+    },
+};

package/dist/kernel/config/index.js

@@ -0,0 +1,32 @@
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+const defaultPort = 4242;
+const defaultHost = "127.0.0.1";
+export function configFrom(flags, env) {
+    const port = flags.port ?? env.SLOPIFY_PORT;
+    const host = flags.host ?? env.SLOPIFY_HOST ?? defaultHost;
+    const dataDir = flags["data-dir"] ?? env.SLOPIFY_DATA_DIR ?? join(homedir(), ".slopify");
+    if (host.trim() === "") {
+        throw new Error("host must not be empty");
+    }
+    return {
+        port: port === undefined ? defaultPort : parsePort(port),
+        host,
+        dataDir: resolve(dataDir),
+        open: flags["no-open"] === true ? false : !isTruthy(env.SLOPIFY_NO_OPEN),
+    };
+}
+function parsePort(value) {
+    const port = Number(value.trim());
+    if (!Number.isInteger(port) || port < 1 || port > 65535) {
+        throw new Error(`invalid port ${JSON.stringify(value)}: expected an integer between 1 and 65535`);
+    }
+    return port;
+}
+function isTruthy(value) {
+    if (value === undefined) {
+        return false;
+    }
+    const normalised = value.trim().toLowerCase();
+    return normalised !== "" && normalised !== "0" && normalised !== "false";
+}

package/dist/kernel/db/index.js

@@ -0,0 +1,24 @@
+import { chmodSync, existsSync } from "node:fs";
+import { DatabaseSync } from "node:sqlite";
+// SQLITE_CONSTRAINT_UNIQUE. The extended result code node:sqlite puts on the error it
+// throws when a UNIQUE index rejects a row.
+const uniqueConstraint = 2067;
+export function openDb(file) {
+    const db = new DatabaseSync(file, { enableForeignKeyConstraints: true, timeout: 5000 });
+    db.exec("PRAGMA journal_mode = WAL");
+    // Provider keys live in this file. The data directory is already 0700, but SQLite
+    // creates the database and its WAL sidecars at 0644, which would survive a copy out.
+    if (file !== ":memory:") {
+        for (const path of [file, `${file}-wal`, `${file}-shm`]) {
+            if (existsSync(path)) {
+                chmodSync(path, 0o600);
+            }
+        }
+    }
+    return db;
+}
+// Which uniqueness rule was broken is the caller's to know from the statement it ran;
+// this only says that the schema, not the code, refused the row.
+export function isUniqueConstraint(error) {
+    return error instanceof Error && "errcode" in error && error.errcode === uniqueConstraint;
+}

package/dist/kernel/db/migrate.js

@@ -0,0 +1,59 @@
+import { readdirSync, readFileSync } from "node:fs";
+// Resolved from this module rather than from the working directory, so it holds both
+// under Vitest (src/kernel/db/migrations) and after the build (dist/kernel/db/migrations,
+// filled by packages/app/scripts/copy-migrations.mjs).
+const migrationsDir = new URL("./migrations/", import.meta.url);
+export function migrate(db, clock) {
+    const files = readdirSync(migrationsDir)
+        .filter((file) => file.endsWith(".sql"))
+        .sort();
+    const known = files.map(versionOf);
+    const applied = appliedVersions(db);
+    const newest = Math.max(0, ...applied);
+    const newestKnown = Math.max(0, ...known);
+    if (newest > newestKnown) {
+        throw new Error(`database schema ${newest} is newer than this app knows (${newestKnown})`);
+    }
+    for (const [index, file] of files.entries()) {
+        const version = known[index];
+        if (version === undefined || applied.has(version)) {
+            continue;
+        }
+        db.exec("BEGIN");
+        try {
+            db.exec(readFileSync(new URL(file, migrationsDir), "utf8"));
+            db.prepare("INSERT INTO schema_migrations (version, applied_at) VALUES (?, ?)").run(version, clock.now().toISOString());
+            db.exec("COMMIT");
+        }
+        catch (error) {
+            db.exec("ROLLBACK");
+            throw error;
+        }
+    }
+}
+function versionOf(file) {
+    const version = Number(file.slice(0, 4));
+    if (!Number.isInteger(version) || version < 1) {
+        throw new Error(`migration ${file} does not start with a version number`);
+    }
+    return version;
+}
+// The first migration creates schema_migrations itself, so an absent table means
+// nothing has been applied yet.
+function appliedVersions(db) {
+    const table = db
+        .prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'schema_migrations'")
+        .get();
+    if (table === undefined) {
+        return new Set();
+    }
+    const versions = new Set();
+    for (const row of db.prepare("SELECT version FROM schema_migrations").all()) {
+        const version = row.version;
+        if (typeof version !== "number") {
+            throw new Error(`schema_migrations holds a non-numeric version: ${String(version)}`);
+        }
+        versions.add(version);
+    }
+    return versions;
+}

package/dist/kernel/db/migrations/0001-init.sql

@@ -0,0 +1,17 @@
+CREATE TABLE projects (id TEXT PRIMARY KEY, title TEXT NOT NULL CHECK(length(title) <= 200), format TEXT NOT NULL CHECK(format IN ('16:9','9:16')), config TEXT NOT NULL, created_at TEXT NOT NULL, updated_at TEXT NOT NULL);
+CREATE TABLE stages (id TEXT PRIMARY KEY, project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE, kind TEXT NOT NULL CHECK(kind IN ('research','article','audio','images','thumbnail','video')), source TEXT NOT NULL, state TEXT NOT NULL CHECK(state IN ('pending','running','done','failed','canceled','provided','skipped')), failure_reason TEXT, attempt_count INTEGER NOT NULL DEFAULT 0, progress_current INTEGER, progress_total INTEGER, started_at TEXT, finished_at TEXT, UNIQUE(project_id, kind));
+CREATE TABLE attempts (id TEXT PRIMARY KEY, stage_id TEXT NOT NULL REFERENCES stages(id) ON DELETE CASCADE, piece_id TEXT, n INTEGER NOT NULL, started_at TEXT NOT NULL, ended_at TEXT, outcome TEXT, error_text TEXT);
+CREATE TABLE stage_pieces (id TEXT PRIMARY KEY, stage_id TEXT NOT NULL REFERENCES stages(id) ON DELETE CASCADE, kind TEXT NOT NULL, idx INTEGER NOT NULL, state TEXT NOT NULL, payload TEXT, UNIQUE(stage_id, kind, idx));
+CREATE TABLE outputs (id TEXT PRIMARY KEY, project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE, stage_kind TEXT NOT NULL, role TEXT NOT NULL, path TEXT NOT NULL, original_filename TEXT, bytes INTEGER NOT NULL, duration_ms INTEGER, meta TEXT, created_at TEXT NOT NULL);
+CREATE INDEX outputs_project ON outputs(project_id, stage_kind);
+CREATE TABLE prompts (id TEXT PRIMARY KEY, kind TEXT NOT NULL CHECK(kind IN ('article','image','thumbnail')), name TEXT NOT NULL, body TEXT NOT NULL, slots TEXT NOT NULL, updated_at TEXT NOT NULL);
+CREATE UNIQUE INDEX prompts_name ON prompts(kind, lower(name));
+CREATE TABLE entries (id TEXT PRIMARY KEY, category TEXT NOT NULL CHECK(category IN ('intro','outro')), mode TEXT NOT NULL CHECK(mode IN ('text','llm')), name TEXT NOT NULL, body TEXT NOT NULL, slots TEXT NOT NULL, updated_at TEXT NOT NULL);
+CREATE UNIQUE INDEX entries_name ON entries(category, lower(name));
+CREATE TABLE provider_keys (provider TEXT PRIMARY KEY, key TEXT NOT NULL, updated_at TEXT NOT NULL);
+CREATE TABLE voices (id TEXT PRIMARY KEY, provider TEXT NOT NULL, name TEXT NOT NULL, voice_id TEXT NOT NULL, UNIQUE(provider, voice_id));
+CREATE TABLE settings (key TEXT PRIMARY KEY, value TEXT NOT NULL);
+CREATE TABLE staged_files (id TEXT PRIMARY KEY, stage_kind TEXT NOT NULL, path TEXT NOT NULL, original_filename TEXT NOT NULL, bytes INTEGER NOT NULL, state TEXT NOT NULL, created_at TEXT NOT NULL);
+CREATE TABLE telemetry_events (id TEXT PRIMARY KEY, type TEXT NOT NULL, payload TEXT NOT NULL, created_at TEXT NOT NULL, delivered_at TEXT);
+CREATE TABLE machine (machine_id TEXT PRIMARY KEY, notice_seen_at TEXT, app_version TEXT NOT NULL);
+CREATE TABLE schema_migrations (version INTEGER PRIMARY KEY, applied_at TEXT NOT NULL);

package/dist/kernel/db/tx.js

@@ -0,0 +1,53 @@
+// SQLite starts a transaction for a SAVEPOINT issued outside one and nests it inside one
+// that is already open, so a slice can wrap its own writes without knowing whether its
+// caller wrapped them too. The name is a constant rather than a parameter: SQLite matches
+// RELEASE and ROLLBACK TO against the most recent savepoint of that name, which is
+// exactly the nesting we want, and nothing a caller passes reaches the statement.
+const savepoint = "slopify";
+export function transact(db, run) {
+    db.exec(`SAVEPOINT ${savepoint}`);
+    try {
+        const result = run();
+        // node:sqlite is synchronous, so an async block would release this frame while its
+        // awaited writes were still to come - and they would then land outside any
+        // transaction. The frame is unwound below, which is the only safe answer.
+        if (isThenable(result)) {
+            // Refusing the block orphans the promise it already started. Node treats an
+            // unhandled rejection as fatal, so it would take the process down and bury the
+            // error thrown here, which is the one that names the mistake.
+            void Promise.resolve(result).catch(() => { });
+            throw new Error("transact runs synchronous work only: an awaited write would land after the savepoint is released");
+        }
+        // Inside the try: a RELEASE that fails leaves the frame open with the block's writes
+        // uncommitted, which is a rollback, not a success to return a value from.
+        db.exec(`RELEASE ${savepoint}`);
+        return result;
+    }
+    catch (error) {
+        unwind(db, error);
+        throw error;
+    }
+}
+// An unguarded ROLLBACK TO would leave the frame open on failure, and the enclosing
+// transact - which names the same savepoint - would then aim its own rollback at the
+// leaked frame and commit part of what it meant to undo.
+function unwind(db, error) {
+    try {
+        db.exec(`ROLLBACK TO ${savepoint}`);
+        db.exec(`RELEASE ${savepoint}`);
+    }
+    catch (cleanup) {
+        throw new Error(`the transaction could not be unwound: ${messageOf(cleanup)}`, {
+            cause: error,
+        });
+    }
+}
+function isThenable(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        "then" in value &&
+        typeof value.then === "function");
+}
+function messageOf(error) {
+    return error instanceof Error ? error.message : String(error);
+}

package/dist/kernel/events.js

@@ -0,0 +1 @@
+export {};

package/dist/kernel/ids.js

@@ -0,0 +1,4 @@
+import { ulid } from "ulid";
+export const ulidIds = {
+    next: () => ulid(),
+};

package/dist/kernel/lock.js

@@ -0,0 +1,73 @@
+import { readFileSync, unlinkSync, writeFileSync } from "node:fs";
+export function acquireInstanceLock(lockPath) {
+    const pid = process.pid;
+    if (!claim(lockPath, pid)) {
+        const holder = holderOf(lockPath);
+        if (holder !== undefined && isAlive(holder)) {
+            throw new Error(`another Slopify instance is already running on this data directory (pid ${holder}). ` +
+                `Stop it, or delete ${lockPath} if it is stale.`);
+        }
+        // The recorded process is gone, or the file says nothing usable. Reclaiming it here
+        // is what keeps a crash from bricking the data directory until a file is deleted by hand.
+        discard(lockPath);
+        if (!claim(lockPath, pid)) {
+            throw new Error(`could not take the instance lock at ${lockPath}: another process was faster`);
+        }
+    }
+    return {
+        release: () => {
+            if (holderOf(lockPath) === pid) {
+                discard(lockPath);
+            }
+        },
+    };
+}
+function claim(lockPath, pid) {
+    try {
+        writeFileSync(lockPath, `${pid}\n`, { flag: "wx", mode: 0o600 });
+        return true;
+    }
+    catch (error) {
+        if (errnoOf(error) === "EEXIST") {
+            return false;
+        }
+        throw error;
+    }
+}
+function holderOf(lockPath) {
+    let contents;
+    try {
+        contents = readFileSync(lockPath, "utf8");
+    }
+    catch {
+        return undefined;
+    }
+    const pid = Number(contents.trim());
+    return Number.isInteger(pid) && pid > 0 ? pid : undefined;
+}
+function discard(lockPath) {
+    try {
+        unlinkSync(lockPath);
+    }
+    catch (error) {
+        if (errnoOf(error) !== "ENOENT") {
+            throw error;
+        }
+    }
+}
+function isAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        // EPERM means the process exists and belongs to someone else.
+        return errnoOf(error) === "EPERM";
+    }
+}
+function errnoOf(error) {
+    if (error instanceof Error && "code" in error && typeof error.code === "string") {
+        return error.code;
+    }
+    return undefined;
+}

package/dist/kernel/log.js

@@ -0,0 +1,34 @@
+import { appendFileSync } from "node:fs";
+import { join } from "node:path";
+// ceiling: prefix matching, not a secret scanner. The prefixes cover the providers in
+// `slices/settings/model.ts`; fal.ai's `<uuid>:<hex>` form has no prefix to match on and
+// is the known gap. That is why LogFields is a closed set of three strings: no caller
+// can hand this module an arbitrary payload to serialise.
+const keyLike = /\b(?:sk|rk|pk|hf|gsk|xai|nvapi|r8)[-_][A-Za-z0-9_-]{16,}|\bAIza[A-Za-z0-9_-]{16,}/g;
+const bearerLike = /\bBearer\s+[A-Za-z0-9._~+/=-]{8,}/gi;
+export function openLog(logsDir, clock) {
+    return {
+        write: (level, event, fields) => {
+            const at = clock.now().toISOString();
+            const record = { ts: at, level, event };
+            if (fields?.projectId !== undefined) {
+                record.projectId = fields.projectId;
+            }
+            if (fields?.stage !== undefined) {
+                record.stage = fields.stage;
+            }
+            if (fields?.detail !== undefined) {
+                record.detail = redact(fields.detail);
+            }
+            // ceiling: one open/append/close per line, and rotation by the date in the file
+            // name. A held handle is the upgrade if the runner ever logs per streamed chunk.
+            const file = join(logsDir, `slopify-${at.slice(0, 10)}.log`);
+            appendFileSync(file, `${JSON.stringify(record)}\n`, { mode: 0o600 });
+        },
+    };
+}
+// Exported for the attempt wrapper: a provider's verbatim error is shown on the project
+// page and stored on the attempt, so it goes through the same filter as a log line.
+export function redact(text) {
+    return text.replace(bearerLike, "Bearer [redacted]").replace(keyLike, "[redacted]");
+}

package/dist/kernel/paths.js

@@ -0,0 +1,21 @@
+import { chmodSync, mkdirSync } from "node:fs";
+import { join, resolve } from "node:path";
+export function layout(dataDir) {
+    const root = resolve(dataDir);
+    return {
+        dataDir: root,
+        db: join(root, "slopify.db"),
+        projects: join(root, "projects"),
+        staging: join(root, "staging"),
+        logs: join(root, "logs"),
+        lock: join(root, ".lock"),
+    };
+}
+export function ensureDirs(paths, options) {
+    for (const dir of [paths.dataDir, paths.projects, paths.staging, paths.logs]) {
+        mkdirSync(dir, { recursive: true, mode: options.mode });
+        // mkdir's mode is masked by the umask and ignored for a directory that already
+        // exists; provider keys sit in this tree, so the mode has to be forced.
+        chmodSync(dir, options.mode);
+    }
+}

package/dist/kernel/pipeline.js

@@ -0,0 +1,22 @@
+// The pipeline's vocabulary. It sits in the kernel because the runner, the slices that
+// implement a stage, and the edge that reports one all name the same finite sets, and
+// the runner may not import a slice to learn them (03-conventions Dependency injection).
+// The frame a run is made in, and the aspect an image is asked for: one set, named once
+// (`logic/04`, `logic/09` step 1).
+export const formats = ["16:9", "9:16"];
+export const stageKinds = ["research", "article", "audio", "images", "thumbnail", "video"];
+export const stageStates = [
+    "pending",
+    "running",
+    "done",
+    "failed",
+    "canceled",
+    "provided",
+    "skipped",
+];
+// logic/01 §Q9 names four project states and derives them in order: running if any
+// stage is running, else canceled, else failed, else done when video is done. A project
+// whose stages are all still pending matches none of them, and that window is real
+// between creating the project and the runner starting the first stage, so `pending` is
+// the fallback the derivation returns. Nothing stores it: status is always derived.
+export const projectStates = ["running", "canceled", "failed", "done", "pending"];

package/dist/kernel/ports/image.js

@@ -0,0 +1 @@
+export {};

package/dist/kernel/ports/llm.js

@@ -0,0 +1 @@
+export const messageRoles = ["system", "user", "assistant"];