@gentbajko/slopify 2.4.0 → 3.0.0

package/dist/host-cli/open-folder.js

@@ -1,10 +1,10 @@
 import { spawn } from "node:child_process";
 import { lstat, readdir } from "node:fs/promises";
 import { isAbsolute, join, relative, sep } from "node:path";
-import { readState, receiptSchema } from "../edge/docker-projects/state.js";
+import { installSchema, readState } from "../edge/docker-install/state.js";
 import { HostFolderRefused } from "../kernel/ports/host-cli.js";
 import { hasCode } from "./paths.js";
-const again = "run the Docker launcher again (npx @gentbajko/slopify@latest --docker)";
+const again = "run the Docker install again (npx @gentbajko/slopify@latest --docker)";
 /** Starts the desktop's opener and returns once it is running; the file manager is not awaited. */
 export function launchXdgOpen(directory) {
     return new Promise((resolve, reject) => {
@@ -24,7 +24,7 @@ export function launchXdgOpen(directory) {
         });
     });
 }
-/** Only folders inside a launcher receipt's project folder, reached through real folders you own, are opened. */
+/** Only folders inside an installation's recorded project folder, reached through real folders you own, are opened. */
 export function createHostFolderOpener(deps) {
     async function receipts() {
         const found = [];
@@ -42,9 +42,9 @@ export function createHostFolderOpener(deps) {
             if (!entry.isDirectory())
                 continue;
             try {
-                const receipt = await readState(join(deps.root, entry.name, "receipt.json"), receiptSchema, deps.uid);
-                if (receipt)
-                    found.push(receipt);
+                const install = await readState(join(deps.root, entry.name, "install.json"), installSchema, deps.uid);
+                if (install)
+                    found.push(install);
             }
             catch {
                 // An unreadable or damaged receipt grants nothing; the others still count.
@@ -59,13 +59,13 @@ export function createHostFolderOpener(deps) {
             root.uid !== BigInt(deps.uid) ||
             String(root.dev) !== identity.dev ||
             String(root.ino) !== identity.ino)
-            throw new HostFolderRefused(`The Slopify host helper did not open this folder because the project folder ${projects} was moved or replaced since the Docker launcher set it up. Put the original folder back, or ${again}.`);
+            throw new HostFolderRefused(`The Slopify host helper did not open this folder because the project folder ${projects} was moved or replaced since the Docker install set it up. Put the original folder back, or ${again}.`);
         let current = projects;
         for (const part of r === "" ? [] : r.split(sep)) {
             current = join(current, part);
             const s = await lstat(current).catch(() => undefined);
             if (!s?.isDirectory() || s.isSymbolicLink() || s.uid !== deps.uid)
-                throw new HostFolderRefused(`The Slopify host helper did not open ${current} because it is missing, a link or a file, or isn't owned by you. Use Re-run section on the project page to make the file again, or copy the path into your file manager.`);
+                throw new HostFolderRefused(`The Slopify host helper did not open ${current} because it is missing, a link or a file, or isn't owned by you. Use More → make it again in its section on the project page to make the file again, or copy the path into your file manager.`);
         }
     }
     return async (path) => {
@@ -77,7 +77,7 @@ export function createHostFolderOpener(deps) {
             if (r === ".." || r.startsWith(`..${sep}`) || isAbsolute(r))
                 continue;
             try {
-                await verify(receipt.projects, receipt.directoryIdentity, r);
+                await verify(receipt.projects, receipt.projectsIdentity, r);
             }
             catch (error) {
                 if (!(error instanceof HostFolderRefused))
@@ -90,6 +90,6 @@ export function createHostFolderOpener(deps) {
             return;
         }
         throw (refusal ??
-            new HostFolderRefused(`The Slopify host helper did not open ${path} because it isn't inside a project folder set up by the Docker launcher. Copy the path into your file manager, or if you moved your project folder, ${again}.`));
+            new HostFolderRefused(`The Slopify host helper did not open ${path} because it isn't inside a project folder set up by the Docker install. Copy the path into your file manager, or if you moved your project folder, ${again}.`));
     };
 }

package/dist/host-cli/runtime.js

@@ -1,10 +1,11 @@
 import { mkdtemp, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { codexImage } from "../adapters/image/codex.js";
+import { codexImage, codexImageTimeoutMs } from "../adapters/image/codex.js";
 import { claudeCodeLlm } from "../adapters/llm/claude-code.js";
 import { nodeClaudeCodeModels } from "../adapters/llm/claude-code-models.js";
 import { codexLlm } from "../adapters/llm/codex.js";
+import { nodeCodexLimits } from "../adapters/llm/codex-limits.js";
 import { nodeCodexModels } from "../adapters/llm/codex-models.js";
 import { geminiLlm } from "../adapters/llm/gemini.js";
 import { nodeGeminiModels } from "../adapters/llm/gemini-models.js";
@@ -12,6 +13,7 @@ import { providerError } from "../kernel/ports/model.js";
 import { createHostFolderOpener } from "./open-folder.js";
 import { createHostStatus } from "./status.js";
 export function createHostRuntime(deps) {
+    const readCodexLimits = deps.readCodexLimits ?? nodeCodexLimits;
     const status = createHostStatus(deps);
     async function command(id) {
         const ready = await status(id);
@@ -56,6 +58,7 @@ export function createHostRuntime(deps) {
                         binary,
                         env: deps.env,
                         readModels: () => models(id),
+                        ...(id === "codex" ? { readLimits: () => readCodexLimits(binary, deps.env) } : {}),
                     }).complete({
                         ...request,
                         ...(id === "codex" && request.thinking !== undefined
@@ -75,10 +78,16 @@ export function createHostRuntime(deps) {
         }),
         image: {
             id: "codex-image",
-            models: () => codexImage({ run: deps.run }).models(),
+            timeoutMs: codexImageTimeoutMs,
+            models: () => codexImage({ run: deps.run, readModels: () => models("codex") }).models(),
             generate: async (request) => {
                 const binary = await command("codex-image");
-                return codexImage({ run: deps.run, binary, env: deps.env }).generate(request);
+                return codexImage({
+                    run: deps.run,
+                    binary,
+                    env: deps.env,
+                    readLimits: () => readCodexLimits(binary, deps.env),
+                }).generate(request);
             },
         },
     };

package/dist/kernel/db/migrations/0022-drop-duplicate-held-work.sql

@@ -0,0 +1,56 @@
+-- Before 2.4.0 every save made while a step waited for Resume minted a new held row for it,
+-- even when the project already had a row for exactly that step (same key and fingerprint).
+-- Save now reserves the existing one instead (existingWork in
+-- slices/rebuild/transition-repo.ts); this removes the copies left behind by older saves.
+--
+-- A row counts for a step the way Save counts it: a finished row (work and piece done), or a
+-- held row nothing ran for (pending, held, unsent, no planning context, no attempt). Per
+-- project, key and fingerprint, the row Save would pick is kept: a finished one first,
+-- otherwise the newest held one. Only held rows that are not that pick are removed, and only
+-- when they carry one piece and no review checkpoint. A revision that reserved a removed
+-- copy is pointed at the kept held row, which is the same unstarted step. A copy some
+-- revision reserved while a finished row exists is left alone: pointing that revision at
+-- the finished result would change what it shows. Finished, running, failed and admitted
+-- work, and assets, are never touched.
+CREATE TEMP TABLE m0022_eligible AS
+SELECT w.id AS work_id, p.id AS piece_id, w.project_id, p.work_key, p.fingerprint,
+  w.rowid AS rid, w.state = 'done' AS done
+FROM revision_work w JOIN revision_work_pieces p ON p.work_id = w.id
+WHERE (w.state = 'done' AND p.state = 'done')
+  OR (w.state = 'pending' AND w.dispatch_state = 'held' AND p.state = 'held'
+    AND p.submitted_at IS NULL AND w.recipe_context IS NULL
+    AND NOT EXISTS (SELECT 1 FROM attempts a WHERE a.work_id = w.id));
+
+CREATE TEMP TABLE m0022_kept AS
+SELECT project_id, work_key, fingerprint, work_id, piece_id, done FROM (
+  SELECT e.*, row_number() OVER (
+    PARTITION BY project_id, work_key, fingerprint ORDER BY done DESC, rid DESC
+  ) AS pick
+  FROM m0022_eligible e
+) WHERE pick = 1;
+
+CREATE TEMP TABLE m0022_copies AS
+SELECT e.work_id, k.work_id AS kept_work_id, k.piece_id AS kept_piece_id
+FROM m0022_eligible e
+JOIN m0022_kept k ON k.project_id = e.project_id AND k.work_key = e.work_key
+  AND k.fingerprint = e.fingerprint
+WHERE e.done = 0 AND e.work_id <> k.work_id
+  AND (SELECT count(*) FROM revision_work_pieces q WHERE q.work_id = e.work_id) = 1
+  AND NOT EXISTS (SELECT 1 FROM review_checkpoints c WHERE c.work_id = e.work_id)
+  AND (k.done = 0
+    OR NOT EXISTS (SELECT 1 FROM revision_work_reservations r WHERE r.work_id = e.work_id));
+
+UPDATE revision_work_reservations
+SET piece_id = CASE WHEN piece_id IS NULL THEN NULL ELSE (
+    SELECT c.kept_piece_id FROM m0022_copies c WHERE c.work_id = revision_work_reservations.work_id
+  ) END,
+  work_id = (
+    SELECT c.kept_work_id FROM m0022_copies c WHERE c.work_id = revision_work_reservations.work_id
+  )
+WHERE work_id IN (SELECT work_id FROM m0022_copies);
+
+DELETE FROM revision_work WHERE id IN (SELECT work_id FROM m0022_copies);
+
+DROP TABLE m0022_eligible;
+DROP TABLE m0022_kept;
+DROP TABLE m0022_copies;

package/dist/kernel/db/migrations/0024-reference-attachments.sql

@@ -0,0 +1,18 @@
+-- A Play draft can carry an uploaded establishing image (the Images stage's reference). SQLite
+-- cannot widen a CHECK constraint in place, so the attachments table is rebuilt with the new
+-- kind. Nothing references it, so enforcement stays on.
+CREATE TABLE play_draft_attachments_reference_upgrade (
+ id TEXT PRIMARY KEY,
+ draft_id TEXT NOT NULL REFERENCES play_drafts(id) ON DELETE CASCADE,
+ staged_file_id TEXT REFERENCES staged_files(id) ON DELETE SET NULL,
+ kind TEXT NOT NULL CHECK(kind IN ('audio','images','thumbnail','reference')),
+ original_filename TEXT NOT NULL,
+ status TEXT NOT NULL CHECK(status IN ('pending','ready','reattach')),
+ error TEXT
+);
+INSERT INTO play_draft_attachments_reference_upgrade (id,draft_id,staged_file_id,kind,original_filename,status,error)
+  SELECT id,draft_id,staged_file_id,kind,original_filename,status,error FROM play_draft_attachments ORDER BY rowid;
+DROP TABLE play_draft_attachments;
+ALTER TABLE play_draft_attachments_reference_upgrade RENAME TO play_draft_attachments;
+CREATE INDEX play_draft_attachment_file ON play_draft_attachments(staged_file_id);
+CREATE INDEX play_draft_attachment_owner ON play_draft_attachments(draft_id);

package/dist/kernel/db/migrations/0025-automatic-reviews.sql

@@ -0,0 +1,40 @@
+-- Automatic reviews. Library prompts of the new "review" kind are what a reviewer model is
+-- asked per stage; SQLite cannot change a CHECK in place, so the table is copied into one whose
+-- CHECK lists the new kind, like 0019 did for "shorts".
+CREATE TABLE prompts_review_upgrade (
+  id TEXT PRIMARY KEY,
+  kind TEXT NOT NULL CHECK (kind IN ('article','image','thumbnail','narration','description','shorts','review')),
+  name TEXT NOT NULL,
+  body TEXT NOT NULL,
+  slots TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+INSERT INTO prompts_review_upgrade (id,kind,name,body,slots,updated_at)
+  SELECT id,kind,name,body,slots,updated_at FROM prompts;
+DROP TABLE prompts;
+ALTER TABLE prompts_review_upgrade RENAME TO prompts;
+CREATE UNIQUE INDEX prompts_name ON prompts(kind,lower(name));
+-- Every verdict a reviewer gave, with its reasons, what Slopify did about it (passed, flagged,
+-- or sent back to be made again) and what the person did (overruled it, or had it redone).
+-- One row per review step fingerprint: the same review of the same output is not asked twice.
+CREATE TABLE review_verdicts (
+ id TEXT PRIMARY KEY,
+ project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+ revision_id TEXT NOT NULL,
+ item_key TEXT NOT NULL,
+ stage TEXT NOT NULL CHECK(stage IN ('article','images','narration','thumbnail','shorts')),
+ item_fingerprint TEXT NOT NULL,
+ review_fingerprint TEXT NOT NULL,
+ passed INTEGER NOT NULL CHECK(passed IN (0,1)),
+ reasons TEXT NOT NULL,
+ outcome TEXT NOT NULL CHECK(outcome IN ('passed','flagged','redo')),
+ attempt INTEGER NOT NULL CHECK(attempt >= 1),
+ action TEXT CHECK(action IN ('overruled','redone')),
+ action_at TEXT,
+ redo_state TEXT CHECK(redo_state IN ('pending','started','failed')),
+ redo_error TEXT,
+ created_at TEXT NOT NULL,
+ UNIQUE(project_id,review_fingerprint)
+);
+CREATE INDEX review_verdicts_item ON review_verdicts(project_id,item_key);
+CREATE INDEX review_verdicts_redo ON review_verdicts(redo_state);

package/dist/kernel/db/migrations/0026-schedule-topic-generation.sql

@@ -0,0 +1,23 @@
+-- A schedule can find its own topics: a series brief, a generation mode and how many topics to
+-- keep queued. `topic_llm_json` is NULL for the template's own LLM. The generating/failed
+-- columns are the generation's own bookkeeping and never bump the schedule's version.
+ALTER TABLE schedules ADD COLUMN brief TEXT;
+ALTER TABLE schedules ADD COLUMN topic_mode TEXT NOT NULL DEFAULT 'off' CHECK(topic_mode IN ('off','queue','hold'));
+ALTER TABLE schedules ADD COLUMN topic_min INTEGER NOT NULL DEFAULT 10 CHECK(topic_min BETWEEN 1 AND 100);
+ALTER TABLE schedules ADD COLUMN topic_llm_json TEXT CHECK(topic_llm_json IS NULL OR json_valid(topic_llm_json));
+ALTER TABLE schedules ADD COLUMN topics_generating_at TEXT;
+ALTER TABLE schedules ADD COLUMN topics_generated_at TEXT;
+ALTER TABLE schedules ADD COLUMN topics_failed_at TEXT;
+ALTER TABLE schedules ADD COLUMN topics_error TEXT;
+-- Topics outside the queue: generated ones held for approval, ones the user rejected, and ones
+-- a run used. Rejected and used rows stay so a later generation never suggests them again.
+CREATE TABLE schedule_topics (
+  id TEXT PRIMARY KEY,
+  schedule_id TEXT NOT NULL REFERENCES schedules(id) ON DELETE CASCADE,
+  title TEXT NOT NULL CHECK(length(trim(title)) BETWEEN 1 AND 200),
+  state TEXT NOT NULL CHECK(state IN ('held','rejected','used')),
+  rank INTEGER NOT NULL,
+  created_at TEXT NOT NULL,
+  decided_at TEXT
+);
+CREATE INDEX schedule_topics_schedule ON schedule_topics(schedule_id, state, rank);

package/dist/kernel/db/migrations/0027-run-cost.sql

@@ -0,0 +1,58 @@
+-- What every successful provider call used and cost, for the project's Run cost tab. The price
+-- is worked out when the call lands and stored with the rates it used, so a later catalogue
+-- change never rewrites what a finished run cost. A CLI call costs nothing on the user's plan
+-- (`on_plan`); `api_cost` is what the same tokens would have cost through the API.
+CREATE TABLE provider_usage (
+ id TEXT PRIMARY KEY,
+ project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+ stage TEXT NOT NULL,
+ kind TEXT NOT NULL CHECK(kind IN ('llm','tts','image','video')),
+ provider TEXT NOT NULL,
+ model TEXT NOT NULL,
+ tokens_in INTEGER,
+ tokens_out INTEGER,
+ tokens_cached INTEGER,
+ characters INTEGER,
+ images INTEGER,
+ seconds REAL,
+ size TEXT,
+ quality TEXT,
+ wall_ms INTEGER NOT NULL,
+ on_plan INTEGER NOT NULL DEFAULT 0 CHECK(on_plan IN (0,1)),
+ cost REAL,
+ api_model TEXT,
+ api_cost REAL,
+ price_json TEXT CHECK(price_json IS NULL OR json_valid(price_json)),
+ created_at TEXT NOT NULL
+);
+CREATE INDEX provider_usage_project ON provider_usage(project_id, created_at);
+
+-- The plan windows a CLI reported around a project's calls, in the order they arrived, so the
+-- tab can say how much of the 5-hour and weekly allowance the run took.
+CREATE TABLE plan_limit_readings (
+ id TEXT PRIMARY KEY,
+ project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+ account TEXT NOT NULL,
+ reading_json TEXT NOT NULL CHECK(json_valid(reading_json)),
+ created_at TEXT NOT NULL
+);
+CREATE INDEX plan_limit_readings_project ON plan_limit_readings(project_id, created_at);
+
+-- A CLI whose plan allowance is used up, until when. One row per account: every project's
+-- calls to it wait on the same reset.
+CREATE TABLE plan_limit_waits (
+ account TEXT PRIMARY KEY,
+ resets_at TEXT,
+ retry_at TEXT NOT NULL,
+ detected_at TEXT NOT NULL
+);
+
+-- The stages waiting on an account. They outlive a restart: the boot resumes these projects
+-- instead of leaving the stage interrupted.
+CREATE TABLE plan_limit_waiters (
+ project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+ stage TEXT NOT NULL,
+ account TEXT NOT NULL,
+ since TEXT NOT NULL,
+ PRIMARY KEY(project_id, stage, account)
+);

package/dist/kernel/db/migrations/0030-automatic-retries.sql

@@ -0,0 +1,18 @@
+-- A step that failed on something time can fix (a rate limit, a timeout, a dropped connection
+-- or CLI) waits and runs again by itself. The wait is kept on the row, so a restart keeps it,
+-- and the count is what caps it. `failure_kind` is the provider error's kind, which picks the
+-- fix-it button a failed step shows.
+ALTER TABLE revision_work ADD COLUMN auto_retries INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE revision_work ADD COLUMN retry_at TEXT;
+ALTER TABLE revision_work ADD COLUMN failure_kind TEXT;
+CREATE INDEX revision_work_retry ON revision_work(retry_at) WHERE retry_at IS NOT NULL;
+ALTER TABLE stages ADD COLUMN retry_at TEXT;
+ALTER TABLE stages ADD COLUMN failure_kind TEXT;
+-- Soften and retry: the image step whose prompt a content filter refused rewords it with the
+-- project's AI model before drawing again. One request per step, cleared once it succeeds.
+CREATE TABLE prompt_softening (
+ project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+ work_key TEXT NOT NULL,
+ requested_at TEXT NOT NULL,
+ PRIMARY KEY(project_id, work_key)
+);

package/dist/kernel/db/migrations/0031-prompt-history-and-description-edits.sql

@@ -0,0 +1,33 @@
+-- Every save of a Library prompt or intro/outro keeps a version, so History can show and
+-- restore any of them. One table serves both libraries: `item_kind` says which, `kind` holds the
+-- prompt's kind or the entry's category, and `mode` the entry's mode (NULL for a prompt). No
+-- foreign key: the row it belongs to lives in one of two tables, and the save path deletes the
+-- versions with the prompt or entry.
+CREATE TABLE library_versions (
+  item_kind TEXT NOT NULL CHECK(item_kind IN ('prompt','entry')),
+  item_id TEXT NOT NULL,
+  version INTEGER NOT NULL CHECK(version >= 1),
+  kind TEXT NOT NULL,
+  mode TEXT CHECK(mode IS NULL OR mode IN ('text','llm')),
+  name TEXT NOT NULL,
+  body TEXT NOT NULL,
+  author TEXT NOT NULL,
+  restored_from INTEGER,
+  created_at TEXT NOT NULL,
+  PRIMARY KEY(item_kind,item_id,version)
+);
+-- What is saved today becomes version 1 of each.
+INSERT INTO library_versions (item_kind,item_id,version,kind,mode,name,body,author,restored_from,created_at)
+  SELECT 'prompt',id,1,kind,NULL,name,body,'you',NULL,updated_at FROM prompts;
+INSERT INTO library_versions (item_kind,item_id,version,kind,mode,name,body,author,restored_from,created_at)
+  SELECT 'entry',id,1,category,mode,name,body,'you',NULL,updated_at FROM entries;
+-- The project page's hand edits to the YouTube description, chapters, hashtags and tags. Each
+-- field keeps the user's text and the generated text it was edited from, so a regenerated
+-- description can tell whether the user changed that field. `links_json` holds this project's
+-- own channel links (such as "Previous video"), which win over the Settings list.
+CREATE TABLE youtube_description_edits (
+  project_id TEXT PRIMARY KEY REFERENCES projects(id) ON DELETE CASCADE,
+  fields_json TEXT NOT NULL CHECK(json_valid(fields_json)),
+  links_json TEXT NOT NULL CHECK(json_valid(links_json)),
+  updated_at TEXT NOT NULL
+);

package/dist/kernel/db/migrations/0032-channels.sql

@@ -0,0 +1,65 @@
+-- Channels: the brand kit, the cast library and the series brief that templates, schedules
+-- and projects belong to. Every install gets one default channel, "My channel", with a fixed
+-- id so a backup made on one install names the same default on another, and everything that
+-- exists moves into it. Nothing about a project's config changes, so no fingerprint does.
+--
+-- A template's channel is a plain column and a project's is a row of project_channels, neither
+-- with a foreign key to channels: a backup can bring in a row naming a channel this install
+-- never had, and such a row (like none at all) reads as the default channel. The projects
+-- table itself is left as it is. A schedule's channel is its template's.
+CREATE TABLE channels (
+  id TEXT PRIMARY KEY,
+  name TEXT NOT NULL CHECK(length(trim(name)) BETWEEN 1 AND 200),
+  is_default INTEGER NOT NULL DEFAULT 0 CHECK(is_default IN (0,1)),
+  brand_json TEXT NOT NULL DEFAULT '{}' CHECK(json_valid(brand_json)),
+  series_brief TEXT NOT NULL DEFAULT '',
+  version INTEGER NOT NULL DEFAULT 1 CHECK(version >= 1),
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+CREATE UNIQUE INDEX channels_one_default ON channels(is_default) WHERE is_default = 1;
+INSERT INTO channels (id, name, is_default, created_at, updated_at) VALUES (
+  '00000000-0000-4000-8000-000000000001', 'My channel', 1,
+  strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+);
+-- The characters, creatures, places and objects a channel keeps drawing the same way.
+CREATE TABLE cast_members (
+  id TEXT PRIMARY KEY,
+  channel_id TEXT NOT NULL REFERENCES channels(id) ON DELETE CASCADE,
+  kind TEXT NOT NULL CHECK(kind IN ('character','creature','place','object')),
+  name TEXT NOT NULL CHECK(length(trim(name)) BETWEEN 1 AND 200),
+  aliases_json TEXT NOT NULL DEFAULT '[]' CHECK(json_valid(aliases_json)),
+  description TEXT NOT NULL DEFAULT '',
+  version INTEGER NOT NULL DEFAULT 1 CHECK(version >= 1),
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+CREATE INDEX cast_members_channel ON cast_members(channel_id);
+-- Picture bytes by content hash: cast reference images and the brand kit's end screen image.
+-- A project names the hashes it was started with, so a row is never removed while it may be
+-- named; the bytes are in the database so every database backup carries them.
+CREATE TABLE image_blobs (
+  sha256 TEXT PRIMARY KEY,
+  mime TEXT NOT NULL CHECK(mime IN ('image/png','image/jpeg')),
+  bytes BLOB NOT NULL,
+  created_at TEXT NOT NULL
+);
+CREATE TABLE cast_images (
+  id TEXT PRIMARY KEY,
+  member_id TEXT NOT NULL REFERENCES cast_members(id) ON DELETE CASCADE,
+  source TEXT NOT NULL CHECK(source IN ('upload','generate')),
+  prompt TEXT,
+  state TEXT NOT NULL CHECK(state IN ('ready','generating','failed')),
+  error TEXT,
+  sha256 TEXT REFERENCES image_blobs(sha256),
+  created_at TEXT NOT NULL
+);
+CREATE INDEX cast_images_member ON cast_images(member_id);
+ALTER TABLE project_templates ADD COLUMN channel_id TEXT;
+CREATE TABLE project_channels (
+  project_id TEXT PRIMARY KEY REFERENCES projects(id) ON DELETE CASCADE,
+  channel_id TEXT NOT NULL
+);
+UPDATE project_templates SET channel_id = '00000000-0000-4000-8000-000000000001';
+INSERT INTO project_channels (project_id, channel_id)
+  SELECT id, '00000000-0000-4000-8000-000000000001' FROM projects;

package/dist/kernel/db/migrations/0034-script-prompts.sql

@@ -0,0 +1,23 @@
+-- Multiple voices.
+--
+-- Library prompts of the new "script" kind: what a multi-voice run (audiobook, podcast, radio
+-- drama, interview) asks the text model for in place of an article - speaker turns. SQLite
+-- cannot change a CHECK in place, so the table is copied into one whose CHECK lists the new
+-- kind, like 0025 did for "review".
+CREATE TABLE prompts_script_upgrade (
+  id TEXT PRIMARY KEY,
+  kind TEXT NOT NULL CHECK (kind IN ('article','image','thumbnail','narration','description','shorts','review','script')),
+  name TEXT NOT NULL,
+  body TEXT NOT NULL,
+  slots TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+INSERT INTO prompts_script_upgrade (id,kind,name,body,slots,updated_at)
+  SELECT id,kind,name,body,slots,updated_at FROM prompts;
+DROP TABLE prompts;
+ALTER TABLE prompts_script_upgrade RENAME TO prompts;
+CREATE UNIQUE INDEX prompts_name ON prompts(kind,lower(name));
+-- A cast member's voice: provider, model, voice, pace and pronunciations, so a character or a
+-- channel's host sounds the same in every episode. NULL is no voice, which every member saved
+-- before this has.
+ALTER TABLE cast_members ADD COLUMN voice_json TEXT CHECK (voice_json IS NULL OR json_valid(voice_json));

package/dist/kernel/db/migrations/0035-narration-aliases.sql

@@ -0,0 +1,13 @@
+-- Library → Aliases: words the narrator says differently from how they are written ("Dr." as
+-- "Doctor"). A project keeps its own copy of the list it started with, so nothing references
+-- these rows and editing them never changes a project behind its back. `position` is the
+-- order the editor shows them in.
+CREATE TABLE narration_aliases (
+  id TEXT PRIMARY KEY,
+  position INTEGER NOT NULL,
+  written TEXT NOT NULL CHECK (length(trim(written)) > 0),
+  spoken TEXT NOT NULL CHECK (length(trim(spoken)) > 0),
+  whole_word INTEGER NOT NULL CHECK (whole_word IN (0, 1)),
+  case_sensitive INTEGER NOT NULL CHECK (case_sensitive IN (0, 1)),
+  updated_at TEXT NOT NULL
+);

package/dist/kernel/db/migrations/0037-project-uploads.sql

@@ -0,0 +1,8 @@
+-- "Mark uploaded" on Home: the person says a finished video is on YouTube, so it leaves Ready
+-- to upload. A row of its own rather than a projects column, like project_channels: nothing
+-- about the project's config changes, so no fingerprint does, and deleting the project takes
+-- the row with it.
+CREATE TABLE project_uploads (
+  project_id TEXT PRIMARY KEY REFERENCES projects(id) ON DELETE CASCADE,
+  uploaded_at TEXT NOT NULL
+);

package/dist/kernel/db/migrations/0038-voice-languages.sql

@@ -0,0 +1,7 @@
+-- Other languages.
+--
+-- The languages a saved voice speaks, as a JSON array of primary language codes (["es"]):
+-- looked up from the provider when the voice is added, or typed in Settings → Voices. Play
+-- lists a project's voices by it. NULL is unknown, which every voice saved before this is,
+-- and an unknown voice is offered for every language.
+ALTER TABLE voices ADD COLUMN languages_json TEXT CHECK (languages_json IS NULL OR json_valid(languages_json));

package/dist/kernel/db/migrations/0039-channel-essentials.sql

@@ -0,0 +1,64 @@
+-- Channel essentials.
+--
+-- Trash: deleting a project, a Library prompt or intro/outro, or a template now only stamps
+-- `deleted_at`; Settings → Trash lists the stamped rows for 30 days, and a daily purge removes
+-- them for good. Every list and lookup skips stamped rows. The name indexes only count rows
+-- that are not in the trash, so a name can be reused while the old one waits there. A later
+-- migration that rebuilds one of these tables must carry `deleted_at` over.
+--
+-- A project's stamp lives in its own table rather than a column: the projects table is read
+-- and written positionally in many places, and a project has no name index to relax.
+CREATE TABLE project_trash (
+  project_id TEXT PRIMARY KEY REFERENCES projects(id) ON DELETE CASCADE,
+  deleted_at TEXT NOT NULL
+);
+ALTER TABLE prompts ADD COLUMN deleted_at TEXT;
+ALTER TABLE entries ADD COLUMN deleted_at TEXT;
+ALTER TABLE project_templates ADD COLUMN deleted_at TEXT;
+DROP INDEX prompts_name;
+CREATE UNIQUE INDEX prompts_name ON prompts(kind,lower(name)) WHERE deleted_at IS NULL;
+DROP INDEX entries_name;
+CREATE UNIQUE INDEX entries_name ON entries(category,lower(name)) WHERE deleted_at IS NULL;
+-- A schedule already kept a `deleted_at` (0010: its history outlives it). `purged_at` marks one
+-- that has left the trash; every schedule deleted before the trash existed counts as left.
+ALTER TABLE schedules ADD COLUMN purged_at TEXT;
+UPDATE schedules SET purged_at = deleted_at WHERE deleted_at IS NOT NULL;
+
+-- Episode memory: a short summary each finished project leaves on its channel, read back into
+-- the article and script prompts of later related episodes while the channel's setting is on.
+-- No foreign key to projects: the memory outlives the project it came from.
+CREATE TABLE episode_memories (
+  id TEXT PRIMARY KEY,
+  channel_id TEXT NOT NULL REFERENCES channels(id) ON DELETE CASCADE,
+  project_id TEXT NOT NULL,
+  title TEXT NOT NULL,
+  summary TEXT NOT NULL CHECK(length(trim(summary)) > 0),
+  cast_json TEXT NOT NULL DEFAULT '[]' CHECK(json_valid(cast_json)),
+  source TEXT NOT NULL CHECK(source IN ('generated','edited')),
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+CREATE UNIQUE INDEX episode_memories_project ON episode_memories(project_id);
+CREATE INDEX episode_memories_channel ON episode_memories(channel_id, created_at);
+-- Off for every channel that exists; a channel made from now on starts with it on. A fresh
+-- install (no project yet) counts its default channel as new.
+ALTER TABLE channels ADD COLUMN episode_memory INTEGER NOT NULL DEFAULT 0 CHECK(episode_memory IN (0,1));
+UPDATE channels SET episode_memory = 1 WHERE NOT EXISTS (SELECT 1 FROM projects);
+-- YouTube's "Altered or synthetic content" answer Studio prep gives: 'auto' follows the rule in
+-- slices/studio/disclosure.ts, 'yes' and 'no' override it for the channel.
+ALTER TABLE channels ADD COLUMN ai_disclosure TEXT NOT NULL DEFAULT 'auto' CHECK(ai_disclosure IN ('auto','yes','no'));
+
+-- The channel's videos made before (or outside) Slopify: titles pasted or imported from a
+-- YouTube Studio CSV, so topic suggestions and duplicate checks skip them too.
+CREATE TABLE channel_videos (
+  id TEXT PRIMARY KEY,
+  channel_id TEXT NOT NULL REFERENCES channels(id) ON DELETE CASCADE,
+  title TEXT NOT NULL CHECK(length(trim(title)) BETWEEN 1 AND 500),
+  created_at TEXT NOT NULL
+);
+CREATE UNIQUE INDEX channel_videos_title ON channel_videos(channel_id, lower(title));
+
+-- Episode memory (appended): what a generated summary was made from, a SHA-256 of the prompt
+-- version, title and article text, so finishing the same article again asks no LLM. A summary
+-- the user edited is never replaced by a later finish.
+ALTER TABLE episode_memories ADD COLUMN recipe TEXT;

package/dist/kernel/db/migrations/0040-standalone-usage.sql

@@ -0,0 +1,35 @@
+-- What every successful provider call made outside a project used and cost: a schedule's
+-- topic generation, a channel's episode summary and its cast pictures. provider_usage cannot
+-- hold them, since each of its rows belongs to a project. Priced the same way when the call
+-- lands. There is no link to the schedule or channel: deleting one keeps what it cost this
+-- week. `channel_id` is the channel the call was made for, resolved when it landed, for Home's
+-- channel filter. A CLI's plan windows reported around the call ride along (`account`,
+-- `reading_json`), so Home's plan standings read them beside a project's.
+CREATE TABLE standalone_usage (
+ id TEXT PRIMARY KEY,
+ owner_kind TEXT NOT NULL CHECK(owner_kind IN ('schedule','channel')),
+ owner_id TEXT NOT NULL,
+ channel_id TEXT NOT NULL,
+ purpose TEXT NOT NULL,
+ kind TEXT NOT NULL CHECK(kind IN ('llm','tts','image','video')),
+ provider TEXT NOT NULL,
+ model TEXT NOT NULL,
+ tokens_in INTEGER,
+ tokens_out INTEGER,
+ tokens_cached INTEGER,
+ characters INTEGER,
+ images INTEGER,
+ seconds REAL,
+ size TEXT,
+ quality TEXT,
+ wall_ms INTEGER NOT NULL,
+ on_plan INTEGER NOT NULL DEFAULT 0 CHECK(on_plan IN (0,1)),
+ cost REAL,
+ api_model TEXT,
+ api_cost REAL,
+ price_json TEXT CHECK(price_json IS NULL OR json_valid(price_json)),
+ account TEXT,
+ reading_json TEXT CHECK(reading_json IS NULL OR json_valid(reading_json)),
+ created_at TEXT NOT NULL
+);
+CREATE INDEX standalone_usage_created ON standalone_usage(created_at);

package/dist/kernel/paths.js

@@ -1,18 +1,38 @@
 import { chmodSync, mkdirSync } from "node:fs";
 import { join, resolve } from "node:path";
-export function layout(dataDir) {
+export function layout(dataDir, files) {
     const root = resolve(dataDir);
+    const projects = join(root, "projects");
     return {
         dataDir: root,
         db: join(root, "slopify.db"),
-        projects: join(root, "projects"),
+        projects: files?.projects ?? projects,
+        backups: files?.backups ?? join(projects, "Backups"),
+        exports: files === undefined ? null : files.exports,
         staging: join(root, "staging"),
         logs: join(root, "logs"),
         lock: join(root, ".lock"),
     };
 }
+// Points a running install's Paths at moved files. The one object every slice was handed is
+// changed in place, so the next file each one reads or writes is in the new place.
+export function repoint(paths, files) {
+    Object.assign(paths, {
+        projects: files.projects,
+        backups: files.backups,
+        exports: files.exports,
+    });
+}
 export function ensureDirs(paths, options) {
-    for (const dir of [paths.dataDir, paths.projects, paths.staging, paths.logs]) {
+    ensureDataDirs(paths, options);
+    ensureOwnerOnly([paths.projects], options);
+}
+// The data dir's own folders, before it is known where the user-visible files go.
+export function ensureDataDirs(paths, options) {
+    ensureOwnerOnly([paths.dataDir, paths.staging, paths.logs], options);
+}
+function ensureOwnerOnly(dirs, options) {
+    for (const dir of dirs) {
         mkdirSync(dir, { recursive: true, mode: options.mode });
         // mkdir's mode is masked by the umask and ignored for a directory that already
         // exists; provider keys sit in this tree, so the mode has to be forced.
@@ -20,7 +40,8 @@ export function ensureDirs(paths, options) {
     }
 }
 // The subtitle-timing model's cache. The app readies it at start and every captioned render
-// reads it, so both name it through here.
-export function subtitleModelDir(dataDir) {
-    return join(dataDir, "models", "english-subtitles");
+// reads it, so both name it through here. Other languages use the multilingual model, kept
+// in a folder of its own and downloaded on first use, never at start.
+export function subtitleModelDir(dataDir, language = "en") {
+    return join(dataDir, "models", language === "en" ? "english-subtitles" : "multilingual-subtitles");
 }